parcelshipping-evri.magallanessorsogon.gov.ph
Open in
urlscan Pro
172.190.81.76
Malicious Activity!
Public Scan
Submitted URL: http://t.co/Uu0pHZ8uyX
Effective URL: https://parcelshipping-evri.magallanessorsogon.gov.ph/trackMyParcelForm.php?sslchannel=true&sessionid=XBwdwAjjLXdp92IJM1eaK90qKhpFMX8Y2UlFpioLb74PQGZS...
Submission: On November 28 via manual from GB — Scanned from GB
Effective URL: https://parcelshipping-evri.magallanessorsogon.gov.ph/trackMyParcelForm.php?sslchannel=true&sessionid=XBwdwAjjLXdp92IJM1eaK90qKhpFMX8Y2UlFpioLb74PQGZS...
Submission: On November 28 via manual from GB — Scanned from GB
Summary
This website contacted 3 IPs
in 2 countries
across 4 domains to perform 9 HTTP transactions.
The main IP is 172.190.81.76, located in
Tappahannock, United States and
belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US.
The main domain is parcelshipping-evri.magallanessorsogon.gov.ph.
TLS certificate: Issued by R3 on November 25th 2023. Valid for: 3 months.
This is the only time parcelshipping-evri.magallanessorsogon.gov.ph was scanned on urlscan.io!
TLS certificate: Issued by R3 on November 25th 2023. Valid for: 3 months.
This is the only time parcelshipping-evri.magallanessorsogon.gov.ph was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Hermes (Transportation)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 2 | 104.244.42.197 104.244.42.197 | 13414 (TWITTER) (TWITTER) | |
| 1 2 | 93.186.225.194 93.186.225.194 | 47541 (VKONTAKTE...) (VKONTAKTE-SPB-AS vk.com) | |
| 2 2 | 198.136.59.206 198.136.59.206 | 33182 (DIMENOC) (DIMENOC) | |
| 2 9 | 172.190.81.76 172.190.81.76 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
| 9 | 3 |
2
198.136.59.206
(United States)
ASN33182 (DIMENOC, US)
PTR: h205us.hmservers.net
ASN33182 (DIMENOC, US)
PTR: h205us.hmservers.net
| www.movemaq.com.br |
9
172.190.81.76
(Tappahannock, United States)
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
| maskuranet.magallanessorsogon.gov.ph | |
| parcelshipping-evri.magallanessorsogon.gov.ph |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 9 |
magallanessorsogon.gov.ph
2 redirects
maskuranet.magallanessorsogon.gov.ph parcelshipping-evri.magallanessorsogon.gov.ph |
443 KB |
| 2 |
movemaq.com.br
2 redirects
www.movemaq.com.br |
333 B |
| 2 |
vk.com
1 redirects
vk.com — Cisco Umbrella Rank: 6956 away.vk.com — Cisco Umbrella Rank: 122844 |
2 KB |
| 2 |
t.co
1 redirects
t.co — Cisco Umbrella Rank: 607 |
954 B |
| 9 | 4 |
| Domain | Requested by | |
|---|---|---|
| 8 | parcelshipping-evri.magallanessorsogon.gov.ph |
1 redirects
away.vk.com
parcelshipping-evri.magallanessorsogon.gov.ph |
| 2 | www.movemaq.com.br | 2 redirects |
| 2 | t.co | 1 redirects |
| 1 | maskuranet.magallanessorsogon.gov.ph | 1 redirects |
| 1 | away.vk.com |
t.co
|
| 1 | vk.com | 1 redirects |
| 9 | 6 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| t.co DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
2023-10-16 - 2024-10-14 |
a year | crt.sh |
| *.vk.com GlobalSign Organization Validation CA - SHA256 - G2 |
2023-03-16 - 2024-02-20 |
a year | crt.sh |
| parcelshipping-evri.magallanessorsogon.gov.ph R3 |
2023-11-25 - 2024-02-23 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://parcelshipping-evri.magallanessorsogon.gov.ph/trackMyParcelForm.php?sslchannel=true&sessionid=XBwdwAjjLXdp92IJM1eaK90qKhpFMX8Y2UlFpioLb74PQGZSzmCFTwEuwG0BHKwYgUOIqReHl9Q9I161217LeWI7H8ZxexuD1C1G11xAoNq6sUSyHqtvnlp2LIhPqJL9eg
Frame ID: 435B280C8785AB885EA7D99641617891
Requests: 9 HTTP requests in this frame
Screenshot
Page Title
Evri - The New Hermes | Cheap Parcel Delivery & Courier ServicePage URL History Show full URLs
-
http://t.co/Uu0pHZ8uyX
HTTP 301
https://t.co/Uu0pHZ8uyX Page URL
-
https://vk.com/away.php?utf=1&to=https%3A%2F%2Fwww.movemaq.com.br%2Fwp-admin%2Fincludes%2Fb...
HTTP 302
https://away.vk.com/away.php?rh=e46dface-b012-4c9e-aa51-c9b3eb505160 Page URL
-
https://www.movemaq.com.br/wp-admin/includes/blockbot
HTTP 301
https://www.movemaq.com.br/wp-admin/includes/blockbot/ HTTP 302
https://maskuranet.magallanessorsogon.gov.ph/ HTTP 302
https://parcelshipping-evri.magallanessorsogon.gov.ph/ HTTP 302
https://parcelshipping-evri.magallanessorsogon.gov.ph/trackMyParcelForm.php?sslchannel=true&sessionid=XBwdwAjjLXdp92IJM1eaK90qKhpF... Page URL
Detected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- \.php(?:$|\?)
