![](/screenshots/925222e9-944c-4c9f-a5bc-ac9c169a4511.png)
utgz.edu.mx
Open in
urlscan Pro
192.175.102.69
Malicious Activity!
Public Scan
Effective URL: https://utgz.edu.mx/Login/
Submission: On September 08 via manual from US
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on August 15th 2020. Valid for: 3 months.
This is the only time utgz.edu.mx was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Walmart (Retail)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 52.71.28.102 52.71.28.102 | 14618 (AMAZON-AES) (AMAZON-AES) | |
1 | 2a03:6f00:1::... 2a03:6f00:1::5c35:60ba | 9123 (TIMEWEB-AS) (TIMEWEB-AS) | |
15 | 192.175.102.69 192.175.102.69 | 32613 (IWEB-AS) (IWEB-AS) | |
1 | 2a00:1288:f03... 2a00:1288:f03d:1fa::4000 | 10310 (YAHOO-1) (YAHOO-1) | |
4 | 212.82.100.181 212.82.100.181 | 34010 (YAHOO-IRD) (YAHOO-IRD) | |
2 | 104.111.243.11 104.111.243.11 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
2 | 35.186.220.184 35.186.220.184 | 15169 (GOOGLE) (GOOGLE) | |
28 | 7 |
ASN14618 (AMAZON-AES, US)
PTR: ec2-52-71-28-102.compute-1.amazonaws.com
urldefense.com |
ASN34010 (YAHOO-IRD, GB)
PTR: spdc.pbp.vip.ir2.yahoo.com
sp.analytics.yahoo.com |
ASN16625 (AKAMAI-AS, US)
PTR: a104-111-243-11.deploy.static.akamaitechnologies.com
i5.walmartimages.com |
ASN15169 (GOOGLE, US)
PTR: 184.220.186.35.bc.googleusercontent.com
collector-pxu6b0qd2s.px-cloud.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
15 |
utgz.edu.mx
utgz.edu.mx |
534 KB |
4 |
yahoo.com
sp.analytics.yahoo.com |
3 KB |
2 |
px-cloud.net
collector-pxu6b0qd2s.px-cloud.net |
2 KB |
2 |
walmartimages.com
i5.walmartimages.com |
35 KB |
1 |
yimg.com
s.yimg.com |
6 KB |
1 |
triplea-prod.ru
triplea-prod.ru |
219 B |
1 |
urldefense.com
1 redirects
urldefense.com |
178 B |
0 |
Failed
function sub() { [native code] }. Failed |
|
28 | 8 |
Domain | Requested by | |
---|---|---|
15 | utgz.edu.mx |
utgz.edu.mx
|
4 | sp.analytics.yahoo.com |
utgz.edu.mx
s.yimg.com |
2 | collector-pxu6b0qd2s.px-cloud.net |
utgz.edu.mx
|
2 | i5.walmartimages.com |
utgz.edu.mx
|
1 | s.yimg.com |
utgz.edu.mx
|
1 | triplea-prod.ru | |
1 | urldefense.com | 1 redirects |
0 | localhost Failed |
utgz.edu.mx
|
28 | 8 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.walmart.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
triplea-prod.ru Let's Encrypt Authority X3 |
2020-09-03 - 2020-12-02 |
3 months | crt.sh |
utgz.edu.mx cPanel, Inc. Certification Authority |
2020-08-15 - 2020-11-13 |
3 months | crt.sh |
*.yahoo.com DigiCert SHA2 High Assurance Server CA |
2020-08-06 - 2020-09-20 |
a month | crt.sh |
*.analytics.yahoo.com DigiCert SHA2 High Assurance Server CA |
2020-08-01 - 2021-01-28 |
6 months | crt.sh |
prod.walmartimages.com GlobalSign RSA OV SSL CA 2018 |
2019-10-30 - 2021-01-09 |
a year | crt.sh |
*.px-cloud.net Let's Encrypt Authority X3 |
2020-08-16 - 2020-11-14 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://utgz.edu.mx/Login/
Frame ID: 4331C490761BA3947C740446013E0A1F
Requests: 28 HTTP requests in this frame
Screenshot
![](/screenshots/925222e9-944c-4c9f-a5bc-ac9c169a4511.png)
Page URL History Show full URLs
-
https://urldefense.com/v3/__https://triplea-prod.ru/y5.html__;!!EFVe01R3CjU!NKDnJebR7B8M6_HeHsLQLL4...
