delivercanadanpost.com Open in urlscan Pro
148.66.138.123 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://ssocanadpost-delivery.blogspot.be/?m=1
Effective URL:
https://delivercanadanpost.com/secure.php?id=5636720
Submission: On November 02 via api (November 2nd 2020, 8:26:02 pm UTC) from IE

Summary HTTP 18 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 18 HTTP transactions. The main IP is 148.66.138.123, located in Singapore and belongs to AS-26496-GO-DADDY-COM-LLC, US. The main domain is delivercanadanpost.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on November 2nd 2020. Valid for: 3 months.

This is the only time delivercanadanpost.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 2	2a00:1450:400... 2a00:1450:4001:816::2001	15169 (GOOGLE) (GOOGLE)
15	148.66.138.123 148.66.138.123	26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC)
2	23.111.9.35 23.111.9.35	33438 (HIGHWINDS2) (HIGHWINDS2)
18	4

2 2a00:1450:4001:816::2001 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

ssocanadpost-delivery.blogspot.be	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ssocanadpost-delivery.blogspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 148.66.138.123 (Singapore)

ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)

delivercanadanpost.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.111.9.35 (Phoenix, United States)

ASN33438 (HIGHWINDS2, US)

use.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
15	delivercanadanpost.com delivercanadanpost.com	117 KB
2	fontawesome.com use.fontawesome.com	70 KB
1	blogspot.com ssocanadpost-delivery.blogspot.com	15 KB
1	blogspot.be 1 redirects ssocanadpost-delivery.blogspot.be	168 B
18	4

	Domain	Requested by
15	delivercanadanpost.com	ssocanadpost-delivery.blogspot.com delivercanadanpost.com
2	use.fontawesome.com	delivercanadanpost.com use.fontawesome.com
1	ssocanadpost-delivery.blogspot.com
1	ssocanadpost-delivery.blogspot.be	1 redirects
18	4

This site contains no links.

Subject Issuer	Validity	Valid
misc-sni.blogspot.com GTS CA 1O1	`2020-10-20` - `2021-01-12`	3 months	crt.sh
delivercanadanpost.com cPanel, Inc. Certification Authority	`2020-11-02` - `2021-01-31`	3 months	crt.sh
*.fontawesome.com DigiCert SHA2 Secure Server CA	`2019-10-28` - `2020-12-23`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://delivercanadanpost.com/secure.php?id=5636720
Frame ID: D156DF7355D417CF86553A55B60C6C92
Requests: 19 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://ssocanadpost-delivery.blogspot.be/?m=1 HTTP 302
https://ssocanadpost-delivery.blogspot.com/?m=1 Page URL
https://delivercanadanpost.com/ Page URL
https://delivercanadanpost.com/secure.php?id=5636720 Page URL

Detected technologies

Java (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /GSE/i

OpenGSE (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /GSE/i

Page Statistics

18
Requests

100 %
HTTPS

33 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

201 kB
Transfer

399 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://ssocanadpost-delivery.blogspot.be/?m=1 HTTP 302
https://ssocanadpost-delivery.blogspot.com/?m=1 Page URL
https://delivercanadanpost.com/ Page URL
https://delivercanadanpost.com/secure.php?id=5636720 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://ssocanadpost-delivery.blogspot.be/?m=1 HTTP 302
https://ssocanadpost-delivery.blogspot.com/?m=1

18 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

/
ssocanadpost-delivery.blogspot.com/
Redirect Chain

https://ssocanadpost-delivery.blogspot.be/?m=1
https://ssocanadpost-delivery.blogspot.com/?m=1

