Submitted URL: https://bit.ly/3g86xcU
Effective URL: http://42.200.136.40:8888/mail/pda/skins/default/images/Jb5xdSwqJHu0n/N7ccS4.html
Submission: On October 17 via manual from AU — Scanned from AU

Summary

This website contacted 3 IPs in 4 countries across 2 domains to perform 3 HTTP transactions. The main IP is 42.200.136.40, located in Central, Hong Kong and belongs to HKTIMS-AP HKT Limited, HK. The main domain is 42.200.136.40.
This is the only time 42.200.136.40 was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 67.199.248.11 396982 (GOOGLE-CL...)
1 45.117.80.159 131353 (NHANHOA-A...)
1 42.200.136.40 4760 (HKTIMS-AP...)
1 177.54.22.22 262447 (IMG BRASI...)
3 3
Apex Domain
Subdomains
Transfer
1 imgtelecom.com.br
imgtelecom.com.br
187 B
1 bit.ly
bit.ly — Cisco Umbrella Rank: 4998
307 B
3 2
Domain Requested by
1 imgtelecom.com.br
1 bit.ly 1 redirects
3 2

This site contains no links.

Subject Issuer Validity Valid
imgtelecom.com.br
cPanel, Inc. Certification Authority
2022-09-09 -
2022-12-08
3 months crt.sh

This page contains 1 frames:

Frame: https://imgtelecom.com.br/boleto/boleto2/phpC/email/phpmailer/language/token_345678909876543RTYJGF/TRGVdv3.php?e=UYTFhghjYTD67GHv
Frame ID: BD7B75BFE9AD359516D8AEE762403DB0
Requests: 3 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://bit.ly/3g86xcU HTTP 301
    http://45.117.80.159:32000/mail/pda/skins/default/images/NxdS8ezQDGHd/9cXDsqZAtfR/IbG7dsDRSxwD/ST30g.ht... Page URL
  2. http://42.200.136.40:8888/mail/pda/skins/default/images/Jb5xdSwqJHu0n/N7ccS4.html Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

3
Requests

33 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

4
Countries

1 kB
Transfer

0 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://bit.ly/3g86xcU HTTP 301
    http://45.117.80.159:32000/mail/pda/skins/default/images/NxdS8ezQDGHd/9cXDsqZAtfR/IbG7dsDRSxwD/ST30g.html?e=YTRcfREnRSX65fgcfgh Page URL
  2. http://42.200.136.40:8888/mail/pda/skins/default/images/Jb5xdSwqJHu0n/N7ccS4.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://bit.ly/3g86xcU HTTP 301
  • http://45.117.80.159:32000/mail/pda/skins/default/images/NxdS8ezQDGHd/9cXDsqZAtfR/IbG7dsDRSxwD/ST30g.html?e=YTRcfREnRSX65fgcfgh

3 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
ST30g.html
45.117.80.159/mail/pda/skins/default/images/NxdS8ezQDGHd/9cXDsqZAtfR/IbG7dsDRSxwD/
Redirect Chain
  • https://bit.ly/3g86xcU
  • http://45.117.80.159:32000/mail/pda/skins/default/images/NxdS8ezQDGHd/9cXDsqZAtfR/IbG7dsDRSxwD/ST30g.html?e=YTRcfREnRSX65fgcfgh
152 B
273 B
Document
General
Full URL
http://45.117.80.159:32000/mail/pda/skins/default/images/NxdS8ezQDGHd/9cXDsqZAtfR/IbG7dsDRSxwD/ST30g.html?e=YTRcfREnRSX65fgcfgh
Protocol
HTTP/1.1
Server
45.117.80.159 , Viet Nam, ASN131353 (NHANHOA-AS-VN NhanHoa Software company, VN),
Reverse DNS
mail.artjsc.vn
Software
IceWarp/8.3 /
Resource Hash
a5b34838677564bc31ceb856ad4fbc66724310be61fc897a914c20c9084ecc69

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language
en-AU,en;q=0.9

Response headers

Connection
close
Content-type
text/html
Date
Mon, 17 Oct 2022 23:26:42 GMT
Server
IceWarp/8.3

Redirect headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=90
content-length
214
content-type
text/html; charset=utf-8
date
Mon, 17 Oct 2022 23:26:42 GMT
location
http://45.117.80.159:32000/mail/pda/skins/default/images/NxdS8ezQDGHd/9cXDsqZAtfR/IbG7dsDRSxwD/ST30g.html?e=YTRcfREnRSX65fgcfgh
server
nginx
via
1.1 google
Primary Request N7ccS4.html
42.200.136.40/mail/pda/skins/default/images/Jb5xdSwqJHu0n/
200 B
323 B
Document
General
Full URL
http://42.200.136.40:8888/mail/pda/skins/default/images/Jb5xdSwqJHu0n/N7ccS4.html
Protocol
HTTP/1.1
Server
42.200.136.40 Central, Hong Kong, ASN4760 (HKTIMS-AP HKT Limited, HK),
Reverse DNS
42-200-136-40.static.imsbiz.com
Software
IceWarp/4.1 /
Resource Hash
b34d1daaeb7fac11d4c0c3c489ff681526569e56fd5b5c0ee7ccd721734a5bce

Request headers

Referer
http://45.117.80.159:32000/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language
en-AU,en;q=0.9

Response headers

Connection
close
Content-type
text/html
Date
Tue, 18 Oct 2022 07:26:42 +0800
Server
IceWarp/4.1
TRGVdv3.php
imgtelecom.com.br/boleto/boleto2/phpC/email/phpmailer/language/token_345678909876543RTYJGF/
0
187 B
Document
General
Full URL
https://imgtelecom.com.br/boleto/boleto2/phpC/email/phpmailer/language/token_345678909876543RTYJGF/TRGVdv3.php?e=UYTFhghjYTD67GHv
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
177.54.22.22 Mage, Brazil, ASN262447 (IMG BRASIL TELECOMUNICACOES LTDA, BR),
Reverse DNS
nsc03.afinet.com.br
Software
Apache /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
http://42.200.136.40:8888/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language
en-AU,en;q=0.9

Response headers

Connection
Keep-Alive
Content-Length
0
Content-Type
text/html; charset=UTF-8
Date
Mon, 17 Oct 2022 23:26:44 GMT
Keep-Alive
timeout=5, max=100
Server
Apache

Verdicts & Comments Add Verdict or Comment

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation

1 Cookies

Domain/Path Name / Value
.bit.ly/ Name: _bit
Value: m9hnqG-9a09cafc2ba9c967bf-00N

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bit.ly
imgtelecom.com.br
177.54.22.22
42.200.136.40
45.117.80.159
67.199.248.11
a5b34838677564bc31ceb856ad4fbc66724310be61fc897a914c20c9084ecc69
b34d1daaeb7fac11d4c0c3c489ff681526569e56fd5b5c0ee7ccd721734a5bce
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855