Submitted URL: https://micros.mx/zrv=52673/zss=562t137t8/ss=62t53t83.php
Effective URL: https://leisus.com.mx/z1111_servr/z1111_ver/p=uTe5n3sjWiQ490242/signin/login.php
Submission: On May 05 via manual from US

Summary

This website contacted 1 IPs in 1 countries across 2 domains to perform 6 HTTP transactions. The main IP is 192.185.57.175, located in Houston, United States and belongs to UNIFIEDLAYER-AS-1 - Unified Layer, US. The main domain is leisus.com.mx.
TLS certificate: Issued by Let's Encrypt Authority X3 on March 31st 2019. Valid for: 3 months.
This is the only time leisus.com.mx was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: PayPal (Financial)

Domain & IP information

IP Address AS Autonomous System
1 1 67.23.237.158 33182 (DIMENOC)
1 7 192.185.57.175 46606 (UNIFIEDLA...)
6 1
Apex Domain
Subdomains
Transfer
7 leisus.com.mx
leisus.com.mx
68 KB
1 micros.mx
micros.mx
278 B
6 2
Domain Requested by
7 leisus.com.mx 1 redirects leisus.com.mx
1 micros.mx 1 redirects
6 2

This site contains no links.

Subject Issuer Validity Valid
leisus.com.mx
Let's Encrypt Authority X3
2019-03-31 -
2019-06-29
3 months crt.sh

This page contains 1 frames:

Primary Page: https://leisus.com.mx/z1111_servr/z1111_ver/p=uTe5n3sjWiQ490242/signin/login.php
Frame ID: 46746793696DBDCCE7996F582CBEF14E
Requests: 6 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://micros.mx/zrv=52673/zss=562t137t8/ss=62t53t83.php HTTP 302
    https://leisus.com.mx/z1111_servr/z1111_ver/p=uTe5n3sjWiQ490242/ HTTP 302
    https://leisus.com.mx/z1111_servr/z1111_ver/p=uTe5n3sjWiQ490242/signin/login.php Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • url /\.php(?:$|\?)/i

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Overall confidence: 100%
Detected patterns
  • script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
  • script /jquery.*\.js/i
  • env /^jQuery$/i

Page Statistics

6
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

1
IPs

1
Countries

68 kB
Transfer

186 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://micros.mx/zrv=52673/zss=562t137t8/ss=62t53t83.php HTTP 302
    https://leisus.com.mx/z1111_servr/z1111_ver/p=uTe5n3sjWiQ490242/ HTTP 302
    https://leisus.com.mx/z1111_servr/z1111_ver/p=uTe5n3sjWiQ490242/signin/login.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request login.php
leisus.com.mx/z1111_servr/z1111_ver/p=uTe5n3sjWiQ490242/signin/
Redirect Chain
  • https://micros.mx/zrv=52673/zss=562t137t8/ss=62t53t83.php
  • https://leisus.com.mx/z1111_servr/z1111_ver/p=uTe5n3sjWiQ490242/
  • https://leisus.com.mx/z1111_servr/z1111_ver/p=uTe5n3sjWiQ490242/signin/login.php
14 KB
4 KB
Document
General
Full URL
https://leisus.com.mx/z1111_servr/z1111_ver/p=uTe5n3sjWiQ490242/signin/login.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
192.185.57.175 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US),
Reverse DNS
192-185-57-175.unifiedlayer.com
Software
nginx/1.14.1 /
Resource Hash
91236b8434781ea039d66544ee9b9bb569175d2fa7168fe503686127a5b5f3d5

Request headers

:method
GET
:authority
leisus.com.mx
:scheme
https
:path
/z1111_servr/z1111_ver/p=uTe5n3sjWiQ490242/signin/login.php
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status
200
server
nginx/1.14.1
date
Sun, 05 May 2019 18:59:18 GMT
content-type
text/html
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma
no-cache
set-cookie
PHPSESSID=9594ad91d84eb459bc596c31518303a3; path=/
content-encoding
gzip

Redirect headers

status
302
server
nginx/1.14.1
date
Sun, 05 May 2019 18:59:18 GMT
content-type
text/html
location
signin/login.php
contextualLogin.css
leisus.com.mx/z1111_servr/z1111_ver/p=uTe5n3sjWiQ490242/signin/login_files/
69 KB
16 KB
Stylesheet
General
Full URL
https://leisus.com.mx/z1111_servr/z1111_ver/p=uTe5n3sjWiQ490242/signin/login_files/contextualLogin.css
Requested by
Host: leisus.com.mx
URL: https://leisus.com.mx/z1111_servr/z1111_ver/p=uTe5n3sjWiQ490242/signin/login.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
192.185.57.175 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US),
Reverse DNS
192-185-57-175.unifiedlayer.com
Software
nginx/1.14.1 /
Resource Hash
be0f85aa43891dbb5ba2d21780dcb5a44eef6dbd3b6cd4a832f9a2f9e2afec96

