www.posthouse.com - urlscan.io

Summary

This website contacted 1 IPs in 2 countries across 3 domains to perform 5 HTTP transactions. The main IP is 207.55.240.17, located in United States and belongs to WEBINT, US. The main domain is www.posthouse.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on December 16th 2021. Valid for: a year.

This is the only time www.posthouse.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: American Express (Financial)

Domain & IP information

	IP Address	AS Autonomous System
1 1	185.107.232.127 185.107.232.127	200484 (SENDINBLU...) (SENDINBLUE-ASN)
1 1	54.83.52.76 54.83.52.76	14618 (AMAZON-AES) (AMAZON-AES)
5	207.55.240.17 207.55.240.17	11989 (WEBINT) (WEBINT)
5	1

1 185.107.232.127 (France) 1 redirects

ASN200484 (SENDINBLUE-ASN, FR)

eggiihe.r.af.d.sendibt2.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.83.52.76 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-83-52-76.compute-1.amazonaws.com

bit.do	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 207.55.240.17 (United States)

ASN11989 (WEBINT, US)
PTR: cp12.deluxehosting.com

www.posthouse.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	posthouse.com www.posthouse.com	390 KB
1	bit.do 1 redirects bit.do — Cisco Umbrella Rank: 259478	245 B
1	sendibt2.com 1 redirects eggiihe.r.af.d.sendibt2.com	145 B
5	3

	Domain	Requested by
5	www.posthouse.com	www.posthouse.com
1	bit.do	1 redirects
1	eggiihe.r.af.d.sendibt2.com	1 redirects
5	3

This site contains no links.

Subject Issuer	Validity	Valid
www.posthouse.com Sectigo RSA Domain Validation Secure Server CA	`2021-12-16` - `2022-12-16`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.posthouse.com/ghf/asbthy/dax/index.php
Frame ID: 2B0A400A71C3FDE452BA355AA42A1D54
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

American - Express

Page URL History Show full URLs

https://eggiihe.r.af.d.sendibt2.com/tr/cl/sDO7IigQMoLWaaG1LY3xKTMa8ohre0IPVZChz2ZEhxQES5JOjYwwzD5Z0pVlB0sri3T7BN... HTTP 302
http://bit.do/fT7NG HTTP 301
https://www.posthouse.com/ghf/asbthy/dax/index.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

