tracking-emiratespost.dynip.online
Open in
urlscan Pro
217.18.63.179
Malicious Activity!
Public Scan
Submitted URL: https://s.id/1qCIC
Effective URL: https://tracking-emiratespost.dynip.online/S336358533/GlifWebSignIn/portal/2a850/
Submission: On November 30 via manual from AE — Scanned from DE
Effective URL: https://tracking-emiratespost.dynip.online/S336358533/GlifWebSignIn/portal/2a850/
Submission: On November 30 via manual from AE — Scanned from DE
Summary
This website contacted 2 IPs
in 3 countries
across 3 domains to perform 20 HTTP transactions.
The main IP is 217.18.63.179, located in
Moscow, Russian Federation and
belongs to TIMEWEB-AS, RU.
The main domain is tracking-emiratespost.dynip.online.
TLS certificate: Issued by R3 on November 29th 2022. Valid for: 3 months.
This is the only time tracking-emiratespost.dynip.online was scanned on urlscan.io!
TLS certificate: Issued by R3 on November 29th 2022. Valid for: 3 months.
This is the only time tracking-emiratespost.dynip.online was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Emirates Post (Transportation)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 1 | 45.126.58.78 45.126.58.78 | 132647 (IDNIC-PAN...) (IDNIC-PANDI-AS-ID Pengelola Nama Domain Internet Indonesia) | |
| 19 | 217.18.63.179 217.18.63.179 | 9123 (TIMEWEB-AS) (TIMEWEB-AS) | |
| 1 | 2a00:1450:400... 2a00:1450:4001:811::200a | 15169 (GOOGLE) (GOOGLE) | |
| 20 | 2 |
1
45.126.58.78
(Indonesia)
ASN132647 (IDNIC-PANDI-AS-ID Pengelola Nama Domain Internet Indonesia, ID)
ASN132647 (IDNIC-PANDI-AS-ID Pengelola Nama Domain Internet Indonesia, ID)
| s.id |
19
217.18.63.179
(Moscow, Russian Federation)
ASN9123 (TIMEWEB-AS, RU)
PTR: 1121973-ce52187.tw1.ru
ASN9123 (TIMEWEB-AS, RU)
PTR: 1121973-ce52187.tw1.ru
| tracking-emiratespost.dynip.online |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 19 |
dynip.online
tracking-emiratespost.dynip.online |
198 KB |
| 1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 107 |
1011 B |
| 1 |
s.id
1 redirects
s.id — Cisco Umbrella Rank: 121249 |
197 B |
| 20 | 3 |
| Domain | Requested by | |
|---|---|---|
| 19 | tracking-emiratespost.dynip.online |
tracking-emiratespost.dynip.online
|
| 1 | fonts.googleapis.com |
tracking-emiratespost.dynip.online
|
| 1 | s.id | 1 redirects |
| 20 | 3 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| tracking-emiratespost.dynip.online R3 |
2022-11-29 - 2023-02-27 |
3 months | crt.sh |
| upload.video.google.com GTS CA 1C3 |
2022-11-02 - 2023-01-25 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://tracking-emiratespost.dynip.online/S336358533/GlifWebSignIn/portal/2a850/
Frame ID: FF9E9382FBFC182B2605870A6BD5A0D3
Requests: 20 HTTP requests in this frame
Screenshot
Page Title
Emirates PostPage URL History Show full URLs
-
https://s.id/1qCIC
HTTP 301
https://tracking-emiratespost.dynip.online/S336358533/GlifWebSignIn/portal/2a850/ Page URL
Detected technologies
Bootstrap
(Web Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
Font Awesome
(Font Scripts)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Google Tag Manager
(Tag Managers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <!-- (?:End )?Google Tag Manager -->
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://s.id/1qCIC
HTTP 301
https://tracking-emiratespost.dynip.online/S336358533/GlifWebSignIn/portal/2a850/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
20 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
/
tracking-emiratespost.dynip.online/S336358533/GlifWebSignIn/portal/2a850/ Redirect Chain
|
10 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
index.css
tracking-emiratespost.dynip.online/S336358533/GlifWebSignIn/portal/2a850/css/ |
3 KB 910 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
UIComponents_UC.Header_Logo_2x.png
tracking-emiratespost.dynip.online/S336358533/GlifWebSignIn/portal/2a850/images/ |
17 KB 17 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
postkor.css
tracking-emiratespost.dynip.online/S336358533/GlifWebSignIn/portal/2a850/9ach/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
banrkolan.css
tracking-emiratespost.dynip.online/S336358533/GlifWebSignIn/portal/2a850/9ach/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bbs.css
tracking-emiratespost.dynip.online/S336358533/GlifWebSignIn/portal/2a850/9ach/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
reset.css
tracking-emiratespost.dynip.online/S336358533/GlifWebSignIn/portal/2a850/9ach/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
font.css
tracking-emiratespost.dynip.online/S336358533/GlifWebSignIn/portal/2a850/9ach/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bootstrap.min.css
tracking-emiratespost.dynip.online/S336358533/GlifWebSignIn/portal/2a850/css/ |
158 KB 28 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
validationEngine.jquery.css
tracking-emiratespost.dynip.online/S336358533/GlifWebSignIn/portal/2a850/css/ |