HTTP 302
https://triplea-prod.ru/y5.html Page URL
- https://utgz.edu.mx/Login/ Page URL
Detected technologies
Detected patterns
- headers server /nginx(?:\/([\d.]+))?/i
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://urldefense.com/v3/__https://triplea-prod.ru/y5.html__;!!EFVe01R3CjU!NKDnJebR7B8M6_HeHsLQLL4p_Ng6eDheyIQxUIjkiKWCNqM7WtxZ7p1fw83LnuI$
HTTP 302
https://triplea-prod.ru/y5.html Page URL
- https://utgz.edu.mx/Login/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://urldefense.com/v3/__https://triplea-prod.ru/y5.html__;!!EFVe01R3CjU!NKDnJebR7B8M6_HeHsLQLL4p_Ng6eDheyIQxUIjkiKWCNqM7WtxZ7p1fw83LnuI$ HTTP 302
- https://triplea-prod.ru/y5.html
28 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
y5.html
triplea-prod.ru/ Redirect Chain
|
70 B 219 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
/
utgz.edu.mx/Login/ |
44 KB 44 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
en.js
utgz.edu.mx/Login/ |
9 KB 9 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
BogleWeb_subset.css-e09c55f339aca33445542e98ee6a102f386448f2-orig-br.css
utgz.edu.mx/Login/Lib_OReoo/ |
2 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ytc.js
s.yimg.com/wi/ |
15 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ytc.js
utgz.edu.mx/Login/Lib_OReoo/ |
13 KB 13 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bat.js
utgz.edu.mx/Login/Lib_OReoo/ |
24 KB 24 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
gtm.js
utgz.edu.mx/Login/Lib_OReoo/ |
107 KB 108 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
k2-_aa161a59-9b5f-4b75-8463-d0a5ce60dc0c.v1.js
utgz.edu.mx/Login/Lib_OReoo/ |
45 KB 45 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
min_style.style.5337d178926b4ee24869.css-789bbba3ed72189d643d7a118ab11b9af4063003-orig-br.css
utgz.edu.mx/Login/Lib_OReoo/ |
20 KB 20 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
capabilities.min.js-022ae3e14067e3b787cda8ad9a4a26e268f1fec8-orig-br.js
utgz.edu.mx/Login/Lib_OReoo/ |
46 KB 47 KB |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
init.js
utgz.edu.mx/Login/Lib_OReoo/ |
74 KB 74 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
rum.js
localhost/walmart1/Home/Lib_OReoo/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
rum.js
localhost/walmart1/Home/Lib_OReoo/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
rum.js
localhost/wal/Lib_OReoo/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
min_js.bundle.5337d178926b4ee24869.js-9a47ba4ea14d7ec8eca433ecc69ce84051075033-orig-br.js
utgz.edu.mx/Login/Lib_OReoo/ |
90 KB 90 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cdn-perf.min.js
utgz.edu.mx/Login/Lib_OReoo/ |
4 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
beacon.js
utgz.edu.mx/Login/Lib_OReoo/ |
4 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sp.pl
sp.analytics.yahoo.com/ |
0 857 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sp.pl
sp.analytics.yahoo.com/ |
0 857 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sp.pl
sp.analytics.yahoo.com/ |
0 857 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
spark.svg
utgz.edu.mx/Login/Lib_OReoo/ |
2 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
BogleWeb_subset-Regular.woff2
i5.walmartimages.com/dfw/63fd9f59-a78c/fcfae9b6-2f69-4f89-beed-f0eeb4237946/v1/ |
17 KB 17 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
BogleWeb_subset-Bold.woff2
i5.walmartimages.com/dfw/63fd9f59-a78c/fcfae9b6-2f69-4f89-beed-f0eeb4237946/v1/ |
18 KB 18 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
rum.js
utgz.edu.mx/Login/Lib_OReoo/ |
46 KB 47 KB |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sp.pl
sp.analytics.yahoo.com/ |
0 857 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collector
collector-pxu6b0qd2s.px-cloud.net/api/v2/ |