64 KB
15 KB

572ms
567ms

Document
text/html

2a00:1450:4001:816::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ssocanadpost-delivery.blogspot.com/?m=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: ssocanadpost-delivery.blogspot.com
:scheme: https
:path: /?m=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
content-security-policy: upgrade-insecure-requests
content-security-policy-report-only: default-src https: blob: data: 'unsafe-inline' 'unsafe-eval'; report-uri https://www.blogger.com/cspreport
content-type: text/html; charset=UTF-8
expires: Mon, 02 Nov 2020 20:25:43 GMT
date: Mon, 02 Nov 2020 20:25:43 GMT
cache-control: private, max-age=0
last-modified: Mon, 02 Nov 2020 13:24:05 GMT
etag: W/"5460b7b7a55d2160e7e86849a14218e143c3c3a00a02ac48509645013ddea5b5"
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 14668
server: GSE
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

status: 302
location: https://ssocanadpost-delivery.blogspot.com/?m=1
content-type: text/html; charset=UTF-8
content-encoding: gzip
date: Mon, 02 Nov 2020 20:25:43 GMT
expires: Mon, 02 Nov 2020 20:25:43 GMT
cache-control: private, max-age=0
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors 'self'
x-xss-protection: 1; mode=block
content-length: 190
server: GSE
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 /
delivercanadanpost.com/ 217 B
422 B 625ms
216ms Document
text/html 148.66.138.123
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: https://delivercanadanpost.com/
Requested by: Host: ssocanadpost-delivery.blogspot.com
URL: https://ssocanadpost-delivery.blogspot.com/?m=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 148.66.138.123 , Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
Software: Apache / PHP/7.3.21
Resource Hash

Request headers

:method: GET
:authority: delivercanadanpost.com
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: document
referer: https://ssocanadpost-delivery.blogspot.com/?m=1
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://ssocanadpost-delivery.blogspot.com/?m=1

Response headers

status: 200
date: Mon, 02 Nov 2020 20:25:44 GMT
server: Apache
x-powered-by: PHP/7.3.21
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
set-cookie: PHPSESSID=6fecffce5bb2bef754208b26a4fae824; path=/
vary: Accept-Encoding,User-Agent
content-encoding: gzip
content-length: 182
content-type: text/html; charset-UTF-8;charset=UTF-8

GET
H2 200 Primary Request secure.php Show response
delivercanadanpost.com/ 6 KB
2 KB 223ms
223ms Document
text/html 148.66.138.123
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: https://delivercanadanpost.com/secure.php?id=5636720
Requested by: Host: delivercanadanpost.com
URL: https://delivercanadanpost.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 148.66.138.123 , Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
Software: Apache / PHP/7.3.21
Resource Hash: fc344347e20456b80b1f24772de9fdd6a3d43d40e97912d08676e70a15159689

Request headers

:method: GET
:authority: delivercanadanpost.com
:scheme: https
:path: /secure.php?id=5636720
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: document
referer: https://delivercanadanpost.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: PHPSESSID=6fecffce5bb2bef754208b26a4fae824
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://delivercanadanpost.com/

Response headers

status: 200
date: Mon, 02 Nov 2020 20:25:44 GMT
server: Apache
x-powered-by: PHP/7.3.21
vary: Accept-Encoding,User-Agent
content-encoding: gzip
content-length: 2203
content-type: text/html; charset=UTF-8

GET
H2 200 jquery-latest.min.js Show response
delivercanadanpost.com/lib/js/ 94 KB
33 KB 392ms
389ms Script
application/javascript 148.66.138.123
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: https://delivercanadanpost.com/lib/js/jquery-latest.min.js
Requested by: Host: delivercanadanpost.com
URL: https://delivercanadanpost.com/secure.php?id=5636720
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 148.66.138.123 , Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
Software: Apache /
Resource Hash: 540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441

Request headers

Referer: https://delivercanadanpost.com/secure.php?id=5636720
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 02 Nov 2020 20:25:45 GMT
content-encoding: gzip
last-modified: Thu, 24 May 2018 17:53:20 GMT
server: Apache
etag: "b2805a7-1762a-56cf753ab2400-gzip"
vary: Accept-Encoding,User-Agent
content-type: application/javascript
status: 200
accept-ranges: bytes
content-length: 33225

