20200723100402.drisbose.giize.com Open in urlscan Pro
104.144.123.142 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://u17218878.ct.sendgrid.net/ls/click?upn=8xueqAtsffMnHFOC-2F1GdUrAu3s-2BjP2DkfxeJ3u9VX6J8Dm5Uec7538r9JHjgyqYA8XH7cFShz8tlKx-...
Effective URL:
http://20200723100402.drisbose.giize.com/itint/review/?id=strussell@fortinet.com
Submission: On July 23 via manual (July 23rd 2020, 2:04:20 pm UTC) from FR

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 4 countries across 7 domains to perform 12 HTTP transactions. The main IP is 104.144.123.142, located in Los Angeles, United States and belongs to AS-COLOCROSSING, US. The main domain is 20200723100402.drisbose.giize.com.

This is the only time 20200723100402.drisbose.giize.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Email (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	167.89.115.54 167.89.115.54	11377 (SENDGRID) (SENDGRID)
1 1	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 1	162.0.229.105 162.0.229.105	22612 (NAMECHEAP...) (NAMECHEAP-NET)
10	104.144.123.142 104.144.123.142	36352 (AS-COLOCR...) (AS-COLOCROSSING)
1	2001:4de0:ac1... 2001:4de0:ac19::1:b:2a	20446 (HIGHWINDS3) (HIGHWINDS3)
1 1	2606:4700:303... 2606:4700:3031::ac43:9f0f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:817::2004	15169 (GOOGLE) (GOOGLE)
12	3

1 167.89.115.54 (United States) 1 redirects

ASN11377 (SENDGRID, US)

u17218878.ct.sendgrid.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:21::14 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.0.229.105 (Canada) 1 redirects

ASN22612 (NAMECHEAP-NET, US)

ijomg.gemashdirect.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 104.144.123.142 (Los Angeles, United States)

ASN36352 (AS-COLOCROSSING, US)

20200723100402.drisbose.giize.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac19::1:b:2a (Netherlands)

ASN20446 (HIGHWINDS3, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3031::ac43:9f0f (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

api.statvoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:817::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	giize.com 20200723100402.drisbose.giize.com	244 KB
1	google.com www.google.com	6 KB
1	statvoo.com 1 redirects api.statvoo.com	444 B
1	jquery.com code.jquery.com	24 KB
1	gemashdirect.xyz 1 redirects ijomg.gemashdirect.xyz	200 B
1	linkedin.com 1 redirects www.linkedin.com	954 B
1	sendgrid.net 1 redirects u17218878.ct.sendgrid.net	334 B
12	7

	Domain	Requested by
10	20200723100402.drisbose.giize.com	20200723100402.drisbose.giize.com
1	www.google.com	20200723100402.drisbose.giize.com
1	api.statvoo.com	1 redirects
1	code.jquery.com	20200723100402.drisbose.giize.com
1	ijomg.gemashdirect.xyz	1 redirects
1	www.linkedin.com	1 redirects
1	u17218878.ct.sendgrid.net	1 redirects
12	7

This site contains no links.

Subject Issuer	Validity	Valid
jquery.org COMODO RSA Domain Validation Secure Server CA	`2018-10-17` - `2020-10-16`	2 years	crt.sh
www.google.com GTS CA 1O1	`2020-07-07` - `2020-09-29`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://20200723100402.drisbose.giize.com/itint/review/?id=strussell@fortinet.com
Frame ID: 98F013B5B47E8BD092B2F07F39117A18
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://u17218878.ct.sendgrid.net/ls/click?upn=8xueqAtsffMnHFOC-2F1GdUrAu3s-2BjP2DkfxeJ3u9VX6J8Dm5Uec7538r9JHj... HTTP 302
https://www.linkedin.com/redir/redirect?url=ijomg%2Egemashdirect%2Exyz%2F%409009%405600%40%2F&urlhash... HTTP 303
http://ijomg.gemashdirect.xyz/@9009@5600@/ HTTP 302
http://20200723100402.drisbose.giize.com/itint/ Page URL
http://20200723100402.drisbose.giize.com/itint/review/?id=strussell@fortinet.com Page URL

