servicearamex-b58da5.ingress-daribow.ewp.live Open in urlscan Pro
63.250.43.13 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.portal.cnprsv.ro/condition/
Effective URL:
https://servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/
Submission: On July 18 via manual (July 18th 2022, 9:07:50 am UTC) from GB — Scanned from GB

Summary HTTP 23 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 5 IPs in 3 countries across 5 domains to perform 23 HTTP transactions. The main IP is 63.250.43.13, located in United States and belongs to NAMECHEAP-NET, US. The main domain is servicearamex-b58da5.ingress-daribow.ewp.live.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on May 24th 2022. Valid for: a year.

This is the only time servicearamex-b58da5.ingress-daribow.ewp.live was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Transportation (Transportation) Generic Tracking (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
1	82.77.13.4 82.77.13.4	8708 (RCS-RDS 7...) (RCS-RDS 73-75 Dr. Staicovici)
14	63.250.43.13 63.250.43.13	22612 (NAMECHEAP...) (NAMECHEAP-NET)
1	2a00:1450:400... 2a00:1450:4001:82f::200a	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:827::2003	15169 (GOOGLE) (GOOGLE)
23	5

1 82.77.13.4 (Suceava, Romania)

ASN8708 (RCS-RDS 73-75 Dr. Staicovici, RO)
PTR: pc04.cnpr.suceava.rdsnet.ro

www.portal.cnprsv.ro	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 63.250.43.13 (United States)

ASN22612 (NAMECHEAP-NET, US)
PTR: ingress-daribow.easywp.com

servicearamex-b58da5.ingress-daribow.ewp.live	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82f::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:827::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	ewp.live servicearamex-b58da5.ingress-daribow.ewp.live	572 KB
2	gstatic.com fonts.gstatic.com	91 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 81	1011 B
1	cnprsv.ro www.portal.cnprsv.ro	651 B
0	Failed function sub() { [native code] }. Failed
23	5

	Domain	Requested by
14	servicearamex-b58da5.ingress-daribow.ewp.live	servicearamex-b58da5.ingress-daribow.ewp.live
2	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	servicearamex-b58da5.ingress-daribow.ewp.live
1	www.portal.cnprsv.ro
0	Failed	servicearamex-b58da5.ingress-daribow.ewp.live
23	5

This site contains links to these domains. Also see Links.

Domain
online.citypaq.es

Subject Issuer	Validity	Valid
cnprsv.ro R3	`2022-07-13` - `2022-10-11`	3 months	crt.sh
*.ingress-daribow.ewp.live Sectigo RSA Domain Validation Secure Server CA	`2022-05-24` - `2023-05-24`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2022-06-27` - `2022-09-19`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2022-06-27` - `2022-09-19`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/
Frame ID: CAB43734B17AED4FAA9E93DDA653CFBC
Requests: 24 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Billing Informationsmails.es

Page URL History Show full URLs

https://www.portal.cnprsv.ro/condition/ Page URL
https://servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/ Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

23
Requests

78 %
HTTPS

50 %
IPv6

5
Domains

5
Subdomains

5
IPs

3
Countries

665 kB
Transfer

901 kB
Size

1
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://online.citypaq.es/pages/registro.xhtml
Title: Go to CityPaq

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.portal.cnprsv.ro/condition/ Page URL
https://servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

23 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK / Show response
www.portal.cnprsv.ro/condition/ 480 B
651 B 929ms
73ms Document
text/html 82.77.13.4
RCS-RDS 73-75 Dr....

General

Check archive.org

Show headers Download Go to

Full URL: https://www.portal.cnprsv.ro/condition/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 82.77.13.4 Suceava, Romania, ASN8708 (RCS-RDS 73-75 Dr. Staicovici, RO),
Reverse DNS: pc04.cnpr.suceava.rdsnet.ro
Software: Apache/2.4.51 (Debian) /
Resource Hash: 2ce7aafed3d8fa1c9c329bbee1fdb8fe04d480498727d2918ccd22eae3151f91

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate
Connection: Keep-Alive
Content-Encoding: gzip
Content-Length: 231
Content-Type: text/html; charset=UTF-8
Date: Mon, 18 Jul 2022 09:07:46 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive: timeout=5, max=100
Pragma: no-cache
Server: Apache/2.4.51 (Debian)
Vary: Accept-Encoding

