URL: https://185.145.252.17/
Submission Tags: scam/phishing e-mail links
Submission: On June 05 via api from US — Scanned from NL

Summary

This website contacted 1 IPs in 1 countries across 0 domains to perform 4 HTTP transactions. The main IP is 185.145.252.17, located in Holon, Israel and belongs to DREAMVPS, IL. The main domain is 185.145.252.17.
TLS certificate: Issued by cPanel, Inc. Certification Authority on May 23rd 2023. Valid for: 3 months.
This is the only time 185.145.252.17 was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
4 185.145.252.17 213038 (DREAMVPS)
4 1
Apex Domain
Subdomains
Transfer
4 0
Domain Requested by
4 0

This site contains links to these domains. Also see Links.

Domain
www.amazon.com
Subject Issuer Validity Valid
cpanel4.uphosting.info
cPanel, Inc. Certification Authority
2023-05-23 -
2023-08-21
3 months crt.sh

This page contains 2 frames:

Primary Page: https://185.145.252.17/
Frame ID: 4DF21E4CBC0637D7F892D478E04144ED
Requests: 2 HTTP requests in this frame

Frame: https://185.145.252.17/about.htm
Frame ID: 9C67D54DBD1536243AE944C16413912D
Requests: 2 HTTP requests in this frame

Screenshot

Page Title

Acupoint Location Complete Study Tool - Practice App. Ver 2.1

Page Statistics

4
Requests

0 %
HTTPS

0 %
IPv6

0
Domains

0
Subdomains

1
IPs

1
Countries

114 kB
Transfer

115 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
185.145.252.17/
3 KB
1 KB
Document
General
Full URL
https://185.145.252.17/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.145.252.17 Holon, Israel, ASN213038 (DREAMVPS, IL),
Reverse DNS
cpanel4.uphosting.info
Software
nginx /
Resource Hash
0498af0401d996aa2e9e94de77fe482ef1ba9f318ceb42323ae5337aac1168d8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Mon, 05 Jun 2023 10:44:30 GMT
server
nginx
vary
Accept-Encoding
x-content-type-options
nosniff
x-nginx-upstream-cache-status
EXPIRED
x-server-powered-by
Engintron
x-xss-protection
1; mode=block
BG.jpg
185.145.252.17/
76 KB
76 KB
Image
General
Full URL
https://185.145.252.17/BG.jpg
Requested by
Host: 185.145.252.17
URL: https://185.145.252.17/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.145.252.17 Holon, Israel, ASN213038 (DREAMVPS, IL),
Reverse DNS
cpanel4.uphosting.info
Software
nginx /
Resource Hash
16a4e23a5b3da1b4d14d766952d46f43da9dc8b8d89ea2ba3b350c140fb0f087
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://185.145.252.17/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

expires
Fri, 04 Aug 2023 10:44:30 GMT
date
Mon, 05 Jun 2023 10:44:30 GMT
x-server-powered-by
Engintron
x-content-type-options
nosniff
last-modified
Fri, 11 Jul 2014 08:57:56 GMT
server
nginx
content-type
image/jpeg
cache-control
max-age=5184000
accept-ranges
bytes
content-length
77558
x-xss-protection
1; mode=block
x-nginx-upstream-cache-status
MISS
about.htm
185.145.252.17/ Frame 9C67
2 KB
1 KB
Document
General
Full URL
https://185.145.252.17/about.htm
Requested by
Host: 185.145.252.17
URL: https://185.145.252.17/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.145.252.17 Holon, Israel, ASN213038 (DREAMVPS, IL),
Reverse DNS
cpanel4.uphosting.info
Software
nginx /
Resource Hash
c71f30a49a409dfba689e278b8ee66f950c65dc171c4ca13bf944bd599a61cf8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://185.145.252.17/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

content-encoding
gzip
content-type
text/html
date
Mon, 05 Jun 2023 10:44:30 GMT
last-modified
Mon, 29 Sep 2014 16:51:22 GMT
server
nginx
vary
Accept-Encoding
x-content-type-options
nosniff
x-nginx-upstream-cache-status
MISS
x-server-powered-by
Engintron
x-xss-protection
1; mode=block
BooksBullet.jpg
185.145.252.17/ Frame 9C67
35 KB
35 KB
Image
General
Full URL
https://185.145.252.17/BooksBullet.jpg
Requested by
Host: 185.145.252.17
URL: https://185.145.252.17/about.htm
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.145.252.17 Holon, Israel, ASN213038 (DREAMVPS, IL),
Reverse DNS
cpanel4.uphosting.info
Software
nginx /
Resource Hash
702073eddecab911b41f15acd2a3329315631dc457276db0f2010da980aa6845
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://185.145.252.17/about.htm
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

expires
Fri, 04 Aug 2023 10:44:30 GMT
date
Mon, 05 Jun 2023 10:44:30 GMT
x-server-powered-by
Engintron
x-content-type-options
nosniff
last-modified
Mon, 29 Sep 2014 16:50:50 GMT
server
nginx
content-type
image/jpeg
cache-control
max-age=5184000
accept-ranges
bytes
content-length
35778
x-xss-protection
1; mode=block
x-nginx-upstream-cache-status
MISS

Verdicts & Comments Add Verdict or Comment

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 boolean| credentialless object| onbeforetoggle object| onscrollend function| changeFunc

0 Cookies

3 Console Messages

Source Level URL
Text
security warning URL: https://185.145.252.17/(Line 26)
Message:
Mixed Content: The page at 'https://185.145.252.17/' was loaded over HTTPS, but requested an insecure element 'https://185.145.252.17/BG.jpg'. This request was not upgraded to HTTPS because its URL's host is an IP address.
security warning URL: https://185.145.252.17/about.htm
Message:
Mixed Content: The page at 'https://185.145.252.17/about.htm' was loaded over HTTPS, but requested an insecure element 'https://185.145.252.17/BooksBullet.jpg'. This request was not upgraded to HTTPS because its URL's host is an IP address.
security warning URL: https://185.145.252.17/about.htm(Line 12)
Message:
Mixed Content: The page at 'https://185.145.252.17/about.htm' was loaded over HTTPS, but requested an insecure element 'https://185.145.252.17/BooksBullet.jpg'. This request was not upgraded to HTTPS because its URL's host is an IP address.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

185.145.252.17
0498af0401d996aa2e9e94de77fe482ef1ba9f318ceb42323ae5337aac1168d8
16a4e23a5b3da1b4d14d766952d46f43da9dc8b8d89ea2ba3b350c140fb0f087
702073eddecab911b41f15acd2a3329315631dc457276db0f2010da980aa6845
c71f30a49a409dfba689e278b8ee66f950c65dc171c4ca13bf944bd599a61cf8