urlscan.io logo urlscan.io
SecurityTrails logo

cesaconstrucciones.com.ar Open in urlscan Pro
200.80.43.130  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://cesaconstrucciones.com.ar/ali
Effective URL: http://cesaconstrucciones.com.ar/ali/
Submission: On March 27 via api from JP — Scanned from JP
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 2 HTTP transactions. The main IP is 200.80.43.130, located in Zárate, Argentina and belongs to IFX18747, US. The main domain is cesaconstrucciones.com.ar.
This is the only time cesaconstrucciones.com.ar was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Email (Online)

Domain & IP information

IP Address AS Autonomous System
1 2 200.80.43.130 18747 (IFX18747)
1 2606:4700:303... 13335 (CLOUDFLAR...)
2 2
Apex Domain
Subdomains		 Transfer
2 cesaconstrucciones.com.ar
cesaconstrucciones.com.ar
6 KB
1 iconarchive.com
icons.iconarchive.com — Cisco Umbrella Rank: 66414
7 KB
2 2
Domain Requested by
2 cesaconstrucciones.com.ar 1 redirects
1 icons.iconarchive.com cesaconstrucciones.com.ar
2 2

This site contains no links.

Subject Issuer Validity Valid

This page contains 1 frames:

Primary Page: http://cesaconstrucciones.com.ar/ali/
Frame ID: 2B2646EDFB3D40C41770F73279E5FABC
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Email Settings | For:

Page URL History Show full URLs

  1. http://cesaconstrucciones.com.ar/ali HTTP 301
    http://cesaconstrucciones.com.ar/ali/ Page URL

Page Statistics

2
Requests

0 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

13 kB
Transfer

12 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://cesaconstrucciones.com.ar/ali HTTP 301
    http://cesaconstrucciones.com.ar/ali/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
cesaconstrucciones.com.ar/ali/
Redirect Chain
  • http://cesaconstrucciones.com.ar/ali
  • http://cesaconstrucciones.com.ar/ali/
5 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://cesaconstrucciones.com.ar/ali/
Protocol
HTTP/1.1
Server
200.80.43.130 Zárate, Argentina, ASN18747 (IFX18747, US),
Reverse DNS
cra3.toservers.com
Software
Apache/2.4.52 (cPanel) OpenSSL/1.1.1m mod_bwlimited/1.4 Phusion_Passenger/6.0.10 / PHP/7.4.28
Resource Hash
54359f64d75161fed73048deef796ad5a4e7ae4ea49407e0187a9206b76a4c2b

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
jp-JP,jp;q=0.9

Response headers

Date
Sun, 27 Mar 2022 08:01:26 GMT
Server
Apache/2.4.52 (cPanel) OpenSSL/1.1.1m mod_bwlimited/1.4 Phusion_Passenger/6.0.10
X-Powered-By
PHP/7.4.28
Keep-Alive
timeout=5, max=99
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8

Redirect headers

Date
Sun, 27 Mar 2022 08:01:26 GMT
Server
Apache/2.4.52 (cPanel) OpenSSL/1.1.1m mod_bwlimited/1.4 Phusion_Passenger/6.0.10
Location
http://cesaconstrucciones.com.ar/ali/
Content-Length
245
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Content-Type
text/html; charset=iso-8859-1
email-2-icon.png
icons.iconarchive.com/icons/graphicloads/100-flat/256/ 		6 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://icons.iconarchive.com/icons/graphicloads/100-flat/256/email-2-icon.png
Requested by
Host: cesaconstrucciones.com.ar
URL: http://cesaconstrucciones.com.ar/ali/
Protocol
HTTP/1.1
Server
2606:4700:3038::6815:e9b6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9b76980f800f067d6c3210912939795ad385e827cd768ed1a1498fc8ff09669c

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
http://cesaconstrucciones.com.ar/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Sun, 27 Mar 2022 08:06:59 GMT
CF-Cache-Status
HIT
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Age
1186
Connection
keep-alive
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
Content-Length
6590
Last-Modified
Wed, 08 Jul 2020 23:41:28 GMT
Server
cloudflare
ETag
"5f0659a8-19be"
Vary
Accept-Encoding
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OCAr2LDFvIxZ9g%2BC1YGEbrLzXd%2BN4B8H21LsaNDJey5zLD7fq19aqerx9exkt8q3r6QrB1B0iqhNLA4i0PoITbBe6Zan5MUudZVBUefL%2BNwdqmvvOf%2BRiRY3kDlklPNLaYaE2G0LC9VJ8HVKiSWHyiybw94%3D"}],"group":"cf-nel","max_age":604800}
Content-Type
image/png
Cache-Control
max-age=14400
Accept-Ranges
bytes
CF-RAY
6f26a13acda780a5-NRT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone object| oncontextlost object| oncontextrestored string| message function| clickIE function| clickNS function| disableCtrlKeyCombination

0 Cookies

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cesaconstrucciones.com.ar
icons.iconarchive.com
200.80.43.130
2606:4700:3038::6815:e9b6
54359f64d75161fed73048deef796ad5a4e7ae4ea49407e0187a9206b76a4c2b
9b76980f800f067d6c3210912939795ad385e827cd768ed1a1498fc8ff09669c