GET
H2 200 Primary Request / Show response
servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/ 44 KB
13 KB 734ms
359ms Document
text/html 63.250.43.13
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.250.43.13 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

ingress-daribow.easywp.com

Software

nginx /

Resource Hash

86a09294850c987c842caf8f7fa6516a2debd7b4ab91d63b3b4e8646ab645dd8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.portal.cnprsv.ro/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

accept-ranges: bytes
age: 13359
cache-control: no-store, no-cache, must-revalidate, public
content-encoding: gzip
content-length: 12423
content-type: text/html; charset=UTF-8
date: Mon, 18 Jul 2022 05:25:07 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
server: nginx
strict-transport-security: max-age=15768000
vary: Accept-Encoding
x-cache: HIT
x-cacheable: YES
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block

GET
H2 200 bootstrap.min.css
servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/index_files/ 137 KB
21 KB 184ms
182ms Stylesheet
text/css 63.250.43.13
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/index_files/bootstrap.min.css

Requested by

Host: servicearamex-b58da5.ingress-daribow.ewp.live
URL: https://servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.250.43.13 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

ingress-daribow.easywp.com

Software

nginx /

Resource Hash

34959e43e6ecf368807a84f92ad9aa6e2dcd5f0c5c1e57da55e8f3248d9d9255

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 18 Jul 2022 05:25:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-cacheable: YES
age: 13359
x-cache: HIT
vary: Accept-Encoding
content-length: 21024
x-xss-protection: 1; mode=block
last-modified: Sun, 17 Jul 2022 13:00:21 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: W/"62d407e5-22485"
strict-transport-security: max-age=15768000
access-control-allow-methods: GET, POST, OPTIONS, DELETE, PUT
content-type: text/css
cache-control: max-age=315360000
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: User-Agent,Keep-Alive,Content-Type
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 validationEngine.jquery.css
servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/index_files/ 3 KB
1 KB 363ms
361ms Stylesheet
text/css 63.250.43.13
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/index_files/validationEngine.jquery.css

Requested by

Host: servicearamex-b58da5.ingress-daribow.ewp.live
URL: https://servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.250.43.13 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

ingress-daribow.easywp.com

Software

nginx /

Resource Hash

cd363d0f8425d6b271c14ee5d6a8d693c3aa1323b64979b69c69d26661927303

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 18 Jul 2022 05:25:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-cacheable: YES
age: 13359
x-cache: HIT
vary: Accept-Encoding
content-length: 781
x-xss-protection: 1; mode=block
last-modified: Sun, 17 Jul 2022 13:00:21 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: W/"62d407e5-d06"
strict-transport-security: max-age=15768000
access-control-allow-methods: GET, POST, OPTIONS, DELETE, PUT
content-type: text/css
cache-control: max-age=315360000
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: User-Agent,Keep-Alive,Content-Type
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 flaticon.css
servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/index_files/ 1 KB
969 B 362ms
361ms Stylesheet
text/css 63.250.43.13
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/index_files/flaticon.css

Requested by

Host: servicearamex-b58da5.ingress-daribow.ewp.live
URL: https://servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.250.43.13 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

ingress-daribow.easywp.com

Software

nginx /

Resource Hash

2650ffdcb2bf4147d062825fee353bd86e80c1f1c22c0b29ea856fdd3213e0a3

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 18 Jul 2022 05:25:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-cacheable: YES
age: 13358
x-cache: HIT
vary: Accept-Encoding
content-length: 446
x-xss-protection: 1; mode=block
last-modified: Sun, 17 Jul 2022 13:00:21 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: W/"62d407e5-4ba"
strict-transport-security: max-age=15768000
access-control-allow-methods: GET, POST, OPTIONS, DELETE, PUT
content-type: text/css
cache-control: max-age=315360000
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: User-Agent,Keep-Alive,Content-Type
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 fontawesome-all.min.css
servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/index_files/ 36 KB
8 KB 363ms
362ms Stylesheet
text/css 63.250.43.13
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/index_files/fontawesome-all.min.css

