saudipostsas.kinsta.cloud Open in urlscan Pro
34.77.249.81  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. http://desakuonline.com/Sas-pgsa/ Page URL
2. http://saudipostsas.kinsta.cloud/box_track/index/ Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	/ Show response desakuonline.com/Sas-pgsa/	410 B 532 B	407ms 385ms	Document text/html	101.50.1.85 BEON-AS-ID PT. Be...
General Check archive.org Show headers Download Go to Full URL http://desakuonline.com/Sas-pgsa/ Protocol HTTP/1.1 Server 101.50.1.85 , Indonesia, ASN55688 (BEON-AS-ID PT. Beon Intermedia, ID), Reverse DNS slark.jagoanhosting.com Software LiteSpeed / Resource Hash 0da1a7ec2aa2281bd185c5ab2af61e80167459b241e1a15a73223efd470f860c Request headers Host desakuonline.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Connection Keep-Alive Content-Type text/html Last-Modified Sat, 09 Jan 2021 14:53:27 GMT Accept-Ranges bytes Content-Encoding gzip Vary Accept-Encoding Content-Length 272 Date Sat, 09 Jan 2021 17:19:36 GMT Server LiteSpeed
GET H/1.1	200 OK	Primary Request / Show response saudipostsas.kinsta.cloud/box_track/index/	6 KB 3 KB	65ms 44ms	Document text/html	34.77.249.81 GOOGLE
General Check archive.org Show headers Download Go to Full URL http://saudipostsas.kinsta.cloud/box_track/index/ Requested by Host: desakuonline.com URL: http://desakuonline.com/Sas-pgsa/ Protocol HTTP/1.1 Server 34.77.249.81 , United States, ASN15169 (GOOGLE, US), Reverse DNS 81.249.77.34.bc.googleusercontent.com Software nginx / Resource Hash 930a1069ecfcc3a0a79bb15d5d910043a04f068ced17258315d24979c986a040 Request headers Host saudipostsas.kinsta.cloud Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Referer http://desakuonline.com/Sas-pgsa/ Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer http://desakuonline.com/Sas-pgsa/ Response headers Server nginx Date Sat, 09 Jan 2021 17:17:21 GMT Content-Type text/html; charset=UTF-8 Transfer-Encoding chunked Connection keep-alive Last-Modified Sun, 27 Sep 2020 13:04:04 GMT Vary Accept-Encoding ETag W/"5f708dc4-19fc" X-Robots-Tag noindex, nofollow, nosnippet, noarchive Content-Encoding gzip X-Edge-Location-Klb 8FtC5EXuQU9ZAR3ZZDCNZcFoeba5ec8168da941df26176f3e32d5fab
GET H2	200	screen.css acs4.3dsecure.no/mdpayacs/content/040/	3 KB 3 KB	236ms 59ms	Stylesheet text/css	93.190.87.72 NO-ITERANETWORKS
General Check archive.org Show headers Download Go to Full URL https://acs4.3dsecure.no/mdpayacs/content/040/screen.css Requested by Host: saudipostsas.kinsta.cloud URL: http://saudipostsas.kinsta.cloud/box_track/index/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 93.190.87.72 Eiksmarka, Norway, ASN200163 (NO-ITERANETWORKS, NO), Reverse DNS Software nginx / Resource Hash 4240658116347f70eea6163be279c9c3680dd81cb5f06275bd6a733dab1a91fc Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer http://saudipostsas.kinsta.cloud/box_track/index/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 09 Jan 2021 17:19:36 GMT last-modified Wed, 05 Jun 2019 15:51:39 GMT server nginx etag "5cf7e50b-c14" strict-transport-security max-age=31536000; includeSubDomains content-type text/css accept-ranges bytes content-length 3092
GET H2	200	gh-buttons.css acs4.3dsecure.no/mdpayacs/content/040/dk/	13 KB 13 KB	254ms 77ms	Stylesheet text/css	93.190.87.72 NO-ITERANETWORKS
