post-ch-diepost-952c48.ingress-erytho.easywp.com Open in urlscan Pro
63.250.43.133  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response post-ch-diepost-952c48.ingress-erytho.easywp.com/ch/	7 KB 2 KB	770ms 255ms	Document text/html	63.250.43.133 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://post-ch-diepost-952c48.ingress-erytho.easywp.com/ch/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 63.250.43.133 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS ingress-erytho.easywp.com Software nginx / Resource Hash fd18aae8eec4823595e041d111c6fab2ceafbe0531f3e359e67a4dcea3334009 Security Headers Name Value Strict-Transport-Security max-age=15768000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :method GET :authority post-ch-diepost-952c48.ingress-erytho.easywp.com :scheme https :path /ch/ pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 accept-language de-DE,de;q=0.9 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers server nginx date Tue, 19 Oct 2021 14:22:09 GMT content-type text/html; charset=UTF-8 vary Accept-Encoding expires Thu, 19 Nov 1981 08:52:00 GMT cache-control no-store, no-cache, must-revalidate, public pragma no-cache x-frame-options SAMEORIGIN x-content-type-options nosniff x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin content-encoding gzip x-cacheable YES age 85613 x-cache HIT accept-ranges bytes content-length 2078 strict-transport-security max-age=15768000
GET H2	200	css2 fonts.googleapis.com/	1 KB 1 KB	66ms 25ms	Stylesheet text/css	142.250.181.234 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css2?family=Varela+Round&display=swap Requested by Host: post-ch-diepost-952c48.ingress-erytho.easywp.com URL: https://post-ch-diepost-952c48.ingress-erytho.easywp.com/ch/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.181.234 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s56-in-f10.1e100.net Software ESF / Resource Hash c2c61ca92609ea007f3659302839b9b11eba97287f9f60e8ab489190cec8f902 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://post-ch-diepost-952c48.ingress-erytho.easywp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Wed, 20 Oct 2021 14:05:13 GMT server ESF date Wed, 20 Oct 2021 14:09:03 GMT x-frame-options SAMEORIGIN report-to {"group":"AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"}]} content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin cross-origin-opener-policy-report-only same-origin; report-to="AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU" expires Wed, 20 Oct 2021 14:09:03 GMT
GET H2	200	all.min.css post-ch-diepost-952c48.ingress-erytho.easywp.com/ch/css/	58 KB 13 KB	501ms 500ms	Stylesheet text/css	63.250.43.133 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://post-ch-diepost-952c48.ingress-erytho.easywp.com/ch/css/all.min.css Requested by Host: post-ch-diepost-952c48.ingress-erytho.easywp.com URL: https://post-ch-diepost-952c48.ingress-erytho.easywp.com/ch/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 63.250.43.133 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS ingress-erytho.easywp.com Software nginx / Resource Hash af1e6edc875a382b338bb25bd7c5c3f474a7f1b36212002a5896dd06f2186325 Security Headers Name Value Strict-Transport-Security max-age=15768000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /ch/css/all.min.css pragma no-cache accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept text/css,*/*;q=0.1 cache-control no-cache sec-fetch-dest style :authority post-ch-diepost-952c48.ingress-erytho.easywp.com referer https://post-ch-diepost-952c48.ingress-erytho.easywp.com/ch/ :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://post-ch-diepost-952c48.ingress-erytho.easywp.com/ch/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Tue, 19 Oct 2021 14:25:58 GMT content-encoding gzip x-content-type-options nosniff x-cacheable YES age 85385 x-cache HIT vary Accept-Encoding content-length 12867 x-xss-protection 1; mode=block last-modified Mon, 18 Oct 2021 00:35:02 GMT server nginx x-frame-options SAMEORIGIN etag "616cc136-e7d0" strict-transport-security max-age=15768000 access-control-allow-methods GET, POST, OPTIONS, DELETE, PUT content-type text/css cache-control max-age=315360000 access-control-allow-credentials true