post-tracking.cat
Open in
urlscan Pro
2606:4700:3032::ac43:a746
Malicious Activity!
Public Scan
Effective URL: https://post-tracking.cat/manage/?view=login&appIdKey=fcd00c0656cc490&country=
Submission: On November 02 via api from US — Scanned from US
Summary
TLS certificate: Issued by GTS CA 1P5 on October 31st 2023. Valid for: 3 months.
This is the only time post-tracking.cat was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Tracking (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 11 | 2606:4700:303... 2606:4700:3032::ac43:a746 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 193.150.24.138 193.150.24.138 | 198143 (CESKAPOST...) (CESKAPOSTA-AS) | |
2 | 176.31.232.62 176.31.232.62 | 16276 (OVH) (OVH) | |
1 | 45.141.56.116 45.141.56.116 | 213373 (IPCONNECT) (IPCONNECT) | |
1 | 2607:f8b0:400... 2607:f8b0:4004:c06::5f | 15169 (GOOGLE) (GOOGLE) | |
4 | 2607:f8b0:400... 2607:f8b0:4004:c1d::5e | 15169 (GOOGLE) (GOOGLE) | |
19 | 6 |
ASN16276 (OVH, FR)
PTR: comandia-nginx-1-server.t-urge.com
cdn.mycomandia.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
post-tracking.cat
1 redirects
post-tracking.cat |
53 KB |
4 |
gstatic.com
fonts.gstatic.com |
145 KB |
2 |
mycomandia.com
cdn.mycomandia.com |
5 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 31 |
936 B |
1 |
logolynx.com
www.logolynx.com — Cisco Umbrella Rank: 270314 |
22 KB |
1 |
ceskaposta.cz
www.ceskaposta.cz |
7 KB |
19 | 6 |
Domain | Requested by | |
---|---|---|
11 | post-tracking.cat |
1 redirects
post-tracking.cat
|
4 | fonts.gstatic.com |
fonts.googleapis.com
|
2 | cdn.mycomandia.com |
post-tracking.cat
|
1 | fonts.googleapis.com |
post-tracking.cat
|
1 | www.logolynx.com |
post-tracking.cat
|
1 | www.ceskaposta.cz |
post-tracking.cat
|
19 | 6 |
This site contains links to these domains. Also see Links.
Domain |
---|
online.citypaq.es |
Subject Issuer | Validity | Valid | |
---|---|---|---|
post-tracking.cat GTS CA 1P5 |
2023-10-31 - 2024-01-29 |
3 months | crt.sh |
ceskaposta.cz GeoTrust TLS RSA CA G1 |
2023-04-26 - 2024-05-02 |
a year | crt.sh |
cdn.mycomandia.com R3 |
2023-03-15 - 2023-06-13 |
3 months | crt.sh |
happybirthdaystar.com R3 |
2023-09-20 - 2023-12-19 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-10-16 - 2024-01-08 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2023-10-16 - 2024-01-08 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://post-tracking.cat/manage/?view=login&appIdKey=fcd00c0656cc490&country=
Frame ID: 7E7D4A6576130ED7EC48728349244545
Requests: 17 HTTP requests in this frame
Frame:
https://post-tracking.cat/cdn-cgi/challenge-platform/h/b/scripts/jsd/61b90d1d/main.js
Frame ID: CBB1033277D8D5E327B3B42FC58A747F
Requests: 2 HTTP requests in this frame
Screenshot
Page Title
Česká poštaPage URL History Show full URLs
- https://post-tracking.cat/ Page URL
- https://post-tracking.cat/manage/?view=login&appIdKey=fcd00c0656cc490&country= Page URL
Detected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
Font Awesome (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Google Tag Manager (Tag Managers) Expand
Detected patterns
- <!-- (?:End )?Google Tag Manager -->
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: Ir a CityPaq
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://post-tracking.cat/ Page URL
- https://post-tracking.cat/manage/?view=login&appIdKey=fcd00c0656cc490&country= Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 16- https://post-tracking.cat/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
- https://post-tracking.cat/cdn-cgi/challenge-platform/h/b/scripts/jsd/61b90d1d/main.js
19 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
post-tracking.cat/ |
1 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
/
post-tracking.cat/manage/ |
15 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bootstrap.min.css