5
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

1
IPs

2
Countries

390 kB
Transfer

389 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://eggiihe.r.af.d.sendibt2.com/tr/cl/sDO7IigQMoLWaaG1LY3xKTMa8ohre0IPVZChz2ZEhxQES5JOjYwwzD5Z0pVlB0sri3T7BN7hOUarkF4D2ORPu28CW1uc7FpGRZZjOXKS2WViiHf3ptYYALTCaU7b82xdEQjc7ozvLXrM4JwrnYWhR2BqTEuOrcTrbkusLVk6bJg3Xx2Bmi2zg-yvWCWkDjKS-2spElNIdVM8q5-ZstprtX324wPjcA HTTP 302
http://bit.do/fT7NG HTTP 301
https://www.posthouse.com/ghf/asbthy/dax/index.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request index.php Show response www.posthouse.com/ghf/asbthy/dax/ Redirect Chain https://eggiihe.r.af.d.sendibt2.com/tr/cl/sDO7IigQMoLWaaG1LY3xKTMa8ohre0IPVZChz2ZEhxQES5JOjYwwzD5Z0pVlB0sri3T7BN7hOUarkF4D2ORPu28CW1uc7FpGRZZjOXKS2WViiHf3ptYYALTCaU7b82xdEQjc7ozvLXrM4JwrnYWhR2BqTEu... http://bit.do/fT7NG https://www.posthouse.com/ghf/asbthy/dax/index.php	4 KB 4 KB	1781ms 280ms	Document text/html	207.55.240.17 WEBINT
General Check archive.org Show headers Download Go to Full URL https://www.posthouse.com/ghf/asbthy/dax/index.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 207.55.240.17 , United States, ASN11989 (WEBINT, US), Reverse DNS cp12.deluxehosting.com Software Apache / Resource Hash `838030bc84be7c393de26baaed75f698c13dd5b1a0d3a0cd877fa82f1a2941be` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 accept-language fr-FR,fr;q=0.9 Response headers Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Mon, 25 Apr 2022 15:25:35 GMT Keep-Alive timeout=5, max=100 Server Apache Transfer-Encoding chunked Redirect headers Connection keep-alive Content-Length 330 Content-Type text/html; charset=iso-8859-1 Date Mon, 25 Apr 2022 15:27:02 GMT Location https://www.posthouse.com/ghf/asbthy/dax/index.php Server nginx/1.18.0
GET H/1.1	200 OK	ad_logo.png www.posthouse.com/ghf/asbthy/dax/ayaworan/	290 KB 290 KB	106ms 104ms	Image image/png	207.55.240.17 WEBINT
General Check archive.org Show headers Download Go to Show image Full URL https://www.posthouse.com/ghf/asbthy/dax/ayaworan/ad_logo.png Requested by Host: www.posthouse.com URL: https://www.posthouse.com/ghf/asbthy/dax/index.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 207.55.240.17 , United States, ASN11989 (WEBINT, US), Reverse DNS cp12.deluxehosting.com Software Apache / Resource Hash `14a18807e373f73ec32feca972a4971ebefd3f4daf3bfa9b1c218d0f941e0133` Request headers accept-language fr-FR,fr;q=0.9 Referer https://www.posthouse.com/ghf/asbthy/dax/index.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers Date Mon, 25 Apr 2022 15:25:35 GMT Last-Modified Wed, 13 Apr 2022 11:42:00 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 296620
GET H/1.1	200 OK	forgot_pass.png www.posthouse.com/ghf/asbthy/dax/ayaworan/	9 KB 9 KB	313ms 104ms	Image image/png	207.55.240.17 WEBINT
General Check archive.org Show headers Download Go to Show image Full URL https://www.posthouse.com/ghf/asbthy/dax/ayaworan/forgot_pass.png Requested by Host: www.posthouse.com URL: https://www.posthouse.com/ghf/asbthy/dax/index.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 207.55.240.17 , United States, ASN11989 (WEBINT, US), Reverse DNS cp12.deluxehosting.com Software Apache / Resource Hash `297beaee50119c2bc43083aed52bfaa345474657ec156fe69465102c37e85bc9` Request headers accept-language fr-FR,fr;q=0.9 Referer https://www.posthouse.com/ghf/asbthy/dax/index.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers Date Mon, 25 Apr 2022 15:25:35 GMT Last-Modified Wed, 13 Apr 2022 11:42:00 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 9127
GET H/1.1	200 OK	header.png www.posthouse.com/ghf/asbthy/dax/ayaworan/	8 KB 8 KB	320ms 107ms	Image image/png	207.55.240.17 WEBINT
General Check archive.org Show headers Download Go to Show image Full URL https://www.posthouse.com/ghf/asbthy/dax/ayaworan/header.png Requested by Host: www.posthouse.com URL: https://www.posthouse.com/ghf/asbthy/dax/index.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 207.55.240.17 , United States, ASN11989 (WEBINT, US), Reverse DNS cp12.deluxehosting.com Software Apache / Resource Hash `327bc5b8fa69fc4a7b00953b567f367698c5408860aa8dfd03bae4af4e52ffaa` Request headers accept-language fr-FR,fr;q=0.9 Referer https://www.posthouse.com/ghf/asbthy/dax/index.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers Date Mon, 25 Apr 2022 15:25:35 GMT Last-Modified Wed, 13 Apr 2022 11:42:00 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 8169
GET H/1.1	200 OK	footer.png www.posthouse.com/ghf/asbthy/dax/ayaworan/	78 KB 78 KB	330ms 111ms	Image image/png	207.55.240.17 WEBINT
General Check archive.org Show headers Download Go to Show image Full URL https://www.posthouse.com/ghf/asbthy/dax/ayaworan/footer.png Requested by Host: www.posthouse.com URL: https://www.posthouse.com/ghf/asbthy/dax/index.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 207.55.240.17 , United States, ASN11989 (WEBINT, US), Reverse DNS cp12.deluxehosting.com Software Apache / Resource Hash `e362860c56043d3c7956139e8426c7055ff0d956c72284bb8ead51677a77ab28` Request headers accept-language fr-FR,fr;q=0.9 Referer https://www.posthouse.com/ghf/asbthy/dax/index.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers Date Mon, 25 Apr 2022 15:25:35 GMT Last-Modified Wed, 13 Apr 2022 11:42:00 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 79885

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: American Express (Financial)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone object| oncontextlost object| oncontextrestored function| getScreenDetails

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bit.do
eggiihe.r.af.d.sendibt2.com
www.posthouse.com
185.107.232.127
207.55.240.17
54.83.52.76
14a18807e373f73ec32feca972a4971ebefd3f4daf3bfa9b1c218d0f941e0133
297beaee50119c2bc43083aed52bfaa345474657ec156fe69465102c37e85bc9
327bc5b8fa69fc4a7b00953b567f367698c5408860aa8dfd03bae4af4e52ffaa
838030bc84be7c393de26baaed75f698c13dd5b1a0d3a0cd877fa82f1a2941be
e362860c56043d3c7956139e8426c7055ff0d956c72284bb8ead51677a77ab28

www.posthouse.com Open in urlscan Pro 207.55.240.17 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

5 Requests

100 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

1 IPs

2 Countries

390 kBTransfer

389 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

0 Cookies

Indicators

www.posthouse.com Open in urlscan Pro
207.55.240.17 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

1
IPs

2
Countries

390 kB
Transfer

389 kB
Size

0
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!