ch-post.info-order.site
Open in
urlscan Pro
104.21.39.125
Malicious Activity!
Public Scan
Effective URL: https://ch-post.info-order.site/218065859
Submission: On July 25 via manual from IT — Scanned from IT
Summary
TLS certificate: Issued by GTS CA 1P5 on July 22nd 2023. Valid for: 3 months.
This is the only time ch-post.info-order.site was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Swiss Post (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 172.67.163.16 172.67.163.16 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
14 | 104.21.39.125 104.21.39.125 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 142.250.184.202 142.250.184.202 | 15169 (GOOGLE) (GOOGLE) | |
4 | 142.250.184.195 142.250.184.195 | 15169 (GOOGLE) (GOOGLE) | |
19 | 4 |
ASN15169 (GOOGLE, US)
PTR: fra24s11-in-f10.1e100.net
fonts.googleapis.com |
ASN15169 (GOOGLE, US)
PTR: fra24s11-in-f3.1e100.net
fonts.gstatic.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
14 |
info-order.site
ch-post.info-order.site |
111 KB |
4 |
gstatic.com
fonts.gstatic.com |
268 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 82 |
874 B |
1 |
95link.cc
1 redirects
95link.cc |
444 B |
19 | 4 |
Domain | Requested by | |
---|---|---|
14 | ch-post.info-order.site |
ch-post.info-order.site
|
4 | fonts.gstatic.com |
ch-post.info-order.site
fonts.googleapis.com |
1 | fonts.googleapis.com |
ch-post.info-order.site
|
1 | 95link.cc | 1 redirects |
19 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
info-order.site GTS CA 1P5 |
2023-07-22 - 2023-10-20 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-07-10 - 2023-10-02 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2023-07-10 - 2023-10-02 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://ch-post.info-order.site/218065859
Frame ID: E2EEA5D70431B3CA3AD8CF86BF24FCBE
Requests: 13 HTTP requests in this frame
Frame:
https://ch-post.info-order.site/supportChatFrame/218065859
Frame ID: 1D8242CE3C5F051AA69CC2373F736CC5
Requests: 7 HTTP requests in this frame
Screenshot
Page Title
Cintura Must de Cartier donnaPage URL History Show full URLs
-
https://95link.cc/ff0890e6
HTTP 302
https://ch-post.info-order.site/218065859 Page URL
Detected technologies
Vue.js (JavaScript Frameworks) ExpandDetected patterns
- (?:/([\d.]+))?/vue(?:\.min)?\.js
Google Font API (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://95link.cc/ff0890e6
HTTP 302
https://ch-post.info-order.site/218065859 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
19 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
218065859
ch-post.info-order.site/ Redirect Chain
|
99 KB 11 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vue.min.js
ch-post.info-order.site/assets_die/ |
91 KB 35 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
696 B 874 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
styles.319ec47afc3920b5.css
ch-post.info-order.site/assets_die/ |
221 KB 27 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
postCHsvg.svg
ch-post.info-order.site/assets_die/ |
3 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
truck.svg
ch-post.info-order.site/assets_die/ |
958 B 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
support_parent.css
ch-post.info-order.site/css/ |
3 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
426 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOlCnqEu92Fr1MmSU5fBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v30/ |
11 KB 11 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
kJF1BvYX7BgnkSrUwT8OhrdQw4oELdPIeeII9v6oDMzByHX9rA6RzaxHMPdY43zj-jCxv3fzvRNU22ZXGJpEpjC_1n-q_4MrImHCIJIZrDCvHOej.woff2
fonts.gstatic.com/s/materialsymbolsoutlined/v127/ |
237 KB 238 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOkCnqEu92Fr1Mu51xIIzIXKMny.woff2
fonts.gstatic.com/s/roboto/v30/ |
12 KB 13 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOlCnqEu92Fr1MmSU5fABc4AMP6lbBP.woff2
fonts.gstatic.com/s/roboto/v30/ |
6 KB 6 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
218065859
ch-post.info-order.site/supportChatFrame/ Frame 1D82 |
23 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
supportIcon.svg
ch-post.info-order.site/img/ |
1 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
support_chat.css
ch-post.info-order.site/css/ Frame 1D82 |
97 KB 16 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
axios.min.js
ch-post.info-order.site/js/ Frame 1D82 |
14 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
support.js
ch-post.info-order.site/js/ Frame 1D82 |
5 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
getMessages
ch-post.info-order.site/api/support/ Frame 1D82 |
15 B 529 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
getMessages
ch-post.info-order.site/api/support/ Frame 1D82 |
15 B 535 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
getMessages
ch-post.info-order.site/api/support/ Frame 1D82 |
15 B 537 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Swiss Post (Transportation)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 function| Vue1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
ch-post.info-order.site/ | Name: connect.sid Value: s%3AmeeK1ZO-ozCXaTP-t1WV9e4Wk5y-KSZq.y9WlxR6uGfrED7B%2FkNiW8jHcXBSe%2BgFs8CXAgcnGr4w |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
95link.cc
ch-post.info-order.site
fonts.googleapis.com
fonts.gstatic.com
104.21.39.125
142.250.184.195
142.250.184.202
172.67.163.16
06ca34565e1f1ebe2df31c8833af58b84baeb39d7d2aaa690bbbda09816cbd94
1af0ee2e409d753adfedb8a11628be961881ad5139d1a9252fcc4984cbce5f2d
1d00c6f0cc689179cfc4dab54f10163635df53e0472ec87fb40790a74f4dbce2
24b9a49d375465e659dbaecb3fda81fbf0d3eedbf138e29cb5229e502d8a4fa1
5a6150db74c3f33743e1cca2e048a4f2e61ef322fdec540dca13777853f0faca
5e4ce7b36ba37b78a5d5f9fd08e6b7b54ba6879d651aa46ec9e1d6fa24ebe30a
72194d152571dd375c4365e5c3b4af9db2c06af0102ced18fcb062597d38be26
77dc532e1d5a0866aa249553782c0e88e29f622431f6e8c26f626d529603d5a8
8bc9bd9ed384ad7138a9fa6d997f66706e5a1aaf46094e830517b36417d77d91
8c049e3780896a1b203420df7dba08c39243e07ef7e73b0cb41df5da3a3f3cf3
8d3251f4935896ec37ada153d20d0109828ad08523127f136415355b3fca2dcf
9315ce272df3bd10349cbdf9c6bd326344b004786dd606d1b423068b65a0357b
a8030af02bd25f6db8ae5084a4e846dd137d7c27b897a87bb133181bd56e6fcf
a8e8b50e70678af351632bb865b4fc6baae41cd695e2327a132b56d97a8f855a
b1d8e73aeaca62e519b792ade3c0400821a86647bb75095a1367ae0301af807d
d157d6c71731cd55ac6685282c281699c8b0d6f2f4b8e8025a7e5a5aff4e2f53
eb8f9db2b3a818201e91cf609ea2edd3a34ca8d49683179118a3ecdc1297c5cc
f2fa035ac385840790e8cf48519ed588ebfbf0d886180842c8187406ed914294