urlscan.io logo urlscan.io
SecurityTrails logo

37.165.178.68.host.secureserver.net Open in urlscan Pro
68.178.165.37  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://l.ead.me/Osdhvd6gg
Effective URL: http://37.165.178.68.host.secureserver.net/publi-mx/redirlogin/LKHF6tfjhvKJHFViu6t5i78y589uhbgjhRyg5ygjkQPFKJf748.php
Submission: On September 28 via manual from ES — Scanned from ES
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 1 countries across 4 domains to perform 6 HTTP transactions. The main IP is 68.178.165.37, located in Scottsdale, United States and belongs to AS-26496-GO-DADDY-COM-LLC, US. The main domain is 37.165.178.68.host.secureserver.net.
This is the only time 37.165.178.68.host.secureserver.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Downloads These files were downloaded by the website

Zip_Factura_27092023_jsHg3f76v_CiUICkBDWpTZp.zip 146 KB application/zip
MIME: Zip archive data, at least v2.0 to extract
Size: 146 KB (149301 bytes, 100% done)
Downloaded from: https://homefileaddseg.blob.core.windows.net/logincompromx/Zip_Factura_27092023_jsHg3f76v_CiUICkBDWpTZp.zip

Domain & IP information

IP Address AS Autonomous System
1 1 18.238.243.100 16509 (AMAZON-02)
1 5 68.178.165.37 26496 (AS-26496-...)
1 20.209.12.41 ()
6 3
Apex Domain
Subdomains		 Transfer
5 secureserver.net
37.165.178.68.host.secureserver.net
76 KB
1 windows.net
homefileaddseg.blob.core.windows.net
1 ead.me
l.ead.me — Cisco Umbrella Rank: 279993
385 B
0 urmh.edu.mx Failed
sistema.urmh.edu.mx Failed
6 4
Domain Requested by
5 37.165.178.68.host.secureserver.net 1 redirects 37.165.178.68.host.secureserver.net
1 homefileaddseg.blob.core.windows.net 37.165.178.68.host.secureserver.net
1 l.ead.me 1 redirects
0 sistema.urmh.edu.mx Failed 37.165.178.68.host.secureserver.net
6 4

This site contains no links.

Subject Issuer Validity Valid
*.blob.core.windows.net
Microsoft Azure TLS Issuing CA 02		 2023-07-05 -
2024-06-27		 a year crt.sh

This page contains 1 frames:

Frame: https://sistema.urmh.edu.mx/
Frame ID: 2393088AF75552A47124AA156A5B4596
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Loader

Page URL History Show full URLs

  1. https://l.ead.me/Osdhvd6gg HTTP 302
    http://37.165.178.68.host.secureserver.net/publi-mx/jhcbyfrioujhbcjhuir74gjh4gufju46tjhbvjhcb6rtriu.html Page URL
  2. http://37.165.178.68.host.secureserver.net/publi-mx/seguritymx/purbtdfspuidjksuy7sdeuhewopeogsdteouirtdljgd.php?MX4088B... HTTP 302
    http://37.165.178.68.host.secureserver.net/publi-mx/redirlogin/LKHF6tfjhvKJHFViu6t5i78y589uhbgjhRyg5ygjkQPFKJf748.php Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

6
Requests

17 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

3
IPs

1
Countries

76 kB
Transfer

76 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://l.ead.me/Osdhvd6gg HTTP 302
    http://37.165.178.68.host.secureserver.net/publi-mx/jhcbyfrioujhbcjhuir74gjh4gufju46tjhbvjhcb6rtriu.html Page URL
  2. http://37.165.178.68.host.secureserver.net/publi-mx/seguritymx/purbtdfspuidjksuy7sdeuhewopeogsdteouirtdljgd.php?MX4088B8E-1028-2J3J-4M6C-4058D2J0DD756_Serie_IWAVZ_y_Folio_120519.html HTTP 302
    http://37.165.178.68.host.secureserver.net/publi-mx/redirlogin/LKHF6tfjhvKJHFViu6t5i78y589uhbgjhRyg5ygjkQPFKJf748.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://l.ead.me/Osdhvd6gg HTTP 302
  • http://37.165.178.68.host.secureserver.net/publi-mx/jhcbyfrioujhbcjhuir74gjh4gufju46tjhbvjhcb6rtriu.html

