qatarpost-qa.chillhousebuy.com Open in urlscan Pro
2606:4700:3037::ac43:a5b9 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://qatarpost-qa.chillhousebuy.com/
Effective URL:
https://qatarpost-qa.chillhousebuy.com/
Submission: On January 29 via api (January 29th 2024, 1:02:42 am UTC) from US — Scanned from US

Summary HTTP 4 Redirects Links 28 Behaviour Indicators

Summary

This website contacted 4 IPs in 1 countries across 3 domains to perform 4 HTTP transactions. The main IP is 2606:4700:3037::ac43:a5b9, located in United States and belongs to CLOUDFLARENET, US. The main domain is qatarpost-qa.chillhousebuy.com.
TLS certificate: Issued by GTS CA 1P5 on January 19th 2024. Valid for: 3 months.

This is the only time qatarpost-qa.chillhousebuy.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Qatar Post (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
1 3	2606:4700:303... 2606:4700:3037::ac43:a5b9	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2620:0:861:ed... 2620:0:861:ed1a::2:b	14907 (WIKIMEDIA) (WIKIMEDIA)
1	2606:4700:303... 2606:4700:3034::ac43:d793	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	4

3 2606:4700:3037::ac43:a5b9 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

qatarpost-qa.chillhousebuy.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:0:861:ed1a::2:b (United States)

ASN14907 (WIKIMEDIA, US)

upload.wikimedia.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3034::ac43:d793 (United States)

ASN13335 (CLOUDFLARENET, US)

sa.keyz2thecity.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	chillhousebuy.com 1 redirects qatarpost-qa.chillhousebuy.com	581 KB
1	keyz2thecity.com sa.keyz2thecity.com	571 B
1	wikimedia.org upload.wikimedia.org — Cisco Umbrella Rank: 2907	28 KB
4	3

	Domain	Requested by
3	qatarpost-qa.chillhousebuy.com	1 redirects qatarpost-qa.chillhousebuy.com
1	sa.keyz2thecity.com	qatarpost-qa.chillhousebuy.com
1	upload.wikimedia.org	qatarpost-qa.chillhousebuy.com
4	3

This site contains links to these domains. Also see Links.

Domain
qatarpost.qa
portal.qatarpost.qa
store.qatarpost.qa
www.connected.qa
www.facebook.com
twitter.com
www.instagram.com
www.youtube.com
www.linkedin.com
apps.apple.com
play.google.com

Subject Issuer	Validity	Valid
chillhousebuy.com GTS CA 1P5	`2024-01-19` - `2024-04-18`	3 months	crt.sh
*.wikipedia.org R3	`2023-12-20` - `2024-03-19`	3 months	crt.sh
keyz2thecity.com E1	`2023-12-31` - `2024-03-30`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://qatarpost-qa.chillhousebuy.com/
Frame ID: E1BBA63B8D6A1C8F8FE2FD63D258AB57
Requests: 15 HTTP requests in this frame

Frame: https://sa.keyz2thecity.com/qtr/checkout/?src=OFF
Frame ID: 2B1F9B424B7FA1FB14D6E4107B11C9B8
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

شروط والأحكام

Page URL History Show full URLs

http://qatarpost-qa.chillhousebuy.com/ HTTP 301
https://qatarpost-qa.chillhousebuy.com/ Page URL

Page Statistics

4
Requests

100 %
HTTPS

100 %
IPv6

3
Domains

3
Subdomains

4
IPs

1
Countries

704 kB
Transfer

1608 kB
Size

0
Cookies

28 Outgoing links

These are links going to different origins than the main page.

URL: https://qatarpost.qa/ar/home

Search URL Search Domain Scan URL

URL: https://qatarpost.qa/ar/loginuser
Title: تسجيل الدخول

Search URL Search Domain Scan URL

URL: https://qatarpost.qa/termsncondition

Search URL Search Domain Scan URL

URL: https://qatarpost.qa/home
Title: الأفراد

Search URL Search Domain Scan URL

URL: https://portal.qatarpost.qa/webcenter/portal/QPostPortal/pages_home/business
Title: اعمال

Search URL Search Domain Scan URL

URL: https://store.qatarpost.qa/webstore
Title: متجر

Search URL Search Domain Scan URL

URL: https://www.connected.qa/ar
Title: كونيكتيد

Search URL Search Domain Scan URL

URL: https://qatarpost.qa/ar/managemypobox
Title: الاشتراك في صندوق البريد عبر الإنترنت

