urlscan.io logo urlscan.io
SecurityTrails logo

139.59.197.128 Open in urlscan Pro
139.59.197.128  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://protect-za.mimecast.com/s/s17-CGZKz1IwZ18LUOvVHP
Effective URL: http://139.59.197.128/?rid=eAwbwyH
Submission: On November 08 via manual from AU — Scanned from AU
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 4 countries across 4 domains to perform 4 HTTP transactions. The main IP is 139.59.197.128, located in London, United Kingdom and belongs to DIGITALOCEAN-ASN, US. The main domain is 139.59.197.128.
This is the only time 139.59.197.128 was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 2 41.74.196.103 37235 (MimecastSA)
1 139.59.197.128 14061 (DIGITALOC...)
1 104.18.11.207 13335 (CLOUDFLAR...)
1 41.149.73.18 5713 (SAIX-NET)
1 34.96.122.219 396982 (GOOGLE-CL...)
4 5
2    41.74.196.103 (South Africa)

ASN37235 (MimecastSA, ZA)
protect-za.mimecast.com
1    139.59.197.128 (London, United Kingdom)

ASN14061 (DIGITALOCEAN-ASN, US)
139.59.197.128
1    104.18.11.207 (Shahr, Iran, Islamic Republic Of)

ASN13335 (CLOUDFLARENET, US)
maxcdn.bootstrapcdn.com
1    41.149.73.18 (Pretoria, South Africa)

ASN5713 (SAIX-NET, ZA)
www.goldfields.com
1    34.96.122.219 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 219.122.96.34.bc.googleusercontent.com
mcusercontent.com
Apex Domain
Subdomains		 Transfer
2 mimecast.com
protect-za.mimecast.com — Cisco Umbrella Rank: 312590
2 KB
1 mcusercontent.com
mcusercontent.com — Cisco Umbrella Rank: 7895
23 KB
1 goldfields.com
www.goldfields.com
21 KB
1 bootstrapcdn.com
maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 1165
20 KB
4 4
Domain Requested by
2 protect-za.mimecast.com 2 redirects
1 mcusercontent.com 139.59.197.128
1 www.goldfields.com 139.59.197.128
1 maxcdn.bootstrapcdn.com 139.59.197.128
4 4

This site contains no links.

Subject Issuer Validity Valid
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2022-01-29 -
2023-01-29		 a year crt.sh
www.goldfields.com
GlobeSSL DV CA		 2022-09-27 -
2023-09-27		 a year crt.sh
mcusercontent.com
GTS CA 1D4		 2022-10-14 -
2023-01-12		 3 months crt.sh

This page contains 1 frames:

Primary Page: http://139.59.197.128/?rid=eAwbwyH
Frame ID: 534045FF00CAA19D8E563F347CB51F36
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Snode CAS Phishing

Page URL History Show full URLs

  1. https://protect-za.mimecast.com/s/s17-CGZKz1IwZ18LUOvVHP HTTP 307
    https://protect-za.mimecast.com/r/CKgUGBovOnVJsRMQtFSdWqKJXD0lgUcu09euT1U__YBm5z-Sp51YCyfAZz9oDLUWgBFJJiS-5k... HTTP 307
    http://139.59.197.128/?rid=eAwbwyH Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css

