urlscan.io logo urlscan.io
SecurityTrails logo

bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id Open in urlscan Pro
5.22.221.225  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://baghlan.gov.af/web/core/lib/
Effective URL: https://bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id/id-logs-5221225/poc/LoginServices/main/umzug.php
Submission: On October 17 via manual from AT — Scanned from AT
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 4 countries across 4 domains to perform 11 HTTP transactions. The main IP is 5.22.221.225, located in Finland and belongs to UPCLOUD, FI. The main domain is bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id.
TLS certificate: Issued by R3 on October 5th 2023. Valid for: 3 months.
This is the only time bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Österreichische Post (Transportation)

Domain & IP information

IP Address AS Autonomous System
1 103.132.98.224 58469 (MOCI-AS-A...)
2 6 5.22.221.225 202053 (UPCLOUD)
2 152.199.21.175 15133 (EDGECAST)
4 104.17.24.14 13335 (CLOUDFLAR...)
11 5
Apex Domain
Subdomains		 Transfer
6 lp2msasbabel.ac.id
bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id
2 MB
4 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 250
76 KB
2 post.at
assets.post.at
15 KB
1 baghlan.gov.af
baghlan.gov.af
681 B
11 4
Domain Requested by
6 bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id 2 redirects bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id
4 cdnjs.cloudflare.com bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id
2 assets.post.at bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id
1 baghlan.gov.af
11 4

This site contains links to these domains. Also see Links.

Domain
www.facebook.com
www.youtube.com
www.linkedin.com
www.instagram.com
Subject Issuer Validity Valid
www.baghlan.gov.af
R3		 2023-09-28 -
2023-12-27		 3 months crt.sh
bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id
R3		 2023-10-05 -
2024-01-03		 3 months crt.sh
assets.post.at
EuropeanSSL Server CA 2		 2023-04-12 -
2024-05-12		 a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2023-07-03 -
2024-07-02		 a year crt.sh

This page contains 1 frames:

Primary Page: https://bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id/id-logs-5221225/poc/LoginServices/main/umzug.php
Frame ID: BEAEF10CF99AB35DB6008A3B009A723B
Requests: 21 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Post AgUmzug - PostAG

Page URL History Show full URLs

  1. https://baghlan.gov.af/web/core/lib/ Page URL
  2. https://bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id/id-logs-5221225/poc HTTP 301
    https://bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id/id-logs-5221225/poc/ HTTP 302
    https://bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id/id-logs-5221225/poc/LoginServices/index.php?execution=e2s1 Page URL
  3. https://bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id/id-logs-5221225/poc/LoginServices/main/umzug.php Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)
Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

11
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

5
IPs

4
Countries

2322 kB
Transfer

4090 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://baghlan.gov.af/web/core/lib/ Page URL
  2. https://bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id/id-logs-5221225/poc HTTP 301
    https://bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id/id-logs-5221225/poc/ HTTP 302
    https://bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id/id-logs-5221225/poc/LoginServices/index.php?execution=e2s1 Page URL
  3. https://bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id/id-logs-5221225/poc/LoginServices/main/umzug.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1
  • https://bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id/id-logs-5221225/poc HTTP 301
  • https://bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id/id-logs-5221225/poc/ HTTP 302
  • https://bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id/id-logs-5221225/poc/LoginServices/index.php?execution=e2s1

11 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
baghlan.gov.af/web/core/lib/ 		233 B
681 B 		Document
General
Check archive.org
Download Go to
Full URL
https://baghlan.gov.af/web/core/lib/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
103.132.98.224 , Afghanistan, ASN58469 (MOCI-AS-AP Ministry of Communication & IT, AF),
Reverse DNS
rate.afghanpost.gov.af
Software
Apache/2.4.56 (Unix) OpenSSL/1.0.2k-fips /
Resource Hash
517c71cee30a3ff535c61b6dc8b1708bc9b4afadb809c7440216e065b4f4b8c4
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language
de-AT,de;q=0.9

