santhividyalayaicse.com
103.39.135.18  Malicious Activity! Public Scan Open in urlscan Pro

Internal
urlscan.io (IP) urlscan.io (Domain)
Effective Hostname
VirusTotal SecurityTrails crt.sh
Submitted URL
Google Safe Browsing Archive.org
Effective URL Pivot
Google Safe Browsing Archive.org
Effective IP
VirusTotal SecurityTrails Domaintools Censys
Go To Rescan
Add Verdict Report
Submitted URL:
https://tr.ee/NKDYl9nRZ2 13yr old
Effective URL:
https://santhividyalayaicse.com/spoop/pages/login.php 2yr old
Submission: On September 12 via api (September 12th 2026, 6:37:00 pm UTC) from BY — Scanned from US Go Pro

Only in urlscan Pro

  • Select different country locations for Private Scans.
  • Use a global network of additional scanning locations and residential IPs for scanning.
  • Interact with pages while you are scanning them.
  • Download files from remote websites.
  • Scan websites on the Tor Network.
Click for more information
Free trials of urlscan Pro are available.
Summary HTTP 4 Redirects Links 2  Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 4 domains to perform 4 HTTP transactions. The main IP is 103.39.135.18, located in India and belongs to EMAXGLOBAL-AS - EMAX GLOBAL MEDIA PVT. LTD, IN. The main domain is santhividyalayaicse.com. 2yr old
TLS certificate: Issued by YR1 on August 16th 2026. Valid for: 3mo.
This is the only time santhividyalayaicse.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Spotify (Online)

Domain & IP information

IP Address AS Autonomous System
1 1 151.101.130.133 151.101.130.133 54113 (FASTLY) (FASTLY - Fastly)
1 3 103.39.135.18 103.39.135.18 133694 (EMAXGLOBA...) (EMAXGLOBAL-AS - EMAX GLOBAL MEDIA PVT. LTD)
1 151.101.193.155 151.101.193.155 54113 (FASTLY) (FASTLY - Fastly)
1 199.232.210.248 199.232.210.248 54113 (FASTLY) (FASTLY - Fastly)
4 3
Apex Domain
Subdomains		 Transfer
3 santhividyalayaicse.com 1 redirects
santhividyalayaicse.com 2yr old
9 KB
1 scdn.co
www.scdn.co — Cisco Umbrella Rank: 29068 9yr old
4 KB
1 jquery.com
code.jquery.com — Cisco Umbrella Rank: 849 13yr old
31 KB
1 tr.ee 1 redirects
tr.ee — Cisco Umbrella Rank: 106083 13yr old
266 B
4 4
Domain Requested by
3 santhividyalayaicse.com 1 redirects santhividyalayaicse.com
1 www.scdn.co
1 code.jquery.com santhividyalayaicse.com
1 tr.ee 1 redirects
4 4

This site contains links to these domains. Also see Links.

Domain
policies.google.com
Subject Issuer Validity Valid
*.santhividyalayaicse.com
YR1		 2026-08-16 -
2026-11-14		 3mo crt.sh
*.jquery.com
Sectigo Public Server Authentication CA DV E36		 2026-05-20 -
2026-12-04		 7mo crt.sh
*.scdn.co
GlobalSign Atlas R3 DV TLS CA 2025 Q4		 2025-12-14 -
2027-01-15		 1yr crt.sh

This page contains 1 frames:

Primary Page: https://santhividyalayaicse.com/spoop/pages/login.php
Frame ID: 597C61562DC399FBB2DCC59F658164C2
Requests: 4 HTTP requests in this frame

Screenshot Go Pro

Only in urlscan Pro

Use the Visual Search feature to find pages with visually similar screenshots.
Click for more information
Free trials of urlscan Pro are available.
Full Image

Page Title

Spotify

Page URL History Go Pro

Only in urlscan Pro

Search our real-time database of newly observed domains and hostnames. Pivot on different attributes, and setup keyword alerts for newly observed domains.
Click for more information
Free trials of urlscan Pro are available.
 Show full URLs

  1. https://tr.ee/NKDYl9nRZ2 HTTP 302
    https://santhividyalayaicse.com/spoop/?lt_utm_source=lt_admin_share_link HTTP 302
    https://santhividyalayaicse.com/spoop/pages/login.php Page URL

Detected technologies

(Programming languages)
Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)
(JavaScript libraries)
Overall confidence: 100%
Detected patterns
  • jquery
  • /jquery(?:-(\d+\.\d+\.\d+))[/.-]
(CDN)
Overall confidence: 100%
Detected patterns
  • code\.jquery\.com/

