disenoprueba.imduyv.gob.mx Open in urlscan Pro
68.65.121.216 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://go.ly/yTFX4
Effective URL:
https://disenoprueba.imduyv.gob.mx/~about.php/?url=Ly9tb2JpbGVfYmx1ZS9pbmRleC5waHA/JmFtcDtpPTIyMFBI
Submission: On February 22 via api (February 22nd 2023, 9:05:37 pm UTC) from US — Scanned from US

Summary HTTP 17 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 5 domains to perform 17 HTTP transactions. The main IP is 68.65.121.216, located in Huntingdon, United States and belongs to NAMECHEAP-NET, US. The main domain is disenoprueba.imduyv.gob.mx.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on July 25th 2022. Valid for: a year.

This is the only time disenoprueba.imduyv.gob.mx was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
1 1	104.21.56.84 104.21.56.84	13335 (CLOUDFLAR...) (CLOUDFLARENET)
9	68.65.121.216 68.65.121.216	22612 (NAMECHEAP...) (NAMECHEAP-NET)
2	104.18.10.207 104.18.10.207	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	142.250.80.99 142.250.80.99	15169 (GOOGLE) (GOOGLE)
2	142.250.65.228 142.250.65.228	15169 (GOOGLE) (GOOGLE)
17	4

1 104.21.56.84 (None, ) 1 redirects

ASN13335 (CLOUDFLARENET, US)

go.ly	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 68.65.121.216 (Huntingdon, United States)

ASN22612 (NAMECHEAP-NET, US)
PTR: premium41-4.web-hosting.com

disenoprueba.imduyv.gob.mx	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.18.10.207 (None, )

ASN13335 (CLOUDFLARENET, US)

maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.80.99 (United States)

ASN15169 (GOOGLE, US)
PTR: lga34s36-in-f3.1e100.net

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.65.228 (United States)

ASN15169 (GOOGLE, US)
PTR: lga25s73-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	imduyv.gob.mx disenoprueba.imduyv.gob.mx	301 KB
4	gstatic.com www.gstatic.com	3 KB
2	google.com www.google.com — Cisco Umbrella Rank: 2	29 KB
2	bootstrapcdn.com maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 768	83 KB
1	go.ly 1 redirects go.ly	583 B
17	5

	Domain	Requested by
9	disenoprueba.imduyv.gob.mx	disenoprueba.imduyv.gob.mx
4	www.gstatic.com	disenoprueba.imduyv.gob.mx www.google.com
2	www.google.com	disenoprueba.imduyv.gob.mx
2	maxcdn.bootstrapcdn.com	disenoprueba.imduyv.gob.mx maxcdn.bootstrapcdn.com
1	go.ly	1 redirects
17	5

This site contains no links.

Subject Issuer	Validity	Valid
disenoprueba.imduyv.gob.mx Sectigo RSA Domain Validation Secure Server CA	`2022-07-25` - `2023-07-25`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-12-30` - `2023-12-30`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2023-02-01` - `2023-04-26`	3 months	crt.sh
www.google.com GTS CA 1C3	`2023-02-01` - `2023-04-26`	3 months	crt.sh

This page contains 4 frames:

Primary Page: https://disenoprueba.imduyv.gob.mx/~about.php/?url=Ly9tb2JpbGVfYmx1ZS9pbmRleC5waHA/JmFtcDtpPTIyMFBI
Frame ID: BECCB2F3B925FCA64081AF043F2B779B
Requests: 1 HTTP requests in this frame

Frame: https://disenoprueba.imduyv.gob.mx/js-ZIGaWOu//mobile_blue/index.php?&i=220PH
Frame ID: B256119D681F566244A13C8A78B9A1A6
Requests: 7 HTTP requests in this frame

Frame: https://disenoprueba.imduyv.gob.mx/js-ZIGaWOu//mobile_blue/Facebook%20Login_files/anchor.htm
Frame ID: 255ECA9108B9BB9AAEB596FFA8724EF6
Requests: 6 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LecguUUAAAAAGcZhPKHMpRYIjyzHiOBcDt2in0X&co=aHR0cHM6Ly9kaXNlbm9wcnVlYmEuaW1kdXl2LmdvYi5teDo0NDM.&hl=en&v=4lbq4vBYAu25DMtzZ7GGbfAF&size=invisible&cb=7n0us9u882py
Frame ID: C7F3676870D4F84D5F9199EBAFDBD028
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Login into.......

