beautifulcheetah.build067.wpsandbox.app Open in urlscan Pro
2606:4700:10::ac43:457 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://beautifulcheetah.build067.wpsandbox.app/hu/postahu/
Submission: On January 22 via api (January 22nd 2023, 4:03:18 am UTC) from JP — Scanned from JP

Summary HTTP 18 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 18 HTTP transactions. The main IP is 2606:4700:10::ac43:457, located in United States and belongs to CLOUDFLARENET, US. The main domain is beautifulcheetah.build067.wpsandbox.app.
TLS certificate: Issued by R3 on December 1st 2022. Valid for: 3 months.

This is the only time beautifulcheetah.build067.wpsandbox.app was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Magyar Posta (Transportation)

Domain & IP information

	IP Address		AS Autonomous System
18	2606:4700:10:... 2606:4700:10::ac43:457		13335 (CLOUDFLAR...) (CLOUDFLARENET)
18	1

18 2606:4700:10::ac43:457 (United States)

ASN13335 (CLOUDFLARENET, US)

beautifulcheetah.build067.wpsandbox.app	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
18	wpsandbox.app beautifulcheetah.build067.wpsandbox.app	234 KB
18	1

	Domain	Requested by
18	beautifulcheetah.build067.wpsandbox.app	beautifulcheetah.build067.wpsandbox.app
18	1

This site contains no links.

Subject Issuer	Validity	Valid
*.build067.wpsandbox.app R3	`2022-12-01` - `2023-03-01`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://beautifulcheetah.build067.wpsandbox.app/hu/postahu/
Frame ID: E25873600ACBB707C23A52FCF5E43F84
Requests: 15 HTTP requests in this frame

Frame: https://beautifulcheetah.build067.wpsandbox.app/cdn-cgi/challenge-platform/h/g/scripts/alpha/invisible.js?ts=1674360000
Frame ID: 685555FE63042AC91BA5BD7CFC50D93A
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Magyar Posta Zrt. - Nyitó

