urlscan.io logo urlscan.io
SecurityTrails logo

ca-canadapost.com Open in urlscan Pro
198.57.151.208  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://crm.nii.ph/custom/modules/Administration/4.html
Effective URL: https://ca-canadapost.com/ids/User/b30be/
Submission: On November 03 via manual from CA
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 21 HTTP transactions. The main IP is 198.57.151.208, located in Provo, United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is ca-canadapost.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on November 3rd 2020. Valid for: 3 months.
This is the only time ca-canadapost.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Canada Post (Transportation)

Domain & IP information

IP Address AS Autonomous System
1 112.205.215.221 9299 (IPG-AS-AP...)
2 20 198.57.151.208 46606 (UNIFIEDLA...)
1 2a02:26f0:170... 20940 (AKAMAI-ASN1)
1 2 2606:4700:303... 13335 (CLOUDFLAR...)
21 4
Apex Domain
Subdomains		 Transfer
20 ca-canadapost.com
ca-canadapost.com
133 KB
2 zupimages.net
zupimages.net
www.zupimages.net
5 KB
1 canadapost.ca
www.canadapost.ca
5 KB
1 nii.ph
crm.nii.ph
439 B
21 4
Domain Requested by
20 ca-canadapost.com 2 redirects ca-canadapost.com
1 www.zupimages.net ca-canadapost.com
1 zupimages.net 1 redirects
1 www.canadapost.ca ca-canadapost.com
1 crm.nii.ph
21 5

This site contains no links.

Subject Issuer Validity Valid
webmail.ca-canadapost.com
Let's Encrypt Authority X3		 2020-11-03 -
2021-02-01		 3 months crt.sh
www.canadapost.ca
GeoTrust RSA CA 2018		 2020-05-23 -
2021-08-22		 a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2020-07-23 -
2021-07-23		 a year crt.sh

This page contains 2 frames:

Primary Page: https://ca-canadapost.com/ids/User/b30be/
Frame ID: B981ECEB21404F11033B2A3EA61694B3
Requests: 9 HTTP requests in this frame

Frame: https://ca-canadapost.com/ids/User/b30be/sandokhan.html
Frame ID: C275DF3B2E42BFF5F9F0BC715269B820
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://crm.nii.ph/custom/modules/Administration/4.html Page URL
  2. https://ca-canadapost.com/ids/User/ HTTP 302
    https://ca-canadapost.com/ids/User/b30be HTTP 301
    https://ca-canadapost.com/ids/User/b30be/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

21
Requests

95 %
HTTPS

50 %
IPv6

4
Domains

5
Subdomains

4
IPs

3
Countries

142 kB
Transfer

399 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://crm.nii.ph/custom/modules/Administration/4.html Page URL
  2. https://ca-canadapost.com/ids/User/ HTTP 302
    https://ca-canadapost.com/ids/User/b30be HTTP 301
    https://ca-canadapost.com/ids/User/b30be/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 17
  • https://zupimages.net/up/20/38/e429.png HTTP 301
  • https://www.zupimages.net/up/20/38/e429.png

21 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
4.html
crm.nii.ph/custom/modules/Administration/ 		82 B
439 B 		Document
General
Check archive.org
Download Go to
Full URL
http://crm.nii.ph/custom/modules/Administration/4.html
Protocol
HTTP/1.1
Server
112.205.215.221 Santa Elena, Philippines, ASN9299 (IPG-AS-AP Philippine Long Distance Telephone Company, PH),
Reverse DNS
112.205.215.221.pldt.net
Software
Apache / ASP.NET
Resource Hash
eac6aa99ef058f2b4fc01ea3b036ea85e75e41bda88de3a1a92388f91e3e5735

