Submitted URL: http://citacionadjunta2.from-oh.com/
Effective URL: http://72.167.135.170/conteudo.html
Submission: On September 19 via manual from AR — Scanned from DE

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 6 HTTP transactions. The main IP is 72.167.135.170, located in United States and belongs to AS-26496-GO-DADDY-COM-LLC, US. The main domain is 72.167.135.170.
This is the only time 72.167.135.170 was scanned on urlscan.io!

urlscan.io Verdict: No classification

Downloads These files were downloaded by the website

Size: 4 MB (4487775 bytes, 82% done)
Downloaded from: http://72.167.135.170/ADVERTENCIA7.zip

Domain & IP information

IP Address AS Autonomous System
1 1 94.158.244.44 39798 (MIVOCLOUD)
5 72.167.135.170 26496 (AS-26496-...)
1 208.95.112.1 53334 (TUT-AS)
6 2
Apex Domain
Subdomains
Transfer
1 ip-api.com
ip-api.com — Cisco Umbrella Rank: 3879
479 B
1 from-oh.com
citacionadjunta2.from-oh.com
255 B
6 2
Domain Requested by
1 ip-api.com 72.167.135.170
1 citacionadjunta2.from-oh.com 1 redirects
6 2

This site contains no links.

Subject Issuer Validity Valid

This page contains 1 frames:

Frame: http://72.167.135.170/ADVERTENCIA7.zip
Frame ID: FE9AC4891F0FE247879A0A8F17E617AC
Requests: 6 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. http://citacionadjunta2.from-oh.com/ HTTP 302
    http://72.167.135.170/conteudo.html Page URL

Page Statistics

6
Requests

0 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

3 kB
Transfer

5 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://citacionadjunta2.from-oh.com/ HTTP 302
    http://72.167.135.170/conteudo.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request conteudo.html
72.167.135.170/
Redirect Chain
  • http://citacionadjunta2.from-oh.com/
  • http://72.167.135.170/conteudo.html
5 KB
2 KB
Document
General
Full URL
http://72.167.135.170/conteudo.html
Protocol
HTTP/1.1
Server
72.167.135.170 , United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
170.135.167.72.host.secureserver.net
Software
Apache/2.4.41 (Ubuntu) /
Resource Hash
b114380d96f73071e7db56f8dc3407ca7b290505e5432d88a02af312c6e2c61f

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Accept-Ranges
bytes
Connection
Keep-Alive
Content-Encoding
gzip
Content-Length
1694
Content-Type
text/html
Date
Tue, 19 Sep 2023 13:36:35 GMT
ETag
"1216-605aca79f1b40-gzip"
Keep-Alive
timeout=5, max=100
Last-Modified
Tue, 19 Sep 2023 02:02:45 GMT
Server
Apache/2.4.41 (Ubuntu)
Vary
Accept-Encoding

Redirect headers

Connection
Keep-Alive
Content-Length
108
Content-Type
text/html; charset=UTF-8
Date
Tue, 19 Sep 2023 13:36:34 GMT
Keep-Alive
timeout=5, max=100
Location
http://72.167.135.170/conteudo.html
Server
Apache/2.4.41 (Ubuntu)
/
ip-api.com/json/
302 B
479 B
XHR
General
Full URL
http://ip-api.com/json/
Requested by
Host: 72.167.135.170
URL: http://72.167.135.170/conteudo.html
Protocol
HTTP/1.1
Server
208.95.112.1 , United States, ASN53334 (TUT-AS, US),
Reverse DNS
ip-api.com
Software
/
Resource Hash
cafad2028be6381782314a24359152d8a294558df043ca191218cbe6c91e51e0

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://72.167.135.170/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Tue, 19 Sep 2023 13:36:35 GMT
X-Rl
44
X-Ttl
60
Content-Length
302
Content-Type
application/json; charset=utf-8
log.php
72.167.135.170/
0
202 B
XHR
General
Full URL
http://72.167.135.170/log.php
Requested by
Host: 72.167.135.170
URL: http://72.167.135.170/conteudo.html
Protocol
HTTP/1.1
Server
72.167.135.170 , United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
170.135.167.72.host.secureserver.net
Software
Apache/2.4.41 (Ubuntu) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
http://72.167.135.170/conteudo.html
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

Date
Tue, 19 Sep 2023 13:36:35 GMT
Server
Apache/2.4.41 (Ubuntu)
Connection
Keep-Alive
Keep-Alive
timeout=5, max=99
Content-Length
0
Content-Type
text/html; charset=UTF-8
log.php
72.167.135.170/
0
203 B
XHR
General
Full URL
http://72.167.135.170/log.php
Requested by
Host: 72.167.135.170
URL: http://72.167.135.170/conteudo.html
Protocol
HTTP/1.1
Server
72.167.135.170 , United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
170.135.167.72.host.secureserver.net
Software
Apache/2.4.41 (Ubuntu) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
http://72.167.135.170/conteudo.html
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

Date
Tue, 19 Sep 2023 13:36:35 GMT
Server
Apache/2.4.41 (Ubuntu)
Connection
Keep-Alive
Keep-Alive
timeout=5, max=100
Content-Length
0
Content-Type
text/html; charset=UTF-8
log.php
72.167.135.170/
0
202 B
XHR
General
Full URL
http://72.167.135.170/log.php
Requested by
Host: 72.167.135.170
URL: http://72.167.135.170/conteudo.html
Protocol
HTTP/1.1
Server
72.167.135.170 , United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
170.135.167.72.host.secureserver.net
Software
Apache/2.4.41 (Ubuntu) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
http://72.167.135.170/conteudo.html
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

Date
Tue, 19 Sep 2023 13:36:38 GMT
Server
Apache/2.4.41 (Ubuntu)
Connection
Keep-Alive
Keep-Alive
timeout=5, max=99
Content-Length
0
Content-Type
text/html; charset=UTF-8
ADVERTENCIA7.zip
72.167.135.170/
0
0
Document
General
Full URL
http://72.167.135.170/ADVERTENCIA7.zip
Requested by
Host: 72.167.135.170
URL: http://72.167.135.170/conteudo.html
Protocol
HTTP/1.1
Server
72.167.135.170 , United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
170.135.167.72.host.secureserver.net
Software
Apache/2.4.41 (Ubuntu) /
Resource Hash

Request headers

Referer
http://72.167.135.170/conteudo.html
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Accept-Ranges
bytes
Connection
Keep-Alive
Content-Length
4487775
Content-Type
application/zip
Date
Tue, 19 Sep 2023 13:36:38 GMT
ETag
"447a5f-605a828b72600"
Keep-Alive
timeout=5, max=98
Last-Modified
Mon, 18 Sep 2023 20:40:56 GMT
Server
Apache/2.4.41 (Ubuntu)

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| downloadInProgress function| downloadRandomFile function| logAction

0 Cookies

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

citacionadjunta2.from-oh.com
ip-api.com
208.95.112.1
72.167.135.170
94.158.244.44
b114380d96f73071e7db56f8dc3407ca7b290505e5432d88a02af312c6e2c61f
cafad2028be6381782314a24359152d8a294558df043ca191218cbe6c91e51e0
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855