urlscan.io logo urlscan.io
SecurityTrails logo

irmall.superghs.com Open in urlscan Pro
119.31.233.123  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://tothe.win/4ABU
Effective URL: https://irmall.superghs.com/backup/Auto/verify.php?5pgs6kcj-jmvw-0fv8-hr1l-aepjb53gxd26_4koz6rml7a12yq0x9e5hsgw3ib8vdfpujcnt...
Submission: On October 21 via automatic, source phishtank — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 2 countries across 2 domains to perform 3 HTTP transactions. The main IP is 119.31.233.123, located in Singapore and belongs to DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU. The main domain is irmall.superghs.com.
TLS certificate: Issued by R3 on October 13th 2022. Valid for: 3 months.
This is the only time irmall.superghs.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 15.197.142.173 16509 (AMAZON-02)
1 4 119.31.233.123 38719 (DREAMSCAP...)
3 1
Apex Domain
Subdomains		 Transfer
4 superghs.com
irmall.superghs.com
301 KB
1 tothe.win
tothe.win
297 B
3 2
Domain Requested by
4 irmall.superghs.com 1 redirects irmall.superghs.com
1 tothe.win 1 redirects
3 2

This site contains no links.

Subject Issuer Validity Valid
cpanel.irewardmall.com
R3		 2022-10-13 -
2023-01-11		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://irmall.superghs.com/backup/Auto/verify.php?5pgs6kcj-jmvw-0fv8-hr1l-aepjb53gxd26_4koz6rml7a12yq0x9e5hsgw3ib8vdfpujcntbcoy1fpxq5zuvmhk7al3t08sw2dg9jei64nrqil7yeamdgfhpc32z9x6uv1bnr8s0wjot45k&frt=jhg&data=
Frame ID: C79C1BEA8FF630A62C48E7287884C38B
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Mailer

Page URL History Show full URLs

  1. http://tothe.win/4ABU HTTP 302
    https://irmall.superghs.com/backup/Auto HTTP 301
    https://irmall.superghs.com/backup/Auto/ Page URL
  2. https://irmall.superghs.com/backup/Auto/verify.php?5pgs6kcj-jmvw-0fv8-hr1l-aepjb53gxd26_4koz6rml7a12yq0x... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

3
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

1
IPs

2
Countries

301 kB
Transfer

299 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://tothe.win/4ABU HTTP 302
    https://irmall.superghs.com/backup/Auto HTTP 301
    https://irmall.superghs.com/backup/Auto/ Page URL
  2. https://irmall.superghs.com/backup/Auto/verify.php?5pgs6kcj-jmvw-0fv8-hr1l-aepjb53gxd26_4koz6rml7a12yq0x9e5hsgw3ib8vdfpujcntbcoy1fpxq5zuvmhk7al3t08sw2dg9jei64nrqil7yeamdgfhpc32z9x6uv1bnr8s0wjot45k&frt=jhg&data= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://tothe.win/4ABU HTTP 302
  • https://irmall.superghs.com/backup/Auto HTTP 301
  • https://irmall.superghs.com/backup/Auto/

3 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
irmall.superghs.com/backup/Auto/
Redirect Chain
  • http://tothe.win/4ABU
  • https://irmall.superghs.com/backup/Auto
  • https://irmall.superghs.com/backup/Auto/
747 B
931 B 		Document
General
Check archive.org
Download Go to
Full URL
https://irmall.superghs.com/backup/Auto/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
119.31.233.123 , Singapore, ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU),
Reverse DNS
server1.superghs.com
Software
Apache /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length
747
content-type
text/html; charset=UTF-8
date
Fri, 21 Oct 2022 02:21:52 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
pragma
no-cache
server
Apache

Redirect headers

content-length
248
content-type
text/html; charset=iso-8859-1
date
Fri, 21 Oct 2022 02:21:52 GMT
location
https://irmall.superghs.com/backup/Auto/
server
Apache
Primary Request verify.php
irmall.superghs.com/backup/Auto/ 		26 KB
27 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://irmall.superghs.com/backup/Auto/verify.php?5pgs6kcj-jmvw-0fv8-hr1l-aepjb53gxd26_4koz6rml7a12yq0x9e5hsgw3ib8vdfpujcntbcoy1fpxq5zuvmhk7al3t08sw2dg9jei64nrqil7yeamdgfhpc32z9x6uv1bnr8s0wjot45k&frt=jhg&data=
Requested by
Host: irmall.superghs.com
URL: https://irmall.superghs.com/backup/Auto/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
119.31.233.123 , Singapore, ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU),
Reverse DNS
server1.superghs.com
Software
Apache /
Resource Hash
3fad7a44a8297eaa27092fe6edf9bc06206d72dd34e3ee1f63fd3ce92730b593

Request headers

Referer
https://irmall.superghs.com/backup/Auto/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-type
text/html; charset=UTF-8
date
Fri, 21 Oct 2022 02:21:53 GMT
server
Apache
lib.js
irmall.superghs.com/backup/Auto/ 		272 KB
274 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://irmall.superghs.com/backup/Auto/lib.js
Requested by
Host: irmall.superghs.com
URL: https://irmall.superghs.com/backup/Auto/verify.php?5pgs6kcj-jmvw-0fv8-hr1l-aepjb53gxd26_4koz6rml7a12yq0x9e5hsgw3ib8vdfpujcntbcoy1fpxq5zuvmhk7al3t08sw2dg9jei64nrqil7yeamdgfhpc32z9x6uv1bnr8s0wjot45k&frt=jhg&data=
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
119.31.233.123 , Singapore, ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU),
Reverse DNS
server1.superghs.com
Software
Apache /
Resource Hash
19c2ff8384c14552104a2f7a5a830aef510669837d65fb0c20a9bee749e54b8b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://irmall.superghs.com/backup/Auto/verify.php?5pgs6kcj-jmvw-0fv8-hr1l-aepjb53gxd26_4koz6rml7a12yq0x9e5hsgw3ib8vdfpujcntbcoy1fpxq5zuvmhk7al3t08sw2dg9jei64nrqil7yeamdgfhpc32z9x6uv1bnr8s0wjot45k&frt=jhg&data=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Fri, 21 Oct 2022 02:21:53 GMT
last-modified
Wed, 14 Jul 2021 04:22:24 GMT
server
Apache
accept-ranges
bytes
content-length
278292
content-type
application/javascript

Verdicts & Comments Add Verdict or Comment

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| $ function| jQuery

1 Cookies

Domain/Path Name / Value
irmall.superghs.com/ Name: PHPSESSID
Value: kk06ukhnh53g7kvpjklk2lo713

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

irmall.superghs.com
tothe.win
119.31.233.123
15.197.142.173
19c2ff8384c14552104a2f7a5a830aef510669837d65fb0c20a9bee749e54b8b
3fad7a44a8297eaa27092fe6edf9bc06206d72dd34e3ee1f63fd3ce92730b593