ctt-expresso.com Open in urlscan Pro
2a06:98c1:3121::3 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://ctt-expresso.com/
Effective URL:
https://ctt-expresso.com/entrega.php
Submission: On April 22 via manual (April 22nd 2023, 6:09:06 pm UTC) from PT — Scanned from NL

Summary HTTP 1 Redirects Links 40 Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 1 HTTP transactions. The main IP is 2a06:98c1:3121::3, located in United States and belongs to CLOUDFLARENET, US. The main domain is ctt-expresso.com.
TLS certificate: Issued by GTS CA 1P5 on March 4th 2023. Valid for: 3 months.

This is the only time ctt-expresso.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: CTT Correios (Transportation)

Domain & IP information

	IP Address		AS Autonomous System
1 2	2a06:98c1:312... 2a06:98c1:3121::3		13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2

2 2a06:98c1:3121::3 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

ctt-expresso.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	ctt-expresso.com 1 redirects ctt-expresso.com	266 KB
1	1

	Domain	Requested by
2	ctt-expresso.com	1 redirects
1	1

This site contains links to these domains. Also see Links.

Domain
www.ctt.pt
appserver.ctt.pt
www.bancoctt.pt
dott.pt
www.cttexpress.com
apps.apple.com
play.google.com
www.facebook.com
www.instagram.com
www.linkedin.com
www.youtube.com
livroreclamacoes.pt

Subject Issuer	Validity	Valid
*.ctt-expresso.com GTS CA 1P5	`2023-03-04` - `2023-06-02`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://ctt-expresso.com/entrega.php
Frame ID: E078BB1EA99F5687C55F87E48019B472
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Seguir ou Alterar uma Entrega

Page URL History Show full URLs

https://ctt-expresso.com/ HTTP 302
https://ctt-expresso.com/entrega.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

1
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

316 kB
Transfer

980 kB
Size

0
Cookies

40 Outgoing links

These are links going to different origins than the main page.

URL: https://www.ctt.pt/particulares/index

Search URL Search Domain Scan URL

URL: https://www.ctt.pt/feapl_2/app/open/objectSearch/objectSearch.jspx?request_locale=pt
Title: Seguir ou alterar entrega

Search URL Search Domain Scan URL

URL: https://www.ctt.pt/feapl_2/app/open/postalCodeSearch/postalCodeSearch.jspx?request_locale=pt
Title: Encontrar códigos postais

Search URL Search Domain Scan URL

URL: https://www.ctt.pt/feecom/app/open/shipping/request.jspx
Title: Enviar sem sair de casa

Search URL Search Domain Scan URL

URL: https://appserver.ctt.pt/ProcessoAduaneiro/
Title: Desalfandegar uma encomenda

Search URL Search Domain Scan URL

URL: https://www.ctt.pt/feapl_2/app/open/stationSearch/stationSearch.jspx?request_locale=pt
Title: Encontrar Lojas e Pontos CTT

Search URL Search Domain Scan URL

URL: https://www.ctt.pt/forms/portagens-em-divida
Title: Consultar portagens em dívida

Search URL Search Domain Scan URL

URL: https://www.ctt.pt/feapl_2/app/open/objectSearch/objectSearch.jspx?objects=RV935677281CN&request_locale=en
Title: Inglês

Search URL Search Domain Scan URL

URL: https://www.ctt.pt/feapl_2/app/open/objectSearch/objectSearch.jspx?objects=RV935677281CN&request_locale=pt
Title: Português

Search URL Search Domain Scan URL

URL: https://www.ctt.pt/ajuda/index
Title: Ajuda

Search URL Search Domain Scan URL

URL: https://www.ctt.pt/empresas/index
Title: Empresas

Search URL Search Domain Scan URL

URL: https://www.ctt.pt/grupo-ctt/index
Title: Grupo CTT

Search URL Search Domain Scan URL

URL: https://www.ctt.pt/femgu/login.jspx?lang=def&redirect=/particulares/index

Search URL Search Domain Scan URL

URL: https://www.ctt.pt/femgu/app/open/enroll/showUserEnrollAction.jspx?lang=def&redirect=https://www.ctt.pt/feapl_2/app/open/objectSearch/objectSearch.jspx
Title: Faça o seu registo

Search URL Search Domain Scan URL

URL: https://www.ctt.pt/particulares/area-cliente
Title: Área de Cliente CTT

Search URL Search Domain Scan URL

URL: https://appserver.ctt.pt/CustomerArea/ClientArea?IsFromClientAreaAndIsMobile=true

Search URL Search Domain Scan URL

URL: https://www.ctt.pt/particulares/enviar/
Title: diferentes soluções de envio disponíveis.