Requested by

Host: servicearamex-b58da5.ingress-daribow.ewp.live
URL: https://servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.250.43.13 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

ingress-daribow.easywp.com

Software

nginx /

Resource Hash

cfac6241dd3aabb5f1552c17501790093015c006a8e13671823c1ff4872beaae

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 18 Jul 2022 05:25:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-cacheable: YES
age: 13358
x-cache: HIT
vary: Accept-Encoding
content-length: 8083
x-xss-protection: 1; mode=block
last-modified: Sun, 17 Jul 2022 13:00:21 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: W/"62d407e5-8ef7"
strict-transport-security: max-age=15768000
access-control-allow-methods: GET, POST, OPTIONS, DELETE, PUT
content-type: text/css
cache-control: max-age=315360000
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: User-Agent,Keep-Alive,Content-Type
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 new-style-common-screen.css
servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/index_files/ 71 KB
10 KB 361ms
360ms Stylesheet
text/css 63.250.43.13
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/index_files/new-style-common-screen.css

Requested by

Host: servicearamex-b58da5.ingress-daribow.ewp.live
URL: https://servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.250.43.13 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

ingress-daribow.easywp.com

Software

nginx /

Resource Hash

310385735191aa33955b493511353e089078222ea94ff2dc3ad34e51ae601695

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 18 Jul 2022 05:25:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-cacheable: YES
age: 13358
x-cache: HIT
vary: Accept-Encoding
content-length: 9476
x-xss-protection: 1; mode=block
last-modified: Sun, 17 Jul 2022 13:00:21 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: W/"62d407e5-11b70"
strict-transport-security: max-age=15768000
access-control-allow-methods: GET, POST, OPTIONS, DELETE, PUT
content-type: text/css
cache-control: max-age=315360000
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: User-Agent,Keep-Alive,Content-Type
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 common-dynamic.css
servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/index_files/ 2 KB
1 KB 360ms
359ms Stylesheet
text/css 63.250.43.13
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/index_files/common-dynamic.css

Requested by

Host: servicearamex-b58da5.ingress-daribow.ewp.live
URL: https://servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.250.43.13 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

ingress-daribow.easywp.com

Software

nginx /

Resource Hash

03d7d7a9bd36cfc6aa3142289fb02145ec39d2998b18430dc7c141d7b3490d51

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 18 Jul 2022 05:25:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-cacheable: YES
age: 13358
x-cache: HIT
vary: Accept-Encoding
content-length: 637
x-xss-protection: 1; mode=block
last-modified: Sun, 17 Jul 2022 13:00:21 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: W/"62d407e5-7c8"
strict-transport-security: max-age=15768000
access-control-allow-methods: GET, POST, OPTIONS, DELETE, PUT
content-type: text/css
cache-control: max-age=315360000
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: User-Agent,Keep-Alive,Content-Type
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 logo.png
servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/index_files/ 11 KB
12 KB 351ms
350ms Image
image/png 63.250.43.13
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/index_files/logo.png

Requested by

Host: servicearamex-b58da5.ingress-daribow.ewp.live
URL: https://servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.250.43.13 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

ingress-daribow.easywp.com

Software

nginx /

Resource Hash

4fe6de808059296b630c6989e9c147d0dde1d1a7bbd4f2f536ea47b67dd47310

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 18 Jul 2022 05:25:09 GMT
x-content-type-options: nosniff
x-cacheable: YES
age: 13358
x-cache: HIT
content-length: 11664
x-xss-protection: 1; mode=block
last-modified: Sun, 17 Jul 2022 13:00:21 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: "62d407e5-2d90"
strict-transport-security: max-age=15768000
access-control-allow-methods: GET, POST, OPTIONS, DELETE, PUT
content-type: image/png
cache-control: max-age=315360000
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: User-Agent,Keep-Alive,Content-Type
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 tmc-card-icon.png
servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/index_files/ 354 KB
355 KB 533ms
531ms Image
image/png 63.250.43.13
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/index_files/tmc-card-icon.png