6 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
jhcbyfrioujhbcjhuir74gjh4gufju46tjhbvjhcb6rtriu.html
37.165.178.68.host.secureserver.net/publi-mx/
Redirect Chain
  • https://l.ead.me/Osdhvd6gg
  • http://37.165.178.68.host.secureserver.net/publi-mx/jhcbyfrioujhbcjhuir74gjh4gufju46tjhbvjhcb6rtriu.html
226 B
555 B 		Document
General
Check archive.org
Download Go to
Full URL
http://37.165.178.68.host.secureserver.net/publi-mx/jhcbyfrioujhbcjhuir74gjh4gufju46tjhbvjhcb6rtriu.html
Protocol
HTTP/1.1
Server
68.178.165.37 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
37.165.178.68.host.secureserver.net
Software
Apache/2.4.41 (Ubuntu) /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language
es-ES,es;q=0.9

Response headers

Accept-Ranges
bytes
Connection
Keep-Alive
Content-Encoding
gzip
Content-Length
219
Content-Type
text/html
Date
Thu, 28 Sep 2023 09:47:30 GMT
ETag
"e2-604f1edc4efc0-gzip"
Keep-Alive
timeout=5, max=100
Last-Modified
Sat, 09 Sep 2023 19:16:23 GMT
Server
Apache/2.4.41 (Ubuntu)
Vary
Accept-Encoding

Redirect headers

cache-control
no-store, no-cache, must-revalidate
content-type
text/html; charset=UTF-8
date
Thu, 28 Sep 2023 09:47:29 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
location
http://37.165.178.68.host.secureserver.net/publi-mx/jhcbyfrioujhbcjhuir74gjh4gufju46tjhbvjhcb6rtriu.html
pragma
no-cache
server
nginx
via
1.1 e3d9ae12f22103dbc65c451ae520a012.cloudfront.net (CloudFront)
x-amz-cf-id
MF8Qa48wTgbNsVPvBFcRgiI9p3H0tMCdI80S9rc2lM-otCDPMhdgkg==
x-amz-cf-pop
AMS58-P1
x-cache
Miss from cloudfront
Primary Request LKHF6tfjhvKJHFViu6t5i78y589uhbgjhRyg5ygjkQPFKJf748.php
37.165.178.68.host.secureserver.net/publi-mx/redirlogin/
Redirect Chain
  • http://37.165.178.68.host.secureserver.net/publi-mx/seguritymx/purbtdfspuidjksuy7sdeuhewopeogsdteouirtdljgd.php?MX4088B8E-1028-2J3J-4M6C-4058D2J0DD756_Serie_IWAVZ_y_Folio_120519.html
  • http://37.165.178.68.host.secureserver.net/publi-mx/redirlogin/LKHF6tfjhvKJHFViu6t5i78y589uhbgjhRyg5ygjkQPFKJf748.php
2 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://37.165.178.68.host.secureserver.net/publi-mx/redirlogin/LKHF6tfjhvKJHFViu6t5i78y589uhbgjhRyg5ygjkQPFKJf748.php
Protocol
HTTP/1.1
Server
68.178.165.37 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
37.165.178.68.host.secureserver.net
Software
Apache/2.4.41 (Ubuntu) /
Resource Hash
c320180cda06e403defaab18556c9d52db78a9014820b82b0640f31d99adfb40

Request headers

Referer
http://37.165.178.68.host.secureserver.net/publi-mx/jhcbyfrioujhbcjhuir74gjh4gufju46tjhbvjhcb6rtriu.html
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language
es-ES,es;q=0.9

Response headers

Connection
Keep-Alive
Content-Encoding
gzip
Content-Length
996
Content-Type
text/html; charset=UTF-8
Date
Thu, 28 Sep 2023 09:47:30 GMT
Keep-Alive
timeout=5, max=98
Server
Apache/2.4.41 (Ubuntu)
Vary
Accept-Encoding

