www.royalmail-delivery.ml Open in urlscan Pro
179.43.142.175  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response www.royalmail-delivery.ml/	9 KB 3 KB	134ms 30ms	Document text/html	179.43.142.175 PLI-AS
General Check archive.org Show headers Download Go to Full URL https://www.royalmail-delivery.ml/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 179.43.142.175 Zurich, Switzerland, ASN51852 (PLI-AS, PA), Reverse DNS Software Apache/2.4.38 (Debian) / Resource Hash 5b96325311acc571c3a933d8292e9b2dd4395c1301be7d05e44933617b27bf4f Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Connection Keep-Alive Content-Encoding gzip Content-Length 3018 Content-Type text/html; charset=UTF-8 Date Tue, 28 Jun 2022 13:34:55 GMT Keep-Alive timeout=5, max=100 Server Apache/2.4.38 (Debian) Vary Accept-Encoding
GET H/1.1	200 OK	index.css www.royalmail-delivery.ml/assets/css/	2 KB 908 B	18ms 17ms	Stylesheet text/css	179.43.142.175 PLI-AS
General Check archive.org Show headers Download Go to Full URL https://www.royalmail-delivery.ml/assets/css/index.css Requested by Host: www.royalmail-delivery.ml URL: https://www.royalmail-delivery.ml/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 179.43.142.175 Zurich, Switzerland, ASN51852 (PLI-AS, PA), Reverse DNS Software Apache/2.4.38 (Debian) / Resource Hash 5b6372a686d0cea58be71d3f16c51ea7c74c22d0e42d8683ea3e7a243a211934 Request headers accept-language de-DE,de;q=0.9 Referer https://www.royalmail-delivery.ml/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers Date Tue, 28 Jun 2022 13:34:55 GMT Content-Encoding gzip Last-Modified Fri, 03 Jun 2022 14:17:40 GMT Server Apache/2.4.38 (Debian) ETag "603-5e08bc8f30900-gzip" Vary Accept-Encoding Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 573
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.6.0/	87 KB 31 KB	51ms 15ms	Script text/javascript	2a00:1450:4001:80e::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js Requested by Host: www.royalmail-delivery.ml URL: https://www.royalmail-delivery.ml/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.royalmail-delivery.ml/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Tue, 28 Jun 2022 13:31:38 GMT content-encoding gzip x-content-type-options nosniff age 197 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 31017 x-xss-protection 0 last-modified Wed, 10 Mar 2021 14:28:09 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Wed, 28 Jun 2023 13:31:38 GMT
GET H/1.1	200 OK	form.js Show response www.royalmail-delivery.ml/assets/js/	3 KB 937 B	50ms 17ms	Script application/javascript	179.43.142.175 PLI-AS
General Check archive.org Show headers Download Go to Full URL https://www.royalmail-delivery.ml/assets/js/form.js Requested by Host: www.royalmail-delivery.ml URL: https://www.royalmail-delivery.ml/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 179.43.142.175 Zurich, Switzerland, ASN51852 (PLI-AS, PA), Reverse DNS Software Apache/2.4.38 (Debian) / Resource Hash b46ff70e59f24b5d39ad818a06b7c69050504091c8d80db1a3851a95659be3bb Request headers accept-language de-DE,de;q=0.9 Referer https://www.royalmail-delivery.ml/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers Date Tue, 28 Jun 2022 13:34:55 GMT Content-Encoding gzip Last-Modified Wed, 15 Jun 2022 13:28:00 GMT Server Apache/2.4.38 (Debian) ETag "c0a-5e17c7d6c5800-gzip" Vary Accept-Encoding Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 587
GET H/1.1	200 OK	header.css www.royalmail-delivery.ml/assets/css/	715 B 638 B	34ms 16ms	Stylesheet text/css	179.43.142.175 PLI-AS
General Check archive.org Show headers Download Go to Full URL https://www.royalmail-delivery.ml/assets/css/header.css Requested by Host: www.royalmail-delivery.ml URL: https://www.royalmail-delivery.ml/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 179.43.142.175 Zurich, Switzerland, ASN51852 (PLI-AS, PA), Reverse DNS Software Apache/2.4.38 (Debian) / Resource Hash bfead901423b5f2f4ca3a9aa7fee87cce8f79de4e054f3fb676ce3c60fd58d77 Request headers accept-language de-DE,de;q=0.9 Referer https://www.royalmail-delivery.ml/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers Date Tue, 28 Jun 2022 13:34:55 GMT Content-Encoding gzip Last-Modified Thu, 02 Jun 2022 19:37:42 GMT Server Apache/2.4.38 (Debian) ETag "2cb-5e07c23a2ed80-gzip" Vary Accept-Encoding Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 303