Requested by

Host: servicearamex-b58da5.ingress-daribow.ewp.live
URL: https://servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.250.43.13 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

ingress-daribow.easywp.com

Software

nginx /

Resource Hash

7745090d135d94c6511c29ab794d731fa628dcf73682ee0c4f23b89ebe5f8415

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 18 Jul 2022 05:25:09 GMT
x-content-type-options: nosniff
x-cacheable: YES
age: 13357
x-cache: HIT
content-length: 363005
x-xss-protection: 1; mode=block
last-modified: Sun, 17 Jul 2022 13:00:21 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: "62d407e5-589fd"
strict-transport-security: max-age=15768000
access-control-allow-methods: GET, POST, OPTIONS, DELETE, PUT
content-type: image/png
cache-control: max-age=315360000
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: User-Agent,Keep-Alive,Content-Type
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 correos-paq-72-mini.png
servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/index_files/ 2 KB
3 KB 532ms
531ms Image
image/png 63.250.43.13
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/index_files/correos-paq-72-mini.png

Requested by

Host: servicearamex-b58da5.ingress-daribow.ewp.live
URL: https://servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.250.43.13 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

ingress-daribow.easywp.com

Software

nginx /

Resource Hash

984461e2d55896f29bb79d75b8ab42c1f8c4111bd2fb0c5f03dbc50d1b24b894

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 18 Jul 2022 05:25:10 GMT
x-content-type-options: nosniff
x-cacheable: YES
age: 13356
x-cache: HIT
content-length: 2373
x-xss-protection: 1; mode=block
last-modified: Sun, 17 Jul 2022 13:00:21 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: "62d407e5-945"
strict-transport-security: max-age=15768000
access-control-allow-methods: GET, POST, OPTIONS, DELETE, PUT
content-type: image/png
cache-control: max-age=315360000
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: User-Agent,Keep-Alive,Content-Type
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 correos-paq72.png
servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/index_files/ 2 KB
2 KB 884ms
883ms Image
image/png 63.250.43.13
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/index_files/correos-paq72.png

Requested by

Host: servicearamex-b58da5.ingress-daribow.ewp.live
URL: https://servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.250.43.13 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

ingress-daribow.easywp.com

Software

nginx /

Resource Hash

5d2fb215dbbcbfd1bd663a0cdeaf31c63abde8c6f20aa63551733ebc498bf605

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 18 Jul 2022 05:25:11 GMT
x-content-type-options: nosniff
x-cacheable: YES
age: 13356
x-cache: HIT
content-length: 1976
x-xss-protection: 1; mode=block
last-modified: Sun, 17 Jul 2022 13:00:21 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: "62d407e5-7b8"
strict-transport-security: max-age=15768000
access-control-allow-methods: GET, POST, OPTIONS, DELETE, PUT
content-type: image/png
cache-control: max-age=315360000
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: User-Agent,Keep-Alive,Content-Type
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 48-480088_payment-method-credit-card-master-card-hd-png-remo.png
servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/index_files/ 59 KB
60 KB 885ms
884ms Image
image/png 63.250.43.13
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/index_files/48-480088_payment-method-credit-card-master-card-hd-png-remo.png

Requested by

Host: servicearamex-b58da5.ingress-daribow.ewp.live
URL: https://servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.250.43.13 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

ingress-daribow.easywp.com

Software

nginx /

Resource Hash

b56162edbd3395fd1655cd195d9c1518eec57a604074cd6c9dbc911c939ce7d3

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 18 Jul 2022 05:25:10 GMT
x-content-type-options: nosniff
x-cacheable: YES
age: 13357
x-cache: HIT
content-length: 60817
x-xss-protection: 1; mode=block
last-modified: Sun, 17 Jul 2022 13:00:21 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: "62d407e5-ed91"
strict-transport-security: max-age=15768000
access-control-allow-methods: GET, POST, OPTIONS, DELETE, PUT
content-type: image/png
cache-control: max-age=315360000
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: User-Agent,Keep-Alive,Content-Type
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 404 stopExecutionOnTimeout-157cd5b220a5c80d4ff8e0e70ac069bffd87a61252088146915e8726e5d9f147.js.t%C3%A9l%C3%A9chargement
servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/index_files/ 0
0 899ms
897ms Script
text/html 63.250.43.13
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/index_files/stopExecutionOnTimeout-157cd5b220a5c80d4ff8e0e70ac069bffd87a61252088146915e8726e5d9f147.js.t%C3%A9l%C3%A9chargement

