![](/screenshots/3069b2d5-95b6-4ac1-9fe4-8511e633db41.png)
returndirect-online.com
Open in
urlscan Pro
185.156.72.17
Malicious Activity!
Public Scan
Submission: On March 29 via api from GB — Scanned from GB
Summary
This is the only time returndirect-online.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Royal Mail (Government)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
10 | 185.156.72.17 185.156.72.17 | 61432 (VAIZ-AS I...) (VAIZ-AS ITBks892) | |
1 | 2.21.20.211 2.21.20.211 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
11 | 3 |
ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-21-20-211.deploy.static.akamaitechnologies.com
www.royalmail.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
returndirect-online.com
returndirect-online.com |
270 KB |
1 |
royalmail.com
www.royalmail.com — Cisco Umbrella Rank: 47230 |
61 KB |
11 | 2 |
Domain | Requested by | |
---|---|---|
10 | returndirect-online.com |
returndirect-online.com
|
1 | www.royalmail.com | |
11 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.royalmail.com Entrust Certification Authority - L1K |
2022-06-01 - 2023-06-01 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
http://returndirect-online.com/
Frame ID: B9FE942DA8354BFDAABEA8889CED3753
Requests: 12 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
returndirect-online.com/ |
95 KB 31 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
css_GbyBld2YVfGaoHcw3eZJtGlhAxDTBpV3xkP06qLMwBI.css
returndirect-online.com/rumi_assetz/css/ |
26 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
css__6NsxoZZPhWfqnbaEQb7wCY6LyRmdblZQ2D8Q7XDSIY.css
returndirect-online.com/rumi_assetz/css/ |
829 KB 96 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo.png
returndirect-online.com/rumi_assetz/img/ |
12 KB 13 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
SafeSpace-logo.png
returndirect-online.com/rumi_assetz/img/ |
6 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
10 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
redelivery_background_image.jpg
www.royalmail.com/sites/royalmail.com/files/styles/intro_desktop_reduced/public/2020-10/ |
61 KB 61 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
scam-guidance.png
returndirect-online.com/rumi_assetz/img/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
keep-me-posted.png
returndirect-online.com/rumi_assetz/img/ |
11 KB 11 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
chevin-medium.woff
returndirect-online.com/rumi_assetz/fonts/ |
34 KB 34 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
pfdintextstd-bold-webfont.woff
returndirect-online.com/rumi_assetz/fonts/ |
33 KB 33 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
chevin-bold.woff
returndirect-online.com/rumi_assetz/fonts/ |
35 KB 35 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Royal Mail (Government)1 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
returndirect-online.com/ | Name: PHPSESSID Value: 1006a4d2d52d66569f3bd1acac32c6ad |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
returndirect-online.com
www.royalmail.com
185.156.72.17
2.21.20.211
101040cce1a0f84a41f1f5a15a2ae5507c4d96d89de4ebdd9492cb81d6966fc0
19bc8195dd9855f19aa07730dde649b469610310d3069577c643f4eaa2ccc012
3060f58cd766bb2fcaab5b176a99cc2d731086d6b895137554ceac63ee31db03
344b29deab56ac203aa9d4c258a097020f4b207da082f1267e2b9a4280903c34
4380aee5cd17c45b917f4575cc43857d5716df8e35744ca2de8927f9d6cf925c
59b1b91d85d2c035f814c3bf2022b2b45cff6f816dfb9e918e1820d4e527d451
5e001149ad167758a03acb66388cc23c2aba60bbe811da33bb2ea44c59157eb7
8e5bd63208d0cf73eb49c33fe135dbb66e5fe3d680fac9abeb4a4670a79b01a7
9314ec2d98780f916a6357eaee875203f4fb04438313c111fafa9a36ba579997
a8c3bcb00ae3ee45dc394906c4e5e23e88a905234d8343ed43c9069618a2d69e
ab0d37e28146cdcbaed1152d246a8bede90c4bb6c116e076622daf055b858c9f
c4c5803969be7974c37be81e77723fa781e2917fae61fc0f3ba9bc46af27d055