ra.jsudelivery.cfd
Open in
urlscan Pro
2606:4700:3034::6815:e08
Malicious Activity!
Public Scan
Effective URL: https://ra.jsudelivery.cfd/sw/
Submission: On November 11 via manual from SE — Scanned from DE
Summary
TLS certificate: Issued by WE1 on November 11th 2024. Valid for: 3 months.
This is the only time ra.jsudelivery.cfd was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: PostNord AB (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 13.225.78.98 13.225.78.98 | 16509 (AMAZON-02) (AMAZON-02) | |
1 26 | 2606:4700:303... 2606:4700:3034::6815:e08 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
25 | 1 |
ASN16509 (AMAZON-02, US)
PTR: server-13-225-78-98.fra2.r.cloudfront.net
qrco.de |
Apex Domain Subdomains |
Transfer | |
---|---|---|
26 |
jsudelivery.cfd
1 redirects
ra.jsudelivery.cfd |
386 KB |
1 |
qrco.de
1 redirects
qrco.de — Cisco Umbrella Rank: 85682 |
339 B |
25 | 2 |
Domain | Requested by | |
---|---|---|
26 | ra.jsudelivery.cfd |
1 redirects
ra.jsudelivery.cfd
|
1 | qrco.de | 1 redirects |
25 | 2 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.postnord.se |
portal.postnord.com |
www.postnord.com |
www.facebook.com |
twitter.com |
www.linkedin.com |
www.instagram.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
jsudelivery.cfd WE1 |
2024-11-11 - 2025-02-09 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://ra.jsudelivery.cfd/sw/
Frame ID: 9C9BE0C36C8F57F4D47D4FB1B932906D
Requests: 25 HTTP requests in this frame
Screenshot
Page Title
Spåra brev, paket och pall | PostNordPage URL History Show full URLs
-
https://qrco.de/bfYVQJ?FpE=gmiVC8P19G?SfH=rqSbQTwNew
HTTP 302
https://ra.jsudelivery.cfd/sw HTTP 301
https://ra.jsudelivery.cfd/sw/ Page URL
Detected technologies
Socket.io (JavaScript Frameworks) ExpandDetected patterns
- socket\.io.*\.js
Vue.js (JavaScript Frameworks) Expand
Detected patterns
- <[^>]+\sdata-v(?:ue)?-
Page Statistics
37 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Title: Hantera dina försändelser
Search URL Search Domain Scan URL
Title: Information om PostNord Koncernen
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title: Handla online
Search URL Search Domain Scan URL
Title: Business portal
Search URL Search Domain Scan URL
Title: Ombudsbutiken
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title: Sök brevlåda eller serviceställe
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://qrco.de/bfYVQJ?FpE=gmiVC8P19G?SfH=rqSbQTwNew
HTTP 302
https://ra.jsudelivery.cfd/sw HTTP 301
https://ra.jsudelivery.cfd/sw/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
25 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
ra.jsudelivery.cfd/sw/ Redirect Chain
|
2 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
index-caef2925.js
ra.jsudelivery.cfd/sw/assets/ |
492 KB 147 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
f6170fbbQpmCH.css
ra.jsudelivery.cfd/sw/assets/ |
952 B 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
234bc799ykE7C.js
ra.jsudelivery.cfd/sw/assets/ |
5 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
1746bc94ykE7C.js
ra.jsudelivery.cfd/sw/assets/ |
52 KB 17 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
ra.jsudelivery.cfd/ |
632 B 1 KB |
Other
image/vnd.microsoft.icon |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
accb0538ykE7C.js
ra.jsudelivery.cfd/sw/assets/ |
34 KB 11 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
09bf01f8ykE7C.js
ra.jsudelivery.cfd/sw/assets/ |
2 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
5d7e5651ykE7C.js
ra.jsudelivery.cfd/sw/assets/ |
3 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
