![](/screenshots/e7dffdd6-523b-4002-8ce7-f2f0e62adc05.png)
fedex-app-1.herokuapp.com
Open in
urlscan Pro
35.173.44.176
Malicious Activity!
Public Scan
Submission: On April 13 via manual from US
Summary
TLS certificate: Issued by DigiCert SHA2 High Assurance Server CA on April 19th 2017. Valid for: 3 years.
This is the only time fedex-app-1.herokuapp.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Fedex (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
8 | 35.173.44.176 35.173.44.176 | 14618 (AMAZON-AES) (AMAZON-AES) | |
1 | 2a02:26f0:6c0... 2a02:26f0:6c00:19d::2070 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
9 | 3 |
ASN14618 (AMAZON-AES, US)
PTR: ec2-35-173-44-176.compute-1.amazonaws.com
fedex-app-1.herokuapp.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
herokuapp.com
fedex-app-1.herokuapp.com |
375 KB |
1 |
fedex.com
www.fedex.com |
5 KB |
9 | 2 |
Domain | Requested by | |
---|---|---|
8 | fedex-app-1.herokuapp.com |
fedex-app-1.herokuapp.com
|
1 | www.fedex.com |
fedex-app-1.herokuapp.com
|
9 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.herokuapp.com DigiCert SHA2 High Assurance Server CA |
2017-04-19 - 2020-06-22 |
3 years | crt.sh |
www.fedex.com GeoTrust RSA CA 2018 |
2019-10-10 - 2020-12-08 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://fedex-app-1.herokuapp.com/
Frame ID: 8574C84081BAD44D43A0F924D69C841B
Requests: 17 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
9 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
fedex-app-1.herokuapp.com/ |
375 KB 375 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
s51507175343935.js
fedex-app-1.herokuapp.com/fedx/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
680 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
18 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
5 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
8 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
646b51db238fde1fae4a597ae052
fedex-app-1.herokuapp.com/fedx/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
contentim_controller-min.js
fedex-app-1.herokuapp.com/fedx/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
app-min.js
fedex-app-1.herokuapp.com/fedx/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main-min.js
fedex-app-1.herokuapp.com/fedx/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sprite-placeholder.png
www.fedex.com/images/legacy/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
960 B 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
spacer.gif
fedex-app-1.herokuapp.com/fedx/ |
196 B 196 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
85 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bg_button_purple.gif
fedex-app-1.herokuapp.com/images/ |
196 B 196 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
39 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Fedex (Transportation)26 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate object| locate string| text function| delineate object| antiClickjack function| make_blankp1 function| make_blankp2 function| validate function| validates number| vh boolean| fxg_header string| fx_device_type function| disableStyle function| loadcssfile function| loadDoc1 function| fLogon function| invitationError string| res string| zork1 number| theleft number| theright object| _cf number| vf string| reg_account function| loadDoc0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fedex-app-1.herokuapp.com
www.fedex.com
2a02:26f0:6c00:19d::2070
35.173.44.176
18276be8a74fa5b487872aab8c5b9cf68f2e27a7fc4c46bb9a304f4d17be85d4
65f95004ced86b52c3f62243a9766ff5b9147f2ef7fcca3a78ab0891cd9c0253
694639ec3961fdf6810cf74b9792475cab55edc6fda135d18415e7a56995ee0e
6f46e13ab4b86da0407a98685e6cdf678aa732e29335fe0f441c2b816ddf0e46
80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880
9867dcff5a30aadaf7d305e48e1e00b08d6487f351637eb71a74b8a718776d21
a0f04c5505fcda769f1b91f3319e08fde3ea8c5ff4b790831e1c02bd5125ef33
c374177a220133cfd7d2ab2d670d7e9655b3a0492657a75167eaff7a139e1133
cd01717dc5e565d88fa9d0e8bfeb8ecee91155cf24c2161f4f475386b18ecb25
f074f6b72de4069563e5b174cb995360ba25a6b4daa97f733b8e772ec862b106