General Check archive.org Show headers Download Go to Full URL https://acs4.3dsecure.no/mdpayacs/content/040/dk/gh-buttons.css Requested by Host: saudipostsas.kinsta.cloud URL: http://saudipostsas.kinsta.cloud/box_track/index/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 93.190.87.72 Eiksmarka, Norway, ASN200163 (NO-ITERANETWORKS, NO), Reverse DNS Software nginx / Resource Hash 686251c35af3f83c0532d534a4df34651f06a875fe2b70a7f450c702106f2555 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer http://saudipostsas.kinsta.cloud/box_track/index/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 09 Jan 2021 17:19:36 GMT last-modified Tue, 13 Oct 2015 12:20:10 GMT server nginx etag "561cf6fa-3290" strict-transport-security max-age=31536000; includeSubDomains content-type text/css accept-ranges bytes content-length 12944
GET H2	200	commons.js Show response acs4.3dsecure.no/mdpayacs/content/	1 KB 1 KB	255ms 78ms	Script application/javascript	93.190.87.72 NO-ITERANETWORKS
General Check archive.org Show headers Download Go to Full URL https://acs4.3dsecure.no/mdpayacs/content/commons.js Requested by Host: saudipostsas.kinsta.cloud URL: http://saudipostsas.kinsta.cloud/box_track/index/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 93.190.87.72 Eiksmarka, Norway, ASN200163 (NO-ITERANETWORKS, NO), Reverse DNS Software nginx / Resource Hash 2da2729846948ccfd97ed924936cdc406a1037b4af9bf77d98027c1576d8f8cd Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer http://saudipostsas.kinsta.cloud/box_track/index/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 09 Jan 2021 17:19:36 GMT last-modified Thu, 04 Oct 2018 00:56:30 GMT server nginx etag W/"1202-1538614590000" strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript accept-ranges bytes content-length 1202
GET H2	404	jquery-1.9.1.min.js acs4.3dsecure.no/mdpayacs/content/040/js/	0 0	255ms 78ms	Script text/html	93.190.87.72 NO-ITERANETWORKS
General Check archive.org Show headers Download Go to Full URL https://acs4.3dsecure.no/mdpayacs/content/040/js/jquery-1.9.1.min.js Requested by Host: saudipostsas.kinsta.cloud URL: http://saudipostsas.kinsta.cloud/box_track/index/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 93.190.87.72 Eiksmarka, Norway, ASN200163 (NO-ITERANETWORKS, NO), Reverse DNS Software / Resource Hash Request headers Referer http://saudipostsas.kinsta.cloud/box_track/index/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers
GET H/1.1	200 OK	date_time.js Show response saudipostsas.kinsta.cloud/box_track/index/Autentisering_files/	823 B 890 B	34ms 33ms	Script application/javascript	34.77.249.81 GOOGLE
General Check archive.org Show headers Download Go to Full URL http://saudipostsas.kinsta.cloud/box_track/index/Autentisering_files/date_time.js Requested by Host: saudipostsas.kinsta.cloud URL: http://saudipostsas.kinsta.cloud/box_track/index/ Protocol HTTP/1.1 Server 34.77.249.81 , United States, ASN15169 (GOOGLE, US), Reverse DNS 81.249.77.34.bc.googleusercontent.com Software nginx / Resource Hash c755ac1453166b808d71cdcd5ddce44e18137d626666e38564feeedfb7cdd1cb Request headers Referer http://saudipostsas.kinsta.cloud/box_track/index/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 09 Jan 2021 17:17:21 GMT Content-Encoding gzip Last-Modified Sun, 27 Sep 2020 13:04:04 GMT Server nginx ETag W/"5f708dc4-337" Vary Accept-Encoding Content-Type application/javascript; charset=UTF-8 Access-Control-Allow-Origin * Cache-Control max-age=315360000 Transfer-Encoding chunked Connection keep-alive X-Robots-Tag noindex, nofollow, nosnippet, noarchive X-Edge-Location-Klb 8FtC5EXuQU9ZAR3ZZDCNZcFo2a84071237e14f7d821a50820d741bf8 Expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	200 OK	engsplogo.png sp.com.sa/media/1841/	12 KB 12 KB	464ms 125ms	Image image/png	185.12.166.253 SP-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://sp.com.sa/media/1841/engsplogo.png Requested by Host: saudipostsas.kinsta.cloud URL: http://saudipostsas.kinsta.cloud/box_track/index/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.12.166.253 Riyadh, Saudi Arabia, ASN60050 (SP-ASN, SA), Reverse DNS waselalami.com.sa Software / Resource Hash 16893732c1d56cff7778f74e569a833e345cc0f0fb0c3226380d7bcf414f51fe Security Headers Name Value X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer http://saudipostsas.kinsta.cloud/box_track/index/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 09 Jan 2021 17:20:15 GMT Last-Modified Tue, 30 Jul 2019 06:41:46 GMT ETag "6e2597dba146d51:0" X-OPNET-Transaction-Trace a2_0778b83c-5b10-4260-8ede-31086ac3413e-14276-340705 X-Frame-Options SAMEORIGIN Content-Type image/png Access-Control-Allow-Origin * Cache-Control public;max-age,max-age=31536000 Accept-Ranges bytes Content-Length 12128 X-Xss-Protection 1; mode=block
GET H2	404	jquery-1.9.1.min.js acs4.3dsecure.no/mdpayacs/content/040/js/	0 0	58ms 58ms	Script text/html	93.190.87.72 NO-ITERANETWORKS
General Check archive.org Show headers Download Go to Full URL https://acs4.3dsecure.no/mdpayacs/content/040/js/jquery-1.9.1.min.js Requested by Host: saudipostsas.kinsta.cloud URL: http://saudipostsas.kinsta.cloud/box_track/index/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 93.190.87.72 Eiksmarka, Norway, ASN200163 (NO-ITERANETWORKS, NO), Reverse DNS Software / Resource Hash Request headers Referer http://saudipostsas.kinsta.cloud/box_track/index/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers
GET H2	200	gh-icons.png acs4.3dsecure.no/mdpayacs/content/040/dk/	4 KB 4 KB	63ms 63ms	Image image/png	93.190.87.72 NO-ITERANETWORKS
General Check archive.org Show headers Download Go to Show image Full URL https://acs4.3dsecure.no/mdpayacs/content/040/dk/gh-icons.png Requested by Host: acs4.3dsecure.no URL: https://acs4.3dsecure.no/mdpayacs/content/040/dk/gh-buttons.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 93.190.87.72 Eiksmarka, Norway, ASN200163 (NO-ITERANETWORKS, NO), Reverse DNS Software nginx / Resource Hash 018c7d12a799726510b7d6e7ce4a18023b3f70aded8102d3cdee725f34175658 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://acs4.3dsecure.no/mdpayacs/content/040/dk/gh-buttons.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 09 Jan 2021 17:19:36 GMT last-modified Tue, 13 Oct 2015 12:20:10 GMT server nginx etag "561cf6fa-f6c" strict-transport-security max-age=31536000; includeSubDomains content-type image/png accept-ranges bytes content-length 3948

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online) Saudi Post (Government)

23 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| trustedTypes boolean| crossOriginIsolated function| changeLanguage function| submitEnter function| dotToComma function| updateViewportOrientation function| date_time function| onBodyLoad function| validate object| date number| year number| month object| months number| d number| day object| days number| h number| m number| s string| result

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

acs4.3dsecure.no
desakuonline.com
saudipostsas.kinsta.cloud
sp.com.sa
101.50.1.85
185.12.166.253
34.77.249.81
93.190.87.72
018c7d12a799726510b7d6e7ce4a18023b3f70aded8102d3cdee725f34175658
0da1a7ec2aa2281bd185c5ab2af61e80167459b241e1a15a73223efd470f860c
16893732c1d56cff7778f74e569a833e345cc0f0fb0c3226380d7bcf414f51fe
2da2729846948ccfd97ed924936cdc406a1037b4af9bf77d98027c1576d8f8cd
4240658116347f70eea6163be279c9c3680dd81cb5f06275bd6a733dab1a91fc
686251c35af3f83c0532d534a4df34651f06a875fe2b70a7f450c702106f2555
930a1069ecfcc3a0a79bb15d5d910043a04f068ced17258315d24979c986a040
c755ac1453166b808d71cdcd5ddce44e18137d626666e38564feeedfb7cdd1cb