GET
H2 200 jquery.mask.min.js Show response
delivercanadanpost.com/lib/js/ 8 KB
3 KB 208ms
205ms Script
application/javascript 148.66.138.123
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: https://delivercanadanpost.com/lib/js/jquery.mask.min.js
Requested by: Host: delivercanadanpost.com
URL: https://delivercanadanpost.com/secure.php?id=5636720
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 148.66.138.123 , Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
Software: Apache /
Resource Hash: bbb318e841b96acb3c2614eec417a4d7caf9606ea996507dccba84e2f6724e7e

Request headers

Referer: https://delivercanadanpost.com/secure.php?id=5636720
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 02 Nov 2020 20:25:45 GMT
content-encoding: gzip
last-modified: Thu, 24 May 2018 17:53:56 GMT
server: Apache
etag: "b2805a8-1ff9-56cf755d07500-gzip"
vary: Accept-Encoding,User-Agent
content-type: application/javascript
status: 200
accept-ranges: bytes
content-length: 3396

GET
H2 200 Acc_Carding.js Show response
delivercanadanpost.com/lib/js/ 1 KB
485 B 207ms
204ms Script
application/javascript 148.66.138.123
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: https://delivercanadanpost.com/lib/js/Acc_Carding.js
Requested by: Host: delivercanadanpost.com
URL: https://delivercanadanpost.com/secure.php?id=5636720
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 148.66.138.123 , Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
Software: Apache /
Resource Hash: 8ae2198685862aa7223d6992148994c2b2f5f812746c2b0cb661163e0ffd2e06

Request headers

Referer: https://delivercanadanpost.com/secure.php?id=5636720
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 02 Nov 2020 20:25:45 GMT
content-encoding: gzip
last-modified: Sun, 15 Jul 2018 19:28:18 GMT
server: Apache
etag: "b2805a3-5b0-5710eb70b3880-gzip"
vary: Accept-Encoding,User-Agent
content-type: application/javascript
status: 200
accept-ranges: bytes
content-length: 386

GET
H2 200 chronopost.css
delivercanadanpost.com/lib/css/ 2 KB
802 B 205ms
203ms Stylesheet
text/css 148.66.138.123
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: https://delivercanadanpost.com/lib/css/chronopost.css
Requested by: Host: delivercanadanpost.com
URL: https://delivercanadanpost.com/secure.php?id=5636720
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 148.66.138.123 , Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
Software: Apache /
Resource Hash: 8f43a9f3e13f3e6e4037387a79d9df3a705d27b808fb4d346209a7a18062c011

Request headers

Referer: https://delivercanadanpost.com/secure.php?id=5636720
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 02 Nov 2020 20:25:45 GMT
content-encoding: gzip
last-modified: Sun, 15 Jul 2018 17:57:38 GMT
server: Apache
etag: "b280477-78f-5710d72cb6880-gzip"
vary: Accept-Encoding,User-Agent
content-type: text/css
status: 200
accept-ranges: bytes
content-length: 683

GET
H2 200 loading.css
delivercanadanpost.com/lib/css/ 482 B
359 B 206ms
204ms Stylesheet
text/css 148.66.138.123
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: https://delivercanadanpost.com/lib/css/loading.css
Requested by: Host: delivercanadanpost.com
URL: https://delivercanadanpost.com/secure.php?id=5636720
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 148.66.138.123 , Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
Software: Apache /
Resource Hash: be77f65264e66598326119e42d38a363c12311df7aa5b15d98717d46e098d546

Request headers

Referer: https://delivercanadanpost.com/secure.php?id=5636720
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 02 Nov 2020 20:25:45 GMT
content-encoding: gzip
last-modified: Sun, 15 Jul 2018 18:49:52 GMT
server: Apache
etag: "b280504-1e2-5710e2d987400-gzip"
vary: Accept-Encoding,User-Agent
content-type: text/css
status: 200
accept-ranges: bytes
content-length: 276

