xn--custom-txs-z4a1h.click Open in urlscan Pro Puny
custom-táxés.click IDN
104.21.42.26 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://xn--custom-txs-z4a1h.click/
Effective URL:
https://xn--custom-txs-z4a1h.click/
Submission Tags: @ecarlesi threat #phishing #postvox Search All
Submission: On October 27 via api (October 27th 2023, 2:32:40 am UTC) from AU — Scanned from AU

Summary HTTP 14 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 1 domains to perform 14 HTTP transactions. The main IP is 104.21.42.26, located in and belongs to CLOUDFLARENET, US. The main domain is xn--custom-txs-z4a1h.click.
TLS certificate: Issued by E1 on October 26th 2023. Valid for: 3 months.

This is the only time xn--custom-txs-z4a1h.click was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: An Post (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
1 1	172.67.199.66 172.67.199.66	13335 (CLOUDFLAR...) (CLOUDFLARENET)
14	104.21.42.26 104.21.42.26	13335 (CLOUDFLAR...) (CLOUDFLARENET)
14	2

1 172.67.199.66 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

xn--custom-txs-z4a1h.click	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 104.21.42.26 (None, )

ASN13335 (CLOUDFLARENET, US)

xn--custom-txs-z4a1h.click	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
15	xn--custom-txs-z4a1h.click 1 redirects xn--custom-txs-z4a1h.click	2 MB
14	1

	Domain	Requested by
15	xn--custom-txs-z4a1h.click	1 redirects xn--custom-txs-z4a1h.click
14	1

This site contains no links.

Subject Issuer	Validity	Valid
xn--custom-txs-z4a1h.click E1	`2023-10-26` - `2024-01-24`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://xn--custom-txs-z4a1h.click/
Frame ID: CF2D4FB6AE291FA307CEA5F67D65CB01
Requests: 21 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Track your post and parcels | Personal | An Post

Page URL History Show full URLs

http://xn--custom-txs-z4a1h.click/ HTTP 301
https://xn--custom-txs-z4a1h.click/ Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

