parcelcredit.com Open in urlscan Pro
107.158.163.254  Malicious Activity! Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response parcelcredit.com/diepost/de/	16 KB 17 KB	1188ms 291ms	Document text/html	107.158.163.254 EONIX-COMMUNICATI...
General Check archive.org Show headers Download Go to Full URL https://parcelcredit.com/diepost/de/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 107.158.163.254 Las Vegas, United States, ASN62904 (EONIX-COMMUNICATIONS-ASBLOCK-62904, US), Reverse DNS Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips / Resource Hash 15428a3c51040b042185c8be1c1c060a255cb171ac4ca2980c841d7939528965 Request headers Host parcelcredit.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site none Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Sec-Fetch-Dest document Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 23 Nov 2020 10:48:48 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips Last-Modified Mon, 09 Nov 2020 14:55:26 GMT ETag "4127-5b3adc0a22164" Accept-Ranges bytes Content-Length 16679 Keep-Alive timeout=5, max=32768 Connection Keep-Alive Content-Type text/html; charset=UTF-8
GET H2	200	utils.6702255f1b18d698d5e9.js Show response g.fastcdn.co/js/	47 KB 16 KB	73ms 22ms	Script application/javascript	35.244.137.202 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://g.fastcdn.co/js/utils.6702255f1b18d698d5e9.js Requested by Host: parcelcredit.com URL: https://parcelcredit.com/diepost/de/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 35.244.137.202 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS 202.137.244.35.bc.googleusercontent.com Software UploadServer / Resource Hash 5cb0eaba6c9c1771fa32cd570b42275a9d3753805b6b7e76d0651878610353b2 Request headers Referer https://parcelcredit.com/diepost/de/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 02:22:39 GMT content-encoding gzip age 30370 x-guploader-uploadid ABg5-UzIRg2Bvqk-E3KrSo3s-wjJTa03kkcxhpsAPX9yUX-7Wv6fV7TQ63wvL8ELNRdH5cM6gBZEdgIujpab7eYgRw4 x-goog-storage-class MULTI_REGIONAL x-goog-metageneration 1 x-goog-stored-content-encoding gzip alt-svc clear content-length 15964 last-modified Thu, 19 Nov 2020 12:59:50 GMT server UploadServer etag "544b0b8fbbefd69e02a5b913f994ed2a" vary Accept-Encoding x-goog-hash crc32c=tD12bg==, md5=VEsLj7vv1p4CpbkT+ZTtKg== x-goog-generation 1605790790533151 cache-control public, max-age=31536000 x-goog-stored-content-length 15964 accept-ranges bytes content-type application/javascript expires Tue, 23 Nov 2021 02:22:39 GMT
GET H2	200	Cradle.67cb4906b4116ba8973b.js Show response g.fastcdn.co/js/	16 KB 5 KB	87ms 36ms	Script application/javascript	35.244.137.202 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://g.fastcdn.co/js/Cradle.67cb4906b4116ba8973b.js Requested by Host: parcelcredit.com URL: https://parcelcredit.com/diepost/de/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 35.244.137.202 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS 202.137.244.35.bc.googleusercontent.com Software UploadServer / Resource Hash 473d69cea9a04e2014548a36a2d845091aa29eb61f311a83253d574526fe16c8 Request headers Referer https://parcelcredit.com/diepost/de/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 16 Nov 2020 11:00:50 GMT content-encoding gzip age 604079 x-guploader-uploadid ABg5-UykDCOw2wobdFucHaar2JP50LQSEjkhs0X4k9biwqRbCwgIe8ySvl5TuvWWXouIDBl87fp-yEJZ7Zdt2I2l x-goog-storage-class MULTI_REGIONAL x-goog-metageneration 1 x-goog-stored-content-encoding gzip alt-svc clear content-length 4722 last-modified Thu, 22 Oct 2020 08:37:25 GMT server UploadServer etag "da97ade09636d3045aa95e216562250a" vary Accept-Encoding x-goog-hash crc32c=abC03w==, md5=2pet4JY20wRaqV4hZWIlCg== x-goog-generation 1603355845974864 cache-control public, max-age=31536000 x-goog-stored-content-length 4722 accept-ranges bytes content-type application/javascript expires Tue, 16 Nov 2021 11:00:50 GMT
GET H2	200	LazyImage.5c22b33358ebb526e37b.js Show response g.fastcdn.co/js/	3 KB 2 KB	86ms 35ms	Script application/javascript	35.244.137.202 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://g.fastcdn.co/js/LazyImage.5c22b33358ebb526e37b.js Requested by Host: parcelcredit.com URL: https://parcelcredit.com/diepost/de/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 35.244.137.202 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS 202.137.244.35.bc.googleusercontent.com Software UploadServer / Resource Hash 7a69efa7f043d1309d50f5d70776d810d4cd44833f5275f9753b8a3384cf8e50 Request headers Referer https://parcelcredit.com/diepost/de/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sun, 22 Nov 2020 04:25:06 GMT content-encoding gzip age 109423 x-guploader-uploadid ABg5-UwR9AVeaP09tMLoD3neILd4UPupqmJj_9iNlKni-_TsmnowsApG1HbfSC0Ze0DUYasPABVn2bSywMshF1Llww6ekX0lDA x-goog-storage-class MULTI_REGIONAL x-goog-metageneration 1 x-goog-stored-content-encoding gzip alt-svc clear content-length 1564 last-modified Thu, 19 Nov 2020 12:59:49 GMT server UploadServer etag "84bcc7a8bc9590da263d48ca3f75b2c2" vary Accept-Encoding x-goog-hash crc32c=n9dmLA==, md5=hLzHqLyVkNomPUjKP3Wywg== x-goog-generation 1605790789142772 cache-control public, max-age=31536000 x-goog-stored-content-length 1564 accept-ranges bytes content-type application/javascript expires Mon, 22 Nov 2021 04:25:06 GMT