accept-ranges bytes access-control-allow-headers User-Agent,Keep-Alive,Content-Type expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	bootstrap.min.css stackpath.bootstrapcdn.com/bootstrap/4.5.2/css/	157 KB 25 KB	62ms 29ms	Stylesheet text/css	104.18.10.207 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/css/bootstrap.min.css Requested by Host: post-ch-diepost-952c48.ingress-erytho.easywp.com URL: https://post-ch-diepost-952c48.ingress-erytho.easywp.com/ch/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.10.207 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5b0fbe5b7ad705f6a937c4998ad02f73d8f0d976fe231b74aef0ec996990c93a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://post-ch-diepost-952c48.ingress-erytho.easywp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 20 Oct 2021 14:09:03 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT cdn-edgestorageid 601, 617, 617 age 15582993 cdn-cachedat 2021-04-23 06:59:53 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 timing-allow-origin * access-control-allow-origin * last-modified Mon, 25 Jan 2021 22:04:11 GMT server cloudflare cdn-requestpullcode 200 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/css; charset=utf-8 cdn-cache HIT vary Accept-Encoding cache-control public, max-age=31919000 cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cdn-requestid 625ca095ad66f0f52ab5582709315de2 cf-ray 6a12d25e9ffd411a-PRG cdn-requestcountrycode CZ cdn-requestpullsuccess True
GET H2	200	style.css post-ch-diepost-952c48.ingress-erytho.easywp.com/ch/css/	9 KB 3 KB	253ms 252ms	Stylesheet text/css	63.250.43.133 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://post-ch-diepost-952c48.ingress-erytho.easywp.com/ch/css/style.css Requested by Host: post-ch-diepost-952c48.ingress-erytho.easywp.com URL: https://post-ch-diepost-952c48.ingress-erytho.easywp.com/ch/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 63.250.43.133 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS ingress-erytho.easywp.com Software nginx / Resource Hash 4f56fb282160f7ceaec371e85c61ea17856ba1978c453610cf6a7475811f75d9 Security Headers Name Value Strict-Transport-Security max-age=15768000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /ch/css/style.css pragma no-cache accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept text/css,*/*;q=0.1 cache-control no-cache sec-fetch-dest style :authority post-ch-diepost-952c48.ingress-erytho.easywp.com referer https://post-ch-diepost-952c48.ingress-erytho.easywp.com/ch/ :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://post-ch-diepost-952c48.ingress-erytho.easywp.com/ch/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Tue, 19 Oct 2021 14:39:49 GMT content-encoding gzip x-content-type-options nosniff x-cacheable YES age 84553 x-cache HIT vary Accept-Encoding content-length 2210 x-xss-protection 1; mode=block last-modified Mon, 18 Oct 2021 00:35:02 GMT server nginx x-frame-options SAMEORIGIN etag "616cc136-24ee" strict-transport-security max-age=15768000 access-control-allow-methods GET, POST, OPTIONS, DELETE, PUT content-type text/css cache-control max-age=315360000 access-control-allow-credentials true accept-ranges bytes access-control-allow-headers User-Agent,Keep-Alive,Content-Type expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	200 OK	masking-input.js Show response s3-us-west-2.amazonaws.com/s.cdpn.io/3/	6 KB 6 KB	684ms 184ms	Script text/javascript	52.218.229.24 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s3-us-west-2.amazonaws.com/s.cdpn.io/3/masking-input.js Requested by Host: post-ch-diepost-952c48.ingress-erytho.easywp.com URL: https://post-ch-diepost-952c48.ingress-erytho.easywp.com/ch/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.218.229.24 Boardman, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-us-west-2.amazonaws.com Software AmazonS3 / Resource Hash 5eb35f04e9f27358da6d4d10c8cab27641286f9d01268388afbde24175a26d8b Request headers Accept-Language de-DE,de;q=0.9 Referer https://post-ch-diepost-952c48.ingress-erytho.easywp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Wed, 20 Oct 2021 14:09:05 GMT Last-Modified Wed, 30 Nov 2016 13:54:12 GMT Server AmazonS3 x-amz-request-id 37B05J1DCV2MX6CW ETag "34caa9c1db33dea7751ad862bd5755e2" x-amz-version-id null Cache-Control public Accept-Ranges bytes Content-Type text/javascript Content-Length 5939 x-amz-id-2 5hfDNaUI1TGRlDutMez/b3J63swIag9D5RGA5lT7YkVATaA7dpMYn1hO0VO/Qv/liXS70JU7cuY= Expires Mon, 30 Nov 2026 13:54:10 GMT