14
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

2
Countries

2274 kB
Transfer

5613 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://xn--custom-txs-z4a1h.click/ HTTP 301
https://xn--custom-txs-z4a1h.click/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions
7 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response xn--custom-txs-z4a1h.click/ Redirect Chain http://xn--custom-txs-z4a1h.click/ https://xn--custom-txs-z4a1h.click/	56 KB 8 KB	865ms 675ms	Document text/html	104.21.42.26 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://xn--custom-txs-z4a1h.click/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.21.42.26 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `ea6e4eeb0657eaa022da14c547528b40a17e2f84b534fb6790e12c53df57e019` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 accept-language en-AU,en;q=0.9 Response headers alt-svc h3=":443"; ma=86400 cache-control no-store, no-cache, must-revalidate cf-cache-status DYNAMIC cf-ray 81c7876c884c3056-MEL content-encoding br content-type text/html; charset=UTF-8 date Fri, 27 Oct 2023 02:32:32 GMT expires Thu, 19 Nov 1981 08:52:00 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} pragma no-cache report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rhh9xcAKSvLQWDWsQvD%2FywZNGjJeSE%2BB7d3peHsfw6DfnS5%2F9k3fj5OnuVDBZEOi52ur7QlI3sLySLWWhJit%2Bo7OfEnMG8b4yox98akVwWVDtOxs1RcgcHbwV8mx9DzEHMLxxM1HBg1AeGagOw%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding Redirect headers CF-RAY 81c7876ab85a2ee8-MEL Cache-Control max-age=3600 Connection keep-alive Date Fri, 27 Oct 2023 02:32:31 GMT Expires Fri, 27 Oct 2023 03:32:31 GMT Location https://xn--custom-txs-z4a1h.click/ NEL {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Report-To {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WhqxOnY9mjHFLoT%2FD8JEtxD20L5HhB0JHGYd3VBtoUIliquwMbYV4m%2Ff%2B6JbEZrwe3NKavxi8Efsr%2FGGuS9gjyLfZg1PMne%2BsAlAUBgqAa7wvk3VLY0ugDTQAzXTeOV1YgG7kIzkCDA3aIDxPA%3D%3D"}],"group":"cf-nel","max_age":604800} Server cloudflare Transfer-Encoding chunked Vary Accept-Encoding alt-svc h3=":443"; ma=86400
GET H2	200	core.min.css xn--custom-txs-z4a1h.click/assets/	5 MB 2 MB	1531ms 1529ms	Stylesheet text/css	104.21.42.26 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://xn--custom-txs-z4a1h.click/assets/core.min.css Requested by Host: xn--custom-txs-z4a1h.click URL: https://xn--custom-txs-z4a1h.click/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.21.42.26 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `5acb69db0d8275e5fa0a5000bdd413529779277177bcdf90af13a09632f59eb7` Request headers accept-language en-AU,en;q=0.9 Referer https://xn--custom-txs-z4a1h.click/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 Response headers date Fri, 27 Oct 2023 02:32:33 GMT content-encoding br cf-cache-status MISS last-modified Sat, 08 Jul 2023 13:26:28 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"4f332f-5fff9b25e0900-gzip" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FG9%2BAok%2BoVcMyY5jgwYgiXyjfumbLK4Vw7gJK%2FT7oF5zhHsPGkJQcoK3QgfFKlbC0Z1vCqpCA1ZJNCwwY7vaA0wVmQjhz%2Fd1iRq8DWSeE6OJnQg%2FfGv8MxSua63XHMqaKA9sJISDjZbhldxgqw%3D%3D"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=14400 cf-ray 81c78770cf383056-MEL alt-svc h3=":443"; ma=86400
GET H2	200	jquery.js Show response xn--custom-txs-z4a1h.click/cntdjs/	88 KB 32 KB	963ms 961ms	Script application/javascript	104.21.42.26 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://xn--custom-txs-z4a1h.click/cntdjs/jquery.js Requested by Host: xn--custom-txs-z4a1h.click URL: https://xn--custom-txs-z4a1h.click/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.21.42.26 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `bde63cda98d2198a19933540edb43bb53931a352202bffe75067ac9ba722673a` Request headers accept-language en-AU,en;q=0.9 Referer https://xn--custom-txs-z4a1h.click/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 Response headers date Fri, 27 Oct 2023 02:32:32 GMT content-encoding br cf-cache-status MISS last-modified Sun, 17 Sep 2023 14:31:28 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"15f86-6058ee18ef000-gzip" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2HgPMYQuoxw4ATGxa%2FQ8nNMxEkQeBXtC2nK4bjWb2lj4RCu0UEAKEhQ2z0kFXd9Ru0%2F4zGPgDoKyXN25%2BqIXMBr04txEdVz2Ai0drFqrO7uYGiJSlQJ2o2Pg35vyNMDIrrIibaWPCSwfDmQ9Fw%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=14400 cf-ray 81c78770cf3c3056-MEL alt-svc h3=":443"; ma=86400