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

12
Requests

17 %
HTTPS

57 %
IPv6

7
Domains

7
Subdomains

3
IPs

4
Countries

273 kB
Transfer

596 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://u17218878.ct.sendgrid.net/ls/click?upn=8xueqAtsffMnHFOC-2F1GdUrAu3s-2BjP2DkfxeJ3u9VX6J8Dm5Uec7538r9JHjgyqYA8XH7cFShz8tlKx-2Fjq3FOzpULvZ7oNSWQTIREqHv4fyu4JQjZOQvBIUMlVzxFnNAidvfczfQ8B9HwXNlOBX6VAFYsLDrixTrZofkQdnjle0A9wxfPOirm3zzBd0mHJIzIUX04_M4lh2QOYIgQ1emEw96z32w8NV-2F4q7B7HaDi7rQd0-2FAlpdPiOKSCdpxLfMOg4-2Fna9dFYOApcykQSG6UScKCGNusSoJ5j5utotjsNT-2BlLiHAwkWEI41sS0Dyntk0cl4V5O-2Fxf9YhqnUgqnI9jffjhhLZMrUHUsdeZFI1rnr98cLC-2BJfEzBOOkGVB88uqnobTquORqr5I4zHXyGx6PfApbAyCbJIWyUHgiUk7DgbLHC-2Fps-3D HTTP 302
https://www.linkedin.com/redir/redirect?url=ijomg%2Egemashdirect%2Exyz%2F%409009%405600%40%2F&urlhash=Nk6R& HTTP 303
http://ijomg.gemashdirect.xyz/@9009@5600@/ HTTP 302
http://20200723100402.drisbose.giize.com/itint/ Page URL
http://20200723100402.drisbose.giize.com/itint/review/?id=strussell@fortinet.com Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://u17218878.ct.sendgrid.net/ls/click?upn=8xueqAtsffMnHFOC-2F1GdUrAu3s-2BjP2DkfxeJ3u9VX6J8Dm5Uec7538r9JHjgyqYA8XH7cFShz8tlKx-2Fjq3FOzpULvZ7oNSWQTIREqHv4fyu4JQjZOQvBIUMlVzxFnNAidvfczfQ8B9HwXNlOBX6VAFYsLDrixTrZofkQdnjle0A9wxfPOirm3zzBd0mHJIzIUX04_M4lh2QOYIgQ1emEw96z32w8NV-2F4q7B7HaDi7rQd0-2FAlpdPiOKSCdpxLfMOg4-2Fna9dFYOApcykQSG6UScKCGNusSoJ5j5utotjsNT-2BlLiHAwkWEI41sS0Dyntk0cl4V5O-2Fxf9YhqnUgqnI9jffjhhLZMrUHUsdeZFI1rnr98cLC-2BJfEzBOOkGVB88uqnobTquORqr5I4zHXyGx6PfApbAyCbJIWyUHgiUk7DgbLHC-2Fps-3D HTTP 302
https://www.linkedin.com/redir/redirect?url=ijomg%2Egemashdirect%2Exyz%2F%409009%405600%40%2F&urlhash=Nk6R& HTTP 303
http://ijomg.gemashdirect.xyz/@9009@5600@/ HTTP 302
http://20200723100402.drisbose.giize.com/itint/

Request Chain 10

https://api.statvoo.com/favicon/?url=fortinet.com HTTP 302
https://www.google.com/s2/favicons?sz=64&domain_url=fortinet.com

12 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

/ Show response
20200723100402.drisbose.giize.com/itint/
Redirect Chain

https://u17218878.ct.sendgrid.net/ls/click?upn=8xueqAtsffMnHFOC-2F1GdUrAu3s-2BjP2DkfxeJ3u9VX6J8Dm5Uec7538r9JHjgyqYA8XH7cFShz8tlKx-2Fjq3FOzpULvZ7oNSWQTIREqHv4fyu4JQjZOQvBIUMlVzxFnNAidvfczfQ8B9HwXNlO...
https://www.linkedin.com/redir/redirect?url=ijomg%2Egemashdirect%2Exyz%2F%409009%405600%40%2F&urlhash=Nk6R&
http://ijomg.gemashdirect.xyz/@9009@5600@/
http://20200723100402.drisbose.giize.com/itint/