GET H2	200	swiis-logo.png post-ch-diepost-952c48.ingress-erytho.easywp.com/ch/img/	5 KB 5 KB	244ms 244ms	Image image/png	63.250.43.133 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://post-ch-diepost-952c48.ingress-erytho.easywp.com/ch/img/swiis-logo.png Requested by Host: post-ch-diepost-952c48.ingress-erytho.easywp.com URL: https://post-ch-diepost-952c48.ingress-erytho.easywp.com/ch/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 63.250.43.133 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS ingress-erytho.easywp.com Software nginx / Resource Hash 490ed4cd487facdb15cde073a96adbb1abf8912ddbfa22fd04a22c70a3326560 Security Headers Name Value Strict-Transport-Security max-age=15768000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /ch/img/swiis-logo.png pragma no-cache accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority post-ch-diepost-952c48.ingress-erytho.easywp.com referer https://post-ch-diepost-952c48.ingress-erytho.easywp.com/ch/ :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://post-ch-diepost-952c48.ingress-erytho.easywp.com/ch/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Tue, 19 Oct 2021 14:25:58 GMT x-content-type-options nosniff x-cacheable YES age 85385 x-cache HIT content-length 4845 x-xss-protection 1; mode=block last-modified Mon, 18 Oct 2021 00:35:02 GMT server nginx x-frame-options SAMEORIGIN etag "616cc136-12ed" strict-transport-security max-age=15768000 access-control-allow-methods GET, POST, OPTIONS, DELETE, PUT content-type image/png cache-control max-age=315360000 access-control-allow-credentials true accept-ranges bytes access-control-allow-headers User-Agent,Keep-Alive,Content-Type expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	789655.png post-ch-diepost-952c48.ingress-erytho.easywp.com/ch/img/	24 KB 25 KB	240ms 240ms	Image image/png	63.250.43.133 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://post-ch-diepost-952c48.ingress-erytho.easywp.com/ch/img/789655.png Requested by Host: post-ch-diepost-952c48.ingress-erytho.easywp.com URL: https://post-ch-diepost-952c48.ingress-erytho.easywp.com/ch/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 63.250.43.133 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS ingress-erytho.easywp.com Software nginx / Resource Hash a6d98908dc979e12f29673659f3e4462a4fd97c00fa07acda6e126a03b81ad85 Security Headers Name Value Strict-Transport-Security max-age=15768000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /ch/img/789655.png pragma no-cache accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority post-ch-diepost-952c48.ingress-erytho.easywp.com referer https://post-ch-diepost-952c48.ingress-erytho.easywp.com/ch/ :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://post-ch-diepost-952c48.ingress-erytho.easywp.com/ch/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Tue, 19 Oct 2021 14:39:52 GMT x-content-type-options nosniff x-cacheable YES age 84552 x-cache HIT content-length 24695 x-xss-protection 1; mode=block last-modified Mon, 18 Oct 2021 00:35:02 GMT server nginx x-frame-options SAMEORIGIN etag "616cc136-6077" strict-transport-security max-age=15768000 access-control-allow-methods GET, POST, OPTIONS, DELETE, PUT content-type image/png cache-control max-age=315360000 access-control-allow-credentials true accept-ranges bytes access-control-allow-headers User-Agent,Keep-Alive,Content-Type expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	1.png post-ch-diepost-952c48.ingress-erytho.easywp.com/ch/img/	597 B 1 KB	364ms 363ms	Image image/png	63.250.43.133 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://post-ch-diepost-952c48.ingress-erytho.easywp.com/ch/img/1.png Requested by Host: post-ch-diepost-952c48.ingress-erytho.easywp.com URL: https://post-ch-diepost-952c48.ingress-erytho.easywp.com/ch/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 63.250.43.133 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS ingress-erytho.easywp.com Software nginx / Resource Hash 