3 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
flaticon.css
tracking-emiratespost.dynip.online/S336358533/GlifWebSignIn/portal/2a850/css/ |
1 KB 670 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
fontawesome-all.min.css
tracking-emiratespost.dynip.online/S336358533/GlifWebSignIn/portal/2a850/css/ |
36 KB 9 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
new-style-common-screen.css
tracking-emiratespost.dynip.online/S336358533/GlifWebSignIn/portal/2a850/css/ |
70 KB 12 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
common-dynamic.css
tracking-emiratespost.dynip.online/S336358533/GlifWebSignIn/portal/2a850/css/ |
519 B 722 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
visa.png
tracking-emiratespost.dynip.online/S336358533/GlifWebSignIn/portal/2a850/images/ |
14 KB 14 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
mastercard.png
tracking-emiratespost.dynip.online/S336358533/GlifWebSignIn/portal/2a850/images/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
base-bc635a8066cae48fe4ae1e9584dae35a3c5aac5f287d88362b4e02cb3b3f8c5f.css
tracking-emiratespost.dynip.online/S336358533/GlifWebSignIn/portal/2a850/css/ |
3 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
application-b183243468889ccac29f50cb91971600b27ab309c289600f0e29f9a77e11b2b4.js
tracking-emiratespost.dynip.online/S336358533/GlifWebSignIn/portal/2a850/css/ |
200 KB 70 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
js
tracking-emiratespost.dynip.online/S336358533/GlifWebSignIn/portal/2a850/css/ |
37 KB 37 KB |
Script
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
css
fonts.googleapis.com/ |
2 KB 1011 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Emirates Post (Transportation)61 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| LiveValidation function| LiveValidationForm object| Validate object| RsaOaep function| $ function| jQuery object| MATCH_X_CHARACTERS object| supported_cards object| ranked_card_types boolean| card_detection_available boolean| mask_sensitive_account_data boolean| always_display_cvn boolean| always_require_cvn string| card_number_orig string| card_cvn_orig boolean| echeck_enabled string| echeck_account_number_orig string| echeck_routing_number_orig string| currency object| card_type_presence_params object| t object| card_brand_names object| card_expiry_year_validator object| card_expiry_month_validator object| card_number_validator object| card_cvn_validator object| card_cvn_presence_validator_params object| card_cvn_length_validator_params object| card_type_validator_radio_buttons object| card_type_validator_drop_down undefined| echeckFields undefined| echeck_routing_number_validator undefined| echeck_account_number_validator undefined| echeck_check_number_validator undefined| echeck_account_type_validator undefined| date_of_birth_month_validator undefined| date_of_birth_day_validator undefined| date_of_birth_year_validator undefined| driver_license_number_validator undefined| driver_license_state_validator undefined| company_tax_id_validator function| strip_spaces function| checkLuhn function| validate_expiry_date function| validate_date_of_birth function| isBlank function| isNotBlank function| getCurrentCardType function| set_cvn_display function| set_cvn_required function| set_jpo_method_display function| set_jpo_installments function| initialize_card function| initializeCardDetection function| initializeECheck function| maskAll function| maskAllButLastFour function| init_masking object| sessionTimer function| displayTerms function| isIE0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
5 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
| Header | Value |
|---|---|
| Strict-Transport-Security | max-age=31536000 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fonts.googleapis.com
s.id
tracking-emiratespost.dynip.online
217.18.63.179
2a00:1450:4001:811::200a
45.126.58.78
2650ffdcb2bf4147d062825fee353bd86e80c1f1c22c0b29ea856fdd3213e0a3
2e6c37dce49aa29359da9f8213274dd675646341fb974561dcd467ad50d65beb
360657b0831aa856ab1921f0c0d2a0e89e92cf8ef79635e759d499c530264f1d
689c92039510600677c54ae9126e19fa11eb0d01884a77e17599a06dba62c271
7a30c78d591040258f9f9d981f7495e9b3a175364fa06463647a441994f7e541
a658a0009d7afb4439a08cdc445ab2412016d5bb4befb24797eedd7a63981ee0
ab20d8ca042e3971cc9b47007fa9ca6d25cf6e96abde88b3b1766296628a14ca
b183243468889ccac29f50cb91971600b27ab309c289600f0e29f9a77e11b2b4
c76ef5645e14cb6a36c7125a7a4bba9a44a61e6392a1e16f224db0e2d376d1e8
cd363d0f8425d6b271c14ee5d6a8d693c3aa1323b64979b69c69d26661927303
cfac6241dd3aabb5f1552c17501790093015c006a8e13671823c1ff4872beaae
e2464f998b38ae5f4a6f68dd19faea6939ccb6db5388ce17a0621c3fe186f859
ed696db79e2cdac5db4ad2883e3ddb80fed59ef426cd565aee4c4edf385b188d
f8fe35612b4eeac21706418c7de85adeb3731c4e08302af357a983620e470016
fdcb0b24c450c291ff671a4796be86d9220675a2ef20b1ba9967cd93d6b3aa64