Submitted URL: https://threatcop.techmahindra.com/?rid=9d46e590d40a261b446ebf80919557d8&first=1
Effective URL: https://threatcop.techmahindra.com/?rid=9d46e590d40a261b446ebf80919557d8
Submission: On December 21 via manual from RO — Scanned from DE

Summary

This website contacted 4 IPs in 3 countries across 3 domains to perform 5 HTTP transactions. The main IP is 203.143.186.170, located in India and belongs to MAHINDRABT-AS-AP Tech Mahindra Ltd. Software Development Organisation India, IN. The main domain is threatcop.techmahindra.com.
TLS certificate: Issued by DigiCert TLS RSA SHA256 2020 CA1 on February 16th 2021. Valid for: a year.
This is the only time threatcop.techmahindra.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Downloads These files were downloaded by the website

MIME: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Size: 1 MB (1255072 bytes, 100% done)
Downloaded from: https://threatcop.techmahindra.com/loadUrl/?rId=9d46e590d40a261b446ebf80919557d8

Domain & IP information

IP Address AS Autonomous System
1 4 203.143.186.170 17825 (MAHINDRAB...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2001:4de0:ac1... 20446 (HIGHWINDS3)
5 4
Apex Domain
Subdomains
Transfer
4 techmahindra.com
threatcop.techmahindra.com
168 KB
1 jquery.com
code.jquery.com
29 KB
1 jsdelivr.net
cdn.jsdelivr.net
25 KB
5 3
Domain Requested by
4 threatcop.techmahindra.com 1 redirects threatcop.techmahindra.com
1 code.jquery.com threatcop.techmahindra.com
1 cdn.jsdelivr.net threatcop.techmahindra.com
5 3

This site contains no links.

Subject Issuer Validity Valid
*.TechMahindra.com
DigiCert TLS RSA SHA256 2020 CA1
2021-02-16 -
2022-03-18
a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2021-07-03 -
2022-07-02
a year crt.sh
*.jquery.com
Sectigo RSA Domain Validation Secure Server CA
2021-07-14 -
2022-08-14
a year crt.sh

This page contains 1 frames:

Frame: https://threatcop.techmahindra.com/loadUrl/?rId=9d46e590d40a261b446ebf80919557d8
Frame ID: 632EC25E631C32034725BDE6E6BF13BB
Requests: 7 HTTP requests in this frame

Screenshot

Page Title

Gov.UK

Page URL History Show full URLs

  1. https://threatcop.techmahindra.com/?rid=9d46e590d40a261b446ebf80919557d8&first=1 HTTP 302
    https://threatcop.techmahindra.com/?rid=9d46e590d40a261b446ebf80919557d8 Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Overall confidence: 100%
Detected patterns
  • <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
  • //cdn\.jsdelivr\.net/

Page Statistics

5
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

4
IPs

3
Countries

222 kB
Transfer

632 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://threatcop.techmahindra.com/?rid=9d46e590d40a261b446ebf80919557d8&first=1 HTTP 302
    https://threatcop.techmahindra.com/?rid=9d46e590d40a261b446ebf80919557d8 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
threatcop.techmahindra.com/
Redirect Chain
  • https://threatcop.techmahindra.com/?rid=9d46e590d40a261b446ebf80919557d8&first=1
  • https://threatcop.techmahindra.com/?rid=9d46e590d40a261b446ebf80919557d8
222 KB
164 KB
Document
General
Full URL
https://threatcop.techmahindra.com/?rid=9d46e590d40a261b446ebf80919557d8
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
203.143.186.170 , India, ASN17825 (MAHINDRABT-AS-AP Tech Mahindra Ltd. Software Development Organisation India, IN),
Reverse DNS
threatcop.techmahindra.com
Software
/
Resource Hash
5fb81b738238b545b7e35268591fc0d4d7d55da3ede649afd0f7851b093dc2cf
Security Headers
Name Value
Strict-Transport-Security max-age=16070400; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

Date
Tue, 21 Dec 2021 14:22:14 GMT
Content-Type
text/html; charset=utf-8
Connection
keep-alive
X-DNS-Prefetch-Control
off
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=16070400; includeSubDomains; preload
X-Download-Options
noopen
X-Content-Type-Options
nosniff
X-XSS-Protection
1; mode=block
Cache-Control
private, no-cache, no-store, must-revalidate
Expires
-1
Pragma
no-cache
ETag
W/"378d7-kzH7AXqdEnLYj6ldRqOvnFQrX7A"
Content-Encoding
gzip
Transfer-Encoding
chunked

