![](/screenshots/1d3e7888-4172-4089-a9a6-134e9e8bf9f8.png)
pochtarefund-xeq7t7.aaksz.xyz
Open in
urlscan Pro
45.9.148.174
Malicious Activity!
Public Scan
Submission: On December 19 via automatic, source openphish
Summary
TLS certificate: Issued by R3 on December 16th 2020. Valid for: 3 months.
This is the only time pochtarefund-xeq7t7.aaksz.xyz was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Russian Post (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
11 | 45.9.148.174 45.9.148.174 | 49447 (NICEIT) (NICEIT) | |
2 | 2001:4de0:ac1... 2001:4de0:ac19::1:b:3a | 20446 (HIGHWINDS3) (HIGHWINDS3) | |
1 | 2a00:1450:400... 2a00:1450:4001:81d::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2001:4de0:ac1... 2001:4de0:ac19::1:b:1a | 20446 (HIGHWINDS3) (HIGHWINDS3) | |
1 | 2606:4700::68... 2606:4700::6810:125e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
3 | 2a00:1450:400... 2a00:1450:4001:825::2003 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:81e::2003 | 15169 (GOOGLE) (GOOGLE) | |
20 | 7 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
aaksz.xyz
pochtarefund-xeq7t7.aaksz.xyz |
349 KB |
4 |
gstatic.com
fonts.gstatic.com |
35 KB |
2 |
bootstrapcdn.com
stackpath.bootstrapcdn.com |
38 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com |
7 KB |
1 |
jquery.com
code.jquery.com |
30 KB |
1 |
googleapis.com
fonts.googleapis.com |
740 B |
20 | 6 |
Domain | Requested by | |
---|---|---|
11 | pochtarefund-xeq7t7.aaksz.xyz |
pochtarefund-xeq7t7.aaksz.xyz
|
4 | fonts.gstatic.com |
fonts.googleapis.com
|
2 | stackpath.bootstrapcdn.com |
pochtarefund-xeq7t7.aaksz.xyz
|
1 | cdnjs.cloudflare.com |
pochtarefund-xeq7t7.aaksz.xyz
|
1 | code.jquery.com |
pochtarefund-xeq7t7.aaksz.xyz
|
1 | fonts.googleapis.com |
pochtarefund-xeq7t7.aaksz.xyz
|
20 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.aaksz.xyz R3 |
2020-12-16 - 2021-03-16 |
3 months | crt.sh |
*.bootstrapcdn.com Sectigo RSA Domain Validation Secure Server CA |
2020-09-22 - 2021-10-12 |
a year | crt.sh |
upload.video.google.com GTS CA 1O1 |
2020-11-10 - 2021-02-02 |
3 months | crt.sh |
jquery.org Sectigo RSA Domain Validation Secure Server CA |
2020-10-06 - 2021-10-16 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2020-10-21 - 2021-10-20 |
a year | crt.sh |
*.gstatic.com GTS CA 1O1 |
2020-11-10 - 2021-02-02 |
3 months | crt.sh |
This page contains 4 frames:
Primary Page:
https://pochtarefund-xeq7t7.aaksz.xyz/item
Frame ID: 7BB2F043E13D69F7B6E7E8A2CDBCBA3C
Requests: 17 HTTP requests in this frame
Frame:
https://pochtarefund-xeq7t7.aaksz.xyz/img/logo2.svg
Frame ID: 8CC14917B26B5CE2390579893599BB54
Requests: 1 HTTP requests in this frame
Frame:
https://pochtarefund-xeq7t7.aaksz.xyz/img/code.svg
Frame ID: F3D3A58AE610A475690CD06723404693
Requests: 1 HTTP requests in this frame
Frame:
https://pochtarefund-xeq7t7.aaksz.xyz/img/logo2.svg
Frame ID: 87FD1347F07267356E389FA14BE49DD4
Requests: 1 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
20 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
item
pochtarefund-xeq7t7.aaksz.xyz/ |
11 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
stackpath.bootstrapcdn.com/bootstrap/4.3.1/css/ |
152 KB 23 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
4 KB 740 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
app.css
pochtarefund-xeq7t7.aaksz.xyz/css/ |
8 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon-bank.png
pochtarefund-xeq7t7.aaksz.xyz/img/ |
23 KB 23 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon-card.png