GET H/1.1	200 OK	logo.png www.royalmail-delivery.ml/assets/images/	12 KB 13 KB	19ms 18ms	Image image/png	179.43.142.175 PLI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.royalmail-delivery.ml/assets/images/logo.png Requested by Host: www.royalmail-delivery.ml URL: https://www.royalmail-delivery.ml/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 179.43.142.175 Zurich, Switzerland, ASN51852 (PLI-AS, PA), Reverse DNS Software Apache/2.4.38 (Debian) / Resource Hash 344b29deab56ac203aa9d4c258a097020f4b207da082f1267e2b9a4280903c34 Request headers accept-language de-DE,de;q=0.9 Referer https://www.royalmail-delivery.ml/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers Date Tue, 28 Jun 2022 13:34:55 GMT Last-Modified Thu, 02 Jun 2022 15:36:44 GMT Server Apache/2.4.38 (Debian) ETag "31ae-5e078c5df5b00" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 12718
GET H2	200	visa_115x72.png payments.worldpay.com/resources/static/89-0/img/logos/	4 KB 4 KB	124ms 86ms	Image image/png	151.101.2.47 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://payments.worldpay.com/resources/static/89-0/img/logos/visa_115x72.png Requested by Host: www.royalmail-delivery.ml URL: https://www.royalmail-delivery.ml/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.2.47 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash b27a419a67b083d8e0daa128715c555374e77b56dd88b9d2d8dfaf0222f5ab05 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.royalmail-delivery.ml/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers strict-transport-security max-age=63072000; includeSubDomains; preload via 1.1 varnish x-content-type-options nosniff age 0 x-cache HIT content-length 3977 x-xss-protection 1; mode=block x-served-by cache-fra19165-FRA last-modified Thu, 01 Jan 1970 00:00:01 GMT x-timer S1656423295.269350,VS0,VE79 date Tue, 28 Jun 2022 13:34:55 GMT vary Origin, Access-Control-Request-Method, Access-Control-Request-Headers access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH content-type image/png access-control-allow-origin * cache-control no-store accept-ranges bytes access-control-allow-headers content-type x-cache-hits 1
GET H2	200	mastercard_115x72.png payments.worldpay.com/resources/static/89-0/img/logos/	2 KB 2 KB	16ms 8ms	Image image/png	151.101.2.47 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://payments.worldpay.com/resources/static/89-0/img/logos/mastercard_115x72.png Requested by Host: www.royalmail-delivery.ml URL: https://www.royalmail-delivery.ml/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.2.47 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 68c197a4e06478ea59d33ac31ac1cf1d56d7fe5b48aaa9c7e50ce2c213ac3db4 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.royalmail-delivery.ml/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers strict-transport-security max-age=63072000; includeSubDomains; preload via 1.1 varnish x-content-type-options nosniff age 40983 x-cache HIT content-length 2182 x-xss-protection 1; mode=block x-served-by cache-fra19165-FRA last-modified Thu, 01 Jan 1970 00:00:01 GMT x-timer S1656423295.269546,VS0,VE0 date Tue, 28 Jun 2022 13:34:55 GMT vary Origin, Access-Control-Request-Method, Access-Control-Request-Headers access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH content-type image/png access-control-allow-origin * cache-control no-store accept-ranges bytes access-control-allow-headers content-type x-cache-hits 20
