rv-ranjan.za.com Open in urlscan Pro
185.221.216.115  Malicious Activity! Public Scan

Submitted URL: http://rv-ranjan.za.com/cgialfa/symperl.htm
Effective URL: https://rv-ranjan.za.com/cgialfa/symperl.htm
Submission: On July 04 via api from US — Scanned from GB

Summary

This website contacted 4 IPs in 3 countries across 3 domains to perform 9 HTTP transactions. The main IP is 185.221.216.115, located in London, United Kingdom and belongs to HOST4GEEKS-LLC, US. The main domain is rv-ranjan.za.com.
TLS certificate: Issued by R3 on June 5th 2024. Valid for: 3 months.
This is the only time rv-ranjan.za.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Email (Online)

Domain & IP information

IP Address AS Autonomous System
2 185.221.216.115 393960 (HOST4GEEK...)
6 219.118.67.12 2514 (INFOSPHER...)
1 2a04:4e42::649 54113 (FASTLY)
9 4
Apex Domain
Subdomains
Transfer
6 earth-core.jp
webmail.earth-core.jp
13 KB
2 za.com
rv-ranjan.za.com
44 KB
1 jquery.com
code.jquery.com — Cisco Umbrella Rank: 816
30 KB
9 3
Domain Requested by
6 webmail.earth-core.jp rv-ranjan.za.com
webmail.earth-core.jp
2 rv-ranjan.za.com rv-ranjan.za.com
1 code.jquery.com rv-ranjan.za.com
9 3

This site contains no links.

Subject Issuer Validity Valid
rv-ranjan.za.com
R3
2024-06-05 -
2024-09-03
3 months crt.sh
*.earth-core.jp
JPRS Domain Validation Authority - G4
2023-07-11 -
2024-07-31
a year crt.sh
*.jquery.com
Sectigo ECC Domain Validation Secure Server CA
2024-06-25 -
2025-06-25
a year crt.sh

This page contains 1 frames:

Primary Page: https://rv-ranjan.za.com/cgialfa/symperl.htm
Frame ID: 3DA1DF8E365086C2FB109D4365290F94
Requests: 10 HTTP requests in this frame

Screenshot

Page Title

:: Welcome to Webmail

Page URL History Show full URLs

  1. http://rv-ranjan.za.com/cgialfa/symperl.htm HTTP 307
    https://rv-ranjan.za.com/cgialfa/symperl.htm Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Overall confidence: 100%
Detected patterns
  • jquery-ui.*\.js

Page Statistics

9
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

4
IPs

3
Countries

87 kB
Transfer

197 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://rv-ranjan.za.com/cgialfa/symperl.htm HTTP 307
    https://rv-ranjan.za.com/cgialfa/symperl.htm Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request symperl.htm
rv-ranjan.za.com/cgialfa/
Redirect Chain
  • http://rv-ranjan.za.com/cgialfa/symperl.htm
  • https://rv-ranjan.za.com/cgialfa/symperl.htm
191 B
433 B
Document
General
Full URL
https://rv-ranjan.za.com/cgialfa/symperl.htm
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
185.221.216.115 London, United Kingdom, ASN393960 (HOST4GEEKS-LLC, US),
Reverse DNS
sokhanedoost.com
Software
Apache /
Resource Hash
e4cf7496fb629c7aa46647145476f04c2e964d4d8b5ec7f01448af6910f31890

Request headers

Accept-Language
en-GB,en;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Accept-Ranges
bytes
Connection
Keep-Alive
Content-Length
191
Content-Type
text/html
Date
Thu, 04 Jul 2024 21:38:43 GMT
Keep-Alive
timeout=5, max=100
Last-Modified
Wed, 03 Jul 2024 00:21:51 GMT
Server
Apache

Redirect headers

Location
https://rv-ranjan.za.com/cgialfa/symperl.htm
Non-Authoritative-Reason
HttpsUpgrades
jquery.js
rv-ranjan.za.com/alfacgiapi/
43 KB
44 KB
Script
General
Full URL
https://rv-ranjan.za.com/alfacgiapi/jquery.js
Requested by
Host: rv-ranjan.za.com
URL: https://rv-ranjan.za.com/cgialfa/symperl.htm
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
185.221.216.115 London, United Kingdom, ASN393960 (HOST4GEEKS-LLC, US),
Reverse DNS
sokhanedoost.com
Software
Apache /
Resource Hash
dca3d8ac1917b8d47a545feb0614c42d11d501067e1105cba1ec3fdf3b9fd8c9

