ip-148-66-133-207.ip.secureserver.net
Open in
urlscan Pro
148.66.133.207
Malicious Activity!
Public Scan
Effective URL: https://ip-148-66-133-207.ip.secureserver.net/post/delivery-status.page.php?/DeliveryCancelled/&pageID=JqmjWyeSHdxfirCtldDgOJgGuVJddAWmrIVNHAg...
Submission: On January 19 via api from BE
Summary
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on January 15th 2021. Valid for: a year.
This is the only time ip-148-66-133-207.ip.secureserver.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Canada Post (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 25 | 148.66.133.207 148.66.133.207 | 26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC) | |
1 | 2606:4700:20:... 2606:4700:20::ac43:4739 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 67.202.94.93 67.202.94.93 | 32748 (STEADFAST) (STEADFAST) | |
25 | 4 |
ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
ip-148-66-133-207.ip.secureserver.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
25 |
secureserver.net
2 redirects
ip-148-66-133-207.ip.secureserver.net |
796 KB |
1 |
amung.us
whos.amung.us |
145 B |
1 |
waust.at
waust.at |
7 KB |
25 | 3 |
Domain | Requested by | |
---|---|---|
25 | ip-148-66-133-207.ip.secureserver.net |
2 redirects
ip-148-66-133-207.ip.secureserver.net
|
1 | whos.amung.us |
waust.at
|
1 | waust.at |
ip-148-66-133-207.ip.secureserver.net
|
25 | 3 |
This site contains links to these domains. Also see Links.
Domain |
---|
whos.amung.us |
Subject Issuer | Validity | Valid | |
---|---|---|---|
ip-148-66-133-207.ip.secureserver.net Sectigo RSA Domain Validation Secure Server CA |
2021-01-15 - 2022-01-15 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2020-09-04 - 2021-09-04 |
a year | crt.sh |
whos.amung.us Sectigo RSA Domain Validation Secure Server CA |
2020-05-21 - 2022-05-21 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://ip-148-66-133-207.ip.secureserver.net/post/delivery-status.page.php?/DeliveryCancelled/&pageID=JqmjWyeSHdxfirCtldDgOJgGuVJddAWmrIVNHAgOdetMVvGHZJonTUuNqDr
Frame ID: 1B19B0F1817D9AF1A16164F217CF76B9
Requests: 26 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://ip-148-66-133-207.ip.secureserver.net/NOTE
HTTP 301
http://ip-148-66-133-207.ip.secureserver.net/NOTE/ Page URL
-
https://ip-148-66-133-207.ip.secureserver.net/post
HTTP 301
https://ip-148-66-133-207.ip.secureserver.net/post/ Page URL
- https://ip-148-66-133-207.ip.secureserver.net/post/delivery-status.page.php?/DeliveryCancelled/&pageID=JqmjWyeSHdxfirCtldD... Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- headers server /php\/?([\d.]+)?/i
CentOS (Operating Systems) Expand
Detected patterns
- headers server /CentOS/i
OpenSSL (Web Server Extensions) Expand
Detected patterns
- headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i
ZURB Foundation (Web Frameworks) Expand
Detected patterns
- html /<div [^>]*class="[^"]*(?:small|medium|large)-\d{1,2} columns/i
Angular (JavaScript Frameworks) Expand
Detected patterns
- html /<[^>]+ ng-version="([\d.]+)"/i
Apache (Web Servers) Expand
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: 17
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://ip-148-66-133-207.ip.secureserver.net/NOTE
HTTP 301
http://ip-148-66-133-207.ip.secureserver.net/NOTE/ Page URL
-
https://ip-148-66-133-207.ip.secureserver.net/post
HTTP 301
https://ip-148-66-133-207.ip.secureserver.net/post/ Page URL
- https://ip-148-66-133-207.ip.secureserver.net/post/delivery-status.page.php?/DeliveryCancelled/&pageID=JqmjWyeSHdxfirCtldDgOJgGuVJddAWmrIVNHAgOdetMVvGHZJonTUuNqDr Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://ip-148-66-133-207.ip.secureserver.net/NOTE HTTP 301
- http://ip-148-66-133-207.ip.secureserver.net/NOTE/
- https://ip-148-66-133-207.ip.secureserver.net/post HTTP 301
- https://ip-148-66-133-207.ip.secureserver.net/post/
25 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
ip-148-66-133-207.ip.secureserver.net/NOTE/ Redirect Chain
|
96 B 439 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Cookie set
/
ip-148-66-133-207.ip.secureserver.net/post/ Redirect Chain
|
225 B 696 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
delivery-status.page.php
ip-148-66-133-207.ip.secureserver.net/post/ |
49 KB 50 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
general.css
ip-148-66-133-207.ip.secureserver.net/post/content/ |
7 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
basic.css
ip-148-66-133-207.ip.secureserver.net/post/content/ |
152 KB 152 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
org.css
ip-148-66-133-207.ip.secureserver.net/post/content/ |
399 KB 399 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bound.css
ip-148-66-133-207.ip.secureserver.net/post/content/ |
63 KB 63 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cpc-main-logo.svg