Nuxt.js
(JavaScript Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <div [^>]*id="__nuxt"
Vue.js
(JavaScript Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <[^>]+\sdata-v(?:ue)?-
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://t.co/Uu0pHZ8uyX
HTTP 301
https://t.co/Uu0pHZ8uyX Page URL
-
https://vk.com/away.php?utf=1&to=https%3A%2F%2Fwww.movemaq.com.br%2Fwp-admin%2Fincludes%2Fblockbot
HTTP 302
https://away.vk.com/away.php?rh=e46dface-b012-4c9e-aa51-c9b3eb505160 Page URL
-
https://www.movemaq.com.br/wp-admin/includes/blockbot
HTTP 301
https://www.movemaq.com.br/wp-admin/includes/blockbot/ HTTP 302
https://maskuranet.magallanessorsogon.gov.ph/ HTTP 302
https://parcelshipping-evri.magallanessorsogon.gov.ph/ HTTP 302
https://parcelshipping-evri.magallanessorsogon.gov.ph/trackMyParcelForm.php?sslchannel=true&sessionid=XBwdwAjjLXdp92IJM1eaK90qKhpFMX8Y2UlFpioLb74PQGZSzmCFTwEuwG0BHKwYgUOIqReHl9Q9I161217LeWI7H8ZxexuD1C1G11xAoNq6sUSyHqtvnlp2LIhPqJL9eg Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://t.co/Uu0pHZ8uyX HTTP 301
- https://t.co/Uu0pHZ8uyX
- https://vk.com/away.php?utf=1&to=https%3A%2F%2Fwww.movemaq.com.br%2Fwp-admin%2Fincludes%2Fblockbot HTTP 302
- https://away.vk.com/away.php?rh=e46dface-b012-4c9e-aa51-c9b3eb505160
9 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Uu0pHZ8uyX
t.co/ Redirect Chain
|
457 B 608 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
away.php
away.vk.com/ Redirect Chain
|
506 B 828 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Primary Request
trackMyParcelForm.php
parcelshipping-evri.magallanessorsogon.gov.ph/ Redirect Chain
|
52 KB 53 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
d_main.css
parcelshipping-evri.magallanessorsogon.gov.ph/e_v_assetz/css/ |
65 KB 66 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
evri-heart.svg
parcelshipping-evri.magallanessorsogon.gov.ph/e_v_assetz/img/ |
3 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery.js
parcelshipping-evri.magallanessorsogon.gov.ph/e_v_assetz/js/ |
266 KB 266 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
misc.js
parcelshipping-evri.magallanessorsogon.gov.ph/e_v_assetz/js/ |
16 KB 16 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
poppins-regular-webfont.7930357.woff2
parcelshipping-evri.magallanessorsogon.gov.ph/e_v_assetz/fonts/ |
19 KB 19 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
poppins-semibold-webfont.392d12d.woff2
parcelshipping-evri.magallanessorsogon.gov.ph/e_v_assetz/fonts/ |
19 KB 20 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Hermes (Transportation)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture function| $ function| jQuery object| $jscomp7 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| .t.co/ | Name: muc Value: 8129b796-f773-4a10-8cf9-0820d2b0199c |
|
| .vk.com/ | Name: remixlang Value: 3 |
|
| .vk.com/ | Name: remixstlid Value: 9050001172099744375_EqgMYP0BxyIJZ1PwHrY1haOkFe0lnqUj17zq3Af3bzL |
|
| .vk.com/ | Name: remixua Value: -1%7C-1%7C202%7C795292644 |
|
| www.movemaq.com.br/ | Name: PHPSESSID Value: k7rkjbiegri8afhe2dqt9ajin1 |
|
| maskuranet.magallanessorsogon.gov.ph/ | Name: PHPSESSID Value: 8867fa679c93968cba05f61b9ca54fad |
|
| parcelshipping-evri.magallanessorsogon.gov.ph/ | Name: PHPSESSID Value: 7b249d64c038deede611095742c6b648 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
| Header | Value |
|---|---|
| Strict-Transport-Security | max-age=0 |
| X-Xss-Protection | 0 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
away.vk.com
maskuranet.magallanessorsogon.gov.ph
parcelshipping-evri.magallanessorsogon.gov.ph
t.co
vk.com
www.movemaq.com.br
104.244.42.197
172.190.81.76
198.136.59.206
93.186.225.194
031c5081599c7bd31d20405cd83935c937575c5bdffcc9879136cf1fa776bc39
067b66273ba2a156d2f6ca5529e4aeb9949408e47e06bd2d38e2093edc3bbab1
45a86a7d7cec006960446e77620153702fb735052c0a0c755f4d1dac85c9c9f8
475575a56670c4ab3f05ca4b001674bbea9e6cbacaf9e0c0f2527a1aacdb9731
5805b5c786e9d2a4ef962597ae6f2ad133b015b182ab5ff0747e1ae373a20c26
6c072d5390b0af0f25e23f3113ecd39b85222a73eabe923e3b24ce933677895e
84086bb634fc6fd223918894c6b74641811e06e84007937c5809942b7a02ddff