URL: https://lx-correo-s2.hc.edu.uy/
Submission Tags: @phishunt_io
Submission: On April 25 via api from DE — Scanned from DE

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 3 HTTP transactions. The main IP is 164.73.66.15, located in Uruguay and belongs to Uruguay, UY. The main domain is lx-correo-s2.hc.edu.uy.
TLS certificate: Issued by R3 on April 25th 2022. Valid for: 3 months.
This is the only time lx-correo-s2.hc.edu.uy was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
3 164.73.66.15 1797 (Uruguay)
3 1
Apex Domain
Subdomains
Transfer
3 hc.edu.uy
lx-correo-s2.hc.edu.uy
27 KB
3 1
Domain Requested by
3 lx-correo-s2.hc.edu.uy lx-correo-s2.hc.edu.uy
3 1

This site contains links to these domains. Also see Links.

Domain
www.zimbra.com
blog.zimbra.com
wiki.zimbra.com
Subject Issuer Validity Valid
lx-correo-s2.hc.edu.uy
R3
2022-04-25 -
2022-07-24
3 months crt.sh

This page contains 1 frames:

Primary Page: https://lx-correo-s2.hc.edu.uy/
Frame ID: CB1281894670D29989845CFB2B5EB9E3
Requests: 3 HTTP requests in this frame

Screenshot

Page Title

Beim Zimbra-Webclient anmelden

Page Statistics

3
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

27 kB
Transfer

80 kB
Size

2
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
lx-correo-s2.hc.edu.uy/
12 KB
5 KB
Document
General
Full URL
https://lx-correo-s2.hc.edu.uy/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
164.73.66.15 , Uruguay, ASN1797 (Uruguay, UY),
Reverse DNS
lx-correo-s2.hc.edu.uy
Software
nginx /
Resource Hash
5a3d4d9d4ac6ced6b01340f14d718094ace2eb7ecb8bf1cdbc40606c44416098
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
no-store, no-cache, must-revalidate, max-age=0
content-encoding
gzip
content-language
de-DE
content-type
text/html;charset=utf-8
date
Mon, 25 Apr 2022 21:31:43 GMT
expires
-1
pragma
no-cache
server
nginx
vary
User-Agent Accept-Encoding
x-frame-options
SAMEORIGIN
x-ua-compatible
IE=edge
common,login,zhtml,skin.css
lx-correo-s2.hc.edu.uy/css/
58 KB
12 KB
Stylesheet
General
Full URL
https://lx-correo-s2.hc.edu.uy/css/common,login,zhtml,skin.css?skin=harmony&v=220324043827
Requested by
Host: lx-correo-s2.hc.edu.uy
URL: https://lx-correo-s2.hc.edu.uy/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
164.73.66.15 , Uruguay, ASN1797 (Uruguay, UY),
Reverse DNS
lx-correo-s2.hc.edu.uy
Software
nginx /
Resource Hash
e30ccf0334e73b091a0c373aeef749c101a96da401392a451e031e580c6077b3
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://lx-correo-s2.hc.edu.uy/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Mon, 25 Apr 2022 21:31:43 GMT
content-encoding
gzip
vary
User-Agent, Accept-Encoding
server
nginx
x-frame-options
SAMEORIGIN
content-type
text/css
cache-control
public, max-age=2595600
expires
Wed, 25 May 2022 22:31:45 GMT
LoginBanner_white.png
lx-correo-s2.hc.edu.uy/skins/_base/logos/
10 KB
10 KB
Image
General
Full URL
https://lx-correo-s2.hc.edu.uy/skins/_base/logos/LoginBanner_white.png?v=220324043827
Requested by
Host: lx-correo-s2.hc.edu.uy
URL: https://lx-correo-s2.hc.edu.uy/css/common,login,zhtml,skin.css?skin=harmony&v=220324043827
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
164.73.66.15 , Uruguay, ASN1797 (Uruguay, UY),
Reverse DNS
lx-correo-s2.hc.edu.uy
Software
nginx /
Resource Hash
c4042c52c573f1b9ed868271a06894d2cdb70e2c4e7a8a070a6fb604630ad138
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://lx-correo-s2.hc.edu.uy/css/common,login,zhtml,skin.css?skin=harmony&v=220324043827
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Mon, 25 Apr 2022 21:31:44 GMT
last-modified
Wed, 06 Apr 2022 18:25:04 GMT
server
nginx
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
public, max-age=2595600
accept-ranges
bytes
content-length
9891
expires
Wed, 25 May 2022 22:31:45 GMT

Verdicts & Comments Add Verdict or Comment

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone object| oncontextlost object| oncontextrestored function| getScreenDetails function| ZmSkin object| link function| clientChange function| showWhatsThis function| forgotPassword function| onLoad function| BaseSkin object| skin

2 Cookies

Domain/Path Name / Value
lx-correo-s2.hc.edu.uy/ Name: ZM_TEST
Value: true
lx-correo-s2.hc.edu.uy/ Name: ZM_LOGIN_CSRF
Value: 4bc00fb6-933f-4e3e-b1ed-0e3b9b921270

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Frame-Options SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

lx-correo-s2.hc.edu.uy
164.73.66.15
5a3d4d9d4ac6ced6b01340f14d718094ace2eb7ecb8bf1cdbc40606c44416098
c4042c52c573f1b9ed868271a06894d2cdb70e2c4e7a8a070a6fb604630ad138
e30ccf0334e73b091a0c373aeef749c101a96da401392a451e031e580c6077b3