post-tracking.cat/manage/Tienda/ |
137 KB 22 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
validationEngine.jquery.css
post-tracking.cat/manage/Tienda/ |
3 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
flaticon.css
post-tracking.cat/manage/Tienda/ |
1 KB 896 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
fontawesome-all.min.css
post-tracking.cat/manage/Tienda/ |
36 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
new-style-common-screen.css
post-tracking.cat/manage/Tienda/ |
68 KB 9 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
common-dynamic.css
post-tracking.cat/manage/Tienda/ |
88 B 542 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo.png
www.ceskaposta.cz/CeskaPosta-theme/images/cp/ |
6 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
correos-paq-72-mini.png
cdn.mycomandia.com/static/logos/ |
2 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
correos-paq72.png
cdn.mycomandia.com/static/logos/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
566499b1d4ca8d93d9dcc83df612f506.jpeg
www.logolynx.com/images/logolynx/56/ |
22 KB 22 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
3 KB 936 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jizfRExUiTo99u79B_mh0O6tLQ.woff2
fonts.gstatic.com/s/ptsans/v17/ |
46 KB 46 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jizaRExUiTo99u79D0KExQ.woff2
fonts.gstatic.com/s/ptsans/v17/ |
44 KB 45 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jizfRExUiTo99u79B_mh0OCtLQ0Z.woff2
fonts.gstatic.com/s/ptsans/v17/ |
29 KB 29 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jizaRExUiTo99u79D0yExdGM.woff2
fonts.gstatic.com/s/ptsans/v17/ |
26 KB 26 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
main.js
post-tracking.cat/cdn-cgi/challenge-platform/h/b/scripts/jsd/61b90d1d/ Frame CBB1 Redirect Chain
|
7 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
820030d3581e2604
post-tracking.cat/cdn-cgi/challenge-platform/h/b/jsd/r/ Frame CBB1 |
0 568 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Tracking (Transportation)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| documentPictureInPicture2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
post-tracking.cat/ | Name: PHPSESSID Value: b077dq5ci2v089ijojnrt6m7h3 |
|
.post-tracking.cat/ | Name: cf_clearance Value: TvAa8iT.kXxu5eOWBfLQ6Ta7keynHCCfux7ndMxutjQ-1698968093-0-1-53aacbb8.dee75e7e.ffd05774-0.2.1698968093 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.mycomandia.com
fonts.googleapis.com
fonts.gstatic.com
post-tracking.cat
www.ceskaposta.cz
www.logolynx.com
176.31.232.62
193.150.24.138
2606:4700:3032::ac43:a746
2607:f8b0:4004:c06::5f
2607:f8b0:4004:c1d::5e
45.141.56.116
0151f669d4836b43571a25f6ec49fbd5bde7173d92081c6418d7cd7b7db3b152
141f0c53e457585d4ac7426eb3d757666d250ee6fbf0e9c0878128e4c627f0b1
1a8635c7077b20e45b38d58f63b6562a47630e137c0e2c68b5b31611a8524a15
2650ffdcb2bf4147d062825fee353bd86e80c1f1c22c0b29ea856fdd3213e0a3
34959e43e6ecf368807a84f92ad9aa6e2dcd5f0c5c1e57da55e8f3248d9d9255
3e45f03e1a612d2f8e65ea99bdf6e8425a88f740b2deeaa8e78b4e324ae322cf
458bb3a60559f5c11cce4ce12b4a829f5f25a3b43531d2ee7a43565ccede7f18
5d2fb215dbbcbfd1bd663a0cdeaf31c63abde8c6f20aa63551733ebc498bf605
61d32ce0b6a45fb798e7c646c493c1ce682d4c57d19a61fd89cef962e83c21fb
65022d5f76d6e8ca21971c6b00bd7af6533c705aedfbae57a94d44a9f4839e3c
984461e2d55896f29bb79d75b8ab42c1f8c4111bd2fb0c5f03dbc50d1b24b894
aa930ff6af94a3bc31e249fe7a43f73e908dc9daa46591656ed00888105625f2
aef350173a8d3e7225c7984992a0934373a6ce2a24e62f8931d708cdc20ba996
cd363d0f8425d6b271c14ee5d6a8d693c3aa1323b64979b69c69d26661927303
cfac6241dd3aabb5f1552c17501790093015c006a8e13671823c1ff4872beaae
e13ffa988be59cbf299d7ff68f019f902b60848203ac4990819eb7e4624ee52d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f6b948f8c37194c3975515c5a4db29c477d1c678c353405c2d938cafac37f27d