Response headers

Accept-Ranges
bytes
Cache-Control
max-age=1209600
Connection
Keep-Alive
Content-Encoding
gzip
Content-Length
211
Content-Type
text/html
Date
Tue, 17 Oct 2023 13:55:16 GMT
ETag
"e9-607de9689a080-gzip"
Expires
Tue, 31 Oct 2023 13:55:16 GMT
Keep-Alive
timeout=5, max=100
Last-Modified
Tue, 17 Oct 2023 00:27:30 GMT
Server
Apache/2.4.56 (Unix) OpenSSL/1.0.2k-fips
Vary
Accept-Encoding,User-Agent
X-Content-Type-Options
nosniff
index.php
bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id/id-logs-5221225/poc/LoginServices/
Redirect Chain
  • https://bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id/id-logs-5221225/poc
  • https://bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id/id-logs-5221225/poc/
  • https://bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id/id-logs-5221225/poc/LoginServices/index.php?execution=e2s1
1 MB
492 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id/id-logs-5221225/poc/LoginServices/index.php?execution=e2s1
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
5.22.221.225 , Finland, ASN202053 (UPCLOUD, FI),
Reverse DNS
5-22-221-225.pl-waw1.upcloud.host
Software
nginx / PHP/8.0.30 PleskLin
Resource Hash
26715b46bcef43103c5f59b1d6434631585bf4da036d61862c5ea14bdb028249

Request headers

Referer
https://baghlan.gov.af/web/core/lib/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language
de-AT,de;q=0.9

Response headers

content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 17 Oct 2023 13:55:17 GMT
server
nginx
vary
Accept-Encoding
x-powered-by
PHP/8.0.30 PleskLin

Redirect headers

content-length
0
content-type
text/html; charset=UTF-8
date
Tue, 17 Oct 2023 13:55:17 GMT
location
LoginServices/index.php?execution=e2s1
server
nginx
x-powered-by
PHP/8.0.30 PleskLin
Post_Horn_Mini_positiv_RGB_Neu.png
assets.post.at/-/media/Bilder/Investor-Relations/Logos/ 		7 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://assets.post.at/-/media/Bilder/Investor-Relations/Logos/Post_Horn_Mini_positiv_RGB_Neu.png?h=152&w=300&la=en&hash=D981593C4CC9858BF3FD86953D2D5E0B
Requested by
Host: bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id
URL: https://bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id/id-logs-5221225/poc/LoginServices/index.php?execution=e2s1
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.21.175 , Germany, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (via/F36E) /
Resource Hash
032dc5bfa56b44c946b2c85427784bfa7142591036cbe9e359cfb0a0f4f80e86
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-AT,de;q=0.9
Referer
https://bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date
Tue, 17 Oct 2023 13:55:17 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
age
454276
x-cache
HIT
content-disposition
inline; filename="Post_Horn_Mini_positiv_RGB_Neu.png"
content-length
7568
x-xss-protection
1; mode=block
request-context
appId=cid-v1:c9357763-5871-40eb-adfd-d635262fffa0
referrer-policy
strict-origin-when-cross-origin
last-modified
Wed, 22 Feb 2023 11:26:42 GMT
server
ECAcc (via/F36E)
etag
a926b315946f47a18ff6b5bfa365062d
content-type
image/png
access-control-expose-headers
Request-Context
cache-control
public, max-age=604800
accept-ranges
bytes
expires
Wed, 16 Oct 2024 13:55:17 GMT
box.png
bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id/id-logs-5221225/poc/LoginServices/ 		452 KB
452 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id/id-logs-5221225/poc/LoginServices/box.png
Requested by
Host: bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id
URL: https://bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id/id-logs-5221225/poc/LoginServices/index.php?execution=e2s1
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
5.22.221.225 , Finland, ASN202053 (UPCLOUD, FI),
Reverse DNS
5-22-221-225.pl-waw1.upcloud.host
Software
nginx / PleskLin
Resource Hash
83c1036474a804140d06a88fb47b00145f2b772ee6a732f2b1a169dcbadbf27e

Request headers

accept-language
de-AT,de;q=0.9
Referer
https://bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id/id-logs-5221225/poc/LoginServices/index.php?execution=e2s1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date
Tue, 17 Oct 2023 13:55:17 GMT
last-modified
Thu, 21 Sep 2023 11:10:42 GMT
server
nginx
etag
"650c24b2-70f58"
x-powered-by
PleskLin
content-type
image/png
accept-ranges
bytes
content-length
462680
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.1.0/ 		84 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/jquery/3.1.0/jquery.min.js
Requested by
Host: bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id
URL: https://bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id/id-logs-5221225/poc/LoginServices/index.php?execution=e2s1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
702b9e051e82b32038ffdb33a4f7eb5f7b38f4cf6f514e4182d8898f4eb0b7fb
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

