shopticonis.com
Open in
urlscan Pro
46.17.100.94
Malicious Activity!
Public Scan
Effective URL: https://shopticonis.com/deliveryClick/iPhone11/?dom=trackingthebird.com&country=NL&cep=WKaw19LGJYCZw_YRTc9OA-lf8e10BlOdP...
Submission Tags: falconsandbox
Submission: On December 16 via api from US
Summary
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on November 5th 2020. Valid for: a year.
This is the only time shopticonis.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Tracking (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 2 | 2a00:1450:400... 2a00:1450:4001:81a::200e | 15169 (GOOGLE) (GOOGLE) | |
3 | 2a00:1450:400... 2a00:1450:4001:801::2003 | 15169 (GOOGLE) (GOOGLE) | |
1 1 | 18.194.134.212 18.194.134.212 | 16509 (AMAZON-02) (AMAZON-02) | |
1 13 | 46.17.100.94 46.17.100.94 | 57043 (HOSTKEY-AS) (HOSTKEY-AS) | |
1 | 2606:4700::68... 2606:4700::6812:e234 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2606:4700:303... 2606:4700:3037::ac43:c36c | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
19 | 5 |
ASN15169 (GOOGLE, US)
shipmentontheway.page.link |
ASN16509 (AMAZON-02, US)
PTR: ec2-18-194-134-212.eu-central-1.compute.amazonaws.com
trackingthebird.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
13 |
shopticonis.com
1 redirects
shopticonis.com |
401 KB |
3 |
gstatic.com
www.gstatic.com |
71 KB |
2 |
mdsyzz.com
api.mdsyzz.com |
3 KB |
2 |
page.link
1 redirects
shipmentontheway.page.link |
12 KB |
1 |
onesignal.com
cdn.onesignal.com |
3 KB |
1 |
trackingthebird.com
1 redirects
trackingthebird.com |
2 KB |
19 | 6 |
Domain | Requested by | |
---|---|---|
13 | shopticonis.com |
1 redirects
www.gstatic.com
shopticonis.com |
3 | www.gstatic.com |
shipmentontheway.page.link
www.gstatic.com |
2 | api.mdsyzz.com |
shopticonis.com
api.mdsyzz.com |
2 | shipmentontheway.page.link | 1 redirects |
1 | cdn.onesignal.com |
shopticonis.com
|
1 | trackingthebird.com | 1 redirects |
19 | 6 |
This site contains links to these domains. Also see Links.
Domain |
---|
trackingthebird.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.page.link GTS CA 1O1 |
2020-11-10 - 2021-02-02 |
3 months | crt.sh |
*.gstatic.com GTS CA 1O1 |
2020-11-10 - 2021-02-02 |
3 months | crt.sh |
shopticonis.com Sectigo RSA Domain Validation Secure Server CA |
2020-11-05 - 2021-11-05 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2020-08-04 - 2021-08-04 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://shopticonis.com/deliveryClick/iPhone11/?dom=trackingthebird.com&country=NL&cep=WKaw19LGJYCZw_YRTc9OA-lf8e10BlOdPHslrunrdrCu-p8-TSd1K_WKtM_4SeFjThG8JJQdeiPMTR6k80XgIfiO23YlMJK_w9ULkjwH6wUQsy-5NV5jRPlRxkLLBT4rfmeG0ML5O0xVTeeqdXwtqW_CdEEFc5RyvOzD1J-7u4hr7fSl1E492De7IaY65RtmpqjDVThfqylZx6pff4GB0eMz7jUo7Vx-q_GjNxXFSx2TCx-qRGReA9zyDMCWNLTjDGRiZQPv0AaQrTzhIt1IlgtYcudF-3egK1Wqynvp72DY8n9xnme8iFTOmbaaOIUBT3Xh5aRAqsLamnUplgm_fhgqBx6yclcG0L6X_yViAFS3NM811A2-kRZOHFXqZ05tHu74cVyfb5EROb0oMuZ9RbP24v-Q3soLzi3oJ-kCQGk&lptoken=165e08bf10fb591d1878
Frame ID: EBFDD679CC4BD935A3A809ECE22373D3
Requests: 19 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- https://shipmentontheway.page.link/JZF3 Page URL
-
https://shipmentontheway.page.link/JZF3?_imcp=1
HTTP 302
https://trackingthebird.com/27b2c2ee-3862-414e-ba42-6d492a0ca94e HTTP 302
https://shopticonis.com/deliveryClick/iPhone11?dom=trackingthebird.com&country=NL&cep=WKaw19LGJYCZw_... HTTP 301
