postnord-dk-office.91-223-169-237.cprapid.com Open in urlscan Pro
91.223.169.237 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://postnord-dk-office.91-223-169-237.cprapid.com/
Effective URL:
https://postnord-dk-office.91-223-169-237.cprapid.com/.PostNord.A.S/a1b2c3/b9ee5d09175e67613f8947febe75f8d7/login/
Submission Tags: @ecarlesi threat #phishing Search All
Submission: On October 26 via api (October 26th 2023, 9:48:12 pm UTC) from FR — Scanned from DK

Summary HTTP 2 Redirects Links 9 Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 2 HTTP transactions. The main IP is 91.223.169.237, located in Stockholm, Sweden and belongs to KAMATERA, US. The main domain is postnord-dk-office.91-223-169-237.cprapid.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on October 26th 2023. Valid for: 3 months.

This is the only time postnord-dk-office.91-223-169-237.cprapid.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address		AS Autonomous System
3 5	91.223.169.237 91.223.169.237		36007 (KAMATERA) (KAMATERA)
2	2

5 91.223.169.237 (Stockholm, Sweden) 3 redirects

ASN36007 (KAMATERA, US)

postnord-dk-office.91-223-169-237.cprapid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	cprapid.com 3 redirects postnord-dk-office.91-223-169-237.cprapid.com	1 MB
2	1

	Domain	Requested by
5	postnord-dk-office.91-223-169-237.cprapid.com	3 redirects
2	1

This site contains links to these domains. Also see Links.

Domain
apps.apple.com
play.google.com
portal.postnord.com
netbutik.postnord.dk
logistics.postnord.dk
kundeservice.postnord.dk
www.postnord.com
www.facebook.com
www.findsmiley.dk

Subject Issuer	Validity	Valid
postnord-dk-office.91-223-169-237.cprapid.com cPanel, Inc. Certification Authority	`2023-10-26` - `2024-01-24`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://postnord-dk-office.91-223-169-237.cprapid.com/.PostNord.A.S/a1b2c3/b9ee5d09175e67613f8947febe75f8d7/login/
Frame ID: 694884E3F42E00336252A40404F07B53
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Spor dine forsendelser med Track og Trace | PostNorddisruption-banner-iconangle-small-rightangle-small-right

Page URL History Show full URLs

http://postnord-dk-office.91-223-169-237.cprapid.com/ HTTP 302
https://postnord-dk-office.91-223-169-237.cprapid.com/.PostNord.A.S/index.php Page URL
https://postnord-dk-office.91-223-169-237.cprapid.com/.PostNord.A.S/a1b2c3/b9ee5d09175e67613f8947febe75f8d7 HTTP 301
https://postnord-dk-office.91-223-169-237.cprapid.com/.PostNord.A.S/a1b2c3/b9ee5d09175e67613f8947febe75f8d7/ HTTP 302
https://postnord-dk-office.91-223-169-237.cprapid.com/.PostNord.A.S/a1b2c3/b9ee5d09175e67613f8947febe75f8d7/login/ Page URL

Detected technologies

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

Page Statistics

2
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

1286 kB
Transfer

1286 kB
Size

2
Cookies

9 Outgoing links

These are links going to different origins than the main page.

URL: https://apps.apple.com/dk/app/postnord/id396871673?l=da
Title: Brug appen

Search URL Search Domain Scan URL

URL: https://play.google.com/store/apps/details?id=se.postnord.private&hl=da&gl=DK
Title: Brug appen

Search URL Search Domain Scan URL

URL: https://portal.postnord.com/?market=DK&cta=loginDK
Title: Kundeportalen

Search URL Search Domain Scan URL

URL: https://netbutik.postnord.dk/
Title: Netbutik

Search URL Search Domain Scan URL

URL: http://logistics.postnord.dk/login
Title: Gods Online

Search URL Search Domain Scan URL

URL: https://kundeservice.postnord.dk/s/?language=da
Title: Kundeservice - Privat

Search URL Search Domain Scan URL

URL: https://www.postnord.com/da/karriere/arbejd-hos-os
Title: Ledige jobs

Search URL Search Domain Scan URL

URL: https://www.facebook.com/PostNordDK

Search URL Search Domain Scan URL

URL: https://www.findsmiley.dk/Sider/Search.aspx?k=20148586%20OR%2026663903%20OR%2026115396
Title: Smiley-ordningen

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://postnord-dk-office.91-223-169-237.cprapid.com/ HTTP 302
https://postnord-dk-office.91-223-169-237.cprapid.com/.PostNord.A.S/index.php Page URL
https://postnord-dk-office.91-223-169-237.cprapid.com/.PostNord.A.S/a1b2c3/b9ee5d09175e67613f8947febe75f8d7 HTTP 301
https://postnord-dk-office.91-223-169-237.cprapid.com/.PostNord.A.S/a1b2c3/b9ee5d09175e67613f8947febe75f8d7/ HTTP 302
https://postnord-dk-office.91-223-169-237.cprapid.com/.PostNord.A.S/a1b2c3/b9ee5d09175e67613f8947febe75f8d7/login/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://postnord-dk-office.91-223-169-237.cprapid.com/ HTTP 302
https://postnord-dk-office.91-223-169-237.cprapid.com/.PostNord.A.S/index.php

