dux.lnr.mybluehost.me Open in urlscan Pro
162.241.218.37 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://billowy-zenith-galley.glitch.me/
Effective URL:
https://dux.lnr.mybluehost.me/Oauth/api/
Submission: On November 15 via automatic, source phishtank (November 15th 2023, 5:35:24 am UTC) — Scanned from DE

Summary HTTP 15 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 2 countries across 5 domains to perform 15 HTTP transactions. The main IP is 162.241.218.37, located in and belongs to . The main domain is dux.lnr.mybluehost.me.
TLS certificate: Issued by R3 on November 13th 2023. Valid for: 3 months.

This is the only time dux.lnr.mybluehost.me was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	44.217.233.228 44.217.233.228	14618 (AMAZON-AES) (AMAZON-AES)
1	154.70.82.246 154.70.82.246	30982 (CAFENET) (CAFENET)
1 1	35.212.125.21 35.212.125.21	15169 (GOOGLE) (GOOGLE)
1	208.113.140.196 208.113.140.196	26347 (DREAMHOST-AS) (DREAMHOST-AS)
1	162.241.218.37 162.241.218.37	() ()
15	5

1 44.217.233.228 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-44-217-233-228.compute-1.amazonaws.com

billowy-zenith-galley.glitch.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 154.70.82.246 (Togo)

ASN30982 (CAFENET, TG)
PTR: ns5.netmaster.tg

cameg-togo.tg	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.212.125.21 (Washington, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 21.125.212.35.bc.googleusercontent.com

muhammadumars4.sg-host.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 208.113.140.196 (United States)

ASN26347 (DREAMHOST-AS, US)
PTR: dp-7526661d21.dreamhostps.com

manmal15.dream.press	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.241.218.37 (None, )

ASN- ()

dux.lnr.mybluehost.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
1	mybluehost.me dux.lnr.mybluehost.me
1	dream.press manmal15.dream.press	471 B
1	sg-host.com 1 redirects muhammadumars4.sg-host.com	562 B
1	cameg-togo.tg cameg-togo.tg	379 B
1	glitch.me billowy-zenith-galley.glitch.me	638 B
15	5

	Domain	Requested by
1	dux.lnr.mybluehost.me	dux.lnr.mybluehost.me
1	manmal15.dream.press
1	muhammadumars4.sg-host.com	1 redirects
1	cameg-togo.tg
1	billowy-zenith-galley.glitch.me
15	5

This site contains no links.

Subject Issuer	Validity	Valid
glitch.com Amazon RSA 2048 M01	`2023-02-22` - `2024-02-01`	a year	crt.sh
cameg-togo.tg cPanel, Inc. Certification Authority	`2023-09-16` - `2023-12-15`	3 months	crt.sh
*.dream.press USERTrust RSA Domain Validation Secure Server CA	`2023-09-08` - `2024-09-15`	a year	crt.sh
dux.lnr.mybluehost.me R3	`2023-11-13` - `2024-02-11`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://dux.lnr.mybluehost.me/Oauth/api/
Frame ID: 693A82D53C82DD58C8FC24AC35F63A1D
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://billowy-zenith-galley.glitch.me/ Page URL
https://cameg-togo.tg//wp-content/et-cache/ta.html Page URL
https://muhammadumars4.sg-host.com/1rpe HTTP 307
https://manmal15.dream.press/wp-admin/al.html Page URL
https://dux.lnr.mybluehost.me/Oauth/api/ Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

Page Statistics

15
Requests

27 %
HTTPS

0 %
IPv6

5
Domains

5
Subdomains

5
IPs

2
Countries

1 kB
Transfer

22 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://billowy-zenith-galley.glitch.me/ Page URL
https://cameg-togo.tg//wp-content/et-cache/ta.html Page URL
https://muhammadumars4.sg-host.com/1rpe HTTP 307
https://manmal15.dream.press/wp-admin/al.html Page URL
https://dux.lnr.mybluehost.me/Oauth/api/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 2

https://muhammadumars4.sg-host.com/1rpe HTTP 307
https://manmal15.dream.press/wp-admin/al.html

