![](/screenshots/1aaf3a6f-907f-456e-86a4-0c0dcc69649c.png)
postal-oz.top
Open in
urlscan Pro
204.44.92.197
Malicious Activity!
Public Scan
Effective URL: https://postal-oz.top/
Submission: On September 01 via api from US — Scanned from US
Summary
TLS certificate: Issued by R3 on September 1st 2023. Valid for: 3 months.
This is the only time postal-oz.top was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: USPS (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 8 | 204.44.92.197 204.44.92.197 | 8100 (ASN-QUADR...) (ASN-QUADRANET-GLOBAL) | |
1 | 2606:4700::68... 2606:4700::6810:fa43 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
8 | 2 |
ASN8100 (ASN-QUADRANET-GLOBAL, US)
PTR: 204.44.92.197.static.quadranet.com
postal-oz.top |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
postal-oz.top
1 redirects
postal-oz.top |
146 KB |
1 |
fonts.net
fast.fonts.net — Cisco Umbrella Rank: 3759 |
546 B |
8 | 2 |
Domain | Requested by | |
---|---|---|
8 | postal-oz.top |
1 redirects
postal-oz.top
|
1 | fast.fonts.net |
postal-oz.top
|
8 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
ue-postal.top R3 |
2023-09-01 - 2023-11-30 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-05-05 - 2024-05-04 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://postal-oz.top/
Frame ID: 0B3B35F34599DAD9FA4E4DFFE2A7A2B2
Requests: 8 HTTP requests in this frame
Screenshot
![](/screenshots/1aaf3a6f-907f-456e-86a4-0c0dcc69649c.png)
Page Title
USPS.comĀ® - USPS TrackingĀ® ResultsPage URL History Show full URLs
-
http://postal-oz.top/
HTTP 301
https://postal-oz.top/ Page URL
Detected technologies
![](/vendor/wappa/icons/Bootstrap.png)
Detected patterns
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
![](/vendor/wappa/icons/Vue.js.png)
Detected patterns
- <[^>]+\sdata-v(?:ue)?-
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://postal-oz.top/
HTTP 301
https://postal-oz.top/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
8 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
postal-oz.top/ Redirect Chain
|
1 KB 734 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
index-29557f3b.css
postal-oz.top/static/css/ |
304 KB 60 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.js
postal-oz.top/static/js/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
postal-oz.top/static/js/ |
39 KB 11 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
axios.js
postal-oz.top/static/js/ |
42 KB 11 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
postal-oz.top/static/js/ |
86 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
data.js
postal-oz.top/static/js/ |
7 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1.css
fast.fonts.net/t/ |
0 546 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: USPS (Transportation)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture function| $ function| jQuery function| axios3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
postal-oz.top/ | Name: think_lang Value: en-us |
|
postal-oz.top/ | Name: PHPSESSID Value: ca71032afa0c2560177d491ef5761e6d |
|
.fonts.net/ | Name: __cf_bm Value: iK0ouH71F8r3ZsCnguh6f0w32WyAz0JlBxdzbR0.G_Q-1693597331-0-AbpLw4msejXeTB9x8ZrPVmlmUdOYukI/Qd59VfqGpCH36nQHeECCwlKvUy+JlaA/d32dZSWrRN1NYKtrmgcsJjg= |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fast.fonts.net
postal-oz.top
204.44.92.197
2606:4700::6810:fa43
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
32b42f9bc813dd6bad1b45129eade1df8dd1463908f79505209fbfa1aa71018a
34536bb948cf9dae653a11f99c30cd5aa1d3f8fcb018624d3164046c6a319776
96b65382c74cd6255d4628044c5394f2ef3f0662d7d72b10f1bceb50b6ee5455
9ee2fcff6709e4d0d24b09ca0fc56aade12b4961ed9c43fd13b03248bfb57afe
a2fa1faf8c05785159a7868f1c705b725f05e6b9410eb790266dba33dd0d873d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f3c4ba6619fe0f79706cde1a108d522820f85f3157aa4a53241396ad5b308d50