3 KB
1 KB

791ms
328ms

Document
text/html

104.144.123.142
AS-COLOCROSSING

General

Check archive.org

Show headers Download Go to

Full URL: http://20200723100402.drisbose.giize.com/itint/
Protocol: HTTP/1.1
Server: 104.144.123.142 Los Angeles, United States, ASN36352 (AS-COLOCROSSING, US),
Reverse DNS
Software: nginx / PHP/7.4.8RC1
Resource Hash: 62108409aaa6e82c185f70c66485636bacb61fda8064d2b78894f6fb845bfbaa

Request headers

Host: 20200723100402.drisbose.giize.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Server: nginx
Date: Thu, 23 Jul 2020 14:04:03 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=60
Vary: Accept-Encoding
X-Powered-By: PHP/7.4.8RC1
Content-Encoding: gzip

Redirect headers

Date: Thu, 23 Jul 2020 14:04:02 GMT
Server: Apache
Location: http://20200723100402.drisbose.giize.com/itint/
Content-Length: 231
Content-Type: text/html; charset=iso-8859-1

GET
H2 200 jquery-3.3.1.slim.min.js Show response
code.jquery.com/ 68 KB
24 KB 31ms
11ms Script
application/javascript 2001:4de0:ac19::1:b:2a
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.3.1.slim.min.js
Requested by: Host: 20200723100402.drisbose.giize.com
URL: http://20200723100402.drisbose.giize.com/itint/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac19::1:b:2a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: dde76b9b2b90d30eb97fc81f06caa8c338c97b688cea7d2729c88f529f32fbb1

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: http://20200723100402.drisbose.giize.com/itint/
Origin: http://20200723100402.drisbose.giize.com

Response headers

date: Thu, 23 Jul 2020 14:04:03 GMT
content-encoding: gzip
last-modified: Sat, 20 Jan 2018 17:26:44 GMT
server: nginx
status: 200
etag: W/"5a637bd4-1111d"
vary: Accept-Encoding
x-hw: 1595513043.dop234.fr8.t,1595513043.cds109.fr8.hn,1595513043.cds225.fr8.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 24038

GET
H/1.1 200
OK Primary Request / Show response
20200723100402.drisbose.giize.com/itint/review/ 5 KB
2 KB 192ms
191ms Document
text/html 104.144.123.142
AS-COLOCROSSING

General

Check archive.org

Show headers Download Go to

Full URL: http://20200723100402.drisbose.giize.com/itint/review/?id=strussell@fortinet.com
Requested by: Host: 20200723100402.drisbose.giize.com
URL: http://20200723100402.drisbose.giize.com/itint/
Protocol: HTTP/1.1
Server: 104.144.123.142 Los Angeles, United States, ASN36352 (AS-COLOCROSSING, US),
Reverse DNS
Software: nginx / PHP/7.4.8RC1
Resource Hash: 8ed6897f2fd52d9597a92cd80feedca95bfc463611b67d6e4f6aa32626928091

Request headers

Host: 20200723100402.drisbose.giize.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://20200723100402.drisbose.giize.com/itint/
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: http://20200723100402.drisbose.giize.com/itint/

Response headers

Server: nginx
Date: Thu, 23 Jul 2020 14:04:09 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=60
Vary: Accept-Encoding
X-Powered-By: PHP/7.4.8RC1
Content-Encoding: gzip

GET
H/1.1 200
OK bootstrap.css
20200723100402.drisbose.giize.com/itint/review/filex/ 138 KB
21 KB 165ms
163ms Stylesheet
text/css 104.144.123.142
AS-COLOCROSSING

General

Check archive.org

Show headers Download Go to

Full URL: http://20200723100402.drisbose.giize.com/itint/review/filex/bootstrap.css
Requested by: Host: 20200723100402.drisbose.giize.com
URL: http://20200723100402.drisbose.giize.com/itint/review/?id=strussell@fortinet.com
Protocol: HTTP/1.1
Server: 104.144.123.142 Los Angeles, United States, ASN36352 (AS-COLOCROSSING, US),
Reverse DNS
Software: nginx /
Resource Hash: 31df1e69ea3aece8a8bae5c08bcb7f5e977cb76f886897b301355359b66a48ec