255ac343be8acf31ca3debe1a89ecfeb7bf7949ca9bfcce726ec20db90d4ff71 Security Headers Name Value Strict-Transport-Security max-age=15768000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /ch/img/1.png pragma no-cache accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority post-ch-diepost-952c48.ingress-erytho.easywp.com referer https://post-ch-diepost-952c48.ingress-erytho.easywp.com/ch/ :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://post-ch-diepost-952c48.ingress-erytho.easywp.com/ch/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Tue, 19 Oct 2021 14:39:52 GMT x-content-type-options nosniff x-cacheable YES age 84552 x-cache HIT content-length 597 x-xss-protection 1; mode=block last-modified Mon, 18 Oct 2021 00:35:02 GMT server nginx x-frame-options SAMEORIGIN etag "616cc136-255" strict-transport-security max-age=15768000 access-control-allow-methods GET, POST, OPTIONS, DELETE, PUT content-type image/png cache-control max-age=315360000 access-control-allow-credentials true accept-ranges bytes access-control-allow-headers User-Agent,Keep-Alive,Content-Type expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	2.png post-ch-diepost-952c48.ingress-erytho.easywp.com/ch/img/	572 B 1 KB	364ms 363ms	Image image/png	63.250.43.133 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://post-ch-diepost-952c48.ingress-erytho.easywp.com/ch/img/2.png Requested by Host: post-ch-diepost-952c48.ingress-erytho.easywp.com URL: https://post-ch-diepost-952c48.ingress-erytho.easywp.com/ch/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 63.250.43.133 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS ingress-erytho.easywp.com Software nginx / Resource Hash 441985bca86f350bd89721c5219dbcee393f2d9b206930ba3997919a1f4d2e9c Security Headers Name Value Strict-Transport-Security max-age=15768000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /ch/img/2.png pragma no-cache accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority post-ch-diepost-952c48.ingress-erytho.easywp.com referer https://post-ch-diepost-952c48.ingress-erytho.easywp.com/ch/ :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://post-ch-diepost-952c48.ingress-erytho.easywp.com/ch/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Tue, 19 Oct 2021 14:39:52 GMT x-content-type-options nosniff x-cacheable YES age 84552 x-cache HIT content-length 572 x-xss-protection 1; mode=block last-modified Mon, 18 Oct 2021 00:35:02 GMT server nginx x-frame-options SAMEORIGIN etag "616cc136-23c" strict-transport-security max-age=15768000 access-control-allow-methods GET, POST, OPTIONS, DELETE, PUT content-type image/png cache-control max-age=315360000 access-control-allow-credentials true accept-ranges bytes access-control-allow-headers User-Agent,Keep-Alive,Content-Type expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	3.png post-ch-diepost-952c48.ingress-erytho.easywp.com/ch/img/	564 B 1 KB	365ms 364ms	Image image/png	63.250.43.133 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://post-ch-diepost-952c48.ingress-erytho.easywp.com/ch/img/3.png Requested by Host: post-ch-diepost-952c48.ingress-erytho.easywp.com URL: https://post-ch-diepost-952c48.ingress-erytho.easywp.com/ch/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 63.250.43.133 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS ingress-erytho.easywp.com Software nginx / Resource Hash 1dd20181a733ac6bad0e65d39105cd1fe1bdd5cb9f68341a82d7a206310a1290 Security Headers Name Value Strict-Transport-Security max-age=15768000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /ch/img/3.png pragma no-cache accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority post-ch-diepost-952c48.ingress-erytho.easywp.com referer https://post-ch-diepost-952c48.ingress-erytho.easywp.com/ch/ :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://post-ch-diepost-952c48.ingress-erytho.easywp.com/ch/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Tue, 19 Oct 2021 14:39:52 GMT x-content-type-options nosniff x-cacheable YES age 84552 x-cache HIT content-length 564 x-xss-protection 1; mode=block last-modified Mon, 18 Oct 2021 00:35:02 GMT server nginx x-frame-options SAMEORIGIN etag "616cc136-234" strict-transport-security max-age=15768000 