pstx21-reschedule.com Open in urlscan Pro
108.167.172.158 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://pstx21-reschedule.com/royalmail/
Submission: On June 28 via automatic, source phishtank (June 28th 2021, 11:21:39 am UTC)

Summary HTTP 7 Redirects Links 17 Behaviour Indicators

Summary

This website contacted 6 IPs in 4 countries across 5 domains to perform 7 HTTP transactions. The main IP is 108.167.172.158, located in United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is pstx21-reschedule.com.
TLS certificate: Issued by R3 on June 25th 2021. Valid for: 3 months.

This is the only time pstx21-reschedule.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Royal Mail (Government)

Domain & IP information

	IP Address	AS Autonomous System
1	108.167.172.158 108.167.172.158	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
1	78.129.237.3 78.129.237.3	20860 (IOMART-AS) (IOMART-AS)
1	195.80.159.133 195.80.159.133	29152 (DECKNET-AS) (DECKNET-AS)
1	2a00:1450:400... 2a00:1450:4001:80e::200a	15169 (GOOGLE) (GOOGLE)
1	145.239.131.55 145.239.131.55	16276 (OVH) (OVH)
7	6

1 108.167.172.158 (United States)

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: gator4263.hostgator.com

pstx21-reschedule.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 78.129.237.3 (United Kingdom)

ASN20860 (IOMART-AS, GB)

smtpjs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 195.80.159.133 (Paris, France)

ASN29152 (DECKNET-AS, FR)

l2.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80e::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 145.239.131.55 (France)

ASN16276 (OVH, FR)
PTR: i.ibb.co

i.ibb.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
1	ibb.co i.ibb.co	3 KB
1	googleapis.com ajax.googleapis.com	31 KB
1	l2.io l2.io	229 B
1	smtpjs.com smtpjs.com	782 B
1	pstx21-reschedule.com pstx21-reschedule.com	318 KB
7	5

	Domain	Requested by
1	i.ibb.co	pstx21-reschedule.com
1	ajax.googleapis.com	pstx21-reschedule.com
1	l2.io	pstx21-reschedule.com
1	smtpjs.com	pstx21-reschedule.com
1	pstx21-reschedule.com
7	5

This site contains links to these domains. Also see Links.

Domain
www.royalmail.com
personal.help.royalmail.com
send.royalmail.com
parcel.royalmail.com
jobs.royalmailgroup.com
www.royalmailgroup.com

Subject Issuer	Validity	Valid
pstx21-reschedule.com R3	`2021-06-25` - `2021-09-23`	3 months	crt.sh
smtpjs.com R3	`2021-06-09` - `2021-09-07`	3 months	crt.sh
l2.io R3	`2021-06-05` - `2021-09-03`	3 months	crt.sh
upload.video.google.com GTS CA 1O1	`2021-05-31` - `2021-08-23`	3 months	crt.sh
ibb.co R3	`2021-06-07` - `2021-09-05`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://pstx21-reschedule.com/royalmail/
Frame ID: 2266EE6BFE19DE3EC6EB8BB6CF9AB84B
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

7
Requests

71 %
HTTPS

20 %
IPv6

5
Domains

5
Subdomains

6
IPs

4
Countries

455 kB
Transfer

1085 kB
Size

0
Cookies

17 Outgoing links

These are links going to different origins than the main page.

URL: https://www.royalmail.com/
Title:

Search URL Search Domain Scan URL

URL: https://www.royalmail.com/coronavirus
Title: coronavirus

Search URL Search Domain Scan URL

URL: https://personal.help.royalmail.com/app/answers/detail/a_id/12556
Title: Service Updates

Search URL Search Domain Scan URL

URL: https://send.royalmail.com/
Title: Click & Drop

Search URL Search Domain Scan URL

URL: https://www.royalmail.com/downloadapp
Title: Royal Mail app

Search URL Search Domain Scan URL

URL: https://www.royalmail.com/register?destination=/
Title: Register

Search URL Search Domain Scan URL

URL: https://www.royalmail.com/discounts-payment/credit-account/online-business-account
Title: Online Business Account login

