imduyv.gob.mx
Open in
urlscan Pro
68.65.121.216
Malicious Activity!
Public Scan
Effective URL: http://imduyv.gob.mx/~wp-lgs.php/?url=Ly8vbW9iaWxlZnJhbmNlL2xvZ2luLz8mYW1wO2k9M1dKSUo=
Submission: On April 13 via automatic, source openphish — Scanned from DE
Summary
This is the only time imduyv.gob.mx was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Facebook (Social Network)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 69.61.26.123 69.61.26.123 | 141518 (SUBHOST-A...) (SUBHOST-AS-IN Subhosting Innovations Pvt Ltd) | |
1 | 2a00:1450:400... 2a00:1450:4001:82a::2002 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:810::2008 | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a00:1450:400... 2a00:1450:4001:812::200e | 15169 (GOOGLE) (GOOGLE) | |
3 | 2a00:1450:400... 2a00:1450:4001:813::2002 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:80e::2002 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:806::2002 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:831::2001 | 15169 (GOOGLE) (GOOGLE) | |
3 | 68.65.121.216 68.65.121.216 | 22612 (NAMECHEAP...) (NAMECHEAP-NET) | |
3 | 2a00:1450:400... 2a00:1450:4001:80f::2002 | 15169 (GOOGLE) (GOOGLE) | |
3 | 2a00:1450:400... 2a00:1450:4001:80e::2001 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:806::2004 | 15169 (GOOGLE) (GOOGLE) | |
1 | 190.115.26.9 190.115.26.9 | 262254 (DDOS-GUAR...) (DDOS-GUARD CORP.) | |
22 | 13 |
ASN141518 (SUBHOST-AS-IN Subhosting Innovations Pvt Ltd, IN)
v.ht |
ASN15169 (GOOGLE, US)
www.googletagservices.com |
ASN15169 (GOOGLE, US)
www.googletagmanager.com |
ASN15169 (GOOGLE, US)
www.google-analytics.com |
ASN15169 (GOOGLE, US)
securepubads.g.doubleclick.net |
ASN15169 (GOOGLE, US)
f7ed47b6723b28e100e45018918a8d6b.safeframe.googlesyndication.com |
ASN22612 (NAMECHEAP-NET, US)
PTR: premium41-4.web-hosting.com
imduyv.gob.mx |
ASN15169 (GOOGLE, US)
pagead2.googlesyndication.com |
ASN15169 (GOOGLE, US)
tpc.googlesyndication.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
googlesyndication.com
f7ed47b6723b28e100e45018918a8d6b.safeframe.googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 111 tpc.googlesyndication.com — Cisco Umbrella Rank: 145 |
40 KB |
3 |
imduyv.gob.mx
imduyv.gob.mx |
3 KB |
3 |
doubleclick.net
securepubads.g.doubleclick.net — Cisco Umbrella Rank: 201 |
125 KB |
2 |
google.com
adservice.google.com — Cisco Umbrella Rank: 90 www.google.com — Cisco Umbrella Rank: 2 |
2 KB |
2 |
google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 35 |
20 KB |
1 |
cutlinks.ca
cutlinks.ca |
|
1 |
google.de
adservice.google.de — Cisco Umbrella Rank: 7832 |
531 B |
1 |
googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 62 |
44 KB |
1 |
googletagservices.com
www.googletagservices.com — Cisco Umbrella Rank: 198 |
26 KB |
1 |
v.ht
v.ht |
2 KB |
22 | 10 |
Domain | Requested by | |
---|---|---|
3 | tpc.googlesyndication.com |
securepubads.g.doubleclick.net
tpc.googlesyndication.com |
3 | pagead2.googlesyndication.com |
securepubads.g.doubleclick.net
tpc.googlesyndication.com |
3 | imduyv.gob.mx |
v.ht
imduyv.gob.mx |
3 | securepubads.g.doubleclick.net |
www.googletagservices.com
securepubads.g.doubleclick.net |
2 | www.google-analytics.com |
www.googletagmanager.com
www.google-analytics.com |
1 | cutlinks.ca |
imduyv.gob.mx
|
1 | www.google.com |
tpc.googlesyndication.com
|
1 | f7ed47b6723b28e100e45018918a8d6b.safeframe.googlesyndication.com |
securepubads.g.doubleclick.net
|
1 | adservice.google.com |
securepubads.g.doubleclick.net
