gov-chiunghwapost-twdg.2ix.ch Open in urlscan Pro
2a00:f48:2000:affe::50 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://s.free.fr/aQ2cML6N
Effective URL:
https://gov-chiunghwapost-twdg.2ix.ch/u/328e7/SSLAuthUI.html
Submission: On December 05 via manual (December 5th 2022, 7:07:08 am UTC) from JP — Scanned from FR

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 3 countries across 3 domains to perform 12 HTTP transactions. The main IP is 2a00:f48:2000:affe::50, located in Germany and belongs to TTM, DE. The main domain is gov-chiunghwapost-twdg.2ix.ch.
TLS certificate: Issued by R3 on October 27th 2022. Valid for: 3 months.

This is the only time gov-chiunghwapost-twdg.2ix.ch was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Chunghwa Post (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
2 2	2a01:e0c:1:15... 2a01:e0c:1:1599::29	12322 (PROXAD) (PROXAD)
1 2	2a03:c980:dea... 2a03:c980:dead:1004:91:218:228:13	210079 (EUROBYTE ...) (EUROBYTE Eurobyte LLC)
3 14	2a00:f48:2000... 2a00:f48:2000:affe::50	47447 (TTM) (TTM)
12	2

2 2a01:e0c:1:1599::29 (France) 2 redirects

ASN12322 (PROXAD, FR)

s.free.fr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:c980:dead:1004:91:218:228:13 (Russian Federation) 1 redirects

ASN210079 (EUROBYTE Eurobyte LLC, RU)

ziflame.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 2a00:f48:2000:affe::50 (Germany) 3 redirects

ASN47447 (TTM, DE)

gov-chiunghwapost-twdg.2ix.ch	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	2ix.ch 3 redirects gov-chiunghwapost-twdg.2ix.ch	97 KB
2	ziflame.ru 1 redirects ziflame.ru	753 B
2	free.fr 2 redirects s.free.fr	422 B
12	3

	Domain	Requested by
14	gov-chiunghwapost-twdg.2ix.ch	3 redirects gov-chiunghwapost-twdg.2ix.ch
2	ziflame.ru	1 redirects
2	s.free.fr	2 redirects
12	3

This site contains no links.

Subject Issuer	Validity	Valid
2ix.ch R3	`2022-10-27` - `2023-01-25`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://gov-chiunghwapost-twdg.2ix.ch/u/328e7/SSLAuthUI.html
Frame ID: 72720F151C8FC47928E51F84E780245D
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

信用卡付款頁面

Page URL History Show full URLs

https://s.free.fr/aQ2cML6N HTTP 301
http://ziflame.ru/tw HTTP 301
http://ziflame.ru/tw/ Page URL
https://s.free.fr/bkYjx3Vw HTTP 301
https://gov-chiunghwapost-twdg.2ix.ch/u/ HTTP 302
https://gov-chiunghwapost-twdg.2ix.ch/u/328e7 HTTP 301
https://gov-chiunghwapost-twdg.2ix.ch/u/328e7/ HTTP 302
https://gov-chiunghwapost-twdg.2ix.ch/u/328e7/SSLAuthUI.html Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css

Page Statistics

12
Requests

92 %
HTTPS

100 %
IPv6

3
Domains

3
Subdomains

2
IPs

3
Countries

97 kB
Transfer

204 kB
Size

4
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://s.free.fr/aQ2cML6N HTTP 301
http://ziflame.ru/tw HTTP 301
http://ziflame.ru/tw/ Page URL
https://s.free.fr/bkYjx3Vw HTTP 301
https://gov-chiunghwapost-twdg.2ix.ch/u/ HTTP 302
https://gov-chiunghwapost-twdg.2ix.ch/u/328e7 HTTP 301
https://gov-chiunghwapost-twdg.2ix.ch/u/328e7/ HTTP 302
https://gov-chiunghwapost-twdg.2ix.ch/u/328e7/SSLAuthUI.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://s.free.fr/aQ2cML6N HTTP 301
http://ziflame.ru/tw HTTP 301
http://ziflame.ru/tw/

12 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

/ Show response
ziflame.ru/tw/
Redirect Chain

https://s.free.fr/aQ2cML6N
http://ziflame.ru/tw
http://ziflame.ru/tw/

72 B
528 B

737ms
737ms

Document
text/html

2a03:c980:dead:1004:91:218:228:13
EUROBYTE Eurobyte...

