uk123gbgma.temp.swtest.ru Open in urlscan Pro
77.222.61.114 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://hr891.infusion-links.com/api/v1/click/4507673779372032/4955126156623872&umid=724e6b74-dad9-4125-9b9f-843a7a02de86&auth=2e...
Effective URL:
http://uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/authen.php?id=83102946
Submission: On September 08 via manual (September 8th 2020, 8:27:18 pm UTC) from NZ

Summary HTTP 16 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 3 countries across 4 domains to perform 16 HTTP transactions. The main IP is 77.222.61.114, located in Russian Federation and belongs to SWEB-AS, RU. The main domain is uk123gbgma.temp.swtest.ru.

This is the only time uk123gbgma.temp.swtest.ru was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Royal Mail (Government)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2a00:1450:400... 2a00:1450:4001:814::2013	15169 (GOOGLE) (GOOGLE)
1 1	3.220.113.157 3.220.113.157	14618 (AMAZON-AES) (AMAZON-AES)
14	77.222.61.114 77.222.61.114	44112 (SWEB-AS) (SWEB-AS)
2	23.111.9.35 23.111.9.35	33438 (HIGHWINDS2) (HIGHWINDS2)
16	2

1 2a00:1450:4001:814::2013 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

hr891.infusion-links.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.220.113.157 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-220-113-157.compute-1.amazonaws.com

rebrand.ly	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 77.222.61.114 (Russian Federation)

ASN44112 (SWEB-AS, RU)
PTR: vh287.sweb.ru

uk123gbgma.temp.swtest.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.111.9.35 (Phoenix, United States)

ASN33438 (HIGHWINDS2, US)

use.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	swtest.ru uk123gbgma.temp.swtest.ru	118 KB
2	fontawesome.com use.fontawesome.com	70 KB
1	rebrand.ly 1 redirects rebrand.ly	401 B
1	infusion-links.com 1 redirects hr891.infusion-links.com	190 B
16	4

	Domain	Requested by
14	uk123gbgma.temp.swtest.ru	uk123gbgma.temp.swtest.ru
2	use.fontawesome.com	uk123gbgma.temp.swtest.ru use.fontawesome.com
1	rebrand.ly	1 redirects
1	hr891.infusion-links.com	1 redirects
16	4

This site contains no links.

Subject Issuer	Validity	Valid
*.fontawesome.com DigiCert SHA2 Secure Server CA	`2019-10-28` - `2020-12-23`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/authen.php?id=83102946
Frame ID: AA2E574A9F68CE21CACD75352991C139
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://hr891.infusion-links.com/api/v1/click/4507673779372032/4955126156623872&umid=724e6b74-dad9-4125-9b9f-... HTTP 303
https://rebrand.ly/o8ync15vbn656?inf_contact_key=ad93482fd2292bbf7199d546e9cfe3fe680f8914173f91... HTTP 301
http://uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/?inf_contact_key=ad93482fd2292bbf7199d546e9cfe3fe... Page URL
http://uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/authen.php?id=83102946 Page URL

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i
html /<link[^>]* href="https:\/\/use\.fontawesome\.com\/releases\/v([^>]+)\/css\//i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

16
Requests

13 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

2
IPs

3
Countries

188 kB
Transfer

319 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://hr891.infusion-links.com/api/v1/click/4507673779372032/4955126156623872&umid=724e6b74-dad9-4125-9b9f-843a7a02de86&auth=2e1b1c721d44101085fca6affa5063d710a155bd-3d522dbb2b2c2207e1f533bae06633673293a305 HTTP 303
https://rebrand.ly/o8ync15vbn656?inf_contact_key=ad93482fd2292bbf7199d546e9cfe3fe680f8914173f9191b1c0223e68310bb1 HTTP 301
http://uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/?inf_contact_key=ad93482fd2292bbf7199d546e9cfe3fe680f8914173f9191b1c0223e68310bb1 Page URL
http://uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/authen.php?id=83102946 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://hr891.infusion-links.com/api/v1/click/4507673779372032/4955126156623872&umid=724e6b74-dad9-4125-9b9f-843a7a02de86&auth=2e1b1c721d44101085fca6affa5063d710a155bd-3d522dbb2b2c2207e1f533bae06633673293a305 HTTP 303
https://rebrand.ly/o8ync15vbn656?inf_contact_key=ad93482fd2292bbf7199d546e9cfe3fe680f8914173f9191b1c0223e68310bb1 HTTP 301
http://uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/?inf_contact_key=ad93482fd2292bbf7199d546e9cfe3fe680f8914173f9191b1c0223e68310bb1

