urlscan.io logo urlscan.io
SecurityTrails logo

auspos-help.com Open in urlscan Pro
103.144.2.39  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://auspos-help.com/
Submission: On April 14 via api from NZ — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 3 countries across 3 domains to perform 10 HTTP transactions. The main IP is 103.144.2.39, located in Hong Kong and belongs to YISUCLOUDLTD-HK YISU CLOUD LTD, HK. The main domain is auspos-help.com.
TLS certificate: Issued by R3 on April 14th 2022. Valid for: 3 months.
This is the only time auspos-help.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Australia Post (Transportation)

Domain & IP information

IP Address AS Autonomous System
6 103.144.2.39 138152 (YISUCLOUD...)
2 221.231.83.250 4134 (CHINANET-...)
1 2408:4001:f00... 37963 (ALIBABA-C...)
1 47.246.136.160 45102 (ALIBABA-C...)
10 4
Apex Domain
Subdomains		 Transfer
6 auspos-help.com
auspos-help.com
104 KB
3 cnzz.com
s9.cnzz.com — Cisco Umbrella Rank: 50477
c.cnzz.com — Cisco Umbrella Rank: 27641
z12.cnzz.com — Cisco Umbrella Rank: 61447
5 KB
1 mmstat.com
cnzz.mmstat.com — Cisco Umbrella Rank: 26766
464 B
10 3
Domain Requested by
6 auspos-help.com auspos-help.com
1 cnzz.mmstat.com auspos-help.com
1 z12.cnzz.com auspos-help.com
1 c.cnzz.com s9.cnzz.com
1 s9.cnzz.com auspos-help.com
10 5

This site contains links to these domains. Also see Links.

Domain
www.cnzz.com
Subject Issuer Validity Valid
auspos-help.com
R3		 2022-04-14 -
2022-07-13		 3 months crt.sh
*.cnzz.com
GlobalSign Organization Validation CA - SHA256 - G2		 2022-01-11 -
2023-02-12		 a year crt.sh
*.mmstat.com
GlobalSign Organization Validation CA - SHA256 - G2		 2021-06-28 -
2022-07-30		 a year crt.sh

This page contains 1 frames:

Primary Page: https://auspos-help.com/
Frame ID: 6193A92BE17A4CDE772D1E2D40EAC701
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

au-post

Detected technologies

Overall confidence: 100%
Detected patterns
Overall confidence: 100%
Detected patterns
  • //[^./]+\.cnzz\.com/(?:z_stat.php|core)\?
Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

