pridefulmoon.com Open in urlscan Pro
192.185.33.198 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://theflamboyant.net/cssblog/redirect-to-google
Effective URL:
https://pridefulmoon.com/forums/archive/ZMIQ9E542GCZL79/8WuY4RLd/UAVMGU/IPAMHOdIvaLthMle5/?utm_source=podia&utm_medium=br...
Submission: On August 11 via automatic, source phishtank (August 11th 2023, 3:53:10 am UTC) — Scanned from DE

Summary HTTP 1 Redirects Links 5 Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 3 domains to perform 1 HTTP transactions. The main IP is 192.185.33.198, located in United States and belongs to NETWORK-SOLUTIONS-HOSTING, US. The main domain is pridefulmoon.com.
TLS certificate: Issued by R3 on July 22nd 2023. Valid for: 3 months.

This is the only time pridefulmoon.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Swiss Post (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
1 2	192.185.33.198 192.185.33.198	19871 (NETWORK-S...) (NETWORK-SOLUTIONS-HOSTING)
1 1	52.26.17.69 52.26.17.69	16509 (AMAZON-02) (AMAZON-02)
1	2

2 192.185.33.198 (United States) 1 redirects

ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: zecia.net

theflamboyant.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pridefulmoon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.26.17.69 (Boardman, United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-26-17-69.us-west-2.compute.amazonaws.com

links.podia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
1	pridefulmoon.com pridefulmoon.com	5 MB
1	podia.com 1 redirects links.podia.com — Cisco Umbrella Rank: 986968	343 B
1	theflamboyant.net 1 redirects theflamboyant.net	553 B
1	3

	Domain	Requested by
1	pridefulmoon.com
1	links.podia.com	1 redirects
1	theflamboyant.net	1 redirects
1	3

This site contains links to these domains. Also see Links.

Domain
account.idp
de
-

Subject Issuer	Validity	Valid
www.test.theflamboyant.net R3	`2023-07-22` - `2023-10-20`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://pridefulmoon.com/forums/archive/ZMIQ9E542GCZL79/8WuY4RLd/UAVMGU/IPAMHOdIvaLthMle5/?utm_source=podia&utm_medium=broadcast&utm_campaign=1576594
Frame ID: EE044CB9146C0F028C62F47B7437BEB4
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Adressen | postshop.ch

Page URL History Show full URLs

http://theflamboyant.net/cssblog/redirect-to-google HTTP 301
http://links.podia.com/f/a/UdIJhFNrsc6HZC7MPv29CA~~/AAGitQA~/RgRmtTqMP0SVaHR0cHM6Ly9wcmlkZWZ1bG1vb2... HTTP 302
https://pridefulmoon.com/forums/archive/ZMIQ9E542GCZL79/8WuY4RLd/UAVMGU/IPAMHOdIvaLthMle5/?utm_source... Page URL

Page Statistics

1
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

1
Countries

4971 kB
Transfer

14873 kB
Size

0
Cookies

5 Outgoing links

These are links going to different origins than the main page.

URL: https://account.idp/?targetURL=checkout/addresses&abortURL=checkout/addresses&app=opc&service=opc&lang=de
Title: Login

Search URL Search Domain Scan URL

URL: http://de/redirect-barrierefreiheit
Title: Barrierefreiheit

Search URL Search Domain Scan URL

URL: https://-/media/post/agb/agb-shops-der-post.pdf?sc_lang=de
Title: Allgemeine Geschäftsbedingungen

Search URL Search Domain Scan URL

URL: http://de/redirect-rechtliche-hinweise
Title: Rechtlicher Hinweis

Search URL Search Domain Scan URL

URL: http://de/redirect-impressum
Title: Impressum

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://theflamboyant.net/cssblog/redirect-to-google HTTP 301
http://links.podia.com/f/a/UdIJhFNrsc6HZC7MPv29CA~~/AAGitQA~/RgRmtTqMP0SVaHR0cHM6Ly9wcmlkZWZ1bG1vb24uY29tL2ZvcnVtcy9hcmNoaXZlL1pNSVE5RTU0MkdDWkw3OS84V3VZNFJMZC9VQVZNR1UvSVBBTUhPZEl2YUx0aE1sZTUvP3V0bV9zb3VyY2U9cG9kaWEmdXRtX21lZGl1bT1icm9hZGNhc3QmdXRtX2NhbXBhaWduPTE1NzY1OTRXA3NwY0IKZMmMtdJkHrXLTlITd2l0Y2hpZ2VzQGdtYWlsLmNvbVgEAADZzQ~~ HTTP 302
https://pridefulmoon.com/forums/archive/ZMIQ9E542GCZL79/8WuY4RLd/UAVMGU/IPAMHOdIvaLthMle5/?utm_source=podia&utm_medium=broadcast&utm_campaign=1576594 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