Page Statistics

4
Requests

75 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

5
IPs

4
Countries

199 kB
Transfer

483 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://protect-za.mimecast.com/s/s17-CGZKz1IwZ18LUOvVHP HTTP 307
    https://protect-za.mimecast.com/r/CKgUGBovOnVJsRMQtFSdWqKJXD0lgUcu09euT1U__YBm5z-Sp51YCyfAZz9oDLUWgBFJJiS-5keCQqV9pUH354SdczlgFpfc1iyTpz9Uh8jRA5bWUpgGCjm6QNWGs3S1Z1ZgnwinmmDZYfu1wLnBzAclQaUdIltZgviYy26iHLqplyTNMQs5ay7ID1nPb-MbegoRrUcMZW2lxEl8ul9KNdFt8Xtdco5g4VcVF3Bsr9aIBZQgW38eIsIIMTK6WRh1-y_hLHSexKLcz9m-KYpdIKFrzPMNkcFhFxT-9lD0cV7G47R0BpADeLJ-02rQ0z1L09Vmgaoon9BYOrvfrfmxwqDlKRbEl8_GbEzOS9fICwkZCZoW2wwrFLr4Jp_6QdwRLDceS9gY5N6t80CWAUQtBMOIKPVeUDhQ-NNPLZg2GTVzfDf28Am0J3WhAdMfitzv41KlC4XPW_BMmR8IPKXo5HdN0jHv3dMSMjNsuojs5h2K3ILjTKqerDx0xoAP0qm5eFHk6zo0cLMsMsNR20VYXJNHZxiL2Za1AVfArVcdtW5OyQfeWmh4pJtm_gutaBiNfxT3R2lxouJouZhyZc9n-D98u6_Q5kshH647E7yujjyCtjjOYpEamjmqxKd0YaYu0iIy8lbHejjo1uyHH7jz_AR7DSGzOgDIXPjJn6nsdcMicSmpgCWBvuvLnKY9j1eBNb86CUKo67JkhL74SnoLGmMSwShekjOdGerMCLdYBqEnAlpFgqSQveZbcBlsVYMQfeM9cuL6DekkkEdUlHV8uHXdNnQeubJccJyCiGSa0u6PP7iDcfLCOjsr4XGXHBcnvxb8KK4A8xIlUGXBnv0Sq2BOJd153ENDP8ME1NDSStQoI8dd9odcKNM2NIU9BoQ1LxXDdU6jCW0DhR-8PDkpkqkydvaKh-QFsw1TB-nc0ekVLObSVSh7zQu5ELfE7NvcBshX7MYNCUd0mPwcGslE6gMStpPzUZirrQN_ASpq2orrpgMXOpKsrODFFQkg87aSAJDStOlei3pEzL9w88misJP_nkao7WVhAApXaAwqhEkbZ8THcn5EINmFTjEIAGUy4er2iS3dCdPgSF3pYbl8_i97MdfJ7l-HAhU6kQTvLgBt849Cw8C9IgiH7l6qHpn1RLv5Gt9Hut_dGf_v5Ay5bx__H3G5GkIksyhCsI8WY6SEVxhNNFZpp6jxolnljDshd3_9zml9NkwwDJYid4RHRg3Hxdonz1eY3Azsiv_xrYv8buZ9uhmYY8ogG8PZPO21Me75Id-kjM9ZDqku9vLnceCY_unCmWm5m6598wuaRwuUYuLQAV1LVC9j40_85jq9KWSQjBzKNkwJaz_X8Cs-XJ9fOUmmaHIv7KoEGMDDkFEtAioZP39u4-OUhmu9aQ-mZ2Ss7xxh8Sy30H_6es_YoSQSoJesPZvOmaiY26pMar7-Y1iozfHOs-ZVOGaDEOHSC0I1U-yAUSmlbb6UghncxuAAs2U_SVyDrsgizLxQNd6sedTdsMX_UZfofPa0VYg-GsaUMb_4Axp1RTG81N0jXk8QyLdM96-CVBvnNlAh1BisGm1fM7asoBPHDtH8w5dB HTTP 307
    http://139.59.197.128/?rid=eAwbwyH Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
139.59.197.128/
Redirect Chain
  • https://protect-za.mimecast.com/s/s17-CGZKz1IwZ18LUOvVHP
  • https://protect-za.mimecast.com/r/CKgUGBovOnVJsRMQtFSdWqKJXD0lgUcu09euT1U__YBm5z-Sp51YCyfAZz9oDLUWgBFJJiS-5keCQqV9pUH354SdczlgFpfc1iyTpz9Uh8jRA5bWUpgGCjm6QNWGs3S1Z1ZgnwinmmDZYfu1wLnBzAclQaUdIltZgvi...
  • http://139.59.197.128/?rid=eAwbwyH
185 KB
135 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://139.59.197.128/?rid=eAwbwyH
Protocol
HTTP/1.1
Server
139.59.197.128 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
/
Resource Hash
312e6c4a64c181b5dcdca3173edc97ade97f5bd16b28dbba6b71d800f8ec505c