Search URL Search Domain Scan URL

URL: https://qatarpost.qa/ar/visionmissiongoals
Title: الرؤية و الرسالة و الأهداف

Search URL Search Domain Scan URL

URL: https://qatarpost.qa/ar/history
Title: تاريخ بريد قطر

Search URL Search Domain Scan URL

URL: https://qatarpost.qa/ar/news
Title: أخبار

Search URL Search Domain Scan URL

URL: https://qatarpost.qa/ar/branchlocator
Title: الفروع وساعات العمل

Search URL Search Domain Scan URL

URL: https://qatarpost.qa/ar/careers
Title: الوظائف

Search URL Search Domain Scan URL

URL: https://qatarpost.qa/ar/faqs
Title: الأسئلة الشائعة

Search URL Search Domain Scan URL

URL: https://qatarpost.qa/ar/dangerousgoods
Title: المواد المحظورة

Search URL Search Domain Scan URL

URL: https://qatarpost.qa/ar/postalstandards
Title: المعايير البريدية

Search URL Search Domain Scan URL

URL: https://qatarpost.qa/ar/video
Title: فيديوهات

Search URL Search Domain Scan URL

URL: https://qatarpost.qa/ar/privacypolicy
Title: سياسة الخصوصية

Search URL Search Domain Scan URL

URL: https://qatarpost.qa/ar/informationsecuritypolicy
Title: السياسة العامة لأمن المعلومات

Search URL Search Domain Scan URL

URL: https://qatarpost.qa/ar/termsncondition
Title: الشروط والأحكام

Search URL Search Domain Scan URL

URL: https://qatarpost.qa/ar/integratedmanagementsystempolicy
Title: سياسة نظام الإدارة المتكامل

Search URL Search Domain Scan URL

URL: https://www.facebook.com/qatarpost/

Search URL Search Domain Scan URL

URL: https://twitter.com/QATAR_POST

Search URL Search Domain Scan URL

URL: https://www.instagram.com/qatar.post/

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCW_U5vRfYb-fHXJrI0IKrfA

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/qatar-general-postal-corporation-q-post-/people/

Search URL Search Domain Scan URL

URL: https://apps.apple.com/app/id1266211128

Search URL Search Domain Scan URL

URL: https://play.google.com/store/apps/details?id=qa.com.qatarpost2

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://qatarpost-qa.chillhousebuy.com/ HTTP 301
https://qatarpost-qa.chillhousebuy.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions
12 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
qatarpost-qa.chillhousebuy.com/
Redirect Chain

http://qatarpost-qa.chillhousebuy.com/
https://qatarpost-qa.chillhousebuy.com/

1006 KB
579 KB

628ms
560ms

Document
text/html

2606:4700:3037::ac43:a5b9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://qatarpost-qa.chillhousebuy.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3037::ac43:a5b9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9d18fef1a6abe544c5c3e4f4006d8b43337d9a31554109177a91f765df92e0a3

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 84cd8cee1a2e4bbb-BUF
content-encoding: gzip
content-security-policy: upgrade-insecure-requests
content-type: text/html
date: Mon, 29 Jan 2024 01:02:35 GMT
last-modified: Mon, 27 Nov 2023 07:55:34 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
platform: hostinger
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kpFOehO1SHZO359JNypOSElmIToMlRR2HCzVPm9pAzhRU%2B%2BHH7ep8Z2SZIeKBPVHFmPuS%2FwNCL3KFEHWuBk%2FQBQy%2BxRE9VVostmrd%2BTbZNI8NSLkFomPDqS9UB9Wvng%2FS1cU2GetNLgEt4dvWNgiXlXLPj9Kt9g4XMA5BBI%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-turbo-charged-by: LiteSpeed

Redirect headers

CF-RAY: 84cd8ced6df44bd2-BUF
Cache-Control: max-age=3600
Connection: keep-alive
Date: Mon, 29 Jan 2024 01:02:35 GMT
Expires: Mon, 29 Jan 2024 02:02:35 GMT
Location: https://qatarpost-qa.chillhousebuy.com/
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BttB9cEBMW%2FzNWgLDhLPjg%2Fm1LC8BbK7CxMSKk62O1yFn93Wkt9tSd5LkMHZGv34ZQ67NzlQenlX0wtaXMDy7PWtUtcJLbAlTXsOJ%2FwUFE2xWlJMHKq8%2FN8wzPUsGiuATO%2Fz%2BLoa3gw2RIeXalD6SVLKL395VLEchY%2BBNh0%3D"}],"group":"cf-nel","max_age":604800}
Server: cloudflare
Transfer-Encoding: chunked
Vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400