16 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Cookie set / Show response uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/ Redirect Chain https://hr891.infusion-links.com/api/v1/click/4507673779372032/4955126156623872&umid=724e6b74-dad9-4125-9b9f-843a7a02de86&auth=2e1b1c721d44101085fca6affa5063d710a155bd-3d522dbb2b2c2207e1f533bae0663... https://rebrand.ly/o8ync15vbn656?inf_contact_key=ad93482fd2292bbf7199d546e9cfe3fe680f8914173f9191b1c0223e68310bb1 http://uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/?inf_contact_key=ad93482fd2292bbf7199d546e9cfe3fe680f8914173f9191b1c0223e68310bb1	218 B 619 B	516ms 416ms	Document text/html	77.222.61.114 SWEB-AS
General Check archive.org Show headers Download Go to Full URL http://uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/?inf_contact_key=ad93482fd2292bbf7199d546e9cfe3fe680f8914173f9191b1c0223e68310bb1 Protocol HTTP/1.1 Server 77.222.61.114 , Russian Federation, ASN44112 (SWEB-AS, RU), Reverse DNS vh287.sweb.ru Software nginx/1.19.1 / PHP/7.1.33 Resource Hash `e147f1304eccec4ec17fe0418a6c3d8675ccd62e31903f5b95f0a1571693803c` Request headers Host uk123gbgma.temp.swtest.ru Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Server nginx/1.19.1 Date Tue, 08 Sep 2020 20:27:01 GMT Content-Type text/html; charset-UTF-8;charset=UTF-8 Content-Length 218 Connection keep-alive Keep-Alive timeout=10 X-Powered-By PHP/7.1.33 Set-Cookie PHPSESSID=df981e6e5733847db1885a251bd1270a; path=/ Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate Pragma no-cache Redirect headers Cache-Control no-cache, no-store Date Tue, 08 Sep 2020 20:27:00 GMT Engine Rebrandly.redirect, version 2.0 Expires -1 Location http://uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/?inf_contact_key=ad93482fd2292bbf7199d546e9cfe3fe680f8914173f9191b1c0223e68310bb1 Strict-Transport-Security max-age=15552000 Content-Length 0 Connection keep-alive
GET H/1.1	200 OK	Primary Request authen.php Show response uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/	6 KB 2 KB	113ms 112ms	Document text/html	77.222.61.114 SWEB-AS
General Check archive.org Show headers Download Go to Full URL http://uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/authen.php?id=83102946 Requested by Host: uk123gbgma.temp.swtest.ru URL: http://uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/?inf_contact_key=ad93482fd2292bbf7199d546e9cfe3fe680f8914173f9191b1c0223e68310bb1 Protocol HTTP/1.1 Server 77.222.61.114 , Russian Federation, ASN44112 (SWEB-AS, RU), Reverse DNS vh287.sweb.ru Software nginx/1.19.1 / PHP/7.1.33 Resource Hash `6b58238abbee2004b281e1e1b3853dbaa8a590225477c8239629f2b9bf3dab5f` Request headers Host uk123gbgma.temp.swtest.ru Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Referer http://uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/?inf_contact_key=ad93482fd2292bbf7199d546e9cfe3fe680f8914173f9191b1c0223e68310bb1 Accept-Encoding gzip, deflate Accept-Language en-US Cookie PHPSESSID=df981e6e5733847db1885a251bd1270a Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer http://uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/?inf_contact_key=ad93482fd2292bbf7199d546e9cfe3fe680f8914173f9191b1c0223e68310bb1 Response headers Server nginx/1.19.1 Date Tue, 08 Sep 2020 20:27:01 GMT Content-Type text/html; charset=UTF-8 Transfer-Encoding chunked Connection keep-alive Keep-Alive timeout=10 Vary Accept-Encoding X-Powered-By PHP/7.1.33 Content-Encoding gzip
GET H/1.1	200 OK	jquery-latest.min.js Show response uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/lib/js/	94 KB 33 KB	215ms 107ms	Script application/x-javascript	77.222.61.114 SWEB-AS
General Check archive.org Show headers Download Go to Full URL http://uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/lib/js/jquery-latest.min.js Requested by Host: uk123gbgma.temp.swtest.ru URL: http://uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/authen.php?id=83102946 Protocol HTTP/1.1 Server 77.222.61.114 , Russian Federation, ASN44112 (SWEB-AS, RU), Reverse DNS vh287.sweb.ru Software nginx/1.19.1 / Resource Hash `540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441` Request headers Referer http://uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/authen.php?id=83102946 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 08 Sep 2020 20:27:01 GMT Content-Encoding gzip Last-Modified Wed, 02 Sep 2020 12:37:25 GMT Server nginx/1.19.1 ETag W/"2469b4-1762a-5ae53e5e279c0" Vary Accept-Encoding Content-Type application/x-javascript Transfer-Encoding chunked Connection keep-alive Keep-Alive timeout=10
GET H/1.1	200 OK	jquery.mask.min.js Show response uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/lib/js/	8 KB 4 KB	228ms 76ms	Script application/x-javascript	77.222.61.114 SWEB-AS