Request headers

Host
crm.nii.ph
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 03 Nov 2020 14:40:04 GMT
Server
Apache
Content-Type
text/html
Last-Modified
Tue, 03 Nov 2020 12:48:01 GMT
Accept-Ranges
bytes
ETag
"80d64090dfb1d61:0-gzip"
X-Powered-By
ASP.NET
Vary
Accept-Encoding
Content-Encoding
gzip
Content-Length
95
Keep-Alive
timeout=15, max=100
Connection
Keep-Alive
Primary Request /
ca-canadapost.com/ids/User/b30be/
Redirect Chain
  • https://ca-canadapost.com/ids/User/
  • https://ca-canadapost.com/ids/User/b30be
  • https://ca-canadapost.com/ids/User/b30be/
2 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ca-canadapost.com/ids/User/b30be/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
198.57.151.208 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
198-57-151-208.unifiedlayer.com
Software
Apache /
Resource Hash
0ddc5d3fc9c5b0bdfead804f08815333fec10366c095258c33399f807d382b0e

Request headers

:method
GET
:authority
ca-canadapost.com
:scheme
https
:path
/ids/User/b30be/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
document
referer
http://crm.nii.ph/custom/modules/Administration/4.html
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
http://crm.nii.ph/custom/modules/Administration/4.html

Response headers

status
200
date
Tue, 03 Nov 2020 14:40:06 GMT
server
Apache
last-modified
Tue, 03 Nov 2020 14:40:05 GMT
accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-length
938
content-type
text/html

Redirect headers

status
301
date
Tue, 03 Nov 2020 14:40:05 GMT
server
Apache
location
https://ca-canadapost.com/ids/User/b30be/
content-length
249
content-type
text/html; charset=iso-8859-1
bootstrap.min.css
ca-canadapost.com/ids/User/b30be/ekos/ 		107 KB
25 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ca-canadapost.com/ids/User/b30be/ekos/bootstrap.min.css
Requested by
Host: ca-canadapost.com
URL: https://ca-canadapost.com/ids/User/b30be/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
198.57.151.208 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
198-57-151-208.unifiedlayer.com
Software
Apache /
Resource Hash
b5fd723750763ebb731f9221e413e7d64d58d5192dc040e42292ed3dcccca732

Request headers

Referer
https://ca-canadapost.com/ids/User/b30be/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 03 Nov 2020 14:40:06 GMT
content-encoding
gzip
last-modified
Tue, 03 Nov 2020 14:40:05 GMT
server
Apache
vary
Accept-Encoding
content-type
text/css
status
200
accept-ranges
bytes
desktop.css
ca-canadapost.com/ids/User/b30be/ekos/ 		10 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ca-canadapost.com/ids/User/b30be/ekos/desktop.css
Requested by
Host: ca-canadapost.com
URL: https://ca-canadapost.com/ids/User/b30be/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
198.57.151.208 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
198-57-151-208.unifiedlayer.com
Software
Apache /
Resource Hash
93e92f15020c203962ba140cc23ce3b9b377bb6355517e5a1afa1bef7cc41d75

Request headers

Referer
https://ca-canadapost.com/ids/User/b30be/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 03 Nov 2020 14:40:06 GMT
content-encoding
gzip
last-modified
Tue, 03 Nov 2020 14:40:05 GMT
server
Apache
vary
Accept-Encoding
content-type
text/css
status
200
accept-ranges
bytes
content-length
3227
pubup.css
ca-canadapost.com/ids/User/b30be/ 		3 KB
786 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ca-canadapost.com/ids/User/b30be/pubup.css
Requested by
Host: ca-canadapost.com
URL: https://ca-canadapost.com/ids/User/b30be/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
198.57.151.208 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
198-57-151-208.unifiedlayer.com
Software
Apache /
Resource Hash
f99f5e80bb4c60e94c0e572536bb8416e40730e50bc31ff6af974742b1078429