Request headers

Referer: http://20200723100402.drisbose.giize.com/itint/review/?id=strussell@fortinet.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 23 Jul 2020 14:04:09 GMT
Content-Encoding: gzip
Last-Modified: Tue, 07 Jul 2020 23:04:18 GMT
Server: nginx
ETag: W/"5f04ff72-22682"
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=315360000
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=60
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK jquery.js Show response
20200723100402.drisbose.giize.com/itint/review/filex/ 85 KB
30 KB 347ms
328ms Script
application/javascript 104.144.123.142
AS-COLOCROSSING

General

Check archive.org

Show headers Download Go to

Full URL: http://20200723100402.drisbose.giize.com/itint/review/filex/jquery.js
Requested by: Host: 20200723100402.drisbose.giize.com
URL: http://20200723100402.drisbose.giize.com/itint/review/?id=strussell@fortinet.com
Protocol: HTTP/1.1
Server: 104.144.123.142 Los Angeles, United States, ASN36352 (AS-COLOCROSSING, US),
Reverse DNS
Software: nginx /
Resource Hash: 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

Request headers

Referer: http://20200723100402.drisbose.giize.com/itint/review/?id=strussell@fortinet.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 23 Jul 2020 14:04:09 GMT
Content-Encoding: gzip
Last-Modified: Tue, 07 Jul 2020 23:04:19 GMT
Server: nginx
ETag: W/"5f04ff73-1538f"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=315360000
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=60
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK bootstrap.js Show response
20200723100402.drisbose.giize.com/itint/review/filex/ 69 KB
21 KB 319ms
300ms Script
application/javascript 104.144.123.142
AS-COLOCROSSING

General

Check archive.org

Show headers Download Go to

Full URL: http://20200723100402.drisbose.giize.com/itint/review/filex/bootstrap.js
Requested by: Host: 20200723100402.drisbose.giize.com
URL: http://20200723100402.drisbose.giize.com/itint/review/?id=strussell@fortinet.com
Protocol: HTTP/1.1
Server: 104.144.123.142 Los Angeles, United States, ASN36352 (AS-COLOCROSSING, US),
Reverse DNS
Software: nginx /
Resource Hash: 928f97f310d8f768c5e3d521e3b1ce2cff156f9cc60c5d09fad772f4a2c43f52

Request headers

Referer: http://20200723100402.drisbose.giize.com/itint/review/?id=strussell@fortinet.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 23 Jul 2020 14:04:09 GMT
Content-Encoding: gzip
Last-Modified: Tue, 07 Jul 2020 23:04:18 GMT
Server: nginx
ETag: W/"5f04ff72-1141a"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=315360000
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=60
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK general.css
20200723100402.drisbose.giize.com/itint/review/filex/ 2 KB
1 KB 319ms
301ms Stylesheet
text/css 104.144.123.142
AS-COLOCROSSING

General

Check archive.org

Show headers Download Go to

Full URL: http://20200723100402.drisbose.giize.com/itint/review/filex/general.css
Requested by: Host: 20200723100402.drisbose.giize.com
URL: http://20200723100402.drisbose.giize.com/itint/review/?id=strussell@fortinet.com
Protocol: HTTP/1.1
Server: 104.144.123.142 Los Angeles, United States, ASN36352 (AS-COLOCROSSING, US),
Reverse DNS
Software: nginx /
Resource Hash: dc3bd6047578cebc5589c2458a4a774c5dd0d7636b2fa8653ee0350acf6fa8b2

Request headers

Referer: http://20200723100402.drisbose.giize.com/itint/review/?id=strussell@fortinet.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 23 Jul 2020 14:04:09 GMT
Content-Encoding: gzip
Last-Modified: Tue, 07 Jul 2020 23:04:18 GMT
Server: nginx
ETag: W/"5f04ff72-965"
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=315360000
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=60
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK email.png
20200723100402.drisbose.giize.com/itint/review/filex/ 54 KB
0 158ms
158ms Image
image/png 104.144.123.142
AS-COLOCROSSING