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://rv-ranjan.za.com/cgialfa/symperl.htm
Accept-Language
en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 04 Jul 2024 21:38:43 GMT
Last-Modified
Wed, 03 Jul 2024 00:11:15 GMT
Server
Apache
Content-Type
text/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
44402
common.min.css
webmail.earth-core.jp/skins/classic/
14 KB
4 KB
Stylesheet
General
Full URL
https://webmail.earth-core.jp/skins/classic/common.min.css?s=1415172545
Requested by
Host: rv-ranjan.za.com
URL: https://rv-ranjan.za.com/alfacgiapi/jquery.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
219.118.67.12 , Japan, ASN2514 (INFOSPHERE NTT PC Communications, Inc., JP),
Reverse DNS
webmail.earth-core.jp
Software
Apache /
Resource Hash
a6eaf994e7a16aa9b5c156b2e4a96adae87f06c5237c60e559863ace8ac9b02d
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://rv-ranjan.za.com/
Accept-Language
en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 04 Jul 2024 21:38:44 GMT
Content-Encoding
gzip
Last-Modified
Wed, 05 Nov 2014 07:29:05 GMT
Server
Apache
ETag
"1004a4f0-389f-5071788d73240"
X-Frame-Options
SAMEORIGIN
Vary
Accept-Encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=15, max=100
Content-Length
3757
jquery-ui-1.9.2.custom.css
webmail.earth-core.jp/plugins/jqueryui/themes/classic/
34 KB
6 KB
Stylesheet
General
Full URL
https://webmail.earth-core.jp/plugins/jqueryui/themes/classic/jquery-ui-1.9.2.custom.css?s=1415172545
Requested by
Host: rv-ranjan.za.com
URL: https://rv-ranjan.za.com/alfacgiapi/jquery.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
219.118.67.12 , Japan, ASN2514 (INFOSPHERE NTT PC Communications, Inc., JP),
Reverse DNS
webmail.earth-core.jp
Software
Apache /
Resource Hash
fee5a30ddc52ae26830d5e5c91ad1e765f8cfd3f00c093ba9bc804683ee8fa64
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://rv-ranjan.za.com/
Accept-Language
en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 04 Jul 2024 21:38:44 GMT
Content-Encoding
gzip
Last-Modified
Wed, 05 Nov 2014 07:29:05 GMT
Server
Apache
ETag
"10049fd6-890c-5071788d73240"
X-Frame-Options
SAMEORIGIN
Vary
Accept-Encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=15, max=100
Content-Length
6245
jquery-3.1.1.min.js
code.jquery.com/
85 KB
30 KB
Script
General
Full URL
https://code.jquery.com/jquery-3.1.1.min.js
Requested by
Host: rv-ranjan.za.com
URL: https://rv-ranjan.za.com/alfacgiapi/jquery.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://rv-ranjan.za.com/
Accept-Language
en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 04 Jul 2024 21:38:43 GMT
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
age
3858766
x-cache
HIT, HIT
content-length
30070
x-served-by
cache-lga21947-LGA, cache-lcy-eglc8600094-LCY
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
server
nginx
x-timer
S1720129124.500962,VS0,VE0
etag
W/"28feccc0-152b5"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=604800
accept-ranges
bytes
x-cache-hits
78, 38605
no-logo.png
webmail.earth-core.jp/skins/default//images/
182 B
486 B
Image
General
Full URL
https://webmail.earth-core.jp/skins/default//images/no-logo.png
Requested by
Host: rv-ranjan.za.com
URL: https://rv-ranjan.za.com/alfacgiapi/jquery.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
219.118.67.12 , Japan, ASN2514 (INFOSPHERE NTT PC Communications, Inc., JP),
Reverse DNS
webmail.earth-core.jp
Software
Apache /
Resource Hash
4cbb138f810bdde4e309dc7b9e6d3d09510f7df1e139d95666253c43f16708d0
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://rv-ranjan.za.com/
Accept-Language
en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 04 Jul 2024 21:38:44 GMT
Last-Modified
Wed, 01 Apr 2015 05:22:39 GMT
Server
Apache
ETag
"4cb9f-b6-512a2e75cd961"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=15, max=100
Content-Length
182
truncated
/
19 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
24ed9db3eb0d97ecf1f0832cbd30bd37744e0d2b520ccdad5af60f7a08a45b90