Page URL History Show full URLs

https://go.ly/yTFX4 HTTP 301
https://disenoprueba.imduyv.gob.mx/~about.php/?url=Ly9tb2JpbGVfYmx1ZS9pbmRleC5waHA/JmFtcDtpPTIyMFBI Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Page Statistics

17
Requests

100 %
HTTPS

0 %
IPv6

5
Domains

5
Subdomains

4
IPs

2
Countries

415 kB
Transfer

939 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://go.ly/yTFX4 HTTP 301
https://disenoprueba.imduyv.gob.mx/~about.php/?url=Ly9tb2JpbGVfYmx1ZS9pbmRleC5waHA/JmFtcDtpPTIyMFBI Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
disenoprueba.imduyv.gob.mx/~about.php/
Redirect Chain

https://go.ly/yTFX4
https://disenoprueba.imduyv.gob.mx/~about.php/?url=Ly9tb2JpbGVfYmx1ZS9pbmRleC5waHA/JmFtcDtpPTIyMFBI

542 B
449 B

412ms
81ms

Document
text/html

68.65.121.216
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://disenoprueba.imduyv.gob.mx/~about.php/?url=Ly9tb2JpbGVfYmx1ZS9pbmRleC5waHA/JmFtcDtpPTIyMFBI
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 68.65.121.216 Huntingdon, United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: premium41-4.web-hosting.com
Software: LiteSpeed / PHP/7.2.34
Resource Hash: 0d85b03323433b2837aa8bf3b39d0e3e022c9ccb0b10a4a972e1b4907e82a292

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

content-encoding: br
content-length: 281
content-type: text/html; charset=UTF-8
date: Wed, 22 Feb 2023 21:05:32 GMT
server: LiteSpeed
vary: Accept-Encoding
x-powered-by: PHP/7.2.34
x-turbo-charged-by: LiteSpeed

Redirect headers

access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 79daae2f9c5b558f-EWR
content-type: text/html; charset=utf-8
date: Wed, 22 Feb 2023 21:05:32 GMT
location: https://disenoprueba.imduyv.gob.mx/~about.php/?url=Ly9tb2JpbGVfYmx1ZS9pbmRleC5waHA/JmFtcDtpPTIyMFBI
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VFL0OYojm7A5OydBDIXsTjuzXF4hgrbldVtHk8Pbll0KAq5zTjXPFAYtEjVEcHWRVQAJN0%2BnSNmPXwhS7AgeEPqYFJ7biSJ7%2BPTjNA1wy6b4OIkml3W7ow%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=15552000; includeSubDomains; preload
vary: Accept
x-content-type-options: nosniff
x-powered-by: Express

GET
H2 200 index.php Show response
disenoprueba.imduyv.gob.mx/js-ZIGaWOu//mobile_blue/ Frame B256 4 KB
2 KB 82ms
81ms Document
text/html 68.65.121.216
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://disenoprueba.imduyv.gob.mx/js-ZIGaWOu//mobile_blue/index.php?&i=220PH
Requested by: Host: disenoprueba.imduyv.gob.mx
URL: https://disenoprueba.imduyv.gob.mx/~about.php/?url=Ly9tb2JpbGVfYmx1ZS9pbmRleC5waHA/JmFtcDtpPTIyMFBI
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 68.65.121.216 Huntingdon, United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: premium41-4.web-hosting.com
Software: LiteSpeed / PHP/7.2.34
Resource Hash: a4f7ab05f3996aa937485b3a63762d50b6b575ecaea027c41fae0abc5bcb3c05