Request headers

Referer
https://ca-canadapost.com/ids/User/b30be/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 03 Nov 2020 14:40:06 GMT
content-encoding
gzip
last-modified
Tue, 03 Nov 2020 14:40:05 GMT
server
Apache
vary
Accept-Encoding
content-type
text/css
status
200
accept-ranges
bytes
content-length
747
cpc-main-logo.svg
www.canadapost.ca/cpc/assets/cpc/img/logos/ 		12 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.canadapost.ca/cpc/assets/cpc/img/logos/cpc-main-logo.svg
Requested by
Host: ca-canadapost.com
URL: https://ca-canadapost.com/ids/User/b30be/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:1700:19a::1dc5 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software
/
Resource Hash
e467e89a41e68909313eef448847f3446650158fb5d046295fea70fd7d776b87
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ca-canadapost.com/ids/User/b30be/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Security-Policy
frame-ancestors 'self'
Content-Encoding
gzip
x-content-type-options
nosniff
x-permitted-cross-domain-policies
master-only
p3p
CP="NON CUR OTPi OUR NOR UNI"
Connection
keep-alive
Vary
Accept-Encoding
Content-Length
3967
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
Last-Modified
Mon, 15 May 2017 20:24:36 GMT
x-frame-options
SAMEORIGIN
Date
Tue, 03 Nov 2020 14:40:06 GMT
strict-transport-security
max-age=31536000
Content-Type
image/svg+xml
Cache-Control
max-age=86400, private
ETag
"591a0e84-3037"
Accept-Ranges
bytes
Expires
Wed, 02 Sep 2020 06:51:18 GMT
ifram.css
ca-canadapost.com/ids/User/b30be/ 		807 B
347 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ca-canadapost.com/ids/User/b30be/ifram.css
Requested by
Host: ca-canadapost.com
URL: https://ca-canadapost.com/ids/User/b30be/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
198.57.151.208 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
198-57-151-208.unifiedlayer.com
Software
Apache /
Resource Hash
aa0cec019b9949decffa697083d6529db01073164e758ed7c65ed51b83a9df08

Request headers

Referer
https://ca-canadapost.com/ids/User/b30be/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 03 Nov 2020 14:40:06 GMT
content-encoding
gzip
last-modified
Tue, 03 Nov 2020 14:40:05 GMT
server
Apache
vary
Accept-Encoding
content-type
text/css
status
200
accept-ranges
bytes
content-length
315
2020-08-18_151724.png
ca-canadapost.com/ids/User/b30be/images/ 		335 B
373 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ca-canadapost.com/ids/User/b30be/images/2020-08-18_151724.png
Requested by
Host: ca-canadapost.com
URL: https://ca-canadapost.com/ids/User/b30be/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
198.57.151.208 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
198-57-151-208.unifiedlayer.com
Software
Apache /
Resource Hash
dd7f24bcd34389ae222dabca96a9afdc2727212c5f42a6dd88ea2df60aae2d06

Request headers

Referer
https://ca-canadapost.com/ids/User/b30be/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
date
Tue, 03 Nov 2020 14:40:06 GMT
last-modified
Tue, 03 Nov 2020 14:40:05 GMT
server
Apache
accept-ranges
bytes
content-length
335
content-type
image/png
sandokhan.html
ca-canadapost.com/ids/User/b30be/ Frame C275 		20 KB
7 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ca-canadapost.com/ids/User/b30be/sandokhan.html
Requested by
Host: ca-canadapost.com
URL: https://ca-canadapost.com/ids/User/b30be/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
198.57.151.208 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
198-57-151-208.unifiedlayer.com
Software
Apache /
Resource Hash
d58f2738b979cb35922c8d9e356a0414417a3b3cace4638294fb0611f247cff4

Request headers

:method
GET
:authority
ca-canadapost.com
:scheme
https
:path
/ids/User/b30be/sandokhan.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
same-origin
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://ca-canadapost.com/ids/User/b30be/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://ca-canadapost.com/ids/User/b30be/