Detected technologies

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

18
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

234 kB
Transfer

386 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

18 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response beautifulcheetah.build067.wpsandbox.app/hu/postahu/	43 KB 29 KB	2857ms 2784ms	Document text/html	2606:4700:10::ac43:457 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://beautifulcheetah.build067.wpsandbox.app/hu/postahu/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::ac43:457 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `b5e624787490d388dc46d579535808ff6c30b9466ca2049dead3df964a32e2a0` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 accept-language jp-JP,jp;q=0.9 Response headers alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 78d565f13acae031-NRT content-encoding br content-type text/html; charset=UTF-8 date Sun, 22 Jan 2023 04:03:12 GMT server cloudflare vary Accept-Encoding x-hostname gpc067-node1.us-midwest-1.nxcli.net x-robots-tag noindex x-served-by gpc067-node1
GET H2	200	font-awesome.min.css beautifulcheetah.build067.wpsandbox.app/hu/postahu/	30 KB 7 KB	15ms 14ms	Stylesheet text/css	2606:4700:10::ac43:457 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://beautifulcheetah.build067.wpsandbox.app/hu/postahu/font-awesome.min.css Requested by Host: beautifulcheetah.build067.wpsandbox.app URL: https://beautifulcheetah.build067.wpsandbox.app/hu/postahu/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::ac43:457 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `29af2e0b8a8af19a81f246c1cc29ea11da8aa6eb421fff94038764ff90439857` Request headers accept-language jp-JP,jp;q=0.9 Referer https://beautifulcheetah.build067.wpsandbox.app/hu/postahu/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers date Sun, 22 Jan 2023 04:03:12 GMT content-encoding br cf-cache-status HIT last-modified Thu, 09 Dec 2021 08:28:50 GMT server cloudflare age 1 etag W/"78f6-5d2b2655a9480" vary Accept-Encoding x-hostname gpc067-node1.us-midwest-1.nxcli.net content-type text/css x-robots-tag noindex cf-ray 78d56602abdfe031-NRT alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 x-served-by gpc067-node1
GET H2	200	Untitled1.css beautifulcheetah.build067.wpsandbox.app/hu/postahu/js/	2 KB 359 B	20ms 20ms	Stylesheet text/css	2606:4700:10::ac43:457 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://beautifulcheetah.build067.wpsandbox.app/hu/postahu/js/Untitled1.css Requested by Host: beautifulcheetah.build067.wpsandbox.app URL: https://beautifulcheetah.build067.wpsandbox.app/hu/postahu/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::ac43:457 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `3a5b8544a55ecbdf060aac85bb177af1a40b398193086197ccf77b5d1bb9371a` Request headers accept-language jp-JP,jp;q=0.9 Referer https://beautifulcheetah.build067.wpsandbox.app/hu/postahu/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers date Sun, 22 Jan 2023 04:03:12 GMT content-encoding br cf-cache-status HIT last-modified Thu, 09 Dec 2021 08:05:40 GMT server cloudflare age 1 etag W/"6b7-5d2b21280dd00" vary Accept-Encoding x-hostname gpc067-node1.us-midwest-1.nxcli.net content-type text/css x-robots-tag noindex cf-ray 78d56602abe0e031-NRT alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 x-served-by gpc067-node1
GET H2	200	index.css beautifulcheetah.build067.wpsandbox.app/hu/postahu/js/	27 KB 3 KB	21ms 20ms	Stylesheet text/css	2606:4700:10::ac43:457 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://beautifulcheetah.build067.wpsandbox.app/hu/postahu/js/index.css Requested by Host: beautifulcheetah.build067.wpsandbox.app URL: https://beautifulcheetah.build067.wpsandbox.app/hu/postahu/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::ac43:457 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `4aee46fd06311704d292eb39a9a6863a278383bef851467df3d8d3d694dd800b` Request headers accept-language jp-JP,jp;q=0.9 Referer https://beautifulcheetah.build067.wpsandbox.app/hu/postahu/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers date Sun, 22 Jan 2023 04:03:12 GMT content-encoding br cf-cache-status HIT last-modified Thu, 09 Dec 2021 08:45:36 GMT server cloudflare age 1 etag W/"6dca-5d2b2a150ec00" vary Accept-Encoding x-hostname gpc067-node1.us-midwest-1.nxcli.net content-type text/css x-robots-tag noindex cf-ray 78d56602abe2e031-NRT alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 x-served-by gpc067-node1