Request headers

Referer: https://disenoprueba.imduyv.gob.mx/~about.php/?url=Ly9tb2JpbGVfYmx1ZS9pbmRleC5waHA/JmFtcDtpPTIyMFBI
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

content-encoding: br
content-length: 1505
content-type: text/html; charset=UTF-8
date: Wed, 22 Feb 2023 21:05:32 GMT
server: LiteSpeed
vary: Accept-Encoding
x-powered-by: PHP/7.2.34
x-turbo-charged-by: LiteSpeed

GET
H2 200 font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/ Frame B256 30 KB
7 KB 332ms
16ms Stylesheet
text/css 104.18.10.207
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css

Requested by

Host: disenoprueba.imduyv.gob.mx
URL: https://disenoprueba.imduyv.gob.mx/js-ZIGaWOu//mobile_blue/index.php?&i=220PH

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.10.207 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://disenoprueba.imduyv.gob.mx/
Origin: https://disenoprueba.imduyv.gob.mx
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Wed, 22 Feb 2023 21:05:33 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
cdn-edgestorageid: 755
age: 155166
cdn-cachedat: 12/08/2022 20:58:03
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Mon, 25 Jan 2021 22:04:55 GMT
cdn-proxyver: 1.03
cdn-requestpullcode: 200
server: cloudflare
etag: W/"269550530cc127b6aa5a35925a7de6ce"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cache-control: public, max-age=31919000
cdn-requestid: 42178455b9371583ac3113750d81f1c0
timing-allow-origin: *
cdn-requestcountrycode: US
cdn-status: 200
cf-ray: 79daae375a7519f7-EWR
cdn-requestpullsuccess: True

GET
H2 200 style.css
disenoprueba.imduyv.gob.mx/js-ZIGaWOu//mobile_blue/Facebook%20Login_files/ Frame B256 1 KB
534 B 84ms
83ms Stylesheet
text/css 68.65.121.216
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://disenoprueba.imduyv.gob.mx/js-ZIGaWOu//mobile_blue/Facebook%20Login_files/style.css
Requested by: Host: disenoprueba.imduyv.gob.mx
URL: https://disenoprueba.imduyv.gob.mx/js-ZIGaWOu//mobile_blue/index.php?&i=220PH
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 68.65.121.216 Huntingdon, United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: premium41-4.web-hosting.com
Software: LiteSpeed /
Resource Hash: 1d309e54873d9219eec4ca63af38fdd3885de42b10aae999cf1a6bf83aa812c2

Request headers

accept-language: en-US,en;q=0.9
Referer: https://disenoprueba.imduyv.gob.mx/js-ZIGaWOu//mobile_blue/index.php?&i=220PH
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Wed, 22 Feb 2023 21:05:33 GMT
content-encoding: br
last-modified: Sat, 12 Dec 2020 21:10:20 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
content-length: 314
expires: Wed, 01 Mar 2023 21:05:33 GMT

GET
H2 200 recaptcha__en.js Show response
disenoprueba.imduyv.gob.mx/js-ZIGaWOu//mobile_blue/Facebook%20Login_files/ Frame B256 343 KB
128 KB 95ms
94ms Script
application/javascript 68.65.121.216
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://disenoprueba.imduyv.gob.mx/js-ZIGaWOu//mobile_blue/Facebook%20Login_files/recaptcha__en.js
Requested by: Host: disenoprueba.imduyv.gob.mx
URL: https://disenoprueba.imduyv.gob.mx/js-ZIGaWOu//mobile_blue/index.php?&i=220PH
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 68.65.121.216 Huntingdon, United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: premium41-4.web-hosting.com
Software: LiteSpeed /
Resource Hash: 84aff23bb47fbea74e9c9944cc840a4c17dbf1c32fc9f6a5c4717417e02751c6

Request headers

Referer: https://disenoprueba.imduyv.gob.mx/js-ZIGaWOu//mobile_blue/index.php?&i=220PH
Origin: https://disenoprueba.imduyv.gob.mx
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Wed, 22 Feb 2023 21:05:33 GMT
content-encoding: br
last-modified: Sat, 12 Dec 2020 21:10:20 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
content-length: 131193
expires: Wed, 01 Mar 2023 21:05:33 GMT