access-control-allow-methods GET, POST, OPTIONS, DELETE, PUT content-type image/png cache-control max-age=315360000 access-control-allow-credentials true accept-ranges bytes access-control-allow-headers User-Agent,Keep-Alive,Content-Type expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	4.png post-ch-diepost-952c48.ingress-erytho.easywp.com/ch/img/	657 B 1 KB	365ms 364ms	Image image/png	63.250.43.133 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://post-ch-diepost-952c48.ingress-erytho.easywp.com/ch/img/4.png Requested by Host: post-ch-diepost-952c48.ingress-erytho.easywp.com URL: https://post-ch-diepost-952c48.ingress-erytho.easywp.com/ch/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 63.250.43.133 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS ingress-erytho.easywp.com Software nginx / Resource Hash b07b4ba931d2ff580554dec6bcdad83977282139a2c2278df7b37eeb811c9ade Security Headers Name Value Strict-Transport-Security max-age=15768000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /ch/img/4.png pragma no-cache accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority post-ch-diepost-952c48.ingress-erytho.easywp.com referer https://post-ch-diepost-952c48.ingress-erytho.easywp.com/ch/ :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://post-ch-diepost-952c48.ingress-erytho.easywp.com/ch/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Tue, 19 Oct 2021 14:39:52 GMT x-content-type-options nosniff x-cacheable YES age 84552 x-cache HIT content-length 657 x-xss-protection 1; mode=block last-modified Mon, 18 Oct 2021 00:35:02 GMT server nginx x-frame-options SAMEORIGIN etag "616cc136-291" strict-transport-security max-age=15768000 access-control-allow-methods GET, POST, OPTIONS, DELETE, PUT content-type image/png cache-control max-age=315360000 access-control-allow-credentials true accept-ranges bytes access-control-allow-headers User-Agent,Keep-Alive,Content-Type expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	cleave.min.js Show response cdnjs.cloudflare.com/ajax/libs/cleave.js/1.6.0/	21 KB 6 KB	65ms 29ms	Script application/javascript	104.16.18.94 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/cleave.js/1.6.0/cleave.min.js Requested by Host: post-ch-diepost-952c48.ingress-erytho.easywp.com URL: https://post-ch-diepost-952c48.ingress-erytho.easywp.com/ch/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.18.94 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7eb194c2648de022cb8f29399b9f4409d5ec0cc5314d6e4eea175c78d1d5089a Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Referer https://post-ch-diepost-952c48.ingress-erytho.easywp.com/ Origin https://post-ch-diepost-952c48.ingress-erytho.easywp.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 20 Oct 2021 14:09:04 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 4321091 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 content-length 5638 timing-allow-origin * last-modified Tue, 19 May 2020 10:54:20 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5ec3badc-528d" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rVBavvclU8U38Nnl8HS9HTSCYrKa%2B%2FvBGnwuXNMi8B0Vqt3fgBRoR6Ck%2B3Ew59%2BfZmBqAPYopoX4UMw%2F3j5hi4T6MD%2F1duSraGWhHuiiHBsEq4KepRT0UbTmwyYPUbxx3K7a6YLc"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 6a12d261bee72794-PRG expires Mon, 10 Oct 2022 14:09:04 GMT
GET H2	200	css fonts.googleapis.com/	1003 B 516 B	25ms 25ms	Stylesheet text/css	142.250.181.234 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Poppins&play=swap Requested by Host: post-ch-diepost-952c48.ingress-erytho.easywp.com URL: https://post-ch-diepost-952c48.ingress-erytho.easywp.com/ch/css/style.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.181.234 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s56-in-f10.1e100.net Software ESF / Resource Hash 83b2db06e4e840f5c818b986001e24ed7added38a25e036e6e12607025d14f0e Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://post-ch-diepost-952c48.ingress-erytho.easywp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Wed, 20 Oct 2021 13:33:21 GMT server ESF date Wed, 20 Oct 2021 14:09:04 GMT x-frame-options SAMEORIGIN report-to {"group":"AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"}]} content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin cross-origin-opener-policy-report-only same-origin; report-to="AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU" expires Wed, 20 Oct 2021 14:09:04 GMT
