12.104.160.72 Open in urlscan Pro
12.104.160.72 Public Scan

Go To Rescan
Add Verdict Report

URL:
http://12.104.160.72/iesxs/cgi-bin/itsrchkpwd.exe%20id=form1%20name=form1
Submission: On June 18 via manual (June 18th 2019, 1:04:13 pm UTC) from IE

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 9 HTTP transactions. The main IP is 12.104.160.72, located in United States and belongs to ATT-INTERNET4 - AT&T Services, Inc., US. The main domain is 12.104.160.72.

This is the only time 12.104.160.72 was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
8	12.104.160.72 12.104.160.72	7018 (ATT-INTER...) (ATT-INTERNET4 - AT&T Services)
1	130.250.162.133 130.250.162.133	394897 (VXCHNGE-TN01) (VXCHNGE-TN01 - vXchnge Operating)
9	2

8 12.104.160.72 (United States)

ASN7018 (ATT-INTERNET4 - AT&T Services, Inc., US)

12.104.160.72	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 130.250.162.133 (United States)

ASN394897 (VXCHNGE-TN01 - vXchnge Operating, LLC, US)

www.xpresssuite.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
1	xpresssuite.com www.xpresssuite.com
9	1

	Domain	Requested by
1	www.xpresssuite.com	12.104.160.72
9	1

This site contains no links.

Subject Issuer	Validity	Valid
	`1970-01-01` - `1970-01-01`	a few seconds	crt.sh

This page contains 5 frames:

Primary Page: http://12.104.160.72/iesxs/cgi-bin/itsrchkpwd.exe%20id=form1%20name=form1
Frame ID: 431D3FD42A264B31D2D1A52AA5D838E2
Requests: 1 HTTP requests in this frame

Frame: http://12.104.160.72/iesxs/html/uleft.htm
Frame ID: 150C8204F7328894F2DDE7801E28BAF0
Requests: 2 HTTP requests in this frame

Frame: http://12.104.160.72/iesxs/html/sidebar.htm
Frame ID: CBFEA93FA622E5DFC3E1280B6F66E5C9
Requests: 1 HTTP requests in this frame

Frame: http://12.104.160.72/iesxs/html/top.htm
Frame ID: CCB46B996A9A457B91B316DDF7095063
Requests: 4 HTTP requests in this frame

Frame: http://12.104.160.72/iesxs/html/invcust.htm
Frame ID: C3CDCC29CA45B232B8EA0A2381016943
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Page Statistics