1 HTTP transactions
9 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / pridefulmoon.com/forums/archive/ZMIQ9E542GCZL79/8WuY4RLd/UAVMGU/IPAMHOdIvaLthMle5/ Redirect Chain http://theflamboyant.net/cssblog/redirect-to-google http://links.podia.com/f/a/UdIJhFNrsc6HZC7MPv29CA~~/AAGitQA~/RgRmtTqMP0SVaHR0cHM6Ly9wcmlkZWZ1bG1vb24uY29tL2ZvcnVtcy9hcmNoaXZlL1pNSVE5RTU0MkdDWkw3OS84V3VZNFJMZC9VQVZNR1UvSVBBTUhPZEl2YUx0aE1sZTUvP3V0... https://pridefulmoon.com/forums/archive/ZMIQ9E542GCZL79/8WuY4RLd/UAVMGU/IPAMHOdIvaLthMle5/?utm_source=podia&utm_medium=broadcast&utm_campaign=1576594	14 MB 5 MB	1634ms 1134ms	Document text/html	192.185.33.198 NETWORK-SOLUTIONS...
General Check archive.org Show headers Download Go to Full URL https://pridefulmoon.com/forums/archive/ZMIQ9E542GCZL79/8WuY4RLd/UAVMGU/IPAMHOdIvaLthMle5/?utm_source=podia&utm_medium=broadcast&utm_campaign=1576594 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.185.33.198 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US), Reverse DNS zecia.net Software Apache / Resource Hash Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers content-encoding gzip content-type text/html; charset=UTF-8 date Fri, 11 Aug 2023 03:52:57 GMT server Apache vary Accept-Encoding Redirect headers Connection keep-alive Content-Length 0 Content-Type text/plain Date Fri, 11 Aug 2023 03:52:56 GMT Location https://pridefulmoon.com/forums/archive/ZMIQ9E542GCZL79/8WuY4RLd/UAVMGU/IPAMHOdIvaLthMle5/?utm_source=podia&utm_medium=broadcast&utm_campaign=1576594 Server msys-http X-Robots-Tag noindex
GET DATA	200 OK	truncated /	3 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `b1d8e73aeaca62e519b792ade3c0400821a86647bb75095a1367ae0301af807d` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	2 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `512166d840ee09fe9063127d2c01abc24ddb09c782ccfd5e9216a7707c686906` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	310 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `4035d0e2b9df4665bb58b5038a710c7b349fc6669c936a226104888911600d22` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	269 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `2b3c0e1295dea1fd9ea9524f4a87cec9dbfb68ae4684b52cc53edc2cfbf74690` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	224 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `9cd9052ac95b038da896b9c460eb5fc75b3509471e285850c4e53286f7b79316` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 Response headers Content-Type image/svg+xml;charset=utf8
GET DATA	200 OK	truncated /	241 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `92063426d8c0f5bddcaa5cc6bd2bc7e1dbdac0899120a5faf8c1ed08fba618f9` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	30 KB 30 KB		Font font/woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `6dbba61ebcd011f90651705072296582ef12065838be406c1033a7b198b1ea1b` Request headers Referer Origin https://pridefulmoon.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 Response headers Content-Type font/woff2
GET DATA	200 OK	truncated /	30 KB 30 KB		Font font/woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `c0dff120512a8b623a3dbc0b98fcc028d8380961dbb89c0f9ad391b47a2a13b7` Request headers Referer Origin https://pridefulmoon.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 Response headers Content-Type font/woff2
GET DATA	200 OK	truncated /	31 KB 31 KB		Font font/woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `f241569fa67822be0a1d7fcf2406745c9c196d62fd5cdb9826f2e071ca3bb8ff` Request headers Referer Origin https://pridefulmoon.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 Response headers Content-Type font/woff2

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Swiss Post (Transportation)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| savepage_ShadowLoader

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

links.podia.com
pridefulmoon.com
theflamboyant.net
192.185.33.198
52.26.17.69
2b3c0e1295dea1fd9ea9524f4a87cec9dbfb68ae4684b52cc53edc2cfbf74690
4035d0e2b9df4665bb58b5038a710c7b349fc6669c936a226104888911600d22
512166d840ee09fe9063127d2c01abc24ddb09c782ccfd5e9216a7707c686906
6dbba61ebcd011f90651705072296582ef12065838be406c1033a7b198b1ea1b
92063426d8c0f5bddcaa5cc6bd2bc7e1dbdac0899120a5faf8c1ed08fba618f9
9cd9052ac95b038da896b9c460eb5fc75b3509471e285850c4e53286f7b79316
b1d8e73aeaca62e519b792ade3c0400821a86647bb75095a1367ae0301af807d
c0dff120512a8b623a3dbc0b98fcc028d8380961dbb89c0f9ad391b47a2a13b7
f241569fa67822be0a1d7fcf2406745c9c196d62fd5cdb9826f2e071ca3bb8ff

pridefulmoon.com Open in urlscan Pro 192.185.33.198 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

1 Requests

100 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

2 IPs

1 Countries

4971 kBTransfer

14873 kBSize

0 Cookies

5 Outgoing links

Page URL History

Redirected requests

1 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 9 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

0 Cookies

Indicators

pridefulmoon.com Open in urlscan Pro
192.185.33.198 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

1
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

1
Countries

4971 kB
Transfer

14873 kB
Size

0
Cookies

1 HTTP transactions
9 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!