15 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 /
billowy-zenith-galley.glitch.me/ 276 B
638 B 401ms
166ms Document
text/html 44.217.233.228
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://billowy-zenith-galley.glitch.me/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.217.233.228 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-217-233-228.compute-1.amazonaws.com
Software: AmazonS3 /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
cache-control: no-cache
content-length: 276
content-type: text/html; charset=utf-8
date: Wed, 15 Nov 2023 05:35:19 GMT
etag: "981eb8e08aa5273fea4c30f78675caa5"
last-modified: Fri, 10 Nov 2023 06:06:21 GMT
server: AmazonS3
x-amz-id-2: pDNkiOwDmtAt/3OJ/gsPfVIon93YWzbNHCwcuO4nWoVZpauLD3kWSi4fC+VysBkWQUIpWyIS+ls=
x-amz-request-id: 9VE0NAHEX406B0G0
x-amz-server-side-encryption: AES256
x-amz-version-id: _9V.lJpkDQCx_frox0N73WRxHKj8vLmZ

GET
H/1.1 200
OK ta.html
cameg-togo.tg//wp-content/et-cache/ 170 B
379 B 1397ms
116ms Document
text/html 154.70.82.246
CAFENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cameg-togo.tg//wp-content/et-cache/ta.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 154.70.82.246 , Togo, ASN30982 (CAFENET, TG),
Reverse DNS: ns5.netmaster.tg
Software: nginx /
Resource Hash

Request headers

Referer: https://billowy-zenith-galley.glitch.me/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Length: 170
Content-Type: text/html
Date: Wed, 15 Nov 2023 05:35:20 GMT
Last-Modified: Mon, 30 Oct 2023 14:59:26 GMT
Server: nginx

GET
H2

200

al.html Show response
manmal15.dream.press/wp-admin/
Redirect Chain

https://muhammadumars4.sg-host.com/1rpe
https://manmal15.dream.press/wp-admin/al.html

160 B
471 B

615ms
96ms

Document
text/html

208.113.140.196
DREAMHOST-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://manmal15.dream.press/wp-admin/al.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

208.113.140.196 , United States, ASN26347 (DREAMHOST-AS, US),

Reverse DNS

dp-7526661d21.dreamhostps.com

Software

nginx /

Resource Hash

f8d2ba46e68ff708c0595513a2869e269421807c83ff54fbe2a7e49e95291bcd

Security Headers

Name	Value
Content-Security-Policy	default-src * 'unsafe-inline' 'unsafe-eval' data: blob:;
Strict-Transport-Security	max-age=31536000;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://cameg-togo.tg//wp-content/et-cache/ta.html
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: public, max-age=86400
content-encoding: br
content-security-policy: default-src * 'unsafe-inline' 'unsafe-eval' data: blob:;
content-type: text/html
date: Wed, 15 Nov 2023 05:35:22 GMT
etag: W/"6552c8a4-a0"
last-modified: Tue, 14 Nov 2023 01:08:52 GMT
referrer-policy: no-referrer-when-downgrade
server: nginx
strict-transport-security: max-age=31536000;
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block

Redirect headers

cache-control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
content-type: text/html; charset=UTF-8
date: Wed, 15 Nov 2023 05:35:21 GMT
expires: Mon, 10 Oct 1975 08:09:15 GMT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
location: https://manmal15.dream.press/wp-admin/al.html
pragma: no-cache
server: nginx
x-httpd: 1
x-proxy-cache: MISS
x-proxy-cache-info: 0307 NC:000000 UP:SKIP_CACHE_SET_COOKIE
x-redirect-by: WordPress
x-redirect-powered-by: url-shortify 1.7.8 https://kaizencoders.com
x-robots-tag: noindex, nofollow

GET
H2 200 Primary Request /
dux.lnr.mybluehost.me/Oauth/api/ 21 KB
0 1986ms
1598ms Document
text/html 162.241.218.37

General

Check archive.org

Show headers Download Go to

Full URL: https://dux.lnr.mybluehost.me/Oauth/api/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.241.218.37 -, , ASN (),
Reverse DNS
Software: nginx/1.21.6 /
Resource Hash