GET H2	200	jquery-1.12.4.min.js Show response beautifulcheetah.build067.wpsandbox.app/hu/postahu/js/	95 KB 34 KB	27ms 26ms	Script application/javascript	2606:4700:10::ac43:457 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://beautifulcheetah.build067.wpsandbox.app/hu/postahu/js/jquery-1.12.4.min.js Requested by Host: beautifulcheetah.build067.wpsandbox.app URL: https://beautifulcheetah.build067.wpsandbox.app/hu/postahu/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::ac43:457 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `3ae5d8b5a2806b811378107313b19f0b05baae4b2bbe85e19e9cd223391a0fe3` Request headers accept-language jp-JP,jp;q=0.9 Referer https://beautifulcheetah.build067.wpsandbox.app/hu/postahu/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers date Sun, 22 Jan 2023 04:03:12 GMT content-encoding br cf-cache-status HIT last-modified Thu, 09 Dec 2021 08:05:40 GMT server cloudflare age 0 etag W/"17b8e-5d2b21280dd00" vary Accept-Encoding x-hostname gpc067-node1.us-midwest-1.nxcli.net content-type application/javascript x-robots-tag noindex cf-ray 78d56602abe3e031-NRT alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 x-served-by gpc067-node1
GET H2	404	jquery.inputmask.min.js beautifulcheetah.build067.wpsandbox.app/hu/postahu/js/	0 0	19ms 19ms	Script text/html	2606:4700:10::ac43:457 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://beautifulcheetah.build067.wpsandbox.app/hu/postahu/js/jquery.inputmask.min.js Requested by Host: beautifulcheetah.build067.wpsandbox.app URL: https://beautifulcheetah.build067.wpsandbox.app/hu/postahu/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::ac43:457 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers accept-language jp-JP,jp;q=0.9 Referer https://beautifulcheetah.build067.wpsandbox.app/hu/postahu/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers date Sun, 22 Jan 2023 04:03:12 GMT content-encoding br cf-cache-status HIT server cloudflare age 0 vary Accept-Encoding content-type text/html; charset=iso-8859-1 x-robots-tag noindex cf-ray 78d56602abe4e031-NRT alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 x-served-by gpc067-node1
GET H3	200	highmob.png beautifulcheetah.build067.wpsandbox.app/hu/postahu/images/	4 KB 4 KB	638ms 638ms	Image image/png	2606:4700:10::ac43:457 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://beautifulcheetah.build067.wpsandbox.app/hu/postahu/images/highmob.png Requested by Host: beautifulcheetah.build067.wpsandbox.app URL: https://beautifulcheetah.build067.wpsandbox.app/hu/postahu/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:10::ac43:457 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `be789ea65bfa401248217d54258c9ce1208db12f06517d4122b57572e4d330f0` Request headers accept-language jp-JP,jp;q=0.9 Referer https://beautifulcheetah.build067.wpsandbox.app/hu/postahu/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers date Sun, 22 Jan 2023 04:03:13 GMT cf-cache-status HIT last-modified Thu, 09 Dec 2021 08:09:32 GMT server cloudflare etag "ea6-5d2b22054e700" vary Accept-Encoding x-hostname gpc067-node1.us-midwest-1.nxcli.net content-type image/png accept-ranges bytes x-robots-tag noindex cf-ray 78d56603a94d2612-NRT content-length 3750 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 x-served-by gpc067-node1
GET H3	200	xx.png beautifulcheetah.build067.wpsandbox.app/hu/postahu/images/	17 KB 17 KB	184ms 183ms	Image image/png	2606:4700:10::ac43:457 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://beautifulcheetah.build067.wpsandbox.app/hu/postahu/images/xx.png Requested by Host: beautifulcheetah.build067.wpsandbox.app URL: https://beautifulcheetah.build067.wpsandbox.app/hu/postahu/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:10::ac43:457 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `fafbf7a0a7f4d2da968c90db88a517187dd54b3d06f3767ce873b79407f76b9a` Request headers accept-language jp-JP,jp;q=0.9 Referer https://beautifulcheetah.build067.wpsandbox.app/hu/postahu/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers date Sun, 22 Jan 2023 04:03:12 GMT cf-cache-status HIT last-modified Thu, 09 Dec 2021 08:39:16 GMT server cloudflare etag "425a-5d2b28aaa9500" vary Accept-Encoding x-hostname gpc067-node1.us-midwest-1.nxcli.net content-type image/png accept-ranges bytes x-robots-tag noindex cf-ray 78d56603a9522612-NRT content-length 16986 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 x-served-by gpc067-node1
GET H3	200	collie.jfif beautifulcheetah.build067.wpsandbox.app/hu/postahu/	6 KB 6 KB	516ms 515ms	Image image/jpeg	2606:4700:10::ac43:457 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://beautifulcheetah.build067.wpsandbox.app/hu/postahu/collie.jfif Requested by Host: beautifulcheetah.build067.wpsandbox.app URL: https://beautifulcheetah.build067.wpsandbox.app/hu/postahu/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:10::ac43:457 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `0fb41ab8877699782e17566fafad17e01b8d04b840db658583cb0d3b9508fff4` Request headers accept-language jp-JP,jp;q=0.9 Referer https://beautifulcheetah.build067.wpsandbox.app/hu/postahu/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers date Sun, 22 Jan 2023 04:03:13 GMT cf-cache-status DYNAMIC last-modified Thu, 09 Dec 2021 08:13:50 GMT server cloudflare etag "185e-5d2b22fb5ab80" x-hostname gpc067-node1.us-midwest-1.nxcli.net content-type image/jpeg accept-ranges bytes x-robots-tag noindex cf-ray 78d56603a9562612-NRT content-length 6238 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 x-served-by gpc067-node1