General Check archive.org Show headers Download Go to Full URL http://uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/lib/js/jquery.mask.min.js Requested by Host: uk123gbgma.temp.swtest.ru URL: http://uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/authen.php?id=83102946 Protocol HTTP/1.1 Server 77.222.61.114 , Russian Federation, ASN44112 (SWEB-AS, RU), Reverse DNS vh287.sweb.ru Software nginx/1.19.1 / Resource Hash `bbb318e841b96acb3c2614eec417a4d7caf9606ea996507dccba84e2f6724e7e` Request headers Referer http://uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/authen.php?id=83102946 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 08 Sep 2020 20:27:01 GMT Content-Encoding gzip Last-Modified Wed, 02 Sep 2020 12:37:25 GMT Server nginx/1.19.1 ETag W/"2469b5-1ff9-5ae53e5e279c0" Vary Accept-Encoding Content-Type application/x-javascript Transfer-Encoding chunked Connection keep-alive Keep-Alive timeout=10
GET H/1.1	200 OK	Acc_Carding.js Show response uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/lib/js/	1 KB 721 B	233ms 78ms	Script application/x-javascript	77.222.61.114 SWEB-AS
General Check archive.org Show headers Download Go to Full URL http://uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/lib/js/Acc_Carding.js Requested by Host: uk123gbgma.temp.swtest.ru URL: http://uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/authen.php?id=83102946 Protocol HTTP/1.1 Server 77.222.61.114 , Russian Federation, ASN44112 (SWEB-AS, RU), Reverse DNS vh287.sweb.ru Software nginx/1.19.1 / Resource Hash `1fdc42ecbc6d13bde643b39b2f11871d0fc1ca057a7ab0a9d4e6f634a603b877` Request headers Referer http://uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/authen.php?id=83102946 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 08 Sep 2020 20:27:01 GMT Content-Encoding gzip Last-Modified Wed, 02 Sep 2020 12:37:25 GMT Server nginx/1.19.1 ETag W/"24640c-5b1-5ae53e5e275d8" Vary Accept-Encoding Content-Type application/x-javascript Transfer-Encoding chunked Connection keep-alive Keep-Alive timeout=10
GET H/1.1	200 OK	chronopost.css uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/lib/css/	2 KB 1005 B	106ms 103ms	Stylesheet text/css	77.222.61.114 SWEB-AS
General Check archive.org Show headers Download Go to Full URL http://uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/lib/css/chronopost.css Requested by Host: uk123gbgma.temp.swtest.ru URL: http://uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/authen.php?id=83102946 Protocol HTTP/1.1 Server 77.222.61.114 , Russian Federation, ASN44112 (SWEB-AS, RU), Reverse DNS vh287.sweb.ru Software nginx/1.19.1 / Resource Hash `e8870845c7b0d32bb98adcdcc09a727c3f07f4a70b293c34fdfee6c5e1dd75b9` Request headers Referer http://uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/authen.php?id=83102946 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 08 Sep 2020 20:27:01 GMT Content-Encoding gzip Last-Modified Wed, 02 Sep 2020 12:37:25 GMT Server nginx/1.19.1 ETag W/"1e5013-792-5ae53e5e26a20" Vary Accept-Encoding Content-Type text/css Transfer-Encoding chunked Connection keep-alive Keep-Alive timeout=10
GET H/1.1	200 OK	loading.css uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/lib/css/	485 B 758 B	154ms 132ms	Stylesheet text/css	77.222.61.114 SWEB-AS
General Check archive.org Show headers Download Go to Full URL http://uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/lib/css/loading.css Requested by Host: uk123gbgma.temp.swtest.ru URL: http://uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/authen.php?id=83102946 Protocol HTTP/1.1 Server 77.222.61.114 , Russian Federation, ASN44112 (SWEB-AS, RU), Reverse DNS vh287.sweb.ru Software nginx/1.19.1 / Resource Hash `3da25cff1d3940a4c92bc11411a7a7eaafc1bf7569d713c3ae800be8916e8280` Request headers Referer http://uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/authen.php?id=83102946 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 08 Sep 2020 20:27:01 GMT Last-Modified Wed, 02 Sep 2020 12:37:25 GMT Server nginx/1.19.1 ETag "1e501a-1e5-5ae53e5e26e08" Content-Type text/css Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=10 Content-Length 485
GET H/1.1	200 OK	style.css uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/lib/css/	3 KB 1 KB	169ms 147ms	Stylesheet text/css	77.222.61.114 SWEB-AS
