URL: http://pauliusb.eu/zimbra/index.php?email=satheesh.k@hindujaleylandfinance.com
Submission: On September 26 via automatic, source openphish — Scanned from DE

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 3 HTTP transactions. The main IP is 92.61.37.67, located in Lithuania and belongs to TELIA-LIETUVA, LT. The main domain is pauliusb.eu.
This is the only time pauliusb.eu was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 92.61.37.67 43811 (TELIA-LIE...)
2 103.20.91.67 58381 (WOWRACK-A...)
3 2
Apex Domain
Subdomains
Transfer
2 ptpn12.com
mail.ptpn12.com
25 KB
1 pauliusb.eu
pauliusb.eu
5 KB
3 2
Domain Requested by
2 mail.ptpn12.com pauliusb.eu
mail.ptpn12.com
1 pauliusb.eu
3 2

This site contains links to these domains. Also see Links.

Domain
www.zimbra.com
blog.zimbra.com
wiki.zimbra.com
Subject Issuer Validity Valid
*.ptpn12.com
Sectigo RSA Domain Validation Secure Server CA
2021-04-16 -
2022-05-16
a year crt.sh

This page contains 1 frames:

Primary Page: http://pauliusb.eu/zimbra/index.php?email=satheesh.k@hindujaleylandfinance.com
Frame ID: 2D649D0097C3D77CA360A121FD75145E
Requests: 3 HTTP requests in this frame

Screenshot

Page Title

Zimbra Web Client Sign In

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

3
Requests

67 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

30 kB
Transfer

77 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request index.php
pauliusb.eu/zimbra/
5 KB
5 KB
Document
General
Full URL
http://pauliusb.eu/zimbra/index.php?email=satheesh.k@hindujaleylandfinance.com
Protocol
HTTP/1.1
Server
92.61.37.67 , Lithuania, ASN43811 (TELIA-LIETUVA, LT),
Reverse DNS
ltvnsplsk67.hostex.lt
Software
Apache / PHP/5.6.40 PleskLin
Resource Hash
4238a5dd702bbf68f884a27e5df659bb57139eec97eb35d47d60ebf1a78c5e84

Request headers

Host
pauliusb.eu
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

Date
Sun, 26 Sep 2021 13:10:11 GMT
Server
Apache
X-Powered-By
PHP/5.6.40 PleskLin
Keep-Alive
timeout=2, max=100
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
common,login,zhtml,skin.css
mail.ptpn12.com/zimbra/css/
60 KB
12 KB
Stylesheet
General
Full URL
https://mail.ptpn12.com/zimbra/css/common,login,zhtml,skin.css?skin=harmony&v=141215153341
Requested by
Host: pauliusb.eu
URL: http://pauliusb.eu/zimbra/index.php?email=satheesh.k@hindujaleylandfinance.com
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.20.91.67 Surabaya, Indonesia, ASN58381 (WOWRACK-AS-ID Wow Internet Indonesia, ID),
Reverse DNS
mail.ptpn12.com
Software
nginx /
Resource Hash
26eb658aaea4e3695ad5a9067b8c9508d03229ef9422299243696b0be5ce7a39
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://pauliusb.eu/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Sun, 26 Sep 2021 13:09:01 GMT
Content-Encoding
gzip
Server
nginx
X-Frame-Options
SAMEORIGIN
Vary
User-Agent, Accept-Encoding, User-Agent
Connection
keep-alive
Content-Type
text/css
Cache-Control
public, max-age=2595600
Transfer-Encoding
chunked
Strict-Transport-Security
max-age=31536000
Expires
Tue, 26 Oct 2021 14:09:00 GMT
LoginBanner_white.png
mail.ptpn12.com/zimbra/skins/_base/logos/
12 KB
13 KB
Image
General
Full URL
https://mail.ptpn12.com/zimbra/skins/_base/logos/LoginBanner_white.png?v=141215153344
Requested by
Host: mail.ptpn12.com
URL: https://mail.ptpn12.com/zimbra/css/common,login,zhtml,skin.css?skin=harmony&v=141215153341
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.20.91.67 Surabaya, Indonesia, ASN58381 (WOWRACK-AS-ID Wow Internet Indonesia, ID),
Reverse DNS
mail.ptpn12.com
Software
nginx /
Resource Hash
e9938d831d47476ba1bae2c1116bae70493e98b384cc14c15a5e348a38c01942
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://mail.ptpn12.com/zimbra/css/common,login,zhtml,skin.css?skin=harmony&v=141215153341
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Sun, 26 Sep 2021 13:09:02 GMT
Content-Encoding
gzip
Last-Modified
Mon, 15 Dec 2014 21:11:16 GMT
Server
nginx
X-Frame-Options
SAMEORIGIN
Vary
Accept-Encoding, User-Agent
Connection
keep-alive
Content-Type
image/png
Cache-Control
public, max-age=2595600
Strict-Transport-Security
max-age=31536000
Accept-Ranges
bytes
Content-Length
12444
Expires
Tue, 26 Oct 2021 14:09:02 GMT

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect boolean| originAgentCluster

0 Cookies

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

mail.ptpn12.com
pauliusb.eu
103.20.91.67
92.61.37.67
26eb658aaea4e3695ad5a9067b8c9508d03229ef9422299243696b0be5ce7a39
4238a5dd702bbf68f884a27e5df659bb57139eec97eb35d47d60ebf1a78c5e84
e9938d831d47476ba1bae2c1116bae70493e98b384cc14c15a5e348a38c01942