Request headers

Referer: https://manmal15.dream.press/wp-admin/al.html
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: max-age=7200
content-encoding: gzip
content-length: 5753
content-type: text/html; charset=UTF-8
date: Wed, 15 Nov 2023 05:35:15 GMT
expires: Wed, 15 Nov 2023 07:35:23 GMT
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
server: nginx/1.21.6
vary: Accept-Encoding
x-newfold-cache-level: 2
x-server-cache: false

GET jquery.min.js
dux.lnr.mybluehost.me/Oauth/api/js/ 0
0

GET ua-parser.min.js
dux.lnr.mybluehost.me/Oauth/api/js/ 0
0

GET font-awesome.min.css
dux.lnr.mybluehost.me/Oauth/api/css/ 0
0

GET core_form.js
dux.lnr.mybluehost.me/Oauth/api/core/ 0
0

GET core_token.js
dux.lnr.mybluehost.me/Oauth/api/core/ 0
0

GET core_form.css
dux.lnr.mybluehost.me/Oauth/api/css/ 0
0

GET css.css
dux.lnr.mybluehost.me/Oauth/api/css/ 0
0

GET dkb-global.css
dux.lnr.mybluehost.me/Oauth/api/css/ 0
0

GET dkb_responsive.min.css
dux.lnr.mybluehost.me/Oauth/api/css/ 0
0

GET index.css
dux.lnr.mybluehost.me/Oauth/api/css/ 0
0

GET img.jpg
dux.lnr.mybluehost.me/Oauth/api/img/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: dux.lnr.mybluehost.me
URL: https://dux.lnr.mybluehost.me/Oauth/api/js/jquery.min.js

Domain: dux.lnr.mybluehost.me
URL: https://dux.lnr.mybluehost.me/Oauth/api/js/ua-parser.min.js

Domain: dux.lnr.mybluehost.me
URL: https://dux.lnr.mybluehost.me/Oauth/api/css/font-awesome.min.css

Domain: dux.lnr.mybluehost.me
URL: https://dux.lnr.mybluehost.me/Oauth/api/core/core_form.js

Domain: dux.lnr.mybluehost.me
URL: https://dux.lnr.mybluehost.me/Oauth/api/core/core_token.js

Domain: dux.lnr.mybluehost.me
URL: https://dux.lnr.mybluehost.me/Oauth/api/css/core_form.css

Domain: dux.lnr.mybluehost.me
URL: https://dux.lnr.mybluehost.me/Oauth/api/css/css.css

Domain: dux.lnr.mybluehost.me
URL: https://dux.lnr.mybluehost.me/Oauth/api/css/dkb-global.css

Domain: dux.lnr.mybluehost.me
URL: https://dux.lnr.mybluehost.me/Oauth/api/css/dkb_responsive.min.css

Domain: dux.lnr.mybluehost.me
URL: https://dux.lnr.mybluehost.me/Oauth/api/css/index.css

Domain: dux.lnr.mybluehost.me
URL: https://dux.lnr.mybluehost.me/Oauth/api/img/img.jpg

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			muhammadumars4.sg-host.com/	1970-01-20 16:56:58	Name: kc_us_click_2 Value: 1rpe
			muhammadumars4.sg-host.com/	1970-01-21 00:59:22	Name: kc_us_visitor Value: 65545899c7a17

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

billowy-zenith-galley.glitch.me
cameg-togo.tg
dux.lnr.mybluehost.me
manmal15.dream.press
muhammadumars4.sg-host.com
dux.lnr.mybluehost.me
154.70.82.246
162.241.218.37
208.113.140.196
35.212.125.21
44.217.233.228
f8d2ba46e68ff708c0595513a2869e269421807c83ff54fbe2a7e49e95291bcd

dux.lnr.mybluehost.me Open in urlscan Pro 162.241.218.37 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

15 Requests

27 %HTTPS

0 %IPv6

5 Domains

5 Subdomains

5 IPs

2 Countries

1 kBTransfer

22 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

2 Cookies

Indicators

dux.lnr.mybluehost.me Open in urlscan Pro
162.241.218.37 Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

27 %
HTTPS

0 %
IPv6

5
Domains

5
Subdomains

5
IPs

2
Countries

1 kB
Transfer

22 kB
Size

2
Cookies

15 HTTP transactions
0 data transactions