viajesexitus.com
Open in
urlscan Pro
174.136.25.160
Malicious Activity!
Public Scan
Effective URL: http://viajesexitus.com/IsraeilPoste/IsraeilPoste/app/
Submission: On May 07 via manual from IL — Scanned from DE
Summary
This is the only time viajesexitus.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Israel Post (Transporation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 167.89.118.83 167.89.118.83 | 11377 (SENDGRID) (SENDGRID) | |
1 | 192.254.186.156 192.254.186.156 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
6 | 174.136.25.160 174.136.25.160 | 17378 (AS17378) (AS17378) | |
7 | 2 |
ASN11377 (SENDGRID, US)
PTR: o16789118x83.outbound-mail.sendgrid.net
mail-links.digitevent.com |
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: coldspring.co.uk
repararfacil.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
viajesexitus.com
viajesexitus.com |
82 KB |
1 |
repararfacil.com
repararfacil.com |
284 B |
1 |
digitevent.com
1 redirects
mail-links.digitevent.com |
235 B |
7 | 3 |
Domain | Requested by | |
---|---|---|
6 | viajesexitus.com |
repararfacil.com
viajesexitus.com |
1 | repararfacil.com | |
1 | mail-links.digitevent.com | 1 redirects |
7 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
repararfacil.com R3 |
2023-03-19 - 2023-06-17 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
http://viajesexitus.com/IsraeilPoste/IsraeilPoste/app/
Frame ID: 8700233E9EB18B9E8F28B77D145FC094
Requests: 7 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://mail-links.digitevent.com/ls/click?upn=pLHFc7LgLURqKrLHtiaLqIVeISiFuSN7rmPYdJ6tiLdHt-2FGU3ZhMdmVYXij9F...
HTTP 302
https://repararfacil.com/IL.html Page URL
- http://viajesexitus.com/IsraeilPoste/IsraeilPoste/app/ Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://mail-links.digitevent.com/ls/click?upn=pLHFc7LgLURqKrLHtiaLqIVeISiFuSN7rmPYdJ6tiLdHt-2FGU3ZhMdmVYXij9FH0BuTH1_1fhQkziSuXEjt8Gy5w3Q8U-2FLTkI-2FE3c34JTO38-2FaM5xEeTt707dba-2F0XquO8NQLsgWquItQAjBuR7pEnK2jHEm1DJEgfBOnGJmucZuUh8-2FiAOpV-2FGgTRyvsli3DjAWKprFKMSkNsRG4frRUzMBe5LFvBb56sL8YtVM2OJ5-2B2hDosxr53HRDb43CjEaP-2BMniaMepNicwu66vh5dDKBck7-2FIsfu8iWmesjcv3nggOiR8NsFYju-2BQXF9HSwnYP-2FGDQA8bk0ccwL94RySAKHNitc8RUrIbdW8GAch-2BDP7mZqCSaR8ta7KlMpggo29Q-2BdDHsDc4xTTNJw6uRC0RJWV39lKg-3D-3D
HTTP 302
https://repararfacil.com/IL.html Page URL
- http://viajesexitus.com/IsraeilPoste/IsraeilPoste/app/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://mail-links.digitevent.com/ls/click?upn=pLHFc7LgLURqKrLHtiaLqIVeISiFuSN7rmPYdJ6tiLdHt-2FGU3ZhMdmVYXij9FH0BuTH1_1fhQkziSuXEjt8Gy5w3Q8U-2FLTkI-2FE3c34JTO38-2FaM5xEeTt707dba-2F0XquO8NQLsgWquItQAjBuR7pEnK2jHEm1DJEgfBOnGJmucZuUh8-2FiAOpV-2FGgTRyvsli3DjAWKprFKMSkNsRG4frRUzMBe5LFvBb56sL8YtVM2OJ5-2B2hDosxr53HRDb43CjEaP-2BMniaMepNicwu66vh5dDKBck7-2FIsfu8iWmesjcv3nggOiR8NsFYju-2BQXF9HSwnYP-2FGDQA8bk0ccwL94RySAKHNitc8RUrIbdW8GAch-2BDP7mZqCSaR8ta7KlMpggo29Q-2BdDHsDc4xTTNJw6uRC0RJWV39lKg-3D-3D HTTP 302
- https://repararfacil.com/IL.html
7 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
IL.html
repararfacil.com/ Redirect Chain
|
203 B 284 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
/
viajesexitus.com/IsraeilPoste/IsraeilPoste/app/ |
2 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
app.css
viajesexitus.com/IsraeilPoste/IsraeilPoste/app/files/files1/ |
2 KB 939 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo.png
viajesexitus.com/IsraeilPoste/IsraeilPoste/app/files/files1/ |
5 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
pc.png
viajesexitus.com/IsraeilPoste/IsraeilPoste/app/files/files1/ |
74 KB 74 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jq.js.%D8%AA%D9%86%D8%B2%D9%8A%D9%84
viajesexitus.com/IsraeilPoste/IsraeilPoste/app/files/files1/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
h.ttf
viajesexitus.com/IsraeilPoste/IsraeilPoste/app/files/files1/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Israel Post (Transporation)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless function| cloneDetect0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
mail-links.digitevent.com
repararfacil.com
viajesexitus.com
167.89.118.83
174.136.25.160
192.254.186.156
4cb179b69035457e9386419a8689b3f92212277390ae886e757e02296f826dbb
7cff082fe3676f7e02428c7d1b72b5daf671c05eb60e4e53ddd10267080111f0
bef05b5087b95f81b1517c93eb7f47d1755d5d95adf41eff841cad5f8dd388ac
f7b883aed7ce01a302659fe88f04ad2bef44651ac81e94154edd754f2a6619bc