GET H2	200	OneSignalSDK.js Show response cdn.onesignal.com/sdks/	8 KB 3 KB	16ms 15ms	Script application/javascript	2606:4700::6812:e134 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.onesignal.com/sdks/OneSignalSDK.js Requested by Host: parcelcredit.com URL: https://parcelcredit.com/diepost/de/ Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 2606:4700::6812:e134 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ffb110318b55e8d7acaeaa7816d495e33a5000643327241099565537973ed051 Request headers Referer https://parcelcredit.com/diepost/de/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 10:48:49 GMT content-encoding gzip cf-cache-status HIT server cloudflare age 2307 etag W/"af07e3bccd7885748057bb532c526ac5" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/javascript cache-control public, max-age=43200 cf-ray 5f6a51ea8ec0bef1-FRA cf-request-id 06965186970000bef1a534a000000001 expires Mon, 23 Nov 2020 22:48:49 GMT
GET H2	200	auto-push.min.js Show response api.mdsyzz.com/	3 KB 2 KB	270ms 245ms	Script application/x-javascript	2606:4700:3035::681b:b37f CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://api.mdsyzz.com/auto-push.min.js Requested by Host: parcelcredit.com URL: https://parcelcredit.com/diepost/de/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::681b:b37f , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / ASP.NET Resource Hash b06f7d0490cab0748132202a04418a8ff03b3c58435aa22f22ac241504ef0722 Request headers Referer https://parcelcredit.com/diepost/de/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 10:48:49 GMT content-encoding br cf-cache-status DYNAMIC last-modified Fri, 20 Nov 2020 16:39:50 GMT server cloudflare x-powered-by ASP.NET etag W/"08fafc35bbfd61:0" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=jFpoHIIa4JgqWjfi5ZJgc9tDHIay9z4prChyc5JDntJAlVwRrV1JBt4tIWgeNXwEr7BkHWsVA14Cj11cvj8otdT%2BUo8zNaVRYz9zaZJW8o%2Fi6PAwVZ14KmomLQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/x-javascript access-control-allow-origin * nel {"report_to":"cf-nel","max_age":604800} cf-ray 5f6a51eab886dfcb-FRA cf-request-id 06965186b70000dfcbc8b57000000001
GET H2	200	52538771-0-1200px-Die-Post-ch-L.png v.fastcdn.co/u/27d140b1/	21 KB 22 KB	74ms 21ms	Image image/png	192.229.133.208 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://v.fastcdn.co/u/27d140b1/52538771-0-1200px-Die-Post-ch-L.png Requested by Host: parcelcredit.com URL: https://parcelcredit.com/diepost/de/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.229.133.208 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (amb/6B72) / Resource Hash 23df17a2ec1e0a9cc543334728f1542cf0eceda2c5c7b99a271034a9a83cd548 Request headers Referer https://parcelcredit.com/diepost/de/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 10:48:49 GMT x-goog-stored-content-length 21976 age 6291741 x-guploader-uploadid ABg5-Uxr-5GSqX37EJ3jWzdMXI_a_0LFzaB73oAkDs-VjZ0KoYZ2PBO5NgfOgK-h4suMkug5_iWOYQQVPdIBL3WcgQ x-cache HIT x-goog-storage-class STANDARD x-goog-metageneration 2 x-goog-stored-content-encoding identity x-goog-meta-expires Mon, 27 Sep 2021 03:54:51 GMT alt-svc h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 21976 last-modified Thu, 06 Aug 2020 11:54:51 GMT server ECS (amb/6B72) etag "5359193990b5ad40d802d47a2c3d57cf" x-goog-hash crc32c=EXiiDQ==, md5=U1kZOZC1rUDYAtR6LD1Xzw== content-type image/png x-goog-generation 1596714891452734 cache-control max-age=315360000, public x-goog-meta-content-length 0 accept-ranges bytes expires Tue, 23 Nov 2021 10:48:49 GMT
GET H2	200	52476260-0-Skrmbillede-2020-08-.png v.fastcdn.co/u/27d140b1/	48 KB 48 KB	34ms 17ms	Image image/png	192.229.133.208 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://v.fastcdn.co/u/27d140b1/52476260-0-Skrmbillede-2020-08-.png Requested by Host: parcelcredit.com URL: https://parcelcredit.com/diepost/de/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.229.133.208 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (amb/6BA6) / Resource Hash e19b07e08275a2aebe531983638b6a0f0ed7111e764e424dc171d1e1409342f4 Request headers Referer https://parcelcredit.com/diepost/de/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 10:48:49 GMT x-goog-stored-content-length 49123 age 9407138 x-guploader-uploadid AAANsUmTn5JMmrN5zMm6LR9Q0Boz1Aadm0b-aJDxz7pCJbfFRrJcf-01nYg0sNHAMbQY8Gws2OE3-Yf7G1bk873P62I x-cache HIT x-goog-storage-class STANDARD x-goog-metageneration 2 x-goog-stored-content-encoding identity x-goog-meta-expires Fri, 24 Sep 2021 05:16:33 GMT alt-svc h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 49123 last-modified Mon, 03 Aug 2020 13:16:33 GMT server ECS (amb/6BA6) etag "83c020694161e5d6f378864a7d5b7a57" x-goog-hash crc32c=ZRHG5w==, md5=g8AgaUFh5dbzeIZKfVt6Vw== content-type image/png x-goog-generation 1596460593173552 cache-control max-age=315360000, public x-goog-meta-content-length 0 accept-ranges bytes expires Tue, 23 Nov 2021 10:48:49 GMT
GET		f21b755c-d63b-44dc-ae0d-d1657ae61fda api.md4syzz.info/rest/v1/p-apps/get-id/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

