royulmail.top Open in urlscan Pro
38.60.196.209 Malicious Activity! Unlisted Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://royulmail.top/
Effective URL:
https://royulmail.top/
Submission: On March 30 via api (March 30th 2023, 3:08:27 pm UTC) from US — Scanned from US

Summary HTTP 20 Redirects Behaviour Indicators

Summary

This website contacted 6 IPs in 3 countries across 5 domains to perform 20 HTTP transactions. The main IP is 38.60.196.209, located in London, United Kingdom and belongs to KAOPU-HK Kaopu Cloud HK Limited, HK. The main domain is royulmail.top.
TLS certificate: Issued by R3 on March 30th 2023. Valid for: 3 months.

This is the only time royulmail.top was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Royal Mail (Government)

Domain & IP information

	IP Address	AS Autonomous System
1 17	38.60.196.209 38.60.196.209	138915 (KAOPU-HK ...) (KAOPU-HK Kaopu Cloud HK Limited)
1	2607:f8b0:400... 2607:f8b0:4006:80e::200a	15169 (GOOGLE) (GOOGLE)
1	2a04:4e42::485 2a04:4e42::485	54113 (FASTLY) (FASTLY)
1	52.219.4.79 52.219.4.79	16509 (AMAZON-02) (AMAZON-02)
1	2607:f8b0:400... 2607:f8b0:4006:80b::2003	15169 (GOOGLE) (GOOGLE)
20	6

17 38.60.196.209 (London, United Kingdom) 1 redirects

ASN138915 (KAOPU-HK Kaopu Cloud HK Limited, HK)

royulmail.top	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:80e::200a (Nutley, United States)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42::485 (United States)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.219.4.79 (Tokyo, Japan)

ASN16509 (AMAZON-02, US)
PTR: s3-ap-northeast-1-r-w.amazonaws.com

images-su.s3.ap-northeast-1.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:80b::2003 (Nutley, United States)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
17	royulmail.top 1 redirects royulmail.top	154 KB
1	gstatic.com fonts.gstatic.com	16 KB
1	amazonaws.com images-su.s3.ap-northeast-1.amazonaws.com	27 KB
1	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 374	54 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 47	1 KB
20	5

	Domain	Requested by
17	royulmail.top	1 redirects royulmail.top
1	fonts.gstatic.com	fonts.googleapis.com
1	images-su.s3.ap-northeast-1.amazonaws.com	royulmail.top
1	cdn.jsdelivr.net	royulmail.top
1	fonts.googleapis.com	royulmail.top
20	5

This site contains no links.

Subject Issuer	Validity	Valid
royulmail.top R3	`2023-03-30` - `2023-06-28`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-03-06` - `2023-05-29`	3 months	crt.sh
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2022 Q4	`2022-12-23` - `2024-01-24`	a year	crt.sh
*.s3-ap-northeast-1.amazonaws.com Amazon	`2022-09-21` - `2023-09-04`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2023-03-06` - `2023-05-29`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://royulmail.top/
Frame ID: F7B76752E40063C67C186B0DFEAF6700
Requests: 21 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Royal Mail | Royal Mail Group Ltd

Page URL History Show full URLs

http://royulmail.top/ HTTP 301
https://royulmail.top/ Page URL

Detected technologies

Vue.js (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

<[^>]+\sdata-v(?:ue)?-

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

<link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
//cdn\.jsdelivr\.net/

Page Statistics

20
Requests

100 %
HTTPS

60 %
IPv6

5
Domains

5
Subdomains

6
IPs

3
Countries

252 kB
Transfer

978 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://royulmail.top/ HTTP 301
https://royulmail.top/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

20 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
royulmail.top/
Redirect Chain

http://royulmail.top/
https://royulmail.top/

898 B
616 B

351ms
176ms

Document
text/html

38.60.196.209
KAOPU-HK Kaopu Cl...

General

Check archive.org

Show headers Download Go to

Full URL: https://royulmail.top/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 38.60.196.209 London, United Kingdom, ASN138915 (KAOPU-HK Kaopu Cloud HK Limited, HK),
Reverse DNS
Software: Apache /
Resource Hash: f4c0a9d82de9d9f87699da5e87644803440a7c971b6b63dc7309d58b4b9a5678

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

content-encoding: gzip
content-type: text/html; charset=utf-8
date: Thu, 30 Mar 2023 15:08:15 GMT
server: Apache
vary: Accept-Encoding