Search URL Search Domain Scan URL

URL: https://parcel.royalmail.com/
Title: Click & DropOpens in a new window

Search URL Search Domain Scan URL

URL: https://jobs.royalmailgroup.com/
Title: JobsOpens in a new window

Search URL Search Domain Scan URL

URL: https://www.royalmailgroup.com/
Title: Royal Mail GroupOpens in a new window

Search URL Search Domain Scan URL

URL: https://www.royalmail.com/terms-and-conditions
Title: Terms and conditions

Search URL Search Domain Scan URL

URL: https://www.royalmail.com/privacy-notice
Title: Privacy

Search URL Search Domain Scan URL

URL: https://www.royalmail.com/terms-website
Title: Terms of use

Search URL Search Domain Scan URL

URL: https://www.royalmail.com/cookies-policy
Title: Cookies

Search URL Search Domain Scan URL

URL: https://www.royalmailgroup.com/en/site/accessibility/
Title: AccessibilityOpens in a new window

Search URL Search Domain Scan URL

URL: https://www.royalmail.com/cymraeg
Title: Cymraeg

Search URL Search Domain Scan URL

URL: http://www.royalmail.com/cookies-policy
Title: Cookies policy

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
5 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
pstx21-reschedule.com/royalmail/ 857 KB
318 KB 399ms
137ms Document
text/html 108.167.172.158
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://pstx21-reschedule.com/royalmail/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.167.172.158 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: gator4263.hostgator.com
Software: Apache /
Resource Hash: 6347cd8477cec8acc843fa3b7b671cfdfc9f5d779489d86f2440b533aa618893

Request headers

:method: GET
:authority: pstx21-reschedule.com
:scheme: https
:path: /royalmail/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 28 Jun 2021 11:21:22 GMT
server: Apache
last-modified: Sat, 26 Jun 2021 09:15:52 GMT
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html

GET
H2 200 smtp.js Show response
smtpjs.com/v3/ 871 B
782 B 78ms
23ms Script
application/javascript 78.129.237.3
IOMART-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://smtpjs.com/v3/smtp.js
Requested by: Host: pstx21-reschedule.com
URL: https://pstx21-reschedule.com/royalmail/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 78.129.237.3 , United Kingdom, ASN20860 (IOMART-AS, GB),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 1fd711cb491a361ef91e29c50de0680a4b156c0b34bb91e18570d0037263a776

Request headers

Referer: https://pstx21-reschedule.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 28 Jun 2021 11:21:22 GMT
content-encoding: gzip
last-modified: Tue, 10 Nov 2020 17:17:51 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
etag: "162f436b85b7d61:0"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
accept-ranges: bytes
content-length: 603

GET
H/1.1 200
OK ip.js Show response
l2.io/ 25 B
229 B 56ms
16ms Script
text/html 195.80.159.133
DECKNET-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://l2.io/ip.js?var=userip
Requested by: Host: pstx21-reschedule.com
URL: https://pstx21-reschedule.com/royalmail/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 195.80.159.133 Paris, France, ASN29152 (DECKNET-AS, FR),
Reverse DNS
Software: Apache/2.4.25 (Debian) /
Resource Hash: 0a41ea9e6ecd29d02230402f41399cd90d2ecec25ba40fcffa8033180b86b37f

Request headers

Referer: https://pstx21-reschedule.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 28 Jun 2021 11:21:23 GMT
Server: Apache/2.4.25 (Debian)
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
Content-Length: 25
Content-Type: text/html; charset=UTF-8

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.5.1/ 87 KB
31 KB 27ms
7ms Script
text/javascript 2a00:1450:4001:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js

Requested by

Host: pstx21-reschedule.com
URL: https://pstx21-reschedule.com/royalmail/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://pstx21-reschedule.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 28 Jun 2021 10:48:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1965
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31021
x-xss-protection: 0
last-modified: Fri, 08 May 2020 07:05:03 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 28 Jun 2022 10:48:38 GMT