2 HTTP transactions
8 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	index.php Show response postnord-dk-office.91-223-169-237.cprapid.com/.PostNord.A.S/ Redirect Chain http://postnord-dk-office.91-223-169-237.cprapid.com/ https://postnord-dk-office.91-223-169-237.cprapid.com/.PostNord.A.S/index.php	632 B 861 B	128ms 56ms	Document text/html	91.223.169.237 KAMATERA
General Check archive.org Show headers Download Go to Full URL https://postnord-dk-office.91-223-169-237.cprapid.com/.PostNord.A.S/index.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 91.223.169.237 Stockholm, Sweden, ASN36007 (KAMATERA, US), Reverse DNS Software Apache / Resource Hash `7feaf70193d7a90f1c2af7e45b011290ed46a204c8c6beeb417673a1b503b3a8` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 accept-language da-DK,da;q=0.9 Response headers Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Thu, 26 Oct 2023 21:48:07 GMT Keep-Alive timeout=5, max=100 Server Apache Transfer-Encoding chunked Redirect headers Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Thu, 26 Oct 2023 21:48:07 GMT Keep-Alive timeout=5, max=100 Server Apache Transfer-Encoding chunked location https://postnord-dk-office.91-223-169-237.cprapid.com/.PostNord.A.S/index.php
GET H/1.1	200 OK	Primary Request / Show response postnord-dk-office.91-223-169-237.cprapid.com/.PostNord.A.S/a1b2c3/b9ee5d09175e67613f8947febe75f8d7/login/ Redirect Chain https://postnord-dk-office.91-223-169-237.cprapid.com/.PostNord.A.S/a1b2c3/b9ee5d09175e67613f8947febe75f8d7? https://postnord-dk-office.91-223-169-237.cprapid.com/.PostNord.A.S/a1b2c3/b9ee5d09175e67613f8947febe75f8d7/? https://postnord-dk-office.91-223-169-237.cprapid.com/.PostNord.A.S/a1b2c3/b9ee5d09175e67613f8947febe75f8d7/login/?	1 MB 1 MB	54ms 53ms	Document text/html	91.223.169.237 KAMATERA
General Check archive.org Show headers Download Go to Full URL https://postnord-dk-office.91-223-169-237.cprapid.com/.PostNord.A.S/a1b2c3/b9ee5d09175e67613f8947febe75f8d7/login/? Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 91.223.169.237 Stockholm, Sweden, ASN36007 (KAMATERA, US), Reverse DNS Software Apache / Resource Hash `3526015c0f4a1153b86e97290c0693721f25db82a933f6f7553d915d8d1e6146` Request headers Referer https://postnord-dk-office.91-223-169-237.cprapid.com/.PostNord.A.S/index.php Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 accept-language da-DK,da;q=0.9 Response headers Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Thu, 26 Oct 2023 21:48:09 GMT Keep-Alive timeout=5, max=97 Server Apache Transfer-Encoding chunked Redirect headers Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Thu, 26 Oct 2023 21:48:08 GMT Keep-Alive timeout=5, max=98 Server Apache Transfer-Encoding chunked location login/?
GET DATA	200 OK	truncated /	2 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `ec37cb89f3f377b4aa80c1e3436c6834e6441d8837d7c19d464e1cc96e9d6ece` Request headers accept-language da-DK,da;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	23 KB 23 KB		Font image/woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `e5b1ff1ff6c566174e53ad8a64a632b83f520f73a9d8c3a54e4d697dcc1dec2c` Request headers Referer Origin https://postnord-dk-office.91-223-169-237.cprapid.com accept-language da-DK,da;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 Response headers Content-Type image/woff
GET DATA	200 OK	truncated /	23 KB 23 KB		Font image/woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `d75a0592ebbc4991535da046298cde7954fe9a9ae5508d062bed24e1b185706f` Request headers Referer Origin https://postnord-dk-office.91-223-169-237.cprapid.com accept-language da-DK,da;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 Response headers Content-Type image/woff
GET DATA	200 OK	truncated /	23 KB 23 KB		Font image/woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `38d1f2e8a0124d26a0b5c02bed82972042488e9272434564932a6e6a9925efb1` Request headers Referer Origin https://postnord-dk-office.91-223-169-237.cprapid.com accept-language da-DK,da;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 Response headers Content-Type image/woff
GET DATA	200 OK	truncated /	25 KB 25 KB		Font application/x-font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `93914d4538d1d68f086a4650fcaa932e8597caa2c86072650a44e9e7589955ff` Request headers Referer Origin https://postnord-dk-office.91-223-169-237.cprapid.com accept-language da-DK,da;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 Response headers Content-Type application/x-font-woff
GET DATA	200 OK	truncated /	26 KB 26 KB		Font application/x-font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `7e113240915eaee7a6b2ac0f50df00b852c409f6e9ec94067081dd24be92f214` Request headers Referer Origin https://postnord-dk-office.91-223-169-237.cprapid.com accept-language da-DK,da;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 Response headers Content-Type application/x-font-woff
GET DATA	200 OK	truncated /	27 KB 27 KB		Font application/x-font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `6f78aac65f196e103c049969af692b75300c6ee41ece2df98293918edceca448` Request headers Referer Origin https://postnord-dk-office.91-223-169-237.cprapid.com accept-language da-DK,da;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 Response headers Content-Type application/x-font-woff
GET DATA	200 OK	truncated /	24 KB 24 KB		Font image/woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `e8cd09dc6968a0009fb2ae2ea7f25095e3eb2a22fa65d0f45e4ccee029c3fcec` Request headers Referer Origin https://postnord-dk-office.91-223-169-237.cprapid.com accept-language da-DK,da;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 Response headers Content-Type image/woff

