imduyv.gob.mx Open in urlscan Pro
68.65.121.216 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://imduyv.gob.mx/~wp-lms.php/?url=Ly9tb2JpbGVfYmx1ZS9pbmRleC5waHA/JmFtcDtpPUZKRVZQ
Submission: On April 16 via api (April 16th 2023, 3:08:23 pm UTC) from US — Scanned from US

Summary HTTP 18 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 3 countries across 5 domains to perform 18 HTTP transactions. The main IP is 68.65.121.216, located in Saint Petersburg, United States and belongs to NAMECHEAP-NET, US. The main domain is imduyv.gob.mx.

This is the only time imduyv.gob.mx was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
9	68.65.121.216 68.65.121.216	22612 (NAMECHEAP...) (NAMECHEAP-NET)
1	190.115.26.9 190.115.26.9	262254 (DDOS-GUAR...) (DDOS-GUARD CORP.)
2	2606:4700::68... 2606:4700::6812:acf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2607:f8b0:400... 2607:f8b0:4006:80b::2003	15169 (GOOGLE) (GOOGLE)
2	2607:f8b0:402... 2607:f8b0:4020:807::2004	15169 (GOOGLE) (GOOGLE)
18	5

9 68.65.121.216 (Saint Petersburg, United States)

ASN22612 (NAMECHEAP-NET, US)
PTR: premium41-4.web-hosting.com

imduyv.gob.mx	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 190.115.26.9 (Belize City, Belize)

ASN262254 (DDOS-GUARD CORP., BZ)

cutlinks.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:acf (United States)

ASN13335 (CLOUDFLARENET, US)

maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:4006:80b::2003 (New York, United States)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4020:807::2004 (Montreal, Canada)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	imduyv.gob.mx imduyv.gob.mx	354 KB
4	gstatic.com www.gstatic.com	2 KB
2	google.com www.google.com — Cisco Umbrella Rank: 2	33 KB
2	bootstrapcdn.com maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 818	83 KB
1	cutlinks.ca cutlinks.ca
18	5

	Domain	Requested by
9	imduyv.gob.mx	imduyv.gob.mx
4	www.gstatic.com	imduyv.gob.mx www.google.com
2	www.google.com	imduyv.gob.mx
2	maxcdn.bootstrapcdn.com	imduyv.gob.mx maxcdn.bootstrapcdn.com
1	cutlinks.ca	imduyv.gob.mx
18	5

This site contains no links.

Subject Issuer	Validity	Valid
cutlinks.ca R3	`2023-04-07` - `2023-07-06`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-12-30` - `2023-12-30`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2023-03-28` - `2023-06-20`	3 months	crt.sh
www.google.com GTS CA 1C3	`2023-03-28` - `2023-06-20`	3 months	crt.sh

This page contains 4 frames:

Primary Page: http://imduyv.gob.mx/~wp-lms.php/?url=Ly9tb2JpbGVfYmx1ZS9pbmRleC5waHA/JmFtcDtpPUZKRVZQ
Frame ID: 24B87F3FFF04954DCED6BE0FF253CA27
Requests: 2 HTTP requests in this frame

Frame: http://imduyv.gob.mx/js-BWSthHQ//mobile_blue/index.php?&i=FJEVP
Frame ID: 1C7FEB947669B575E5A5AC9F10B930B1
Requests: 7 HTTP requests in this frame

Frame: http://imduyv.gob.mx/js-BWSthHQ//mobile_blue/Facebook%20Login_files/anchor.htm
Frame ID: EC985F1626B3C1DDC53D777C66BA0E9B
Requests: 6 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LecguUUAAAAAGcZhPKHMpRYIjyzHiOBcDt2in0X&co=aHR0cDovL2ltZHV5di5nb2IubXg6ODA.&hl=en&v=4lbq4vBYAu25DMtzZ7GGbfAF&size=invisible&cb=2ai6gr7wb3o6
Frame ID: 8D78F3592A7BCFFDEB28C6C4A4A97E01
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Login into.......