GET
H2 200 api.js Show response
disenoprueba.imduyv.gob.mx/js-ZIGaWOu//mobile_blue/Facebook%20Login_files/ Frame B256 884 B
734 B 82ms
81ms Script
application/javascript 68.65.121.216
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://disenoprueba.imduyv.gob.mx/js-ZIGaWOu//mobile_blue/Facebook%20Login_files/api.js
Requested by: Host: disenoprueba.imduyv.gob.mx
URL: https://disenoprueba.imduyv.gob.mx/js-ZIGaWOu//mobile_blue/index.php?&i=220PH
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 68.65.121.216 Huntingdon, United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: premium41-4.web-hosting.com
Software: LiteSpeed /
Resource Hash: 5733efc9c2f38b7b1a2fd21a763803c14e7286a6264cb85dd117754da6680c34

Request headers

accept-language: en-US,en;q=0.9
Referer: https://disenoprueba.imduyv.gob.mx/js-ZIGaWOu//mobile_blue/index.php?&i=220PH
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Wed, 22 Feb 2023 21:05:33 GMT
content-encoding: br
last-modified: Sat, 12 Dec 2020 21:10:20 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
content-length: 500
expires: Wed, 01 Mar 2023 21:05:33 GMT

GET
H2 404 recaptcha__en.js
www.gstatic.com/recaptcha/releases/4lbq4vBYAu25DMtzZ7GGbfAF/ Frame B256 0
0 987ms
666ms Script
text/html 142.250.80.99
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/4lbq4vBYAu25DMtzZ7GGbfAF/recaptcha__en.js

Requested by

Host: disenoprueba.imduyv.gob.mx
URL: https://disenoprueba.imduyv.gob.mx/js-ZIGaWOu//mobile_blue/Facebook%20Login_files/api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.80.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s36-in-f3.1e100.net

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://disenoprueba.imduyv.gob.mx/
Origin: https://disenoprueba.imduyv.gob.mx
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Wed, 22 Feb 2023 21:05:34 GMT
x-content-type-options: nosniff
server: sffe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1621
x-xss-protection: 0

GET
H2 200 anchor.htm Show response
disenoprueba.imduyv.gob.mx/js-ZIGaWOu//mobile_blue/Facebook%20Login_files/ Frame 255E 21 KB
10 KB 301ms
301ms Document
text/html 68.65.121.216
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://disenoprueba.imduyv.gob.mx/js-ZIGaWOu//mobile_blue/Facebook%20Login_files/anchor.htm
Requested by: Host: disenoprueba.imduyv.gob.mx
URL: https://disenoprueba.imduyv.gob.mx/js-ZIGaWOu//mobile_blue/index.php?&i=220PH
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 68.65.121.216 Huntingdon, United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: premium41-4.web-hosting.com
Software: LiteSpeed /
Resource Hash: edcd4c49fcb8bf04f1d999fb31c1285eeb6c5939657482019564220ae5f85c84

Request headers

Referer: https://disenoprueba.imduyv.gob.mx/js-ZIGaWOu//mobile_blue/index.php?&i=220PH
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
content-encoding: br
content-length: 10178
content-type: text/html
date: Wed, 22 Feb 2023 21:05:33 GMT
last-modified: Sat, 12 Dec 2020 21:10:20 GMT
server: LiteSpeed
vary: Accept-Encoding
x-turbo-charged-by: LiteSpeed

GET
H2 200 fontawesome-webfont.woff2
maxcdn.bootstrapcdn.com/font-awesome/4.7.0/fonts/ Frame B256 75 KB
76 KB 39ms
39ms Font
font/woff2 104.18.10.207
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0

Requested by

Host: maxcdn.bootstrapcdn.com
URL: https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.10.207 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css
Origin: https://disenoprueba.imduyv.gob.mx
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Wed, 22 Feb 2023 21:05:33 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 1029
cdn-cachedat: 01/02/2023 00:17:33
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 77160
last-modified: Mon, 25 Jan 2021 22:04:55 GMT
cdn-proxyver: 1.03
cdn-requestpullcode: 200
server: cloudflare
etag: "af7ae505a9eed503f8b8e6982036873e"
vary: Accept-Encoding
content-type: font/woff2
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cache-control: public, max-age=31919000
cdn-requestid: 106ef4f1a3d5067c128210ee61063136
accept-ranges: bytes
timing-allow-origin: *
cdn-requestcountrycode: US
cdn-status: 200
cf-ray: 79daae379ada19f7-EWR
cdn-requestpullsuccess: True

