198.102.61.248 - urlscan.io

Summary

This website contacted 1 IPs in 1 countries across 0 domains to perform 3 HTTP transactions. The main IP is 198.102.61.248, located in Redlands, United States and belongs to ESRI, US. The main domain is 198.102.61.248.
TLS certificate: Issued by DigiCert SHA2 High Assurance Server CA on August 29th 2019. Valid for: 2 years.

This is the only time 198.102.61.248 was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address		AS Autonomous System
1 4	198.102.61.248 198.102.61.248		10411 (ESRI) (ESRI)
3	1

4 198.102.61.248 (Redlands, United States) 1 redirects

ASN10411 (ESRI, US)

198.102.61.248	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	0

	Domain	Requested by
3	0

This site contains no links.

Subject Issuer	Validity	Valid
*.esri.com DigiCert SHA2 High Assurance Server CA	`2019-08-29` - `2021-07-01`	2 years	crt.sh

This page contains 1 frames:

Primary Page: https://198.102.61.248/index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars
Frame ID: 0AACA9CB43D28ABC4812598009588D5F
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://198.102.61.248/index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars HTTP 302
https://198.102.61.248/index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

3
Requests

0 %
HTTPS

0 %
IPv6

0
Domains

0
Subdomains

1
IPs

1
Countries

74 kB
Transfer

184 kB
Size

6
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://198.102.61.248/index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars HTTP 302
https://198.102.61.248/index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

410
Gone

Primary Request

Cookie set index.php Show response
198.102.61.248/
Redirect Chain

http://198.102.61.248/index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars
https://198.102.61.248/index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars

1011 B
1 KB

863ms
178ms

Document
text/html

198.102.61.248
ESRI

General

Check archive.org

Show headers Download Go to

Full URL: https://198.102.61.248/index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 198.102.61.248 Redlands, United States, ASN10411 (ESRI, US),
Reverse DNS
Software: nginx /
Resource Hash: bce8629c16c7bdda84d78142f788e31e8fa901209b7f48dbcef71a5997801b50

Request headers

Host: 198.102.61.248
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 28 Mar 2021 19:00:44 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
X-OneAgent-JS-Injection: true
X-ruxit-JS-Agent: true
Server-Timing: dtRpid;desc="-121558349"
Set-Cookie: dtCookie=v_4_srv_6_sn_12BC0FB4979BFF29FAF6FB4B93A1DCE2_perc_100000_ol_0_mul_1_rcs-3Acss_0; Path=/

Redirect headers

Location: https://198.102.61.248/index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars
Server: BigIP
Connection: Keep-Alive
Content-Length: 0

GET
H/1.1 200
OK ruxitagentjs_ICA2SVfqru_10211210318124316.js Show response
198.102.61.248/ 183 KB
72 KB 347ms
346ms Script
text/javascript 198.102.61.248
ESRI

General

Check archive.org

Show headers Download Go to

Full URL

https://198.102.61.248/ruxitagentjs_ICA2SVfqru_10211210318124316.js

Requested by

Host: 198.102.61.248
URL: https://198.102.61.248/index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_256_GCM

Server

198.102.61.248 Redlands, United States, ASN10411 (ESRI, US),

Reverse DNS

Software

nginx /

Resource Hash

d27788062eecc5daed762c7cd7e107318efb2831495082e624047b95fef8430e

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://198.102.61.248/index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 28 Mar 2021 19:00:44 GMT
Content-Encoding: gzip
X-Upstream-HTTP-Server: nginx
Last-Modified: Wed, 03 Mar 2010 07:01:40 GMT
Server: nginx
X-Upstream-Response-Time: 1616958044.205
X-Frame-Options: SAMEORIGIN
Content-Type: text/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000, immutable
X-Upstream: 10.37.160.1:8100
Connection: keep-alive
Content-Length: 72882
X-Upstream-Status: 200
Expires: Mon, 28 Mar 2022 19:00:44 GMT

POST
H/1.1 200
OK rb_bf33006wli Show response
198.102.61.248/ 120 B
569 B 177ms
176ms XHR
text/plain 198.102.61.248
ESRI

General

Check archive.org

Show headers Download Go to

Full URL

https://198.102.61.248/rb_bf33006wli?type=js&session=v_4_srv_6_sn_12BC0FB4979BFF29FAF6FB4B93A1DCE2_perc_100000_ol_0_mul_1_rcs-3Acss_0&svrid=6&flavor=post&visitID=LAKJCRPJATQRMKPDAJPHPKKAJRIUJPHK-0&modifiedSince=1616121456258&referer=https%3A%2F%2F198.102.61.248%2Findex.php%3Fs%3D%2FIndex%2F%5Cthink%5Capp%2Finvokefunction%26function%3Dcall_user_func_array%26vars&app=ea7c4b59f27d43eb&crc=4046353146&end=1

Requested by

Host: 198.102.61.248
URL: https://198.102.61.248/ruxitagentjs_ICA2SVfqru_10211210318124316.js

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_256_GCM

Server

198.102.61.248 Redlands, United States, ASN10411 (ESRI, US),

Reverse DNS

Software

nginx /

Resource Hash

cd6502229896199f90e091238085b0b75d1e204e82eb0e4dc9486eec6322d39c

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://198.102.61.248/index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Sun, 28 Mar 2021 19:00:46 GMT
X-Upstream-HTTP-Server: nginx
Server: nginx
X-Upstream-Response-Time: 1616958046.581
X-Frame-Options: SAMEORIGIN
Content-Type: text/plain; charset=utf-8
X-Upstream: 10.37.160.1:8100
Connection: keep-alive
Content-Length: 120
X-Upstream-Status: 200

Verdicts & Comments Add Verdict or Comment

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

6 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
198.102.61.248/	1969-12-31 23:59:59	Name: dtPC Value: 6$558045379_289h2vLAKJCRPJATQRMKPDAJPHPKKAJRIUJPHK-0e1
198.102.61.248/	1969-12-31 23:59:59	Name: rxvt Value: 1616959845405\|1616958045387
198.102.61.248/	1969-12-31 23:59:59	Name: dtSa Value: -
198.102.61.248/	1969-12-31 23:59:59	Name: rxVisitor Value: 1616958045384T3NOEI0APC246EU9J1JPGFCT1QP2SLIG
198.102.61.248/	1969-12-31 23:59:59	Name: dtLatC Value: 517
198.102.61.248/	1969-12-31 23:59:59	Name: dtCookie Value: v_4_srv_6_sn_12BC0FB4979BFF29FAF6FB4B93A1DCE2_perc_100000_ol_0_mul_1_rcs-3Acss_0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

198.102.61.248
bce8629c16c7bdda84d78142f788e31e8fa901209b7f48dbcef71a5997801b50
cd6502229896199f90e091238085b0b75d1e204e82eb0e4dc9486eec6322d39c
d27788062eecc5daed762c7cd7e107318efb2831495082e624047b95fef8430e

198.102.61.248 Open in urlscan Pro 198.102.61.248 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

3 Requests

0 %HTTPS

0 %IPv6

0 Domains

0 Subdomains

1 IPs

1 Countries

74 kBTransfer

184 kBSize

6 Cookies

0 Outgoing links

Page URL History

Redirected requests

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

11 JavaScript Global Variables

6 Cookies

Indicators

198.102.61.248 Open in urlscan Pro
198.102.61.248 Public Scan

Screenshot
Live screenshot

Full Image

3
Requests

0 %
HTTPS

0 %
IPv6

0
Domains

0
Subdomains

1
IPs

1
Countries

74 kB
Transfer

184 kB
Size

6
Cookies

3 HTTP transactions
0 data transactions