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Page Statistics

18
Requests

44 %
HTTPS

60 %
IPv6

5
Domains

5
Subdomains

5
IPs

3
Countries

472 kB
Transfer

944 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

18 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
imduyv.gob.mx/~wp-lms.php/ 587 B
681 B 221ms
110ms Document
text/html 68.65.121.216
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: http://imduyv.gob.mx/~wp-lms.php/?url=Ly9tb2JpbGVfYmx1ZS9pbmRleC5waHA/JmFtcDtpPUZKRVZQ
Protocol: HTTP/1.1
Server: 68.65.121.216 Saint Petersburg, United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: premium41-4.web-hosting.com
Software: LiteSpeed / PHP/7.0.33
Resource Hash: 25b6e00eae6ae57a51eea2210ff62432513de859998d9dca47748567b43eb180

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

content-encoding: gzip
content-length: 409
content-type: text/html; charset=UTF-8
date: Sun, 16 Apr 2023 15:08:19 GMT
keep-alive: timeout=5, max=100
server: LiteSpeed
vary: Accept-Encoding
x-powered-by: PHP/7.0.33
x-turbo-charged-by: LiteSpeed

GET
H2 404 AJz0j8
cutlinks.ca/ 0
0 760ms
478ms Script
text/html 190.115.26.9
DDOS-GUARD CORP.

General

Check archive.org

Show headers Download Go to

Full URL

https://cutlinks.ca/AJz0j8

Requested by

Host: imduyv.gob.mx
URL: http://imduyv.gob.mx/~wp-lms.php/?url=Ly9tb2JpbGVfYmx1ZS9pbmRleC5waHA/JmFtcDtpPUZKRVZQ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

190.115.26.9 Belize City, Belize, ASN262254 (DDOS-GUARD CORP., BZ),

Reverse DNS

Software

ddos-guard /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;

Request headers

accept-language: en-US,en;q=0.9
Referer: http://imduyv.gob.mx/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests;
date: Sun, 16 Apr 2023 15:08:20 GMT
server: ddos-guard
content-length: 0
content-type: text/html; charset=UTF-8

GET
H/1.1 200
OK index.php Show response
imduyv.gob.mx/js-BWSthHQ//mobile_blue/ Frame 1C7F 4 KB
2 KB 104ms
103ms Document
text/html 68.65.121.216
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: http://imduyv.gob.mx/js-BWSthHQ//mobile_blue/index.php?&i=FJEVP
Requested by: Host: imduyv.gob.mx
URL: http://imduyv.gob.mx/~wp-lms.php/?url=Ly9tb2JpbGVfYmx1ZS9pbmRleC5waHA/JmFtcDtpPUZKRVZQ
Protocol: HTTP/1.1
Server: 68.65.121.216 Saint Petersburg, United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: premium41-4.web-hosting.com
Software: LiteSpeed / PHP/7.0.33
Resource Hash: f1adf3bd41013e705b1257dd8478addbdc83bc1a4b1087212bcff296dbe316e1

Request headers

Referer: http://imduyv.gob.mx/~wp-lms.php/?url=Ly9tb2JpbGVfYmx1ZS9pbmRleC5waHA/JmFtcDtpPUZKRVZQ
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

content-encoding: gzip
content-length: 1745
content-type: text/html; charset=UTF-8
date: Sun, 16 Apr 2023 15:08:19 GMT
keep-alive: timeout=5, max=100
server: LiteSpeed
vary: Accept-Encoding
x-powered-by: PHP/7.0.33
x-turbo-charged-by: LiteSpeed

GET
H2 200 font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/ Frame 1C7F 30 KB
7 KB 136ms
49ms Stylesheet
text/css 2606:4700::6812:acf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css

Requested by

Host: imduyv.gob.mx
URL: http://imduyv.gob.mx/js-BWSthHQ//mobile_blue/index.php?&i=FJEVP