GET
H2 200 styles__ltr.css
disenoprueba.imduyv.gob.mx/js-ZIGaWOu//mobile_blue/Facebook%20Login_files/anchor_data/ Frame 255E 50 KB
25 KB 231ms
229ms Stylesheet
text/css 68.65.121.216
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://disenoprueba.imduyv.gob.mx/js-ZIGaWOu//mobile_blue/Facebook%20Login_files/anchor_data/styles__ltr.css
Requested by: Host: disenoprueba.imduyv.gob.mx
URL: https://disenoprueba.imduyv.gob.mx/js-ZIGaWOu//mobile_blue/Facebook%20Login_files/anchor.htm
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 68.65.121.216 Huntingdon, United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: premium41-4.web-hosting.com
Software: LiteSpeed /
Resource Hash: 9f7c3261df3df9aae8b6c8e4433a7ba73cedd3a1c17880764b6728a0f52980c5

Request headers

accept-language: en-US,en;q=0.9
Referer: https://disenoprueba.imduyv.gob.mx/js-ZIGaWOu//mobile_blue/Facebook%20Login_files/anchor.htm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Wed, 22 Feb 2023 21:05:33 GMT
content-encoding: br
last-modified: Sat, 12 Dec 2020 21:10:20 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
content-length: 25113
expires: Wed, 01 Mar 2023 21:05:33 GMT

GET
H2 200 recaptcha__en.js Show response
disenoprueba.imduyv.gob.mx/js-ZIGaWOu//mobile_blue/Facebook%20Login_files/ Frame 255E 343 KB
128 KB 80ms
78ms Script
application/javascript 68.65.121.216
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://disenoprueba.imduyv.gob.mx/js-ZIGaWOu//mobile_blue/Facebook%20Login_files/recaptcha__en.js
Requested by: Host: disenoprueba.imduyv.gob.mx
URL: https://disenoprueba.imduyv.gob.mx/js-ZIGaWOu//mobile_blue/Facebook%20Login_files/anchor.htm
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 68.65.121.216 Huntingdon, United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: premium41-4.web-hosting.com
Software: LiteSpeed /
Resource Hash: 84aff23bb47fbea74e9c9944cc840a4c17dbf1c32fc9f6a5c4717417e02751c6

Request headers

accept-language: en-US,en;q=0.9
Referer: https://disenoprueba.imduyv.gob.mx/js-ZIGaWOu//mobile_blue/Facebook%20Login_files/anchor.htm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Wed, 22 Feb 2023 21:05:33 GMT
content-encoding: br
last-modified: Sat, 12 Dec 2020 21:10:20 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
content-length: 131193
expires: Wed, 01 Mar 2023 21:05:33 GMT

GET
H2 200 x4dl7Lk5ENOB7Pbvmb3t7sJ-hPoGBwvfellrHtOoe40.js Show response
disenoprueba.imduyv.gob.mx/js-ZIGaWOu//mobile_blue/Facebook%20Login_files/anchor_data/ Frame 255E 14 KB
6 KB 232ms
231ms Script
application/javascript 68.65.121.216
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://disenoprueba.imduyv.gob.mx/js-ZIGaWOu//mobile_blue/Facebook%20Login_files/anchor_data/x4dl7Lk5ENOB7Pbvmb3t7sJ-hPoGBwvfellrHtOoe40.js
Requested by: Host: disenoprueba.imduyv.gob.mx
URL: https://disenoprueba.imduyv.gob.mx/js-ZIGaWOu//mobile_blue/Facebook%20Login_files/anchor.htm
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 68.65.121.216 Huntingdon, United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: premium41-4.web-hosting.com
Software: LiteSpeed /
Resource Hash: c78765ecb93910d381ecf6ef99bdedeec27e84fa06070bdf7a596b1ed3a87b8d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://disenoprueba.imduyv.gob.mx/js-ZIGaWOu//mobile_blue/Facebook%20Login_files/anchor.htm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Wed, 22 Feb 2023 21:05:33 GMT
content-encoding: br
last-modified: Sat, 12 Dec 2020 21:10:20 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
content-length: 5877
expires: Wed, 01 Mar 2023 21:05:33 GMT