GET
H2 200 style.css
delivercanadanpost.com/lib/css/ 3 KB
883 B 206ms
204ms Stylesheet
text/css 148.66.138.123
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: https://delivercanadanpost.com/lib/css/style.css
Requested by: Host: delivercanadanpost.com
URL: https://delivercanadanpost.com/secure.php?id=5636720
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 148.66.138.123 , Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
Software: Apache /
Resource Hash: 3302f8bc164c287ddd6b68e127f573416bce177f16f4364b04a77d3de4bd4eed

Request headers

Referer: https://delivercanadanpost.com/secure.php?id=5636720
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 02 Nov 2020 20:25:45 GMT
content-encoding: gzip
last-modified: Sun, 15 Jul 2018 18:36:14 GMT
server: Apache
etag: "b28054e-a92-5710dfcd6c380-gzip"
vary: Accept-Encoding,User-Agent
content-type: text/css
status: 200
accept-ranges: bytes
content-length: 801

GET
H2 200 stylee.css
delivercanadanpost.com/lib/css/ 7 KB
2 KB 206ms
205ms Stylesheet
text/css 148.66.138.123
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: https://delivercanadanpost.com/lib/css/stylee.css
Requested by: Host: delivercanadanpost.com
URL: https://delivercanadanpost.com/secure.php?id=5636720
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 148.66.138.123 , Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
Software: Apache /
Resource Hash: 523d91274c32a5399be88a42dd6a2258fde7f7ff388fe2b440df5cf092a2ba27

Request headers

Referer: https://delivercanadanpost.com/secure.php?id=5636720
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 02 Nov 2020 20:25:45 GMT
content-encoding: gzip
last-modified: Sun, 15 Jul 2018 17:25:52 GMT
server: Apache
etag: "b28059a-1b59-5710d01302800-gzip"
vary: Accept-Encoding,User-Agent
content-type: text/css
status: 200
accept-ranges: bytes
content-length: 1696

GET
H2 200 css_1.css
delivercanadanpost.com/lib/css/ 0
84 B 206ms
205ms Stylesheet
text/css 148.66.138.123
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: https://delivercanadanpost.com/lib/css/css_1.css
Requested by: Host: delivercanadanpost.com
URL: https://delivercanadanpost.com/secure.php?id=5636720
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 148.66.138.123 , Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://delivercanadanpost.com/secure.php?id=5636720
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 02 Nov 2020 20:25:45 GMT
last-modified: Sun, 15 Jul 2018 13:50:54 GMT
server: Apache
etag: "b280487-0-5710a00684b80"
vary: User-Agent
content-type: text/css
status: 200
accept-ranges: bytes
content-length: 0

GET
H2 200 font-awesome.min.css
delivercanadanpost.com/lib/css/ 30 KB
7 KB 390ms
389ms Stylesheet
text/css 148.66.138.123
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: https://delivercanadanpost.com/lib/css/font-awesome.min.css
Requested by: Host: delivercanadanpost.com
URL: https://delivercanadanpost.com/secure.php?id=5636720
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 148.66.138.123 , Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
Software: Apache /
Resource Hash: 799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

Request headers

Referer: https://delivercanadanpost.com/secure.php?id=5636720
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 02 Nov 2020 20:25:45 GMT
content-encoding: gzip
last-modified: Sun, 15 Jul 2018 11:53:28 GMT
server: Apache
etag: "b2804f6-7918-571085c6ede00-gzip"
vary: Accept-Encoding,User-Agent
content-type: text/css
status: 200
accept-ranges: bytes
content-length: 7053

GET
H2 200 all.css
use.fontawesome.com/releases/v5.1.0/css/ 45 KB
11 KB 108ms
43ms Stylesheet
text/css 23.111.9.35
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.1.0/css/all.css
Requested by: Host: delivercanadanpost.com
URL: https://delivercanadanpost.com/secure.php?id=5636720
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.9.35 Phoenix, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: ce91e2144ea27f82292ef2c87c5d9e1d0b9994df63836130293865aca18fc550

