![](/screenshots/e44fd0ea-3775-48fe-bf83-a9c4bfeda2b9.png)
buykaa.com
Open in
urlscan Pro
208.91.199.152
Malicious Activity!
Public Scan
Submission: On April 03 via api from US
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on February 27th 2020. Valid for: 3 months.
This is the only time buykaa.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Canada Post (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 208.91.199.152 208.91.199.152 | 394695 (PUBLIC-DO...) (PUBLIC-DOMAIN-REGISTRY) | |
2 | 2620:1ec:bdf::10 2620:1ec:bdf::10 | 8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
3 | 3 |
ASN394695 (PUBLIC-DOMAIN-REGISTRY, US)
PTR: bh-25.webhostbox.net
buykaa.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
2 |
mailinblack.com
cdn.mailinblack.com |
163 KB |
1 |
buykaa.com
buykaa.com |
1 MB |
3 | 2 |
Domain | Requested by | |
---|---|---|
2 | cdn.mailinblack.com |
buykaa.com
|
1 | buykaa.com | |
3 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
buykaa.com Let's Encrypt Authority X3 |
2020-02-27 - 2020-05-27 |
3 months | crt.sh |
cdn.mailinblack.com DigiCert SHA2 Secure Server CA |
2019-12-10 - 2020-12-10 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://buykaa.com/post/
Frame ID: C655384555208E3811B705E03DAE5150
Requests: 6 HTTP requests in this frame
Screenshot
![](/screenshots/e44fd0ea-3775-48fe-bf83-a9c4bfeda2b9.png)
Detected technologies
![](/vendor/wappa/icons/OpenSSL.png)
Detected patterns
- headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
3 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
buykaa.com/post/ |
2 MB 1 MB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
8 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
601 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
OpenSans-Semibold.ttf
cdn.mailinblack.com/cdn/v1/fonts/ |
216 KB 82 KB |
Font
application/font-sfnt |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
OpenSans-Regular.ttf
cdn.mailinblack.com/cdn/v1/fonts/ |
212 KB 81 KB |
Font
application/font-sfnt |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
16 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Canada Post (Transportation)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
buykaa.com
cdn.mailinblack.com
208.91.199.152
2620:1ec:bdf::10
315e34c7c8c0276a7b919c86f435923425d9a69be9c784eb1951ac6d93744d44
718e7572f8c059ca4124d2f300889fa0374d0f7b5516e4c9f57a68b55cacbbec
aa3b0ef53db12e3d45094030cac0e69d384e44cc5978643dd4390041cad546e2
bc8136ff86089f41ca65f0d45d929b805f26566c2129ee9a1fc6457bb71fd069
e64e508b2aa2880f907e470c4550980ec4c0694d103a43f36150ac3f93189bee
e7648cabde29cdd869424e10198a897849e3598d30d66ce73acde87e755b6875