GET
H2 200 ajax-loader.gif
i.ibb.co/RpLNy4f/ 3 KB
3 KB 66ms
34ms Image
image/gif 145.239.131.55
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.ibb.co/RpLNy4f/ajax-loader.gif
Requested by: Host: pstx21-reschedule.com
URL: https://pstx21-reschedule.com/royalmail/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 145.239.131.55 , France, ASN16276 (OVH, FR),
Reverse DNS: i.ibb.co
Software: nginx /
Resource Hash: fd29b3b084cf11160bfc4e99d98a261f2b36bff29113b07367c5204563c5d355

Request headers

Referer: https://pstx21-reschedule.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 28 Jun 2021 11:21:23 GMT
last-modified: Tue, 02 Mar 2021 22:27:30 GMT
server: nginx
access-control-allow-methods: GET, OPTIONS
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 3208
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
DATA 200
OK truncated
/ 12 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 344b29deab56ac203aa9d4c258a097020f4b207da082f1267e2b9a4280903c34

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 34 KB
34 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 59b1b91d85d2c035f814c3bf2022b2b45cff6f816dfb9e918e1820d4e527d451

Request headers

Origin: https://pstx21-reschedule.com
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: application/font-woff

GET
DATA 200
OK truncated
/ 289 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 51e0af0ef371a2295c8cf115b147bc14d729106bec94d4063463f15040720614

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 12 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5a1dde4172791377be893c93e052712b4892671a18f087b2d78c6e8d40ede9a5

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 33 KB
33 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3060f58cd766bb2fcaab5b176a99cc2d731086d6b895137554ceac63ee31db03

Request headers

Origin: https://pstx21-reschedule.com
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: application/font-woff

GET
DATA 200
OK truncated
/ 35 KB
35 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a8c3bcb00ae3ee45dc394906c4e5e23e88a905234d8343ed43c9069618a2d69e

Request headers

Origin: https://pstx21-reschedule.com
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: application/font-woff

GET
DATA 200
OK truncated
/ 10 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ab0d37e28146cdcbaed1152d246a8bede90c4bb6c116e076622daf055b858c9f

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Royal Mail (Government)

24 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
i.ibb.co
l2.io
pstx21-reschedule.com
smtpjs.com
108.167.172.158
145.239.131.55
195.80.159.133
2a00:1450:4001:80e::200a
78.129.237.3
0a41ea9e6ecd29d02230402f41399cd90d2ecec25ba40fcffa8033180b86b37f
1fd711cb491a361ef91e29c50de0680a4b156c0b34bb91e18570d0037263a776
3060f58cd766bb2fcaab5b176a99cc2d731086d6b895137554ceac63ee31db03
344b29deab56ac203aa9d4c258a097020f4b207da082f1267e2b9a4280903c34
51e0af0ef371a2295c8cf115b147bc14d729106bec94d4063463f15040720614
59b1b91d85d2c035f814c3bf2022b2b45cff6f816dfb9e918e1820d4e527d451
5a1dde4172791377be893c93e052712b4892671a18f087b2d78c6e8d40ede9a5
6347cd8477cec8acc843fa3b7b671cfdfc9f5d779489d86f2440b533aa618893
7409cd5a9245b1818c4b51de1b1a96699636cfb6427d214f1e37d4e5598455ce
a8c3bcb00ae3ee45dc394906c4e5e23e88a905234d8343ed43c9069618a2d69e
ab0d37e28146cdcbaed1152d246a8bede90c4bb6c116e076622daf055b858c9f
b8103691ff5ab3d1ed001a3467e623c183cb20507d80a6a33c8785d5fa47fca5
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
fd29b3b084cf11160bfc4e99d98a261f2b36bff29113b07367c5204563c5d355

pstx21-reschedule.com Open in urlscan Pro 108.167.172.158 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

7 Requests

71 %HTTPS

20 %IPv6

5 Domains

5 Subdomains

6 IPs

4 Countries

455 kBTransfer

1085 kBSize

0 Cookies

17 Outgoing links

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 5 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

24 JavaScript Global Variables

0 Cookies

Indicators

pstx21-reschedule.com Open in urlscan Pro
108.167.172.158 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

71 %
HTTPS

20 %
IPv6

5
Domains

5
Subdomains

6
IPs

4
Countries

455 kB
Transfer

1085 kB
Size

0
Cookies

7 HTTP transactions
5 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!