GET H2	200	jquery.mask.js Show response xn--custom-txs-z4a1h.click/cntdjs/	23 KB 6 KB	652ms 650ms	Script application/javascript	104.21.42.26 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://xn--custom-txs-z4a1h.click/cntdjs/jquery.mask.js Requested by Host: xn--custom-txs-z4a1h.click URL: https://xn--custom-txs-z4a1h.click/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.21.42.26 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `a199620fe981df00a825f78761d3f7c8870f8117daa4a890e08018dec386dae8` Request headers accept-language en-AU,en;q=0.9 Referer https://xn--custom-txs-z4a1h.click/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 Response headers date Fri, 27 Oct 2023 02:32:32 GMT content-encoding br cf-cache-status MISS last-modified Sat, 08 Jul 2023 13:24:42 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"5a88-5fff9ac0c9a80-gzip" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Y6qm2A07g4Ys5swBpcO0XrH7oZEkd87ow3Ubip0V3Gm4BiAvrgh5lmBKeZZCTHPNaM65CRjxzBapboOk6vcY89r0GmeqSSmMwxpKFLkmmcROvHETwZyxtQczQcv5pDbRCYpRY%2BETb2CWXaHdYw%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=14400 cf-ray 81c78770cf3e3056-MEL alt-svc h3=":443"; ma=86400
GET H2	200	loading.js Show response xn--custom-txs-z4a1h.click/cntdjs/	2 KB 1 KB	670ms 668ms	Script application/javascript	104.21.42.26 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://xn--custom-txs-z4a1h.click/cntdjs/loading.js Requested by Host: xn--custom-txs-z4a1h.click URL: https://xn--custom-txs-z4a1h.click/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.21.42.26 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `577839abe20e3b1915725950d51b8d7b8363ccb0b2dbaf2835075893b83739dc` Request headers accept-language en-AU,en;q=0.9 Referer https://xn--custom-txs-z4a1h.click/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 Response headers date Fri, 27 Oct 2023 02:32:32 GMT content-encoding br cf-cache-status MISS last-modified Sat, 08 Jul 2023 13:24:42 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"91e-5fff9ac0c9a80-gzip" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gILQ1gxJAIdLRjvj09diCcVZzgSpFs0TP3S6EQvCoaJIFfINEFuVE4bCEPhGsfGElJbHIwwVZFIcJ29BcJiGI9rP2xHQRGwlCOwSZlUyx66qp2E1HLq3JVFiuwHC%2B7J4jHIQIMAjzZfs0Hr1bg%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=14400 cf-ray 81c78770cf3f3056-MEL alt-svc h3=":443"; ma=86400
GET H2	200	styles.c14fce2ba80c26a0.css xn--custom-txs-z4a1h.click/reepay/	16 KB 4 KB	672ms 671ms	Stylesheet text/css	104.21.42.26 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://xn--custom-txs-z4a1h.click/reepay/styles.c14fce2ba80c26a0.css Requested by Host: xn--custom-txs-z4a1h.click URL: https://xn--custom-txs-z4a1h.click/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.21.42.26 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `bd7d3930d3c7da4bb809eeb3cf92cc5937fd3aa1a0e61cee26cef208dda2f457` Request headers accept-language en-AU,en;q=0.9 Referer https://xn--custom-txs-z4a1h.click/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 Response headers date Fri, 27 Oct 2023 02:32:32 GMT content-encoding br cf-cache-status MISS last-modified Sat, 08 Jul 2023 13:24:27 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"3f22-5fff9ab27b8c0-gzip" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aSxjxgY8tuuxshu7L5PTxGQjG9WvMZLdtx%2FjGIq5cyRJjcnjtGIaLOaqI%2Fg5VrZZiRvwkZVY9Et5DEDizeiLx483TaB5qV6AnOU97qbz3Zd%2BZbvIsubNlO3KUN9C%2FpUwlqp22Fv2xZVHuijP9g%3D%3D"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=14400 cf-ray 81c78770cf393056-MEL alt-svc h3=":443"; ma=86400
GET H2	200	infile.css xn--custom-txs-z4a1h.click/reepay/	18 KB 3 KB	663ms 661ms	Stylesheet text/css	104.21.42.26 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://xn--custom-txs-z4a1h.click/reepay/infile.css Requested by Host: xn--custom-txs-z4a1h.click URL: https://xn--custom-txs-z4a1h.click/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.21.42.26 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `d4da046a6f3e5fa7da0adde486f45170afd7db9ae0261331c59fd5c59b822760` Request headers accept-language en-AU,en;q=0.9 Referer https://xn--custom-txs-z4a1h.click/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 Response headers date Fri, 27 Oct 2023 02:32:32 GMT content-encoding br cf-cache-status MISS last-modified Sat, 08 Jul 2023 13:24:29 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"49a4-5fff9ab463d40-gzip" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cIqgdUza6EmQyVRQwi%2FvEdwZXv6A17QCmvw%2Fw3RJ2n108eSA9z1On%2FdPSU%2BEvkNhJEvTfB7MUOFp%2FK0D%2Fw84weFRDsKTbEcPwSCR078rwP%2Fb3FXk90%2FtDAbm1uJEIsrnIYlH%2BIo9YmrCLjZwfA%3D%3D"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=14400 cf-ray 81c78770cf3a3056-MEL alt-svc h3=":443"; ma=86400