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: http://imduyv.gob.mx/
Origin: http://imduyv.gob.mx
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date: Sun, 16 Apr 2023 15:08:19 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
cdn-edgestorageid: 871
age: 31932
cdn-cachedat: 04/12/2023 18:45:23
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Mon, 25 Jan 2021 22:04:55 GMT
cdn-proxyver: 1.03
cdn-requestpullcode: 200
server: cloudflare
etag: W/"269550530cc127b6aa5a35925a7de6ce"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cache-control: public, max-age=31919000
cdn-requestid: c557688cc54e405d727ec327496f537b
timing-allow-origin: *
cdn-requestcountrycode: US
cdn-status: 200
cf-ray: 7b8d57d03a9a2331-ORD
cdn-requestpullsuccess: True

GET
H/1.1 200
OK style.css
imduyv.gob.mx/js-BWSthHQ//mobile_blue/Facebook%20Login_files/ Frame 1C7F 1 KB
775 B 95ms
95ms Stylesheet
text/css 68.65.121.216
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: http://imduyv.gob.mx/js-BWSthHQ//mobile_blue/Facebook%20Login_files/style.css
Requested by: Host: imduyv.gob.mx
URL: http://imduyv.gob.mx/js-BWSthHQ//mobile_blue/index.php?&i=FJEVP
Protocol: HTTP/1.1
Server: 68.65.121.216 Saint Petersburg, United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: premium41-4.web-hosting.com
Software: LiteSpeed /
Resource Hash: 1d309e54873d9219eec4ca63af38fdd3885de42b10aae999cf1a6bf83aa812c2

Request headers

accept-language: en-US,en;q=0.9
Referer: http://imduyv.gob.mx/js-BWSthHQ//mobile_blue/index.php?&i=FJEVP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date: Sun, 16 Apr 2023 15:08:19 GMT
content-encoding: gzip
last-modified: Sat, 12 Dec 2020 21:10:20 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
keep-alive: timeout=5, max=100
content-length: 398
expires: Sun, 23 Apr 2023 15:08:19 GMT

GET
H/1.1 200
OK recaptcha__en.js Show response
imduyv.gob.mx/js-BWSthHQ//mobile_blue/Facebook%20Login_files/ Frame 1C7F 343 KB
153 KB 104ms
104ms Script
application/javascript 68.65.121.216
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: http://imduyv.gob.mx/js-BWSthHQ//mobile_blue/Facebook%20Login_files/recaptcha__en.js
Requested by: Host: imduyv.gob.mx
URL: http://imduyv.gob.mx/js-BWSthHQ//mobile_blue/index.php?&i=FJEVP
Protocol: HTTP/1.1
Server: 68.65.121.216 Saint Petersburg, United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: premium41-4.web-hosting.com
Software: LiteSpeed /
Resource Hash: 84aff23bb47fbea74e9c9944cc840a4c17dbf1c32fc9f6a5c4717417e02751c6

Request headers

Referer: http://imduyv.gob.mx/js-BWSthHQ//mobile_blue/index.php?&i=FJEVP
Origin: http://imduyv.gob.mx
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date: Sun, 16 Apr 2023 15:08:19 GMT
content-encoding: gzip
last-modified: Sat, 12 Dec 2020 21:10:20 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
keep-alive: timeout=5, max=100
content-length: 155793
expires: Sun, 23 Apr 2023 15:08:19 GMT

GET
H/1.1 200
OK api.js Show response
imduyv.gob.mx/js-BWSthHQ//mobile_blue/Facebook%20Login_files/ Frame 1C7F 884 B
981 B 184ms
93ms Script
application/javascript 68.65.121.216
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: http://imduyv.gob.mx/js-BWSthHQ//mobile_blue/Facebook%20Login_files/api.js
Requested by: Host: imduyv.gob.mx
URL: http://imduyv.gob.mx/js-BWSthHQ//mobile_blue/index.php?&i=FJEVP
Protocol: HTTP/1.1
Server: 68.65.121.216 Saint Petersburg, United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: premium41-4.web-hosting.com
Software: LiteSpeed /
Resource Hash: 5733efc9c2f38b7b1a2fd21a763803c14e7286a6264cb85dd117754da6680c34

