pl.postservices.net
Open in
urlscan Pro
2606:4700:30::681b:8d90
Malicious Activity!
Public Scan
Effective URL: https://pl.postservices.net/l/plbrand1i/index.html
Submission: On September 04 via manual from PL
Summary
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on July 26th 2019. Valid for: a year.
This is the only time pl.postservices.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Allegro (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
19 | 2606:4700:30:... 2606:4700:30::681b:8d90 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
22 | 2 |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
pl.postservices.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
19 |
postservices.net
pl.postservices.net |
386 KB |
0 |
winner-r.space
Failed
winner-r.space Failed |
|
22 | 2 |
Domain | Requested by | |
---|---|---|
19 | pl.postservices.net |
pl.postservices.net
|
0 | winner-r.space Failed |
pl.postservices.net
|
22 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com CloudFlare Inc ECC CA-2 |
2019-07-26 - 2020-07-25 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://pl.postservices.net/l/plbrand1i/index.html
Frame ID: 556FAF736E6A90AAC0DFACBAF7C67232
Requests: 22 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
22 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
index.html
pl.postservices.net/l/plbrand1i/ |
39 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
pl.postservices.net/l/plbrand1i/ |
118 KB 18 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bundle_tm.css
pl.postservices.net/l/plbrand1i/ |
43 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
pl.postservices.net/l/plbrand1i/ |
85 KB 29 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.svg
pl.postservices.net/l/plbrand1i/ |
2 KB 966 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
iphonex.png
pl.postservices.net/l/plbrand1i/ |
36 KB 37 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1497184421_ipad.png
pl.postservices.net/l/plbrand1i/ |
10 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
faceza1.jpg
pl.postservices.net/l/plbrand1i/ |
48 KB 49 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
faceza2.jpg
pl.postservices.net/l/plbrand1i/ |
51 KB 51 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
faceza7.jpg
pl.postservices.net/l/plbrand1i/ |
37 KB 37 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
faceza3.jpg
pl.postservices.net/l/plbrand1i/ |
20 KB 20 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
faceza4.jpg
pl.postservices.net/l/plbrand1i/ |
31 KB 31 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
faceza5.jpg
pl.postservices.net/l/plbrand1i/ |
37 KB 37 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
faceza6.jpg
pl.postservices.net/l/plbrand1i/ |
25 KB 25 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ale.jpg
pl.postservices.net/l/plbrand1i/ |
2 KB 2 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bundle_pl.js
pl.postservices.net/l/plbrand1i/ |
22 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tm-line.png
pl.postservices.net/l/plbrand1i/ |
950 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.js
pl.postservices.net/l/plbrand1i/ |
36 KB 9 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
glyphicons-halflings-regular.woff2
winner-r.space/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
glyphicons-halflings-regular.woff
winner-r.space/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
glyphicons-halflings-regular.ttf
winner-r.space/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cart1.png
pl.postservices.net/l/plbrand1i/ |
11 KB 11 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- winner-r.space
- URL
- http://winner-r.space/fonts/glyphicons-halflings-regular.woff2
- Domain
- winner-r.space
- URL
- http://winner-r.space/fonts/glyphicons-halflings-regular.woff
- Domain
- winner-r.space
- URL
- http://winner-r.space/fonts/glyphicons-halflings-regular.ttf
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Allegro (Banking)14 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery object| Helper function| _typeof object| Jingle object| Timer object| Magic undefined| Quiz object| tingle function| alertUser object| d object| weekday object| month object| mydate1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.postservices.net/ | Name: __cfduid Value: de54519a80e2ad9df0fb70560a699805b1567583655 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Content-Type-Options | nosniff |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
pl.postservices.net
winner-r.space
winner-r.space
2606:4700:30::681b:8d90
4ad1f95123cc6cbe7ba0754c8e07f4f17ce2f6dc1fd538b29a14b94b80746249
53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef
5a0cdb60cabf82cdaca1dbc67a15af987085beea1a7cdcb8d8124e4ca4adc001
6aca0e03c5518a91213bd327a62e77db8fb63f5f53731793f97da3c047ff1787
900f92fa26cb95bc4400fb782c6669161ed292ac96495fd4b6e94fa9dff01a5e
907a799bbe2549ed29a908857218363419308345bedead62502b89beddf98b39
91e46fbc6b462178a08b0b025b4897cb7523fe4ef32ab05faeb706c21636afe1
a28ccf8a7b50522bdeea0cd83cdeca221c18fc1f9df3ee6b3d3c48d599206855
a3bbd4fb51714225c15ccde5220f709dda2b215a68954b1de24ef4dd6087bd64
a530ace2f4419eecd1ab869274188c3454976bd6246b95e23ddfc8a20490c5b4
b64b5ce18c7b94ab7075417fcf01277b8cefa195c1771b216d24f2888ec5e36d
b9d086ae89029852c31721c6ce8fc9a6c9a49d175f5117686f53dbdd8fee1573
bbd39831fcc22ed1519ea5064b546b21bc28d1dbd29826aefd1c17cceb186ae6
c31b5b2b098ba6a5c06992ae6d5a76347d430f782411ae356f77cab22e423785
c4300eb27c02b91fa6f293a16af58f8340273dfe1c7130e99e229c232cba62c9
c8632b8cb73b24f7669664256fac4c3e0d093f9a6bcfd959c7c38efe11c5e527
d27bca8268f4c776b63bcd6ace6856c54d7f71049d572b4b8e0275e812aaec59
faf968d6bc328124d03e0268bf805e477ef7980d75d816ae8170fedcb1d1064d
fdfeb8152d37218251edbbcfabd8eb7926da98ddf81a2c9ee8fa66029fdaebb6