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://20200723100402.drisbose.giize.com/itint/review/filex/email.png
Requested by: Host: 20200723100402.drisbose.giize.com
URL: http://20200723100402.drisbose.giize.com/itint/review/?id=strussell@fortinet.com
Protocol: HTTP/1.1
Server: 104.144.123.142 Los Angeles, United States, ASN36352 (AS-COLOCROSSING, US),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Referer: http://20200723100402.drisbose.giize.com/itint/review/?id=strussell@fortinet.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 23 Jul 2020 14:04:09 GMT
Last-Modified: Tue, 07 Jul 2020 23:04:18 GMT
Server: nginx
ETag: "5f04ff72-eed4"
Content-Type: image/png
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=60
Content-Length: 61140
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK user.png
20200723100402.drisbose.giize.com/itint/review/filex/ 16 KB
16 KB 171ms
171ms Image
image/png 104.144.123.142
AS-COLOCROSSING

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://20200723100402.drisbose.giize.com/itint/review/filex/user.png
Requested by: Host: 20200723100402.drisbose.giize.com
URL: http://20200723100402.drisbose.giize.com/itint/review/?id=strussell@fortinet.com
Protocol: HTTP/1.1
Server: 104.144.123.142 Los Angeles, United States, ASN36352 (AS-COLOCROSSING, US),
Reverse DNS
Software: nginx /
Resource Hash: 57d172f0f57f3d5171f68cdd1f3324cfc7e714bb8d341be80b340dccc6947d3c

Request headers

Referer: http://20200723100402.drisbose.giize.com/itint/review/?id=strussell@fortinet.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 23 Jul 2020 14:04:09 GMT
Last-Modified: Tue, 07 Jul 2020 23:04:19 GMT
Server: nginx
ETag: "5f04ff73-40a8"
Content-Type: image/png
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=60
Content-Length: 16552
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK key.png
20200723100402.drisbose.giize.com/itint/review/filex/ 17 KB
18 KB 162ms
161ms Image
image/png 104.144.123.142
AS-COLOCROSSING

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://20200723100402.drisbose.giize.com/itint/review/filex/key.png
Requested by: Host: 20200723100402.drisbose.giize.com
URL: http://20200723100402.drisbose.giize.com/itint/review/?id=strussell@fortinet.com
Protocol: HTTP/1.1
Server: 104.144.123.142 Los Angeles, United States, ASN36352 (AS-COLOCROSSING, US),
Reverse DNS
Software: nginx /
Resource Hash: 7822251ffeca6a927910e4b3b8621b2edbc694c0e82bc22376a32e9c5311dca5

Request headers

Referer: http://20200723100402.drisbose.giize.com/itint/review/?id=strussell@fortinet.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 23 Jul 2020 14:04:09 GMT
Last-Modified: Tue, 07 Jul 2020 23:04:19 GMT
Server: nginx
ETag: "5f04ff73-4556"
Content-Type: image/png
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=60
Content-Length: 17750
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK secured2.png
20200723100402.drisbose.giize.com/itint/review/filex/ 133 KB
134 KB 160ms
160ms Image
image/png 104.144.123.142
AS-COLOCROSSING

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://20200723100402.drisbose.giize.com/itint/review/filex/secured2.png
Requested by: Host: 20200723100402.drisbose.giize.com
URL: http://20200723100402.drisbose.giize.com/itint/review/?id=strussell@fortinet.com
Protocol: HTTP/1.1
Server: 104.144.123.142 Los Angeles, United States, ASN36352 (AS-COLOCROSSING, US),
Reverse DNS
Software: nginx /
Resource Hash: 95ea768c0e353d9d91eef6ed6fddc65ae09fabb0c41b11ff47e88cb411340083

Request headers

Referer: http://20200723100402.drisbose.giize.com/itint/review/?id=strussell@fortinet.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 23 Jul 2020 14:04:09 GMT
Last-Modified: Tue, 07 Jul 2020 23:04:19 GMT
Server: nginx
ETag: "5f04ff73-215ee"
Content-Type: image/png
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=60
Content-Length: 136686
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2