Request headers

accept-language: en-US,en;q=0.9
Referer: http://imduyv.gob.mx/js-BWSthHQ//mobile_blue/index.php?&i=FJEVP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date: Sun, 16 Apr 2023 15:08:19 GMT
content-encoding: gzip
last-modified: Sat, 12 Dec 2020 21:10:20 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
keep-alive: timeout=5, max=100
content-length: 590
expires: Sun, 23 Apr 2023 15:08:19 GMT

GET
H2 404 recaptcha__en.js
www.gstatic.com/recaptcha/releases/4lbq4vBYAu25DMtzZ7GGbfAF/ Frame 1C7F 0
0 652ms
421ms Script
text/html 2607:f8b0:4006:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/4lbq4vBYAu25DMtzZ7GGbfAF/recaptcha__en.js

Requested by

Host: imduyv.gob.mx
URL: http://imduyv.gob.mx/js-BWSthHQ//mobile_blue/Facebook%20Login_files/api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80b::2003 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://imduyv.gob.mx/
Origin: http://imduyv.gob.mx
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date: Sun, 16 Apr 2023 15:08:20 GMT
x-content-type-options: nosniff
server: sffe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1621
x-xss-protection: 0

GET
H/1.1 200
OK anchor.htm Show response
imduyv.gob.mx/js-BWSthHQ//mobile_blue/Facebook%20Login_files/ Frame EC98 21 KB
11 KB 95ms
95ms Document
text/html 68.65.121.216
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: http://imduyv.gob.mx/js-BWSthHQ//mobile_blue/Facebook%20Login_files/anchor.htm
Requested by: Host: imduyv.gob.mx
URL: http://imduyv.gob.mx/js-BWSthHQ//mobile_blue/index.php?&i=FJEVP
Protocol: HTTP/1.1
Server: 68.65.121.216 Saint Petersburg, United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: premium41-4.web-hosting.com
Software: LiteSpeed /
Resource Hash: edcd4c49fcb8bf04f1d999fb31c1285eeb6c5939657482019564220ae5f85c84

Request headers

Referer: http://imduyv.gob.mx/js-BWSthHQ//mobile_blue/index.php?&i=FJEVP
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 10828
content-type: text/html
date: Sun, 16 Apr 2023 15:08:20 GMT
keep-alive: timeout=5, max=100
last-modified: Sat, 12 Dec 2020 21:10:20 GMT
server: LiteSpeed
vary: Accept-Encoding
x-turbo-charged-by: LiteSpeed

GET
H2 200 fontawesome-webfont.woff2
maxcdn.bootstrapcdn.com/font-awesome/4.7.0/fonts/ Frame 1C7F 75 KB
76 KB 41ms
40ms Font
font/woff2 2606:4700::6812:acf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0

Requested by

Host: maxcdn.bootstrapcdn.com
URL: https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css
Origin: http://imduyv.gob.mx
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date: Sun, 16 Apr 2023 15:08:20 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 1029
age: 31933
cdn-cachedat: 01/02/2023 00:17:33
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 77160
last-modified: Mon, 25 Jan 2021 22:04:55 GMT
cdn-proxyver: 1.03
cdn-requestpullcode: 200
server: cloudflare
etag: "af7ae505a9eed503f8b8e6982036873e"
vary: Accept-Encoding
content-type: font/woff2
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cache-control: public, max-age=31919000
cdn-requestid: 762b06a1717f34d8622198432f1cf726
accept-ranges: bytes
timing-allow-origin: *
cdn-requestcountrycode: US
cdn-status: 200
cf-ray: 7b8d57d0fbc62331-ORD
cdn-requestpullsuccess: True

