aupost.biz Open in urlscan Pro
204.44.70.48  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response aupost.biz/	78 B 231 B	638ms 146ms	Document text/html	204.44.70.48 PACIFICRACK
General Check archive.org Show headers Download Go to Full URL https://aupost.biz/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 204.44.70.48 Los Angeles, United States, ASN64270 (PACIFICRACK, US), Reverse DNS 204.44.70.48.static.quadranet.com Software nginx / Resource Hash 13a33a939e609d7200b09962ee7bed474e86e1f0ac7641791667d6a28eb4c1db Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers accept-ranges bytes content-length 78 content-type text/html date Wed, 07 Jun 2023 10:12:07 GMT etag "646f8141-4e" last-modified Thu, 25 May 2023 15:39:45 GMT server nginx strict-transport-security max-age=31536000
GET H2	200	ua.js Show response aupost.biz/static/js/	1 KB 625 B	146ms 146ms	Script application/javascript	204.44.70.48 PACIFICRACK
General Check archive.org Show headers Download Go to Full URL https://aupost.biz/static/js/ua.js Requested by Host: aupost.biz URL: https://aupost.biz/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 204.44.70.48 Los Angeles, United States, ASN64270 (PACIFICRACK, US), Reverse DNS 204.44.70.48.static.quadranet.com Software nginx / Resource Hash 41e9231f90ce266c465bf941d6ab8a289a3146bc0bdeabc11e24ccc5d8bd1426 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://aupost.biz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Wed, 07 Jun 2023 10:12:08 GMT strict-transport-security max-age=31536000 content-encoding gzip last-modified Fri, 03 Mar 2023 17:36:00 GMT server nginx etag W/"64023000-480" vary Accept-Encoding content-type application/javascript cache-control max-age=43200 expires Wed, 07 Jun 2023 22:12:08 GMT
GET H2	200	imageSpin.css aupost.biz/static/css/	395 B 599 B	147ms 146ms	Stylesheet text/css	204.44.70.48 PACIFICRACK
General Check archive.org Show headers Download Go to Full URL https://aupost.biz/static/css/imageSpin.css Requested by Host: aupost.biz URL: https://aupost.biz/static/js/ua.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 204.44.70.48 Los Angeles, United States, ASN64270 (PACIFICRACK, US), Reverse DNS 204.44.70.48.static.quadranet.com Software nginx / Resource Hash df1aad9af246e07ba6123c24dc654d0eb7bc70e33cacccc9ebb82938531270da Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://aupost.biz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Wed, 07 Jun 2023 10:12:08 GMT strict-transport-security max-age=31536000 last-modified Mon, 07 Nov 2022 23:59:50 GMT server nginx etag "63699bf6-18b" content-type text/css cache-control max-age=43200 accept-ranges bytes content-length 395 expires Wed, 07 Jun 2023 22:12:08 GMT
GET H2	200	urlConfig.json Show response aupost.biz/ResourceConfig/	839 B 995 B	148ms 146ms	Script application/json	204.44.70.48 PACIFICRACK
General Check archive.org Show headers Download Go to Full URL https://aupost.biz/ResourceConfig/urlConfig.json Requested by Host: aupost.biz URL: https://aupost.biz/static/js/ua.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 204.44.70.48 Los Angeles, United States, ASN64270 (PACIFICRACK, US), Reverse DNS 204.44.70.48.static.quadranet.com Software nginx / Resource Hash 705cfe1290f6cd59dd11eb13a430eb56ca035006985536629fa3f20260e2c347 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://aupost.biz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Wed, 07 Jun 2023 10:12:08 GMT strict-transport-security max-age=31536000 last-modified Sun, 04 Jun 2023 17:30:50 GMT server nginx etag "647cca4a-347" content-type application/json accept-ranges bytes content-length 839
GET H2	200	axios.js Show response aupost.biz/static/js/	42 KB 13 KB	293ms 292ms	Script application/javascript	204.44.70.48 PACIFICRACK
General Check archive.org Show headers Download Go to Full URL https://aupost.biz/static/js/axios.js Requested by Host: aupost.biz URL: https://aupost.biz/static/js/ua.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 204.44.70.48 Los Angeles, United States, ASN64270 (PACIFICRACK, US), Reverse DNS 204.44.70.48.static.quadranet.com Software nginx / Resource Hash 96b65382c74cd6255d4628044c5394f2ef3f0662d7d72b10f1bceb50b6ee5455 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://aupost.biz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Wed, 07 Jun 2023 10:12:08 GMT strict-transport-security max-age=31536000 content-encoding gzip last-modified Sat, 10 Nov 2018 04:07:50 GMT server nginx etag W/"5be65996-a6f0" vary Accept-Encoding content-type application/javascript cache-control max-age=43200 expires Wed, 07 Jun 2023 22:12:08 GMT