GET H2	200	pxiEyp8kv8JHgFVrJJfecg.woff2 fonts.gstatic.com/s/poppins/v15/	8 KB 8 KB	61ms 18ms	Font font/woff2	142.250.184.227 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/poppins/v15/pxiEyp8kv8JHgFVrJJfecg.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Poppins&play=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.184.227 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s12-in-f3.1e100.net Software sffe / Resource Hash 41e46faff74c6a77d581689ec35eb040f6c96d17f4d2c5b25dccd42ed498b01c Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://post-ch-diepost-952c48.ingress-erytho.easywp.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Mon, 18 Oct 2021 14:59:01 GMT x-content-type-options nosniff age 169803 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 7900 x-xss-protection 0 last-modified Thu, 05 Nov 2020 22:02:01 GMT server sffe content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Tue, 18 Oct 2022 14:59:01 GMT
GET H2	200	sprite-payment.png etoro-cdn.etorostatic.com/web-client/img/	14 KB 15 KB	69ms 9ms	Image image/png	23.218.210.57 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://etoro-cdn.etorostatic.com/web-client/img/sprite-payment.png Requested by Host: post-ch-diepost-952c48.ingress-erytho.easywp.com URL: https://post-ch-diepost-952c48.ingress-erytho.easywp.com/ch/css/style.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.218.210.57 , United States, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-218-210-57.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash 0c1b4014ad0fcd50cd15f046f678660001de4d43fc5d1de75e4b45dad48f843b Request headers Accept-Language de-DE,de;q=0.9 Referer https://post-ch-diepost-952c48.ingress-erytho.easywp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers x-amz-version-id vGm5x3hlYjP446WJvg6.F4Ea8UJHEtCu etag "5fe53d079034795112661b6040909c38" x-amz-request-id K7AGAW87HEJZ7HJM x-amz-meta-cb-modifiedtime Tue, 29 May 2018 11:54:37 GMT x-amz-replication-status COMPLETED content-length 14513 x-amz-id-2 K+nLCIaQcw0fD/YGNKwq5bwDA7Le/d3OSzmZl/40dcWXRoAxDeWlybd+5IQnHnZnBiUzEUMsWEU= last-modified Tue, 29 May 2018 11:56:43 GMT server AmazonS3 date Wed, 20 Oct 2021 14:09:04 GMT access-control-allow-methods GET,HEAD content-type image/png access-control-allow-origin * cache-control max-age=300 accept-ranges bytes expires Wed, 20 Oct 2021 14:14:04 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Swiss Post (Transportation)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect boolean| originAgentCluster function| InputMask object| inputMask string| property function| Cleave object| cleave function| isInputNumber

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=15768000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
etoro-cdn.etorostatic.com
fonts.googleapis.com
fonts.gstatic.com
post-ch-diepost-952c48.ingress-erytho.easywp.com
s3-us-west-2.amazonaws.com
stackpath.bootstrapcdn.com
104.16.18.94
104.18.10.207
142.250.181.234
142.250.184.227
23.218.210.57
52.218.229.24
63.250.43.133
0c1b4014ad0fcd50cd15f046f678660001de4d43fc5d1de75e4b45dad48f843b
1dd20181a733ac6bad0e65d39105cd1fe1bdd5cb9f68341a82d7a206310a1290
255ac343be8acf31ca3debe1a89ecfeb7bf7949ca9bfcce726ec20db90d4ff71
41e46faff74c6a77d581689ec35eb040f6c96d17f4d2c5b25dccd42ed498b01c
441985bca86f350bd89721c5219dbcee393f2d9b206930ba3997919a1f4d2e9c
490ed4cd487facdb15cde073a96adbb1abf8912ddbfa22fd04a22c70a3326560
4f56fb282160f7ceaec371e85c61ea17856ba1978c453610cf6a7475811f75d9
5b0fbe5b7ad705f6a937c4998ad02f73d8f0d976fe231b74aef0ec996990c93a
5eb35f04e9f27358da6d4d10c8cab27641286f9d01268388afbde24175a26d8b
7eb194c2648de022cb8f29399b9f4409d5ec0cc5314d6e4eea175c78d1d5089a
83b2db06e4e840f5c818b986001e24ed7added38a25e036e6e12607025d14f0e
a6d98908dc979e12f29673659f3e4462a4fd97c00fa07acda6e126a03b81ad85
af1e6edc875a382b338bb25bd7c5c3f474a7f1b36212002a5896dd06f2186325
b07b4ba931d2ff580554dec6bcdad83977282139a2c2278df7b37eeb811c9ade
c2c61ca92609ea007f3659302839b9b11eba97287f9f60e8ab489190cec8f902
fd18aae8eec4823595e041d111c6fab2ceafbe0531f3e359e67a4dcea3334009