accept-language
de-AT,de;q=0.9
Referer
https://bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date
Tue, 17 Oct 2023 13:55:17 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
1227970
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
27198
last-modified
Mon, 04 May 2020 16:11:48 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03ec4-1514f"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PwxN%2B702JxhA0wOqYOqK9tPtjGuB9YkMf3xe9EbfIGtWEq0KvwfPwCOQ%2FhqQrxMPusFQarYpdYNgobO7iu6gYt2rzMbSCSqKyiQuwakdXG1J98qGzMVumuJWV65IxISJV0LCMjgY"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
817909d2ffdb9a2a-FRA
expires
Sun, 06 Oct 2024 13:55:17 GMT
imask.min.js
cdnjs.cloudflare.com/ajax/libs/imask/3.4.0/ 		45 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/imask/3.4.0/imask.min.js
Requested by
Host: bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id
URL: https://bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id/id-logs-5221225/poc/LoginServices/index.php?execution=e2s1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8b76b3502583edddf22df0b9c6ee640053a2cdfeaa113ceff3ea9b61d1f6410d
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

accept-language
de-AT,de;q=0.9
Referer
https://bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date
Tue, 17 Oct 2023 13:55:17 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
16748881
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
10899
last-modified
Mon, 04 May 2020 16:11:11 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03e9f-b217"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sUl3db3XLIiUzo94DoBM0eoEUIfvcB2dqVukwZj%2BqHwVlQ8Z7rKuFEmXZbkhyHSA1FP%2B%2FYc6dtxiupayApoUBBavPLRndl26Mg0HM1Y475RU2giBlWDbYPR0I4sJtwIbVw%2B6HI0B"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
817909d2ffdf9a2a-FRA
expires
Sun, 06 Oct 2024 13:55:17 GMT
truncated
/ 		534 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
92ccff15c08a6f16916e3ee6356f4a19e16451acbba3b364df2c34ba84670698

Request headers

accept-language
de-AT,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		21 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a3b9b469d31790096180616fae0155d3af8088924ef1d724bfd085ff3d12f075

Request headers

Referer
Origin
https://bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id
accept-language
de-AT,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Type
application/octet-stream
truncated
/ 		108 KB
108 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
281442cf45996ccfa2562eab455e17d37f070b15fad6faa1f90db74b6fa0ab5d

Request headers

Referer
Origin
https://bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id
accept-language
de-AT,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Type
application/octet-stream
truncated
/ 		21 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
933bff0361186c08db1d4359090544c77cf38d9e6fde710c61d67bb2dbb6a832

Request headers

Referer
Origin
https://bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id
accept-language
de-AT,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Type
application/octet-stream
truncated
/ 		21 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e1a6432e8aff5d2e64ebbcb411139e62ac9225ac7ea6a4cc904965c8ab83a4ed

Request headers

Referer
Origin
https://bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id
accept-language
de-AT,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Type
application/octet-stream
Primary Request umzug.php
bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id/id-logs-5221225/poc/LoginServices/main/ 		1 MB
491 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id/id-logs-5221225/poc/LoginServices/main/umzug.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
5.22.221.225 , Finland, ASN202053 (UPCLOUD, FI),
Reverse DNS
5-22-221-225.pl-waw1.upcloud.host
Software
nginx / PHP/8.0.30 PleskLin
Resource Hash
e66c55a13e8ff83ac2b52a952007ad7a20f633872d94645ebcf7671948c390a6

Request headers

Referer
https://bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id/id-logs-5221225/poc/LoginServices/index.php?execution=e2s1
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language
de-AT,de;q=0.9

Response headers

content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 17 Oct 2023 13:55:21 GMT
server
nginx
vary
Accept-Encoding
x-powered-by
PHP/8.0.30 PleskLin
Post_Horn_Mini_positiv_RGB_Neu.png
assets.post.at/-/media/Bilder/Investor-Relations/Logos/ 		7 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://assets.post.at/-/media/Bilder/Investor-Relations/Logos/Post_Horn_Mini_positiv_RGB_Neu.png?h=152&w=300&la=en&hash=D981593C4CC9858BF3FD86953D2D5E0B
Requested by
Host: bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id
URL: https://bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id/id-logs-5221225/poc/LoginServices/main/umzug.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.21.175 , Germany, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (via/F36E) /
Resource Hash
032dc5bfa56b44c946b2c85427784bfa7142591036cbe9e359cfb0a0f4f80e86
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-AT,de;q=0.9
Referer
https://bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date
Tue, 17 Oct 2023 13:55:21 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
age
454280
x-cache
HIT
content-disposition
inline; filename="Post_Horn_Mini_positiv_RGB_Neu.png"
content-length
7568
x-xss-protection
1; mode=block
request-context
appId=cid-v1:c9357763-5871-40eb-adfd-d635262fffa0
referrer-policy
strict-origin-when-cross-origin
last-modified
Wed, 22 Feb 2023 11:26:42 GMT
server
ECAcc (via/F36E)
etag
a926b315946f47a18ff6b5bfa365062d
content-type
image/png
access-control-expose-headers
Request-Context
cache-control
public, max-age=604800
accept-ranges
bytes
expires
Wed, 16 Oct 2024 13:55:21 GMT
box.png
bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id/id-logs-5221225/poc/LoginServices/ 		452 KB
452 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id/id-logs-5221225/poc/LoginServices/box.png
Requested by
Host: bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id
URL: https://bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id/id-logs-5221225/poc/LoginServices/main/umzug.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
5.22.221.225 , Finland, ASN202053 (UPCLOUD, FI),
Reverse DNS
5-22-221-225.pl-waw1.upcloud.host
Software
nginx / PleskLin
Resource Hash
83c1036474a804140d06a88fb47b00145f2b772ee6a732f2b1a169dcbadbf27e

