![](/screenshots/8f692e59-84bd-460c-8f3f-53f48106b9ad.png)
www.laposte-suspension.com
Open in
urlscan Pro
45.148.119.222
Malicious Activity!
Public Scan
Submission: On January 19 via automatic, source phishtank — Scanned from DE
Summary
TLS certificate: Issued by R3 on January 18th 2023. Valid for: 3 months.
This is the only time www.laposte-suspension.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: La Poste (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
24 | 45.148.119.222 45.148.119.222 | 203790 (UP-NETWORK) (UP-NETWORK) | |
1 | 2606:4700::68... 2606:4700::6810:5614 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 173.231.16.76 173.231.16.76 | 18450 (WEBNX) (WEBNX) | |
1 | 104.75.88.194 104.75.88.194 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
2 | 194.41.184.89 194.41.184.89 | 12511 (CH-POSTNE...) (CH-POSTNETZ Post CH AG) | |
1 | 2a00:17c8:0:1... 2a00:17c8:0:103::20a | 12511 (CH-POSTNE...) (CH-POSTNETZ Post CH AG) | |
30 | 6 |
ASN203790 (UP-NETWORK, FR)
PTR: f.45.148.119.222.outlook.kmbarea.info
www.laposte-suspension.com |
ASN18450 (WEBNX, US)
PTR: 173-231-16-76.static.webnx.com
api.ipify.org |
ASN16625 (AKAMAI-AS, US)
PTR: a104-75-88-194.deploy.static.akamaitechnologies.com
tags.tiqcdn.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
24 |
laposte-suspension.com
www.laposte-suspension.com |
529 KB |
3 |
post.ch
fonts.post.ch — Cisco Umbrella Rank: 668206 www.post.ch — Cisco Umbrella Rank: 55702 |
71 KB |
1 |
tiqcdn.com
tags.tiqcdn.com — Cisco Umbrella Rank: 969 |
31 KB |
1 |
ipify.org
api.ipify.org — Cisco Umbrella Rank: 2847 |
139 B |
1 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 357 |
|
30 | 5 |
Domain | Requested by | |
---|---|---|
24 | www.laposte-suspension.com |
www.laposte-suspension.com
|
2 | fonts.post.ch |
www.laposte-suspension.com
|
1 | www.post.ch |
www.laposte-suspension.com
|
1 | tags.tiqcdn.com |
www.laposte-suspension.com
|
1 | api.ipify.org |
www.laposte-suspension.com
|
1 | cdn.jsdelivr.net |
www.laposte-suspension.com
|
30 | 6 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.post.ch |
account.post.ch |
Subject Issuer | Validity | Valid | |
---|---|---|---|
laposte-suspension.com R3 |
2023-01-18 - 2023-04-18 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-06-02 - 2023-06-01 |
a year | crt.sh |
*.ipify.org Sectigo RSA Domain Validation Secure Server CA |
2022-02-07 - 2023-03-10 |
a year | crt.sh |
*.tiqcdn.com DigiCert TLS RSA SHA256 2020 CA1 |
2023-01-12 - 2024-01-14 |
a year | crt.sh |
fonts.post.ch SwissSign RSA TLS OV ICA 2021 - 1 |
2022-05-12 - 2023-05-12 |
a year | crt.sh |
www.post.ch SwissSign RSA TLS OV ICA 2021 - 1 |
2022-02-21 - 2023-02-21 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.laposte-suspension.com/html/login/
Frame ID: 1E37A4828B3431662A0CAB902EF842A6
Requests: 30 HTTP requests in this frame
Screenshot
![](/screenshots/8f692e59-84bd-460c-8f3f-53f48106b9ad.png)
Page Title
Login - La PosteDetected technologies
![](/vendor/wappa/icons/Font Awesome.png)
Detected patterns
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Detected patterns
- <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
- //cdn\.jsdelivr\.net/
Page Statistics
9 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Title: DE
Search URL Search Domain Scan URL
Title: FR
Search URL Search Domain Scan URL
Title: IT
Search URL Search Domain Scan URL
Title: EN
Search URL Search Domain Scan URL
Title: Accessibilité
Search URL Search Domain Scan URL
Title: CG
Search URL Search Domain Scan URL
Title: Protection des données et Info légales
Search URL Search Domain Scan URL
Title: Colophon
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
30 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
www.laposte-suspension.com/html/login/ |