Page Statistics

4
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

43 kB
Transfer

118 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://tr.ee/NKDYl9nRZ2 HTTP 302
    https://santhividyalayaicse.com/spoop/?lt_utm_source=lt_admin_share_link HTTP 302
    https://santhividyalayaicse.com/spoop/pages/login.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions Go Pro

Only in urlscan Pro

Inspect WebSocket connections, examine POST data effortlessly, and track overlap counts in real time. Features live search and filtering across all HTTP output, complete with full response metadata for deep analysis.
Click for more information
Free trials of urlscan Pro are available.
0 data transactions

Method
Protocol		 Status Resource
Path		 Size
x-fer		 Time
Latency		 Type
MIME-Type		 IP
Location
GET
H/1.1 		200
OK 		Primary Request login.php Show response
santhividyalayaicse.com/spoop/pages/
Redirect Chain
  • https://tr.ee/NKDYl9nRZ2
  • https://santhividyalayaicse.com/spoop/?lt_utm_source=lt_admin_share_link
  • https://santhividyalayaicse.com/spoop/pages/login.php
14 KB
4 KB 		472ms
471ms 		Document
text/html		 103.39.135.18
EMAX GLOBAL MEDIA...
General
Check archive.org
Download Go to
Full URL
https://santhividyalayaicse.com/spoop/pages/login.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
103.39.135.18 , India, ASN133694 (EMAXGLOBAL-AS - EMAX GLOBAL MEDIA PVT. LTD, IN),
Reverse DNS
ind2.webspacekit.com
Software
Apache /
Resource Hash
d404e0fe5d5c28f04384adb68061d411d059703ca5ccccecbe456602c8cf9e32

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="153", "Google Chrome";v="153", "Not_A Brand";v="8"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Linux"

Response headers

Cache-Control
no-store, no-cache, must-revalidate
Connection
Keep-Alive
Content-Encoding
gzip
Content-Length
4156
Content-Type
text/html; charset=UTF-8
Date
Sat, 12 Sep 2026 18:37:02 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive
timeout=5, max=99
Pragma
no-cache
Server
Apache
Vary
Accept-Encoding

Redirect headers

Cache-Control
no-store, no-cache, must-revalidate
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
Date
Sat, 12 Sep 2026 18:37:01 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive
timeout=5, max=100
Location
pages/login.php
Pragma
no-cache
Server
Apache
Transfer-Encoding
chunked
GET
H/1.1 		200
OK 		antibot.js Show response
santhividyalayaicse.com/spoop/assets/js/ 		13 KB
4 KB 		260ms
258ms 		Script
text/javascript		 103.39.135.18
EMAX GLOBAL MEDIA...
General
Check archive.org
Download Go to
Full URL
https://santhividyalayaicse.com/spoop/assets/js/antibot.js
Requested by
Host: santhividyalayaicse.com
URL: https://santhividyalayaicse.com/spoop/pages/login.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
103.39.135.18 , India, ASN133694 (EMAXGLOBAL-AS - EMAX GLOBAL MEDIA PVT. LTD, IN),
Reverse DNS
ind2.webspacekit.com
Software
Apache /
Resource Hash
0c05da42232688ecb6f7e2671a3f34895be98718f818b82cdb307ab02da004cd

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://santhividyalayaicse.com/spoop/pages/login.php
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="153", "Google Chrome";v="153", "Not_A Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