GET H3	200	xxx.png beautifulcheetah.build067.wpsandbox.app/hu/postahu/images/	2 KB 2 KB	178ms 177ms	Image image/png	2606:4700:10::ac43:457 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://beautifulcheetah.build067.wpsandbox.app/hu/postahu/images/xxx.png Requested by Host: beautifulcheetah.build067.wpsandbox.app URL: https://beautifulcheetah.build067.wpsandbox.app/hu/postahu/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:10::ac43:457 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `d3ef7fd1790155f337f8f18f38ce37229665aca17836f5914227079e152e6ce9` Request headers accept-language jp-JP,jp;q=0.9 Referer https://beautifulcheetah.build067.wpsandbox.app/hu/postahu/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers date Sun, 22 Jan 2023 04:03:12 GMT cf-cache-status HIT last-modified Thu, 09 Dec 2021 08:05:22 GMT server cloudflare etag "663-5d2b2116e3480" vary Accept-Encoding x-hostname gpc067-node1.us-midwest-1.nxcli.net content-type image/png accept-ranges bytes x-robots-tag noindex cf-ray 78d56603a9572612-NRT content-length 1635 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 x-served-by gpc067-node1
GET H3	200	x.png beautifulcheetah.build067.wpsandbox.app/hu/postahu/images/	379 B 635 B	174ms 173ms	Image image/png	2606:4700:10::ac43:457 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://beautifulcheetah.build067.wpsandbox.app/hu/postahu/images/x.png Requested by Host: beautifulcheetah.build067.wpsandbox.app URL: https://beautifulcheetah.build067.wpsandbox.app/hu/postahu/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:10::ac43:457 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `6c7ba24b4704001e76f8d581dd48a5c56324e69eb6f74af0c3e9cbd7233e467c` Request headers accept-language jp-JP,jp;q=0.9 Referer https://beautifulcheetah.build067.wpsandbox.app/hu/postahu/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers date Sun, 22 Jan 2023 04:03:12 GMT cf-cache-status HIT last-modified Thu, 09 Dec 2021 08:47:14 GMT server cloudflare etag "17b-5d2b2a7284880" vary Accept-Encoding x-hostname gpc067-node1.us-midwest-1.nxcli.net content-type image/png accept-ranges bytes x-robots-tag noindex cf-ray 78d56603a9582612-NRT content-length 379 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 x-served-by gpc067-node1
GET H3	200	s.png beautifulcheetah.build067.wpsandbox.app/hu/postahu/images/	218 B 472 B	632ms 631ms	Image image/png	2606:4700:10::ac43:457 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://beautifulcheetah.build067.wpsandbox.app/hu/postahu/images/s.png Requested by Host: beautifulcheetah.build067.wpsandbox.app URL: https://beautifulcheetah.build067.wpsandbox.app/hu/postahu/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:10::ac43:457 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `6aba95aab17d28ab1ddc4c8af369d653a5bf67b19b08e7c386622b40a6fa72e4` Request headers accept-language jp-JP,jp;q=0.9 Referer https://beautifulcheetah.build067.wpsandbox.app/hu/postahu/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers date Sun, 22 Jan 2023 04:03:13 GMT cf-cache-status HIT last-modified Thu, 09 Dec 2021 08:51:08 GMT server cloudflare etag "da-5d2b2b51ad700" vary Accept-Encoding x-hostname gpc067-node1.us-midwest-1.nxcli.net content-type image/png accept-ranges bytes x-robots-tag noindex cf-ray 78d56603a9592612-NRT content-length 218 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 x-served-by gpc067-node1
GET H3	200	index.css beautifulcheetah.build067.wpsandbox.app/hu/postahu/js/	27 KB 27 KB	15ms 14ms	Image text/css	2606:4700:10::ac43:457 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://beautifulcheetah.build067.wpsandbox.app/hu/postahu/js/index.css Requested by Host: beautifulcheetah.build067.wpsandbox.app URL: https://beautifulcheetah.build067.wpsandbox.app/hu/postahu/js/index.css Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:10::ac43:457 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers accept-language jp-JP,jp;q=0.9 Referer https://beautifulcheetah.build067.wpsandbox.app/hu/postahu/js/index.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers date Sun, 22 Jan 2023 04:03:12 GMT content-encoding br cf-cache-status HIT last-modified Thu, 09 Dec 2021 08:45:36 GMT server cloudflare age 1 etag W/"6dca-5d2b2a150ec00" vary Accept-Encoding x-hostname gpc067-node1.us-midwest-1.nxcli.net content-type text/css x-robots-tag noindex cf-ray 78d56603a95a2612-NRT alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 x-served-by gpc067-node1
