blog.brandmandir.com Open in urlscan Pro
3.109.88.249 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://blog.brandmandir.com/wp-content/uploads/2022/09/au/mypost/delivery/pay/
Effective URL:
https://blog.brandmandir.com/wp-content/uploads/2022/09/au/mypost/delivery/pay/source/billing.php
Submission: On October 08 via manual (October 8th 2022, 1:04:27 pm UTC) from FR — Scanned from FR

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 9 HTTP transactions. The main IP is 3.109.88.249, located in Mumbai, India and belongs to AMAZON-02, US. The main domain is blog.brandmandir.com.
TLS certificate: Issued by R3 on August 12th 2022. Valid for: 3 months.

This is the only time blog.brandmandir.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Australia Post (Transportation)

Domain & IP information

	IP Address		AS Autonomous System
2 11	3.109.88.249 3.109.88.249		16509 (AMAZON-02) (AMAZON-02)
9	2

11 3.109.88.249 (Mumbai, India) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-109-88-249.ap-south-1.compute.amazonaws.com

blog.brandmandir.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	brandmandir.com 2 redirects blog.brandmandir.com	184 KB
9	1

	Domain	Requested by
11	blog.brandmandir.com	2 redirects blog.brandmandir.com
9	1

This site contains no links.

Subject Issuer	Validity	Valid
blog.brandmandir.com R3	`2022-08-12` - `2022-11-10`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://blog.brandmandir.com/wp-content/uploads/2022/09/au/mypost/delivery/pay/source/billing.php
Frame ID: 883DC1CD527EA9087962FF9ADDA59FFB
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Australia MyPost - Pay a bill

Page URL History Show full URLs

https://blog.brandmandir.com/wp-content/uploads/2022/09/au/mypost/delivery/pay/ HTTP 302
https://blog.brandmandir.com/wp-content/uploads/2022/09/au/mypost/delivery/pay/source/ HTTP 302
https://blog.brandmandir.com/wp-content/uploads/2022/09/au/mypost/delivery/pay/source/billing.php Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