Search URL Search Domain Scan URL

URL: https://www.ctt.pt/particulares/receber/seguir-ou-alterar-uma-entrega/alterar-uma-entrega-expresso
Title: Saber mais sobre estes pedidos de alteração

Search URL Search Domain Scan URL

URL: https://www.ctt.pt/particulares/receber/seguir-ou-alterar-uma-entrega/alterar-uma-entrega-de-correio
Title: Saber mais sobre estes pedidos de alteração

Search URL Search Domain Scan URL

URL: https://www.ctt.pt/feapl_2/app/open/siga/sigaForm.jspx
Title: nova tentativa de entrega

Search URL Search Domain Scan URL

URL: https://www.bancoctt.pt/
Title: Banco CTT

Search URL Search Domain Scan URL

URL: https://dott.pt/
Title: Dott

Search URL Search Domain Scan URL

URL: https://www.cttexpress.com/
Title: CTT Express

Search URL Search Domain Scan URL

URL: https://www.ctt.pt/particulares/pagamentos/
Title: Payshop

Search URL Search Domain Scan URL

URL: https://www.ctt.pt/home/politica-privacidade/index
Title: Política de Privacidade

Search URL Search Domain Scan URL

URL: https://www.ctt.pt/home/politica-cookies
Title: Política de Cookies

Search URL Search Domain Scan URL

URL: https://www.ctt.pt/home/termos-condicoes/index
Title: Termos e Condições

Search URL Search Domain Scan URL

URL: https://www.ctt.pt/home/litigios-de-consumo
Title: Resolução Alternativa de Litígios de Consumo

Search URL Search Domain Scan URL

URL: https://www.ctt.pt/home/oferta-de-acesso/
Title: Oferta de acesso

Search URL Search Domain Scan URL

URL: https://www.ctt.pt/transversais/lista-de-precos-de-correio
Title: Lista de preços de correio

Search URL Search Domain Scan URL

URL: https://apps.apple.com/pt/app/ctt/id715615998?ls=1
Title: Descarregar na App Store

Search URL Search Domain Scan URL

URL: https://play.google.com/store/apps/details?hl=pt-pt&id=ctt.mobile.android.app.ctt&pcampaignid=MKT-Other-global-all-co-prtnr-py-PartBadge-Mar2515-1
Title: Disponível no Google Play

Search URL Search Domain Scan URL

URL: https://www.facebook.com/CTTCorreiosdePortugal
Title: CTT

Search URL Search Domain Scan URL

URL: https://www.facebook.com/CTTEmpresas/
Title: CTT Empresas

Search URL Search Domain Scan URL

URL: https://www.facebook.com/FilateliaCTT
Title: Filatelia CTT

Search URL Search Domain Scan URL

URL: https://www.facebook.com/opainatalsolidario/
Title: Pai Natal Solidário

Search URL Search Domain Scan URL

URL: https://www.instagram.com/cttportugal/

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/ctt---correios-de-portugal-s-a

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UC3NSecyrfNUUZ0XEI4OwU0A

Search URL Search Domain Scan URL

URL: https://livroreclamacoes.pt/

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://ctt-expresso.com/ HTTP 302
https://ctt-expresso.com/entrega.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

