mail-secure-server-reset.ml Open in urlscan Pro
2606:4700:30::6818:73bf  Public Scan

Submitted URL: https://u12675470.ct.sendgrid.net/wf/click?upn=ky2NjsQxcHTXIFU0AfSVObDl7sv7xB-2F2EXQS32mXqDiKWRmaqiOXjoO6nJKHoXUKMnwNNKq-2FGvHbyUR...
Effective URL: https://mail-secure-server-reset.ml/select-en/selector.htm?g=ahujar@anz.com
Submission: On September 18 via manual from AU

Summary

This website contacted 2 IPs in 1 countries across 3 domains to perform 2 HTTP transactions. The main IP is 2606:4700:30::6818:73bf, located in United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is mail-secure-server-reset.ml.
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on September 17th 2019. Valid for: a year.
This is the only time mail-secure-server-reset.ml was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 167.89.123.16 11377 (SENDGRID)
1 2 169.46.89.149 36351 (SOFTLAYER)
1 2606:4700:30:... 13335 (CLOUDFLAR...)
2 2

This site contains no links.

Subject Issuer Validity Valid
*.mybluemix.net
DigiCert SHA2 Secure Server CA
2017-04-13 -
2020-07-10
3 years crt.sh
sni.cloudflaressl.com
CloudFlare Inc ECC CA-2
2019-09-17 -
2020-09-16
a year crt.sh

This page contains 1 frames:

Primary Page: https://mail-secure-server-reset.ml/select-en/selector.htm?g=ahujar@anz.com
Frame ID: 482A686E88A265A96A391364A4557D96
Requests: 2 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://u12675470.ct.sendgrid.net/wf/click?upn=ky2NjsQxcHTXIFU0AfSVObDl7sv7xB-2F2EXQS32mXqDiKWRmaqiOXjoO6nJKHo... HTTP 302
    https://mail-administrator-secure-server.mybluemix.net/?login=ahujar@anz.com HTTP 302
    https://mail-administrator-secure-server.mybluemix.net/msnxv75a5oo2b8uo6m4ql08v.php?login=ahujar@anz.com&13InboxLightaspxn.17742564... Page URL
  2. https://mail-secure-server-reset.ml/select-en/selector.htm?g=ahujar@anz.com Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Page Statistics

2
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

2
IPs

1
Countries

3 kB
Transfer

10 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://u12675470.ct.sendgrid.net/wf/click?upn=ky2NjsQxcHTXIFU0AfSVObDl7sv7xB-2F2EXQS32mXqDiKWRmaqiOXjoO6nJKHoXUKMnwNNKq-2FGvHbyUROS7tsgjIbwkI8qRhUVTOXXkfewaBVA0d-2Fid0NMLhfgSujA7co_9R0pa5ZTo4KQvW7-2F7W5t7aa1CA-2Bb1STIDNF6vpi6JnKCnnQ65-2BFSdFKrEDA85ueQQgGdcGOqzayXhqb39Gip-2BeUoknEpAO8atq8t5OZwvZI3m-2BvXIIZD4nhvZIsvCPporlEDAufnOPbmQb9kHikySjKnVM7B9O3cAF0AS-2BuNVYgYJ-2Bz5-2FTYZZEGIQr1Sqnd9UfVG66A-2BNHh-2BtOD0YDcxqA-3D-3D HTTP 302
    https://mail-administrator-secure-server.mybluemix.net/?login=ahujar@anz.com HTTP 302
    https://mail-administrator-secure-server.mybluemix.net/msnxv75a5oo2b8uo6m4ql08v.php?login=ahujar@anz.com&13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&login=ahujar@anz.com&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4 Page URL
  2. https://mail-secure-server-reset.ml/select-en/selector.htm?g=ahujar@anz.com Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://u12675470.ct.sendgrid.net/wf/click?upn=ky2NjsQxcHTXIFU0AfSVObDl7sv7xB-2F2EXQS32mXqDiKWRmaqiOXjoO6nJKHoXUKMnwNNKq-2FGvHbyUROS7tsgjIbwkI8qRhUVTOXXkfewaBVA0d-2Fid0NMLhfgSujA7co_9R0pa5ZTo4KQvW7-2F7W5t7aa1CA-2Bb1STIDNF6vpi6JnKCnnQ65-2BFSdFKrEDA85ueQQgGdcGOqzayXhqb39Gip-2BeUoknEpAO8atq8t5OZwvZI3m-2BvXIIZD4nhvZIsvCPporlEDAufnOPbmQb9kHikySjKnVM7B9O3cAF0AS-2BuNVYgYJ-2Bz5-2FTYZZEGIQr1Sqnd9UfVG66A-2BNHh-2BtOD0YDcxqA-3D-3D HTTP 302
  • https://mail-administrator-secure-server.mybluemix.net/?login=ahujar@anz.com HTTP 302
  • https://mail-administrator-secure-server.mybluemix.net/msnxv75a5oo2b8uo6m4ql08v.php?login=ahujar@anz.com&13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&login=ahujar@anz.com&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4