9
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

184 kB
Transfer

187 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://blog.brandmandir.com/wp-content/uploads/2022/09/au/mypost/delivery/pay/ HTTP 302
https://blog.brandmandir.com/wp-content/uploads/2022/09/au/mypost/delivery/pay/source/ HTTP 302
https://blog.brandmandir.com/wp-content/uploads/2022/09/au/mypost/delivery/pay/source/billing.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request billing.php Show response blog.brandmandir.com/wp-content/uploads/2022/09/au/mypost/delivery/pay/source/ Redirect Chain https://blog.brandmandir.com/wp-content/uploads/2022/09/au/mypost/delivery/pay/ https://blog.brandmandir.com/wp-content/uploads/2022/09/au/mypost/delivery/pay/source/ https://blog.brandmandir.com/wp-content/uploads/2022/09/au/mypost/delivery/pay/source/billing.php	7 KB 2 KB	329ms 328ms	Document text/html	3.109.88.249 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://blog.brandmandir.com/wp-content/uploads/2022/09/au/mypost/delivery/pay/source/billing.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 3.109.88.249 Mumbai, India, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-109-88-249.ap-south-1.compute.amazonaws.com Software nginx/1.18.0 (Ubuntu) / Resource Hash `f84a267b12e774e378654e49c3329ddd2269109172d0d5a7237ec174a807983f` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36 accept-language fr-FR,fr;q=0.9 Response headers Connection keep-alive Content-Encoding gzip Content-Type text/html; charset=UTF-8 Date Sat, 08 Oct 2022 13:04:22 GMT Server nginx/1.18.0 (Ubuntu) Transfer-Encoding chunked Redirect headers Connection keep-alive Content-Type text/html; charset=UTF-8 Date Sat, 08 Oct 2022 13:04:21 GMT Server nginx/1.18.0 (Ubuntu) Transfer-Encoding chunked location billing.php
GET H/1.1	200 OK	style.css blog.brandmandir.com/wp-content/uploads/2022/09/au/mypost/delivery/pay/source/res/	3 KB 3 KB	137ms 136ms	Stylesheet text/css	3.109.88.249 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://blog.brandmandir.com/wp-content/uploads/2022/09/au/mypost/delivery/pay/source/res/style.css Requested by Host: blog.brandmandir.com URL: https://blog.brandmandir.com/wp-content/uploads/2022/09/au/mypost/delivery/pay/source/billing.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 3.109.88.249 Mumbai, India, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-109-88-249.ap-south-1.compute.amazonaws.com Software nginx/1.18.0 (Ubuntu) / Resource Hash `a0937f7edd561e7ee7ad79de36261545786d292edffcb805f0998559be246bac` Request headers accept-language fr-FR,fr;q=0.9 Referer https://blog.brandmandir.com/wp-content/uploads/2022/09/au/mypost/delivery/pay/source/billing.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36 Response headers Date Sat, 08 Oct 2022 13:04:22 GMT Last-Modified Wed, 21 Sep 2022 23:12:26 GMT Server nginx/1.18.0 (Ubuntu) ETag "632b9a5a-c53" Content-Type text/css Cache-Control max-age=315360000 Connection keep-alive Accept-Ranges bytes Content-Length 3155 Expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	200 OK	jq.js Show response blog.brandmandir.com/wp-content/uploads/2022/09/au/mypost/delivery/pay/source/res/	87 KB 88 KB	411ms 274ms	Script application/javascript	3.109.88.249 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://blog.brandmandir.com/wp-content/uploads/2022/09/au/mypost/delivery/pay/source/res/jq.js Requested by Host: blog.brandmandir.com URL: https://blog.brandmandir.com/wp-content/uploads/2022/09/au/mypost/delivery/pay/source/billing.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 3.109.88.249 Mumbai, India, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-109-88-249.ap-south-1.compute.amazonaws.com Software nginx/1.18.0 (Ubuntu) / Resource Hash `ee11e902416a1d896f538103110337b39a0e2e2606bc1faf5cd0652914891127` Request headers accept-language fr-FR,fr;q=0.9 Referer https://blog.brandmandir.com/wp-content/uploads/2022/09/au/mypost/delivery/pay/source/billing.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36 Response headers Date Sat, 08 Oct 2022 13:04:22 GMT Last-Modified Wed, 21 Sep 2022 23:12:26 GMT Server nginx/1.18.0 (Ubuntu) ETag "632b9a5a-15d9d" Content-Type application/javascript Cache-Control max-age=315360000 Connection keep-alive Accept-Ranges bytes Content-Length 89501 Expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	200 OK	v.js Show response blog.brandmandir.com/wp-content/uploads/2022/09/au/mypost/delivery/pay/source/res/	51 KB 52 KB	548ms 273ms	Script application/javascript	3.109.88.249 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://blog.brandmandir.com/wp-content/uploads/2022/09/au/mypost/delivery/pay/source/res/v.js Requested by Host: blog.brandmandir.com URL: https://blog.brandmandir.com/wp-content/uploads/2022/09/au/mypost/delivery/pay/source/billing.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 3.109.88.249 Mumbai, India, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-109-88-249.ap-south-1.compute.amazonaws.com Software nginx/1.18.0 (Ubuntu) / Resource Hash `c5d85d054886c5b1438c896e06123d5d18a0f530f2da3c46271047b1b40cef00` Request headers accept-language fr-FR,fr;q=0.9 Referer https://blog.brandmandir.com/wp-content/uploads/2022/09/au/mypost/delivery/pay/source/billing.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36 Response headers Date Sat, 08 Oct 2022 13:04:22 GMT Last-Modified Wed, 21 Sep 2022 23:12:26 GMT Server nginx/1.18.0 (Ubuntu) ETag "632b9a5a-cd77" Content-Type application/javascript Cache-Control max-age=315360000 Connection keep-alive Accept-Ranges bytes Content-Length 52599 Expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	200 OK	m.js Show response blog.brandmandir.com/wp-content/uploads/2022/09/au/mypost/delivery/pay/source/res/	23 KB 23 KB	551ms 275ms	Script application/javascript	3.109.88.249 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://blog.brandmandir.com/wp-content/uploads/2022/09/au/mypost/delivery/pay/source/res/m.js Requested by Host: blog.brandmandir.com URL: https://blog.brandmandir.com/wp-content/uploads/2022/09/au/mypost/delivery/pay/source/billing.