Request headers

accept-language
de-AT,de;q=0.9
Referer
https://bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id/id-logs-5221225/poc/LoginServices/main/umzug.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date
Tue, 17 Oct 2023 13:55:21 GMT
last-modified
Thu, 21 Sep 2023 11:10:42 GMT
server
nginx
etag
"650c24b2-70f58"
x-powered-by
PleskLin
content-type
image/png
accept-ranges
bytes
content-length
462680
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.1.0/ 		84 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/jquery/3.1.0/jquery.min.js
Requested by
Host: bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id
URL: https://bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id/id-logs-5221225/poc/LoginServices/main/umzug.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
702b9e051e82b32038ffdb33a4f7eb5f7b38f4cf6f514e4182d8898f4eb0b7fb
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

accept-language
de-AT,de;q=0.9
Referer
https://bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date
Tue, 17 Oct 2023 13:55:21 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
1227974
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
27198
last-modified
Mon, 04 May 2020 16:11:48 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03ec4-1514f"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lV4OE8PMUZhhVLu%2Bh2ZHhloBG2m%2FJAv9yng8uC%2FYPGUm1BtkdLL%2FWQYjG%2BsT7KF3sJUDM9CVGwN12qvmZAdqN9vuNxmCDrU9Jx8Fu0ml%2BghndhkXeZPg26EafqCb%2BzCFZb4955oG"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
817909edf8a29a2a-FRA
expires
Sun, 06 Oct 2024 13:55:21 GMT
imask.min.js
cdnjs.cloudflare.com/ajax/libs/imask/3.4.0/ 		45 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/imask/3.4.0/imask.min.js
Requested by
Host: bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id
URL: https://bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id/id-logs-5221225/poc/LoginServices/main/umzug.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8b76b3502583edddf22df0b9c6ee640053a2cdfeaa113ceff3ea9b61d1f6410d
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

accept-language
de-AT,de;q=0.9
Referer
https://bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date
Tue, 17 Oct 2023 13:55:21 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
16748885
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
10899
last-modified
Mon, 04 May 2020 16:11:11 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03e9f-b217"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7b1lLsfzz5dotfxWZfo7gvwu%2BsHrmnAIBIRTpd6zd5SfF0emsDt5XkS%2FnfgynsninzGOEhTBoqkIEnMMsy62nrkckUOtzltVKbGNmbb%2FufEg9VmkzYP2HJFPwOk75%2FutcJ80lxIw"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
817909edf8b99a2a-FRA
expires
Sun, 06 Oct 2024 13:55:21 GMT
truncated
/ 		534 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
92ccff15c08a6f16916e3ee6356f4a19e16451acbba3b364df2c34ba84670698

Request headers

accept-language
de-AT,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		21 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a3b9b469d31790096180616fae0155d3af8088924ef1d724bfd085ff3d12f075

Request headers

Referer
Origin
https://bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id
accept-language
de-AT,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Type
application/octet-stream
truncated
/ 		108 KB
108 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
281442cf45996ccfa2562eab455e17d37f070b15fad6faa1f90db74b6fa0ab5d

Request headers

Referer
Origin
https://bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id
accept-language
de-AT,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Type
application/octet-stream
truncated
/ 		21 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
933bff0361186c08db1d4359090544c77cf38d9e6fde710c61d67bb2dbb6a832

Request headers

Referer
Origin
https://bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id
accept-language
de-AT,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Type
application/octet-stream
truncated
/ 		21 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e1a6432e8aff5d2e64ebbcb411139e62ac9225ac7ea6a4cc904965c8ab83a4ed

Request headers

Referer
Origin
https://bmctx-65912171f3e5c4172c165111cc0c425a07a975.lp2msasbabel.ac.id
accept-language
de-AT,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Type
application/octet-stream

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Österreichische Post (Transportation)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| date number| year number| month number| day function| $ function| jQuery object| __core-js_shared__ object| core function| IMask

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff