bpost-pakketkosten.su Open in urlscan Pro
165.231.143.114  Malicious Activity! Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request bezorging.php Show response bpost-pakketkosten.su/pakket/	289 KB 289 KB	369ms 246ms	Document text/html	165.231.143.114 FIBERGRID
General Check archive.org Show headers Download Go to Full URL https://bpost-pakketkosten.su/pakket/bezorging.php Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_256_GCM Server 165.231.143.114 Bandhagen, Sweden, ASN37518 (FIBERGRID, SC), Reverse DNS Software Microsoft-IIS/8.5 / PHP/7.2.26 Resource Hash 3a16d5c7ec36abd97801d689d5ae1d63c2b670d4f77500afa6d2f400552db807 Request headers Host bpost-pakketkosten.su Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site none Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Sec-Fetch-Dest document Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Cache-Control no-store, no-cache, must-revalidate, max-age=0, s-maxage=0,post-check=0, pre-check=0 Pragma no-cache Content-Type text/html; charset=UTF-8 Server Microsoft-IIS/8.5 X-Powered-By PHP/7.2.26 Date Wed, 14 Oct 2020 07:08:33 GMT Content-Length 296027
GET H/1.1	404 Not Found	OBP_logo_final_yellow_RGB.png bpost-pakketkosten.su/pakket/	1 KB 1 KB	137ms 50ms	Image text/html	165.231.143.114 FIBERGRID
General Check archive.org Show headers Download Go to Show image Full URL https://bpost-pakketkosten.su/pakket/OBP_logo_final_yellow_RGB.png Requested by Host: bpost-pakketkosten.su URL: https://bpost-pakketkosten.su/pakket/bezorging.php Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_256_GCM Server 165.231.143.114 Bandhagen, Sweden, ASN37518 (FIBERGRID, SC), Reverse DNS Software Microsoft-IIS/8.5 / Resource Hash dc1d54dab6ec8c00f70137927504e4f222c8395f10760b6beecfcfa94e08249f Request headers Referer https://bpost-pakketkosten.su/pakket/bezorging.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Wed, 14 Oct 2020 07:08:33 GMT Server Microsoft-IIS/8.5 Content-Length 1245 Content-Type text/html
GET H2	200	js Show response maps.googleapis.com/maps/api/	120 KB 40 KB	33ms 33ms	Script text/javascript	2a00:1450:4001:814::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://maps.googleapis.com/maps/api/js?client=gme-marktplaats&channel=mp-messaging Requested by Host: bpost-pakketkosten.su URL: https://bpost-pakketkosten.su/pakket/bezorging.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:814::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software mafe / Resource Hash 7ed5ed588db5313b9812f4cc47ab0a21706368644415910dc1c4c28a8f670d46 Security Headers Name Value X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://bpost-pakketkosten.su/pakket/bezorging.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 14 Oct 2020 07:08:34 GMT content-encoding gzip vary Accept-Language server mafe x-frame-options SAMEORIGIN content-type text/javascript; charset=UTF-8 status 200 cache-control public, max-age=1800 server-timing gfet4t7; dur=19 alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 40377 x-xss-protection 0 expires Wed, 14 Oct 2020 07:38:34 GMT
GET DATA	200 OK	truncated /	60 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 4d8efc1a08795aa0356e37486d13806335fa2024a5999dd36284b9e0c7ef2308 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/png
GET H/1.1	200 OK	bezorging.php bpost-pakketkosten.su/pakket/	289 KB 289 KB	238ms 237ms	Font text/html	165.231.143.114 FIBERGRID
General Check archive.org Show headers Download Go to Full URL https://bpost-pakketkosten.su/pakket/bezorging.php Requested by Host: bpost-pakketkosten.su URL: https://bpost-pakketkosten.su/pakket/bezorging.php Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_256_GCM Server 165.231.143.114 Bandhagen, Sweden, ASN37518 (FIBERGRID, SC), Reverse DNS Software Microsoft-IIS/8.5 / PHP/7.2.26 Resource Hash 4b1c1e49308b3377dbf8fe2b3ecbaf15cc67553328bf7200782905b735788ea7 Request headers Origin https://bpost-pakketkosten.su Referer https://bpost-pakketkosten.su/pakket/bezorging.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Pragma no-cache Date Wed, 14 Oct 2020 07:08:33 GMT Cache-Control no-store, no-cache, must-revalidate, max-age=0, s-maxage=0,post-check=0, pre-check=0 Server Microsoft-IIS/8.5 X-Powered-By PHP/7.2.26 Content-Length 296027 Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	bezorging.php bpost-pakketkosten.su/pakket/	16 KB 16 KB	285ms 256ms	Image text/html	165.231.143.114 FIBERGRID
General Check archive.org Show headers Download Go to Show image Full URL https://bpost-pakketkosten.su/pakket/bezorging.php Requested by Host: bpost-pakketkosten.su URL: https://bpost-pakketkosten.su/pakket/bezorging.php Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_256_GCM Server 165.231.143.114 Bandhagen, Sweden, ASN37518 (FIBERGRID, SC), Reverse DNS Software Microsoft-IIS/8.5 / PHP/7.2.26 Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://bpost-pakketkosten.su/pakket/bezorging.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Pragma no-cache Date Wed, 14 Oct 2020 07:08:33 GMT Cache-Control no-store, no-cache, must-revalidate, max-age=0, s-maxage=0,post-check=0, pre-check=0 Server Microsoft-IIS/8.5 X-Powered-By PHP/7.2.26 Content-Length 296027 Content-Type text/html; charset=UTF-8
GET H3-Q050	200	common.js Show response maps.googleapis.com/maps-api-v3/api/js/41/8/	78 KB 78 KB	33ms 15ms	Script text/javascript	2a00:1450:4001:80b::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://maps.googleapis.com/maps-api-v3/api/js/41/8/common.js Requested by Host: maps.googleapis.com URL: https://maps.googleapis.com/maps/api/js?client=gme-marktplaats&channel=mp-messaging Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 3d61f511a1bdc441e3b0e1ce33ead66e051aa0f6e39f6c2e428468a1de6d5496 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://bpost-pakketkosten.su/pakket/bezorging.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 13 Oct 2020 11:20:44 GMT x-content-type-options nosniff last-modified Wed, 29 Jul 2020 06:13:00 GMT server sffe age 71275 vary Accept-Encoding, Origin content-type text/javascript status 200 cache-control public, max-age=31536000 accept-ranges bytes alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 79927 x-xss-protection 0 expires Wed, 13 Oct 2021 11:20:44 GMT
GET H3-Q050	200	util.js Show response maps.googleapis.com/maps-api-v3/api/js/41/8/	144 KB 53 KB	34ms 17ms	Script text/javascript	2a00:1450:4001:80b::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://maps.googleapis.com/maps-api-v3/api/js/41/8/util.js Requested by Host: maps.googleapis.com URL: https://maps.googleapis.com/maps/api/js?client=gme-marktplaats&channel=mp-messaging Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash aee55f1d6a13bb89ad87b393b9a3b335ef580e75d08b50e9efb21699da4fe857 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://bpost-pakketkosten.su/pakket/bezorging.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 07 Oct 2020 23:35:51 GMT content-encoding gzip x-content-type-options nosniff last-modified Wed, 29 Jul 2020 06:13:00 GMT server sffe age 545568 vary Accept-Encoding, Origin content-type text/javascript status 200 cache-control public, max-age=31536000 accept-ranges bytes alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 54471 x-xss-protection 0 expires Thu, 07 Oct 2021 23:35:51 GMT
GET H3-Q050	200	AuthenticationService.Authenticate Show response maps.googleapis.com/maps/api/js/	252 B 390 B	24ms 24ms	Script text/javascript	2a00:1450:4001:80b::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://maps.googleapis.com/maps/api/js/AuthenticationService.Authenticate?1shttps%3A%2F%2Fbpost-pakketkosten.su%2Fpakket%2Fbezorging.php&2sgme-marktplaats&3smp-messaging&callback=_xdc_._v6fabx&client=gme-marktplaats&channel=mp-messaging&token=107130 Requested by Host: maps.googleapis.com URL: https://maps.googleapis.com/maps-api-v3/api/js/41/8/common.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software mafe / Resource Hash 64dd03e82461d01bbce3eb850bc3721b127f62f066f79063cb7eb350301e9e1d Security Headers Name Value X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://bpost-pakketkosten.su/pakket/bezorging.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Wed, 14 Oct 2020 07:08:39 GMT content-encoding gzip server mafe x-frame-options SAMEORIGIN content-type text/javascript; charset=UTF-8 status 200 cache-control no-cache, must-revalidate content-disposition attachment server-timing gfet4t7; dur=10 alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 206 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Belgian Post Group (Transportation)