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 3.109.88.249 Mumbai, India, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-109-88-249.ap-south-1.compute.amazonaws.com Software nginx/1.18.0 (Ubuntu) / Resource Hash `a199620fe981df00a825f78761d3f7c8870f8117daa4a890e08018dec386dae8` Request headers accept-language fr-FR,fr;q=0.9 Referer https://blog.brandmandir.com/wp-content/uploads/2022/09/au/mypost/delivery/pay/source/billing.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36 Response headers Date Sat, 08 Oct 2022 13:04:22 GMT Last-Modified Wed, 21 Sep 2022 23:12:26 GMT Server nginx/1.18.0 (Ubuntu) ETag "632b9a5a-5a88" Content-Type application/javascript Cache-Control max-age=315360000 Connection keep-alive Accept-Ranges bytes Content-Length 23176 Expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	200 OK	logo-mypost.png blog.brandmandir.com/wp-content/uploads/2022/09/au/mypost/delivery/pay/source/res/	2 KB 2 KB	137ms 137ms	Image image/png	3.109.88.249 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://blog.brandmandir.com/wp-content/uploads/2022/09/au/mypost/delivery/pay/source/res/logo-mypost.png Requested by Host: blog.brandmandir.com URL: https://blog.brandmandir.com/wp-content/uploads/2022/09/au/mypost/delivery/pay/source/billing.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 3.109.88.249 Mumbai, India, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-109-88-249.ap-south-1.compute.amazonaws.com Software nginx/1.18.0 (Ubuntu) / Resource Hash `6695fc58bb36ed9c9ab9473d3c63bcec77dd35c73e3c04fe863c58c73333fd63` Request headers accept-language fr-FR,fr;q=0.9 Referer https://blog.brandmandir.com/wp-content/uploads/2022/09/au/mypost/delivery/pay/source/billing.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36 Response headers Date Sat, 08 Oct 2022 13:04:22 GMT Last-Modified Wed, 21 Sep 2022 23:12:26 GMT Server nginx/1.18.0 (Ubuntu) ETag "632b9a5a-752" Content-Type image/png Cache-Control max-age=315360000 Connection keep-alive Accept-Ranges bytes Content-Length 1874 Expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	200 OK	post-billpay.png blog.brandmandir.com/wp-content/uploads/2022/09/au/mypost/delivery/pay/source/res/	3 KB 4 KB	137ms 136ms	Image image/png	3.109.88.249 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://blog.brandmandir.com/wp-content/uploads/2022/09/au/mypost/delivery/pay/source/res/post-billpay.png Requested by Host: blog.brandmandir.com URL: https://blog.brandmandir.com/wp-content/uploads/2022/09/au/mypost/delivery/pay/source/billing.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 3.109.88.249 Mumbai, India, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-109-88-249.ap-south-1.compute.amazonaws.com Software nginx/1.18.0 (Ubuntu) / Resource Hash `8d2d6405a951b0dcaeec9566b06813cb2be533064dbe6524ea42dcf48910596b` Request headers accept-language fr-FR,fr;q=0.9 Referer https://blog.brandmandir.com/wp-content/uploads/2022/09/au/mypost/delivery/pay/source/billing.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36 Response headers Date Sat, 08 Oct 2022 13:04:22 GMT Last-Modified Wed, 21 Sep 2022 23:12:26 GMT Server nginx/1.18.0 (Ubuntu) ETag "632b9a5a-d22" Content-Type image/png Cache-Control max-age=315360000 Connection keep-alive Accept-Ranges bytes Content-Length 3362 Expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	200 OK	secure.png blog.brandmandir.com/wp-content/uploads/2022/09/au/mypost/delivery/pay/source/res/	787 B 1 KB	139ms 138ms	Image image/png	3.109.88.249 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://blog.brandmandir.com/wp-content/uploads/2022/09/au/mypost/delivery/pay/source/res/secure.png Requested by Host: blog.brandmandir.com URL: https://blog.brandmandir.com/wp-content/uploads/2022/09/au/mypost/delivery/pay/source/billing.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 3.109.88.249 Mumbai, India, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-109-88-249.ap-south-1.compute.amazonaws.com Software nginx/1.18.0 (Ubuntu) / Resource Hash `e5372df7729b1978e1d9c9e161622ae83654a97bb072ccb1c8d96aafdbf1135f` Request headers accept-language fr-FR,fr;q=0.9 Referer https://blog.brandmandir.com/wp-content/uploads/2022/09/au/mypost/delivery/pay/source/billing.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36 Response headers Date Sat, 08 Oct 2022 13:04:22 GMT Last-Modified Wed, 21 Sep 2022 23:12:26 GMT Server nginx/1.18.0 (Ubuntu) ETag "632b9a5a-313" Content-Type image/png Cache-Control max-age=315360000 Connection keep-alive Accept-Ranges bytes Content-Length 787 Expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	200 OK	ccv.js Show response blog.brandmandir.com/wp-content/uploads/2022/09/au/mypost/delivery/pay/source/res/	9 KB 9 KB	138ms 138ms	Script application/javascript	3.109.88.249 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://blog.brandmandir.com/wp-content/uploads/2022/09/au/mypost/delivery/pay/source/res/ccv.js Requested by Host: blog.brandmandir.com URL: https://blog.brandmandir.com/wp-content/uploads/2022/09/au/mypost/delivery/pay/source/billing.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 3.109.88.249 Mumbai, India, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-109-88-249.ap-south-1.compute.amazonaws.com Software nginx/1.18.0 (Ubuntu) / Resource Hash `8338536908dbf97a2eeaf21a1390f707b867571d222dcf7be3d905e0a882b9aa` Request headers accept-language fr-FR,fr;q=0.9 Referer https://blog.brandmandir.com/wp-content/uploads/2022/09/au/mypost/delivery/pay/source/billing.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36 Response headers Date Sat, 08 Oct 2022 13:04:22 GMT Last-Modified Wed, 21 Sep 2022 23:12:26 GMT Server nginx/1.18.0 (Ubuntu) ETag "632b9a5a-2205" Content-Type application/javascript Cache-Control max-age=315360000 Connection keep-alive Accept-Ranges bytes Content-Length 8709 Expires Thu, 31 Dec 2037 23:55:55 GMT
GET DATA	200 OK	truncated /	266 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `662294921ca6240beb0f2aecb7f7ac23dd085b782bbe52a369b20226d26afe33` Request headers accept-language fr-FR,fr;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36 Response headers Content-Type image/svg+xml