GET H2	200	maestro_115x72.png payments.worldpay.com/resources/static/89-0/img/logos/	3 KB 3 KB	14ms 7ms	Image image/png	151.101.2.47 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://payments.worldpay.com/resources/static/89-0/img/logos/maestro_115x72.png Requested by Host: www.royalmail-delivery.ml URL: https://www.royalmail-delivery.ml/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.2.47 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 4a6f1ce2469bcb4a4872948722fbfc4b3fbf5bb2ab74b0696ceca688f4bec19e Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.royalmail-delivery.ml/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers strict-transport-security max-age=63072000; includeSubDomains; preload via 1.1 varnish x-content-type-options nosniff age 34 x-cache HIT content-length 2942 x-xss-protection 1; mode=block x-served-by cache-fra19165-FRA last-modified Thu, 01 Jan 1970 00:00:01 GMT x-timer S1656423295.269337,VS0,VE0 date Tue, 28 Jun 2022 13:34:55 GMT vary Origin, Access-Control-Request-Method, Access-Control-Request-Headers access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH content-type image/png access-control-allow-origin * cache-control no-store accept-ranges bytes access-control-allow-headers content-type x-cache-hits 1136
GET H2	200	pin-card-multicard.svg payments.worldpay.com/resources/static/89-0/img/card/	15 KB 15 KB	15ms 8ms	Image image/svg+xml	151.101.2.47 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://payments.worldpay.com/resources/static/89-0/img/card/pin-card-multicard.svg Requested by Host: www.royalmail-delivery.ml URL: https://www.royalmail-delivery.ml/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.2.47 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 2fcf58ffdd7ab1fe8467038fab765b0cc23f8e9e55406955b67903a0bb13737f Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.royalmail-delivery.ml/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers strict-transport-security max-age=63072000; includeSubDomains; preload via 1.1 varnish x-content-type-options nosniff age 19304 x-cache HIT content-length 15372 x-xss-protection 1; mode=block x-served-by cache-fra19165-FRA last-modified Thu, 01 Jan 1970 00:00:01 GMT x-timer S1656423295.269564,VS0,VE0 date Tue, 28 Jun 2022 13:34:55 GMT vary Origin, Access-Control-Request-Method, Access-Control-Request-Headers access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH content-type image/svg+xml access-control-allow-origin * cache-control no-store accept-ranges bytes access-control-allow-headers content-type x-cache-hits 21
GET H/1.1	200 OK	footer.css www.royalmail-delivery.ml/assets/css/	870 B 677 B	17ms 17ms	Stylesheet text/css	179.43.142.175 PLI-AS
General Check archive.org Show headers Download Go to Full URL https://www.royalmail-delivery.ml/assets/css/footer.css Requested by Host: www.royalmail-delivery.ml URL: https://www.royalmail-delivery.ml/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 179.43.142.175 Zurich, Switzerland, ASN51852 (PLI-AS, PA), Reverse DNS Software Apache/2.4.38 (Debian) / Resource Hash 72e4bd8cda447f01c166d74ee3d7314bd3f01ff48c2ed7097b8139970f39c042 Request headers accept-language de-DE,de;q=0.9 Referer https://www.royalmail-delivery.ml/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers Date Tue, 28 Jun 2022 13:34:55 GMT Content-Encoding gzip Last-Modified Thu, 02 Jun 2022 20:37:54 GMT Server Apache/2.4.38 (Debian) ETag "366-5e07cfaedac80-gzip" Vary Accept-Encoding Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 342

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Royal Mail (Government)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| $ function| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
payments.worldpay.com
www.royalmail-delivery.ml
151.101.2.47
179.43.142.175
2a00:1450:4001:80e::200a
2fcf58ffdd7ab1fe8467038fab765b0cc23f8e9e55406955b67903a0bb13737f
344b29deab56ac203aa9d4c258a097020f4b207da082f1267e2b9a4280903c34
4a6f1ce2469bcb4a4872948722fbfc4b3fbf5bb2ab74b0696ceca688f4bec19e
5b6372a686d0cea58be71d3f16c51ea7c74c22d0e42d8683ea3e7a243a211934
5b96325311acc571c3a933d8292e9b2dd4395c1301be7d05e44933617b27bf4f
68c197a4e06478ea59d33ac31ac1cf1d56d7fe5b48aaa9c7e50ce2c213ac3db4
72e4bd8cda447f01c166d74ee3d7314bd3f01ff48c2ed7097b8139970f39c042
b27a419a67b083d8e0daa128715c555374e77b56dd88b9d2d8dfaf0222f5ab05
b46ff70e59f24b5d39ad818a06b7c69050504091c8d80db1a3851a95659be3bb
bfead901423b5f2f4ca3a9aa7fee87cce8f79de4e054f3fb676ce3c60fd58d77
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e