Response headers

status
200
date
Tue, 03 Nov 2020 14:40:06 GMT
server
Apache
last-modified
Tue, 03 Nov 2020 14:40:05 GMT
accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-length
6871
content-type
text/html
Open_Sans.woff
ca-canadapost.com/ids/User/b30be/ekos/ 		0
0 		Font
General
Check archive.org
Download Go to
Full URL
https://ca-canadapost.com/ids/User/b30be/ekos/Open_Sans.woff
Requested by
Host: ca-canadapost.com
URL: https://ca-canadapost.com/ids/User/b30be/ekos/desktop.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
198.57.151.208 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
198-57-151-208.unifiedlayer.com
Software
Apache /
Resource Hash

Request headers

Origin
https://ca-canadapost.com
Referer
https://ca-canadapost.com/ids/User/b30be/ekos/desktop.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 03 Nov 2020 14:40:06 GMT
content-encoding
gzip
last-modified
Tue, 24 Sep 2019 22:54:30 GMT
server
Apache
vary
Accept-Encoding
content-type
text/html
status
404
accept-ranges
bytes
content-length
462
cvv.css
ca-canadapost.com/ids/User/b30be/ Frame C275 		0
0 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ca-canadapost.com/ids/User/b30be/cvv.css
Requested by
Host: ca-canadapost.com
URL: https://ca-canadapost.com/ids/User/b30be/sandokhan.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
198.57.151.208 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
198-57-151-208.unifiedlayer.com
Software
Apache /
Resource Hash

Request headers

Referer
https://ca-canadapost.com/ids/User/b30be/sandokhan.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 03 Nov 2020 14:40:07 GMT
content-encoding
gzip
last-modified
Tue, 24 Sep 2019 22:54:30 GMT
server
Apache
vary
Accept-Encoding
content-type
text/html
status
404
accept-ranges
bytes
content-length
462
index.css
ca-canadapost.com/ids/User/b30be/ Frame C275 		11 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ca-canadapost.com/ids/User/b30be/index.css
Requested by
Host: ca-canadapost.com
URL: https://ca-canadapost.com/ids/User/b30be/sandokhan.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
198.57.151.208 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
198-57-151-208.unifiedlayer.com
Software
Apache /
Resource Hash
2a65f408fa9e249c423ee1c9c5398a1253030f2912dc8d0f009eb3ade2e80ca8

Request headers

Referer
https://ca-canadapost.com/ids/User/b30be/sandokhan.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 03 Nov 2020 14:40:07 GMT
content-encoding
gzip
last-modified
Tue, 03 Nov 2020 14:40:05 GMT
server
Apache
vary
Accept-Encoding
content-type
text/css
status
200
accept-ranges
bytes
content-length
1995
jquery-3.1.1.slim.min.js
ca-canadapost.com/ids/User/b30be/tpl-v17/js/ Frame C275 		95 KB
42 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ca-canadapost.com/ids/User/b30be/tpl-v17/js/jquery-3.1.1.slim.min.js
Requested by
Host: ca-canadapost.com
URL: https://ca-canadapost.com/ids/User/b30be/sandokhan.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
198.57.151.208 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
198-57-151-208.unifiedlayer.com
Software
Apache /
Resource Hash
736b1afd105ee5b36ae35ba0890827ed7df113d16e58d14afad7c20c811d8b81

Request headers

Referer
https://ca-canadapost.com/ids/User/b30be/sandokhan.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 03 Nov 2020 14:40:07 GMT
content-encoding
gzip
last-modified
Tue, 03 Nov 2020 14:40:05 GMT
server
Apache
vary
Accept-Encoding
content-type
application/javascript
status
200
accept-ranges
bytes
jquery-1.9.1.min.js
ca-canadapost.com/ids/User/b30be/tpl-v17/js/ Frame C275 		87 KB
38 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ca-canadapost.com/ids/User/b30be/tpl-v17/js/jquery-1.9.1.min.js
Requested by
Host: ca-canadapost.com
URL: https://ca-canadapost.com/ids/User/b30be/sandokhan.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
198.57.151.208 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
198-57-151-208.unifiedlayer.com
Software
Apache /
Resource Hash
0ac0bf83bcf10aaf186a1445ecee2e89d0374be5387b0f8bb6ebba69bd5177a8