Redirect headers

Connection: close
Content-Length: 293
Content-Type: text/html; charset=iso-8859-1
Date: Thu, 30 Mar 2023 15:08:15 GMT
Location: https://royulmail.top/
Server: Apache

GET
H2 200 css
fonts.googleapis.com/ 12 KB
1 KB 652ms
39ms Stylesheet
text/css 2607:f8b0:4006:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:100,300,400,500,700,900

Requested by

Host: royulmail.top
URL: https://royulmail.top/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::200a Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

b345abe33a4f53c748b8b6858bbe2c0380add9fbbec748044d2e76d6f0bd681d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://royulmail.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 30 Mar 2023 15:08:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 30 Mar 2023 13:58:14 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 30 Mar 2023 15:08:16 GMT

GET
H2 200 materialdesignicons.min.css
cdn.jsdelivr.net/npm/@mdi/font@latest/css/ 331 KB
54 KB 548ms
11ms Stylesheet
text/css 2a04:4e42::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/@mdi/font@latest/css/materialdesignicons.min.css

Requested by

Host: royulmail.top
URL: https://royulmail.top/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

b89606bf42acdeb4f05cff729f63f2f0574e87011d4aa5a05253a3bfcd7461bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://royulmail.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Thu, 30 Mar 2023 15:08:16 GMT
x-content-type-options: nosniff
content-encoding: br
age: 7706
x-jsd-version: 7.2.96
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 54765
x-served-by: cache-fra-eddf8230030-FRA, cache-ewr18153-EWR
x-jsd-version-type: version
etag: W/"52d34-McwSlO6CU7M543fkTyDaQiyOjpU"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 chunk-vendors.c05382a3.js Show response
royulmail.top/js/ 177 KB
59 KB 311ms
271ms Script
application/javascript 38.60.196.209
KAOPU-HK Kaopu Cl...

General

Check archive.org

Show headers Download Go to

Full URL: https://royulmail.top/js/chunk-vendors.c05382a3.js
Requested by: Host: royulmail.top
URL: https://royulmail.top/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 38.60.196.209 London, United Kingdom, ASN138915 (KAOPU-HK Kaopu Cloud HK Limited, HK),
Reverse DNS
Software: Apache /
Resource Hash: c6a2e93c73ef5d200324660f2b09e0ae6fcc8e0e0e4b97a9f9f39081fd9a713e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://royulmail.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Thu, 30 Mar 2023 15:08:15 GMT
content-encoding: gzip
last-modified: Thu, 03 Nov 2022 01:17:24 GMT
server: Apache
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: no-cache
content-disposition: inline; filename=chunk-vendors.c05382a3.js

GET
H2 200 app.2904362e.js Show response
royulmail.top/js/ 18 KB
11 KB 217ms
178ms Script
application/javascript 38.60.196.209
KAOPU-HK Kaopu Cl...

General

Check archive.org

Show headers Download Go to

Full URL: https://royulmail.top/js/app.2904362e.js
Requested by: Host: royulmail.top
URL: https://royulmail.top/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 38.60.196.209 London, United Kingdom, ASN138915 (KAOPU-HK Kaopu Cloud HK Limited, HK),
Reverse DNS
Software: Apache /
Resource Hash: edab64f0fa6a2ac6e06019a54c96b390ac67bec7b12d5ab98c044be5d9d055f1

Request headers

accept-language: en-US,en;q=0.9
Referer: https://royulmail.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Thu, 30 Mar 2023 15:08:15 GMT
content-encoding: gzip
last-modified: Thu, 03 Nov 2022 01:17:24 GMT
server: Apache
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: no-cache
content-disposition: inline; filename=app.2904362e.js
content-length: 11281

GET
H2 200 chunk-vendors.5d4b611b.css
royulmail.top/css/ 313 KB
37 KB 228ms
187ms Stylesheet
text/css 38.60.196.209
KAOPU-HK Kaopu Cl...

General

Check archive.org

Show headers Download Go to

Full URL: https://royulmail.top/css/chunk-vendors.5d4b611b.css
Requested by: Host: royulmail.top
URL: https://royulmail.top/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 38.60.196.209 London, United Kingdom, ASN138915 (KAOPU-HK Kaopu Cloud HK Limited, HK),
Reverse DNS
Software: Apache /
Resource Hash: c5683374ae29fb2473db6a075bf7f93afd8887c550b79dc0b59b37325aeca1f0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://royulmail.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Thu, 30 Mar 2023 15:08:15 GMT
content-encoding: gzip
last-modified: Thu, 03 Nov 2022 01:17:24 GMT
server: Apache
vary: Accept-Encoding
content-type: text/css; charset=utf-8
cache-control: no-cache
content-disposition: inline; filename=chunk-vendors.5d4b611b.css

GET
H2 200 app.dccfe2d7.css
royulmail.top/css/ 2 KB
891 B 225ms
185ms Stylesheet
text/css 38.60.196.209
KAOPU-HK Kaopu Cl...