|
1 | adservice.google.de |
securepubads.g.doubleclick.net
|
1 | www.googletagmanager.com |
v.ht
|
1 | www.googletagservices.com |
v.ht
|
1 | v.ht | |
22 | 13 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
www.v.ht R3 |
2023-03-01 - 2023-05-30 |
3 months | crt.sh |
*.g.doubleclick.net GTS CA 1C3 |
2023-03-28 - 2023-06-20 |
3 months | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2023-03-28 - 2023-06-20 |
3 months | crt.sh |
*.google.de GTS CA 1C3 |
2023-03-28 - 2023-06-20 |
3 months | crt.sh |
*.google.com GTS CA 1C3 |
2023-03-28 - 2023-06-20 |
3 months | crt.sh |
tpc.googlesyndication.com GTS CA 1C3 |
2023-03-28 - 2023-06-20 |
3 months | crt.sh |
www.google.com GTS CA 1C3 |
2023-03-28 - 2023-06-20 |
3 months | crt.sh |
cutlinks.ca R3 |
2023-04-07 - 2023-07-06 |
3 months | crt.sh |
This page contains 5 frames:
Primary Page:
http://imduyv.gob.mx/~wp-lgs.php/?url=Ly8vbW9iaWxlZnJhbmNlL2xvZ2luLz8mYW1wO2k9M1dKSUo=
Frame ID: C7A47E0C09CBA0DC3AD5088AC81EA585
Requests: 14 HTTP requests in this frame
Frame:
https://f7ed47b6723b28e100e45018918a8d6b.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 950C9D76D3C3224297762E20BE7F1E1D
Requests: 1 HTTP requests in this frame
Frame:
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: C707C8530A239E4A67997C5A7B92AD4D
Requests: 3 HTTP requests in this frame
Frame:
https://www.google.com/recaptcha/api2/aframe
Frame ID: 03B653D2BBC95ACD213EE18B30EBAF74
Requests: 2 HTTP requests in this frame
Frame:
http://imduyv.gob.mx/js-LUpZoDg///mobilefrance/login/?&i=3WJIJ
Frame ID: DF6D799307DCADDF1D368EAD44CDCF12
Requests: 2 HTTP requests in this frame
Screenshot
Page Title
Login into.......Page URL History Show full URLs
- https://v.ht/Ggkgkfkycx58 Page URL
- http://imduyv.gob.mx/~wp-lgs.php/?url=Ly8vbW9iaWxlZnJhbmNlL2xvZ2luLz8mYW1wO2k9M1dKSUo= Page URL
Detected technologies
DoubleClick for Publishers (DFP) (Advertising Networks) ExpandDetected patterns
- googletagservices\.com/tag/js/gpt(?:_mobile)?\.js
Google AdSense (Advertising Networks) Expand
Detected patterns
- googlesyndication\.com/
Google Analytics (Analytics) Expand
Detected patterns
- google-analytics\.com/(?:ga|urchin|analytics)\.js
Google Tag Manager (Tag Managers) Expand
Detected patterns
- googletagmanager\.com/gtag/js
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://v.ht/Ggkgkfkycx58 Page URL
- http://imduyv.gob.mx/~wp-lgs.php/?url=Ly8vbW9iaWxlZnJhbmNlL2xvZ2luLz8mYW1wO2k9M1dKSUo= Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
22 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Ggkgkfkycx58
v.ht/ |
3 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gpt.js
www.googletagservices.com/tag/js/ |
77 KB 26 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
112 KB 44 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ |
49 KB 20 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pubads_impl.js
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304050101/ |
399 KB 124 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ppub_config
securepubads.g.doubleclick.net/pagead/ |
26 B 572 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
www.google-analytics.com/j/ |
1 B 198 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
integrator.js
adservice.google.de/adsid/ |
107 B 531 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
integrator.js
adservice.google.com/adsid/ |
107 B 456 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ads
securepubads.g.doubleclick.net/gampad/ |