18 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes function| _ShadowLoader boolean| radioselected boolean| tcsaccepted object| selectedbank function| closeselect function| redirect function| openselect function| radiochange function| changevalues function| gm_authFailure object| google object| module$contents$MapsEvent_MapsEvent object| module$contents$mapsapi$overlay$OverlayView_OverlayView object| _xdc_

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	error	URL: https://maps.googleapis.com/maps/api/js?client=gme-marktplaats&channel=mp-messaging(Line 71) Message: Google Maps JavaScript API error: UnauthorizedURLForClientIdMapError https://developers.google.com/maps/documentation/javascript/error-messages#unauthorized-url-for-client-id-map-error Your site URL to be authorized: https://bpost-pakketkosten.su/pakket/bezorging.php

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bpost-pakketkosten.su
maps.googleapis.com
165.231.143.114
2a00:1450:4001:80b::200a
2a00:1450:4001:814::200a
3a16d5c7ec36abd97801d689d5ae1d63c2b670d4f77500afa6d2f400552db807
3d61f511a1bdc441e3b0e1ce33ead66e051aa0f6e39f6c2e428468a1de6d5496
4b1c1e49308b3377dbf8fe2b3ecbaf15cc67553328bf7200782905b735788ea7
4d8efc1a08795aa0356e37486d13806335fa2024a5999dd36284b9e0c7ef2308
64dd03e82461d01bbce3eb850bc3721b127f62f066f79063cb7eb350301e9e1d
7ed5ed588db5313b9812f4cc47ab0a21706368644415910dc1c4c28a8f670d46
aee55f1d6a13bb89ad87b393b9a3b335ef580e75d08b50e9efb21699da4fe857
dc1d54dab6ec8c00f70137927504e4f222c8395f10760b6beecfcfa94e08249f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855