Request headers

Referer
https://ca-canadapost.com/ids/User/b30be/sandokhan.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 03 Nov 2020 14:40:07 GMT
content-encoding
gzip
last-modified
Tue, 03 Nov 2020 14:40:05 GMT
server
Apache
vary
Accept-Encoding
content-type
application/javascript
status
200
accept-ranges
bytes
jquery-confirm.min.css
ca-canadapost.com/ids/User/b30be/tpl-v17/css/ Frame C275 		23 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ca-canadapost.com/ids/User/b30be/tpl-v17/css/jquery-confirm.min.css
Requested by
Host: ca-canadapost.com
URL: https://ca-canadapost.com/ids/User/b30be/sandokhan.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
198.57.151.208 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
198-57-151-208.unifiedlayer.com
Software
Apache /
Resource Hash
024cfcb5e3188b2f14901e5d3c04c0fe48a5d17abe7e736187bca676b6ca154d

Request headers

Referer
https://ca-canadapost.com/ids/User/b30be/sandokhan.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 03 Nov 2020 14:40:07 GMT
content-encoding
gzip
last-modified
Tue, 03 Nov 2020 14:40:05 GMT
server
Apache
vary
Accept-Encoding
content-type
text/css
status
200
accept-ranges
bytes
content-length
4635
jquery-confirm.min.js
ca-canadapost.com/ids/User/b30be/tpl-v17/js/ Frame C275 		21 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ca-canadapost.com/ids/User/b30be/tpl-v17/js/jquery-confirm.min.js
Requested by
Host: ca-canadapost.com
URL: https://ca-canadapost.com/ids/User/b30be/sandokhan.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
198.57.151.208 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
198-57-151-208.unifiedlayer.com
Software
Apache /
Resource Hash
4a5ebdffe9774fc0a9226dd6625db53aee3de99b53511e0b096d5963eb2b7a6d

Request headers

Referer
https://ca-canadapost.com/ids/User/b30be/sandokhan.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 03 Nov 2020 14:40:07 GMT
content-encoding
gzip
last-modified
Tue, 03 Nov 2020 14:40:05 GMT
server
Apache
vary
Accept-Encoding
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
7459
img0001.png
ca-canadapost.com/ids/User/b30be/images/ Frame C275 		476 B
506 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ca-canadapost.com/ids/User/b30be/images/img0001.png
Requested by
Host: ca-canadapost.com
URL: https://ca-canadapost.com/ids/User/b30be/sandokhan.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
198.57.151.208 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
198-57-151-208.unifiedlayer.com
Software
Apache /
Resource Hash
5aa43b88b4981de5446b3f2ba92d716441f952d206716d89252b247478a2428c

Request headers

Referer
https://ca-canadapost.com/ids/User/b30be/sandokhan.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
date
Tue, 03 Nov 2020 14:40:07 GMT
last-modified
Tue, 03 Nov 2020 14:40:05 GMT
server
Apache
accept-ranges
bytes
content-length
476
content-type
image/png
img0002.png
ca-canadapost.com/ids/User/b30be/images/ Frame C275 		476 B
506 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ca-canadapost.com/ids/User/b30be/images/img0002.png
Requested by
Host: ca-canadapost.com
URL: https://ca-canadapost.com/ids/User/b30be/sandokhan.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
198.57.151.208 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
198-57-151-208.unifiedlayer.com
Software
Apache /
Resource Hash
5aa43b88b4981de5446b3f2ba92d716441f952d206716d89252b247478a2428c