649 B 696 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
container.html
f7ed47b6723b28e100e45018918a8d6b.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 950C |
6 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
/
imduyv.gob.mx/~wp-lgs.php/ |
658 B 689 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sodar
pagead2.googlesyndication.com/getconfig/ |
15 KB 11 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sodar2.js
tpc.googlesyndication.com/sodar/ |
17 KB 7 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
runner.html
tpc.googlesyndication.com/sodar/sodar2/225/ Frame C707 |
13 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
aframe
www.google.com/recaptcha/api2/ Frame 03B6 |
783 B 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
eGrdt-GuiAstYDBBFPRlHe36qu4ukgnY6P6eKjFBaNs.js
pagead2.googlesyndication.com/bg/ Frame C707 |
36 KB 14 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
sodar
pagead2.googlesyndication.com/pagead/ Frame 03B6 |
0 0 |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
generate_204
tpc.googlesyndication.com/ Frame C707 |
0 10 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
AJz0j8
cutlinks.ca/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
imduyv.gob.mx/js-LUpZoDg///mobilefrance/login/ Frame DF6D |
2 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
stylesheet.css
imduyv.gob.mx/js-LUpZoDg///mobilefrance/login/ Frame DF6D |
1 KB 908 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Facebook (Social Network)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 boolean| credentialless6 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.v.ht/ | Name: _ga Value: GA1.2.229622058.1681360341 |
|
.v.ht/ | Name: _gid Value: GA1.2.1775304235.1681360341 |
|
.v.ht/ | Name: _gat_gtag_UA_31510493_3 Value: 1 |
|
.doubleclick.net/ | Name: test_cookie Value: CheckForPermission |
|
.v.ht/ | Name: __gads Value: ID=b1d0174dda02f311:T=1681360341:S=ALNI_MaqxTqqxuxf2Yv6zZrWrxG1SkL0NA |
|
.v.ht/ | Name: __gpi Value: UID=00000bd522f5d856:T=1681360341:RT=1681360341:S=ALNI_Mae5eivDs0bYMag5BMvqFYKCf7tig |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31536000; includeSubdomains; |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
adservice.google.com
adservice.google.de
cutlinks.ca
f7ed47b6723b28e100e45018918a8d6b.safeframe.googlesyndication.com
imduyv.gob.mx
pagead2.googlesyndication.com
securepubads.g.doubleclick.net
tpc.googlesyndication.com
v.ht
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.googletagservices.com
190.115.26.9
2a00:1450:4001:806::2002
2a00:1450:4001:806::2004
2a00:1450:4001:80e::2001
2a00:1450:4001:80e::2002
2a00:1450:4001:80f::2002
2a00:1450:4001:810::2008
2a00:1450:4001:812::200e
2a00:1450:4001:813::2002
2a00:1450:4001:82a::2002
2a00:1450:4001:831::2001
68.65.121.216
69.61.26.123
0f4cc238ed96d4fc4705f9d9f5b0f6b279d6d895c48c48995cd580c7d79daa64
19dc99a8224767e303208b156949a2c7b99e67dbe02ef9aa078fecaa28d3616e
2d1a754922199186d43c7e76757eddaeb26e350387294e0f69ac574bc54914f9
549feae64965edf6cd1bedf9b849f2e5f0b8220cf91edce44d1fe02aa412141d
5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
7ad0e404ece4ab38d0f230cb38cf116809888c1ec224ea16afbf6e2807bcbc6b
989f27bfbbc048404c954358337f42340b82c2fa13944b6da95d61ff5e08e42d
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a5b55ccac98c9c0491d5809c8c3a78df0f7002766d1df81392355b2e1c981671
d33f663b286fd1ac9e8b1994a0779efffa8b65695f6e3bce059f0853eddd4f1b
ebc624137943611046328b7760741c84c78820058c21640eee4dbb7d40ff3a1c