usps-mail.xyz
Open in
urlscan Pro
74.48.73.18
Public Scan
URL:
https://usps-mail.xyz/
Submission Tags: @ecarlesi threat phishing usps Search All
Submission: On November 28 via api from IT — Scanned from CA
Submission Tags: @ecarlesi threat phishing usps Search All
Submission: On November 28 via api from IT — Scanned from CA
Summary
This website contacted 3 IPs
in 2 countries
across 5 domains to perform 14 HTTP transactions.
The main IP is 74.48.73.18, located in
Los Angeles, United States and
belongs to MULTA-ASN1, US.
The main domain is usps-mail.xyz.
TLS certificate: Issued by R3 on November 27th 2023. Valid for: 3 months.
This is the only time usps-mail.xyz was scanned on urlscan.io!
TLS certificate: Issued by R3 on November 27th 2023. Valid for: 3 months.
This is the only time usps-mail.xyz was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 12 | 74.48.73.18 74.48.73.18 | 35916 (MULTA-ASN1) (MULTA-ASN1) | |
| 1 | 104.18.26.170 104.18.26.170 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
| 14 | 3 |
12
74.48.73.18
(Los Angeles, United States)
ASN35916 (MULTA-ASN1, US)
PTR: panhattack.com
ASN35916 (MULTA-ASN1, US)
PTR: panhattack.com
| usps-mail.xyz | |
| btlgovio.xyz | |
| btlgovis.club |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 5 |
btlgovio.xyz
btlgovio.xyz |
151 KB |
| 5 |
usps-mail.xyz
usps-mail.xyz |
523 KB |
| 2 |
btlgovis.club
btlgovis.club |
3 KB |
| 1 |
ipregistry.co
api.ipregistry.co — Cisco Umbrella Rank: 152658 |
1 KB |
| 0 |
Failed
function sub() { [native code] }. Failed |
|
| 14 | 5 |
| Domain | Requested by | |
|---|---|---|
| 5 | btlgovio.xyz |
usps-mail.xyz
btlgovio.xyz |
| 5 | usps-mail.xyz |
usps-mail.xyz
|
| 2 | btlgovis.club |
btlgovio.xyz
|
| 1 | api.ipregistry.co |
btlgovio.xyz
|
| 0 | localhost Failed |
btlgovio.xyz
|
| 14 | 5 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| usps-mail.xyz R3 |
2023-11-27 - 2024-02-25 |
3 months | crt.sh |
| btlgovio.xyz R3 |
2023-11-16 - 2024-02-14 |
3 months | crt.sh |
| btlgovis.club R3 |
2023-11-13 - 2024-02-11 |
3 months | crt.sh |
| ipregistry.co Cloudflare Inc ECC CA-3 |
2023-10-03 - 2024-10-02 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
https://usps-mail.xyz/
Frame ID: 9833189469B4761CB9369480DE283A66
Requests: 5 HTTP requests in this frame
Frame:
https://localhost/
Frame ID: A636D715FDABBEDFCD3A8103D305AC2C
Requests: 9 HTTP requests in this frame
Screenshot
Page Title
USPS.com® - USPS Tracking® ResultsDetected technologies
Vue.js
(JavaScript Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- (?:/([\d.]+))?/vue(?:\.min)?\.js
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
14 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
/
usps-mail.xyz/ |
4 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
qb.js
usps-mail.xyz/js/ |
87 KB 34 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
config.js
usps-mail.xyz/js/ |
240 B 453 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
loading.css
usps-mail.xyz/lib/ |
1 KB 757 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
/
btlgovio.xyz/ Frame A636 |
10 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
loading2.gif
usps-mail.xyz/lib/ |
486 KB 486 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery-3.6.0.min.js
btlgovio.xyz/static/lib/jquery/ Frame A636 |
87 KB 34 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
vue.js
btlgovio.xyz/static/lib/vue/ Frame A636 |
336 KB 105 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
axios.min.js
btlgovio.xyz/static/lib/axios/ Frame A636 |
20 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
config.js
btlgovio.xyz/static/ Frame A636 |
267 B 480 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
getRuleList
btlgovis.club/qyhldbe6/general.Config/ Frame A636 |
2 KB 3 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
/
api.ipregistry.co/ Frame A636 |
2 KB 1 KB |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
checkIp
btlgovis.club/qyhldbe6/Card/ Frame A636 |
55 B 536 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
/
localhost/ Frame A636 |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- localhost
- URL
- https://localhost/
Verdicts & Comments Add Verdict or Comment
10 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| documentPictureInPicture function| $ function| jQuery object| configAll function| mAlert string| x number| setupRed number| selectName function| iframe0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
| Header | Value |
|---|---|
| Strict-Transport-Security | max-age=31536000 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
api.ipregistry.co
btlgovio.xyz
btlgovis.club
localhost
usps-mail.xyz
localhost
104.18.26.170
74.48.73.18
0c2519be093cf8a7d40e63eeb6bc0999c617ce998519043e9e92ba03ab919b3c
2e2eaa0c528bda9a78bdaa5c9e1c3728caff981d0e2babf05431e098a25d317a
69b75483b270421e1a89426dd59387ba090772313561c3e9fa415396a78e8936
80f04717f32ea0320c5e8618fbacedd1fee3a8775ad8292140a6113551d4b5b0
8e1b6e81bca190a50e23a8343a58f839d99763b8380a13480b6fc2faed495c58
a9fea732994c6604eaf8b3149bb49843bbb73fa7479a1cc2f14880ee2f31c356
bc16e7bd83aa7f9ae11c4badc3a777cbf94aaf67eeedca71875dea07726501c9
c57f6f77a9a89bd67e71faafc254f6a1ee610745a6c1dbac76c76425bd6a706e
c79b86ed3f73ebc96d0640cf5881ae4a5df2337e62ef144c84a1c411fced284d
cde91a736591fe2722fee3dd789777b34b368627be35f947f0172aa364cf5d86
df3004364cac9ed26748a3b26fa5efe674877faea17c4e0df3a94b677f39c5e4
e373b70a5167485c73a265421bcfcd1fdddbae49c9c51605e6d2918a3de4ae0d
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e