https://shopticonis.com/deliveryClick/iPhone11/?dom=trackingthebird.com&country=NL&cep=WKaw19LGJYCZw... Page URL
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: Confirm Your Identity
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://shipmentontheway.page.link/JZF3 Page URL
-
https://shipmentontheway.page.link/JZF3?_imcp=1
HTTP 302
https://trackingthebird.com/27b2c2ee-3862-414e-ba42-6d492a0ca94e HTTP 302
https://shopticonis.com/deliveryClick/iPhone11?dom=trackingthebird.com&country=NL&cep=WKaw19LGJYCZw_YRTc9OA-lf8e10BlOdPHslrunrdrCu-p8-TSd1K_WKtM_4SeFjThG8JJQdeiPMTR6k80XgIfiO23YlMJK_w9ULkjwH6wUQsy-5NV5jRPlRxkLLBT4rfmeG0ML5O0xVTeeqdXwtqW_CdEEFc5RyvOzD1J-7u4hr7fSl1E492De7IaY65RtmpqjDVThfqylZx6pff4GB0eMz7jUo7Vx-q_GjNxXFSx2TCx-qRGReA9zyDMCWNLTjDGRiZQPv0AaQrTzhIt1IlgtYcudF-3egK1Wqynvp72DY8n9xnme8iFTOmbaaOIUBT3Xh5aRAqsLamnUplgm_fhgqBx6yclcG0L6X_yViAFS3NM811A2-kRZOHFXqZ05tHu74cVyfb5EROb0oMuZ9RbP24v-Q3soLzi3oJ-kCQGk&lptoken=165e08bf10fb591d1878 HTTP 301
https://shopticonis.com/deliveryClick/iPhone11/?dom=trackingthebird.com&country=NL&cep=WKaw19LGJYCZw_YRTc9OA-lf8e10BlOdPHslrunrdrCu-p8-TSd1K_WKtM_4SeFjThG8JJQdeiPMTR6k80XgIfiO23YlMJK_w9ULkjwH6wUQsy-5NV5jRPlRxkLLBT4rfmeG0ML5O0xVTeeqdXwtqW_CdEEFc5RyvOzD1J-7u4hr7fSl1E492De7IaY65RtmpqjDVThfqylZx6pff4GB0eMz7jUo7Vx-q_GjNxXFSx2TCx-qRGReA9zyDMCWNLTjDGRiZQPv0AaQrTzhIt1IlgtYcudF-3egK1Wqynvp72DY8n9xnme8iFTOmbaaOIUBT3Xh5aRAqsLamnUplgm_fhgqBx6yclcG0L6X_yViAFS3NM811A2-kRZOHFXqZ05tHu74cVyfb5EROb0oMuZ9RbP24v-Q3soLzi3oJ-kCQGk&lptoken=165e08bf10fb591d1878 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
19 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
JZF3
shipmentontheway.page.link/ |
34 KB 11 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
m=_b,_tp
www.gstatic.com/_/mss/boq-devplatform/_/js/k=boq-devplatform.DurableDeepLinkUi.en_US.kb7Ow32vqjw.es5.O/am=BA/d=1/excm=_b,_tp,viewddl/ed=1/dg=0/wt=2/ct=zgms/rs=ADpVLP6OLX6QIplurahOtCvWx54kXTXu1Q/ |
146 KB 52 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
m=byfTOb,lsjVmc,LEikZe
www.gstatic.com/_/mss/boq-devplatform/_/js/k=boq-devplatform.DurableDeepLinkUi.en_US.kb7Ow32vqjw.es5.O/ck=boq-devplatform.DurableDeepLinkUi.2aDmoCSCBBA.L.B1.O/am=BA/d=1/exm=_b,_tp/excm=_b,_tp,viewd... |
35 KB 13 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
m=KjEEgd
www.gstatic.com/_/mss/boq-devplatform/_/js/k=boq-devplatform.DurableDeepLinkUi.en_US.kb7Ow32vqjw.es5.O/ck=boq-devplatform.DurableDeepLinkUi.2aDmoCSCBBA.L.B1.O/am=BA/d=1/exm=LEikZe,_b,_tp,byfTOb,lsj... |
17 KB 6 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
/
shopticonis.com/deliveryClick/iPhone11/ Redirect Chain
|
11 KB 12 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
OneSignalSDK.js
cdn.onesignal.com/sdks/ |
8 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
auto-push.min.js
api.mdsyzz.com/ |
3 KB 2 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.js
shopticonis.com/deliveryClick/iPhone11/js/ |
86 KB 86 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style.content.css
shopticonis.com/deliveryClick/iPhone11/styles/ |
16 KB 16 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
lander.css
shopticonis.com/deliveryClick/iPhone11/ |
2 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
init.js
shopticonis.com/deliveryClick/iPhone11/js/ |
2 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon-box.png
shopticonis.com/deliveryClick/iPhone11/images/ |