10
Requests

100 %
HTTPS

25 %
IPv6

3
Domains

5
Subdomains

4
IPs

3
Countries

110 kB
Transfer

199 kB
Size

6
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
auspos-help.com/ 		15 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://auspos-help.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.144.2.39 , Hong Kong, ASN138152 (YISUCLOUDLTD-HK YISU CLOUD LTD, HK),
Reverse DNS
Software
nginx /
Resource Hash
593c128ee9b9fd57ed0d9ae06a3b32e88e3310dd455b4e6420a4832e8eab8cae
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
no-cache, private
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Thu, 14 Apr 2022 03:20:20 GMT
server
nginx
strict-transport-security
max-age=31536000
vary
Accept-Encoding
logo2.png
auspos-help.com/novue/img/ 		34 KB
34 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://auspos-help.com/novue/img/logo2.png
Requested by
Host: auspos-help.com
URL: https://auspos-help.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.144.2.39 , Hong Kong, ASN138152 (YISUCLOUDLTD-HK YISU CLOUD LTD, HK),
Reverse DNS
Software
nginx /
Resource Hash
1845cfc43a11017dd19133ea1cb48011365d1696b0616b2db10ac8d9d581a306
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://auspos-help.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 03:20:20 GMT
last-modified
Thu, 14 Apr 2022 02:50:39 GMT
server
nginx
etag
"62578bff-88bf"
strict-transport-security
max-age=31536000
content-type
image/png
cache-control
max-age=2592000
accept-ranges
bytes
content-length
35007
expires
Sat, 14 May 2022 03:20:20 GMT
visa.png
auspos-help.com/novue/img/ 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://auspos-help.com/novue/img/visa.png
Requested by
Host: auspos-help.com
URL: https://auspos-help.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.144.2.39 , Hong Kong, ASN138152 (YISUCLOUDLTD-HK YISU CLOUD LTD, HK),
Reverse DNS
Software
nginx /
Resource Hash
44107e95888dfa57decfcbc72260fd4202d2a68a85356dc4aa3ad280100f3ea9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://auspos-help.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 03:20:20 GMT
last-modified
Thu, 07 Apr 2022 03:20:03 GMT
server
nginx
etag
"624e5863-1812"
strict-transport-security
max-age=31536000
content-type
image/png
cache-control
max-age=2592000
accept-ranges
bytes
content-length
6162
expires
Sat, 14 May 2022 03:20:20 GMT
mastercard.png
auspos-help.com/novue/img/ 		10 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://auspos-help.com/novue/img/mastercard.png
Requested by
Host: auspos-help.com
URL: https://auspos-help.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.144.2.39 , Hong Kong, ASN138152 (YISUCLOUDLTD-HK YISU CLOUD LTD, HK),
Reverse DNS
Software
nginx /
Resource Hash
3565799b3a79b120d8c4351a41687a50b4af6ffae30209c80e14efc876cb7a1f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://auspos-help.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 03:20:20 GMT
last-modified
Thu, 07 Apr 2022 03:20:02 GMT
server
nginx
etag
"624e5862-2914"
strict-transport-security
max-age=31536000
content-type
image/png
cache-control
max-age=2592000
accept-ranges
bytes
content-length
10516
expires
Sat, 14 May 2022 03:20:20 GMT
amex.png
auspos-help.com/novue/img/ 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://auspos-help.com/novue/img/amex.png
Requested by
Host: auspos-help.com
URL: https://auspos-help.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.144.2.39 , Hong Kong, ASN138152 (YISUCLOUDLTD-HK YISU CLOUD LTD, HK),
Reverse DNS
Software
nginx /
Resource Hash
b81ac8697764ada2748355f5459a73e8e3a56bc79e7e36e2212afa42580e4cac
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://auspos-help.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 03:20:20 GMT
last-modified
Thu, 07 Apr 2022 03:20:02 GMT
server
nginx
etag
"624e5862-1e81"
strict-transport-security
max-age=31536000
content-type
image/png
cache-control
max-age=2592000
accept-ranges
bytes
content-length
7809
expires
Sat, 14 May 2022 03:20:20 GMT
jquery.min.js
auspos-help.com/js/ 		114 KB
40 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://auspos-help.com/js/jquery.min.js
Requested by
Host: auspos-help.com
URL: https://auspos-help.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.144.2.39 , Hong Kong, ASN138152 (YISUCLOUDLTD-HK YISU CLOUD LTD, HK),
Reverse DNS
Software
nginx /
Resource Hash
a277e7084fb581552a778d553c967917f9dc0498728b7bc302aa119e62dbf035
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://auspos-help.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 03:20:20 GMT
content-encoding
gzip
last-modified
Fri, 08 Apr 2022 08:12:35 GMT
server
nginx
etag
W/"624fee73-1c86a"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=43200
strict-transport-security
max-age=31536000
expires
Thu, 14 Apr 2022 15:20:20 GMT
z_stat.php
s9.cnzz.com/ 		11 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s9.cnzz.com/z_stat.php?id=1281007932&web_id=1281007932
Requested by
Host: auspos-help.com
URL: https://auspos-help.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
221.231.83.250 Yancheng, China, ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN),
Reverse DNS
Software
Tengine / PHP/5.5.25
Resource Hash
1b276d79e87593f896e96ae11439075edc2e826e5b3e4146d14f40b2e31aec34

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://auspos-help.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 02:56:52 GMT
content-encoding
gzip
age
1411
x-powered-by
PHP/5.5.25
x-cache
HIT TCP_MEM_HIT dirn:10:1334952105
x-swift-cachetime
10800
x-swift-savetime
Thu, 14 Apr 2022 02:56:52 GMT
content-length
4049
last-modified
Thu, 14 Apr 2022 02:56:52 GMT
server
Tengine
vary
Accept-Encoding
ali-swift-global-savetime
1649905012
content-type
application/javascript
via
cache12.l2cn2656[47,47,200-0,M], cache13.l2cn2656[48,0], cache10.cn2570[0,0,200-0,H], cache16.cn2570[1,0]
cache-control
max-age=5400,s-maxage=10800
timing-allow-origin
*
eagleid
dde7532416499064239616119e
core.php
c.cnzz.com/ 		970 B
911 B 		Script
General
Check archive.org
Download Go to
Full URL
https://c.cnzz.com/core.php?web_id=1281007932&t=z
Requested by
Host: s9.cnzz.com
URL: https://s9.cnzz.com/z_stat.php?id=1281007932&web_id=1281007932
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
221.231.83.250 Yancheng, China, ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN),
Reverse DNS
Software
Tengine / PHP/5.5.25
Resource Hash
47304ce7b16143e3ad49edab960797fb0f65265675e7b0e23893df4926d7080f