General

Check archive.org

Show headers Download Go to

Full URL: http://ziflame.ru/tw/
Protocol: HTTP/1.1
Server: 2a03:c980:dead:1004:91:218:228:13 , Russian Federation, ASN210079 (EUROBYTE Eurobyte LLC, RU),
Reverse DNS
Software: LiteSpeed / PHP/7.2.34
Resource Hash: e7960312f17c616f9f0d53036d0b842b56b233b366c42193e1bdd6e83567b30b

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36
accept-language: fr-FR,fr;q=0.9

Response headers

Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 90
content-type: text/html; charset=UTF-8
date: Mon, 05 Dec 2022 07:07:00 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: LiteSpeed
vary: Accept-Encoding
x-powered-by: PHP/7.2.34

Redirect headers

Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
content-length: 707
content-type: text/html
date: Mon, 05 Dec 2022 07:07:00 GMT
location: http://ziflame.ru/tw/
server: LiteSpeed

GET
H2

200

Primary Request SSLAuthUI.html Show response
gov-chiunghwapost-twdg.2ix.ch/u/328e7/
Redirect Chain

https://s.free.fr/bkYjx3Vw
https://gov-chiunghwapost-twdg.2ix.ch/u/
https://gov-chiunghwapost-twdg.2ix.ch/u/328e7
https://gov-chiunghwapost-twdg.2ix.ch/u/328e7/
https://gov-chiunghwapost-twdg.2ix.ch/u/328e7/SSLAuthUI.html

10 KB
3 KB

32ms
32ms

Document
text/html

2a00:f48:2000:affe::50
TTM

General

Check archive.org

Show headers Download Go to

Full URL

https://gov-chiunghwapost-twdg.2ix.ch/u/328e7/SSLAuthUI.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),

Reverse DNS

Software

openresty /

Resource Hash

e080bb1f109d928487db3f9176f6be629a2e287b0294c9c9585fb8571391378a

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: http://ziflame.ru/tw/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36
accept-language: fr-FR,fr;q=0.9

Response headers

content-encoding: gzip
content-security-policy: upgrade-insecure-requests
content-type: text/html
date: Mon, 05 Dec 2022 07:07:03 GMT
server: openresty
vary: Accept-Encoding Accept-Encoding
x-lima-id: atzEebt8SQyMjBTwJt

Redirect headers

content-length: 0
content-security-policy: upgrade-insecure-requests
content-type: text/html; charset=UTF-8
date: Mon, 05 Dec 2022 07:07:03 GMT
location: SSLAuthUI.html
server: openresty
x-lima-id: atEzk2R7qJy5eu3Lk8
x-powered-by: PHP/7.4.33

GET
H2 200 bootstrap.css
gov-chiunghwapost-twdg.2ix.ch/u/328e7/SSLAuthUI_fichiers/ 118 KB
21 KB 62ms
61ms Stylesheet
text/css 2a00:f48:2000:affe::50
TTM

General

Check archive.org

Show headers Download Go to

Full URL

https://gov-chiunghwapost-twdg.2ix.ch/u/328e7/SSLAuthUI_fichiers/bootstrap.css

Requested by

Host: gov-chiunghwapost-twdg.2ix.ch
URL: https://gov-chiunghwapost-twdg.2ix.ch/u/328e7/SSLAuthUI.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),

Reverse DNS

Software

openresty /

Resource Hash

f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://gov-chiunghwapost-twdg.2ix.ch/u/328e7/SSLAuthUI.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

date: Mon, 05 Dec 2022 07:07:03 GMT
content-security-policy: upgrade-insecure-requests
content-encoding: gzip
last-modified: Mon, 05 Dec 2022 07:07:03 GMT
server: openresty
etag: W/"1d970-5ef0f559ad2d6"
vary: Accept-Encoding, Accept-Encoding
content-type: text/css
x-lima-id: at9ACnjKUCOVQP1Kou
cache-control: max-age=2592000
expires: Wed, 04 Jan 2023 07:07:03 GMT

GET
H2 200 style.css
gov-chiunghwapost-twdg.2ix.ch/u/328e7/SSLAuthUI_fichiers/ 9 KB
3 KB 32ms
32ms Stylesheet
text/css 2a00:f48:2000:affe::50
TTM

General

Check archive.org

Show headers Download Go to

Full URL

https://gov-chiunghwapost-twdg.2ix.ch/u/328e7/SSLAuthUI_fichiers/style.css

Requested by

Host: gov-chiunghwapost-twdg.2ix.ch
URL: https://gov-chiunghwapost-twdg.2ix.ch/u/328e7/SSLAuthUI.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),