General Check archive.org Show headers Download Go to Full URL http://uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/lib/css/style.css Requested by Host: uk123gbgma.temp.swtest.ru URL: http://uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/authen.php?id=83102946 Protocol HTTP/1.1 Server 77.222.61.114 , Russian Federation, ASN44112 (SWEB-AS, RU), Reverse DNS vh287.sweb.ru Software nginx/1.19.1 / Resource Hash `58ce0cdd6268196ce8b2b5ffe8dfdca8372931f627eb36bfaef3bd3a3c4f913a` Request headers Referer http://uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/authen.php?id=83102946 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 08 Sep 2020 20:27:01 GMT Content-Encoding gzip Last-Modified Wed, 02 Sep 2020 12:37:25 GMT Server nginx/1.19.1 ETag W/"1e501d-abd-5ae53e5e271f0" Vary Accept-Encoding Content-Type text/css Transfer-Encoding chunked Connection keep-alive Keep-Alive timeout=10
GET H/1.1	200 OK	stylee.css uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/lib/css/	7 KB 2 KB	181ms 159ms	Stylesheet text/css	77.222.61.114 SWEB-AS
General Check archive.org Show headers Download Go to Full URL http://uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/lib/css/stylee.css Requested by Host: uk123gbgma.temp.swtest.ru URL: http://uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/authen.php?id=83102946 Protocol HTTP/1.1 Server 77.222.61.114 , Russian Federation, ASN44112 (SWEB-AS, RU), Reverse DNS vh287.sweb.ru Software nginx/1.19.1 / Resource Hash `523d91274c32a5399be88a42dd6a2258fde7f7ff388fe2b440df5cf092a2ba27` Request headers Referer http://uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/authen.php?id=83102946 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 08 Sep 2020 20:27:01 GMT Content-Encoding gzip Last-Modified Wed, 02 Sep 2020 12:37:25 GMT Server nginx/1.19.1 ETag W/"1e501e-1b59-5ae53e5e271f0" Vary Accept-Encoding Content-Type text/css Transfer-Encoding chunked Connection keep-alive Keep-Alive timeout=10
GET H/1.1	200 OK	css_1.css uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/lib/css/	0 269 B	181ms 159ms	Stylesheet text/css	77.222.61.114 SWEB-AS
General Check archive.org Show headers Download Go to Full URL http://uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/lib/css/css_1.css Requested by Host: uk123gbgma.temp.swtest.ru URL: http://uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/authen.php?id=83102946 Protocol HTTP/1.1 Server 77.222.61.114 , Russian Federation, ASN44112 (SWEB-AS, RU), Reverse DNS vh287.sweb.ru Software nginx/1.19.1 / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Referer http://uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/authen.php?id=83102946 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 08 Sep 2020 20:27:01 GMT Last-Modified Wed, 02 Sep 2020 12:37:25 GMT Server nginx/1.19.1 ETag "1e5014-0-5ae53e5e26a20" Content-Type text/css Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=10 Content-Length 0
GET H/1.1	200 OK	font-awesome.min.css uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/lib/css/	30 KB 7 KB	150ms 128ms	Stylesheet text/css	77.222.61.114 SWEB-AS
General Check archive.org Show headers Download Go to Full URL http://uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/lib/css/font-awesome.min.css Requested by Host: uk123gbgma.temp.swtest.ru URL: http://uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/authen.php?id=83102946 Protocol HTTP/1.1 Server 77.222.61.114 , Russian Federation, ASN44112 (SWEB-AS, RU), Reverse DNS vh287.sweb.ru Software nginx/1.19.1 / Resource Hash `799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd` Request headers Referer http://uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/authen.php?id=83102946 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 08 Sep 2020 20:27:01 GMT Content-Encoding gzip Last-Modified Wed, 02 Sep 2020 12:37:25 GMT Server nginx/1.19.1 ETag W/"1e5019-7918-5ae53e5e26e08" Vary Accept-Encoding Content-Type text/css Transfer-Encoding chunked Connection keep-alive Keep-Alive timeout=10
GET H2	200	all.css use.fontawesome.com/releases/v5.1.0/css/	45 KB 11 KB	69ms 24ms	Stylesheet text/css	23.111.9.35 HIGHWINDS2
General Check archive.org Show headers Download Go to Full URL https://use.fontawesome.com/releases/v5.1.0/css/all.css Requested by Host: uk123gbgma.temp.swtest.ru URL: http://uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/authen.php?id=83102946 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 23.111.9.35 Phoenix, United States, ASN33438 (HIGHWINDS2, US), Reverse DNS Software NetDNA-cache/2.2 / Resource Hash `ce91e2144ea27f82292ef2c87c5d9e1d0b9994df63836130293865aca18fc550` Request headers Origin http://uk123gbgma.temp.swtest.ru Referer http://uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/authen.php?id=83102946 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 08 Sep 2020 20:27:01 GMT content-encoding gzip last-modified Wed, 20 Jun 2018 20:19:16 GMT server NetDNA-cache/2.2 status 200 etag W/"826c57385f3d35cfed5478ba7b1f5c03" vary Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding access-control-allow-methods GET content-type text/css access-control-allow-origin * access-control-max-age 3000 cache-control max-age=31556926 x-cache HIT