Request headers

Referer
https://auspos-help.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date
Thu, 14 Apr 2022 03:07:22 GMT
content-encoding
gzip
age
782
x-powered-by
PHP/5.5.25
x-cache
HIT TCP_MEM_HIT dirn:-2:-2
x-swift-cachetime
900
x-swift-savetime
Thu, 14 Apr 2022 03:07:22 GMT
content-length
621
last-modified
Thu, 14 Apr 2022 03:07:22 GMT
server
Tengine
vary
Accept-Encoding
ali-swift-global-savetime
1649905642
content-type
application/javascript
via
cache41.l2cn2656[44,44,200-0,M], cache14.l2cn2656[45,0], cache30.cn2570[0,0,200-0,H], cache16.cn2570[1,0]
timing-allow-origin
*
eagleid
dde7532416499064249777729e
expires
Thu, 14 Apr 2022 03:22:22 GMT
stat.htm
z12.cnzz.com/ 		2 B
123 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://z12.cnzz.com/stat.htm?id=1281007932&r=&lg=en-us&ntime=none&cnzz_eid=1524176374-1649905012-&showp=1600x1200&p=https%3A%2F%2Fauspos-help.com%2F&t=au-post&umuuid=1802616197d17-07c3b3a0eb5151-1a343370-1d4c00-1802616197e774&h=1&rnd=770100241
Requested by
Host: auspos-help.com
URL: https://auspos-help.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2408:4001:f00::135 Beijing, China, ASN37963 (ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.,Ltd., CN),
Reverse DNS
Software
Tengine /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://auspos-help.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 03:20:26 GMT
content-encoding
gzip
server
Tengine
vary
Accept-Encoding
content-type
text/html; charset=utf-8
9.gif
cnzz.mmstat.com/ 		43 B
464 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cnzz.mmstat.com/9.gif?abc=1&rnd=298392996
Requested by
Host: auspos-help.com
URL: https://auspos-help.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
47.246.136.160 , United States, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software
nginx /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://auspos-help.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 03:20:25 GMT
server
nginx
p3p
CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"
cache-control
no-cache
cross-origin-resource-policy
cross-origin
content-type
image/gif
content-length
43
expires
Thu, 01 Jan 1970 00:00:01 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Australia Post (Transportation)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone object| oncontextlost object| oncontextrestored function| getScreenDetails function| xs function| $ function| jQuery object| _cz_loaded string| _cz_account object| _czc object| _CNZZDbridge_1281007932 object| cnzz_image_2141609526 object| cnzz_image_1845751928

6 Cookies

Domain/Path Name / Value
auspos-help.com/ Name: laravel_session
Value: eyJpdiI6Ik5DQmFBZGpud21oZTFKdnFwd3gwOVE9PSIsInZhbHVlIjoiSzE1WW1EQ2ZnMWdwanJXb01xNXpBNFNlZGd2eStpV2pYY2diU0ZadXBQNEUzU01jbytudjRVV2RYYkdsTlhSRHVwWSt5ck40TXlpbXE5MEQ5Z3N0eVFCSTFJZHQrS280QVhLODZGRXN4ME9SZnhETE80VjNYTEF5VDlqNktTTE0iLCJtYWMiOiI0NjlhMWE1MGQ1NzRhM2Y0N2I3ZGE2YTcyNTcxZTIxZGQzNWMzMTRmNDc3MGQ3NDE5N2IzZWZiOTUzOGFkNTY5IiwidGFnIjoiIn0%3D
.auspos-help.com/ Name: UM_distinctid
Value: 1802616197d17-07c3b3a0eb5151-1a343370-1d4c00-1802616197e774
auspos-help.com/ Name: CNZZDATA1281007932
Value: 1524176374-1649905012-%7C1649905012
.mmstat.com/ Name: cna
Value: +YDeGmPycicCAcEbDhqWjR3w
.cnzz.mmstat.com/ Name: sca
Value: de5245e3
.cnzz.mmstat.com/ Name: atpsida
Value: 5574f73f0265234f1aaf4c6a_1649906425_1

2 Console Messages

Source Level URL
Text
javascript warning URL: https://s9.cnzz.com/z_stat.php?id=1281007932&web_id=1281007932
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://c.cnzz.com/core.php?web_id=1281007932&t=z, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://s9.cnzz.com/z_stat.php?id=1281007932&web_id=1281007932
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://c.cnzz.com/core.php?web_id=1281007932&t=z, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000