GET H3	200	basmob.png beautifulcheetah.build067.wpsandbox.app/hu/postahu/images/	34 KB 35 KB	212ms 212ms	Image image/png	2606:4700:10::ac43:457 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://beautifulcheetah.build067.wpsandbox.app/hu/postahu/images/basmob.png Requested by Host: beautifulcheetah.build067.wpsandbox.app URL: https://beautifulcheetah.build067.wpsandbox.app/hu/postahu/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:10::ac43:457 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `b2b3fde37ccd6c8dab0d32b5802880e44023365b42c2bcf2853af9ebfe9bd1ad` Request headers accept-language jp-JP,jp;q=0.9 Referer https://beautifulcheetah.build067.wpsandbox.app/hu/postahu/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers date Sun, 22 Jan 2023 04:03:12 GMT cf-cache-status HIT last-modified Thu, 09 Dec 2021 08:05:28 GMT server cloudflare etag "8922-5d2b211c9c200" vary Accept-Encoding x-hostname gpc067-node1.us-midwest-1.nxcli.net content-type image/png accept-ranges bytes x-robots-tag noindex cf-ray 78d56603b96c2612-NRT content-length 35106 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 x-served-by gpc067-node1
GET H3	200	baspc.png beautifulcheetah.build067.wpsandbox.app/hu/postahu/images/	48 KB 48 KB	205ms 204ms	Image image/png	2606:4700:10::ac43:457 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://beautifulcheetah.build067.wpsandbox.app/hu/postahu/images/baspc.png Requested by Host: beautifulcheetah.build067.wpsandbox.app URL: https://beautifulcheetah.build067.wpsandbox.app/hu/postahu/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:10::ac43:457 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `2c9eafdd8ca759fdb000f2f515b0daf01efb20a3c12e1ed3fd17adc6597f57fc` Request headers accept-language jp-JP,jp;q=0.9 Referer https://beautifulcheetah.build067.wpsandbox.app/hu/postahu/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers date Sun, 22 Jan 2023 04:03:12 GMT cf-cache-status HIT last-modified Thu, 09 Dec 2021 08:39:28 GMT server cloudflare etag "be75-5d2b28b61b000" vary Accept-Encoding x-hostname gpc067-node1.us-midwest-1.nxcli.net content-type image/png accept-ranges bytes x-robots-tag noindex cf-ray 78d56603b96f2612-NRT content-length 48757 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 x-served-by gpc067-node1
GET H3	200	invisible.js Show response beautifulcheetah.build067.wpsandbox.app/cdn-cgi/challenge-platform/h/g/scripts/alpha/ Frame 6855	32 KB 13 KB	8ms 8ms	Script application/javascript	2606:4700:10::ac43:457 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://beautifulcheetah.build067.wpsandbox.app/cdn-cgi/challenge-platform/h/g/scripts/alpha/invisible.js?ts=1674360000 Requested by Host: beautifulcheetah.build067.wpsandbox.app URL: https://beautifulcheetah.build067.wpsandbox.app/hu/postahu/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:10::ac43:457 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `07d521e61cdd819a33620f1d8ae70babfd4fdd606c481ba0fc9d839b3fb189a9` Request headers accept-language jp-JP,jp;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers date Sun, 22 Jan 2023 04:03:12 GMT content-encoding br server cloudflare vary accept-encoding content-type application/javascript; charset=UTF-8 cache-control max-age=14400, public x-control-type-options nosniff x-robots-tag noindex cf-ray 78d56603d98c2612-NRT alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H3	200	pica.js beautifulcheetah.build067.wpsandbox.app/cdn-cgi/challenge-platform/h/g/scripts/ Frame 6855	19 KB 8 KB	8ms 8ms	Other application/javascript	2606:4700:10::ac43:457 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://beautifulcheetah.build067.wpsandbox.app/cdn-cgi/challenge-platform/h/g/scripts/pica.js Requested by Host: beautifulcheetah.build067.wpsandbox.app URL: https://beautifulcheetah.build067.wpsandbox.app/hu/postahu/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:10::ac43:457 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `2bd1df80b2e77a334205e836b9ff08345fdbe233b3bbf9b586b332558afe0040` Request headers accept-language jp-JP,jp;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers date Sun, 22 Jan 2023 04:03:12 GMT content-encoding br server cloudflare vary accept-encoding content-type application/javascript; charset=UTF-8 cache-control max-age=14400, public x-control-type-options nosniff x-robots-tag noindex cf-ray 78d56603f9a52612-NRT alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
POST H3	200	78d565f13acae031 Show response beautifulcheetah.build067.wpsandbox.app/cdn-cgi/challenge-platform/h/g/cv/result/ Frame 6855	2 B 390 B	23ms 22ms	XHR text/plain	2606:4700:10::ac43:457 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://beautifulcheetah.build067.wpsandbox.app/cdn-cgi/challenge-platform/h/g/cv/result/78d565f13acae031 Requested by Host: beautifulcheetah.build067.wpsandbox.app URL: https://beautifulcheetah.build067.wpsandbox.app/cdn-cgi/challenge-platform/h/g/scripts/alpha/invisible.js?ts=1674360000 Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:10::ac43:457 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df` Request headers Referer accept-language jp-JP,jp;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Content-Type application/json Response headers date Sun, 22 Jan 2023 04:03:12 GMT content-encoding br server cloudflare cf-ray 78d566058b1c2612-NRT alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-type text/plain; charset=UTF-8