api.md4syzz.info

URL

https://api.md4syzz.info/rest/v1/p-apps/get-id/f21b755c-d63b-44dc-ae0d-d1657ae61fda?url=https://parcelcredit.com

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Swiss Post (Transportation)

29 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated object| OneSignal object| _at function| InitializePush function| CheckImageAndReplace function| httpGetAsync function| getUrlVars function| getUrlParam object| __variantsData number| __page_id number| __default_experience_id number| __version string| __variant string| __variant_custom_name boolean| __preview number| __page_type string| __variant_hash boolean| __page_generator object| _Translate object| webpackJsonp object| __eventBus

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://cdn.onesignal.com/sdks/OneSignalSDK.js(Line 1) Message: OneSignal: Using fallback ES5 Stub for backwards compatibility.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.md4syzz.info
api.mdsyzz.com
cdn.onesignal.com
g.fastcdn.co
parcelcredit.com
v.fastcdn.co
api.md4syzz.info
107.158.163.254
192.229.133.208
2606:4700:3035::681b:b37f
2606:4700::6812:e134
35.244.137.202
15428a3c51040b042185c8be1c1c060a255cb171ac4ca2980c841d7939528965
23df17a2ec1e0a9cc543334728f1542cf0eceda2c5c7b99a271034a9a83cd548
473d69cea9a04e2014548a36a2d845091aa29eb61f311a83253d574526fe16c8
5cb0eaba6c9c1771fa32cd570b42275a9d3753805b6b7e76d0651878610353b2
7a69efa7f043d1309d50f5d70776d810d4cd44833f5275f9753b8a3384cf8e50
b06f7d0490cab0748132202a04418a8ff03b3c58435aa22f22ac241504ef0722
e19b07e08275a2aebe531983638b6a0f0ed7111e764e424dc171d1e1409342f4
ffb110318b55e8d7acaeaa7816d495e33a5000643327241099565537973ed051