usps.com.02a49owc.anadol.xyz
Open in
urlscan Pro
185.115.242.222
Malicious Activity!
Public Scan
Submission: On February 23 via automatic, source phishtank
Summary
This is the only time usps.com.02a49owc.anadol.xyz was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
9 | 185.115.242.222 185.115.242.222 | 51540 (DBT-AS) (DBT-AS) | |
9 | 1 |
ASN51540 (DBT-AS, TR)
PTR: mx.venov.net
usps.com.02a49owc.anadol.xyz |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
anadol.xyz
usps.com.02a49owc.anadol.xyz |
775 KB |
9 | 1 |
Domain | Requested by | |
---|---|---|
9 | usps.com.02a49owc.anadol.xyz |
usps.com.02a49owc.anadol.xyz
|
9 | 1 |
This site contains no links.
Subject Issuer | Validity | Valid |
---|
This page contains 1 frames:
Primary Page:
http://usps.com.02a49owc.anadol.xyz/track/Login2.php?dispatched=83&id=7004530197&websrc=59c275dc2e97dd3b896ed4ff2b82a8fd
Frame ID: (F0D3AB64493BBB5BB4DE74D620ABB3B9)
Requests: 9 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
9 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
Login2.php
usps.com.02a49owc.anadol.xyz/track/ |
3 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
m1.png
usps.com.02a49owc.anadol.xyz/track/images/ |
33 KB 33 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
m2.png
usps.com.02a49owc.anadol.xyz/track/images/ |
157 KB 157 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
m3.png
usps.com.02a49owc.anadol.xyz/track/images/ |
116 KB 116 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
m4.png
usps.com.02a49owc.anadol.xyz/track/images/ |
461 KB 461 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
m6.png
usps.com.02a49owc.anadol.xyz/track/images/ |
174 B 415 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
m7.png
usps.com.02a49owc.anadol.xyz/track/images/ |
358 B 599 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
m5.png
usps.com.02a49owc.anadol.xyz/track/images/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
continue.png
usps.com.02a49owc.anadol.xyz/track/images/ |
401 B 643 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)1 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| unhideBody0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
usps.com.02a49owc.anadol.xyz
185.115.242.222
00ced541e81e6600003455e31f510dc530d2bc304292fe0e5bb8ad4ea96d8c7c
0677b0bd86269dfb4078afd96b5ae78cb3ae8d2c9bcbe5eea33aaffc809732d8
09b648b79d47694cad6a6a94b2b7758f5bdbd09c1b1e7bf81b30c4a135631e2a
0a30956d43221ed177bc7c8b0b18a004112df1e32bb12f4562a5ba6c1418803c
2198157d1ee29b8b6957684b737d654250088e91cb08abe71d4de7f52b108646
6e0ba70ab0f76f02eae1ee0dde83fcad6bbbd5fd7ab62ead9451b50cfdcf2fac
75ef0d7a934072ca696c97139976716b53b6a16ae8b663b5e047a9145cea5df9
91b6efea20a02cedd2aaa1d070b5b52be34af5a49668b6109da60c02e43c9d61
ba6bd32c726976e61ef06127d1b1a9f068b4d5602fe0220cfcff417ff94b6e61