![](/screenshots/4c8232c6-29bc-436f-b03d-685d275aeb5f.png)
details.m-auspost.com
Open in
urlscan Pro
104.21.59.163
Malicious Activity!
Public Scan
Effective URL: https://details.m-auspost.com/
Submission: On February 25 via manual from AU — Scanned from AU
Summary
TLS certificate: Issued by GTS CA 1P5 on February 10th 2023. Valid for: 3 months.
This is the only time details.m-auspost.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Australia Post (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 67.199.248.11 67.199.248.11 | 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM) | |
1 1 | 172.67.196.29 172.67.196.29 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
10 | 104.21.59.163 104.21.59.163 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
10 | 2 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
m-auspost.com
details.m-auspost.com |
682 KB |
1 |
blt-ly.site
1 redirects
blt-ly.site |
466 B |
1 |
bit.ly
1 redirects
bit.ly — Cisco Umbrella Rank: 5165 |
231 B |
10 | 3 |
Domain | Requested by | |
---|---|---|
10 | details.m-auspost.com |
details.m-auspost.com
|
1 | blt-ly.site | 1 redirects |
1 | bit.ly | 1 redirects |
10 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.m-auspost.com GTS CA 1P5 |
2023-02-10 - 2023-05-11 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://details.m-auspost.com/
Frame ID: BA384EFB9CECEF60EC62FD3BB9AF3642
Requests: 11 HTTP requests in this frame
Screenshot
![](/screenshots/4c8232c6-29bc-436f-b03d-685d275aeb5f.png)
Page Title
aupost-newsPage URL History Show full URLs
-
https://bit.ly/3YMMrpT
HTTP 301
https://blt-ly.site/2Ippe6b HTTP 301
https://details.m-auspost.com/ Page URL
Detected technologies
![](/vendor/wappa/icons/Vue.js.png)
Detected patterns
- <[^>]+\sdata-v(?:ue)?-
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://bit.ly/3YMMrpT
HTTP 301
https://blt-ly.site/2Ippe6b HTTP 301
https://details.m-auspost.com/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
10 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
details.m-auspost.com/ Redirect Chain
|
687 B 798 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
chunk-vendors.66e75b20.js
details.m-auspost.com/js/ |
1 MB 341 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app.149e2466.js
details.m-auspost.com/js/ |
9 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
chunk-vendors.3f4f33a0.css
details.m-auspost.com/css/ |
351 KB 71 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app.bc651dc8.css
details.m-auspost.com/css/ |
29 B 361 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
user
details.m-auspost.com/api/card/websocket-domain/ |
114 B 620 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
487.2e5dcb50.css
details.m-auspost.com/css/ |
576 KB 101 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
487.efd879fb.js
details.m-auspost.com/js/ |
20 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
logo2.9f47e540.png
details.m-auspost.com/img/ |
34 KB 35 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
23 KB 23 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Delivery%20Condensed%20Black.82fab809.ttf
details.m-auspost.com/fonts/ |
123 KB 123 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Australia Post (Transportation)5 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| webpackChunkaupost_news object| __vueuse_ssr_handlers__ object| $cookies boolean| __VUE__4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
details.m-auspost.com/api | Name: JSESSIONID Value: 149733D3A277C586783FCCDAFB0E8E8B |
|
.bit.ly/ | Name: _bit Value: n1p05X-e806bcd271d94b84f3-00L |
|
details.m-auspost.com/ | Name: domainName Value: wss%3A%2F%2Fm.ag-linkt.org%2Fapi%2Fapprove%2F |
|
details.m-auspost.com/ | Name: userIp Value: 173.245.209.160 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bit.ly
blt-ly.site
details.m-auspost.com
104.21.59.163
172.67.196.29
67.199.248.11
1845cfc43a11017dd19133ea1cb48011365d1696b0616b2db10ac8d9d581a306
34915843cf3aee52d510d8fa92bfd42fd17ad4a64676b2fd1eeba138a101e455
50ba20b7c653e82926b60049f1b950a9f3fd63e2817a8e583923d26aee996f5b
58d6334bfdc0ab9e5e55154f9a20ae1683f6792aeb0ebc46ada1b21c9e4ac0d4
aaace6703e59f1408f91cc86c820cdc0abbc30176c25bd530e601620a8d87615
af30123a80228fb7c202164427d32ba8111c7ac6f903bff1fbb742098f9290f8
cc9fab522421c0c01bd297c3f823b57593ffb82d4570206e491f04e435cd7ed5
db4328e4bdeba035392415b321294b9cb794c5d4019c89b6b9bcff9e002d93d2
e43c9fd2717470a58eadef3e095d44e5904c17c2dbfe61806ed684ee2873758a
ea8055348ed2e51533ac39e1ecf400ffdee9058014577b4680bd574cc58ab867
ffbe940d0a791f6460ca6597ddb19ff883bc0664d5d373c0493445ea8d09e0b0