9
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

23 kB
Transfer

21 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request itsrchkpwd.exe%20id=form1%20name=form1 Show response 12.104.160.72/iesxs/cgi-bin/	708 B 865 B	255ms 139ms	Document text/html	12.104.160.72 AT&T Services
General Check archive.org Show headers Download Go to Full URL http://12.104.160.72/iesxs/cgi-bin/itsrchkpwd.exe%20id=form1%20name=form1 Protocol HTTP/1.1 Server 12.104.160.72 , United States, ASN7018 (ATT-INTERNET4 - AT&T Services, Inc., US), Reverse DNS Software Apache / Resource Hash `d49e7847b281ad9028c092ed0b2f4f15d36e39741e6277ad45ac19e620451984` Request headers Host 12.104.160.72 Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Tue, 18 Jun 2019 12:59:08 GMT Server Apache Content-Length 708 Connection close Content-Type text/html; charset=ISO-8859-1
GET H/1.1	200 OK	uleft.htm Show response 12.104.160.72/iesxs/html/ Frame 150C	155 B 438 B	1230ms 118ms	Document text/html	12.104.160.72 AT&T Services
General Check archive.org Show headers Download Go to Full URL http://12.104.160.72/iesxs/html/uleft.htm Requested by Host: 12.104.160.72 URL: http://12.104.160.72/iesxs/cgi-bin/itsrchkpwd.exe%20id=form1%20name=form1 Protocol HTTP/1.1 Server 12.104.160.72 , United States, ASN7018 (ATT-INTERNET4 - AT&T Services, Inc., US), Reverse DNS Software Apache / Resource Hash `a2ab5fe2ef9ba9d93030404ce396bb13027b19a50e626b4377ec76dad2a9ddd9` Request headers Host 12.104.160.72 Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3 Referer http://12.104.160.72/iesxs/cgi-bin/itsrchkpwd.exe%20id=form1%20name=form1 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer http://12.104.160.72/iesxs/cgi-bin/itsrchkpwd.exe%20id=form1%20name=form1 Response headers Date Tue, 18 Jun 2019 12:59:09 GMT Server Apache Last-Modified Wed, 16 Jul 2003 01:23:31 GMT ETag "f13d6-9b-3c28900de2ac0" Accept-Ranges bytes Content-Length 155 Connection close Content-Type text/html; charset=ISO-8859-1 X-Pad avoid browser bug
GET H/1.1	200 OK	sidebar.htm Show response 12.104.160.72/iesxs/html/ Frame CBFE	894 B 1 KB	1485ms 116ms	Document text/html	12.104.160.72 AT&T Services
General Check archive.org Show headers Download Go to Full URL http://12.104.160.72/iesxs/html/sidebar.htm Requested by Host: 12.104.160.72 URL: http://12.104.160.72/iesxs/cgi-bin/itsrchkpwd.exe%20id=form1%20name=form1 Protocol HTTP/1.1 Server 12.104.160.72 , United States, ASN7018 (ATT-INTERNET4 - AT&T Services, Inc., US), Reverse DNS Software Apache / Resource Hash `fbbe856cad7c484cf751e561d850f1c6364feb0089a7def231de2131a6471c20` Request headers Host 12.104.160.72 Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3 Referer http://12.104.160.72/iesxs/cgi-bin/itsrchkpwd.exe%20id=form1%20name=form1 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer http://12.104.160.72/iesxs/cgi-bin/itsrchkpwd.exe%20id=form1%20name=form1 Response headers Date Tue, 18 Jun 2019 12:59:09 GMT Server Apache Last-Modified Fri, 25 Jul 2003 01:21:10 GMT ETag "f13d2-37e-3c33e05090d80" Accept-Ranges bytes Content-Length 894 Connection close Content-Type text/html; charset=ISO-8859-1 X-Pad avoid browser bug
GET H/1.1	200 OK	top.htm Show response 12.104.160.72/iesxs/html/ Frame CCB4	600 B 884 B	3230ms 116ms	Document text/html	12.104.160.72 AT&T Services
General Check archive.org Show headers Download Go to Full URL http://12.104.160.72/iesxs/html/top.htm Requested by Host: 12.104.160.72 URL: http://12.104.160.72/iesxs/cgi-bin/itsrchkpwd.exe%20id=form1%20name=form1 Protocol HTTP/1.1 Server 12.104.160.72 , United States, ASN7018 (ATT-INTERNET4 - AT&T Services, Inc., US), Reverse DNS Software Apache / Resource Hash `8be6894212b0b670a8262b9237356dbc7744b840dd05f34ad6e0c7a55c9c044b` Request headers Host 12.104.160.72 Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3 Referer http://12.104.160.72/iesxs/cgi-bin/itsrchkpwd.exe%20id=form1%20name=form1 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer http://12.104.160.72/iesxs/cgi-bin/itsrchkpwd.exe%20id=form1%20name=form1 Response headers Date Tue, 18 Jun 2019 12:59:11 GMT Server Apache Last-Modified Wed, 16 Jul 2003 01:23:31 GMT ETag "f13d5-258-3c28900de2ac0" Accept-Ranges bytes Content-Length 600 Connection close Content-Type text/html; charset=ISO-8859-1 X-Pad avoid browser bug
GET H/1.1	200 OK	invcust.htm Show response 12.104.160.72/iesxs/html/ Frame C3CD	516 B 800 B	6473ms 115ms	Document text/html	12.104.160.72 AT&T Services
General Check archive.org Show headers Download Go to Full URL http://12.104.160.72/iesxs/html/invcust.htm Requested by Host: 12.104.160.72 URL: http://12.104.160.72/iesxs/cgi-bin/itsrchkpwd.exe%20id=form1%20name=form1 Protocol HTTP/1.1 Server 12.104.160.72 , United States, ASN7018 (ATT-INTERNET4 - AT&T Services, Inc., US), Reverse DNS Software Apache / Resource Hash `a8237933eb00835d1394c9dea476cecf97afef001d09523ae11ace5fe7adb062` Request headers Host 12.104.160.72 Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3 Referer http://12.104.160.72/iesxs/cgi-bin/itsrchkpwd.exe%20id=form1%20name=form1 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer http://12.104.160.72/iesxs/cgi-bin/itsrchkpwd.exe%20id=form1%20name=form1 Response headers Date Tue, 18 Jun 2019 12:59:15 GMT Server Apache Last-Modified Fri, 25 Jul 2003 01:03:32 GMT ETag "f13ce-204-3c33dc5f94100" Accept-Ranges bytes Content-Length 516 Connection close Content-Type text/html; charset=ISO-8859-1 X-Pad avoid browser bug
GET H/1.1	403 Forbidden	iccload.jpg www.xpresssuite.com/images/ Frame 150C	0 0	3496ms 116ms	Image text/html	130.250.162.133 vXchnge Operating
General Check archive.org Show headers Download Go to Show image Full URL http://www.xpresssuite.com/images/iccload.jpg Requested by Host: 12.104.160.72 URL: http://12.104.160.72/iesxs/html/uleft.htm Protocol HTTP/1.1 Security , , Server 130.250.162.133 , United States, ASN394897 (VXCHNGE-TN01 - vXchnge Operating, LLC, US), Reverse DNS Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Referer http://12.104.160.72/iesxs/html/uleft.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers
GET H/1.1	200 OK	fade.gif 12.104.160.72/iesxs/images/ Frame CCB4	3 KB 3 KB	4007ms 118ms	Image image/gif	12.104.160.72 AT&T Services
General Check archive.org Show headers Download Go to Show image Full URL http://12.104.160.72/iesxs/images/fade.gif Requested by Host: 12.104.160.72 URL: http://12.104.160.72/iesxs/html/top.htm Protocol HTTP/1.1 Security , , Server 12.104.160.72 , United States, ASN7018 (ATT-INTERNET4 - AT&T Services, Inc., US), Reverse DNS Software Apache / Resource Hash `2f6ca6a15ee1b6b036ebf2be2c683283d7a65f91cb4a2444aa54c7829115de18` Request headers Referer http://12.104.160.72/iesxs/html/top.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Tue, 18 Jun 2019 12:59:16 GMT Last-Modified Wed, 16 Jul 2003 01:38:42 GMT Server Apache ETag "f13e5-b08-3c289372aec80" Content-Type image/gif Connection close Accept-Ranges bytes Content-Length 2824
GET H/1.1	200 OK	logo.jpg 12.104.160.72/iesxs/images/ Frame CCB4	13 KB 13 KB	12025ms 124ms	Image image/jpeg	12.104.160.72 AT&T Services
General Check archive.org Show headers Download Go to Show image Full URL http://12.104.160.72/iesxs/images/logo.jpg Requested by Host: 12.104.160.72 URL: http://12.104.160.72/iesxs/html/top.htm Protocol HTTP/1.1 Security , , Server 12.104.160.72 , United States, ASN7018 (ATT-INTERNET4 - AT&T Services, Inc., US), Reverse DNS Software Apache / Resource Hash `ed6c95aacf4e1432ae9609c81a722d69393e92baf1b5bd9d1e5dfe0ff4277b5a` Request headers Referer http://12.104.160.72/iesxs/html/top.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Tue, 18 Jun 2019 12:59:24 GMT Last-Modified Fri, 25 Jul 2003 00:32:14 GMT Server Apache ETag "f13ef-3276-3c33d56093f80" Content-Type image/jpeg Connection close Accept-Ranges bytes Content-Length 12918
GET H/1.1	200 OK	fade2.gif 12.104.160.72/iesxs/images/ Frame CCB4	3 KB 3 KB	15263ms 114ms	Image image/gif	12.104.160.72 AT&T Services
General Check archive.org Show headers Download Go to Show image Full URL http://12.104.160.72/iesxs/images/fade2.gif Requested by Host: 12.104.160.72 URL: http://12.104.160.72/iesxs/html/top.htm Protocol HTTP/1.1 Security , , Server 12.104.160.72 , United States, ASN7018 (ATT-INTERNET4 - AT&T Services, Inc., US), Reverse DNS Software Apache / Resource Hash `7f7b9ddf9a87613efa32feba33ad733d8813f771b5d5e90b2b9e32aaaa0830ab` Request headers Referer http://12.104.160.72/iesxs/html/top.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Tue, 18 Jun 2019 12:59:27 GMT Last-Modified Wed, 16 Jul 2003 01:38:42 GMT Server Apache ETag "f13e6-aee-3c289372aec80" Content-Type image/gif Connection close Accept-Ranges bytes Content-Length 2798