Request headers

Origin: https://delivercanadanpost.com
Referer: https://delivercanadanpost.com/secure.php?id=5636720
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 02 Nov 2020 20:25:45 GMT
content-encoding: gzip
last-modified: Wed, 20 Jun 2018 20:19:16 GMT
server: NetDNA-cache/2.2
status: 200
etag: W/"826c57385f3d35cfed5478ba7b1f5c03"
vary: Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
access-control-max-age: 3000
cache-control: max-age=31556926
x-cache: HIT

GET
H2 200 canada-post.svg
delivercanadanpost.com/lib/img/ 8 KB
3 KB 206ms
204ms Image
image/svg+xml 148.66.138.123
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://delivercanadanpost.com/lib/img/canada-post.svg
Requested by: Host: delivercanadanpost.com
URL: https://delivercanadanpost.com/secure.php?id=5636720
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 148.66.138.123 , Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
Software: Apache /
Resource Hash: 7f0672c2b4104ffcb7aae218d58536ea2067f08f2c980177f1010ba7d761d11f

Request headers

Referer: https://delivercanadanpost.com/secure.php?id=5636720
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 02 Nov 2020 20:25:45 GMT
content-encoding: gzip
last-modified: Sat, 15 Sep 2018 21:15:54 GMT
server: Apache
etag: "b28059d-2198-575ef72033680-gzip"
vary: Accept-Encoding,User-Agent
content-type: image/svg+xml
status: 200
accept-ranges: bytes
content-length: 2717

GET
H2 200 gov-canada-logo.svg
delivercanadanpost.com/lib/img/ 14 KB
5 KB 204ms
203ms Image
image/svg+xml 148.66.138.123
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://delivercanadanpost.com/lib/img/gov-canada-logo.svg
Requested by: Host: delivercanadanpost.com
URL: https://delivercanadanpost.com/secure.php?id=5636720
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 148.66.138.123 , Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
Software: Apache /
Resource Hash: 6a50626ef34e5da6014662089f0775c6187d23e5c22379da71203848eac50ee3

Request headers

Referer: https://delivercanadanpost.com/secure.php?id=5636720
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 02 Nov 2020 20:25:45 GMT
content-encoding: gzip
last-modified: Sat, 15 Sep 2018 21:16:14 GMT
server: Apache
etag: "b2805a1-37b3-575ef73346380-gzip"
vary: Accept-Encoding,User-Agent
content-type: image/svg+xml
status: 200
accept-ranges: bytes
content-length: 5388

GET
H2 200 Acc_mask.js Show response
delivercanadanpost.com/lib/js/ 128 B
159 B 204ms
204ms Script
application/javascript 148.66.138.123
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: https://delivercanadanpost.com/lib/js/Acc_mask.js
Requested by: Host: delivercanadanpost.com
URL: https://delivercanadanpost.com/secure.php?id=5636720
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 148.66.138.123 , Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
Software: Apache /
Resource Hash: 15efc3fdcbaccb10adfeef693861db381e4422e739a20cd544aacdcda2b78595

Request headers

Referer: https://delivercanadanpost.com/secure.php?id=5636720
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 02 Nov 2020 20:25:45 GMT
content-encoding: gzip
last-modified: Sun, 15 Jul 2018 19:24:08 GMT
server: Apache
etag: "b2805a4-80-5710ea8248600-gzip"
vary: Accept-Encoding,User-Agent
content-type: application/javascript
status: 200
accept-ranges: bytes
content-length: 79

GET
H2 200 PlutoSansDPDRegular-Web.woff
delivercanadanpost.com/lib/css/ 59 KB
58 KB 204ms
204ms Font
font/woff 148.66.138.123
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: https://delivercanadanpost.com/lib/css/PlutoSansDPDRegular-Web.woff
Requested by: Host: delivercanadanpost.com
URL: https://delivercanadanpost.com/lib/css/chronopost.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 148.66.138.123 , Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
Software: Apache /
Resource Hash: c99d0b5a290e48d4e4cbb86c29dd12436f465696702a81ded130a411f1e98cd3