GET H2	200	jquery-ui.js Show response aupost.biz/static/js/	1 KB 831 B	293ms 293ms	Script application/javascript	204.44.70.48 PACIFICRACK
General Check archive.org Show headers Download Go to Full URL https://aupost.biz/static/js/jquery-ui.js Requested by Host: aupost.biz URL: https://aupost.biz/static/js/ua.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 204.44.70.48 Los Angeles, United States, ASN64270 (PACIFICRACK, US), Reverse DNS 204.44.70.48.static.quadranet.com Software nginx / Resource Hash c94c52961a5b2eb6fb2056be26b78a9a72464b9c952788db5acd3291bbc75084 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://aupost.biz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Wed, 07 Jun 2023 10:12:08 GMT strict-transport-security max-age=31536000 content-encoding gzip last-modified Wed, 01 Mar 2023 18:35:03 GMT server nginx etag W/"63ff9ad7-5a0" vary Accept-Encoding content-type application/javascript cache-control max-age=43200 expires Wed, 07 Jun 2023 22:12:08 GMT
GET H2	200	ResourceRedConfig.js Show response aupost.biz/static/js/	11 KB 5 KB	294ms 293ms	Script application/javascript	204.44.70.48 PACIFICRACK
General Check archive.org Show headers Download Go to Full URL https://aupost.biz/static/js/ResourceRedConfig.js Requested by Host: aupost.biz URL: https://aupost.biz/static/js/ua.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 204.44.70.48 Los Angeles, United States, ASN64270 (PACIFICRACK, US), Reverse DNS 204.44.70.48.static.quadranet.com Software nginx / Resource Hash c0c45e16af9453bbb9dc7b745766465eb72500d8e8cbc26daaae56628b71c4fa Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://aupost.biz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Wed, 07 Jun 2023 10:12:08 GMT strict-transport-security max-age=31536000 content-encoding gzip last-modified Sun, 04 Jun 2023 09:42:53 GMT server nginx etag W/"647c5c9d-2d34" vary Accept-Encoding content-type application/javascript cache-control max-age=43200 expires Wed, 07 Jun 2023 22:12:08 GMT
GET H2	200	loading.png aupost.biz/static/image/	7 KB 7 KB	294ms 293ms	Image image/png	204.44.70.48 PACIFICRACK
General Check archive.org Show headers Download Go to Show image Full URL https://aupost.biz/static/image/loading.png Requested by Host: aupost.biz URL: https://aupost.biz/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 204.44.70.48 Los Angeles, United States, ASN64270 (PACIFICRACK, US), Reverse DNS 204.44.70.48.static.quadranet.com Software nginx / Resource Hash 78b44692dc7f0f2d807d191b35ebe0cd893cfe8b6c48c81e4687804137c31abc Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://aupost.biz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Wed, 07 Jun 2023 10:12:08 GMT strict-transport-security max-age=31536000 last-modified Mon, 07 Nov 2022 23:36:57 GMT server nginx etag "63699699-1d22" content-type image/png cache-control max-age=2592000 accept-ranges bytes content-length 7458 expires Fri, 07 Jul 2023 10:12:08 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Australia Post (Transportation)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| onbeforetoggle object| onscrollend object| url function| axios string| token undefined| is undefined| isTrue string| wsPath

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://aupost.biz/static/js/ResourceRedConfig.js(Line 130) Message: WebSocket connection to 'wss://admin2023--lg.top/websocket/a07dde9bd15529e2a48d0ef3280ff47f' failed: Error during WebSocket handshake: Unexpected response code: 404

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aupost.biz
204.44.70.48
13a33a939e609d7200b09962ee7bed474e86e1f0ac7641791667d6a28eb4c1db
41e9231f90ce266c465bf941d6ab8a289a3146bc0bdeabc11e24ccc5d8bd1426
705cfe1290f6cd59dd11eb13a430eb56ca035006985536629fa3f20260e2c347
78b44692dc7f0f2d807d191b35ebe0cd893cfe8b6c48c81e4687804137c31abc
96b65382c74cd6255d4628044c5394f2ef3f0662d7d72b10f1bceb50b6ee5455
c0c45e16af9453bbb9dc7b745766465eb72500d8e8cbc26daaae56628b71c4fa
c94c52961a5b2eb6fb2056be26b78a9a72464b9c952788db5acd3291bbc75084
df1aad9af246e07ba6123c24dc654d0eb7bc70e33cacccc9ebb82938531270da