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

www.xpresssuite.com
12.104.160.72
130.250.162.133
2f6ca6a15ee1b6b036ebf2be2c683283d7a65f91cb4a2444aa54c7829115de18
7f7b9ddf9a87613efa32feba33ad733d8813f771b5d5e90b2b9e32aaaa0830ab
8be6894212b0b670a8262b9237356dbc7744b840dd05f34ad6e0c7a55c9c044b
a2ab5fe2ef9ba9d93030404ce396bb13027b19a50e626b4377ec76dad2a9ddd9
a8237933eb00835d1394c9dea476cecf97afef001d09523ae11ace5fe7adb062
d49e7847b281ad9028c092ed0b2f4f15d36e39741e6277ad45ac19e620451984
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ed6c95aacf4e1432ae9609c81a722d69393e92baf1b5bd9d1e5dfe0ff4277b5a
fbbe856cad7c484cf751e561d850f1c6364feb0089a7def231de2131a6471c20

12.104.160.72 Open in urlscan Pro 12.104.160.72 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

9 Requests

0 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

23 kBTransfer

21 kBSize

0 Cookies

0 Outgoing links

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

0 Cookies

Indicators

12.104.160.72 Open in urlscan Pro
12.104.160.72 Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

23 kB
Transfer

21 kB
Size

0
Cookies

9 HTTP transactions
0 data transactions