postshee.top
Open in
urlscan Pro
2606:4700:3036::6815:4d36
Malicious Activity!
Public Scan
Submission: On July 24 via api from US — Scanned from DE
Summary
TLS certificate: Issued by GTS CA 1P5 on July 22nd 2023. Valid for: 3 months.
This is the only time postshee.top was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Swiss Post (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
23 | 2606:4700:303... 2606:4700:3036::6815:4d36 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
23 | 1 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
23 |
postshee.top
postshee.top |
223 KB |
23 | 1 |
Domain | Requested by | |
---|---|---|
23 | postshee.top |
postshee.top
|
23 | 1 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
postshee.top GTS CA 1P5 |
2023-07-22 - 2023-10-20 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://postshee.top/
Frame ID: 7C05D9051E12B041452B33A99E93BBE0
Requests: 23 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
23 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
postshee.top/ |
3 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
index-1eaccaf6.js
postshee.top/assets/ |
496 KB 146 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
index-ef7310d7.css
postshee.top/assets/ |
355 B 564 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
/
postshee.top/socket.io/ |
118 B 522 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Layout-97644ab3.js
postshee.top/assets/ |
255 KB 29 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Layout-4442d93c.css
postshee.top/assets/ |
13 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
HomePage-ee93d9d3.js
postshee.top/assets/ |
5 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
_plugin-vue_export-helper-c27b6911.js
postshee.top/assets/ |
1 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
HomePage-92f6726b.css
postshee.top/assets/ |
370 B 669 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
/
postshee.top/socket.io/ |
2 B 412 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
/
postshee.top/socket.io/ |
32 B 450 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
/
postshee.top/socket.io/ |
171 B 545 B |
XHR
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
/
postshee.top/socket.io/ |
2 B 403 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
/
postshee.top/socket.io/ |
20 B 434 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
/
postshee.top/socket.io/ |
2 B 415 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
save-data
postshee.top/api/ |
377 B 847 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
get-app-settings
postshee.top/api/ |
294 B 607 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
get-next-domain
postshee.top/api/ |
0 419 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
can-active
postshee.top/api/ |
112 B 567 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
get-settings
postshee.top/api/ |
48 B 535 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
logger
postshee.top/api/ |
0 408 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
0-dc645ddf.woff2
postshee.top/assets/ |
29 KB 29 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
save-data
postshee.top/api/ |
374 B 854 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Swiss Post (Transportation)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| IMask boolean| __VUE__ boolean| __vite_is_modern_browser object| __darcula_config0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
11 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
postshee.top
2606:4700:3036::6815:4d36
1b86c50efba09a1ff60b40b7d9791214f603d1622e4dda16f8cafa4814359ff5
25819e24d24051c6c0d36c728b05962adae1667aad6a65ab641cfcbfed37dfc7
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
36dadf30f52a2f88023a9486e31563c197a07d74ef9b06b996b1108f413c9b90
410740c838527f530df8f6fff0d7fb8dae6fb80db8454464ce46a428c809d056
4442d93c9fa7cdd30b4a6af9f15367275bb515286152de4016f190da5929e953
474d2259bc5d4e861d2a9ddc19da939a6f1e9188026e554174b987f34f3b33eb
4b7932b43122bece54b808fb7675280703dc5d733e8bfbff01646b674a0dbfec
6553a2002bd57b914d411a44fdf87027d6942583ae4b8839b6391be39be0b6d7
92f6726bfbcfc47a782330c982c0d4e138b17f2a78f2a4dae53be200805a7895
9a98c0afbbb08e52e3e3a9ce91c96ae879e5b497695052436258afc8b9c8886d
b8de7d776da53daa23ed6f28c1ac71a904975fae428ed20bb247e3b0a3469484
baa7c007c345af56a1250877e9592a4f7c53fad09324775298f076c13ae58f53
c5d0b3cea1bc05b34696ae00897f9e3a7236223b6cce1a21190afdb3b0007941
dc645ddffd4b66feb1f5be4d4c661a9ab2e9be2a26c4a08b376ab68d9025dcd9
dccde0b7dc47f9ed3ad3e0db857a4fca5bb8bfc80e67900a0d2cc112730f47d9
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e9df57e04ccb8c8c64a385a1839fef7dd91eb2a2663d4459c607fe0c92b09449
ef7310d7f1fded265c0c00ef9890600034b7c87f5c0515fb7b1066baf202320a
fea0ba4852df94888a0420212856da429d461384eb5d7b7df056d7fee360205e