www.royalmservice.com
Open in
urlscan Pro
199.188.205.245
Malicious Activity!
Public Scan
URL:
https://www.royalmservice.com/
Submission: On March 12 via automatic, source certstream-suspicious — Scanned from DE
Submission: On March 12 via automatic, source certstream-suspicious — Scanned from DE
Summary
This website contacted 3 IPs
in 2 countries
across 2 domains to perform 11 HTTP transactions.
The main IP is 199.188.205.245, located in
United States and
belongs to NAMECHEAP-NET, US.
The main domain is www.royalmservice.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on March 12th 2024. Valid for: a year.
This is the only time www.royalmservice.com was scanned on urlscan.io!
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on March 12th 2024. Valid for: a year.
This is the only time www.royalmservice.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Royal Mail (Government)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 10 | 199.188.205.245 199.188.205.245 | 22612 (NAMECHEAP...) (NAMECHEAP-NET) | |
| 1 | 2.21.20.211 2.21.20.211 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
| 11 | 3 |
10
199.188.205.245
(United States)
ASN22612 (NAMECHEAP-NET, US)
PTR: server61-4.web-hosting.com
ASN22612 (NAMECHEAP-NET, US)
PTR: server61-4.web-hosting.com
| www.royalmservice.com |
1
2.21.20.211
(Frankfurt am Main, Germany)
ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-21-20-211.deploy.static.akamaitechnologies.com
ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-21-20-211.deploy.static.akamaitechnologies.com
| www.royalmail.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 10 |
royalmservice.com
www.royalmservice.com |
259 KB |
| 1 |
royalmail.com
www.royalmail.com — Cisco Umbrella Rank: 59104 |
61 KB |
| 11 | 2 |
| Domain | Requested by | |
|---|---|---|
| 10 | www.royalmservice.com |
www.royalmservice.com
|
| 1 | www.royalmail.com |
www.royalmservice.com
|
| 11 | 2 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| royalmservice.com Sectigo RSA Domain Validation Secure Server CA |
2024-03-12 - 2025-03-12 |
a year | crt.sh |
| *.royalmail.com Entrust Certification Authority - L1K |
2023-06-20 - 2024-06-20 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.royalmservice.com/
Frame ID: 96C4A2246A8306FC5897B3CE7ADEBD84
Requests: 12 HTTP requests in this frame
Screenshot
Page Title
Redelivery - Arrange Online | Royal Mail Group Ltd2D569042-6990-413A-805A-A46371AB1EFDIcon - CollectIcon - LocationIcon - Send itemPage Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
/
www.royalmservice.com/ |
95 KB 27 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
css_GbyBld2YVfGaoHcw3eZJtGlhAxDTBpV3xkP06qLMwBI.css
www.royalmservice.com/rtum_assetz/css/ |
26 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
css__6NsxoZZPhWfqnbaEQb7wCY6LyRmdblZQ2D8Q7XDSIY.css
www.royalmservice.com/rtum_assetz/css/ |
829 KB 91 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
logo.png
www.royalmservice.com/rtum_assetz/img/ |
12 KB 13 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
SafeSpace-logo.png
www.royalmservice.com/rtum_assetz/img/ |
6 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
10 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
redelivery_background_image.jpg
www.royalmail.com/sites/royalmail.com/files/styles/intro_desktop_reduced/public/2020-10/ |
61 KB 61 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
scam-guidance.png
www.royalmservice.com/rtum_assetz/img/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
keep-me-posted.png
www.royalmservice.com/rtum_assetz/img/ |
11 KB 11 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
chevin-medium.woff
www.royalmservice.com/rtum_assetz/fonts/ |
34 KB 34 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
pfdintextstd-bold-webfont.woff
www.royalmservice.com/rtum_assetz/fonts/ |
33 KB 33 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
chevin-bold.woff
www.royalmservice.com/rtum_assetz/fonts/ |
35 KB 35 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Royal Mail (Government)0 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| www.royalmservice.com/ | Name: PHPSESSID Value: js4em2p8mdbm88qcckrh5b48jd |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
www.royalmail.com
www.royalmservice.com
199.188.205.245
2.21.20.211
19bc8195dd9855f19aa07730dde649b469610310d3069577c643f4eaa2ccc012
3060f58cd766bb2fcaab5b176a99cc2d731086d6b895137554ceac63ee31db03
344b29deab56ac203aa9d4c258a097020f4b207da082f1267e2b9a4280903c34
4380aee5cd17c45b917f4575cc43857d5716df8e35744ca2de8927f9d6cf925c
59b1b91d85d2c035f814c3bf2022b2b45cff6f816dfb9e918e1820d4e527d451
5e001149ad167758a03acb66388cc23c2aba60bbe811da33bb2ea44c59157eb7
61b02dbe883308061e0c91772e3c91f92944fd33500ec6fedd9d9998a3a635fe
8e5bd63208d0cf73eb49c33fe135dbb66e5fe3d680fac9abeb4a4670a79b01a7
9314ec2d98780f916a6357eaee875203f4fb04438313c111fafa9a36ba579997
a8c3bcb00ae3ee45dc394906c4e5e23e88a905234d8343ed43c9069618a2d69e
ab0d37e28146cdcbaed1152d246a8bede90c4bb6c116e076622daf055b858c9f
c4c5803969be7974c37be81e77723fa781e2917fae61fc0f3ba9bc46af27d055