urlquery.net
Investigate/Report/a8f8f7dd-e26d-48d2-8377-29e9deb90e3b
WEBSITE ANALYSIS REPORT

https://corfran.com.mx/excel/WebLogin.html?eta=dues.zion@hotmail.com

public
Report tags
suspicious telegram_bot
Submit tags
Request review
Suspicious activity

3 detections · review the detection signals

Review evidence →

Domain graph

Hostnames and connections captured in this scan

CallsLoads fromRedirects toEmbeds
Loading domain graph…

Network requests

Click any request row to expand it in place. Multiple transactions can remain open.

UTC · milliseconds
Reset
Captured HTTP requests; click any summary row or use its hostname button to expand transaction details.
Timestamp (UTC)MethodStatusHost / pathTypeSizeDurationSignals
GET200document25.2 KB930 ms3 alerts

Transaction #02

Request / response

URL

Navigation request GET HTTPS
https://corfran.com.mx/excel/WebLogin.html?eta=dues.zion@hotmail.com

IP / ASN

United States 216.245.213.138

AS46475 · LIMESTONENETWORKS

Requested by
Not recorded

Resource information

File type
HTML document, ASCII text, with very long lines (25762)
MIME type
text/html
First seen (UTC)
15 Oct 2026 · 13:15:46.892 UTC
Last seen (UTC)
15 Oct 2026 · 13:15:46.892 UTC
Times seen
1
Size
25.2 KB (25835 bytes)
MD5
dc05157666f1c63f4e381a5ce55a00b2
SHA1
06cb4c6c7d18cfa009277ae84a01252a8b57063d
SHA256
78e74947b7444487c97026f8d492f76b3fc11a781350795e20bb364b46c46452

Certificate information

Issuer
Let's Encrypt · YR2
Subject
*.corfran.com.mx
Protocol / cipher
TLSv1.3 · TLS_AES_128_GCM_SHA256
SHA1 fingerprint
D8:84:3C:C5:32:B5:54:91:3E:AF:2D:DA:6D:EB:94:61:D6:AB:8C:3E
Valid from
Thu, 15 Oct 2026 00:45:19 GMT
Valid until
Wed, 13 Jan 2027 00:45:18 GMT

Technology fingerprints

  • Apache HTTP Server (Web servers)

Detections

Detection observations attached to this HTTP transaction.
DetectionSeverityVerdict
urlquery Suspicious - Suspicious Javascript codemediumSuspicious
YARAhub by abuse.ch Detects file containing Telegram Bot APImediummalware
DNS4EU SinkholedmediumMalicious

HTTP headers

Request headers

GET /excel/WebLogin.html?eta=dues.zion@hotmail.com HTTP/1.1
Host: corfran.com.mx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.9
Accept-Encoding: gzip, deflate, br, zstd
Sec-GPC: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Priority: u=0, i
Pragma: no-cache
Cache-Control: no-cache

Response headers

HTTP/1.1 200 OK
Date: Thu, 15 Oct 2026 13:14:31 GMT
Server: Apache
Last-Modified: Thu, 15 Oct 2026 04:47:04 GMT
Accept-Ranges: bytes
Content-Length: 25835
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html
GET200stylesheet227.5 KB47 ms—
GET200stylesheet91.5 KB278 ms—
GET200stylesheet3.5 KB88 ms—
GET200script78.5 KB45 ms—
GET200font7.7 KB54 ms—
GET301subdocument0 B2377 ms—
GET301img0 B53 ms—
GET500img708 B139 ms1 alerts
GET200img769 B72 ms—
GET302subdocument0 B132 ms—
GET200subdocument0 B0 ms—
12 visible / 12 matching / 12 captured
First
Loading evidence…
WORKSPACE SETTINGS

Display preferences

Saved on this device.

SuccessInfoWarningDangerCriticalUnknown

Security colors remain independent of your accent.

Go to…

Recent scans ↵ Search reports /Search hosts ↵

No matching commands.

Ctrl/⌘ K Commands · Esc Close
LOCAL DEMONSTRATION

Notifications

No live event connection.

No notifications yet. Preview an event below.

Full request body

Full screenshot

Full browser screenshot