GET H3	200	anPostLogo.svg xn--custom-txs-z4a1h.click/assets/	64 KB 48 KB	1220ms 1220ms	Image image/svg+xml	104.21.42.26 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://xn--custom-txs-z4a1h.click/assets/anPostLogo.svg Requested by Host: xn--custom-txs-z4a1h.click URL: https://xn--custom-txs-z4a1h.click/ Protocol H3 Security QUIC, , AES_128_GCM Server 104.21.42.26 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `56070667e7c231cf6d86005febb13929fe5873d327926478c332e5ccfbc9073c` Request headers accept-language en-AU,en;q=0.9 Referer https://xn--custom-txs-z4a1h.click/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 Response headers date Fri, 27 Oct 2023 02:32:33 GMT content-encoding br cf-cache-status MISS last-modified Sat, 08 Jul 2023 13:25:50 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"10052-5fff9b01a3380" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZuIdPcS2CDBLjeAlybYnE%2FHcg62kMpqYS42vRh6%2BWo9k9si030uUk0iuoXCj9eqxjKPy5qImem7Rxwg3Ce2ILtjiFlfAsMapg5TcK%2BwqLW9EEYJ8Mpr%2BbxCbluk9ufQSY4cr1liqUmKKoCvpcA%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/svg+xml cache-control max-age=14400 cf-ray 81c78774fafc2999-MEL alt-svc h3=":443"; ma=86400
GET H3	200	loadblack.svg xn--custom-txs-z4a1h.click/reepay/	2 KB 1 KB	666ms 665ms	Image image/svg+xml	104.21.42.26 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://xn--custom-txs-z4a1h.click/reepay/loadblack.svg Requested by Host: xn--custom-txs-z4a1h.click URL: https://xn--custom-txs-z4a1h.click/ Protocol H3 Security QUIC, , AES_128_GCM Server 104.21.42.26 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `d32cb065414482445f33d9dfba971f8bbd224bf159d03d7e75668bafcb05f1ad` Request headers accept-language en-AU,en;q=0.9 Referer https://xn--custom-txs-z4a1h.click/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 Response headers date Fri, 27 Oct 2023 02:32:33 GMT content-encoding br cf-cache-status MISS last-modified Sat, 08 Jul 2023 13:24:35 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"69d-5fff9aba1cac0" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8IMbfN%2B2aJYMNwa1ElonAzIp4pm7HYyLBdgziM0Kp8AIXyJXqkVDxJtY6hTccypyNOGSxkeX8pviV0746Go1i4%2F6D73hBDKDT6pwDYj9RbUOSH5%2BEjV5pp6SyEmAFuMftwsFiynIVWXA2LwIGA%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/svg+xml cache-control max-age=14400 cf-ray 81c78774fafd2999-MEL alt-svc h3=":443"; ma=86400
GET DATA	200 OK	truncated /	339 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `db5cf0db08370f66dfe81f2c25aa8b4d07cb193f62977789ce1dab2c9f6132ee` Request headers accept-language en-AU,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 Response headers Content-Type image/svg+xml;charset=utf8
GET DATA	200 OK	truncated /	2 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `e841c6f5f8f054f298a9e19a91e0df68808eb3a903a6cb579575429f6872950e` Request headers accept-language en-AU,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 Response headers Content-Type image/svg+xml;charset=utf8
GET DATA	200 OK	truncated /	591 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `7cd0db0364af9c5f016833323e7a4c884a3a5b6c7ed5c4878693c658710e6c1e` Request headers accept-language en-AU,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 Response headers Content-Type image/svg+xml;charset=utf8
GET DATA	200 OK	truncated /	2 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `f9f472a3d07ae1e0266ee943531b5f9112275284c02b6c6458ae2f44024e1b3f` Request headers accept-language en-AU,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	588 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `752d28e0ed8ba234bf1e696f47c756c8a8843f6940229eba6bbf5bf464f22999` Request headers accept-language en-AU,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 Response headers Content-Type image/svg+xml;charset=utf8
GET DATA	200 OK	truncated /	191 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `37f2ae330fef28c671b6cbf03d88ef430cd67e41da243dd638551b3d1fa19700` Request headers accept-language en-AU,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	575 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `ab82606ba85a53c62dfa7833280a45861b1dc60627a2cec4e4ab52dfb7a3fb8b` Request headers accept-language en-AU,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 Response headers Content-Type image/svg+xml;charset=utf8
GET H3	200	rawline-400.ea42a37247439622.woff2 xn--custom-txs-z4a1h.click/reepay/	79 KB 80 KB	1266ms 1265ms	Font font/woff2	104.21.42.26 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://xn--custom-txs-z4a1h.click/reepay/rawline-400.ea42a37247439622.woff2 Requested by Host: xn--custom-txs-z4a1h.click URL: https://xn--custom-txs-z4a1h.click/reepay/styles.c14fce2ba80c26a0.css Protocol H3 Security QUIC, , AES_128_GCM Server 104.21.42.26 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `8e9d1aba37a102665016fffea61a124e6c385d6783d6cef869f9910c6115a401` Request headers Referer https://xn--custom-txs-z4a1h.click/reepay/styles.c14fce2ba80c26a0.css Origin https://xn--custom-txs-z4a1h.click accept-language en-AU,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 Response headers date Fri, 27 Oct 2023 02:32:36 GMT cf-cache-status MISS last-modified Sat, 08 Jul 2023 13:24:34 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag "13d80-5fff9ab928880" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rT3geBGyXFSS1mD696g1S2jvpbR0YIzGRyoMiHctci4NCex0ixxEUnXdZhhJfzOTqE5r2bJGQ8usyl8XUhsCOug2CGDogulU17a2Ah9Oei23wrxto5yJDAWzRtjlx0YMpQ8l9ozLpW8vjVETCQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type font/woff2 cache-control max-age=14400 accept-ranges bytes cf-ray 81c787830a3c2999-MEL alt-svc h3=":443"; ma=86400 content-length 81280