pochtarefund-xeq7t7.aaksz.xyz/img/ |
7 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon-courier.svg
pochtarefund-xeq7t7.aaksz.xyz/img/ |
9 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
map.jpg
pochtarefund-xeq7t7.aaksz.xyz/img/ |
256 KB 256 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.3.1.min.js
code.jquery.com/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
popper.min.js
cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.7/umd/ |
21 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
stackpath.bootstrapcdn.com/bootstrap/4.3.1/js/ |
57 KB 15 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
from.png
pochtarefund-xeq7t7.aaksz.xyz/img/ |
11 KB 11 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bullet.svg
pochtarefund-xeq7t7.aaksz.xyz/img/ |
188 B 460 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOlCnqEu92Fr1MmYUtfABc4AMP6lbBP.woff2
fonts.gstatic.com/s/roboto/v20/ |
7 KB 7 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
fonts.gstatic.com/s/roboto/v20/ |
11 KB 11 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOlCnqEu92Fr1MmYUtfBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v20/ |
11 KB 11 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
KFOmCnqEu92Fr1Mu5mxKKTU1Kvnz.woff2
fonts.gstatic.com/s/roboto/v20/ |
7 KB 7 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo2.svg
pochtarefund-xeq7t7.aaksz.xyz/img/ Frame 8CC1 |
62 KB 21 KB |
Document
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
code.svg
pochtarefund-xeq7t7.aaksz.xyz/img/ Frame F3D3 |
3 KB 992 B |
Document
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo2.svg
pochtarefund-xeq7t7.aaksz.xyz/img/ Frame 87FD |
62 KB 21 KB |
Document
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Russian Post (Transportation)16 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 object| 2 object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery function| Popper object| bootstrap0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdnjs.cloudflare.com
code.jquery.com
fonts.googleapis.com
fonts.gstatic.com
pochtarefund-xeq7t7.aaksz.xyz
stackpath.bootstrapcdn.com
2001:4de0:ac19::1:b:1a
2001:4de0:ac19::1:b:3a
2606:4700::6810:125e
2a00:1450:4001:81d::200a
2a00:1450:4001:81e::2003
2a00:1450:4001:825::2003
45.9.148.174
0a34a87842c539c1f4feec56bba982fd596b73500046a6e6fe38a22260c6577b
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
1b6863771c330f7b6a857dbfee3959d8e8c61c0e34f1e9ba5f6f38268d05573d
1ceff12ed93f07702593bbe61fd6c3b718304e3ccf8e9ebf9c6bd2844eabb493
26f4796d7fb2fa6ce25fa8b0986016c4fda32def9c8a448997ba7bc3313475a2
2731f4e47f875c7fb1717db9f999edbf60b9f35fff8006c05c186ff6b772a56d
385d3aa4379082f42b34764d494a5d0bc3d06027466a19229b2b47336b66dbfd
3afea5217192d31292aeebc35d114386a25599c3652748a3930635712b4e3ffe
433ce1d8b6bf09fef09baefbcf78d98adaf2ee8a2af3246e2383f1f2f88a5ca0
5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479
607dbd9562d020459f333ea39c07f64358eed9aae14c73708dc4854921399159
60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36
66f3a07e1fa9b64a686b66381e4458dbc8abf3dbbff954720c4eec07b84411c2
734e6e96a794090fa3727fde767f7aeabf840eed59998926c81d2a00a040f8c4
d0d4c28f432208fd49bf86927e9bd0015268bf6094a2018092df965961a9c28f
d9efa03af601fc4f15b84bfe31de72b3c40d8df5bda856ba171196d9e6ee6159
daf6c28c5a080458eba26ba64a95b1fcff823944d429ccb84e8a4f3a0baf05ca
e99ea3c08b00a61e8300df8d8176d923e470241aead58f2efd662a7189121a56
f72a7ddc46efa05feaa1b6b58e7d31be5f90fa9f9e4667c3aea4c930032a56c4