thiswaytotheborder.com
Open in
urlscan Pro
192.99.223.234
Malicious Activity!
Public Scan
Effective URL: https://thiswaytotheborder.com/CHpost/?cep=rM0vT64IN_7sQnODN9sOg6JULGRUl6JrL9rPjVaPyM7cwz70DLOeNcdYDOLrph5UYrXPxynmU2Ed4Etq8_E8...
Submission: On September 20 via manual from CH
Summary
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on August 28th 2019. Valid for: a year.
This is the only time thiswaytotheborder.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Swiss Post (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 34.227.226.117 34.227.226.117 | 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com) | |
1 1 | 35.157.133.117 35.157.133.117 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
1 | 192.99.223.234 192.99.223.234 | 16276 (OVH) (OVH) | |
3 | 35.244.137.202 35.244.137.202 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
3 | 2606:4700::68... 2606:4700::6810:233f | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
1 | 2a00:1450:400... 2a00:1450:4001:81f::200a | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 | 192.229.133.208 192.229.133.208 | 15133 (EDGECAST) (EDGECAST - MCI Communications Services) | |
2 | 130.211.30.60 130.211.30.60 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
3 | 2a00:1450:400... 2a00:1450:4001:825::2003 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
14 | 7 |
ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-34-227-226-117.compute-1.amazonaws.com
fsprr.com |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-35-157-133-117.eu-central-1.compute.amazonaws.com
track.tracknclicks.com |
ASN15169 (GOOGLE - Google LLC, US)
PTR: 202.137.244.35.bc.googleusercontent.com
g.fastcdn.co |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
cdn.onesignal.com | |
onesignal.com |
ASN15169 (GOOGLE - Google LLC, US)
fonts.googleapis.com |
ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US)
v.fastcdn.co |
ASN15169 (GOOGLE - Google LLC, US)
PTR: 60.30.211.130.bc.googleusercontent.com
heatmap.services |
ASN15169 (GOOGLE - Google LLC, US)
fonts.gstatic.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
fastcdn.co
g.fastcdn.co v.fastcdn.co |
32 KB |
3 |
gstatic.com
fonts.gstatic.com |
27 KB |
3 |
onesignal.com
cdn.onesignal.com onesignal.com |
60 KB |
2 |
heatmap.services
heatmap.services |
4 KB |
1 |
googleapis.com
fonts.googleapis.com |
1 KB |
1 |
thiswaytotheborder.com
thiswaytotheborder.com |
14 KB |
1 |
tracknclicks.com
1 redirects
track.tracknclicks.com |
1 KB |
1 |
fsprr.com
1 redirects
fsprr.com |
261 B |
14 | 8 |
Domain | Requested by | |
---|---|---|
3 | fonts.gstatic.com |
thiswaytotheborder.com
|
3 | g.fastcdn.co |
thiswaytotheborder.com
|
2 | heatmap.services |
thiswaytotheborder.com
heatmap.services |
2 | cdn.onesignal.com |
thiswaytotheborder.com
cdn.onesignal.com |
1 | onesignal.com |
cdn.onesignal.com
|
1 | v.fastcdn.co |
thiswaytotheborder.com
|
1 | fonts.googleapis.com |
thiswaytotheborder.com
|
1 | thiswaytotheborder.com | |
1 | track.tracknclicks.com | 1 redirects |
1 | fsprr.com | 1 redirects |
14 | 10 |
This site contains links to these domains. Also see Links.
Domain |
---|
track.tracknclicks.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
thiswaytotheborder.com Sectigo RSA Domain Validation Secure Server CA |
2019-08-28 - 2020-08-27 |
a year | crt.sh |
g.fastcdn.co Let's Encrypt Authority X3 |
2019-08-28 - 2019-11-26 |
3 months | crt.sh |
ssl473492.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2 |
2019-07-02 - 2020-01-08 |
6 months | crt.sh |
*.googleapis.com GTS CA 1O1 |
2019-09-05 - 2019-11-28 |
3 months | crt.sh |
v.fastcdn.co DigiCert SHA2 Secure Server CA |
2017-10-24 - 2020-06-09 |
3 years | crt.sh |
heatmap.services COMODO RSA Domain Validation Secure Server CA |
2018-04-20 - 2020-04-19 |
2 years | crt.sh |
*.google.com GTS CA 1O1 |
2019-09-05 - 2019-11-28 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://thiswaytotheborder.com/CHpost/?cep=rM0vT64IN_7sQnODN9sOg6JULGRUl6JrL9rPjVaPyM7cwz70DLOeNcdYDOLrph5UYrXPxynmU2Ed4Etq8_E8clHq2b-7dn55wF3Txq9K3pFBn0DXaeoiSrrdtNGByBzIKk180qxDQ-VIilzi_Ailwj53bi0UitssplD95iZ52wJsircySlaMdJuc85BFXwUSaUwLIgAFrQTZISxJriPS6e4mfmbVGoIWOh-qXpGbXZmAExs8QOoAA8ELdMv_LPZmLWKs9hlY8ml0axzZSFlsNu_RaL5atSZwsdrdY-qhFEmapT5AYdR2J3kZrQnS52vh&lptoken=15f068c8970d93f803de
Frame ID: A3BF522ED7EEB3E9CB79FDF0FD0FD2E3
Requests: 14 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://fsprr.com/791
HTTP 302
https://track.tracknclicks.com/0111c86f-775d-48de-bbcb-113d5c890c55 HTTP 302