877 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
check-circle-regular.png
shopticonis.com/deliveryClick/iPhone11/images/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
iphone11.png
shopticonis.com/deliveryClick/iPhone11/images/ |
102 KB 102 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
lang.js
shopticonis.com/deliveryClick/iPhone11/js/ |
57 KB 57 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
f21b755c-d63b-44dc-ae0d-d1657ae61fda
api.mdsyzz.com/rest/v1/p-apps/get-id/ |
129 B 790 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
shopticonis.com/deliveryClick/iPhone11/ |
11 KB 11 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ActoCTT-Book.woff
shopticonis.com/deliveryClick/iPhone11/fonts/ |
54 KB 54 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ActoCTT-Medium.woff
shopticonis.com/deliveryClick/iPhone11/fonts/ |
53 KB 54 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Tracking (Transportation)23 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated object| OneSignal object| _at function| InitializePush function| myDomain function| getLocation function| CheckImageAndReplace function| httpGetAsync function| getUrlVars function| getUrlParam function| getURLParameter string| dom string| link function| $ function| jQuery0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
4 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | script-src 'report-sample' 'nonce-5S8E3XTCwhN++6Z1rxcSfw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DurableDeepLinkUi/cspreport;worker-src 'self' script-src 'nonce-5S8E3XTCwhN++6Z1rxcSfw' 'self' 'unsafe-eval' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com https://www.googleapis.com/appsmarket/v2/installedApps/;report-uri /_/DurableDeepLinkUi/cspreport |
X-Content-Type-Options | nosniff |
X-Frame-Options | SAMEORIGIN |
X-Xss-Protection | 0 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
api.mdsyzz.com
cdn.onesignal.com
shipmentontheway.page.link
shopticonis.com
trackingthebird.com
www.gstatic.com
18.194.134.212
2606:4700:3037::ac43:c36c
2606:4700::6812:e234
2a00:1450:4001:801::2003
2a00:1450:4001:81a::200e
46.17.100.94
032814cf4be1a49b079a1c3c0aceda71a8aecb63c4a4a65d01e0a632b4b2a476
0726accab4d4a2b930293a532b2bf73150dab898889f7931b3c87395b12e1015
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
093dc0f94ec5a7cff0cd05d9e7c3eff816635944ea10efd189b3ef3e2439470e
10d91aaba6eb1d6cb7b8f4028d0808a7837ec2c407c77a9d7139ed47494987ef
1a3bab338bed1d9264bd0a3541e691d4c6337c517adb285a846fb23412e40fa8
2c4db7a1a8381593dd83c551398eab57ab255dfb5e825582e935f5665fcd3d18
32168500940af44fb2fe83d34a58b436f0d2055ccbe15b3c3681bdc9a1274e5b
44cf8398bf03c5dea72141b58d9c4932c2aac34d167fd8a2f9ed3c2b49e00f61
5d7dfbd5b9319dcc3609bf74a999472125689f04b5df335bf708774ab4140b02
698a4bede53a13d629a4561497579f0f71d2fce01a69a86b9cebbea6646af2d0
7656dc7c9570125795af911d1bef943124b7e442738430604bd38a78622952e9
7f250f42a336b02e0cde727854257fbd172822d2d2259fa320d1a0eebff1d654
8304827477215b517f051f116d5581a5e030e7f29df69061cb9cf108aa9cbc90
93900b80e11cb2d3b787d9c2eb29a5a49088cb8398912d474c4da4d5cc0edb14
ca03cf1dffcad9df327105a88dcd3c3ee168905cfb8518f827591ee505b841ea
cf49712ce84219f3c864c563c8d23bcaa603d6179f70cffbe788c7c7f6373a60
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f9e1a7ead3f632fd5cf650e77bbe4856c23887e1a22ae03b520c14a445cae01d