General

Check archive.org

Show headers Download Go to

Full URL: https://royulmail.top/css/app.dccfe2d7.css
Requested by: Host: royulmail.top
URL: https://royulmail.top/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 38.60.196.209 London, United Kingdom, ASN138915 (KAOPU-HK Kaopu Cloud HK Limited, HK),
Reverse DNS
Software: Apache /
Resource Hash: 9ef80b8270b674959dd29cc559e850569405620c144d3dae0c796a6a545607d0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://royulmail.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Thu, 30 Mar 2023 15:08:15 GMT
content-encoding: gzip
last-modified: Thu, 03 Nov 2022 01:17:24 GMT
server: Apache
vary: Accept-Encoding
content-type: text/css; charset=utf-8
cache-control: no-cache
content-disposition: inline; filename=app.dccfe2d7.css

GET
H2 200 336.b829f522.js Show response
royulmail.top/js/ 25 KB
9 KB 110ms
102ms Script
application/javascript 38.60.196.209
KAOPU-HK Kaopu Cl...

General

Check archive.org

Show headers Download Go to

Full URL: https://royulmail.top/js/336.b829f522.js
Requested by: Host: royulmail.top
URL: https://royulmail.top/js/app.2904362e.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 38.60.196.209 London, United Kingdom, ASN138915 (KAOPU-HK Kaopu Cloud HK Limited, HK),
Reverse DNS
Software: Apache /
Resource Hash: 04db06c618dec63ca1954e83e8e62f41a1db42ba57541615710756101083442c

Request headers

accept-language: en-US,en;q=0.9
Referer: https://royulmail.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Thu, 30 Mar 2023 15:08:16 GMT
content-encoding: gzip
last-modified: Thu, 03 Nov 2022 01:17:24 GMT
server: Apache
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: no-cache
content-disposition: inline; filename=336.b829f522.js
content-length: 8831

GET
H2 200 177.eb8df375.css
royulmail.top/css/ 898 B
528 B 113ms
105ms Stylesheet
text/css 38.60.196.209
KAOPU-HK Kaopu Cl...

General

Check archive.org

Show headers Download Go to

Full URL: https://royulmail.top/css/177.eb8df375.css
Requested by: Host: royulmail.top
URL: https://royulmail.top/js/app.2904362e.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 38.60.196.209 London, United Kingdom, ASN138915 (KAOPU-HK Kaopu Cloud HK Limited, HK),
Reverse DNS
Software: Apache /
Resource Hash: e8262c8ffe13a3ad8930b38e566a35d677ed572b71e9bf3714a3910ad99f444b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://royulmail.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Thu, 30 Mar 2023 15:08:16 GMT
content-encoding: gzip
last-modified: Thu, 03 Nov 2022 01:17:24 GMT
server: Apache
vary: Accept-Encoding
content-type: text/css; charset=utf-8
cache-control: no-cache
content-disposition: inline; filename=177.eb8df375.css
content-length: 470

GET
H2 200 177.a0b1fe30.js Show response
royulmail.top/js/ 18 KB
5 KB 169ms
161ms Script
application/javascript 38.60.196.209
KAOPU-HK Kaopu Cl...

General

Check archive.org

Show headers Download Go to

Full URL: https://royulmail.top/js/177.a0b1fe30.js
Requested by: Host: royulmail.top
URL: https://royulmail.top/js/app.2904362e.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 38.60.196.209 London, United Kingdom, ASN138915 (KAOPU-HK Kaopu Cloud HK Limited, HK),
Reverse DNS
Software: Apache /
Resource Hash: 906503fbf7ccb7dcbb3babf401565416ce9e77e87dfa294e1896a2aa2a7e6c8c

Request headers

accept-language: en-US,en;q=0.9
Referer: https://royulmail.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Thu, 30 Mar 2023 15:08:16 GMT
content-encoding: gzip
last-modified: Thu, 03 Nov 2022 01:17:24 GMT
server: Apache
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: no-cache
content-disposition: inline; filename=177.a0b1fe30.js
content-length: 5250