GET
H/1.1 200
OK styles__ltr.css
imduyv.gob.mx/js-BWSthHQ//mobile_blue/Facebook%20Login_files/anchor_data/ Frame EC98 50 KB
27 KB 85ms
85ms Stylesheet
text/css 68.65.121.216
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: http://imduyv.gob.mx/js-BWSthHQ//mobile_blue/Facebook%20Login_files/anchor_data/styles__ltr.css
Requested by: Host: imduyv.gob.mx
URL: http://imduyv.gob.mx/js-BWSthHQ//mobile_blue/Facebook%20Login_files/anchor.htm
Protocol: HTTP/1.1
Server: 68.65.121.216 Saint Petersburg, United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: premium41-4.web-hosting.com
Software: LiteSpeed /
Resource Hash: 9f7c3261df3df9aae8b6c8e4433a7ba73cedd3a1c17880764b6728a0f52980c5

Request headers

accept-language: en-US,en;q=0.9
Referer: http://imduyv.gob.mx/js-BWSthHQ//mobile_blue/Facebook%20Login_files/anchor.htm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date: Sun, 16 Apr 2023 15:08:20 GMT
content-encoding: gzip
last-modified: Sat, 12 Dec 2020 21:10:20 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
keep-alive: timeout=5, max=100
content-length: 26848
expires: Sun, 23 Apr 2023 15:08:20 GMT

GET
H/1.1 200
OK recaptcha__en.js Show response
imduyv.gob.mx/js-BWSthHQ//mobile_blue/Facebook%20Login_files/ Frame EC98 343 KB
153 KB 162ms
82ms Script
application/javascript 68.65.121.216
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: http://imduyv.gob.mx/js-BWSthHQ//mobile_blue/Facebook%20Login_files/recaptcha__en.js
Requested by: Host: imduyv.gob.mx
URL: http://imduyv.gob.mx/js-BWSthHQ//mobile_blue/Facebook%20Login_files/anchor.htm
Protocol: HTTP/1.1
Server: 68.65.121.216 Saint Petersburg, United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: premium41-4.web-hosting.com
Software: LiteSpeed /
Resource Hash: 84aff23bb47fbea74e9c9944cc840a4c17dbf1c32fc9f6a5c4717417e02751c6

Request headers

accept-language: en-US,en;q=0.9
Referer: http://imduyv.gob.mx/js-BWSthHQ//mobile_blue/Facebook%20Login_files/anchor.htm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date: Sun, 16 Apr 2023 15:08:20 GMT
content-encoding: gzip
last-modified: Sat, 12 Dec 2020 21:10:20 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
keep-alive: timeout=5, max=100
content-length: 155793
expires: Sun, 23 Apr 2023 15:08:20 GMT

GET
H/1.1 200
OK x4dl7Lk5ENOB7Pbvmb3t7sJ-hPoGBwvfellrHtOoe40.js Show response
imduyv.gob.mx/js-BWSthHQ//mobile_blue/Facebook%20Login_files/anchor_data/ Frame EC98 14 KB
7 KB 168ms
88ms Script
application/javascript 68.65.121.216
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: http://imduyv.gob.mx/js-BWSthHQ//mobile_blue/Facebook%20Login_files/anchor_data/x4dl7Lk5ENOB7Pbvmb3t7sJ-hPoGBwvfellrHtOoe40.js
Requested by: Host: imduyv.gob.mx
URL: http://imduyv.gob.mx/js-BWSthHQ//mobile_blue/Facebook%20Login_files/anchor.htm
Protocol: HTTP/1.1
Server: 68.65.121.216 Saint Petersburg, United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: premium41-4.web-hosting.com
Software: LiteSpeed /
Resource Hash: c78765ecb93910d381ecf6ef99bdedeec27e84fa06070bdf7a596b1ed3a87b8d

Request headers

accept-language: en-US,en;q=0.9
Referer: http://imduyv.gob.mx/js-BWSthHQ//mobile_blue/Facebook%20Login_files/anchor.htm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date: Sun, 16 Apr 2023 15:08:20 GMT
content-encoding: gzip
last-modified: Sat, 12 Dec 2020 21:10:20 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
keep-alive: timeout=5, max=100
content-length: 6540
expires: Sun, 23 Apr 2023 15:08:20 GMT

