![](/screenshots/39ec9070-e316-44b7-ae51-01c395828f20.png)
onlinelpn.net
Open in
urlscan Pro
47.254.92.209
Malicious Activity!
Public Scan
Effective URL: https://onlinelpn.net/repalce-address
Submission: On July 15 via manual from HU — Scanned from CA
Summary
TLS certificate: Issued by R11 on July 14th 2024. Valid for: 3 months.
This is the only time onlinelpn.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: USPS (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 18.238.49.108 18.238.49.108 | 16509 (AMAZON-02) (AMAZON-02) | |
1 2 | 47.254.92.209 47.254.92.209 | 45102 (ALIBABA-C...) (ALIBABA-CN-NET Alibaba US Technology Co.) | |
2 | 2606:2800:21f... 2606:2800:21f:3e9e:5a:9b8f:bddb:fb7c | 15133 (EDGECAST) (EDGECAST) | |
2 | 2606:4700::68... 2606:4700::6811:190e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
5 | 4 |
ASN16509 (AMAZON-02, US)
PTR: server-18-238-49-108.jfk52.r.cloudfront.net
l.ead.me |
ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN)
onlinelpn.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
2 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 240 |
69 KB |
2 |
usps.com
reg.usps.com — Cisco Umbrella Rank: 40856 |
8 KB |
2 |
onlinelpn.net
1 redirects
onlinelpn.net |
241 KB |
1 |
ead.me
1 redirects
l.ead.me — Cisco Umbrella Rank: 431719 |
349 B |
5 | 4 |
Domain | Requested by | |
---|---|---|
2 | cdnjs.cloudflare.com |
onlinelpn.net
|
2 | reg.usps.com |
onlinelpn.net
|
2 | onlinelpn.net | 1 redirects |
1 | l.ead.me | 1 redirects |
5 | 4 |
This site contains links to these domains. Also see Links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
onlinelpn.net R11 |
2024-07-14 - 2024-10-12 |
3 months | crt.sh |
*.usps.com DigiCert TLS RSA SHA256 2020 CA1 |
2024-05-17 - 2025-06-13 |
a year | crt.sh |
cdnjs.cloudflare.com E1 |
2024-06-02 - 2024-08-31 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://onlinelpn.net/repalce-address
Frame ID: 5920A7F1CD231BF68F8E470BB7C050F2
Requests: 14 HTTP requests in this frame
Screenshot
![](/screenshots/39ec9070-e316-44b7-ae51-01c395828f20.png)
Page Title
USPS.comĀ® - Register for an online accountPage URL History Show full URLs
-
https://l.ead.me/bf7qNs
HTTP 302
https://onlinelpn.net/?parameter=c8nkfa783gf HTTP 302
https://onlinelpn.net/repalce-address Page URL
Detected technologies
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
24 Outgoing links
These are links going to different origins than the main page.
Title: www.usps.com/privacypolicy.
Search URL Search Domain Scan URL
Title: Contact Us
Search URL Search Domain Scan URL
Title: Site Index
Search URL Search Domain Scan URL
Title: FAQs
Search URL Search Domain Scan URL
Title: About USPS Home
Search URL Search Domain Scan URL
Title: Newsroom
Search URL Search Domain Scan URL
Title: USPS Service Updates
Search URL Search Domain Scan URL
Title: Forms & Publications
Search URL Search Domain Scan URL
Title: Government Services
Search URL Search Domain Scan URL
Title: Careers
Search URL Search Domain Scan URL
Title: Business Customer Gateway
Search URL Search Domain Scan URL
Title: Postal Inspectors
Search URL Search Domain Scan URL
Title: Inspector General
Search URL Search Domain Scan URL
Title: Postal Explorer
Search URL Search Domain Scan URL
Title: National Postal Museum
Search URL Search Domain Scan URL
Title: Resources for Developers
Search URL Search Domain Scan URL
Title: Privacy Policy
Search URL Search Domain Scan URL
Title: Terms of Use
Search URL Search Domain Scan URL
Title: FOIA
Search URL Search Domain Scan URL
Title: No FEAR Act EEO Data
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://l.ead.me/bf7qNs
HTTP 302
https://onlinelpn.net/?parameter=c8nkfa783gf HTTP 302
https://onlinelpn.net/repalce-address Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
5 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
repalce-address
onlinelpn.net/ Redirect Chain
|
505 KB 241 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
des_brd_2color_logo_274x79.png
reg.usps.com/entreg/assets/images/ |
7 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
rmin-step-1.png
reg.usps.com/entreg/assets/images/ |
506 B 583 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
633 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
57 KB 57 KB |
Font
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
46 KB 46 KB |
Font
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
23 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
3 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
3 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
5 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
3 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
jquery.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.0.0-beta1/ |
256 KB 64 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
jquery.mask.js
cdnjs.cloudflare.com/ajax/libs/jquery.mask/1.14.10/ |
20 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
50 KB 50 KB |
Font
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: USPS (Transportation)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| savepage_ShadowLoader function| $ function| jQuery function| myFunction1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
onlinelpn.net/ | Name: PHPSESSID Value: 6fbv3legci07jdna870saka7mo |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdnjs.cloudflare.com
l.ead.me
onlinelpn.net
reg.usps.com
18.238.49.108
2606:2800:21f:3e9e:5a:9b8f:bddb:fb7c
2606:4700::6811:190e
47.254.92.209
03ca1e2ab37fb3830730e8732c052d69d07d48d5e91f90222584dc85935e612c
194aeec3c0a28672905ad28fc88a464c2db67ab4277b1d29c3e5275013f2c638
4355e35cc451fceed2b769dfe843032c733869fb7ed5da1e09471fcd3b0e1a8c
585262db6911000f59795831f9db7bb41477bcafb135c82b51b0473363134fcf
59f5e4d40c77bc5155713bc956ddb8f4c14e3438d906a920f977073a071fb228
67a4999a59962445831760592fbdc95e023c6c0884cec51fa7bc7cd22c6e0a8a
748622d4d088b843e200776ce65e48c3e7e4b3a7c0fc959c691d99def179205e
78f27c3d7cb5d766466703adc7f7ad7706b7fb05514eec39be0aa253449bd0f8
a6176a82ee3406958660af5fc2f4145c3a324e9a03f46f82ae740ed7c2abe14a
b3a08dd44a05750d27893ce5557ad47333e42d9be692e494675ea8a6b4a41ec5
bcafef03600ff7498457c30861f61146e46c7320c085bc27d540c1e2357bc3dc
be483938eb34538b970684f72e312f62652e84b42b7ad86953962d1ce2217c44
cf3e7a66af3bdd01b6b76bfdd29aa9f3b896cd84720622f57707265c5fb7d599
d3a98329cd78abccb1803215e94d51ec9cd41862ae54997945d416012a5f62cf