GET
DATA 200
OK truncated
/ 27 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 35bad6bde5f7928bcdec714cbc5b7b6f10ccf2b8ef6a59e2a45744d436dbfdf0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 23382ab8e5fe9fa5a7bd1a74d12829ceb67e3ce621aaaa7b5037325a3890a65c

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 4 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8d60c806abe0a1868ea9b10ff1001cab7fdd5477c9e743842df70db41fba995c

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 4 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cc20bbcf3d9cc85278056a8c8141558e536fbe70e0c48d814fd08bee6a810265

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 Qpost-logo.png
upload.wikimedia.org/wikipedia/commons/0/08/ 27 KB
28 KB 204ms
90ms Image
image/png 2620:0:861:ed1a::2:b
WIKIMEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://upload.wikimedia.org/wikipedia/commons/0/08/Qpost-logo.png

Requested by

Host: qatarpost-qa.chillhousebuy.com
URL: https://qatarpost-qa.chillhousebuy.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:0:861:ed1a::2:b , United States, ASN14907 (WIKIMEDIA, US),

Reverse DNS

Software

envoy /

Resource Hash

35bad6bde5f7928bcdec714cbc5b7b6f10ccf2b8ef6a59e2a45744d436dbfdf0

Security Headers

Name	Value
Strict-Transport-Security	max-age=106384710; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Mon, 29 Jan 2024 01:02:36 GMT
strict-transport-security: max-age=106384710; includeSubDomains; preload
x-content-type-options: nosniff
nel: { "report_to": "wm_nel", "max_age": 604800, "failure_fraction": 0.05, "success_fraction": 0.0}
age: 0
x-cache-status: hit-local
x-cache: cp1103 hit, cp1103 miss
server-timing: cache;desc="hit-local", host;desc="cp1103"
content-length: 28088
x-client-ip: 2602:ffc8:2:104::11
x-object-meta-sha1base36: mhldk1vrra96q4b6ipxv2wjhvqycmwy
last-modified: Mon, 23 Aug 2021 07:38:39 GMT
server: envoy
etag: 6325eafc3d72a3eb668e2da9c6247e23
report-to: { "group": "wm_nel", "max_age": 604800, "endpoints": [{ "url": "https://intake-logging.wikimedia.org/v1/events?stream=w3c.reportingapi.network_error&schema_uri=/w3c/reportingapi/network_error/1.0.0" }] }
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Age, Date, Content-Length, Content-Range, X-Content-Duration, X-Cache
accept-ranges: bytes
timing-allow-origin: *

GET
DATA 200
OK truncated
/ 4 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2b4dc0ed4a2b77d6309f57db9b15862530ffc9524f4b5b3eb8bbad2c06bd6e0b

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 4 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 42418fe47db14e99ac15bd904ea9f4fefb27f76367ccb41b3c9250e2f2d6b27d

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 19 KB
19 KB Font
font/woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 51d7afa5395ad12844f433fe21d3b8fa333e1ecbeb8b406c728c69870a9c4765

Request headers

Referer
Origin: https://qatarpost-qa.chillhousebuy.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type: font/woff

GET
DATA 200
OK truncated
/ 75 KB
75 KB Font
font/woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Request headers

Referer
Origin: https://qatarpost-qa.chillhousebuy.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type: font/woff2

GET
H2 200 / Show response
sa.keyz2thecity.com/qtr/checkout/ Frame 2B1F 101 B
571 B 460ms
346ms Document
text/html 2606:4700:3034::ac43:d793
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://sa.keyz2thecity.com/qtr/checkout/?src=OFF
Requested by: Host: qatarpost-qa.chillhousebuy.com
URL: https://qatarpost-qa.chillhousebuy.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::ac43:d793 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b139ed248984c9230dfe366b5582efa9efd0b777fcbc65f89e9f2baf5470afca

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 84cd8cf918864bc6-BUF
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Mon, 29 Jan 2024 01:02:37 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dg%2Bq7gn75pudWPqd06VhyjESuTKNpNFROwe5y3ppwT%2B2sx5jusJe8HDz%2BXZlpTXk1lOd5gOsspi%2BvYsPS8Og8eezsio6L6zfPB%2FoQ281ZMdYbpgm8GQkCNyoxd0goeLT7Unor45GHzb31zjqMoskKvrI"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
DATA 200
OK truncated
/ 37 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e51fa46e07dcf337758eefc67ab188c14afff6500a692578243bca9850af585e