1 HTTP transactions
10 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request entrega.php Show response ctt-expresso.com/ Redirect Chain https://ctt-expresso.com/ https://ctt-expresso.com/entrega.php	787 KB 265 KB	119ms 118ms	Document text/html	2a06:98c1:3121::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ctt-expresso.com/entrega.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/8.0.25 Resource Hash `08df76071c0b5759a8b2fbf2fc1470db37ff08ca0afc9a37235f0de034d112c9` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 accept-language nl-NL,nl;q=0.9 Response headers alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 7bbfd0bffb560e80-AMS content-encoding br content-type text/html; charset=UTF-8 date Sat, 22 Apr 2023 18:09:01 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JIPlnmHE2lKOw7heAYX%2FONkUsv7q7uBSKe%2BsgnEXkx48ugLoSVdhoP4dqamVJzWRi9BUhv3kVxlZ6oHbWGkQ6STZF%2BpGrt7dBe%2F5YLYEmFEt%2F60omv31eMKYldpfy6vlvG%2FuAeeMgRjfkudnvep6"}],"group":"cf-nel","max_age":604800} server cloudflare x-powered-by PHP/8.0.25 Redirect headers alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 7bbfd0be28bc0e80-AMS content-type text/html; charset=UTF-8 date Sat, 22 Apr 2023 18:09:01 GMT location entrega.php nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yr6Q3pKOqAshHkLi1p%2FRjd9fm9Wb7L87vbR2O1CP9oNQAJtx%2Bbn%2FyRHMQC3JozuKCdr0CDusH6vX%2BdaidUWS1i79gLRXkN7xU4PnvnfDt5s2chQhR7HYrGyTSLQIZ3%2B9je95c79P7tVmfeaNzqy4"}],"group":"cf-nel","max_age":604800} server cloudflare x-powered-by PHP/8.0.25
GET DATA	200 OK	truncated /	2 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `67ec4ea68ba0cc7cb0f26d847e96bccc2676724650e72b25c3874a0c40cf6b53` Request headers accept-language nl-NL,nl;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	19 KB 19 KB		Font application/font-woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `369602c7e55e19dbb5974b9f3dfb1efe8ba1f0e0822142f5790ee7be8c02a679` Request headers Referer Origin https://ctt-expresso.com accept-language nl-NL,nl;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers Content-Type application/font-woff2
GET DATA	200 OK	truncated /	13 KB 13 KB		Font application/font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `34e6f307095b702538364e9c209e86feed6955efad05f934175d9add79805365` Request headers Referer Origin https://ctt-expresso.com accept-language nl-NL,nl;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers Content-Type application/font-woff;charset=utf-8
GET DATA	200 OK	truncated /	19 KB 19 KB		Font application/font-woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `6c219f0268f9f338fc7341899f441e030e8c60a273fc211d9d9f7aae12611fe3` Request headers Referer Origin https://ctt-expresso.com accept-language nl-NL,nl;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers Content-Type application/font-woff2
GET DATA	200 OK	truncated /	97 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `8bad8fd2a4b3495222a720a7b10895e73ea65e54f07650adce1dea8d9d52583f` Request headers accept-language nl-NL,nl;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers Content-Type image/jpeg
GET DATA	200 OK	truncated /	6 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `f5a7604bc07b20cae669ab7f41e39e8354bcfbc48e75eb77c2f997118dcdca65` Request headers accept-language nl-NL,nl;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	11 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `638641ec9bd444a3ffc4210baad72dead79e04418f4f999950bee69a47fc9195` Request headers accept-language nl-NL,nl;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	12 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `774eabab992a3072207832d1ff128e09ba5fb1afa4631818b4a13cc10fc4a09c` Request headers accept-language nl-NL,nl;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	14 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `736ac33abf13738dd07c53648893598197c50dca1fb435cdf3815834825cc5e8` Request headers accept-language nl-NL,nl;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	667 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `fdcbeb3f378b7fcb53d3e3280310b503f70d16e92d90243a0b3aa1777e2548dd` Request headers accept-language nl-NL,nl;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers Content-Type image/svg+xml

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: CTT Correios (Transportation)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless function| savepage_ShadowLoader

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ctt-expresso.com
2a06:98c1:3121::3
08df76071c0b5759a8b2fbf2fc1470db37ff08ca0afc9a37235f0de034d112c9
34e6f307095b702538364e9c209e86feed6955efad05f934175d9add79805365
369602c7e55e19dbb5974b9f3dfb1efe8ba1f0e0822142f5790ee7be8c02a679
638641ec9bd444a3ffc4210baad72dead79e04418f4f999950bee69a47fc9195
67ec4ea68ba0cc7cb0f26d847e96bccc2676724650e72b25c3874a0c40cf6b53
6c219f0268f9f338fc7341899f441e030e8c60a273fc211d9d9f7aae12611fe3
736ac33abf13738dd07c53648893598197c50dca1fb435cdf3815834825cc5e8
774eabab992a3072207832d1ff128e09ba5fb1afa4631818b4a13cc10fc4a09c
8bad8fd2a4b3495222a720a7b10895e73ea65e54f07650adce1dea8d9d52583f
f5a7604bc07b20cae669ab7f41e39e8354bcfbc48e75eb77c2f997118dcdca65
fdcbeb3f378b7fcb53d3e3280310b503f70d16e92d90243a0b3aa1777e2548dd

ctt-expresso.com Open in urlscan Pro 2a06:98c1:3121::3 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

1 Requests

100 %HTTPS

100 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

316 kBTransfer

980 kBSize

0 Cookies

40 Outgoing links

Page URL History

Redirected requests

1 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 10 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

0 Cookies

Indicators

ctt-expresso.com Open in urlscan Pro
2a06:98c1:3121::3 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

1
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

316 kB
Transfer

980 kB
Size

0
Cookies

1 HTTP transactions
10 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!