200

favicons
www.google.com/s2/
Redirect Chain

https://api.statvoo.com/favicon/?url=fortinet.com
https://www.google.com/s2/favicons?sz=64&domain_url=fortinet.com

5 KB
6 KB

33ms
33ms

Image
image/png

2a00:1450:4001:817::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/s2/favicons?sz=64&domain_url=fortinet.com

Requested by

Host: 20200723100402.drisbose.giize.com
URL: http://20200723100402.drisbose.giize.com/itint/review/?id=strussell@fortinet.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d90fb0a3d91db4fee13aea0f428a34b6496d3d2ce7c59811d17c102a668ff2c4

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-I30PqitzynW7DOZ5d2TAoA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/FaviconHttp/cspreport;worker-src 'self', script-src 'nonce-I30PqitzynW7DOZ5d2TAoA' 'self' 'unsafe-eval' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/FaviconHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://20200723100402.drisbose.giize.com/itint/review/?id=strussell@fortinet.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 23 Jul 2020 14:04:10 GMT
x-content-type-options: nosniff
server: ESF
x-frame-options: SAMEORIGIN
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
status: 200
cache-control: private, max-age=86400
content-security-policy: script-src 'report-sample' 'nonce-I30PqitzynW7DOZ5d2TAoA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/FaviconHttp/cspreport;worker-src 'self', script-src 'nonce-I30PqitzynW7DOZ5d2TAoA' 'self' 'unsafe-eval' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/FaviconHttp/cspreport
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
expires: Thu, 23 Jul 2020 14:04:10 GMT

Redirect headers

date: Thu, 23 Jul 2020 14:04:10 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
status: 302
content-type: text/html; charset=UTF-8
location: https://www.google.com/s2/favicons?sz=64&domain_url=fortinet.com
cf-ray: 5b75f2f2dfad176e-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 041d962bc20000176e9ebea200000001

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

20200723100402.drisbose.giize.com
api.statvoo.com
code.jquery.com
ijomg.gemashdirect.xyz
u17218878.ct.sendgrid.net
www.google.com
www.linkedin.com
104.144.123.142
162.0.229.105
167.89.115.54
2001:4de0:ac19::1:b:2a
2606:4700:3031::ac43:9f0f
2620:1ec:21::14
2a00:1450:4001:817::2004
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
31df1e69ea3aece8a8bae5c08bcb7f5e977cb76f886897b301355359b66a48ec
57d172f0f57f3d5171f68cdd1f3324cfc7e714bb8d341be80b340dccc6947d3c
62108409aaa6e82c185f70c66485636bacb61fda8064d2b78894f6fb845bfbaa
7822251ffeca6a927910e4b3b8621b2edbc694c0e82bc22376a32e9c5311dca5
8ed6897f2fd52d9597a92cd80feedca95bfc463611b67d6e4f6aa32626928091
928f97f310d8f768c5e3d521e3b1ce2cff156f9cc60c5d09fad772f4a2c43f52
95ea768c0e353d9d91eef6ed6fddc65ae09fabb0c41b11ff47e88cb411340083
d90fb0a3d91db4fee13aea0f428a34b6496d3d2ce7c59811d17c102a668ff2c4
dc3bd6047578cebc5589c2458a4a774c5dd0d7636b2fa8653ee0350acf6fa8b2
dde76b9b2b90d30eb97fc81f06caa8c338c97b688cea7d2729c88f529f32fbb1

20200723100402.drisbose.giize.com Open in urlscan Pro 104.144.123.142 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

12 Requests

17 %HTTPS

57 %IPv6

7 Domains

7 Subdomains

3 IPs

4 Countries

273 kBTransfer

596 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

11 JavaScript Global Variables

0 Cookies

Indicators

20200723100402.drisbose.giize.com Open in urlscan Pro
104.144.123.142 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

17 %
HTTPS

57 %
IPv6

7
Domains

7
Subdomains

3
IPs

4
Countries

273 kB
Transfer

596 kB
Size

0
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!