Reverse DNS

Software

openresty /

Resource Hash

a21e37f28e0471522fcbb0e6860b66a60a582246c4be912dc912b339c35f2ce0

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://gov-chiunghwapost-twdg.2ix.ch/u/328e7/SSLAuthUI.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

date: Mon, 05 Dec 2022 07:07:03 GMT
content-security-policy: upgrade-insecure-requests
content-encoding: gzip
last-modified: Mon, 05 Dec 2022 07:07:03 GMT
server: openresty
etag: W/"24c4-5ef0f559ad2d6"
vary: Accept-Encoding, Accept-Encoding
content-type: text/css
x-lima-id: atL5h9kLfMfQ3FKrB6
cache-control: max-age=2592000
expires: Wed, 04 Jan 2023 07:07:03 GMT

GET
H2 200 CTBC_W.jpg
gov-chiunghwapost-twdg.2ix.ch/u/328e7/img/ 42 KB
43 KB 64ms
62ms Image
image/jpeg 2a00:f48:2000:affe::50
TTM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://gov-chiunghwapost-twdg.2ix.ch/u/328e7/img/CTBC_W.jpg

Requested by

Host: gov-chiunghwapost-twdg.2ix.ch
URL: https://gov-chiunghwapost-twdg.2ix.ch/u/328e7/SSLAuthUI.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),

Reverse DNS

Software

openresty /

Resource Hash

14832827e45f20f385f3584cb5c84441eb00df1be5aeb33882a5b4ab510ae2ed

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://gov-chiunghwapost-twdg.2ix.ch/u/328e7/SSLAuthUI.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

date: Mon, 05 Dec 2022 07:07:03 GMT
content-security-policy: upgrade-insecure-requests
last-modified: Mon, 05 Dec 2022 07:07:03 GMT
server: openresty
etag: W/"a972-5ef0f559ad2d6"
content-type: image/jpeg
x-lima-id: atKG7Hz5y77tzTHacj
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 43378
expires: Wed, 04 Jan 2023 07:07:03 GMT

GET
H2 200 cardtype_ss.png
gov-chiunghwapost-twdg.2ix.ch/u/328e7/img/ 7 KB
8 KB 68ms
66ms Image
image/png 2a00:f48:2000:affe::50
TTM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://gov-chiunghwapost-twdg.2ix.ch/u/328e7/img/cardtype_ss.png

Requested by

Host: gov-chiunghwapost-twdg.2ix.ch
URL: https://gov-chiunghwapost-twdg.2ix.ch/u/328e7/SSLAuthUI.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),

Reverse DNS

Software

openresty /

Resource Hash

a5ca115514cbfc52924374b62761d7f0d1f8e510d08b32905f75b66b3a37b1e1

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://gov-chiunghwapost-twdg.2ix.ch/u/328e7/SSLAuthUI.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

date: Mon, 05 Dec 2022 07:07:03 GMT
content-security-policy: upgrade-insecure-requests
last-modified: Mon, 05 Dec 2022 07:07:03 GMT
server: openresty
etag: W/"1dbd-5ef0f559ad2d6"
content-type: image/png
x-lima-id: at0OrFCd2zgLWynEIf
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 7613
expires: Wed, 04 Jan 2023 07:07:03 GMT

GET
H2 200 card.png
gov-chiunghwapost-twdg.2ix.ch/u/328e7/img/ 399 B
718 B 69ms
66ms Image
image/png 2a00:f48:2000:affe::50
TTM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://gov-chiunghwapost-twdg.2ix.ch/u/328e7/img/card.png

Requested by

Host: gov-chiunghwapost-twdg.2ix.ch
URL: https://gov-chiunghwapost-twdg.2ix.ch/u/328e7/SSLAuthUI.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),

Reverse DNS

Software

openresty /

Resource Hash

39459e2db25db3f30b853a7b510629f766994c88eb2af780e77d4ffa71287ee0

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://gov-chiunghwapost-twdg.2ix.ch/u/328e7/SSLAuthUI.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

date: Mon, 05 Dec 2022 07:07:03 GMT
content-security-policy: upgrade-insecure-requests
last-modified: Mon, 05 Dec 2022 07:07:03 GMT
server: openresty
etag: W/"18f-5ef0f559ad2d6"
content-type: image/png
x-lima-id: atFdpwemIGKcvDGBrz
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 399
expires: Wed, 04 Jan 2023 07:07:03 GMT

GET
H2 200 Exclamation.png
gov-chiunghwapost-twdg.2ix.ch/u/328e7/img/ 481 B
799 B 69ms
67ms Image
image/png 2a00:f48:2000:affe::50
TTM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://gov-chiunghwapost-twdg.2ix.ch/u/328e7/img/Exclamation.png

Requested by

Host: gov-chiunghwapost-twdg.2ix.ch
URL: https://gov-chiunghwapost-twdg.2ix.ch/u/328e7/SSLAuthUI.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),

Reverse DNS

Software

openresty /

Resource Hash

f35b4d8168065dde839d4ebb2bb3747b2734acdf3c85e0c28a163daa97c76d39

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://gov-chiunghwapost-twdg.2ix.ch/u/328e7/SSLAuthUI.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

date: Mon, 05 Dec 2022 07:07:03 GMT
content-security-policy: upgrade-insecure-requests
last-modified: Mon, 05 Dec 2022 07:07:03 GMT
server: openresty
etag: W/"1e1-5ef0f559ad2d6"
content-type: image/png
x-lima-id: atnYhXYcClfGOzyPm1
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 481
expires: Wed, 04 Jan 2023 07:07:03 GMT

GET
H2 200 3D_VISA.png
gov-chiunghwapost-twdg.2ix.ch/u/328e7/img/ 4 KB
4 KB 70ms
68ms Image
image/png 2a00:f48:2000:affe::50
TTM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://gov-chiunghwapost-twdg.2ix.ch/u/328e7/img/3D_VISA.png

Requested by

Host: gov-chiunghwapost-twdg.2ix.ch
URL: https://gov-chiunghwapost-twdg.2ix.ch/u/328e7/SSLAuthUI.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),

Reverse DNS

Software

openresty /

Resource Hash

1818f0c2ef6a363e915bd4c6c2c2cbeef0fcf60ff2da3e79cfe0d1c3bc9ff86b

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://gov-chiunghwapost-twdg.2ix.ch/u/328e7/SSLAuthUI.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

date: Mon, 05 Dec 2022 07:07:03 GMT
content-security-policy: upgrade-insecure-requests
last-modified: Mon, 05 Dec 2022 07:07:03 GMT
server: openresty
etag: W/"1005-5ef0f559ad2d6"
content-type: image/png
x-lima-id: atdLRVs2KZoJGbplGG
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 4101
expires: Wed, 04 Jan 2023 07:07:03 GMT

GET
H2 200 3D_MASTER.png
gov-chiunghwapost-twdg.2ix.ch/u/328e7/img/ 3 KB
3 KB 69ms
68ms Image
image/png 2a00:f48:2000:affe::50
TTM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://gov-chiunghwapost-twdg.2ix.ch/u/328e7/img/3D_MASTER.png

Requested by

Host: gov-chiunghwapost-twdg.2ix.ch
URL: https://gov-chiunghwapost-twdg.2ix.ch/u/328e7/SSLAuthUI.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),

Reverse DNS

Software

openresty /

Resource Hash

203dffbf9fb647ad3576ebc57c4005c1a0cb07cc740a911585b6ba70c8d20892

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://gov-chiunghwapost-twdg.2ix.ch/u/328e7/SSLAuthUI.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

date: Mon, 05 Dec 2022 07:07:03 GMT
content-security-policy: upgrade-insecure-requests
last-modified: Mon, 05 Dec 2022 07:07:03 GMT
server: openresty
etag: W/"c1a-5ef0f559ad2d6"
content-type: image/png
x-lima-id: atXI1RopbB9V8e5zy8
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 3098
expires: Wed, 04 Jan 2023 07:07:03 GMT

GET
H2 200 3D_JCB.png
gov-chiunghwapost-twdg.2ix.ch/u/328e7/img/ 3 KB
3 KB 70ms
68ms Image
image/png 2a00:f48:2000:affe::50
TTM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://gov-chiunghwapost-twdg.2ix.ch/u/328e7/img/3D_JCB.png

Requested by

Host: gov-chiunghwapost-twdg.2ix.ch
URL: https://gov-chiunghwapost-twdg.2ix.ch/u/328e7/SSLAuthUI.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),

