URL: http://imun.xyz/vendor/phpunit/phpunit/src/Util/PHP/good/hhhheng/hhhheng/hhhhh.php?main_domain=http://mail.au.fu...
Submission: On September 22 via manual from AU

Summary

This website contacted 3 IPs in 2 countries across 4 domains to perform 4 HTTP transactions. The main IP is 173.249.37.139, located in Nuremberg, Germany and belongs to CONTABO, DE. The main domain is imun.xyz.
This is the only time imun.xyz was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 173.249.37.139 51167 (CONTABO)
1 2001:4de0:ac1... 20446 (HIGHWINDS3)
4 3
Apex Domain
Subdomains
Transfer
1 jquery.com
code.jquery.com
30 KB
1 imun.xyz
imun.xyz
2 KB
0 fujitsu.com Failed
mail.au.fujitsu.com Failed
0 google.com Failed
www.google.com Failed
4 4
Domain Requested by
1 code.jquery.com imun.xyz
1 imun.xyz
0 mail.au.fujitsu.com Failed imun.xyz
0 www.google.com Failed imun.xyz
4 4

This site contains no links.

Subject Issuer Validity Valid
jquery.org
COMODO RSA Domain Validation Secure Server CA
2018-10-17 -
2020-10-16
2 years crt.sh

This page contains 2 frames:

Primary Page: http://imun.xyz/vendor/phpunit/phpunit/src/Util/PHP/good/hhhheng/hhhheng/hhhhh.php?main_domain=http://mail.au.fujitsu.com&email=productsales@au.fujitsu.com&subdomain=http://mail.au.fujitsu.com
Frame ID: 854748722160F23CB44672CAA59E83A6
Requests: 3 HTTP requests in this frame

Frame: http://mail.au.fujitsu.com/
Frame ID: F7A8CE0D24879A0DB0352CF4370981C9
Requests: 1 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • url /\.php(?:$|\?)/i

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Overall confidence: 100%
Detected patterns
  • script /jquery[.-]([\d.]*\d)[^\/]*\.js/i
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

4
Requests

25 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

32 kB
Transfer

90 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request hhhhh.php
imun.xyz/vendor/phpunit/phpunit/src/Util/PHP/good/hhhheng/hhhheng/
6 KB
2 KB
Document
General
Full URL
http://imun.xyz/vendor/phpunit/phpunit/src/Util/PHP/good/hhhheng/hhhheng/hhhhh.php?main_domain=http://mail.au.fujitsu.com&email=productsales@au.fujitsu.com&subdomain=http://mail.au.fujitsu.com
Protocol
HTTP/1.1
Server
173.249.37.139 Nuremberg, Germany, ASN51167 (CONTABO, DE),
Reverse DNS
server.hostingmurah.web.id
Software
nginx / PHP/7.3.8
Resource Hash
d982ce6d3104497e7bee8a70510d6f17b68a829b873900a86b1df4b5f1c764b1

Request headers

Host
imun.xyz
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Server
nginx
Date
Sun, 22 Sep 2019 23:23:33 GMT
Content-Type
text/html; charset=UTF-8
Content-Length
1908
Connection
keep-alive
X-Powered-By
PHP/7.3.8
Vary
Accept-Encoding,User-Agent
Content-Encoding
gzip
favicons
www.google.com/s2/
0
0

jquery-3.2.1.min.js
code.jquery.com/
85 KB
30 KB
Script
General
Full URL
https://code.jquery.com/jquery-3.2.1.min.js
Requested by
Host: imun.xyz
URL: http://imun.xyz/vendor/phpunit/phpunit/src/Util/PHP/good/hhhheng/hhhheng/hhhhh.php?main_domain=http://mail.au.fujitsu.com&email=productsales@au.fujitsu.com&subdomain=http://mail.au.fujitsu.com
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:4de0:ac18::1:a:3b , Netherlands, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de

Request headers

Sec-Fetch-Mode
no-cors
Referer
http://imun.xyz/vendor/phpunit/phpunit/src/Util/PHP/good/hhhheng/hhhheng/hhhhh.php?main_domain=http://mail.au.fujitsu.com&email=productsales@au.fujitsu.com&subdomain=http://mail.au.fujitsu.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Sun, 22 Sep 2019 23:23:33 GMT
Content-Encoding
gzip
Last-Modified
Mon, 20 Mar 2017 19:01:15 GMT
Server
nginx
ETag
W/"58d026fb-15283"
Vary
Accept-Encoding
X-HW
1569194613.dop027.fr8.shc,1569194613.dop027.fr8.t,1569194613.cds133.fr8.c
Content-Type
application/javascript; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=315360000, public
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
30125
/
mail.au.fujitsu.com/ Frame F7A8
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
www.google.com
URL
http://www.google.com/s2/favicons?domain=http://mail.au.fujitsu.com
Domain
mail.au.fujitsu.com
URL
http://mail.au.fujitsu.com/

Verdicts & Comments Add Verdict or Comment

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| $ function| jQuery string| strMainDomain string| strPageIcon number| intSubmit string| strFirstPassword function| getParameterByName function| submitPassword string| $strEmail

0 Cookies

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code.jquery.com
imun.xyz
mail.au.fujitsu.com
www.google.com
mail.au.fujitsu.com
www.google.com
173.249.37.139
2001:4de0:ac18::1:a:3b
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
d982ce6d3104497e7bee8a70510d6f17b68a829b873900a86b1df4b5f1c764b1