3e2c2a40ykE7C.js
ra.jsudelivery.cfd/sw/assets/ |
102 KB 26 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
c27b6911ykE7C.js
ra.jsudelivery.cfd/sw/assets/ |
2 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
0f9f79eaQpmCH.css
ra.jsudelivery.cfd/sw/assets/ |
62 KB 15 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
d7e3cff1ykE7C.js
ra.jsudelivery.cfd/sw/assets/ |
6 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
535405c2QpmCH.css
ra.jsudelivery.cfd/sw/assets/ |
370 B 927 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
MC4yNDY5NTIxMTU1OTE2NDE2NQ==
ra.jsudelivery.cfd/api/ |
604 B 1 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
d09ebf1eykE7C.js
ra.jsudelivery.cfd/sw/assets/ |
110 KB 33 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
/
ra.jsudelivery.cfd/socket.io/ |
118 B 761 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
d466bde5ykE7C.js
ra.jsudelivery.cfd/sw/assets/ |
114 KB 36 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
f4397cedQpmCH.css
ra.jsudelivery.cfd/sw/assets/ |
400 B 984 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
/
ra.jsudelivery.cfd/socket.io/ |
2 B 635 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
/
ra.jsudelivery.cfd/socket.io/ |
1 B 629 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
93914d45QpmCH.woff2
ra.jsudelivery.cfd/sw/assets/ |
25 KB 26 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
6f78aac6QpmCH.woff2
ra.jsudelivery.cfd/sw/assets/ |
27 KB 28 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
7e113240QpmCH.woff2
ra.jsudelivery.cfd/sw/assets/ |
26 KB 26 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
MC42NTE1MzkxMTc3ODIzMjI0
ra.jsudelivery.cfd/api/ |
36 B 700 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: PostNord AB (Transportation)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| IMask boolean| __vite_is_modern_browser boolean| __VUE__0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
qrco.de
ra.jsudelivery.cfd
13.225.78.98
2606:4700:3034::6815:e08
0f9f79ea43e43a2234b646d40c4179ea98e8275096746855ac986f7346436599
1d031be811a88135c097b007954a82a7e38f79955f1d883813a86a4c5bab912d
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
398869b8dbbe13f8da60226c17f43fca0623da5414cd2fa5a6f7c6394d9290f7
39cefd6a65a77b34900fb8fb17c1d886cd634ec3835336daa233be42d0dd6732
472be6a9fb8d580a0a774b4a09660fe9f61cd093489ac1df6e3553cefdeec110
4d10b3b89f68894574b817e3be4e58fa25abb5132150c566933939fdb8523c0a
535405c2a075053fd5111ad82f9ed040d89ba8508368774d157d0b37bb969769
67f05ad7b5d0af904244a3d038a315aae515f2157bffffd2d1a00ee120fd11c0
69c32d58aec49ba9c278b7a0bfacdb81cf6505a33304544d234acb6bc6d5d62f
6f78aac65f196e103c049969af692b75300c6ee41ece2df98293918edceca448
7963bac07a0b9282974a71db9cefbe13578f3146b5f0fde7b9f588ad9371e65a
7e113240915eaee7a6b2ac0f50df00b852c409f6e9ec94067081dd24be92f214
854d40b833bb095c1db6c16bb1c291b5eb9363219a071652f72e6aef22176125
9229bc150b7631494ae964c0185067f6d40d62dbba088ddf93026c0179062d50
93914d4538d1d68f086a4650fcaa932e8597caa2c86072650a44e9e7589955ff
a11202ac613f4d0b26c2c459f396bc4da2361f9f5e42228d7f2216b82c158016
b12b7091a2d9ee6b3f4c27b4e23bf9207c301bcad862f017cba6c32e2b800da2
b5eed9b425c2021b4461b0c0ac4bb1fe49d8581f3a5c885c612df640fb1637c3
b8f8cdbb8934761a6202b420fdb5a46a7e094f3d8591641847bdf073dba559df
dca36e6afdd4fdf2922f23a1f464c93f9e44c693eb29d944ad9da4077a74f151
e7f6c011776e8db7cd330b54174fd76f7d0216b612387a5ffcfb81e6f0919683
f2d64f8262d277ca3af4d88b8e55c228ffcee86e2da30f09b776835bc0c04c4a
f4397ced557e01524d17b5d0988131cbf8b4c9cb5af39749e74e3671b8eb1917
f6170fbbee0af98d737510b5689b31d78cf4e9a152590e594175b79212210911