Reverse DNS

Software

openresty /

Resource Hash

eacf2b196015c40a02cf7849c614daaca5205159d7ac234ad90ea47fbb714041

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://gov-chiunghwapost-twdg.2ix.ch/u/328e7/SSLAuthUI.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

date: Mon, 05 Dec 2022 07:07:03 GMT
content-security-policy: upgrade-insecure-requests
last-modified: Mon, 05 Dec 2022 07:07:03 GMT
server: openresty
etag: W/"be2-5ef0f559ad2d6"
content-type: image/png
x-lima-id: ate2A3Ycx5Df5iCoBC
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 3042
expires: Wed, 04 Jan 2023 07:07:03 GMT

GET
H2 200 twca_ssl.png
gov-chiunghwapost-twdg.2ix.ch/u/328e7/img/ 6 KB
6 KB 68ms
67ms Image
image/png 2a00:f48:2000:affe::50
TTM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://gov-chiunghwapost-twdg.2ix.ch/u/328e7/img/twca_ssl.png

Requested by

Host: gov-chiunghwapost-twdg.2ix.ch
URL: https://gov-chiunghwapost-twdg.2ix.ch/u/328e7/SSLAuthUI.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),

Reverse DNS

Software

openresty /

Resource Hash

4a1d51361e6bfabde052f3b64166d7ab532241e0c634162ccd6220c76759642a

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://gov-chiunghwapost-twdg.2ix.ch/u/328e7/SSLAuthUI.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

date: Mon, 05 Dec 2022 07:07:03 GMT
content-security-policy: upgrade-insecure-requests
last-modified: Mon, 05 Dec 2022 07:07:03 GMT
server: openresty
etag: W/"173d-5ef0f559ad2d6"
content-type: image/png
x-lima-id: atHvMtT2PmQPrsvJj0
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 5949
expires: Wed, 04 Jan 2023 07:07:03 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Chunghwa Post (Transportation)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontentvisibilityautostatechange

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
ziflame.ru/	1969-12-31 23:59:59	Name: PHPSESSID Value: 10a7a787a277e2b0b6d5265b981dbf12
gov-chiunghwapost-twdg.2ix.ch/	1970-01-20 17:33:04	Name: _lcp Value: a
gov-chiunghwapost-twdg.2ix.ch/	1970-01-20 17:33:04	Name: _lcp2 Value: a
gov-chiunghwapost-twdg.2ix.ch/	1970-01-20 17:33:04	Name: _lcp3 Value: a

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

gov-chiunghwapost-twdg.2ix.ch
s.free.fr
ziflame.ru
2a00:f48:2000:affe::50
2a01:e0c:1:1599::29
2a03:c980:dead:1004:91:218:228:13
14832827e45f20f385f3584cb5c84441eb00df1be5aeb33882a5b4ab510ae2ed
1818f0c2ef6a363e915bd4c6c2c2cbeef0fcf60ff2da3e79cfe0d1c3bc9ff86b
203dffbf9fb647ad3576ebc57c4005c1a0cb07cc740a911585b6ba70c8d20892
39459e2db25db3f30b853a7b510629f766994c88eb2af780e77d4ffa71287ee0
4a1d51361e6bfabde052f3b64166d7ab532241e0c634162ccd6220c76759642a
a21e37f28e0471522fcbb0e6860b66a60a582246c4be912dc912b339c35f2ce0
a5ca115514cbfc52924374b62761d7f0d1f8e510d08b32905f75b66b3a37b1e1
e080bb1f109d928487db3f9176f6be629a2e287b0294c9c9585fb8571391378a
e7960312f17c616f9f0d53036d0b842b56b233b366c42193e1bdd6e83567b30b
eacf2b196015c40a02cf7849c614daaca5205159d7ac234ad90ea47fbb714041
f35b4d8168065dde839d4ebb2bb3747b2734acdf3c85e0c28a163daa97c76d39
f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c

gov-chiunghwapost-twdg.2ix.ch Open in urlscan Pro 2a00:f48:2000:affe::50 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

12 Requests

92 %HTTPS

100 %IPv6

3 Domains

3 Subdomains

2 IPs

3 Countries

97 kBTransfer

204 kBSize

4 Cookies

0 Outgoing links

Page URL History

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

4 Cookies

Indicators

gov-chiunghwapost-twdg.2ix.ch Open in urlscan Pro
2a00:f48:2000:affe::50 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

92 %
HTTPS

100 %
IPv6

3
Domains

3
Subdomains

2
IPs

3
Countries

97 kB
Transfer

204 kB
Size

4
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!