GET
H2 200 hamburger.aa161b6e.svg
royulmail.top/img/ 211 B
228 B 131ms
127ms Image
image/svg+xml 38.60.196.209
KAOPU-HK Kaopu Cl...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://royulmail.top/img/hamburger.aa161b6e.svg
Requested by: Host: royulmail.top
URL: https://royulmail.top/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 38.60.196.209 London, United Kingdom, ASN138915 (KAOPU-HK Kaopu Cloud HK Limited, HK),
Reverse DNS
Software: Apache /
Resource Hash: 4af87ec669bc44d9360fe1fc71109c9643abbda2c755459175c35dfad14ba302

Request headers

accept-language: en-US,en;q=0.9
Referer: https://royulmail.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Thu, 30 Mar 2023 15:08:16 GMT
content-encoding: gzip
last-modified: Thu, 03 Nov 2022 01:17:24 GMT
server: Apache
vary: Accept-Encoding
content-type: image/svg+xml; charset=utf-8
cache-control: no-cache
content-disposition: inline; filename=hamburger.aa161b6e.svg
content-length: 166

GET
H2 200 services-near-you.15c92d84.svg
royulmail.top/img/ 451 B
333 B 127ms
124ms Image
image/svg+xml 38.60.196.209
KAOPU-HK Kaopu Cl...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://royulmail.top/img/services-near-you.15c92d84.svg
Requested by: Host: royulmail.top
URL: https://royulmail.top/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 38.60.196.209 London, United Kingdom, ASN138915 (KAOPU-HK Kaopu Cloud HK Limited, HK),
Reverse DNS
Software: Apache /
Resource Hash: 9659d3f49ff8d643ee07901fee325dce1892ca38c96b58a361ccde36bf6f6628

Request headers

accept-language: en-US,en;q=0.9
Referer: https://royulmail.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Thu, 30 Mar 2023 15:08:16 GMT
content-encoding: gzip
last-modified: Thu, 03 Nov 2022 01:17:24 GMT
server: Apache
vary: Accept-Encoding
content-type: image/svg+xml; charset=utf-8
cache-control: no-cache
content-disposition: inline; filename=services-near-you.15c92d84.svg
content-length: 265

GET
H2 200 logo.f13984c1.png
royulmail.top/img/ 12 KB
12 KB 124ms
121ms Image
image/png 38.60.196.209
KAOPU-HK Kaopu Cl...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://royulmail.top/img/logo.f13984c1.png
Requested by: Host: royulmail.top
URL: https://royulmail.top/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 38.60.196.209 London, United Kingdom, ASN138915 (KAOPU-HK Kaopu Cloud HK Limited, HK),
Reverse DNS
Software: Apache /
Resource Hash: 344b29deab56ac203aa9d4c258a097020f4b207da082f1267e2b9a4280903c34

Request headers

accept-language: en-US,en;q=0.9
Referer: https://royulmail.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Thu, 30 Mar 2023 15:08:16 GMT
cache-control: no-cache
last-modified: Thu, 03 Nov 2022 01:17:24 GMT
content-disposition: inline; filename=logo.f13984c1.png
server: Apache
content-length: 12718
content-type: image/png

GET
H2 200 person.ec418a7b.svg
royulmail.top/img/ 438 B
389 B 98ms
95ms Image
image/svg+xml 38.60.196.209
KAOPU-HK Kaopu Cl...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://royulmail.top/img/person.ec418a7b.svg
Requested by: Host: royulmail.top
URL: https://royulmail.top/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 38.60.196.209 London, United Kingdom, ASN138915 (KAOPU-HK Kaopu Cloud HK Limited, HK),
Reverse DNS
Software: Apache /
Resource Hash: 91095b8a80ec3e7bb3feabc39ec2ecc0445644568292ffbc3df5dd96dcbe8134

Request headers

accept-language: en-US,en;q=0.9
Referer: https://royulmail.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Thu, 30 Mar 2023 15:08:16 GMT
content-encoding: gzip
last-modified: Thu, 03 Nov 2022 01:17:24 GMT
server: Apache
vary: Accept-Encoding
content-type: image/svg+xml; charset=utf-8
cache-control: no-cache
content-disposition: inline; filename=person.ec418a7b.svg
content-length: 307

