korzo.ir Open in urlscan Pro
89.42.209.235 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://korzo.ir/webmail/42/webmail/webmail.php
Effective URL:
https://korzo.ir/webmail/42/webmail/webmail.php
Submission: On April 23 via api (April 23rd 2024, 9:45:34 pm UTC) from US — Scanned from DE

Summary HTTP 9 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 9 HTTP transactions. The main IP is 89.42.209.235, located in Iran, Islamic Republic Of and belongs to NETMIHAN, IR. The main domain is korzo.ir.
TLS certificate: Issued by R3 on March 11th 2024. Valid for: 3 months.

This is the only time korzo.ir was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address		AS Autonomous System
3	89.42.209.235 89.42.209.235		204213 (NETMIHAN) (NETMIHAN)
9	2

3 89.42.209.235 (Iran, Islamic Republic Of)

ASN204213 (NETMIHAN, IR)
PTR: cp82p.nocmails.info

korzo.ir	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
webmail.korzo.ir	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	korzo.ir korzo.ir webmail.korzo.ir	15 KB
9	1

	Domain	Requested by
2	korzo.ir	korzo.ir
1	webmail.korzo.ir	korzo.ir webmail.korzo.ir
9	2

This site contains links to these domains. Also see Links.

Domain
korzo.ir
webmail.korzo.ir

Subject Issuer	Validity	Valid
*.korzo.ir R3	`2024-03-11` - `2024-06-09`	3 months	crt.sh

This page contains 3 frames:

Frame: https://webmail.korzo.ir/unprotected/redirect.html?goto_uri=%2F42%2Fwebmail%2Fwebmail.php
Frame ID: CC09200427AE4B2D16FC71F8F8D18D54
Requests: 10 HTTP requests in this frame

Frame: https://korzo.ir:2096/unprotected/loader.html?random=OF8A6SZ5H3hbz70R&goto_uri=%2f42%2fwebmail%2fwebmail.php
Frame ID: B12B7B5CE082CBCD645F398F8092A487
Requests: 1 HTTP requests in this frame

Frame: https://webmail.korzo.ir/unprotected/loader.html?random=OF8A6SZ5H3hbz70R&goto_uri=%2f42%2fwebmail%2fwebmail.php
Frame ID: D3A825E18144F669FE92945550FA758D
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

cPanel Redirect

Page URL History Show full URLs

http://korzo.ir/webmail/42/webmail/webmail.php HTTP 307
https://korzo.ir/webmail/42/webmail/webmail.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

9
Requests

33 %
HTTPS

0 %
IPv6

1
Domains

2
Subdomains

2
IPs

1
Countries

15 kB
Transfer

57 kB
Size

0
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://korzo.ir:2096/42/webmail/webmail.php
Title: Enter Here

Search URL Search Domain Scan URL

URL: https://webmail.korzo.ir/42/webmail/webmail.php
Title: Enter Here

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://korzo.ir/webmail/42/webmail/webmail.php HTTP 307
https://korzo.ir/webmail/42/webmail/webmail.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
3 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request webmail.php Show response korzo.ir/webmail/42/webmail/ Redirect Chain http://korzo.ir/webmail/42/webmail/webmail.php https://korzo.ir/webmail/42/webmail/webmail.php	34 KB 13 KB	766ms 375ms	Document text/html	89.42.209.235 NETMIHAN
General Check archive.org Show headers Download Go to Full URL https://korzo.ir/webmail/42/webmail/webmail.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 89.42.209.235 , Iran, Islamic Republic Of, ASN204213 (NETMIHAN, IR), Reverse DNS cp82p.nocmails.info Software LiteSpeed / Resource Hash `96890e6ccdba9dfa4b25623298b2a0191f2a9aa853685a94a1bce1d8acc6e6d8` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-encoding br content-type text/html date Tue, 23 Apr 2024 21:45:30 GMT server LiteSpeed vary Accept-Encoding Redirect headers Location https://korzo.ir/webmail/42/webmail/webmail.php Non-Authoritative-Reason HttpsUpgrades
GET H/1.1	200 OK	loader.html Show response korzo.ir/unprotected/ Frame B12B	3 KB 1 KB	428ms 210ms	Document text/html	89.42.209.235 NETMIHAN
General Check archive.org Show headers Download Go to Full URL https://korzo.ir:2096/unprotected/loader.html?random=OF8A6SZ5H3hbz70R&goto_uri=%2f42%2fwebmail%2fwebmail.php Requested by Host: korzo.ir URL: https://korzo.ir/webmail/42/webmail/webmail.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 89.42.209.235 , Iran, Islamic Republic Of, ASN204213 (NETMIHAN, IR), Reverse DNS cp82p.nocmails.info Software / Resource Hash `48a958baff087a82f34c1092ec2878817dc58487215cb6eabd5c343fdebeedbb` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer https://korzo.ir/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers Cache-Control no-cache, no-store, must-revalidate, private Content-Encoding gzip Content-Length 905 Content-Type text/html Date Tue, 23 Apr 2024 21:45:30 GMT Last-Modified Fri, 23 Sep 2022 20:37:03 GMT Pragma no-cache
GET DATA	200 OK	truncated /	508 B 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `4ca52058cb5163949735198c0951ae95b6e7fffc4c218e02dadf65dceb802c02` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers Content-Type image/jpeg
GET DATA	200 OK	truncated /	9 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `18f390ed2b7d610afbbea8b96ca3798be27136e651c5ab42067b330bb08aa3ed` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers Content-Type image/jpeg
GET DATA	200 OK	truncated /	9 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `8358ac617123d28be0a6573004247d99c19dd4ac40253bb9edc43f33ca4930fa` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers Content-Type image/jpeg
GET		redirect.html korzo.ir/unprotected/	0 0

