www.entrega-ctt.net Open in urlscan Pro
153.92.7.29  Malicious Activity! Public Scan

Submitted URL: https://www.entrega-ctt.net/
Effective URL: https://www.entrega-ctt.net/entrega.php
Submission: On November 24 via automatic, source certstream-suspicious — Scanned from GB

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 1 HTTP transactions. The main IP is 153.92.7.29, located in Manchester, United Kingdom and belongs to AS-HOSTINGER, CY. The main domain is www.entrega-ctt.net.
TLS certificate: Issued by R3 on November 24th 2022. Valid for: 3 months.
This is the only time www.entrega-ctt.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: CTT Correios (Transportation)

Domain & IP information

IP Address AS Autonomous System
1 2 153.92.7.29 47583 (AS-HOSTINGER)
1 2
Apex Domain
Subdomains
Transfer
2 entrega-ctt.net
www.entrega-ctt.net
314 KB
1 1
Domain Requested by
2 www.entrega-ctt.net 1 redirects
1 1
Subject Issuer Validity Valid
entrega-ctt.net
R3
2022-11-24 -
2023-02-22
3 months crt.sh

This page contains 1 frames:

Primary Page: https://www.entrega-ctt.net/entrega.php
Frame ID: 07E3AB653441E76A5D567E8F21D6E799
Requests: 11 HTTP requests in this frame

Screenshot

Page Title

Seguir ou Alterar uma Entrega

Page URL History Show full URLs

  1. https://www.entrega-ctt.net/ HTTP 302
    https://www.entrega-ctt.net/entrega.php Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

1
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

364 kB
Transfer

981 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://www.entrega-ctt.net/ HTTP 302
    https://www.entrega-ctt.net/entrega.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

1 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request entrega.php
www.entrega-ctt.net/
Redirect Chain
  • https://www.entrega-ctt.net/
  • https://www.entrega-ctt.net/entrega.php
788 KB
313 KB
Document
General
Full URL
https://www.entrega-ctt.net/entrega.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
153.92.7.29 Manchester, United Kingdom, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
Software
LiteSpeed / PHP/8.0.24
Resource Hash
39e5767df71bbc95c16f91054f7c7dc5cd5e4487aa70a5257b1cc07a491ff80a
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
accept-language
en-GB,en;q=0.9

Response headers

content-encoding
br
content-security-policy
upgrade-insecure-requests
content-type
text/html; charset=UTF-8
date
Thu, 24 Nov 2022 18:48:25 GMT
platform
hostinger
server
LiteSpeed
vary
Accept-Encoding
x-powered-by
PHP/8.0.24

Redirect headers

alt-svc
h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
cache-control
no-cache, no-store, must-revalidate, max-age=0
content-length
0
content-security-policy
upgrade-insecure-requests
content-type
text/html; charset=UTF-8
date
Thu, 24 Nov 2022 18:48:25 GMT
location
entrega.php
platform
hostinger
server
LiteSpeed
x-powered-by
PHP/8.0.24
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
67ec4ea68ba0cc7cb0f26d847e96bccc2676724650e72b25c3874a0c40cf6b53

Request headers

accept-language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
19 KB
19 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
369602c7e55e19dbb5974b9f3dfb1efe8ba1f0e0822142f5790ee7be8c02a679

Request headers

Referer
Origin
https://www.entrega-ctt.net
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Type
application/font-woff2
truncated
/
13 KB
13 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
34e6f307095b702538364e9c209e86feed6955efad05f934175d9add79805365

Request headers

Referer
Origin
https://www.entrega-ctt.net
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Type
application/font-woff;charset=utf-8
truncated
/
19 KB
19 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6c219f0268f9f338fc7341899f441e030e8c60a273fc211d9d9f7aae12611fe3

Request headers

Referer
Origin
https://www.entrega-ctt.net
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Type
application/font-woff2
truncated
/
97 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
8bad8fd2a4b3495222a720a7b10895e73ea65e54f07650adce1dea8d9d52583f

Request headers

accept-language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/
11 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
638641ec9bd444a3ffc4210baad72dead79e04418f4f999950bee69a47fc9195

Request headers

accept-language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
667 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
fdcbeb3f378b7fcb53d3e3280310b503f70d16e92d90243a0b3aa1777e2548dd

Request headers

accept-language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
6 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f5a7604bc07b20cae669ab7f41e39e8354bcfbc48e75eb77c2f997118dcdca65

Request headers

accept-language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Type
image/png
truncated
/
12 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
774eabab992a3072207832d1ff128e09ba5fb1afa4631818b4a13cc10fc4a09c

Request headers

accept-language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
14 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
736ac33abf13738dd07c53648893598197c50dca1fb435cdf3815834825cc5e8

Request headers

accept-language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Type
image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: CTT Correios (Transportation)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| savepage_ShadowLoader

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy upgrade-insecure-requests