GET H3	404	AnPostSans-Bold.woff2 xn--custom-txs-z4a1h.click/webfonts/	0 0	655ms 655ms	Font text/html	104.21.42.26 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://xn--custom-txs-z4a1h.click/webfonts/AnPostSans-Bold.woff2 Requested by Host: xn--custom-txs-z4a1h.click URL: https://xn--custom-txs-z4a1h.click/assets/core.min.css Protocol H3 Security QUIC, , AES_128_GCM Server 104.21.42.26 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers Referer https://xn--custom-txs-z4a1h.click/assets/core.min.css Origin https://xn--custom-txs-z4a1h.click accept-language en-AU,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 Response headers date Fri, 27 Oct 2023 02:32:35 GMT content-encoding br cf-cache-status MISS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lUqUpCWYFi7bnUZhvEoWJ%2BeGncdB9hT0TjqMoXO0mI%2Bc4527t1NM188U06DeSPGmbrQ5AoJpz0Y1U%2BaKnnV9%2F1j9Bm90PL1c426nwNXryNyNk9Pj4VoI4kb65tfNgL79jC157rxe61yMnxigDg%3D%3D"}],"group":"cf-nel","max_age":604800} content-type text/html; charset=iso-8859-1 cache-control max-age=14400 cf-ray 81c787830a3d2999-MEL alt-svc h3=":443"; ma=86400
GET H3	404	AnPostSans-Regular.woff2 xn--custom-txs-z4a1h.click/webfonts/	0 0	650ms 649ms	Font text/html	104.21.42.26 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://xn--custom-txs-z4a1h.click/webfonts/AnPostSans-Regular.woff2 Requested by Host: xn--custom-txs-z4a1h.click URL: https://xn--custom-txs-z4a1h.click/assets/core.min.css Protocol H3 Security QUIC, , AES_128_GCM Server 104.21.42.26 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers Referer https://xn--custom-txs-z4a1h.click/assets/core.min.css Origin https://xn--custom-txs-z4a1h.click accept-language en-AU,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 Response headers date Fri, 27 Oct 2023 02:32:35 GMT content-encoding br cf-cache-status MISS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TwERT%2Fug9l6tk%2Bnf%2FugQKR9yz2WYPaIH9oCyPrXugf8DhA9tQKtLCBhvvZNaHmuJ1oqw57UcrYjhR4L17z23m7QNbNkPypGan0yqb1Zu%2FwU40hgugAxsoWUc6DYmYtJmyu0GgSg8jk7L%2F%2BSL7g%3D%3D"}],"group":"cf-nel","max_age":604800} content-type text/html; charset=iso-8859-1 cache-control max-age=14400 cf-ray 81c787830a3e2999-MEL alt-svc h3=":443"; ma=86400
GET H3	404	AnPostSans-Regular.woff xn--custom-txs-z4a1h.click/webfonts/	0 0	700ms 700ms	Font text/html	104.21.42.26 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://xn--custom-txs-z4a1h.click/webfonts/AnPostSans-Regular.woff Requested by Host: xn--custom-txs-z4a1h.click URL: https://xn--custom-txs-z4a1h.click/assets/core.min.css Protocol H3 Security QUIC, , AES_128_GCM Server 104.21.42.26 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers Referer https://xn--custom-txs-z4a1h.click/assets/core.min.css Origin https://xn--custom-txs-z4a1h.click accept-language en-AU,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 Response headers date Fri, 27 Oct 2023 02:32:36 GMT content-encoding br cf-cache-status MISS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ahT8MmvOOYYD4GhIn0dd2R74AVu4LHjtLMI3PA9eoLQTIzdDw0ckP87iwDqjuZOYNRewZqIHdWIe2SAsh%2BA%2BbFdehcvpKRZJgq4Wjx9v6sjFhFykh%2BWR7mUgVTu44xX6CW%2BVzgvFQX96Rl6D%2FA%3D%3D"}],"group":"cf-nel","max_age":604800} content-type text/html; charset=iso-8859-1 cache-control max-age=14400 cf-ray 81c7878719012999-MEL alt-svc h3=":443"; ma=86400
GET H3	404	AnPostSans-Bold.woff xn--custom-txs-z4a1h.click/webfonts/	0 0	694ms 694ms	Font text/html	104.21.42.26 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://xn--custom-txs-z4a1h.click/webfonts/AnPostSans-Bold.woff Requested by Host: xn--custom-txs-z4a1h.click URL: https://xn--custom-txs-z4a1h.click/assets/core.min.css Protocol H3 Security QUIC, , AES_128_GCM Server 104.21.42.26 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers Referer https://xn--custom-txs-z4a1h.click/assets/core.min.css Origin https://xn--custom-txs-z4a1h.click accept-language en-AU,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 Response headers date Fri, 27 Oct 2023 02:32:36 GMT content-encoding br cf-cache-status MISS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=k3czCiozpAyvwTL68n4GBNSs%2BeFlgwbJyWK%2FsORFdM8Zw2bvFxu4JocjCcHx7iWshKR41xjY13PCsz9Q3Rudub%2ByTS8UqUtK3WaFbH6fK7DYbHv8YOkg5uo120EGTVsQrUKlrRd0itXmZyObcg%3D%3D"}],"group":"cf-nel","max_age":604800} content-type text/html; charset=iso-8859-1 cache-control max-age=14400 cf-ray 81c7878729112999-MEL alt-svc h3=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: An Post (Transportation)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			xn--custom-txs-z4a1h.click/	1969-12-31 23:59:59	Name: PHPSESSID Value: 4mhkqphnu8fjoct6edmfjm6vs1