ip-148-66-133-207.ip.secureserver.net/post/content/ |
12 KB 12 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cpc-logo.svg
ip-148-66-133-207.ip.secureserver.net/post/content/ |
938 B 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
info-glyph.svg
ip-148-66-133-207.ip.secureserver.net/post/content/ |
2 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
alert.svg
ip-148-66-133-207.ip.secureserver.net/post/content/ |
1007 B 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Alert.svg
ip-148-66-133-207.ip.secureserver.net/post/content/ |
220 B 220 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
gov-canada-logo.svg
ip-148-66-133-207.ip.secureserver.net/post/content/ |
14 KB 14 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
d.js
waust.at/ |
13 KB 7 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
fonts.css
ip-148-66-133-207.ip.secureserver.net/post/content/ |
20 KB 21 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
whos.amung.us/pingjs/ |
29 B 145 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
3 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
track-banner-chevron-desktop.svg
ip-148-66-133-207.ip.secureserver.net/post/content/ |
3 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
white.svg
ip-148-66-133-207.ip.secureserver.net/post/content/ |
220 B 220 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
track-banner-bg-desktop.svg
ip-148-66-133-207.ip.secureserver.net/post/content/ |
641 B 975 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
track-icon-desktop.svg
ip-148-66-133-207.ip.secureserver.net/post/content/ |
2 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
feedback.svg
ip-148-66-133-207.ip.secureserver.net/post/content/ |
724 B 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
KFOmCnqEu92Fr1Mu4mxK.woff2
ip-148-66-133-207.ip.secureserver.net/post/content/ |
15 KB 16 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
KFOlCnqEu92Fr1MmSU5fBBc4.woff2
ip-148-66-133-207.ip.secureserver.net/post/content/ |
15 KB 16 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
KFOlCnqEu92Fr1MmEU9fBBc4.woff2
ip-148-66-133-207.ip.secureserver.net/post/content/ |
16 KB 16 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
KFOlCnqEu92Fr1MmWUlfBBc4.woff2
ip-148-66-133-207.ip.secureserver.net/post/content/ |
15 KB 16 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Canada Post (Transportation)31 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| GUmTpiZw function| ilvBFpPwt function| PyUWuqyDU2 function| tNiOACDjbA3 function| JlmLrcanVh4 object| _wau string| wau_w_col string| wau_w_siz object| WAU_ren function| WAU_dynamic function| WAU_dynamic_request function| WAU_r_d function| WAU_insert function| WAU_la function| WAU_addCommas function| WAU_lrd function| WAU_lrs function| WAU_cps function| docReady object| x string| x1 string| x21 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
ip-148-66-133-207.ip.secureserver.net/ | Name: PHPSESSID Value: v3bbdcl685rqm20bimt3lnc1o6 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ip-148-66-133-207.ip.secureserver.net
waust.at
whos.amung.us
148.66.133.207
2606:4700:20::ac43:4739
67.202.94.93
24369e1b2461af9dcefecaf9cc93d64cf22a4c5bac32506100b9e21014507bcf
29f6da0a8c21c5681511bb9b08663d3fd2c5d09c9bd8054ec354c563b8c8b7c1
2c3ef75ec5c7389ab19835091856419a5e6c220a8446ed5145561705912ac971
3d03c4918f50939cab500268643bf8ee6634cce00e3620c148623c68d42030eb
426f0628d73d36a64fb4a26378bc799697e85b56f13e79407695b490bdc3212b
48c3fa6f86c54f1d9bb519220713d4b0a1f8cd1a589a3c03b9fa82e98ecb13e3
4b7bcf4485b487930c12c9031078b953b210f5cb8fdb35e5dbcba2b2456d86dc
56165d806975b2882087e56fa91bb3be04be7c24e2af4db7e25a64dcbc90425e
5c4664dec23fc339079382bfe35804c9fbfd0fbb653f65103c84e7096d6ee051
6a50626ef34e5da6014662089f0775c6187d23e5c22379da71203848eac50ee3
6f4587fb64cd2e7ce26ba21941c80f3ab8d28c257b73d04a87c949b32e4cde2d
6fbee148d2f200534b93648f15f1e14d7b485fe560063df884da92a40c6eb8a4
78f28964ea6e280d3115c7c01dc5389928e60d6a451aa22381194fd5680fe97a
8150663f0e19f60400235d0f5871c48f62a68ae8cd64f007a7100d3b2a57d91a
8c4ed474d4a74faabd168bab080af77b7c74b25586df124ca0380633ae66566c
8fb1850e00c24b83e04ea4f41fe5774cff1d476a293fa7b35cba97827eb194cd
9ab89aff3f5665980aca51362bced84d5c7cfe4131075836c313be28308f3479
9c20b6d80f0ab81e61c35fe5f44b1e1619c8625818f6417aa8f72ca11f169deb
acf56f4833ccd8789f66864deae46f9a6efb8625f15b9e5996a00e5634f094e1
b4d07892cde715d50bb69c1982df496385d1dfd8f9d1867c31f19a3c8634cfae
b94438d2f6494a5b1ed3b1de0fe5ce8242fd1bf93358812e5812afd51ba84f72
bfbac6ac6e53ca7e02f40d58191e829212013927ab352c7da568c3d37ba55499
c4ca3281582b1dcf6c63684d8e6f31a9c3875b18d46992d11bbf506e6d6c5eef
d1f9fbf33db045a86af8a16f01659de9e5fbcce3199edb10a3ac4dc76155c4f9
e467e89a41e68909313eef448847f3446650158fb5d046295fea70fd7d776b87
e62e54914dbabecaaaa6b6ba4b605ec384be240d485555452e7e094a3c5d9b7c