GET
H2 200 anchor Show response
www.google.com/recaptcha/api2/ Frame 8D78 47 KB
26 KB 215ms
88ms Document
text/html 2607:f8b0:4020:807::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LecguUUAAAAAGcZhPKHMpRYIjyzHiOBcDt2in0X&co=aHR0cDovL2ltZHV5di5nb2IubXg6ODA.&hl=en&v=4lbq4vBYAu25DMtzZ7GGbfAF&size=invisible&cb=2ai6gr7wb3o6

Requested by

Host: imduyv.gob.mx
URL: http://imduyv.gob.mx/js-BWSthHQ//mobile_blue/Facebook%20Login_files/recaptcha__en.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:807::2004 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

d52476a8c39c4655c0b71d6859c16dac10d806ae66f858f5d26f9dc1d36b15f1

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-efuCZk0Aj6PPwW2pct3BUQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://imduyv.gob.mx/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-length: 26176
content-security-policy: script-src 'report-sample' 'nonce-efuCZk0Aj6PPwW2pct3BUQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sun, 16 Apr 2023 15:08:20 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 404 styles__ltr.css
www.gstatic.com/recaptcha/releases/4lbq4vBYAu25DMtzZ7GGbfAF/ Frame 8D78 0
0 689ms
607ms Stylesheet
text/html 2607:f8b0:4006:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.gstatic.com/recaptcha/releases/4lbq4vBYAu25DMtzZ7GGbfAF/styles__ltr.css
Requested by: Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LecguUUAAAAAGcZhPKHMpRYIjyzHiOBcDt2in0X&co=aHR0cDovL2ltZHV5di5nb2IubXg6ODA.&hl=en&v=4lbq4vBYAu25DMtzZ7GGbfAF&size=invisible&cb=2ai6gr7wb3o6
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:80b::2003 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

GET
H3 404 recaptcha__en.js
www.gstatic.com/recaptcha/releases/4lbq4vBYAu25DMtzZ7GGbfAF/ Frame 8D78 0
0 1172ms
1091ms Script
text/html 2607:f8b0:4006:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.gstatic.com/recaptcha/releases/4lbq4vBYAu25DMtzZ7GGbfAF/recaptcha__en.js
Requested by: Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LecguUUAAAAAGcZhPKHMpRYIjyzHiOBcDt2in0X&co=aHR0cDovL2ltZHV5di5nb2IubXg6ODA.&hl=en&v=4lbq4vBYAu25DMtzZ7GGbfAF&size=invisible&cb=2ai6gr7wb3o6
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:80b::2003 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

GET
H/1.1 200
OK x4dl7Lk5ENOB7Pbvmb3t7sJ-hPoGBwvfellrHtOoe40.js Show response
www.google.com/js/bg/ Frame EC98 14 KB
7 KB 98ms
43ms Script
text/javascript 2607:f8b0:4020:807::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://www.google.com/js/bg/x4dl7Lk5ENOB7Pbvmb3t7sJ-hPoGBwvfellrHtOoe40.js

Requested by

Host: imduyv.gob.mx
URL: http://imduyv.gob.mx/js-BWSthHQ//mobile_blue/Facebook%20Login_files/recaptcha__en.js

Protocol

HTTP/1.1

Server

2607:f8b0:4020:807::2004 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c78765ecb93910d381ecf6ef99bdedeec27e84fa06070bdf7a596b1ed3a87b8d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: http://imduyv.gob.mx/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

Date: Sun, 16 Apr 2023 06:02:45 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Age: 32735
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
Cross-Origin-Resource-Policy: cross-origin
Content-Length: 6068
X-XSS-Protection: 0
Last-Modified: Fri, 09 Oct 2020 16:26:02 GMT
Server: sffe
Cross-Origin-Opener-Policy: same-origin; report-to="botguard-scs"
Vary: Accept-Encoding
Report-To: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
Content-Type: text/javascript
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
Expires: Mon, 15 Apr 2024 06:02:45 GMT

GET
H3 200 logo_48.png
www.gstatic.com/recaptcha/api2/ Frame EC98 2 KB
2 KB 65ms
40ms Image
image/png 2607:f8b0:4006:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/recaptcha/api2/logo_48.png

Requested by

Host: imduyv.gob.mx
URL: http://imduyv.gob.mx/js-BWSthHQ//mobile_blue/Facebook%20Login_files/anchor_data/styles__ltr.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2003 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: http://imduyv.gob.mx/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date: Mon, 10 Apr 2023 23:44:18 GMT
x-content-type-options: nosniff
age: 487442
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2228
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
expires: Mon, 17 Apr 2023 23:44:18 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 boolean| credentialless

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

6 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	error	URL: http://imduyv.gob.mx/js-BWSthHQ//mobile_blue/index.php?&i=FJEVP(Line 40) Message: Error while parsing the 'sandbox' attribute: 'allow-storage-access-by-user-activation' is an invalid sandbox flag.
network	error	URL: https://cutlinks.ca/AJz0j8 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://www.gstatic.com/recaptcha/releases/4lbq4vBYAu25DMtzZ7GGbfAF/recaptcha__en.js Message: Failed to load resource: the server responded with a status of 404 ()
security	error	URL: http://imduyv.gob.mx/js-BWSthHQ//mobile_blue/index.php?&i=FJEVP Message: Refused to execute script from 'https://www.gstatic.com/recaptcha/releases/4lbq4vBYAu25DMtzZ7GGbfAF/recaptcha__en.js' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled.
network	error	URL: https://www.gstatic.com/recaptcha/releases/4lbq4vBYAu25DMtzZ7GGbfAF/styles__ltr.css Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://www.gstatic.com/recaptcha/releases/4lbq4vBYAu25DMtzZ7GGbfAF/recaptcha__en.js Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cutlinks.ca
imduyv.gob.mx
maxcdn.bootstrapcdn.com
www.google.com
www.gstatic.com
190.115.26.9
2606:4700::6812:acf
2607:f8b0:4006:80b::2003
2607:f8b0:4020:807::2004
68.65.121.216
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
1d309e54873d9219eec4ca63af38fdd3885de42b10aae999cf1a6bf83aa812c2
25b6e00eae6ae57a51eea2210ff62432513de859998d9dca47748567b43eb180
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
5733efc9c2f38b7b1a2fd21a763803c14e7286a6264cb85dd117754da6680c34
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
84aff23bb47fbea74e9c9944cc840a4c17dbf1c32fc9f6a5c4717417e02751c6
9f7c3261df3df9aae8b6c8e4433a7ba73cedd3a1c17880764b6728a0f52980c5
c78765ecb93910d381ecf6ef99bdedeec27e84fa06070bdf7a596b1ed3a87b8d
d52476a8c39c4655c0b71d6859c16dac10d806ae66f858f5d26f9dc1d36b15f1
edcd4c49fcb8bf04f1d999fb31c1285eeb6c5939657482019564220ae5f85c84
f1adf3bd41013e705b1257dd8478addbdc83bc1a4b1087212bcff296dbe316e1

imduyv.gob.mx Open in urlscan Pro 68.65.121.216 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

18 Requests

44 %HTTPS

60 %IPv6

5 Domains

5 Subdomains

5 IPs

3 Countries

472 kBTransfer

944 kBSize

0 Cookies

0 Outgoing links

Redirected requests

18 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

0 Cookies

6 Console Messages

Indicators

imduyv.gob.mx Open in urlscan Pro
68.65.121.216 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

18
Requests

44 %
HTTPS

60 %
IPv6

5
Domains

5
Subdomains

5
IPs

3
Countries

472 kB
Transfer

944 kB
Size

0
Cookies

18 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!