GET
H2 200 search.87b8a9da.svg
royulmail.top/img/ 292 B
286 B 134ms
131ms Image
image/svg+xml 38.60.196.209
KAOPU-HK Kaopu Cl...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://royulmail.top/img/search.87b8a9da.svg
Requested by: Host: royulmail.top
URL: https://royulmail.top/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 38.60.196.209 London, United Kingdom, ASN138915 (KAOPU-HK Kaopu Cloud HK Limited, HK),
Reverse DNS
Software: Apache /
Resource Hash: 5406a168b9663a41e7126094996e180bb0a03eb39857e9321f43c4d5a565cb34

Request headers

accept-language: en-US,en;q=0.9
Referer: https://royulmail.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Thu, 30 Mar 2023 15:08:16 GMT
content-encoding: gzip
last-modified: Thu, 03 Nov 2022 01:17:24 GMT
server: Apache
vary: Accept-Encoding
content-type: image/svg+xml; charset=utf-8
cache-control: no-cache
content-disposition: inline; filename=search.87b8a9da.svg
content-length: 227

GET
H2 200 chevron.5ee309b6.svg
royulmail.top/img/ 170 B
212 B 132ms
130ms Image
image/svg+xml 38.60.196.209
KAOPU-HK Kaopu Cl...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://royulmail.top/img/chevron.5ee309b6.svg
Requested by: Host: royulmail.top
URL: https://royulmail.top/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 38.60.196.209 London, United Kingdom, ASN138915 (KAOPU-HK Kaopu Cloud HK Limited, HK),
Reverse DNS
Software: Apache /
Resource Hash: dd65b4b10b2ed5d6b8551aba22bd90467dc2fbeb70575ae3a04bd92246802f4e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://royulmail.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Thu, 30 Mar 2023 15:08:16 GMT
content-encoding: gzip
last-modified: Thu, 03 Nov 2022 01:17:24 GMT
server: Apache
vary: Accept-Encoding
content-type: image/svg+xml; charset=utf-8
cache-control: no-cache
content-disposition: inline; filename=chevron.5ee309b6.svg
content-length: 152

GET
DATA 200
OK truncated
/ 6 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8e5bd63208d0cf73eb49c33fe135dbb66e5fe3d680fac9abeb4a4670a79b01a7

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 external.2703e74e.svg
royulmail.top/img/ 261 B
272 B 123ms
123ms Image
image/svg+xml 38.60.196.209
KAOPU-HK Kaopu Cl...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://royulmail.top/img/external.2703e74e.svg
Requested by: Host: royulmail.top
URL: https://royulmail.top/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 38.60.196.209 London, United Kingdom, ASN138915 (KAOPU-HK Kaopu Cloud HK Limited, HK),
Reverse DNS
Software: Apache /
Resource Hash: 00eaf266b1c04be7ee1327002f005320edc9b77ab0a609c3cc37279a71c3ffc1

Request headers

accept-language: en-US,en;q=0.9
Referer: https://royulmail.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Thu, 30 Mar 2023 15:08:16 GMT
content-encoding: gzip
last-modified: Thu, 03 Nov 2022 01:17:24 GMT
server: Apache
vary: Accept-Encoding
content-type: image/svg+xml; charset=utf-8
cache-control: no-cache
content-disposition: inline; filename=external.2703e74e.svg
content-length: 212

GET
H/1.1 200
OK background.png
images-su.s3.ap-northeast-1.amazonaws.com/images/ 27 KB
27 KB 997ms
461ms Image
image/png 52.219.4.79
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images-su.s3.ap-northeast-1.amazonaws.com/images/background.png
Requested by: Host: royulmail.top
URL: https://royulmail.top/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.219.4.79 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-ap-northeast-1-r-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: d57a72e085a27b2f6b83fda6535b0a5fe10053023d08c387c1f751a1c0add98a

Request headers

accept-language: en-US,en;q=0.9
Referer: https://royulmail.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Thu, 30 Mar 2023 15:08:18 GMT
Last-Modified: Wed, 02 Nov 2022 20:11:51 GMT
Server: AmazonS3
x-amz-request-id: NDC5NQ1235QF8WA7
ETag: "e0de26d09d9d37deab7b4f93ad11225c"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 27246
x-amz-id-2: kuWaj0xHUg4gmoPaOvBDlDSw/+VIYgUS7sqaL3u2Ri+cGIkR4jHWKkgh8qLiCxR7cRyPa4ZHz3U=