GET
H2 200 anchor Show response
www.google.com/recaptcha/api2/ Frame C7F3 42 KB
22 KB 374ms
56ms Document
text/html 142.250.65.228
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LecguUUAAAAAGcZhPKHMpRYIjyzHiOBcDt2in0X&co=aHR0cHM6Ly9kaXNlbm9wcnVlYmEuaW1kdXl2LmdvYi5teDo0NDM.&hl=en&v=4lbq4vBYAu25DMtzZ7GGbfAF&size=invisible&cb=7n0us9u882py

Requested by

Host: disenoprueba.imduyv.gob.mx
URL: https://disenoprueba.imduyv.gob.mx/js-ZIGaWOu//mobile_blue/Facebook%20Login_files/recaptcha__en.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.65.228 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s73-in-f4.1e100.net

Software

GSE /

Resource Hash

9199144da2ab68d22f56b69c1b41c93a6dbc87110845e21196c600e109bb3b2d

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-AsTcgr70mQg2CHPCJdcUQg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disenoprueba.imduyv.gob.mx/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-length: 22353
content-security-policy: script-src 'report-sample' 'nonce-AsTcgr70mQg2CHPCJdcUQg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Wed, 22 Feb 2023 21:05:34 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 200 x4dl7Lk5ENOB7Pbvmb3t7sJ-hPoGBwvfellrHtOoe40.js Show response
www.google.com/js/bg/ Frame 255E 14 KB
6 KB 135ms
6ms Script
text/javascript 142.250.65.228
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/js/bg/x4dl7Lk5ENOB7Pbvmb3t7sJ-hPoGBwvfellrHtOoe40.js

Requested by

Host: disenoprueba.imduyv.gob.mx
URL: https://disenoprueba.imduyv.gob.mx/js-ZIGaWOu//mobile_blue/Facebook%20Login_files/recaptcha__en.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.65.228 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s73-in-f4.1e100.net

Software

sffe /

Resource Hash

c78765ecb93910d381ecf6ef99bdedeec27e84fa06070bdf7a596b1ed3a87b8d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://disenoprueba.imduyv.gob.mx/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 18:18:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 96425
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6068
x-xss-protection: 0
last-modified: Fri, 09 Oct 2020 16:26:02 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 21 Feb 2024 18:18:29 GMT

GET
H2 200 logo_48.png
www.gstatic.com/recaptcha/api2/ Frame 255E 2 KB
3 KB 317ms
3ms Image
image/png 142.250.80.99
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/recaptcha/api2/logo_48.png

Requested by

Host: disenoprueba.imduyv.gob.mx
URL: https://disenoprueba.imduyv.gob.mx/js-ZIGaWOu//mobile_blue/Facebook%20Login_files/anchor_data/styles__ltr.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.80.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s36-in-f3.1e100.net

Software

sffe /

Resource Hash

1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://disenoprueba.imduyv.gob.mx/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Thu, 16 Feb 2023 12:08:43 GMT
x-content-type-options: nosniff
age: 550611
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2228
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
expires: Thu, 23 Feb 2023 12:08:43 GMT

GET
H2 404 styles__ltr.css
www.gstatic.com/recaptcha/releases/4lbq4vBYAu25DMtzZ7GGbfAF/ Frame C7F3 0
0 517ms
381ms Stylesheet
text/html 142.250.80.99
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.gstatic.com/recaptcha/releases/4lbq4vBYAu25DMtzZ7GGbfAF/styles__ltr.css
Requested by: Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LecguUUAAAAAGcZhPKHMpRYIjyzHiOBcDt2in0X&co=aHR0cHM6Ly9kaXNlbm9wcnVlYmEuaW1kdXl2LmdvYi5teDo0NDM.&hl=en&v=4lbq4vBYAu25DMtzZ7GGbfAF&size=invisible&cb=7n0us9u882py
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.80.99 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga34s36-in-f3.1e100.net
Software: /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