Redirect headers

Date
Tue, 21 Dec 2021 14:22:14 GMT
Content-Type
text/html; charset=utf-8
Content-Length
120
Connection
keep-alive
X-DNS-Prefetch-Control
off
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=16070400; includeSubDomains; preload
X-Download-Options
noopen
X-Content-Type-Options
nosniff
X-XSS-Protection
1; mode=block
Cache-Control
private, no-cache, no-store, must-revalidate
Expires
-1
Pragma
no-cache
Location
/?rid=9d46e590d40a261b446ebf80919557d8
Vary
Accept
bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@4.6.1/dist/css/
158 KB
25 KB
Stylesheet
General
Full URL
https://cdn.jsdelivr.net/npm/bootstrap@4.6.1/dist/css/bootstrap.min.css
Requested by
Host: threatcop.techmahindra.com
URL: https://threatcop.techmahindra.com/?rid=9d46e590d40a261b446ebf80919557d8
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5714 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0c5ed985fdbddc027124d4e6879ce1a1860832cda85e2b517c18d8fbd2fffc06
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://threatcop.techmahindra.com/
Origin
https://threatcop.techmahindra.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Tue, 21 Dec 2021 14:17:01 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
4660988
x-jsd-version
4.6.1
x-cache
HIT, MISS
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=31536000; includeSubDomains; preload
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-served-by
cache-fra19167-FRA, cache-mxp6965-MXP
timing-allow-origin
*
x-jsd-version-type
version
server
cloudflare
etag
W/"278e1-H7g/xZXPKL+TYth2EOrfo7e7vlk"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
cf-ray
6c11bb4a7f5d83b5-MXP
truncated
/
122 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2f1f61abf9adf4236bea093c58250c49b3915ff2108d55d2900e7a3e81ad81e9

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Content-Type
image/png
jquery-2.2.4.min.js
code.jquery.com/
84 KB
29 KB
Script
General
Full URL
https://code.jquery.com/jquery-2.2.4.min.js
Requested by
Host: threatcop.techmahindra.com
URL: https://threatcop.techmahindra.com/?rid=9d46e590d40a261b446ebf80919557d8
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac18::1:a:2b , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
nginx /
Resource Hash
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

Request headers

Referer
https://threatcop.techmahindra.com/
Origin
https://threatcop.techmahindra.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Tue, 21 Dec 2021 14:17:02 GMT
content-encoding
gzip
last-modified
Fri, 20 May 2016 17:24:41 GMT
server
nginx
etag
W/"573f4859-14e4a"
vary
Accept-Encoding
x-hw
1640096222.dop009.ml1.t,1640096222.cds217.ml1.hn,1640096222.cds220.ml1.c
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
29811
landing.js
threatcop.techmahindra.com/static/js/app/
2 KB
3 KB
Script
General
Full URL
https://threatcop.techmahindra.com/static/js/app/landing.js
Requested by
Host: threatcop.techmahindra.com
URL: https://threatcop.techmahindra.com/?rid=9d46e590d40a261b446ebf80919557d8
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
203.143.186.170 , India, ASN17825 (MAHINDRABT-AS-AP Tech Mahindra Ltd. Software Development Organisation India, IN),
Reverse DNS
threatcop.techmahindra.com
Software
/
Resource Hash
de590844ec385b30ad6b85be411da6eea64da55dc06dad1ea7299e1438b60023
Security Headers
Name Value
Strict-Transport-Security max-age=16070400; includeSubDomains; preload

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatcop.techmahindra.com/?rid=9d46e590d40a261b446ebf80919557d8
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date
Tue, 21 Dec 2021 14:22:14 GMT
Last-Modified
Thu, 11 Feb 2021 06:07:07 GMT
ETag
W/"8d2-1778fb34a23"
Strict-Transport-Security
max-age=16070400; includeSubDomains; preload
Content-Type
application/javascript; charset=UTF-8
Cache-Control
public, max-age=0
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
2258
truncated
/
44 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
9d26c2a9cc4f048c1d7727596873b096de3b75eaf1eb8a5d1fec548a36fe20dd

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Content-Type
image/png
/
threatcop.techmahindra.com/loadUrl/
0
0
Document
General
Full URL
https://threatcop.techmahindra.com/loadUrl/?rId=9d46e590d40a261b446ebf80919557d8
Requested by
Host: threatcop.techmahindra.com
URL: https://threatcop.techmahindra.com/static/js/app/landing.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
203.143.186.170 , India, ASN17825 (MAHINDRABT-AS-AP Tech Mahindra Ltd. Software Development Organisation India, IN),
Reverse DNS
threatcop.techmahindra.com
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=16070400; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://threatcop.techmahindra.com/?rid=9d46e590d40a261b446ebf80919557d8

Response headers

Date
Tue, 21 Dec 2021 14:22:15 GMT
Content-Type
application/x-msdownload
Content-Length
1255072
Connection
keep-alive
X-DNS-Prefetch-Control
off
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=16070400; includeSubDomains; preload
X-Download-Options
noopen
X-Content-Type-Options
nosniff
X-XSS-Protection
1; mode=block
Cache-Control
private, no-cache, no-store, must-revalidate
Expires
-1
Pragma
no-cache
Content-Disposition
attachment; filename=december21.exe
x-timestamp
1640096535193
x-sent
true
Accept-Ranges
bytes
Last-Modified
Tue, 21 Dec 2021 06:07:45 GMT
ETag
W/"1326a0-17ddb9a57f6"

Verdicts & Comments Add Verdict or Comment

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery function| getUserIP function| Sr4H5sJK function| urlParam

1 Cookies

Domain/Path Name / Value
.threatcop.techmahindra.com/ Name: TS017cca37
Value: 010d622b9c17141d98aaff6f4b051d055b90bb7eec3f034deb8a21259f6bf30f1a283005054c21d1a8a0232787b87240a6e11b401a

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=16070400; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block