Redirect headers

Connection
Keep-Alive
Content-Length
0
Content-Type
text/html; charset=UTF-8
Date
Thu, 28 Sep 2023 09:47:30 GMT
Keep-Alive
timeout=5, max=99
Location
http://37.165.178.68.host.secureserver.net/publi-mx/redirlogin/LKHF6tfjhvKJHFViu6t5i78y589uhbgjhRyg5ygjkQPFKJf748.php
Server
Apache/2.4.41 (Ubuntu)
Zip_Factura_27092023_jsHg3f76v_CiUICkBDWpTZp.zip
homefileaddseg.blob.core.windows.net/logincompromx/ 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://homefileaddseg.blob.core.windows.net/logincompromx/Zip_Factura_27092023_jsHg3f76v_CiUICkBDWpTZp.zip
Requested by
Host: 37.165.178.68.host.secureserver.net
URL: http://37.165.178.68.host.secureserver.net/publi-mx/redirlogin/LKHF6tfjhvKJHFViu6t5i78y589uhbgjhRyg5ygjkQPFKJf748.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
20.209.12.41 -, , ASN (),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash

Request headers

Referer
http://37.165.178.68.host.secureserver.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language
es-ES,es;q=0.9

Response headers

Content-Length
149301
Content-MD5
aybjoaEokCS6p/Hcr+uMiw==
Content-Type
application/zip
Date
Thu, 28 Sep 2023 09:47:34 GMT
ETag
0x8DBBF6066E0E31B
Last-Modified
Wed, 27 Sep 2023 13:48:16 GMT
Server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-blob-type
BlockBlob
x-ms-lease-status
unlocked
x-ms-request-id
dcd36b26-301e-0003-69f0-f17872000000
x-ms-version
2009-09-19
loading.gif
37.165.178.68.host.secureserver.net/publi-mx/redirlogin/ 		73 KB
74 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://37.165.178.68.host.secureserver.net/publi-mx/redirlogin/loading.gif
Protocol
HTTP/1.1
Server
68.178.165.37 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
37.165.178.68.host.secureserver.net
Software
Apache/2.4.41 (Ubuntu) /
Resource Hash
638fce3e3314951073649ec6d040c1611d32ace1b8b7a5146260d73cd2770e7d

Request headers

accept-language
es-ES,es;q=0.9
Referer
http://37.165.178.68.host.secureserver.net/publi-mx/redirlogin/LKHF6tfjhvKJHFViu6t5i78y589uhbgjhRyg5ygjkQPFKJf748.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date
Thu, 28 Sep 2023 09:47:34 GMT
Last-Modified
Wed, 13 Sep 2023 00:33:24 GMT
Server
Apache/2.4.41 (Ubuntu)
ETag
"12528-60532b5087d00"
Content-Type
image/gif
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=97
Content-Length
75048
redir_link.txt
37.165.178.68.host.secureserver.net/publi-mx/redirlogin/redir/ 		662 B
555 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://37.165.178.68.host.secureserver.net/publi-mx/redirlogin/redir/redir_link.txt
Requested by
Host: 37.165.178.68.host.secureserver.net
URL: http://37.165.178.68.host.secureserver.net/publi-mx/redirlogin/LKHF6tfjhvKJHFViu6t5i78y589uhbgjhRyg5ygjkQPFKJf748.php
Protocol
HTTP/1.1
Server
68.178.165.37 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
37.165.178.68.host.secureserver.net
Software
Apache/2.4.41 (Ubuntu) /
Resource Hash

Request headers

accept-language
es-ES,es;q=0.9
Referer
http://37.165.178.68.host.secureserver.net/publi-mx/redirlogin/LKHF6tfjhvKJHFViu6t5i78y589uhbgjhRyg5ygjkQPFKJf748.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date
Thu, 28 Sep 2023 09:47:37 GMT
Content-Encoding
gzip
Last-Modified
Mon, 25 Sep 2023 18:17:43 GMT
Server
Apache/2.4.41 (Ubuntu)
ETag
"296-60632f96bffc0-gzip"
Vary
Accept-Encoding
Content-Type
text/plain
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=96
Content-Length
218
/
sistema.urmh.edu.mx/ 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
sistema.urmh.edu.mx
URL
https://sistema.urmh.edu.mx/

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies