nonprofittransfer.com
Open in
urlscan Pro
162.246.22.196
Malicious Activity!
Public Scan
Submission: On February 13 via manual from DE
Summary
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on February 9th 2021. Valid for: a year.
This is the only time nonprofittransfer.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: PostNord AB (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 162.246.22.196 162.246.22.196 | 19318 (IS-AS-1) (IS-AS-1) | |
3 | 35.244.137.202 35.244.137.202 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2606:4700::68... 2606:4700::6812:e134 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2606:4700:303... 2606:4700:3032::6815:17e7 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 192.229.133.208 192.229.133.208 | 15133 (EDGECAST) (EDGECAST) | |
8 | 5 |
ASN19318 (IS-AS-1, US)
PTR: painel.vwnet.com.br
nonprofittransfer.com |
ASN15169 (GOOGLE, US)
PTR: 202.137.244.35.bc.googleusercontent.com
g.fastcdn.co |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
fastcdn.co
g.fastcdn.co v.fastcdn.co |
29 KB |
2 |
mdsyzz.info
api.mdsyzz.info |
3 KB |
1 |
onesignal.com
cdn.onesignal.com |
3 KB |
1 |
nonprofittransfer.com
nonprofittransfer.com |
15 KB |
8 | 4 |
Domain | Requested by | |
---|---|---|
3 | g.fastcdn.co |
nonprofittransfer.com
|
2 | api.mdsyzz.info |
nonprofittransfer.com
api.mdsyzz.info |
1 | v.fastcdn.co |
nonprofittransfer.com
|
1 | cdn.onesignal.com |
nonprofittransfer.com
|
1 | nonprofittransfer.com | |
8 | 5 |
This site contains links to these domains. Also see Links.
Domain |
---|
bettertrackstofollow.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
nonprofittransfer.com Sectigo RSA Domain Validation Secure Server CA |
2021-02-09 - 2022-02-09 |
a year | crt.sh |
g.fastcdn.co GTS CA 1D2 |
2021-01-24 - 2021-04-24 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2020-08-04 - 2021-08-04 |
a year | crt.sh |
v.fastcdn.co DigiCert SHA2 Secure Server CA |
2020-05-05 - 2022-07-14 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://nonprofittransfer.com/postnorddk/dk/?cep=NbisaUAXfHd_AGCssqVlaF1zw1CVdYdg2lH0JqVYLBwuzuYdpfAVFUqONtkWy5xR8OYFRoNkiVf6H406VJNr62BewtNWtvN0y1tehzAJ8cYk7lUgJqVDFgEMLZVUcDVMqmM4ih1ZVzLtgjRWLpmc_EFaCHq6nV96KKJPufbD6QrDHTFja...
Frame ID: 5C461FAAC05450A06A14ECD74553812A
Requests: 8 HTTP requests in this frame
Screenshot
Detected technologies
CentOS (Operating Systems) ExpandDetected patterns
- headers server /CentOS/i
OpenSSL (Web Server Extensions) Expand
Detected patterns
- headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i
Apache (Web Servers) Expand
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: Betal gebyr
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
8 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
nonprofittransfer.com/postnorddk/dk/ |
14 KB 15 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
utils.6702255f1b18d698d5e9.js
g.fastcdn.co/js/ |
47 KB 16 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Cradle.0c31ec18122b86fb9fd1.js
g.fastcdn.co/js/ |
20 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
LazyImage.5c22b33358ebb526e37b.js
g.fastcdn.co/js/ |
3 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
OneSignalSDK.js
cdn.onesignal.com/sdks/ |
9 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
auto-push.min.js
api.mdsyzz.info/ |
3 KB 2 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
54487141-0-download-1.png
v.fastcdn.co/u/27d140b1/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
81ab0785-3e5a-4aac-97c6-2a233e2567d6
api.mdsyzz.info/rest/v1/p-apps/get-id/ |
129 B 805 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: PostNord AB (Transportation)31 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated object| OneSignal object| _at function| InitializePush function| myDomain function| getLocation function| CheckImageAndReplace function| httpGetAsync function| getUrlVars function| getUrlParam object| __variantsData number| __page_id number| __default_experience_id number| __version string| __variant string| __variant_custom_name boolean| __preview number| __page_type string| __variant_hash boolean| __page_generator object| _Translate object| webpackJsonp object| __eventBus0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
api.mdsyzz.info
cdn.onesignal.com
g.fastcdn.co
nonprofittransfer.com
v.fastcdn.co
162.246.22.196
192.229.133.208
2606:4700:3032::6815:17e7
2606:4700::6812:e134
35.244.137.202
032814cf4be1a49b079a1c3c0aceda71a8aecb63c4a4a65d01e0a632b4b2a476
0648f73f208b2f496c9313f42375405d35cc4b2da5324e393d21ba4f2b71ff5c
21fd9abd914e9a1b1af21b85ac64107f23b51fbaeb05779dc6e9f13e0727caa0
50d767e4a47c388ee24280927c032be6ef0097927f75851b190266cccb9552a4
5cb0eaba6c9c1771fa32cd570b42275a9d3753805b6b7e76d0651878610353b2
66109913f2822c41c56c88299701fab6e98eacd1c10c2934fc96843e5ce5aad9
7a69efa7f043d1309d50f5d70776d810d4cd44833f5275f9753b8a3384cf8e50
984f80e2c26543daf410023d488d48fbfcef61ff7c006c2b7ad2eb2080aabefb