27 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
utag.js
www.laposte-suspension.com/html/login/Login%20-%20La%20Poste_fichiers/ |
145 KB 48 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fontawesome.min.css.css
cdn.jsdelivr.net/npm/@fortawesome/fontawesome-free@6.2.1/css/ |
0 0 |
Stylesheet
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
swisspost-internet-header.css
www.laposte-suspension.com/html/login/Login%20-%20La%20Poste_fichiers/ |
177 KB 42 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
post.css
www.laposte-suspension.com/html/login/Login%20-%20La%20Poste_fichiers/ |
1 MB 351 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logrend.css
www.laposte-suspension.com/html/login/Login%20-%20La%20Poste_fichiers/ |
18 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.3.6.0.min.js
www.laposte-suspension.com/html/login/Login%20-%20La%20Poste_fichiers/ |
87 KB 43 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
swisspost-internet-header.esm.js
www.laposte-suspension.com/html/login/Login%20-%20La%20Poste_fichiers/ |
2 KB 1015 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
utag.sync.js
www.laposte-suspension.com/html/login/Login%20-%20La%20Poste_fichiers/ |
109 B 218 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
index
www.laposte-suspension.com/html/login/Login%20-%20La%20Poste_fichiers/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
utag.289.js
www.laposte-suspension.com/html/login/Login%20-%20La%20Poste_fichiers/ |
5 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
utag.407.js
www.laposte-suspension.com/html/login/Login%20-%20La%20Poste_fichiers/ |
2 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
utag.428.js
www.laposte-suspension.com/html/login/Login%20-%20La%20Poste_fichiers/ |
2 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
utag.445.js
www.laposte-suspension.com/html/login/Login%20-%20La%20Poste_fichiers/ |
2 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
post-logo-fr.svg
www.laposte-suspension.com/html/login/Login%20-%20La%20Poste_fichiers/ |
4 KB 5 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sesam-buttons.css
www.laposte-suspension.com/html/login/Login%20-%20La%20Poste_fichiers/ |
3 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
login-statics-cache-filter.css
www.laposte-suspension.com/html/login/Login%20-%20La%20Poste_fichiers/ |
60 B 168 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
loginRegistration.js
www.laposte-suspension.com/html/login/Login%20-%20La%20Poste_fichiers/ |
1 KB 635 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.validate-1.12.0.min.js
www.laposte-suspension.com/html/login/Login%20-%20La%20Poste_fichiers/ |
20 KB 9 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
klp.js
www.laposte-suspension.com/html/login/Login%20-%20La%20Poste_fichiers/ |
20 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
api.ipify.org/ |
33 B 139 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
utag.js
tags.tiqcdn.com/utag/schweizerischepost/secure/prod/ |
145 KB 31 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
arrow.svg
www.laposte-suspension.com/html/login/img/ |
1 KB 1 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
FrutigerNeueforPostW05-Rg.woff2
fonts.post.ch/frutigerneueforpost/v2/ |
30 KB 31 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
p-b2f4002d.js
www.laposte-suspension.com/html/login/Login%20-%20La%20Poste_fichiers/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
connect.svg
www.laposte-suspension.com/html/login/images/ |
1 KB 1 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
SwissSignCircularWeb-Bold.woff2
www.laposte-suspension.com/html/login/Login%20-%20La%20Poste_fichiers/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
FrutigerNeueforPostW05-Bold.woff2
fonts.post.ch/frutigerneueforpost/v2/ |
30 KB 31 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Json
www.post.ch/api/headerjs/ |
86 KB 10 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
SwissSignCircularWeb-Bold.woff
www.laposte-suspension.com/html/login/Login%20-%20La%20Poste_fichiers/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: La Poste (Transportation)52 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| oncontentvisibilityautostatechange string| logoutErrorText object| utag_err boolean| utag_condload function| getCookie object| $jsonp undefined| defaultConsent undefined| cookieArr object| utag undefined| pad undefined| updateCookie function| _tealium_old_error boolean| __tealium_twc_switch object| UnicTMSHelper object| digitalData function| callback boolean| isSafari string| client_device_userAgent function| $ function| jQuery string| guiName object| MESSAGES string| layoutType string| preventMaximize object| klp function| displayOverlayMessage function| changeInputType function| setInvalidInput function| displayAllOverlayMessage function| errorPlacementValidatio function| setOverlayDimensionsToCurrentDocumentDimensions function| getGlobalHostError function| getGlobalHostMsg object| POPUP_TEXT object| TiQ_GlobalEventTracker function| delayTracker function| event_init function| createElementEnrichmentVarsObject function| startTracker number| pvCounter object| dataLayer function| jq object| v object| vc number| v0 number| v1 number| v2 number| vc0 number| vc1 number| vc2 number| len3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.laposte-suspension.com/ | Name: utag_main Value: v_id:0185c917467e0016e5ca47ed49c303073002e06b00b08$_sn:1$_ss:1$_st:1674117823935$ses_id:1674116023935%3Bexp-session$_pn:1%3Bexp-session |
|
.laposte-suspension.com/ | Name: user_profile_profileInfo_loginStatusCookie Value: undefined |
|
www.laposte-suspension.com/ | Name: user_profile_attributes_primarySegment Value: extern |
7 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
api.ipify.org
cdn.jsdelivr.net
fonts.post.ch
tags.tiqcdn.com
www.laposte-suspension.com
www.post.ch
104.75.88.194
173.231.16.76
194.41.184.89
2606:4700::6810:5614
2a00:17c8:0:103::20a
45.148.119.222
00b5a0cad4d794176f43c0e789cae330990722ad67e7a214771d5639152f2aee
1d570d464e872473874a63beffdce368e2ce7471d9ecf033f491862889e714a5
1e772bfc19390539e9f710eff71a0c375069f98783a502caac55e9350d458278
2327716fd34176fe27eb3cfa7bb26ac072b72a8d406709e4a11124cd96a052e8
4259aa795b6bda4d441bf6e03a402fa65a8cfae1650fdc450f30d640a973748f
4bf14f6148c952494d0d365f8e6f350c407a06248d58504537f6814ff3631648
5e5829adbb242a73b971192a9c5a2e59cfd5170dc7f8ef47b45b4a7d2cb3d2fa
61310e10b0cedcfbb60654fcb113828e3609052112fa443a01bd55b1c072b70a
63d389ca8f485e9fde12dc2ba4729cc57bb1ac057c2253cc7c0846a270d6ac03
6c2cb38ab36f689291120a2f11ea0e448618c3d79b438a3be30270d21714a336
6dbba61ebcd011f90651705072296582ef12065838be406c1033a7b198b1ea1b
6f2202602a3ebcf0eea47af094cd27397c1ce3e5b42aed5bb1bc1bb0a1bc5e7a
80d9df6a033c91c176960af80250168863680188e01dbdca5b7c53256e5ad769
93f85b28acc702236525954770c9900897c8a72d33a55d4a7d3aa4907359fff2
a2224e099ab00fd60710d8e7e767192499d8ef2bf8e4f6c5202dde7dd082754d
a421028205d3fef9d0a3a77adbc8b51cdb6f40bdcecd7ee9828673587c5cb8f1
b684249f4f1b13adab72bf8c5f41a9421c92f7896e1e94e5bcd624e4ddd4f857
c0dff120512a8b623a3dbc0b98fcc028d8380961dbb89c0f9ad391b47a2a13b7
c4f69daa1e5e8700ab2240c788baf36f295f650145736b45d0507fe1abbe672f
d15de893d12557e83e979db3572685a035b60f1bc78da4dfac35d5e716edcb28
d27c99460a5f65fcb395c9d23be4ede3b407452d99c8d41bfec948c8bfa40cc3
ed445819d412e08fa1c51fcd6d35997c7481fb7d459bdc2bbcbce9bbdc9433f0
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e