![](/screenshots/d71fe94c-3820-4e83-a0ff-fa8ec8259390.png)
indusrivervalley.org
Open in
urlscan Pro
2606:4700:3035::ac43:c792
Malicious Activity!
Public Scan
Effective URL: https://indusrivervalley.org/redirect/ar/
Submission: On January 28 via manual from IL — Scanned from NL
Summary
TLS certificate: Issued by GTS CA 1P5 on December 20th 2022. Valid for: 3 months.
This is the only time indusrivervalley.org was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Israel Post (Transporation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 2a06:98c1:312... 2a06:98c1:3121::3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
13 | 2606:4700:303... 2606:4700:3035::ac43:c792 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
14 | 2 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
13 |
indusrivervalley.org
indusrivervalley.org |
110 KB |
1 |
rotf.lol
1 redirects
rotf.lol — Cisco Umbrella Rank: 772406 |
634 B |
14 | 2 |
Domain | Requested by | |
---|---|---|
13 | indusrivervalley.org |
indusrivervalley.org
|
1 | rotf.lol | 1 redirects |
14 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.indusrivervalley.org GTS CA 1P5 |
2022-12-20 - 2023-03-20 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://indusrivervalley.org/redirect/ar/
Frame ID: 262799BD4423034F0C45A1FA832AA527
Requests: 14 HTTP requests in this frame
Screenshot
![](/screenshots/d71fe94c-3820-4e83-a0ff-fa8ec8259390.png)
Page Title
שירות הדואר הישראליPage URL History Show full URLs
-
https://rotf.lol/israelpos
HTTP 301
https://indusrivervalley.org/redirect/ar/ Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://rotf.lol/israelpos
HTTP 301
https://indusrivervalley.org/redirect/ar/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
indusrivervalley.org/redirect/ar/ Redirect Chain
|
4 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.css
indusrivervalley.org/redirect/ar/inc/ |
1 KB 857 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cora.png
indusrivervalley.org/redirect/ar/inc/ |
641 B 1003 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
post.png
indusrivervalley.org/redirect/ar/inc/ |
5 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
99.png
indusrivervalley.org/redirect/ar/inc/ |
5 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
t60.png
indusrivervalley.org/redirect/ar/inc/ |
57 KB 58 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jq.js
indusrivervalley.org/redirect/ar/inc// |
87 KB 32 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
m.js
indusrivervalley.org/redirect/ar/inc// |
11 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
h.ttf
indusrivervalley.org/redirect/ar/inc/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
spy.php
indusrivervalley.org/redirect/ar/ |
0 479 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
date.php
indusrivervalley.org/redirect/ar/ |
21 B 465 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
date.php
indusrivervalley.org/redirect/ar/ |
21 B 465 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
date.php
indusrivervalley.org/redirect/ar/ |
21 B 469 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST |
date.php
indusrivervalley.org/redirect/ar/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- indusrivervalley.org
- URL
- https://indusrivervalley.org/redirect/ar/date.php
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Israel Post (Transporation)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontentvisibilityautostatechange function| $ function| jQuery number| c0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
indusrivervalley.org
rotf.lol
indusrivervalley.org
2606:4700:3035::ac43:c792
2a06:98c1:3121::3
03aec4465760e67eaa777a96bc2f27822d8e7526c6692b39fde02316dc5a9173
072eb05095eeede132910b564b573b1dd4c53478ea8c44cf2a9d39be56886794
32cb3c5c141802399b8c1d60bca37c971ab660f1bb22e32e7084bd4778a0a0b0
6dbd37899c2653b6e7ce1f32ecfd72854cf26b235e7f82e83c80397e7390791d
72037311a4dfde4d042df73e31b7cbeafc0bdf2aaa605b69aff3326015a396da
7cff082fe3676f7e02428c7d1b72b5daf671c05eb60e4e53ddd10267080111f0
7fbd5eb92e6146753c21a5b43617adbd64c49a328d92d16b149844287e3385e7
897666212b1a6002d15bc6e18bfe26932a605dbc1521c797da5356e728b5da81
9035ff7b7eaf5e77341f28d85dca60891260ef8e531e07f40cb9c1acab00efbb
ad79673c9e4d4b18c65b4f1db5404f41941deb982ea8cb37d5753a8d82307c2f
bd80bbe4f601eb38a50867880a0460a940f08acbdbadfc22c38873be8be58ed6
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855