URL: http://iuripp.tk/mail1.php
Submission: On March 26 via automatic, source openphish — Scanned from DE

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 4 HTTP transactions. The main IP is 203.143.21.140, located in Colombo, Sri Lanka and belongs to LANKA-COM Lanka Communication Services, LK. The main domain is iuripp.tk.
This is the only time iuripp.tk was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 203.143.21.140 5087 (LANKA-COM...)
3 46.18.231.9 197033 (CPRO-AS)
4 2
Apex Domain
Subdomains
Transfer
3 inforoutes.fr
zimbra.inforoutes.fr
42 KB
1 iuripp.tk
iuripp.tk
13 KB
4 2
Domain Requested by
3 zimbra.inforoutes.fr iuripp.tk
zimbra.inforoutes.fr
1 iuripp.tk
4 2

This site contains links to these domains. Also see Links.

Domain
www.zimbra.com
blog.zimbra.com
wiki.zimbra.com
Subject Issuer Validity Valid

This page contains 1 frames:

Primary Page: http://iuripp.tk/mail1.php
Frame ID: 2DF1164760F3DE55F9FA75ADB4F67482
Requests: 4 HTTP requests in this frame

Screenshot

Page Title

Zimbra Web Client Sign In

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

4
Requests

0 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

56 kB
Transfer

94 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request mail1.php
iuripp.tk/
13 KB
13 KB
Document
General
Full URL
http://iuripp.tk/mail1.php
Protocol
HTTP/1.1
Server
203.143.21.140 Colombo, Sri Lanka, ASN5087 (LANKA-COM Lanka Communication Services, LK),
Reverse DNS
Software
Apache /
Resource Hash
4a3eb596e91d4c3af24cccdbb4fec025038f66719c4f5832136d8f440f76ef71
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

Date
Sat, 26 Mar 2022 01:31:52 GMT
Server
Apache
X-Frame-Options
SAMEORIGIN
X-Content-Type-Options
nosniff
Referrer-Policy
same-origin
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
common,login,zhtml,skin.css
zimbra.inforoutes.fr/css/
49 KB
10 KB
Stylesheet
General
Full URL
http://zimbra.inforoutes.fr/css/common,login,zhtml,skin.css?skin=serenity&v=140408125537
Requested by
Host: iuripp.tk
URL: http://iuripp.tk/mail1.php
Protocol
HTTP/1.1
Server
46.18.231.9 Livron-sur-Drome, France, ASN197033 (CPRO-AS, FR),
Reverse DNS
zimbra.inforoutes.fr
Software
/
Resource Hash
fd0816968c97c77662b005de9bb335723e53b195af149e9ba421a9f4978b8411

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Sat, 26 Mar 2022 01:31:52 GMT
Content-Encoding
gzip
Vary
User-Agent, Accept-Encoding, User-Agent
Expires
Sat, 2 Apr 2022 01:31:52 GMT
Cache-Control
public, max-age=604800
Transfer-Encoding
chunked
Content-Type
text/css
LoginBanner_white.png
zimbra.inforoutes.fr/skins/_base/logos/
12 KB
13 KB
Image
General
Full URL
http://zimbra.inforoutes.fr/skins/_base/logos/LoginBanner_white.png?v=140408125537
Requested by
Host: zimbra.inforoutes.fr
URL: http://zimbra.inforoutes.fr/css/common,login,zhtml,skin.css?skin=serenity&v=140408125537
Protocol
HTTP/1.1
Server
46.18.231.9 Livron-sur-Drome, France, ASN197033 (CPRO-AS, FR),
Reverse DNS
zimbra.inforoutes.fr
Software
/
Resource Hash
e9938d831d47476ba1bae2c1116bae70493e98b384cc14c15a5e348a38c01942

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://zimbra.inforoutes.fr/css/common,login,zhtml,skin.css?skin=serenity&v=140408125537
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Sat, 26 Mar 2022 01:31:52 GMT
Cache-Control
public, max-age=604800
Expires
Sat, 2 Apr 2022 01:31:52 GMT
Last-Modified
Tue, 08 Apr 2014 17:38:08 GMT
Accept-Ranges
bytes
Content-Length
12596
Content-Type
image/png
DecorationLogin.png
zimbra.inforoutes.fr/skins/serenity/img/
19 KB
20 KB
Image
General
Full URL
http://zimbra.inforoutes.fr/skins/serenity/img/DecorationLogin.png?v=140408125537
Requested by
Host: zimbra.inforoutes.fr
URL: http://zimbra.inforoutes.fr/css/common,login,zhtml,skin.css?skin=serenity&v=140408125537
Protocol
HTTP/1.1
Server
46.18.231.9 Livron-sur-Drome, France, ASN197033 (CPRO-AS, FR),
Reverse DNS
zimbra.inforoutes.fr
Software
/
Resource Hash
26e1cbd4a6605a397eb628e82503e98c1f36b0b14e554d8d87490696beac14a1

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://zimbra.inforoutes.fr/css/common,login,zhtml,skin.css?skin=serenity&v=140408125537
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Sat, 26 Mar 2022 01:31:52 GMT
Cache-Control
public, max-age=604800
Expires
Sat, 2 Apr 2022 01:31:52 GMT
Last-Modified
Tue, 08 Apr 2014 17:38:08 GMT
Accept-Ranges
bytes
Content-Length
19911
Content-Type
image/png

Verdicts & Comments Add Verdict or Comment

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone object| oncontextlost object| oncontextrestored function| ZmSkin object| link function| clientChange function| showWhatsThis function| forgotPassword function| onLoad function| BaseSkin object| skin

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN