webmail-mtaonline.pihen35696.workers.dev Open in urlscan Pro
2606:4700:3034::ac43:9fba Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://webmail-mtaonline.pihen35696.workers.dev/,n/a,https:/openphish.com/feed.txt
Effective URL:
https://webmail-mtaonline.pihen35696.workers.dev/,n/a,https:/openphish.com/feed.txt
Submission: On August 10 via api (August 10th 2024, 4:51:36 am UTC) from US — Scanned from DE

Summary HTTP 8 Redirects Links 5 Behaviour Indicators

Summary

This website contacted 6 IPs in 1 countries across 6 domains to perform 8 HTTP transactions. The main IP is 2606:4700:3034::ac43:9fba, located in United States and belongs to CLOUDFLARENET, US. The main domain is webmail-mtaonline.pihen35696.workers.dev.
TLS certificate: Issued by WE1 on July 27th 2024. Valid for: 3 months.

This is the only time webmail-mtaonline.pihen35696.workers.dev was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	2606:4700:303... 2606:4700:3034::ac43:9fba	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	193.122.191.58 193.122.191.58	31898 (ORACLE-BM...) (ORACLE-BMC-31898)
1	152.199.19.160 152.199.19.160	15133 (EDGECAST) (EDGECAST)
1	2606:4700::68... 2606:4700::6811:180e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	137.118.7.42 137.118.7.42	6250 (NEONOVA-NET) (NEONOVA-NET)
8	6

1 2606:4700:3034::ac43:9fba (United States)

ASN13335 (CLOUDFLARENET, US)

webmail-mtaonline.pihen35696.workers.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 193.122.191.58 (Ashburn, United States)

ASN31898 (ORACLE-BMC-31898, US)
PTR: sni-s.av-mx.com

webmail.mtaonline.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 152.199.19.160 (United States)

ASN15133 (EDGECAST, US)

ajax.aspnetcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:180e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 137.118.7.42 (United States)

ASN6250 (NEONOVA-NET, US)
PTR: govweb.neonova.net

cas.neonova.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	mtaonline.net webmail.mtaonline.net	16 KB
1	neonova.net cas.neonova.net	10 KB
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 336	5 KB
1	aspnetcdn.com ajax.aspnetcdn.com — Cisco Umbrella Rank: 5661	30 KB
1	workers.dev webmail-mtaonline.pihen35696.workers.dev	3 KB
0	googleapis.com Failed ajax.googleapis.com Failed
8	6

	Domain	Requested by
3	webmail.mtaonline.net	webmail-mtaonline.pihen35696.workers.dev
1	cas.neonova.net	webmail.mtaonline.net
1	cdnjs.cloudflare.com	webmail-mtaonline.pihen35696.workers.dev
1	ajax.aspnetcdn.com	webmail-mtaonline.pihen35696.workers.dev
1	webmail-mtaonline.pihen35696.workers.dev
0	ajax.googleapis.com Failed	webmail-mtaonline.pihen35696.workers.dev
8	6

This site contains links to these domains. Also see Links.

Domain
www.mtaonline.net
www.zimbra.com
blog.zimbra.com
wiki.zimbra.com

Subject Issuer	Validity	Valid
pihen35696.workers.dev WE1	`2024-07-27` - `2024-10-25`	3 months	crt.sh
*.mtaonline.net R11	`2024-08-02` - `2024-10-31`	3 months	crt.sh
*.vo.msecnd.net DigiCert SHA2 Secure Server CA	`2024-06-06` - `2025-06-06`	a year	crt.sh
cdnjs.cloudflare.com WE1	`2024-07-31` - `2024-10-29`	3 months	crt.sh
*.neonova.net Go Daddy Secure Certificate Authority - G2	`2023-12-06` - `2025-01-04`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://webmail-mtaonline.pihen35696.workers.dev/,n/a,https:/openphish.com/feed.txt
Frame ID: A078DFEA5534163B1C1D8E4A65CC9A03
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Zimbra Web Client Sign In

Page URL History Show full URLs

http://webmail-mtaonline.pihen35696.workers.dev/,n/a,https:/openphish.com/feed.txt HTTP 307
https://webmail-mtaonline.pihen35696.workers.dev/,n/a,https:/openphish.com/feed.txt Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

8
Requests

88 %
HTTPS

40 %
IPv6

6
Domains

6
Subdomains

6
IPs

1
Countries

64 kB
Transfer

184 kB
Size

0
Cookies

5 Outgoing links

These are links going to different origins than the main page.

URL: http://www.mtaonline.net/
Title: Zimbra

Search URL Search Domain Scan URL

URL: https://www.zimbra.com/
Title: Zimbra

Search URL Search Domain Scan URL

URL: https://blog.zimbra.com/
Title: Blog

Search URL Search Domain Scan URL

URL: https://wiki.zimbra.com/
Title: Wiki

Search URL Search Domain Scan URL

URL: https://www.zimbra.com/forums
Title: Forums

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://webmail-mtaonline.pihen35696.workers.dev/,n/a,https:/openphish.com/feed.txt HTTP 307
https://webmail-mtaonline.pihen35696.workers.dev/,n/a,https:/openphish.com/feed.txt Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request feed.txt Show response
webmail-mtaonline.pihen35696.workers.dev/,n/a,https:/openphish.com/
Redirect Chain

http://webmail-mtaonline.pihen35696.workers.dev/,n/a,https:/openphish.com/feed.txt
https://webmail-mtaonline.pihen35696.workers.dev/,n/a,https:/openphish.com/feed.txt

9 KB
3 KB

262ms
38ms

Document
text/html

2606:4700:3034::ac43:9fba
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://webmail-mtaonline.pihen35696.workers.dev/,n/a,https:/openphish.com/feed.txt
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::ac43:9fba , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: efecfb5256a686eec8bd0f3750c37a29fe0ce6f9e8e93ccddc0361998e203962

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cf-ray: 8b0d5ef5994618e9-FRA
content-encoding: br
content-type: text/html;charset=UTF-8
date: Sat, 10 Aug 2024 04:51:28 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HKPBYwmZRi6fFcBkh4zVNbYOJKuW1g161wRMzY8C%2BcAF6crlmGxSh%2BH%2FRirvT3qRADAMdJ3%2B9mQnsIpGNDmCu8vQm9APe7IZP0y5Bfec2GZaOSTnzLkvA38peSfd2olf9ejEcwZZcOJWQWPBwwdtGP2jAAr7uok8WQak5P%2F2bgaEEpEiT44m"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

Redirect headers

Cross-Origin-Resource-Policy: Cross-Origin
Location: https://webmail-mtaonline.pihen35696.workers.dev/,n/a,https:/openphish.com/feed.txt
Non-Authoritative-Reason: HSTS

GET
H/1.1 200
OK common,login,zhtml,skin.css
webmail.mtaonline.net/css/ 58 KB
12 KB 1362ms
192ms Stylesheet
text/css 193.122.191.58
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to

Full URL

https://webmail.mtaonline.net/css/common,login,zhtml,skin.css?skin=harmony&v=220324043827

Requested by

Host: webmail-mtaonline.pihen35696.workers.dev
URL: https://webmail-mtaonline.pihen35696.workers.dev/,n/a,https:/openphish.com/feed.txt

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

193.122.191.58 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),

Reverse DNS

sni-s.av-mx.com

Software

nginx /

Resource Hash

27de9204cedbf817884c29fb12c1bdbeec2be9ab6ed357c6f7b03d5e750f4b9a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://webmail-mtaonline.pihen35696.workers.dev/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date: Sat, 10 Aug 2024 04:51:29 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Referrer-Policy: no-referrer
Server: nginx
Transfer-Encoding: chunked
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
Vary: User-Agent, Accept-Encoding
Cache-Control: public, max-age=2595600
Connection: keep-alive
X-Robots-Tag: noindex
Expires: Mon, 9 Sep 2024 05:51:29 GMT

GET
H/1.1 200
OK ImgCritical_32.png
webmail.mtaonline.net/img/dwt/ 2 KB
2 KB 1275ms
105ms Image
image/png 193.122.191.58
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://webmail.mtaonline.net/img/dwt/ImgCritical_32.png

Requested by

Host: webmail-mtaonline.pihen35696.workers.dev
URL: https://webmail-mtaonline.pihen35696.workers.dev/,n/a,https:/openphish.com/feed.txt

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

193.122.191.58 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),

Reverse DNS

sni-s.av-mx.com

Software

nginx /

Resource Hash

dbe2ddb68a1551e50afee8edce02b19f9f86a0f43643fac32f66616bd10e30cb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://webmail-mtaonline.pihen35696.workers.dev/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date: Sat, 10 Aug 2024 04:51:29 GMT
X-Content-Type-Options: nosniff
Referrer-Policy: no-referrer
Last-Modified: Thu, 24 Mar 2022 08:00:10 GMT
Server: nginx
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Cache-Control: public, max-age=2595600
Connection: keep-alive
Accept-Ranges: bytes
X-Robots-Tag: noindex
Content-Length: 1786
Expires: Mon, 9 Sep 2024 05:51:29 GMT

GET
H2 200 jquery-3.3.1.min.js Show response
ajax.aspnetcdn.com/ajax/jQuery/ 85 KB
30 KB 152ms
18ms Script
application/javascript 152.199.19.160
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.aspnetcdn.com/ajax/jQuery/jquery-3.3.1.min.js

Requested by

Host: webmail-mtaonline.pihen35696.workers.dev
URL: https://webmail-mtaonline.pihen35696.workers.dev/,n/a,https:/openphish.com/feed.txt

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

152.199.19.160 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (ama/48FC) /

Resource Hash

160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://webmail-mtaonline.pihen35696.workers.dev/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 10 Aug 2024 04:51:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 12010762
x-cache: HIT
content-length: 30394
x-xss-protection: 1; mode=block
last-modified: Mon, 22 Jan 2018 19:27:49 GMT
server: ECAcc (ama/48FC)
etag: "80288516b793d31:0"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public,max-age=31536000
accept-ranges: bytes
timing-allow-origin: *

GET
H3 200 jquery.mask.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery.mask/1.14.10/ 20 KB
5 KB 271ms
27ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery.mask/1.14.10/jquery.mask.js

Requested by

Host: webmail-mtaonline.pihen35696.workers.dev
URL: https://webmail-mtaonline.pihen35696.workers.dev/,n/a,https:/openphish.com/feed.txt

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

be483938eb34538b970684f72e312f62652e84b42b7ad86953962d1ce2217c44

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://webmail-mtaonline.pihen35696.workers.dev/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 10 Aug 2024 04:51:28 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 258753
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 4517
last-modified: Mon, 04 May 2020 16:11:47 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ec3-4e98"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=J8Oom9ixbBJgiO%2FTWgh3405tMW8evRp5UYKvfG%2FD3IF0nl1c4LMGAEKlXhoElep%2BNBNy6yLEBzlttrDvYuH%2Fvd%2FFpk3eSW%2BCZOjBaIM44EovlflHjY7gT2WNRXEvjyMGJRPjO%2Fziy9iaNewk8CY3nrNK"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8b0d5ef93df18ed4-FRA
expires: Thu, 31 Jul 2025 04:51:28 GMT