https://thiswaytotheborder.com/CHpost/?cep=rM0vT64IN_7sQnODN9sOg6JULGRUl6JrL9rPjVaPyM7cwz70DLOeNcdYDOLrph5U... Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- headers server /php\/?([\d.]+)?/i
CentOS (Operating Systems) Expand
Detected patterns
- headers server /CentOS/i
OpenSSL (Web Server Extensions) Expand
Detected patterns
- headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i
Apache (Web Servers) Expand
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
Google Font API (Font Scripts) Expand
Detected patterns
- html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title:
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://fsprr.com/791
HTTP 302
https://track.tracknclicks.com/0111c86f-775d-48de-bbcb-113d5c890c55 HTTP 302
https://thiswaytotheborder.com/CHpost/?cep=rM0vT64IN_7sQnODN9sOg6JULGRUl6JrL9rPjVaPyM7cwz70DLOeNcdYDOLrph5UYrXPxynmU2Ed4Etq8_E8clHq2b-7dn55wF3Txq9K3pFBn0DXaeoiSrrdtNGByBzIKk180qxDQ-VIilzi_Ailwj53bi0UitssplD95iZ52wJsircySlaMdJuc85BFXwUSaUwLIgAFrQTZISxJriPS6e4mfmbVGoIWOh-qXpGbXZmAExs8QOoAA8ELdMv_LPZmLWKs9hlY8ml0axzZSFlsNu_RaL5atSZwsdrdY-qhFEmapT5AYdR2J3kZrQnS52vh&lptoken=15f068c8970d93f803de Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
thiswaytotheborder.com/CHpost/ Redirect Chain
|
14 KB 14 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
utils.96115e0e398cba385e4c.js
g.fastcdn.co/js/ |
32 KB 11 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Cradle.54177007bb509a9c0552.js
g.fastcdn.co/js/ |
16 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
LazyImage.11f65ec56b7eb117e504.js
g.fastcdn.co/js/ |
3 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
OneSignalSDK.js
cdn.onesignal.com/sdks/ |
17 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
24 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
46159230-0-Skrmbillede-2019-09-.png
v.fastcdn.co/u/86d496f7/ |
15 KB 15 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
lib.js
heatmap.services/static/ |
10 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mem5YaGs126MiZpBA-UN7rgOUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v17/ |
9 KB 9 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v17/ |
9 KB 9 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v17/ |
9 KB 9 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
OneSignalPageSDKES6.js
cdn.onesignal.com/sdks/ |
214 KB 52 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
web
onesignal.com/api/v1/sync/8784864e-8b2f-48c8-9a4d-2d21a49b0e9c/ |
3 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
raw-data
heatmap.services/api/ |
33 B 392 B |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Swiss Post (Transportation)26 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| OneSignal object| __variantsData number| __page_id number| __default_experience_id number| __version string| __variant string| __variant_custom_name boolean| __preview number| __page_type string| __variant_hash string| __page_domain number| __predator_throttle object| __predator_blacklist boolean| __page_generator object| _Translate object| webpackJsonp object| core object| __core-js_shared__ object| __eventBus object| __config number| __workspaceWidth number| __oneSignalSdkLoadCount function| __jp0 object| _htmp0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.onesignal.com
fonts.googleapis.com
fonts.gstatic.com
fsprr.com
g.fastcdn.co
heatmap.services
onesignal.com
thiswaytotheborder.com
track.tracknclicks.com
v.fastcdn.co
130.211.30.60
192.229.133.208
192.99.223.234
2606:4700::6810:233f
2a00:1450:4001:81f::200a
2a00:1450:4001:825::2003
34.227.226.117
35.157.133.117
35.244.137.202
0a2617768e184d5ddcc9a4e65b4780f0028502af41c54c438c18177bcaf581aa
0a733c9a259685cf9a9816145434c0087227f35400e16208e7e63e58ccd44538
10746954a07869acc8d41a5107902ab54ec17875aff6a289599ed223dab119db
16f688bad571627f2a40dad80951a0220fa5d11cdf8fb2888bf2887c53811c7d
4d4e7b0fd5db7220cae70cef05b9ee13c1f28efdc433fb1df1719126a2e588f9
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
60f7db69ce06cc1ba8e63489cd3ea3e72b1ad8881daf28ba2a8d73148e54ec25
77187de7f83031f12fd13c8fc56b656549eeffa84477ca44bff95153c224b646
a48a6e4b14fe55f750c0a3dfb5a6f4941bdc06af0aa542b90de25c30c2b4625c
a80f35623695004113b7439593e0e84613cc0385f2d7d651b8748861a189779e
a8c3e77b3670e862e745a50d611cb3ead2c0731f9e165b90ab82194edbca7828
aeae628bb5c58695aeeb38d775b0d3e58f0d3448679f5f2a1c9038cc63ae2156
b8e23a845bc6b7fd417d29182e0e38d353e64b5e12e06bb1de2b5ce063db1dcc
ec3229424f384b8b89766dbbe066a032fc0c28196241df63d4b789375fb8fd66