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Australia Post (Transportation)

21 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

blog.brandmandir.com
3.109.88.249
662294921ca6240beb0f2aecb7f7ac23dd085b782bbe52a369b20226d26afe33
6695fc58bb36ed9c9ab9473d3c63bcec77dd35c73e3c04fe863c58c73333fd63
8338536908dbf97a2eeaf21a1390f707b867571d222dcf7be3d905e0a882b9aa
8d2d6405a951b0dcaeec9566b06813cb2be533064dbe6524ea42dcf48910596b
a0937f7edd561e7ee7ad79de36261545786d292edffcb805f0998559be246bac
a199620fe981df00a825f78761d3f7c8870f8117daa4a890e08018dec386dae8
c5d85d054886c5b1438c896e06123d5d18a0f530f2da3c46271047b1b40cef00
e5372df7729b1978e1d9c9e161622ae83654a97bb072ccb1c8d96aafdbf1135f
ee11e902416a1d896f538103110337b39a0e2e2606bc1faf5cd0652914891127
f84a267b12e774e378654e49c3329ddd2269109172d0d5a7237ec174a807983f

blog.brandmandir.com Open in urlscan Pro 3.109.88.249 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

9 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

184 kBTransfer

187 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

21 JavaScript Global Variables

0 Cookies

Indicators

blog.brandmandir.com Open in urlscan Pro
3.109.88.249 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

184 kB
Transfer

187 kB
Size

0
Cookies

9 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!