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 388 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 193ce33047b3b03ce0e24da1bf3d70507eaba50d95fb9c293da2d0b5830c2b69

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ 6 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5a4607302a28ac27f9e083779598747107c0ea7e4f0062d72de69f6903230525

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2f4058dc2048016eda730d48f841e21b1cab7227046686b7ee8faa8463c67462

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 email-decode.min.js Show response
qatarpost-qa.chillhousebuy.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
1 KB 34ms
33ms Script
application/javascript 2606:4700:3037::ac43:a5b9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://qatarpost-qa.chillhousebuy.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Requested by

Host: qatarpost-qa.chillhousebuy.com
URL: https://qatarpost-qa.chillhousebuy.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3037::ac43:a5b9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Mon, 29 Jan 2024 01:02:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 26 Jan 2024 10:32:07 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"65b38a27-4d7"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oAZheGS1QobXQfaBHOpVV%2FENpjqdVSiOAT0tkyeijLsOMg5tILRCVkAZz%2FpjYYQ4VgGB1CxOmwMsxE1Bl0hvCneYCPHiq4h1L27GgAYMl3goor4HaUxFuT%2FDH%2FJMmxnICbdA7U1CdqI5KA%2F3UKkisgOn8AloZfV%2B7yfU%2F90%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-frame-options: DENY
cache-control: max-age=172800, public
cf-ray: 84cd8cf9ff274bbb-BUF
expires: Wed, 31 Jan 2024 01:02:37 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Qatar Post (Transportation)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	error	URL: https://sa.keyz2thecity.com/qtr/checkout/?src=OFF(Line 1) Message: Unsafe attempt to initiate navigation for frame with URL 'https://qatarpost-qa.chillhousebuy.com/' from frame with URL 'https://sa.keyz2thecity.com/qtr/checkout/?src=OFF'. The frame attempting navigation is targeting its top-level window, but is neither same-origin with its target nor has it received a user gesture. See https://www.chromestatus.com/feature/5851021045661696.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

qatarpost-qa.chillhousebuy.com
sa.keyz2thecity.com
upload.wikimedia.org
2606:4700:3034::ac43:d793
2606:4700:3037::ac43:a5b9
2620:0:861:ed1a::2:b
193ce33047b3b03ce0e24da1bf3d70507eaba50d95fb9c293da2d0b5830c2b69
23382ab8e5fe9fa5a7bd1a74d12829ceb67e3ce621aaaa7b5037325a3890a65c
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2b4dc0ed4a2b77d6309f57db9b15862530ffc9524f4b5b3eb8bbad2c06bd6e0b
2f4058dc2048016eda730d48f841e21b1cab7227046686b7ee8faa8463c67462
35bad6bde5f7928bcdec714cbc5b7b6f10ccf2b8ef6a59e2a45744d436dbfdf0
42418fe47db14e99ac15bd904ea9f4fefb27f76367ccb41b3c9250e2f2d6b27d
51d7afa5395ad12844f433fe21d3b8fa333e1ecbeb8b406c728c69870a9c4765
5a4607302a28ac27f9e083779598747107c0ea7e4f0062d72de69f6903230525
8d60c806abe0a1868ea9b10ff1001cab7fdd5477c9e743842df70db41fba995c
9d18fef1a6abe544c5c3e4f4006d8b43337d9a31554109177a91f765df92e0a3
b139ed248984c9230dfe366b5582efa9efd0b777fcbc65f89e9f2baf5470afca
cc20bbcf3d9cc85278056a8c8141558e536fbe70e0c48d814fd08bee6a810265
e51fa46e07dcf337758eefc67ab188c14afff6500a692578243bca9850af585e

qatarpost-qa.chillhousebuy.com Open in urlscan Pro 2606:4700:3037::ac43:a5b9 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

4 Requests

100 %HTTPS

100 %IPv6

3 Domains

3 Subdomains

4 IPs

1 Countries

704 kBTransfer

1608 kBSize

0 Cookies

28 Outgoing links

Page URL History

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 12 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

0 Cookies

1 Console Messages

Security Headers

Indicators

qatarpost-qa.chillhousebuy.com Open in urlscan Pro
2606:4700:3037::ac43:a5b9 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

100 %
HTTPS

100 %
IPv6

3
Domains

3
Subdomains

4
IPs

1
Countries

704 kB
Transfer

1608 kB
Size

0
Cookies

4 HTTP transactions
12 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!