Request headers

Referer
https://leisus.com.mx/z1111_servr/z1111_ver/p=uTe5n3sjWiQ490242/signin/login.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status
200
date
Sun, 05 May 2019 18:59:18 GMT
content-encoding
gzip
last-modified
Fri, 14 Sep 2018 06:13:02 GMT
server
nginx/1.14.1
content-type
text/css
jquery-1.7.2.min.js
leisus.com.mx/z1111_servr/z1111_ver/p=uTe5n3sjWiQ490242/signin/login_files/
93 KB
38 KB
Script
General
Full URL
https://leisus.com.mx/z1111_servr/z1111_ver/p=uTe5n3sjWiQ490242/signin/login_files/jquery-1.7.2.min.js
Requested by
Host: leisus.com.mx
URL: https://leisus.com.mx/z1111_servr/z1111_ver/p=uTe5n3sjWiQ490242/signin/login.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
192.185.57.175 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US),
Reverse DNS
192-185-57-175.unifiedlayer.com
Software
nginx/1.14.1 /
Resource Hash
47b68dce8cb6805ad5b3ea4d27af92a241f4e29a5c12a274c852e4346a0500b4

Request headers

Referer
https://leisus.com.mx/z1111_servr/z1111_ver/p=uTe5n3sjWiQ490242/signin/login.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status
200
date
Sun, 05 May 2019 18:59:18 GMT
content-encoding
gzip
last-modified
Fri, 30 Mar 2018 08:25:40 GMT
server
nginx/1.14.1
content-type
application/javascript
paypal-logo-129x32.png
leisus.com.mx/z1111_servr/z1111_ver/p=uTe5n3sjWiQ490242/signin/login_files/
2 KB
2 KB
Image
General
Full URL
https://leisus.com.mx/z1111_servr/z1111_ver/p=uTe5n3sjWiQ490242/signin/login_files/paypal-logo-129x32.png
Requested by
Host: leisus.com.mx
URL: https://leisus.com.mx/z1111_servr/z1111_ver/p=uTe5n3sjWiQ490242/signin/login.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
192.185.57.175 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US),
Reverse DNS
192-185-57-175.unifiedlayer.com
Software
nginx/1.14.1 /
Resource Hash
469508b4664c2f85861164e12c8842efebc42797533b4203a3691c3bc462b165

Request headers

Referer
https://leisus.com.mx/z1111_servr/z1111_ver/p=uTe5n3sjWiQ490242/signin/login.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status
200
date
Sun, 05 May 2019 18:59:18 GMT
last-modified
Fri, 14 Sep 2018 06:02:06 GMT
server
nginx/1.14.1
accept-ranges
bytes
content-length
1610
content-type
image/png
icon-PN-check.png
leisus.com.mx/z1111_servr/z1111_ver/p=uTe5n3sjWiQ490242/signin/login_files/
2 KB
2 KB
Image
General
Full URL
https://leisus.com.mx/z1111_servr/z1111_ver/p=uTe5n3sjWiQ490242/signin/login_files/icon-PN-check.png
Requested by
Host: leisus.com.mx
URL: https://leisus.com.mx/z1111_servr/z1111_ver/p=uTe5n3sjWiQ490242/signin/login.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
192.185.57.175 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US),
Reverse DNS
192-185-57-175.unifiedlayer.com
Software
nginx/1.14.1 /
Resource Hash
4a77d272b8cf508cc4a7e0da5763faa9958e42a5554fdb5d29fc3be51d685653

Request headers

Referer
https://leisus.com.mx/z1111_servr/z1111_ver/p=uTe5n3sjWiQ490242/signin/login.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status
200
date
Sun, 05 May 2019 18:59:18 GMT
last-modified
Fri, 14 Sep 2018 00:56:12 GMT
server
nginx/1.14.1
accept-ranges
bytes
content-length
2236
content-type
image/png
glyph_alert_critical_big-2x.png
leisus.com.mx/z1111_servr/z1111_ver/p=uTe5n3sjWiQ490242/signin/login_files/
6 KB
6 KB
Image
General
Full URL
https://leisus.com.mx/z1111_servr/z1111_ver/p=uTe5n3sjWiQ490242/signin/login_files/glyph_alert_critical_big-2x.png
Requested by
Host: leisus.com.mx
URL: https://leisus.com.mx/z1111_servr/z1111_ver/p=uTe5n3sjWiQ490242/signin/login.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
192.185.57.175 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US),
Reverse DNS
192-185-57-175.unifiedlayer.com
Software
nginx/1.14.1 /
Resource Hash
13e4806e5c517e074ab1ea26fe0f2b7b87eaa3988006f35ed0bd4c89502d0d79

Request headers

Referer
https://leisus.com.mx/z1111_servr/z1111_ver/p=uTe5n3sjWiQ490242/signin/login.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status
200
date
Sun, 05 May 2019 18:59:18 GMT
last-modified
Fri, 14 Sep 2018 00:56:12 GMT
server
nginx/1.14.1
accept-ranges
bytes
content-length
5828
content-type
image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask function| $ function| jQuery

1 Cookies

Domain/Path Name / Value
leisus.com.mx/ Name: PHPSESSID
Value: 9594ad91d84eb459bc596c31518303a3