GET
H2 404 recaptcha__en.js
www.gstatic.com/recaptcha/releases/4lbq4vBYAu25DMtzZ7GGbfAF/ Frame C7F3 0
0 702ms
565ms Script
text/html 142.250.80.99
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.gstatic.com/recaptcha/releases/4lbq4vBYAu25DMtzZ7GGbfAF/recaptcha__en.js
Requested by: Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LecguUUAAAAAGcZhPKHMpRYIjyzHiOBcDt2in0X&co=aHR0cHM6Ly9kaXNlbm9wcnVlYmEuaW1kdXl2LmdvYi5teDo0NDM.&hl=en&v=4lbq4vBYAu25DMtzZ7GGbfAF&size=invisible&cb=7n0us9u882py
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.80.99 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga34s36-in-f3.1e100.net
Software: /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 boolean| credentialless object| oncontentvisibilityautostatechange

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	error	URL: https://disenoprueba.imduyv.gob.mx/js-ZIGaWOu//mobile_blue/index.php?&i=220PH(Line 40) Message: Error while parsing the 'sandbox' attribute: 'allow-storage-access-by-user-activation' is an invalid sandbox flag.
network	error	URL: https://www.gstatic.com/recaptcha/releases/4lbq4vBYAu25DMtzZ7GGbfAF/recaptcha__en.js Message: Failed to load resource: the server responded with a status of 404 ()
security	error	URL: https://disenoprueba.imduyv.gob.mx/js-ZIGaWOu//mobile_blue/index.php?&i=220PH Message: Refused to execute script from 'https://www.gstatic.com/recaptcha/releases/4lbq4vBYAu25DMtzZ7GGbfAF/recaptcha__en.js' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled.
network	error	URL: https://www.gstatic.com/recaptcha/releases/4lbq4vBYAu25DMtzZ7GGbfAF/styles__ltr.css Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://www.gstatic.com/recaptcha/releases/4lbq4vBYAu25DMtzZ7GGbfAF/recaptcha__en.js Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

disenoprueba.imduyv.gob.mx
go.ly
maxcdn.bootstrapcdn.com
www.google.com
www.gstatic.com
104.18.10.207
104.21.56.84
142.250.65.228
142.250.80.99
68.65.121.216
0d85b03323433b2837aa8bf3b39d0e3e022c9ccb0b10a4a972e1b4907e82a292
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
1d309e54873d9219eec4ca63af38fdd3885de42b10aae999cf1a6bf83aa812c2
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
5733efc9c2f38b7b1a2fd21a763803c14e7286a6264cb85dd117754da6680c34
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
84aff23bb47fbea74e9c9944cc840a4c17dbf1c32fc9f6a5c4717417e02751c6
9199144da2ab68d22f56b69c1b41c93a6dbc87110845e21196c600e109bb3b2d
9f7c3261df3df9aae8b6c8e4433a7ba73cedd3a1c17880764b6728a0f52980c5
a4f7ab05f3996aa937485b3a63762d50b6b575ecaea027c41fae0abc5bcb3c05
c78765ecb93910d381ecf6ef99bdedeec27e84fa06070bdf7a596b1ed3a87b8d
edcd4c49fcb8bf04f1d999fb31c1285eeb6c5939657482019564220ae5f85c84

disenoprueba.imduyv.gob.mx Open in urlscan Pro 68.65.121.216 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

17 Requests

100 %HTTPS

0 %IPv6

5 Domains

5 Subdomains

4 IPs

2 Countries

415 kBTransfer

939 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

0 Cookies

5 Console Messages

Indicators

disenoprueba.imduyv.gob.mx Open in urlscan Pro
68.65.121.216 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

17
Requests

100 %
HTTPS

0 %
IPv6

5
Domains

5
Subdomains

4
IPs

2
Countries

415 kB
Transfer

939 kB
Size

0
Cookies

17 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!