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Magyar Posta (Transportation)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| oncontentvisibilityautostatechange function| $ function| jQuery

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.wpsandbox.app/	1970-01-20 09:06:01	Name: __cf_bm Value: 7aHl.ZiLMoZgYgEA1yPeoc4TNQZ.nDDFq6fAyCz6UnU-1674360192-0-Ad4NQizomygvul+x7OvERdRvk2a+VyVlv1nFGQRKNrCDIEEaem/WR7WKqwlK0duxI5VLLXVFhOPkMmXSTINvsEpbcbDn9a7CyONv+8RKMR6zhmerYEDBWlvo4DO6abSnrpHXPeeTwDr+bwfOFRPWzkM=

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://beautifulcheetah.build067.wpsandbox.app/hu/postahu/js/jquery.inputmask.min.js Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

beautifulcheetah.build067.wpsandbox.app
2606:4700:10::ac43:457
07d521e61cdd819a33620f1d8ae70babfd4fdd606c481ba0fc9d839b3fb189a9
0fb41ab8877699782e17566fafad17e01b8d04b840db658583cb0d3b9508fff4
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
29af2e0b8a8af19a81f246c1cc29ea11da8aa6eb421fff94038764ff90439857
2bd1df80b2e77a334205e836b9ff08345fdbe233b3bbf9b586b332558afe0040
2c9eafdd8ca759fdb000f2f515b0daf01efb20a3c12e1ed3fd17adc6597f57fc
3a5b8544a55ecbdf060aac85bb177af1a40b398193086197ccf77b5d1bb9371a
3ae5d8b5a2806b811378107313b19f0b05baae4b2bbe85e19e9cd223391a0fe3
4aee46fd06311704d292eb39a9a6863a278383bef851467df3d8d3d694dd800b
6aba95aab17d28ab1ddc4c8af369d653a5bf67b19b08e7c386622b40a6fa72e4
6c7ba24b4704001e76f8d581dd48a5c56324e69eb6f74af0c3e9cbd7233e467c
b2b3fde37ccd6c8dab0d32b5802880e44023365b42c2bcf2853af9ebfe9bd1ad
b5e624787490d388dc46d579535808ff6c30b9466ca2049dead3df964a32e2a0
be789ea65bfa401248217d54258c9ce1208db12f06517d4122b57572e4d330f0
d3ef7fd1790155f337f8f18f38ce37229665aca17836f5914227079e152e6ce9
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
fafbf7a0a7f4d2da968c90db88a517187dd54b3d06f3767ce873b79407f76b9a

beautifulcheetah.build067.wpsandbox.app Open in urlscan Pro 2606:4700:10::ac43:457 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

18 Requests

100 %HTTPS

100 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

234 kBTransfer

386 kBSize

1 Cookies

0 Outgoing links

Redirected requests

18 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

beautifulcheetah.build067.wpsandbox.app Open in urlscan Pro
2606:4700:10::ac43:457 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

18
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

234 kB
Transfer

386 kB
Size

1
Cookies

18 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!