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language
en-AU,en;q=0.9

Response headers

Content-Encoding
gzip
Content-Type
text/html; charset=utf-8
Date
Tue, 08 Nov 2022 13:48:52 GMT
Transfer-Encoding
chunked
Vary
Accept-Encoding
X-Server
gophish

Redirect headers

Cache-control
no-store
Connection
keep-alive
Content-Length
0
Date
Tue, 08 Nov 2022 13:48:51 GMT
Location
http://139.59.197.128?rid=eAwbwyH
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
X-Robots-Tag
noindex, nofollow
bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/ 		118 KB
20 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css
Requested by
Host: 139.59.197.128
URL: http://139.59.197.128/?rid=eAwbwyH
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.11.207 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
en-AU,en;q=0.9
Referer
http://139.59.197.128/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Tue, 08 Nov 2022 13:48:52 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
cdn-edgestorageid
603
age
18108603
cdn-cachedat
09/27/2021 14:18:54
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Mon, 25 Jan 2021 22:03:59 GMT
cdn-proxyver
1.0
cdn-requestpullcode
200
server
cloudflare
vary
Accept-Encoding
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cache-control
public, max-age=31919000
cdn-requestid
0f1310bf9ea8d4961a2ada07a2669960
timing-allow-origin
*
cdn-requestcountrycode
US
cdn-status
200
cf-ray
766ec4cc9c50a97d-SYD
cdn-requestpullsuccess
True
gold-fields-logo.svg
www.goldfields.com/images/ 		21 KB
21 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.goldfields.com/images/gold-fields-logo.svg
Requested by
Host: 139.59.197.128
URL: http://139.59.197.128/?rid=eAwbwyH
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_CBC
Server
41.149.73.18 Pretoria, South Africa, ASN5713 (SAIX-NET, ZA),
Reverse DNS
Software
nginx /
Resource Hash
99756840c10e36d543fcc8a66eec3e99240c20598978d6cdefb37f8a61c8ec30
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains;

Request headers

accept-language
en-AU,en;q=0.9
Referer
http://139.59.197.128/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

Date
Tue, 08 Nov 2022 13:48:29 GMT
Strict-Transport-Security
max-age=63072000; includeSubdomains;
Last-Modified
Fri, 05 Jun 2020 14:01:16 GMT
Server
nginx
ETag
"538b-5a756b1d36300"
Content-Type
image/svg+xml
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
21387
2d3dc591-3def-db9e-adca-806f8a37fdff.png
mcusercontent.com/89cd665cf6420f23c45237439/images/ 		22 KB
23 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://mcusercontent.com/89cd665cf6420f23c45237439/images/2d3dc591-3def-db9e-adca-806f8a37fdff.png
Requested by
Host: 139.59.197.128
URL: http://139.59.197.128/?rid=eAwbwyH
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.96.122.219 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
219.122.96.34.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
b78f5a23e395fc7f816dab1c78134f2804c654b79f3d4e01c6b65652a53d382b

Request headers

accept-language
en-AU,en;q=0.9
Referer
http://139.59.197.128/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Tue, 08 Nov 2022 13:48:52 GMT
x-guploader-uploadid
ADPycdsu8mqQq3UVjYcn7lApmoCO0A6hj12mbMB2VLuMRCcGpHMgdihsLDhU9iJnp1FLIvp6fnT0-u8FAZZ5Zg_mULVQJWp1A844
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
22982
last-modified
Fri, 22 Jul 2022 11:26:39 GMT
server
UploadServer
etag
"c3250c63346e9ec76b401536419b8eb2"
x-goog-generation
1658489199718320
content-type
image/png
x-goog-hash
crc32c=yG51Kw==, md5=wyUMYzRunsdrQBU2QZuOsg==
cache-control
public, max-age=3600
x-goog-stored-content-length
22982
accept-ranges
bytes
expires
Tue, 08 Nov 2022 14:48:52 GMT
truncated
/ 		137 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
33bcea827ab38d4c220cd6719470f6c594296e0948868a121680d809bb119548

Request headers

accept-language
en-AU,en;q=0.9
Referer
http://139.59.197.128/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

Content-Type
image/png

Verdicts & Comments Add Verdict or Comment

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch object| navigation

0 Cookies