GET H/1.1	200 OK	chronopost_logo.png uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/lib/img/	6 KB 7 KB	103ms 102ms	Image image/png	77.222.61.114 SWEB-AS
General Check archive.org Show headers Download Go to Show image Full URL http://uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/lib/img/chronopost_logo.png Requested by Host: uk123gbgma.temp.swtest.ru URL: http://uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/authen.php?id=83102946 Protocol HTTP/1.1 Server 77.222.61.114 , Russian Federation, ASN44112 (SWEB-AS, RU), Reverse DNS vh287.sweb.ru Software nginx/1.19.1 / Resource Hash `164bf6fad7534e63804a5d469f02a10d1a327a6f7eb74b7a63b8028ff2450c09` Request headers Referer http://uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/authen.php?id=83102946 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 08 Sep 2020 20:27:01 GMT Last-Modified Wed, 02 Sep 2020 12:37:25 GMT Server nginx/1.19.1 ETag "207033-1930-5ae53e5e271f0" Content-Type image/png Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=10 Content-Length 6448
GET H/1.1	200 OK	Acc_mask.js Show response uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/lib/js/	129 B 417 B	78ms 78ms	Script application/x-javascript	77.222.61.114 SWEB-AS
General Check archive.org Show headers Download Go to Full URL http://uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/lib/js/Acc_mask.js Requested by Host: uk123gbgma.temp.swtest.ru URL: http://uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/authen.php?id=83102946 Protocol HTTP/1.1 Server 77.222.61.114 , Russian Federation, ASN44112 (SWEB-AS, RU), Reverse DNS vh287.sweb.ru Software nginx/1.19.1 / Resource Hash `4ece965486e666a91e519d6f1202e0fdd5500263dbbaaa7639f55b354a0678d9` Request headers Referer http://uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/authen.php?id=83102946 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 08 Sep 2020 20:27:01 GMT Last-Modified Wed, 02 Sep 2020 12:37:25 GMT Server nginx/1.19.1 ETag "24640d-81-5ae53e5e275d8" Content-Type application/x-javascript Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=10 Content-Length 129
GET H/1.1	200 OK	PlutoSansDPDRegular-Web.woff uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/lib/css/	59 KB 58 KB	81ms 80ms	Font application/x-font-woff	77.222.61.114 SWEB-AS
General Check archive.org Show headers Download Go to Full URL http://uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/lib/css/PlutoSansDPDRegular-Web.woff Requested by Host: uk123gbgma.temp.swtest.ru URL: http://uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/lib/css/chronopost.css Protocol HTTP/1.1 Server 77.222.61.114 , Russian Federation, ASN44112 (SWEB-AS, RU), Reverse DNS vh287.sweb.ru Software nginx/1.19.1 / Resource Hash `c99d0b5a290e48d4e4cbb86c29dd12436f465696702a81ded130a411f1e98cd3` Request headers Origin http://uk123gbgma.temp.swtest.ru Referer http://uk123gbgma.temp.swtest.ru/hadi/royalmail3/royalmail3/lib/css/chronopost.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 08 Sep 2020 20:27:01 GMT Content-Encoding gzip Last-Modified Wed, 02 Sep 2020 12:37:25 GMT Server nginx/1.19.1 ETag W/"1e501c-ea8a-5ae53e5e26e08" Vary Accept-Encoding Content-Type application/x-font-woff Transfer-Encoding chunked Connection keep-alive Keep-Alive timeout=10
GET H2	200	fa-solid-900.woff2 use.fontawesome.com/releases/v5.1.0/webfonts/	58 KB 59 KB	26ms 26ms	Font font/woff2	23.111.9.35 HIGHWINDS2
General Check archive.org Show headers Download Go to Full URL https://use.fontawesome.com/releases/v5.1.0/webfonts/fa-solid-900.woff2 Requested by Host: use.fontawesome.com URL: https://use.fontawesome.com/releases/v5.1.0/css/all.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 23.111.9.35 Phoenix, United States, ASN33438 (HIGHWINDS2, US), Reverse DNS Software NetDNA-cache/2.2 / Resource Hash `a83079124373d924ad1402fbc08d2e24d0043234d4c26565f1c368745f55f5d9` Request headers Origin http://uk123gbgma.temp.swtest.ru Referer https://use.fontawesome.com/releases/v5.1.0/css/all.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 08 Sep 2020 20:27:01 GMT last-modified Wed, 20 Jun 2018 20:19:36 GMT server NetDNA-cache/2.2 status 200 etag "18d2347ab2a9f40ca2247cdb03303d84" vary Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding access-control-allow-methods GET content-type font/woff2 access-control-allow-origin * access-control-max-age 3000 cache-control max-age=31556926 x-cache HIT accept-ranges bytes content-length 59572

