urlscan.io logo urlscan.io
SecurityTrails logo

irmall.superghs.com Open in urlscan Pro
119.31.233.123  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://tothe.win/4ABU
Effective URL: https://irmall.superghs.com/backup/Auto/verify.php?tz1nhfkj-un82-buzf-kwys-ge5tsrfhv9o7_9htcl68rev1ysd4pg3qkzf5bn2am0wi7xoju...
Submission: On October 10 via manual from AU — Scanned from AU
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 2 countries across 2 domains to perform 3 HTTP transactions. The main IP is 119.31.233.123, located in Singapore and belongs to DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU. The main domain is irmall.superghs.com.
TLS certificate: Issued by R3 on August 13th 2022. Valid for: 3 months.
This is the only time irmall.superghs.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 3.33.152.147 16509 (AMAZON-02)
1 4 119.31.233.123 38719 (DREAMSCAP...)
3 1
Apex Domain
Subdomains		 Transfer
4 superghs.com
irmall.superghs.com
301 KB
1 tothe.win
tothe.win
286 B
3 2
Domain Requested by
4 irmall.superghs.com 1 redirects irmall.superghs.com
1 tothe.win 1 redirects
3 2

This site contains no links.

Subject Issuer Validity Valid
irmall.superghs.com
R3		 2022-08-13 -
2022-11-11		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://irmall.superghs.com/backup/Auto/verify.php?tz1nhfkj-un82-buzf-kwys-ge5tsrfhv9o7_9htcl68rev1ysd4pg3qkzf5bn2am0wi7xoju3crfil8vqs6x90bnja74wo2gmtk1pzhudy5ebuank26o7hr8swdftv9lzgcmpxje0iq41y35&frt=jhg&data=
Frame ID: EECE91ECBD4FA7F83907C115A28DB253
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Mailer

Page URL History Show full URLs

  1. http://tothe.win/4ABU HTTP 302
    https://irmall.superghs.com/backup/Auto HTTP 301
    https://irmall.superghs.com/backup/Auto/ Page URL
  2. https://irmall.superghs.com/backup/Auto/verify.php?tz1nhfkj-un82-buzf-kwys-ge5tsrfhv9o7_9htcl68rev1ysd4p... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

3
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

1
IPs

2
Countries

301 kB
Transfer

299 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://tothe.win/4ABU HTTP 302
    https://irmall.superghs.com/backup/Auto HTTP 301
    https://irmall.superghs.com/backup/Auto/ Page URL
  2. https://irmall.superghs.com/backup/Auto/verify.php?tz1nhfkj-un82-buzf-kwys-ge5tsrfhv9o7_9htcl68rev1ysd4pg3qkzf5bn2am0wi7xoju3crfil8vqs6x90bnja74wo2gmtk1pzhudy5ebuank26o7hr8swdftv9lzgcmpxje0iq41y35&frt=jhg&data= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://tothe.win/4ABU HTTP 302
  • https://irmall.superghs.com/backup/Auto HTTP 301
  • https://irmall.superghs.com/backup/Auto/

3 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
irmall.superghs.com/backup/Auto/
Redirect Chain
  • http://tothe.win/4ABU
  • https://irmall.superghs.com/backup/Auto
  • https://irmall.superghs.com/backup/Auto/
747 B
953 B 		Document
General
Check archive.org
Download Go to
Full URL
https://irmall.superghs.com/backup/Auto/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
119.31.233.123 , Singapore, ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU),
Reverse DNS
server1.superghs.com
Software
Apache /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language
en-AU,en;q=0.9

Response headers

cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length
747
content-type
text/html; charset=UTF-8
date
Mon, 10 Oct 2022 06:57:52 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
pragma
no-cache
server
Apache

Redirect headers

content-length
248
content-type
text/html; charset=iso-8859-1
date
Mon, 10 Oct 2022 06:57:51 GMT
location
https://irmall.superghs.com/backup/Auto/
server
Apache
Primary Request verify.php
irmall.superghs.com/backup/Auto/ 		26 KB
27 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://irmall.superghs.com/backup/Auto/verify.php?tz1nhfkj-un82-buzf-kwys-ge5tsrfhv9o7_9htcl68rev1ysd4pg3qkzf5bn2am0wi7xoju3crfil8vqs6x90bnja74wo2gmtk1pzhudy5ebuank26o7hr8swdftv9lzgcmpxje0iq41y35&frt=jhg&data=
Requested by
Host: irmall.superghs.com
URL: https://irmall.superghs.com/backup/Auto/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
119.31.233.123 , Singapore, ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU),
Reverse DNS
server1.superghs.com
Software
Apache /
Resource Hash
3fad7a44a8297eaa27092fe6edf9bc06206d72dd34e3ee1f63fd3ce92730b593

Request headers

Referer
https://irmall.superghs.com/backup/Auto/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language
en-AU,en;q=0.9

Response headers

content-type
text/html; charset=UTF-8
date
Mon, 10 Oct 2022 06:57:52 GMT
server
Apache
lib.js
irmall.superghs.com/backup/Auto/ 		272 KB
274 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://irmall.superghs.com/backup/Auto/lib.js
Requested by
Host: irmall.superghs.com
URL: https://irmall.superghs.com/backup/Auto/verify.php?tz1nhfkj-un82-buzf-kwys-ge5tsrfhv9o7_9htcl68rev1ysd4pg3qkzf5bn2am0wi7xoju3crfil8vqs6x90bnja74wo2gmtk1pzhudy5ebuank26o7hr8swdftv9lzgcmpxje0iq41y35&frt=jhg&data=
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
119.31.233.123 , Singapore, ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU),
Reverse DNS
server1.superghs.com
Software
Apache /
Resource Hash
19c2ff8384c14552104a2f7a5a830aef510669837d65fb0c20a9bee749e54b8b

Request headers

accept-language
en-AU,en;q=0.9
Referer
https://irmall.superghs.com/backup/Auto/verify.php?tz1nhfkj-un82-buzf-kwys-ge5tsrfhv9o7_9htcl68rev1ysd4pg3qkzf5bn2am0wi7xoju3crfil8vqs6x90bnja74wo2gmtk1pzhudy5ebuank26o7hr8swdftv9lzgcmpxje0iq41y35&frt=jhg&data=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Mon, 10 Oct 2022 06:57:53 GMT
last-modified
Wed, 14 Jul 2021 04:22:24 GMT
server
Apache
accept-ranges
bytes
content-length
278292
content-type
application/javascript

Verdicts & Comments Add Verdict or Comment

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| $ function| jQuery

1 Cookies

Domain/Path Name / Value
irmall.superghs.com/ Name: PHPSESSID
Value: t5tgg45orgpv81613qaiutqlq3

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

irmall.superghs.com
tothe.win
119.31.233.123
3.33.152.147
19c2ff8384c14552104a2f7a5a830aef510669837d65fb0c20a9bee749e54b8b
3fad7a44a8297eaa27092fe6edf9bc06206d72dd34e3ee1f63fd3ce92730b593