GET		redirect.html korzo.ir/unprotected/	0 0

GET H2	200	loader.html webmail.korzo.ir/unprotected/ Frame D3A8	3 KB 1 KB	2767ms 2643ms	Document text/html	89.42.209.235 NETMIHAN
General Check archive.org Show headers Download Go to Full URL https://webmail.korzo.ir/unprotected/loader.html?random=OF8A6SZ5H3hbz70R&goto_uri=%2f42%2fwebmail%2fwebmail.php Requested by Host: korzo.ir URL: https://korzo.ir/webmail/42/webmail/webmail.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 89.42.209.235 , Iran, Islamic Republic Of, ASN204213 (NETMIHAN, IR), Reverse DNS cp82p.nocmails.info Software LiteSpeed / Resource Hash Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer https://korzo.ir/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers cache-control no-cache, no-store, must-revalidate, private content-encoding gzip content-length 905 content-type text/html date Tue, 23 Apr 2024 21:45:34 GMT last-modified Fri, 23 Sep 2022 20:37:03 GMT pragma no-cache server LiteSpeed vary Accept-Encoding
GET		redirect.html korzo.ir/unprotected/	0 0

GET		redirect.html korzo.ir/unprotected/	0 0

GET		redirect.html webmail.korzo.ir/unprotected/	0 0

GET		redirect.html webmail.korzo.ir/unprotected/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: korzo.ir
URL: https://korzo.ir:2096/unprotected/redirect.html?goto_uri=%2F42%2Fwebmail%2Fwebmail.php

Domain: korzo.ir
URL: https://korzo.ir:2096/unprotected/redirect.html?goto_uri=%2F42%2Fwebmail%2Fwebmail.php

Domain: korzo.ir
URL: https://korzo.ir:2096/unprotected/redirect.html?goto_uri=%2F42%2Fwebmail%2Fwebmail.php

Domain: korzo.ir
URL: https://korzo.ir:2096/unprotected/redirect.html?goto_uri=%2F42%2Fwebmail%2Fwebmail.php

Domain: webmail.korzo.ir
URL: https://webmail.korzo.ir/unprotected/redirect.html?goto_uri=%2F42%2Fwebmail%2Fwebmail.php

Domain: webmail.korzo.ir
URL: https://webmail.korzo.ir/unprotected/redirect.html?goto_uri=%2F42%2Fwebmail%2Fwebmail.php

Verdicts & Comments Add Verdict or Comment

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	URL: about:blank Message: An iframe which has both allow-scripts and allow-same-origin for its sandbox attribute can escape its sandboxing.
security	warning	URL: about:blank Message: An iframe which has both allow-scripts and allow-same-origin for its sandbox attribute can escape its sandboxing.
security	warning	URL: about:blank Message: An iframe which has both allow-scripts and allow-same-origin for its sandbox attribute can escape its sandboxing.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

korzo.ir
webmail.korzo.ir
korzo.ir
webmail.korzo.ir
89.42.209.235
18f390ed2b7d610afbbea8b96ca3798be27136e651c5ab42067b330bb08aa3ed
48a958baff087a82f34c1092ec2878817dc58487215cb6eabd5c343fdebeedbb
4ca52058cb5163949735198c0951ae95b6e7fffc4c218e02dadf65dceb802c02
8358ac617123d28be0a6573004247d99c19dd4ac40253bb9edc43f33ca4930fa
96890e6ccdba9dfa4b25623298b2a0191f2a9aa853685a94a1bce1d8acc6e6d8

korzo.ir Open in urlscan Pro 89.42.209.235 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

9 Requests

33 %HTTPS

0 %IPv6

1 Domains

2 Subdomains

2 IPs

1 Countries

15 kBTransfer

57 kBSize

0 Cookies

2 Outgoing links

Page URL History

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

13 JavaScript Global Variables

0 Cookies

3 Console Messages

Indicators

korzo.ir Open in urlscan Pro
89.42.209.235 Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

33 %
HTTPS

0 %
IPv6

1
Domains

2
Subdomains

2
IPs

1
Countries

15 kB
Transfer

57 kB
Size

0
Cookies

9 HTTP transactions
3 data transactions