Cache-Control
max-age=2592000, public
Content-Encoding
gzip
Connection
Keep-Alive
Expires
Mon, 12 Oct 2026 18:37:02 GMT
Accept-Ranges
bytes
Content-Length
3599
Keep-Alive
timeout=5, max=98
Date
Sat, 12 Sep 2026 18:37:02 GMT
Last-Modified
Sat, 18 Oct 2025 23:17:30 GMT
Vary
Accept-Encoding
Server
Apache
Content-Type
text/javascript; charset=utf-8
GET
H2 		200
 jquery-3.6.0.min.js Show response
code.jquery.com/ 		87 KB
31 KB 		233ms
19ms 		Script
application/javascript		 151.101.193.155
Fastly
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.6.0.min.js
Requested by
Host: santhividyalayaicse.com
URL: https://santhividyalayaicse.com/spoop/pages/login.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.155 , United States, ASN54113 (FASTLY - Fastly, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://santhividyalayaicse.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="153", "Google Chrome";v="153", "Not_A Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
etag
W/"28feccc0-15d9d"
age
1670595
x-cache
HIT, HIT
date
Sat, 12 Sep 2026 18:37:04 GMT
content-type
application/javascript; charset=utf-8
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
x-cache-hits
668492, 75041
x-served-by
cache-lga21931-LGA, cache-pdk-kfty8610044-PDK
vary
Accept-Encoding
cache-control
public, max-age=31536000, stale-while-revalidate=604800
x-timer
S1789238224.060672,VS0,VE0
cross-origin-resource-policy
cross-origin
via
1.1 varnish, 1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
30875
server
nginx
GET
H/1.1 		200
OK 		favicon.png
www.scdn.co/i/_global/ 		4 KB
4 KB 		88ms
18ms 		Other
image/png		 199.232.210.248
Fastly
General
Check archive.org
Download Go to
Full URL
https://www.scdn.co/i/_global/favicon.png
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
199.232.210.248 , United States, ASN54113 (FASTLY - Fastly, Inc., US),
Reverse DNS
Software
/
Resource Hash
0c7ee91862c795f69147f2174a919b1303dd28ce8ceccabe3f50ae219bfb01b7

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://santhividyalayaicse.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="153", "Google Chrome";v="153", "Not_A Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

x-goog-metageneration
1
x-amz-meta-goog-reserved-file-mtime
1670576184
ETag
"326dfa6c84225dfca443693e985fdaab"
Age
1629124
x-goog-stored-content-encoding
identity
X-Cache
HIT, HIT
x-goog-stored-content-length
3646
Date
Sat, 12 Sep 2026 18:37:04 GMT
Content-Type
image/png
Last-Modified
Fri, 09 Dec 2022 09:15:44 GMT
X-Served-By
cache-chi-kmdw8640085-CHI, cache-pdk-kfty8610041-PDK
X-Cache-Hits
1459, 4428
Cache-Control
public, max-age=31536000
Timing-Allow-Origin
*
Connection
keep-alive
x-amz-checksum-crc32c
iuRMew==
Accept-Ranges
bytes
Access-Control-Allow-Origin
*
x-goog-generation
1670577344003625
Content-Length
3646

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Spotify (Online) Go Pro

Only in urlscan Pro

Use our Phishing URL feed to retrieve phishing pages targeting 3000+ brands in real-time. Set up monitoring and alerts. Use maliciousness scores and AI-powered brand name recognition to hunt for brand impersonation.
Click for more information
Free trials of urlscan Pro are available.

3 JavaScript Window variables Go Pro

Only in urlscan Pro

Inspect and pivot on JavaScript variables, identifiers, and other key site metadata data with urlscan Pro. Reveal and search on client-side frameworks, runtime variables, and custom values.
Click for more information
Free trials of urlscan Pro are available.

These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.

function| getAntiBotToken function| $ function| jQuery

3 Cookies Go Pro

Only in urlscan Pro

Review, search, and pivot on browser cookies and persistence site data to see how a site tracks users and keeps sessions alive across visits.
Click for more information
Free trials of urlscan Pro are available.

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path Expires Name / Value
santhividyalayaicse.com/ 1970-01-21
17:00:41 		Name: PHPSESSID
Value: 4d7a46f93dfa6eeb12ccd015987be8cc
santhividyalayaicse.com/ 1970-01-21
17:00:41 		Name: _test
Value: 1
santhividyalayaicse.com/ 1970-01-21
17:00:41 		Name: _abp
Value: eyJmcCI6IncyNDBpMCIsImNmcCI6Ii01YmV6NTUiLCJtbSI6MCwiYyI6MCwiayI6MCwicyI6MCwidCI6MjE3NSwidHMiOjAsInNjIjp7IndpZHRoIjoxNjAwLCJoZWlnaHQiOjEyMDAsImNvbG9yRGVwdGgiOjI0LCJwaXhlbERlcHRoIjoyNCwiYXZhaWxXaWR0aCI6MTYwMCwiYXZhaWxIZWlnaHQiOjEyMDB9LCJicyI6MzAsInYiOiIxLjAifQ==

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source Level URL
Text
deprecation warning URL: https://santhividyalayaicse.com/spoop/assets/js/antibot.js(Line 118)
Message:
The ScriptProcessorNode is deprecated. Use AudioWorkletNode instead. (https://bit.ly/audio-worklet)
rendering warning URL: https://santhividyalayaicse.com/spoop/pages/login.php
Message:
[]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader flag to opt in to lower security guarantees for trusted content.