GET jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/1.8.3/ 0
0

GET
H/1.1 200
OK mtaonline.net-large.png
cas.neonova.net/zimbra/ 10 KB
10 KB 1191ms
132ms Image
image/png 137.118.7.42
NEONOVA-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cas.neonova.net/zimbra/mtaonline.net-large.png
Requested by: Host: webmail.mtaonline.net
URL: https://webmail.mtaonline.net/css/common,login,zhtml,skin.css?skin=harmony&v=220324043827
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 137.118.7.42 , United States, ASN6250 (NEONOVA-NET, US),
Reverse DNS: govweb.neonova.net
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 2f82588fe21dafee058aa2e5a0aa576c7cdee74a354c129b2432f410856aea75

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date: Sat, 10 Aug 2024 04:51:30 GMT
Last-Modified: Mon, 10 Aug 2020 16:26:51 GMT
Server: Apache/2.2.15 (CentOS)
ETag: "a353f-269e-5ac886c0b8d0f"
Content-Type: image/png
Connection: close
Accept-Ranges: bytes
Content-Length: 9886

GET
H/1.1 200
OK favicon.ico
webmail.mtaonline.net/img/logo/ 1 KB
2 KB 102ms
102ms Other
image/x-icon 193.122.191.58
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to

Full URL

https://webmail.mtaonline.net/img/logo/favicon.ico

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

193.122.191.58 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),

Reverse DNS

sni-s.av-mx.com

Software

nginx /

Resource Hash

1afd891aacc433e75265e3ddc9cb4fc63b88259977811384426c535037711637

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://webmail-mtaonline.pihen35696.workers.dev/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date: Sat, 10 Aug 2024 04:51:31 GMT
X-Content-Type-Options: nosniff
Referrer-Policy: no-referrer
Last-Modified: Thu, 24 Mar 2022 08:00:10 GMT
Server: nginx
X-Frame-Options: SAMEORIGIN
Content-Type: image/x-icon
Cache-Control: public, max-age=2595600
Connection: keep-alive
Accept-Ranges: bytes
X-Robots-Tag: noindex
Content-Length: 1150
Expires: Mon, 9 Sep 2024 05:51:31 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: ajax.googleapis.com
URL: http://ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://webmail-mtaonline.pihen35696.workers.dev/,n/a,https:/openphish.com/feed.txt Message: Mixed Content: The page at 'https://webmail-mtaonline.pihen35696.workers.dev/,n/a,https:/openphish.com/feed.txt' was loaded over HTTPS, but requested an insecure script 'http://ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js'. This request has been blocked; the content must be served over HTTPS.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.aspnetcdn.com
ajax.googleapis.com
cas.neonova.net
cdnjs.cloudflare.com
webmail-mtaonline.pihen35696.workers.dev
webmail.mtaonline.net
ajax.googleapis.com
137.118.7.42
152.199.19.160
193.122.191.58
2606:4700:3034::ac43:9fba
2606:4700::6811:180e
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
1afd891aacc433e75265e3ddc9cb4fc63b88259977811384426c535037711637
27de9204cedbf817884c29fb12c1bdbeec2be9ab6ed357c6f7b03d5e750f4b9a
2f82588fe21dafee058aa2e5a0aa576c7cdee74a354c129b2432f410856aea75
be483938eb34538b970684f72e312f62652e84b42b7ad86953962d1ce2217c44
dbe2ddb68a1551e50afee8edce02b19f9f86a0f43643fac32f66616bd10e30cb
efecfb5256a686eec8bd0f3750c37a29fe0ce6f9e8e93ccddc0361998e203962

webmail-mtaonline.pihen35696.workers.dev Open in urlscan Pro 2606:4700:3034::ac43:9fba Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

8 Requests

88 %HTTPS

40 %IPv6

6 Domains

6 Subdomains

6 IPs

1 Countries

64 kBTransfer

184 kBSize

0 Cookies

5 Outgoing links

Page URL History

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

webmail-mtaonline.pihen35696.workers.dev Open in urlscan Pro
2606:4700:3034::ac43:9fba Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

88 %
HTTPS

40 %
IPv6

6
Domains

6
Subdomains

6
IPs

1
Countries

64 kB
Transfer

184 kB
Size

0
Cookies

8 HTTP transactions
0 data transactions