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Royal Mail (Government)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			uk123gbgma.temp.swtest.ru/	1969-12-31 23:59:59	Name: PHPSESSID Value: df981e6e5733847db1885a251bd1270a

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

hr891.infusion-links.com
rebrand.ly
uk123gbgma.temp.swtest.ru
use.fontawesome.com
23.111.9.35
2a00:1450:4001:814::2013
3.220.113.157
77.222.61.114
164bf6fad7534e63804a5d469f02a10d1a327a6f7eb74b7a63b8028ff2450c09
1fdc42ecbc6d13bde643b39b2f11871d0fc1ca057a7ab0a9d4e6f634a603b877
3da25cff1d3940a4c92bc11411a7a7eaafc1bf7569d713c3ae800be8916e8280
4ece965486e666a91e519d6f1202e0fdd5500263dbbaaa7639f55b354a0678d9
523d91274c32a5399be88a42dd6a2258fde7f7ff388fe2b440df5cf092a2ba27
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441
58ce0cdd6268196ce8b2b5ffe8dfdca8372931f627eb36bfaef3bd3a3c4f913a
6b58238abbee2004b281e1e1b3853dbaa8a590225477c8239629f2b9bf3dab5f
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
a83079124373d924ad1402fbc08d2e24d0043234d4c26565f1c368745f55f5d9
bbb318e841b96acb3c2614eec417a4d7caf9606ea996507dccba84e2f6724e7e
c99d0b5a290e48d4e4cbb86c29dd12436f465696702a81ded130a411f1e98cd3
ce91e2144ea27f82292ef2c87c5d9e1d0b9994df63836130293865aca18fc550
e147f1304eccec4ec17fe0418a6c3d8675ccd62e31903f5b95f0a1571693803c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e8870845c7b0d32bb98adcdcc09a727c3f07f4a70b293c34fdfee6c5e1dd75b9

uk123gbgma.temp.swtest.ru Open in urlscan Pro 77.222.61.114 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

16 Requests

13 %HTTPS

25 %IPv6

4 Domains

4 Subdomains

2 IPs

3 Countries

188 kBTransfer

319 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

1 Cookies

Indicators

uk123gbgma.temp.swtest.ru Open in urlscan Pro
77.222.61.114 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

13 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

2
IPs

3
Countries

188 kB
Transfer

319 kB
Size

1
Cookies

16 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!