GET
H2 200 loader-1.8c2ef1a7.gif
royulmail.top/img/ 17 KB
17 KB 113ms
113ms Image
image/gif 38.60.196.209
KAOPU-HK Kaopu Cl...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://royulmail.top/img/loader-1.8c2ef1a7.gif
Requested by: Host: royulmail.top
URL: https://royulmail.top/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 38.60.196.209 London, United Kingdom, ASN138915 (KAOPU-HK Kaopu Cloud HK Limited, HK),
Reverse DNS
Software: Apache /
Resource Hash: 15d00b6ea1ab8c26f181c0074e7fe69fb40ce0aa22a0f9414193c33a79c0f44a

Request headers

accept-language: en-US,en;q=0.9
Referer: https://royulmail.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Thu, 30 Mar 2023 15:08:17 GMT
cache-control: no-cache
last-modified: Thu, 03 Nov 2022 01:17:24 GMT
content-disposition: inline; filename=loader-1.8c2ef1a7.gif
server: Apache
content-length: 17234
content-type: image/gif

GET
H2 200 KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
16 KB 134ms
27ms Font
font/woff2 2607:f8b0:4006:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,300,400,500,700,900

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80b::2003 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f75911313e1c7802c23345ab57e754d87801581706780c993fb23ff4e0fe62ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://royulmail.top
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Thu, 30 Mar 2023 09:55:05 GMT
x-content-type-options: nosniff
age: 18792
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15740
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 29 Mar 2024 09:55:05 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Royal Mail (Government)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| webpackChunkukpost

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.jsdelivr.net
fonts.googleapis.com
fonts.gstatic.com
images-su.s3.ap-northeast-1.amazonaws.com
royulmail.top
2607:f8b0:4006:80b::2003
2607:f8b0:4006:80e::200a
2a04:4e42::485
38.60.196.209
52.219.4.79
00eaf266b1c04be7ee1327002f005320edc9b77ab0a609c3cc37279a71c3ffc1
04db06c618dec63ca1954e83e8e62f41a1db42ba57541615710756101083442c
15d00b6ea1ab8c26f181c0074e7fe69fb40ce0aa22a0f9414193c33a79c0f44a
344b29deab56ac203aa9d4c258a097020f4b207da082f1267e2b9a4280903c34
4af87ec669bc44d9360fe1fc71109c9643abbda2c755459175c35dfad14ba302
5406a168b9663a41e7126094996e180bb0a03eb39857e9321f43c4d5a565cb34
8e5bd63208d0cf73eb49c33fe135dbb66e5fe3d680fac9abeb4a4670a79b01a7
906503fbf7ccb7dcbb3babf401565416ce9e77e87dfa294e1896a2aa2a7e6c8c
91095b8a80ec3e7bb3feabc39ec2ecc0445644568292ffbc3df5dd96dcbe8134
9659d3f49ff8d643ee07901fee325dce1892ca38c96b58a361ccde36bf6f6628
9ef80b8270b674959dd29cc559e850569405620c144d3dae0c796a6a545607d0
b345abe33a4f53c748b8b6858bbe2c0380add9fbbec748044d2e76d6f0bd681d
b89606bf42acdeb4f05cff729f63f2f0574e87011d4aa5a05253a3bfcd7461bf
c5683374ae29fb2473db6a075bf7f93afd8887c550b79dc0b59b37325aeca1f0
c6a2e93c73ef5d200324660f2b09e0ae6fcc8e0e0e4b97a9f9f39081fd9a713e
d57a72e085a27b2f6b83fda6535b0a5fe10053023d08c387c1f751a1c0add98a
dd65b4b10b2ed5d6b8551aba22bd90467dc2fbeb70575ae3a04bd92246802f4e
e8262c8ffe13a3ad8930b38e566a35d677ed572b71e9bf3714a3910ad99f444b
edab64f0fa6a2ac6e06019a54c96b390ac67bec7b12d5ab98c044be5d9d055f1
f4c0a9d82de9d9f87699da5e87644803440a7c971b6b63dc7309d58b4b9a5678
f75911313e1c7802c23345ab57e754d87801581706780c993fb23ff4e0fe62ef

royulmail.top Open in urlscan Pro 38.60.196.209 Malicious Activity! Unlisted Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

20 Requests

100 %HTTPS

60 %IPv6

5 Domains

5 Subdomains

6 IPs

3 Countries

252 kBTransfer

978 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

20 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

0 Cookies

Indicators

royulmail.top Open in urlscan Pro
38.60.196.209 Malicious Activity! Unlisted Scan

Screenshot
Live screenshot

Full Image

20
Requests

100 %
HTTPS

60 %
IPv6

5
Domains

5
Subdomains

6
IPs

3
Countries

252 kB
Transfer

978 kB
Size

0
Cookies

20 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!