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://xn--custom-txs-z4a1h.click/webfonts/AnPostSans-Regular.woff2 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://xn--custom-txs-z4a1h.click/webfonts/AnPostSans-Bold.woff2 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://xn--custom-txs-z4a1h.click/webfonts/AnPostSans-Regular.woff Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://xn--custom-txs-z4a1h.click/webfonts/AnPostSans-Bold.woff Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

xn--custom-txs-z4a1h.click
104.21.42.26
172.67.199.66
37f2ae330fef28c671b6cbf03d88ef430cd67e41da243dd638551b3d1fa19700
56070667e7c231cf6d86005febb13929fe5873d327926478c332e5ccfbc9073c
577839abe20e3b1915725950d51b8d7b8363ccb0b2dbaf2835075893b83739dc
5acb69db0d8275e5fa0a5000bdd413529779277177bcdf90af13a09632f59eb7
752d28e0ed8ba234bf1e696f47c756c8a8843f6940229eba6bbf5bf464f22999
7cd0db0364af9c5f016833323e7a4c884a3a5b6c7ed5c4878693c658710e6c1e
8e9d1aba37a102665016fffea61a124e6c385d6783d6cef869f9910c6115a401
a199620fe981df00a825f78761d3f7c8870f8117daa4a890e08018dec386dae8
ab82606ba85a53c62dfa7833280a45861b1dc60627a2cec4e4ab52dfb7a3fb8b
bd7d3930d3c7da4bb809eeb3cf92cc5937fd3aa1a0e61cee26cef208dda2f457
bde63cda98d2198a19933540edb43bb53931a352202bffe75067ac9ba722673a
d32cb065414482445f33d9dfba971f8bbd224bf159d03d7e75668bafcb05f1ad
d4da046a6f3e5fa7da0adde486f45170afd7db9ae0261331c59fd5c59b822760
db5cf0db08370f66dfe81f2c25aa8b4d07cb193f62977789ce1dab2c9f6132ee
e841c6f5f8f054f298a9e19a91e0df68808eb3a903a6cb579575429f6872950e
ea6e4eeb0657eaa022da14c547528b40a17e2f84b534fb6790e12c53df57e019
f9f472a3d07ae1e0266ee943531b5f9112275284c02b6c6458ae2f44024e1b3f

xn--custom-txs-z4a1h.click Open in urlscan Pro Puny custom-táxés.click IDN 104.21.42.26 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

14 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

2 IPs

2 Countries

2274 kBTransfer

5613 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 7 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

7 JavaScript Global Variables

1 Cookies

4 Console Messages

Indicators

xn--custom-txs-z4a1h.click Open in urlscan Pro Puny
custom-táxés.click IDN
104.21.42.26 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

2
Countries

2274 kB
Transfer

5613 kB
Size

1
Cookies

14 HTTP transactions
7 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!