808 B 1 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collector
collector-pxu6b0qd2s.px-cloud.net/api/v2/ |
520 B 584 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- localhost
- URL
- https://localhost/walmart1/Home/Lib_OReoo/rum.js?mode=release&bh=localhost%2Fwalmart1%2FHome%2FLib_OReoo&bd=&pv_id=d3250e15-93fe-433c-9d5c-087c920b35e2
- Domain
- localhost
- URL
- https://localhost/walmart1/Home/Lib_OReoo/rum.js?mode=release&bh=localhost%2Fwalmart1%2FHome%2FLib_OReoo&bd=&pv_id=e01033cb-d27e-43f7-b8a2-d46ae269be28
- Domain
- localhost
- URL
- https://localhost/wal/Lib_OReoo/rum.js?mode=release&bh=localhost%2Fwal%2FLib_OReoo&bd=&pv_id=3753e553-992b-4e40-b43c-34ddbe5147df
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Walmart (Retail)30 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| trustedTypes object| Aes object| Base64 object| Utf8 string| boat string| aobst string| output string| ctrTxt object| _wml number| TBRewriteHostAltWeight string| _pxAppId string| SW_DOMAIN object| BOOMR object| _tbq object| TB_OPT_Config object| YAHOO object| _bcq object| dotq function| UET object| google_tag_manager object| dataLayer object| t4q object| _cf object| cf string| _sd_trace object| __core-js_shared__ object| core object| PXu6b0qd2S object| PX undefined| _u6b0qd2Shandler5 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.utgz.edu.mx/ | Name: _px3 Value: 703099b0513e90c51eb0c54b0067ae7004e5f5f5b369907629927b1774f4bd20:n3AmaAVkUgWV/B72+tRLLDXHpmTZgr/DvqRyHqJEP1nagFdVN58UULQhEX+4vowIEy+8JD5NnWeElmLXwq/0tw==:1000:VGzNwPjC/6KmiNG/4KBSVTp0wNMSO4AJEIqiHxhcRssXPGrGQ4o99Z7innfZ3pKjHBWGyVPcf5mR6u0C2ZahaWMUXTTvMt6ojM02V4617JVJaDBXfSXLLVl9z3y+2R8kFEmyZuOocxK0uEBHBFITYfeSaW4eeQ5KmQpja6kBb00= |
|
utgz.edu.mx/ | Name: _pxff_cc Value: U2FtZVNpdGU9TGF4Ow== |
|
.utgz.edu.mx/ | Name: _pxde Value: 648dbb5e6da14e22a8a03c54e39245259aaa5f05eda97b184f9812ebaf07db60:eyJ0aW1lc3RhbXAiOjE1OTk1NzQzNDk2ODIsImZfa2IiOjAsImlwY19pZCI6W119 |
|
.utgz.edu.mx/ | Name: _pxvid Value: 53f1c7ea-f1dd-11ea-a4bf-0242ac120008 |
|
utgz.edu.mx/ | Name: _abck Value: gw0wjhuobdhuo7phb95v_1954 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
collector-pxu6b0qd2s.px-cloud.net
i5.walmartimages.com
localhost
s.yimg.com
sp.analytics.yahoo.com
triplea-prod.ru
urldefense.com
utgz.edu.mx
localhost
104.111.243.11
192.175.102.69
212.82.100.181
2a00:1288:f03d:1fa::4000
2a03:6f00:1::5c35:60ba
35.186.220.184
52.71.28.102
0d0cbd713d59b1214b24864c2d86699c88d951162983b8e20011a8738be20589
0f0c350a31a2003d12bce0506f4074b7876dd912fd6640d2722547134dca9f68
1d117db76aed1e544c07169cd6542ae243556095fb8a92d4775e96f86dfb4058
26160a7ac91afffbbea0e6f3bfc5519359e0ed7164682519d2dd70e269d21805
32548efead138191f772d25390523484ecdc9db03ae8c065e617b75793137462
38035dbdfc46c0d29f5ba00623432994304043db344ce95cc12f00d303883f0a
3d21d4f95c12784e0f9fa3c095607b950cdaf2126fba831d3bb9b732f99cc336
65e818adbdc972d37e8b17d0dbcffc7ed141c6df3d4e58d1dc53377ca83fe259
6ea0d356dffb08472d19b8ac4b709b3b577d03281613e6c2013a1da22ec1899e
7bcfc8b5f8ce4157f620fdf9b6e1ef1bde9a8df89bb3848cc22a07425a129014
838d63eac0454836eadee494cc898885b91f56fc225189055e8790e7795bf681
88cf2c9a4c4bcef2aa64fb6ea0f337f78e9a7dc61d87993441369fa5cb429d32
979c75350ac4806eaaeeadc6c8c9d3ca5e16cc91b75ef58a13d498eeb297f52c
9c851f7e15e9c95c052e8c67ff62e4341c9374ae51aba4b7caccb46e5bf411df
a701416834f2183efcfc964684ca508687bf2584f5429dbbc448d8262e0f9120
abd1eef7654d57ebe1683b9ba540044e604194b2c4c991feea61bb43b771173e
d86648e76ba24611ab5d4b455e783f0883b77377618db805768d36db32581565
d9ba2fe346685d07142d6c944b479f618a6f3b0a9b058c79433c07f009e9792e
db542edfd86c350eaef6930809e23c0d2d39eeb0b0bb02a0a17fe0e90aafc2d0
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e9a359a250afd33159f0ea35e0f7db86ffa320fe200279a8824d9f2fde0e8ea1
ee501f5efc4a400035852e5e930412e6be82f58b48efbbb67412d35dc61b3e21