2 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
msnxv75a5oo2b8uo6m4ql08v.php
mail-administrator-secure-server.mybluemix.net/
Redirect Chain
  • https://u12675470.ct.sendgrid.net/wf/click?upn=ky2NjsQxcHTXIFU0AfSVObDl7sv7xB-2F2EXQS32mXqDiKWRmaqiOXjoO6nJKHoXUKMnwNNKq-2FGvHbyUROS7tsgjIbwkI8qRhUVTOXXkfewaBVA0d-2Fid0NMLhfgSujA7co_9R0pa5ZTo4KQvW7...
  • https://mail-administrator-secure-server.mybluemix.net/?login=ahujar@anz.com
  • https://mail-administrator-secure-server.mybluemix.net/msnxv75a5oo2b8uo6m4ql08v.php?login=ahujar@anz.com&13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418...
668 B
947 B
Document
General
Full URL
https://mail-administrator-secure-server.mybluemix.net/msnxv75a5oo2b8uo6m4ql08v.php?login=ahujar@anz.com&13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&login=ahujar@anz.com&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
169.46.89.149 Irving, United States, ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US),
Reverse DNS
95.59.2ea9.ip4.static.sl-reverse.com
Software
Apache /
Resource Hash
7e93d16f68b7915fc85558e0f3ba7156e795e8e2805e2aaff4cc13349ab9173f

Request headers

Host
mail-administrator-secure-server.mybluemix.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
none
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1

Response headers

X-Backside-Transport
OK OK
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
Date
Wed, 18 Sep 2019 03:24:37 GMT
Server
Apache
Vary
Accept-Encoding
X-Global-Transaction-ID
0d28ff5e5d81a37425f70e83

Redirect headers

X-Backside-Transport
OK OK
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
Date
Wed, 18 Sep 2019 03:24:36 GMT
Location
msnxv75a5oo2b8uo6m4ql08v.php?login=ahujar@anz.com&13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&login=ahujar@anz.com&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=1252899642&fid=1&fav=1
Server
Apache
X-Global-Transaction-ID
0d28ff5e5d81a374c9c25fc7
Primary Request selector.htm
mail-secure-server-reset.ml/select-en/
9 KB
2 KB
Document
General
Full URL
https://mail-secure-server-reset.ml/select-en/selector.htm?g=ahujar@anz.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::6818:73bf , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2febf6a1817bb3d3c30140c257fdf9ad7ed246d3a63fa99124852999c31dc4d2

Request headers

:method
GET
:authority
mail-secure-server-reset.ml
:scheme
https
:path
/select-en/selector.htm?g=ahujar@anz.com
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://mail-administrator-secure-server.mybluemix.net/msnxv75a5oo2b8uo6m4ql08v.php?login=ahujar@anz.com&13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&login=ahujar@anz.com&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
navigate
Referer
https://mail-administrator-secure-server.mybluemix.net/msnxv75a5oo2b8uo6m4ql08v.php?login=ahujar@anz.com&13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&login=ahujar@anz.com&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4

Response headers

status
200
date
Wed, 18 Sep 2019 03:24:37 GMT
content-type
text/html
set-cookie
__cfduid=df182a3c3b29544bddc8af3fe2277e3f41568777077; expires=Thu, 17-Sep-20 03:24:37 GMT; path=/; domain=.mail-secure-server-reset.ml; HttpOnly
last-modified
Tue, 03 Sep 2019 07:59:43 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
5180353d6f605940-VIE
content-encoding
br

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| populate

1 Cookies

Domain/Path Name / Value
.mail-secure-server-reset.ml/ Name: __cfduid
Value: df182a3c3b29544bddc8af3fe2277e3f41568777077

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

mail-administrator-secure-server.mybluemix.net
mail-secure-server-reset.ml
u12675470.ct.sendgrid.net
167.89.123.16
169.46.89.149
2606:4700:30::6818:73bf
2febf6a1817bb3d3c30140c257fdf9ad7ed246d3a63fa99124852999c31dc4d2
7e93d16f68b7915fc85558e0f3ba7156e795e8e2805e2aaff4cc13349ab9173f