bqhuir70i.wusps.xyz Open in urlscan Pro
154.91.158.162  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request index.html Show response bqhuir70i.wusps.xyz/index/usps/	23 KB 4 KB	673ms 257ms	Document text/html	154.91.158.162 CLOUDDATA-NETWORKS-1
General Check archive.org Show headers Download Go to Full URL https://bqhuir70i.wusps.xyz/index/usps/index.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 154.91.158.162 , Hong Kong, ASN399955 (CLOUDDATA-NETWORKS-1, US), Reverse DNS Software nginx / Resource Hash d58912bed66ab9fc2d9f1d0fd50626a3bcfcf9502b7111871b57ddca0f6c8c6e Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers content-encoding gzip content-type text/html; charset=utf-8 date Wed, 27 Jul 2022 01:17:47 GMT server nginx strict-transport-security max-age=31536000 vary Accept-Encoding
GET H2	200	9634b14e-481f-de9c-1147-45f3cb27e143.png mcusercontent.com/5f0738438c34e2c4615011078/images/	7 KB 8 KB	70ms 16ms	Image image/png	34.96.122.219 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://mcusercontent.com/5f0738438c34e2c4615011078/images/9634b14e-481f-de9c-1147-45f3cb27e143.png Requested by Host: bqhuir70i.wusps.xyz URL: https://bqhuir70i.wusps.xyz/index/usps/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.96.122.219 Kansas City, United States, ASN15169 (GOOGLE, US), Reverse DNS 219.122.96.34.bc.googleusercontent.com Software UploadServer / Resource Hash f7349b4bf958eab82fbea0cc42ebab340b68add1d602b4a01200c6530e02020e Request headers accept-language de-DE,de;q=0.9 Referer https://bqhuir70i.wusps.xyz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36 Response headers date Wed, 27 Jul 2022 01:10:52 GMT age 461 x-guploader-uploadid ADPycduQ8w2T9Dkt7qWYsgSRskjxgL19aKQPzoQGNq_MZw2_UjWqoGBoLbX0ii3d0nzLfvjZjUd98WGt8Jyrj6EvhRfPAt5xxWe9 x-goog-storage-class MULTI_REGIONAL x-goog-metageneration 1 x-goog-stored-content-encoding identity alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 7398 last-modified Tue, 08 Feb 2022 22:34:02 GMT server UploadServer etag "e52a6d24dce4dad49980d7f6af85c355" x-goog-hash crc32c=YBsnWA==, md5=5SptJNzk2tSZgNf2r4XDVQ== x-goog-generation 1644359642060574 cache-control public, max-age=3600 x-goog-stored-content-length 7398 accept-ranges bytes content-type image/png expires Wed, 27 Jul 2022 02:10:52 GMT
GET H2	404	sZUk bqhuir70i.wusps.xyz/V9VVj/NQShh/er/gdX_/0C60/f7iYpkcLaN3r/QlM4AQE/YDQsTSR/	0 0	240ms 240ms	Script text/html	154.91.158.162 CLOUDDATA-NETWORKS-1
General Check archive.org Show headers Download Go to Full URL https://bqhuir70i.wusps.xyz/V9VVj/NQShh/er/gdX_/0C60/f7iYpkcLaN3r/QlM4AQE/YDQsTSR/sZUk Requested by Host: bqhuir70i.wusps.xyz URL: https://bqhuir70i.wusps.xyz/index/usps/index.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 154.91.158.162 , Hong Kong, ASN399955 (CLOUDDATA-NETWORKS-1, US), Reverse DNS Software nginx / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer https://bqhuir70i.wusps.xyz/index/usps/index.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36 Response headers date Wed, 27 Jul 2022 01:17:47 GMT content-encoding gzip server nginx vary Accept-Encoding content-type text/html; charset=utf-8

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: USPS (Transportation)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://bqhuir70i.wusps.xyz/V9VVj/NQShh/er/gdX_/0C60/f7iYpkcLaN3r/QlM4AQE/YDQsTSR/sZUk Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bqhuir70i.wusps.xyz
mcusercontent.com
154.91.158.162
34.96.122.219
d58912bed66ab9fc2d9f1d0fd50626a3bcfcf9502b7111871b57ddca0f6c8c6e
f7349b4bf958eab82fbea0cc42ebab340b68add1d602b4a01200c6530e02020e