Request headers

Referer
https://ca-canadapost.com/ids/User/b30be/sandokhan.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
date
Tue, 03 Nov 2020 14:40:07 GMT
last-modified
Tue, 03 Nov 2020 14:40:05 GMT
server
Apache
accept-ranges
bytes
content-length
476
content-type
image/png
e429.png
www.zupimages.net/up/20/38/ Frame C275
Redirect Chain
  • https://zupimages.net/up/20/38/e429.png
  • https://www.zupimages.net/up/20/38/e429.png
4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.zupimages.net/up/20/38/e429.png
Requested by
Host: ca-canadapost.com
URL: https://ca-canadapost.com/ids/User/b30be/sandokhan.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3038::6815:e9c5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c9c28fdd41dc48085360a73964739895c453d4b32314f236fed3c4370ec0ce8a

Request headers

Referer
https://ca-canadapost.com/ids/User/b30be/sandokhan.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 03 Nov 2020 14:40:07 GMT
cf-cache-status
HIT
cf-bgj
csam-hash
server
cloudflare
age
2630
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=wfywURIDK%2BhurDI1N4GlsosbfzaOGL3%2FUzE8zX10n6%2BBNWPL%2FAxIwcvUltkw1V0b4IvrXdnQ0laOB9Tc11KKRa1Di7rG19lJ0cVuj9Mz911zbYOD7mLUbEu8yl2f9A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
status
200
cache-control
max-age=432000
nel
{"report_to":"cf-nel","max_age":604800}
content-disposition
filename="e429.png"
cf-ray
5ec6d93c6a021762-FRA
cf-request-id
06302619c600001762babef000000001

Redirect headers

date
Tue, 03 Nov 2020 14:40:07 GMT
cf-cache-status
EXPIRED
nel
{"report_to":"cf-nel","max_age":604800}
server
cloudflare
status
301
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=MGPZKW0NKsvtoUMtWih746Gg5E7RcsUq0QOBXbN3Xx%2Fenp%2FWAqpsCBkkIF32nN1YooRv9NinfbSDnIe7Xe7KDKm%2FEnt5BgMyRSCCOSM9dfXaUuM9Un0O%2B%2BMk"}],"group":"cf-nel","max_age":604800}
content-type
text/html
location
https://www.zupimages.net/up/20/38/e429.png
cache-control
max-age=432000
cf-ray
5ec6d93bd8b41762-FRA
cf-request-id
0630261969000017627232c000000001
jquery-3.1.1.slim.min.js
ca-canadapost.com/ids/User/b30be/js/ Frame C275 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://ca-canadapost.com/ids/User/b30be/js/jquery-3.1.1.slim.min.js
Requested by
Host: ca-canadapost.com
URL: https://ca-canadapost.com/ids/User/b30be/sandokhan.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
198.57.151.208 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
198-57-151-208.unifiedlayer.com
Software
Apache /
Resource Hash

Request headers

Referer
https://ca-canadapost.com/ids/User/b30be/sandokhan.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 03 Nov 2020 14:40:07 GMT
content-encoding
gzip
last-modified
Tue, 24 Sep 2019 22:54:30 GMT
server
Apache
vary
Accept-Encoding
content-type
text/html
status
404
accept-ranges
bytes
content-length
462
jquery-3.1.1.slim.min.js
ca-canadapost.com/ids/User/b30be/js/ Frame C275 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://ca-canadapost.com/ids/User/b30be/js/jquery-3.1.1.slim.min.js
Requested by
Host: ca-canadapost.com
URL: https://ca-canadapost.com/ids/User/b30be/sandokhan.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
198.57.151.208 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
198-57-151-208.unifiedlayer.com
Software
Apache /
Resource Hash

Request headers

Referer
https://ca-canadapost.com/ids/User/b30be/sandokhan.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 03 Nov 2020 14:40:07 GMT
content-encoding
gzip
last-modified
Tue, 24 Sep 2019 22:54:30 GMT
server
Apache
vary
Accept-Encoding
content-type
text/html
status
404
accept-ranges
bytes
content-length
462

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Canada Post (Transportation)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes

0 Cookies