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture function| savepage_ShadowLoader

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			postnord-dk-office.91-223-169-237.cprapid.com/.PostNord.A.S	1969-12-31 23:59:59	Name: real Value: OK
			postnord-dk-office.91-223-169-237.cprapid.com/	1970-01-20 16:29:08	Name: bid Value: b9ee5d09175e67613f8947febe75f8d7

6 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://postnord-dk-office.91-223-169-237.cprapid.com/.PostNord.A.S/a1b2c3/b9ee5d09175e67613f8947febe75f8d7/login/?(Line 51) Message: <link rel=preload> has an invalid `href` value
other	warning	URL: https://postnord-dk-office.91-223-169-237.cprapid.com/.PostNord.A.S/a1b2c3/b9ee5d09175e67613f8947febe75f8d7/login/?(Line 52) Message: <link rel=preload> has an invalid `href` value
other	warning	URL: https://postnord-dk-office.91-223-169-237.cprapid.com/.PostNord.A.S/a1b2c3/b9ee5d09175e67613f8947febe75f8d7/login/?(Line 53) Message: <link rel=preload> has an invalid `href` value
other	warning	URL: https://postnord-dk-office.91-223-169-237.cprapid.com/.PostNord.A.S/a1b2c3/b9ee5d09175e67613f8947febe75f8d7/login/?(Line 54) Message: <link rel=preload> has an invalid `href` value
other	warning	URL: https://postnord-dk-office.91-223-169-237.cprapid.com/.PostNord.A.S/a1b2c3/b9ee5d09175e67613f8947febe75f8d7/login/?(Line 55) Message: <link rel=preload> has an invalid `href` value
other	warning	URL: https://postnord-dk-office.91-223-169-237.cprapid.com/.PostNord.A.S/a1b2c3/b9ee5d09175e67613f8947febe75f8d7/login/?(Line 57) Message: <link rel=preload> has an invalid `href` value

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

postnord-dk-office.91-223-169-237.cprapid.com
91.223.169.237
3526015c0f4a1153b86e97290c0693721f25db82a933f6f7553d915d8d1e6146
38d1f2e8a0124d26a0b5c02bed82972042488e9272434564932a6e6a9925efb1
6f78aac65f196e103c049969af692b75300c6ee41ece2df98293918edceca448
7e113240915eaee7a6b2ac0f50df00b852c409f6e9ec94067081dd24be92f214
7feaf70193d7a90f1c2af7e45b011290ed46a204c8c6beeb417673a1b503b3a8
93914d4538d1d68f086a4650fcaa932e8597caa2c86072650a44e9e7589955ff
d75a0592ebbc4991535da046298cde7954fe9a9ae5508d062bed24e1b185706f
e5b1ff1ff6c566174e53ad8a64a632b83f520f73a9d8c3a54e4d697dcc1dec2c
e8cd09dc6968a0009fb2ae2ea7f25095e3eb2a22fa65d0f45e4ccee029c3fcec
ec37cb89f3f377b4aa80c1e3436c6834e6441d8837d7c19d464e1cc96e9d6ece

postnord-dk-office.91-223-169-237.cprapid.com Open in urlscan Pro 91.223.169.237 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

2 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

1286 kBTransfer

1286 kBSize

2 Cookies

9 Outgoing links

Page URL History

Redirected requests

2 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 8 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

2 Cookies

6 Console Messages

Indicators

postnord-dk-office.91-223-169-237.cprapid.com Open in urlscan Pro
91.223.169.237 Public Scan

Screenshot
Live screenshot

Full Image

2
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

1286 kB
Transfer

1286 kB
Size

2
Cookies

2 HTTP transactions
8 data transactions