Request headers

Origin: https://delivercanadanpost.com
Referer: https://delivercanadanpost.com/lib/css/chronopost.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 02 Nov 2020 20:25:45 GMT
content-encoding: gzip
last-modified: Sun, 15 Jul 2018 14:45:30 GMT
server: Apache
etag: "b280529-ea8a-5710ac3ac1680-gzip"
vary: Accept-Encoding,User-Agent
content-type: font/woff
status: 200
accept-ranges: bytes
content-length: 59386

GET
DATA 200
OK truncated
/ 266 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 662294921ca6240beb0f2aecb7f7ac23dd085b782bbe52a369b20226d26afe33

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 fa-solid-900.woff2
use.fontawesome.com/releases/v5.1.0/webfonts/ 58 KB
59 KB 41ms
41ms Font
font/woff2 23.111.9.35
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.1.0/webfonts/fa-solid-900.woff2
Requested by: Host: use.fontawesome.com
URL: https://use.fontawesome.com/releases/v5.1.0/css/all.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.9.35 Phoenix, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: a83079124373d924ad1402fbc08d2e24d0043234d4c26565f1c368745f55f5d9

Request headers

Origin: https://delivercanadanpost.com
Referer: https://use.fontawesome.com/releases/v5.1.0/css/all.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 02 Nov 2020 20:25:45 GMT
last-modified: Wed, 20 Jun 2018 20:19:36 GMT
server: NetDNA-cache/2.2
status: 200
etag: "18d2347ab2a9f40ca2247cdb03303d84"
vary: Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods: GET
content-type: font/woff2
access-control-allow-origin: *
access-control-max-age: 3000
cache-control: max-age=31556926
x-cache: HIT
accept-ranges: bytes
content-length: 59572

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			delivercanadanpost.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 6fecffce5bb2bef754208b26a4fae824

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

delivercanadanpost.com
ssocanadpost-delivery.blogspot.be
ssocanadpost-delivery.blogspot.com
use.fontawesome.com
148.66.138.123
23.111.9.35
2a00:1450:4001:816::2001
15efc3fdcbaccb10adfeef693861db381e4422e739a20cd544aacdcda2b78595
3302f8bc164c287ddd6b68e127f573416bce177f16f4364b04a77d3de4bd4eed
523d91274c32a5399be88a42dd6a2258fde7f7ff388fe2b440df5cf092a2ba27
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441
662294921ca6240beb0f2aecb7f7ac23dd085b782bbe52a369b20226d26afe33
6a50626ef34e5da6014662089f0775c6187d23e5c22379da71203848eac50ee3
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
7f0672c2b4104ffcb7aae218d58536ea2067f08f2c980177f1010ba7d761d11f
8ae2198685862aa7223d6992148994c2b2f5f812746c2b0cb661163e0ffd2e06
8f43a9f3e13f3e6e4037387a79d9df3a705d27b808fb4d346209a7a18062c011
a83079124373d924ad1402fbc08d2e24d0043234d4c26565f1c368745f55f5d9
bbb318e841b96acb3c2614eec417a4d7caf9606ea996507dccba84e2f6724e7e
be77f65264e66598326119e42d38a363c12311df7aa5b15d98717d46e098d546
c99d0b5a290e48d4e4cbb86c29dd12436f465696702a81ded130a411f1e98cd3
ce91e2144ea27f82292ef2c87c5d9e1d0b9994df63836130293865aca18fc550
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
fc344347e20456b80b1f24772de9fdd6a3d43d40e97912d08676e70a15159689

delivercanadanpost.com Open in urlscan Pro 148.66.138.123 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

18 Requests

100 %HTTPS

33 %IPv6

4 Domains

4 Subdomains

4 IPs

3 Countries

201 kBTransfer

399 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

18 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

8 JavaScript Global Variables

1 Cookies

Security Headers

Indicators

delivercanadanpost.com Open in urlscan Pro
148.66.138.123 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

18
Requests

100 %
HTTPS

33 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

201 kB
Transfer

399 kB
Size

1
Cookies

18 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!