Request headers

Accept-Language
en-GB,en;q=0.9;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type
image/gif
listheader.gif
webmail.earth-core.jp/skins/classic/images/
314 B
621 B
Image
General
Full URL
https://webmail.earth-core.jp/skins/classic/images/listheader.gif?v=ab42.314
Requested by
Host: webmail.earth-core.jp
URL: https://webmail.earth-core.jp/skins/classic/common.min.css?s=1415172545
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
219.118.67.12 , Japan, ASN2514 (INFOSPHERE NTT PC Communications, Inc., JP),
Reverse DNS
webmail.earth-core.jp
Software
Apache /
Resource Hash
cf8e517f37fafd1177b366b0b39d616c71bcee9fec89ae17f6108dca319de1a0
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://webmail.earth-core.jp/skins/classic/common.min.css?s=1415172545
Accept-Language
en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 04 Jul 2024 21:38:44 GMT
Last-Modified
Wed, 05 Nov 2014 07:29:05 GMT
Server
Apache
ETag
"1004a546-13a-5071788d73240"
X-Frame-Options
SAMEORIGIN
Content-Type
image/gif
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=15, max=99
Content-Length
314
bg.gif
webmail.earth-core.jp/skins/classic/images/buttons/
196 B
502 B
Image
General
Full URL
https://webmail.earth-core.jp/skins/classic/images/buttons/bg.gif?v=30b2.196
Requested by
Host: webmail.earth-core.jp
URL: https://webmail.earth-core.jp/skins/classic/common.min.css?s=1415172545
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
219.118.67.12 , Japan, ASN2514 (INFOSPHERE NTT PC Communications, Inc., JP),
Reverse DNS
webmail.earth-core.jp
Software
Apache /
Resource Hash
581d7ca4ed46235b1b20393209eea721cc12937269a882e5a0299215cbf793c1
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://webmail.earth-core.jp/skins/classic/common.min.css?s=1415172545
Accept-Language
en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 04 Jul 2024 21:38:44 GMT
Last-Modified
Wed, 05 Nov 2014 07:29:05 GMT
Server
Apache
ETag
"200cab82-c4-5071788d73240"
X-Frame-Options
SAMEORIGIN
Content-Type
image/gif
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=15, max=99
Content-Length
196
favicon.ico
webmail.earth-core.jp/skins/default//images/
1 KB
1 KB
Other
General
Full URL
https://webmail.earth-core.jp/skins/default//images/favicon.ico
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
219.118.67.12 , Japan, ASN2514 (INFOSPHERE NTT PC Communications, Inc., JP),
Reverse DNS
webmail.earth-core.jp
Software
Apache /
Resource Hash
8436b8d56ce0596f7df21bb46cac82344d082d6a1f481bd9ad3e08fe7834bf25
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://rv-ranjan.za.com/
Accept-Language
en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 04 Jul 2024 21:38:45 GMT
Last-Modified
Fri, 10 Apr 2015 07:07:10 GMT
Server
Apache
ETag
"4cb91-47e-5135969b46380"
X-Frame-Options
SAMEORIGIN
Content-Type
image/x-icon
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=15, max=98
Content-Length
1150

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

undefined| event object| fence object| sharedStorage string| userinfo string| authdone function| _0x1fa76f function| _0x42c1 function| _0x23ac function| $ function| jQuery function| _0x5bbd function| _0x59c9

0 Cookies

3 Console Messages

Source Level URL
Text
javascript warning URL: https://rv-ranjan.za.com/alfacgiapi/jquery.js
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.1.1.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://rv-ranjan.za.com/alfacgiapi/jquery.js
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.1.1.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
recommendation verbose URL: https://rv-ranjan.za.com/cgialfa/symperl.htm
Message:
[DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o