Requested by

Host: servicearamex-b58da5.ingress-daribow.ewp.live
URL: https://servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.250.43.13 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

ingress-daribow.easywp.com

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 18 Jul 2022 09:07:47 GMT
content-encoding: gzip
server: nginx
age: 0
vary: Accept-Encoding
x-cache: MISS
content-type: text/html; charset=UTF-8
cache-control: no-cache, must-revalidate, max-age=0
strict-transport-security: max-age=15768000
link: <https://servicearamex-b58da5.ingress-daribow.ewp.live/wp-json/>; rel="https://api.w.org/"
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H2 200 jquery.min.js.t%C3%A9l%C3%A9chargement Show response
servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/index_files/ 84 KB
85 KB 350ms
349ms Script
application/octet-stream 63.250.43.13
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/index_files/jquery.min.js.t%C3%A9l%C3%A9chargement

Requested by

Host: servicearamex-b58da5.ingress-daribow.ewp.live
URL: https://servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.250.43.13 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

ingress-daribow.easywp.com

Software

nginx /

Resource Hash

702b9e051e82b32038ffdb33a4f7eb5f7b38f4cf6f514e4182d8898f4eb0b7fb

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 18 Jul 2022 05:25:08 GMT
x-content-type-options: nosniff
x-cacheable: YES
age: 13358
x-cache: HIT
content-length: 86351
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Sun, 17 Jul 2022 13:00:21 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: "62d407e5-1514f"
strict-transport-security: max-age=15768000
content-type: application/octet-stream
cache-control: public
accept-ranges: bytes

GET
H2 200 css
fonts.googleapis.com/ 2 KB
1011 B 147ms
54ms Stylesheet
text/css 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=PT+Sans:400,700

Requested by

Host: servicearamex-b58da5.ingress-daribow.ewp.live
URL: https://servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/index_files/new-style-common-screen.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e2464f998b38ae5f4a6f68dd19faea6939ccb6db5388ce17a0621c3fe186f859

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://servicearamex-b58da5.ingress-daribow.ewp.live/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 18 Jul 2022 08:32:46 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 18 Jul 2022 09:07:47 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 18 Jul 2022 09:07:47 GMT

GET index.html
/C:/Users/ideapad/Desktop/PostaOffice/ 0
0

GET
DATA 200
OK truncated
/ 549 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e298029630a2994690144a756709a06f8b3ed902440096ac7aec5b4cea285014

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 jizfRExUiTo99u79B_mh0O6tLQ.woff2
fonts.gstatic.com/s/ptsans/v17/ 46 KB
47 KB 149ms
42ms Font
font/woff2 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/ptsans/v17/jizfRExUiTo99u79B_mh0O6tLQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=PT+Sans:400,700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

141f0c53e457585d4ac7426eb3d757666d250ee6fbf0e9c0878128e4c627f0b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://servicearamex-b58da5.ingress-daribow.ewp.live
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Wed, 13 Jul 2022 19:26:54 GMT
x-content-type-options: nosniff
age: 394853
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47048
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:55:54 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 13 Jul 2023 19:26:54 GMT

GET
H2 200 jizaRExUiTo99u79D0KExQ.woff2
fonts.gstatic.com/s/ptsans/v17/ 44 KB
44 KB 233ms
126ms Font
font/woff2 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/ptsans/v17/jizaRExUiTo99u79D0KExQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=PT+Sans:400,700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e13ffa988be59cbf299d7ff68f019f902b60848203ac4990819eb7e4624ee52d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://servicearamex-b58da5.ingress-daribow.ewp.live
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Wed, 13 Jul 2022 19:26:32 GMT
x-content-type-options: nosniff
age: 394875
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 45300
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:11:08 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 13 Jul 2023 19:26:32 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
URL: file:///C:/Users/ideapad/Desktop/PostaOffice/index.html

Domain
URL: file:///C:/Users/ideapad/Desktop/PostaOffice/index.html

Domain
URL: file:///C:/Users/ideapad/Desktop/PostaOffice/index.html

Domain
URL: file:///C:/Users/ideapad/Desktop/PostaOffice/index.html

Domain
URL: file:///C:/Users/ideapad/Desktop/PostaOffice/index.html

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Transportation (Transportation) Generic Tracking (Transportation)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.portal.cnprsv.ro/	1969-12-31 23:59:59	Name: PHPSESSID Value: hlbpehjud6451vld9nabmbh5ke

7 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	error	URL: https://servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/(Line 288) Message: Not allowed to load local resource: file:///C:/Users/ideapad/Desktop/PostaOffice/index.html
javascript	error	URL: https://servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/(Line 288) Message: Not allowed to load local resource: file:///C:/Users/ideapad/Desktop/PostaOffice/index.html
javascript	error	URL: https://servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/(Line 288) Message: Not allowed to load local resource: file:///C:/Users/ideapad/Desktop/PostaOffice/index.html
javascript	error	URL: https://servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/(Line 288) Message: Not allowed to load local resource: file:///C:/Users/ideapad/Desktop/PostaOffice/index.html
javascript	error	URL: https://servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/(Line 288) Message: Not allowed to load local resource: file:///C:/Users/ideapad/Desktop/PostaOffice/index.html
network	error	URL: https://servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/index_files/stopExecutionOnTimeout-157cd5b220a5c80d4ff8e0e70ac069bffd87a61252088146915e8726e5d9f147.js.t%C3%A9l%C3%A9chargement Message: Failed to load resource: the server responded with a status of 404 ()
security	error	URL: https://servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/ Message: Refused to execute script from 'https://servicearamex-b58da5.ingress-daribow.ewp.live/PostOffice/index_files/jquery.min.js.t%C3%A9l%C3%A9chargement' because its MIME type ('application/octet-stream') is not executable, and strict MIME type checking is enabled.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.


fonts.googleapis.com
fonts.gstatic.com
servicearamex-b58da5.ingress-daribow.ewp.live
www.portal.cnprsv.ro

2a00:1450:4001:827::2003
2a00:1450:4001:82f::200a
63.250.43.13
82.77.13.4
03d7d7a9bd36cfc6aa3142289fb02145ec39d2998b18430dc7c141d7b3490d51
141f0c53e457585d4ac7426eb3d757666d250ee6fbf0e9c0878128e4c627f0b1
2650ffdcb2bf4147d062825fee353bd86e80c1f1c22c0b29ea856fdd3213e0a3
2ce7aafed3d8fa1c9c329bbee1fdb8fe04d480498727d2918ccd22eae3151f91
310385735191aa33955b493511353e089078222ea94ff2dc3ad34e51ae601695
34959e43e6ecf368807a84f92ad9aa6e2dcd5f0c5c1e57da55e8f3248d9d9255
4fe6de808059296b630c6989e9c147d0dde1d1a7bbd4f2f536ea47b67dd47310
5d2fb215dbbcbfd1bd663a0cdeaf31c63abde8c6f20aa63551733ebc498bf605
702b9e051e82b32038ffdb33a4f7eb5f7b38f4cf6f514e4182d8898f4eb0b7fb
7745090d135d94c6511c29ab794d731fa628dcf73682ee0c4f23b89ebe5f8415
86a09294850c987c842caf8f7fa6516a2debd7b4ab91d63b3b4e8646ab645dd8
984461e2d55896f29bb79d75b8ab42c1f8c4111bd2fb0c5f03dbc50d1b24b894
b56162edbd3395fd1655cd195d9c1518eec57a604074cd6c9dbc911c939ce7d3
cd363d0f8425d6b271c14ee5d6a8d693c3aa1323b64979b69c69d26661927303
cfac6241dd3aabb5f1552c17501790093015c006a8e13671823c1ff4872beaae
e13ffa988be59cbf299d7ff68f019f902b60848203ac4990819eb7e4624ee52d
e2464f998b38ae5f4a6f68dd19faea6939ccb6db5388ce17a0621c3fe186f859
e298029630a2994690144a756709a06f8b3ed902440096ac7aec5b4cea285014

servicearamex-b58da5.ingress-daribow.ewp.live Open in urlscan Pro 63.250.43.13 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

23 Requests

78 %HTTPS

50 %IPv6

5 Domains

5 Subdomains

5 IPs

3 Countries

665 kBTransfer

901 kBSize

1 Cookies

1 Outgoing links

Page URL History

Redirected requests

23 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

8 JavaScript Global Variables

1 Cookies

7 Console Messages

Indicators

servicearamex-b58da5.ingress-daribow.ewp.live Open in urlscan Pro
63.250.43.13 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

23
Requests

78 %
HTTPS

50 %
IPv6

5
Domains

5
Subdomains

5
IPs

3
Countries

665 kB
Transfer

901 kB
Size

1
Cookies

23 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!