urlscan.io logo urlscan.io
SecurityTrails logo

magyar_posta_securepay_hu.fx-lifeperformance.com Open in urlscan Pro
2606:4700:3033::6815:33d1  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://magyar_posta_securepay_hu.fx-lifeperformance.com/MagyarPostaZrt/auth/pM5zH2/info.php
Submission: On June 09 via manual from HU — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 2 HTTP transactions. The main IP is 2606:4700:3033::6815:33d1, located in United States and belongs to CLOUDFLARENET, US. The main domain is magyar_posta_securepay_hu.fx-lifeperformance.com.
TLS certificate: Issued by GTS CA 1P5 on June 8th 2023. Valid for: 3 months.
This is the only time magyar_posta_securepay_hu.fx-lifeperformance.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Magyar Posta (Transportation)

Domain & IP information

IP Address AS Autonomous System
1 2606:4700:303... 13335 (CLOUDFLAR...)
1 194.88.45.136 5588 (GTSCE GTS...)
2 3
Apex Domain
Subdomains		 Transfer
1 posta.hu
www.posta.hu — Cisco Umbrella Rank: 538589
7 KB
1 fx-lifeperformance.com
magyar_posta_securepay_hu.fx-lifeperformance.com
608 KB
2 2
Domain Requested by
1 www.posta.hu magyar_posta_securepay_hu.fx-lifeperformance.com
1 magyar_posta_securepay_hu.fx-lifeperformance.com
2 2

This site contains no links.

Subject Issuer Validity Valid
fx-lifeperformance.com
GTS CA 1P5		 2023-06-08 -
2023-09-06		 3 months crt.sh
*.posta.hu
NetLock Üzleti (Class B) Tanúsítványkiadó		 2023-02-11 -
2023-11-03		 9 months crt.sh

This page contains 1 frames:

Primary Page: https://magyar_posta_securepay_hu.fx-lifeperformance.com/MagyarPostaZrt/auth/pM5zH2/info.php
Frame ID: AAF177E791A8C8C8E4FAEE32094D2E1F
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Magyar Posta

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

2
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

777 kB
Transfer

2238 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request info.php
magyar_posta_securepay_hu.fx-lifeperformance.com/MagyarPostaZrt/auth/pM5zH2/ 		2 MB
608 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://magyar_posta_securepay_hu.fx-lifeperformance.com/MagyarPostaZrt/auth/pM5zH2/info.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3033::6815:33d1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PHP/7.4.13
Resource Hash
ebce19e2c1f78e15153f577d700d18323ff68d56c33fc574ada89a62525414ad

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
7d47a0fb0eb93603-FRA
content-encoding
br
content-type
text/html; charset=UTF-8
date
Fri, 09 Jun 2023 07:23:22 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VhrMf6x4wTg%2BA8AxjcTZcY3zo%2FQrkbmqGel0d1M0eTH9yxdnGUWjZCgy%2FT14p9Wp5vjp67zFhDPAxSrLhXNhm8WAZGXZ1oTUdUmrLbwmnZl8tjkZNggIWcVtlXgLuVLcgRcYBgOKXra6CKkKmfYCPGAiO07K1xJiqO44W1%2BJ3B0LJuGQCgyhF5zYrm8eOdg%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
x-powered-by
PHP/7.4.13
footer-logo.png
www.posta.hu/static/g/ 		6 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.posta.hu/static/g/footer-logo.png
Requested by
Host: magyar_posta_securepay_hu.fx-lifeperformance.com
URL: https://magyar_posta_securepay_hu.fx-lifeperformance.com/MagyarPostaZrt/auth/pM5zH2/info.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
194.88.45.136 Budapest, Hungary, ASN5588 (GTSCE GTS Central Europe Antel Germany, CZ),
Reverse DNS
postaportal.posta.hu
Software
openresty/1.19.9.1 /
Resource Hash
ff455199dd10ed879c2c2723a9ed4eea6694e1389361356af16aaabe0dc77290

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://magyar_posta_securepay_hu.fx-lifeperformance.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 09 Jun 2023 07:23:23 GMT
Last-Modified
Fri, 16 Oct 2015 10:24:24 GMT
Server
openresty/1.19.9.1
Content-Type
image/png
Access-Control-Allow-Origin
*
Cache-Control
max-age=0, no-cache, no-store, must-revalidate
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
6517
X-UA-Compatible
IE=Edge,chrome=1
truncated
/ 		59 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
48468d11d6d2c76de049c6943072c23edf0c357f3791caff0c3113455f28a813

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		79 KB
79 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
48a15eb1ac9f2a7bf1dc4f9edcc7e89412ab0c23c6008516123c5d3aec113b59

Request headers

Referer
Origin
https://magyar_posta_securepay_hu.fx-lifeperformance.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

Content-Type
application/octet-stream
truncated
/ 		4 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2b1160758fc23edc2a13da40178e473aa281355d6f20880e03a8150371cdee25

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		83 KB
83 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4253aa4ecd2f7b23e3c0bbf9a69306f0d5dc4c3dffb91dda0f725d457a8e8e13

Request headers

Referer
Origin
https://magyar_posta_securepay_hu.fx-lifeperformance.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

Content-Type
application/octet-stream

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Magyar Posta (Transportation)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| onbeforetoggle object| onscrollend function| savepage_ShadowLoader

0 Cookies