kaavart.com
Open in
urlscan Pro
2.59.134.16
Malicious Activity!
Public Scan
Effective URL: https://kaavart.com/qa/ar/
Submission: On October 13 via manual from QA — Scanned from DE
Summary
TLS certificate: Issued by R3 on September 9th 2022. Valid for: 3 months.
This is the only time kaavart.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Qatar Post (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 67.199.248.11 67.199.248.11 | 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM) | |
1 2 | 198.37.116.25 198.37.116.25 | 17216 (DC74-AS) (DC74-AS) | |
1 16 | 2.59.134.16 2.59.134.16 | 58212 (DATAFOREST) (DATAFOREST) | |
16 | 2 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
16 |
kaavart.com
1 redirects
kaavart.com |
382 KB |
2 |
somee.com
1 redirects
www.trackqr5598.somee.com |
553 B |
1 |
bit.ly
1 redirects
bit.ly — Cisco Umbrella Rank: 4998 |
237 B |
16 | 3 |
Domain | Requested by | |
---|---|---|
16 | kaavart.com |
1 redirects
kaavart.com
|
2 | www.trackqr5598.somee.com | 1 redirects |
1 | bit.ly | 1 redirects |
16 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
kaavart.com R3 |
2022-09-09 - 2022-12-08 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://kaavart.com/qa/ar/
Frame ID: 611FD965F5A7BC63C534406A20EF1FC0
Requests: 16 HTTP requests in this frame
Screenshot
Page Title
Qatar Postal ServicesPage URL History Show full URLs
-
https://bit.ly/3B86006Dtg
HTTP 301
http://www.trackqr5598.somee.com/home HTTP 301
http://www.trackqr5598.somee.com/home/ Page URL
-
https://kaavart.com/qa/
HTTP 302
https://kaavart.com/qa/ar/ Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://bit.ly/3B86006Dtg
HTTP 301
http://www.trackqr5598.somee.com/home HTTP 301
http://www.trackqr5598.somee.com/home/ Page URL
-
https://kaavart.com/qa/
HTTP 302
https://kaavart.com/qa/ar/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://bit.ly/3B86006Dtg HTTP 301
- http://www.trackqr5598.somee.com/home HTTP 301
- http://www.trackqr5598.somee.com/home/
16 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
www.trackqr5598.somee.com/home/ Redirect Chain
|
73 B 320 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
/
kaavart.com/qa/ar/ Redirect Chain
|
4 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
kaavart.com/qa/ar/inc/ |
1 KB 733 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jq.js
kaavart.com/qa/ar/inc/ |
87 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
menu.png
kaavart.com/qa/ar/inc/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.png
kaavart.com/qa/ar/inc/ |
27 KB 13 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
narrow.png
kaavart.com/qa/ar/inc/ |
541 B 802 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
social.png
kaavart.com/qa/ar/inc/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
android.png
kaavart.com/qa/ar/inc/ |
6 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
apple.png
kaavart.com/qa/ar/inc/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bv.jpg
kaavart.com/qa/ar/inc/ |
388 KB 313 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
m.js
kaavart.com/qa/ar/inc/ |
23 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
spy.php
kaavart.com/qa/ar/ |
0 173 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
date.php
kaavart.com/qa/ar/ |
21 B 197 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
date.php
kaavart.com/qa/ar/ |
21 B 197 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
date.php
kaavart.com/qa/ar/ |
21 B 197 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Qatar Post (Transportation)12 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| $ function| jQuery number| c1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.bit.ly/ | Name: _bit Value: m9diFG-a60bddcc0ad3955373-00u |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bit.ly
kaavart.com
www.trackqr5598.somee.com
198.37.116.25
2.59.134.16
67.199.248.11
193ce33047b3b03ce0e24da1bf3d70507eaba50d95fb9c293da2d0b5830c2b69
35bad6bde5f7928bcdec714cbc5b7b6f10ccf2b8ef6a59e2a45744d436dbfdf0
459bf2fe17ccbf61168f5ea3410bbc2e15eb12c7b9a1e4663261daa37b4eb004
4f9eba1087d448e97f3d51d85da865db5709a5c34145e45d863affc540f5c6f1
5a1aa46f4fbd353666f0cb9ce412e0ee7d7f006179599322dddbdf7f4d348fca
5a4607302a28ac27f9e083779598747107c0ea7e4f0062d72de69f6903230525
5a595afc674381cf5517bb10b891e152a4104b475b7722058b628276d2c4cdc2
89a38f8d2397fde7cc17a14a4351a507dfd4fcae333d8b3ac1c26800c43d68d1
8dcff9898a596cd02153e5abdd3d5fa4b00b2941a71f0ffb03d6cf652418b778
a199620fe981df00a825f78761d3f7c8870f8117daa4a890e08018dec386dae8
ad20cbf3c0aca9202a49b458b7221307df4ffe579a6f66b8016dc9b460ff1fa2
af33e51c760cefc47c8a35d8fee11bbbd9b69c7cca285cbb67d2f8a668c0f1ef
d41068bc76b5a203fc224c00212d08a1090c19d4d24ade45d2bc6db7b38a362b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ed0e4393a7619427b26145b3b1318565f97f9021e5a8adcfceb72b30f5add58b
ee11e902416a1d896f538103110337b39a0e2e2606bc1faf5cd0652914891127