w2261017.tgmss.com
Open in
urlscan Pro
45.119.83.120
Malicious Activity!
Public Scan
URL:
http://w2261017.tgmss.com/admin/model/localisation/188-109-106-210.188.109llbnQxL2NjdHJ1dGgub3JnL3dlYi9kdmQvQVVESU9fVFP/amz/
Submission: On August 18 via automatic, source phishtank
Submission: On August 18 via automatic, source phishtank
Summary
This website contacted 1 IPs
in 1 countries
across 1 domains to perform 9 HTTP transactions.
The main IP is 45.119.83.120, located in
Viet Nam and
belongs to LVSS-AS-VN Long Van System Solution JSC, VN.
The main domain is w2261017.tgmss.com.
This is the only time w2261017.tgmss.com was scanned on urlscan.io!
This is the only time w2261017.tgmss.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: La Poste (Transportation)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 9 | 45.119.83.120 45.119.83.120 | 131386 (LVSS-AS-V...) (LVSS-AS-VN Long Van System Solution JSC) | |
| 9 | 1 |
9
45.119.83.120
(Viet Nam)
ASN131386 (LVSS-AS-VN Long Van System Solution JSC, VN)
PTR: mail.bandidau.com
ASN131386 (LVSS-AS-VN Long Van System Solution JSC, VN)
PTR: mail.bandidau.com
| w2261017.tgmss.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 9 |
tgmss.com
w2261017.tgmss.com |
165 KB |
| 9 | 1 |
| Domain | Requested by | |
|---|---|---|
| 9 | w2261017.tgmss.com |
w2261017.tgmss.com
|
| 9 | 1 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| www.chronopost.fr |
| boutique.chronopost.fr |
| www.transport-express-colis.com |
| www.laposte.fr |
| www.geopostgroup.com |
| timbres.laposte.fr |
| Subject Issuer | Validity | Valid |
|---|
This page contains 1 frames:
Primary Page:
http://w2261017.tgmss.com/admin/model/localisation/188-109-106-210.188.109llbnQxL2NjdHJ1dGgub3JnL3dlYi9kdmQvQVVESU9fVFP/amz/
Frame ID: 6D3A3EAA2A148B97EECFFC8D74F73ACF
Requests: 9 HTTP requests in this frame
22 Outgoing links
These are links going to different origins than the main page.
URL: http://www.chronopost.fr/expedier/inputLTNumbersNoJahia.do?listeNumeros=#debut
Search URL Search Domain Scan URL
URL: http://www.chronopost.fr/expedier/inputLTNumbersNoJahia.do?listeNumeros=#contenu
Title: Contenu de page
Title: Contenu de page
Search URL Search Domain Scan URL
URL: http://www.chronopost.fr/transport-express/livraison-colis/logout.do?pid=704&iv4Context=-1
Title: Aide
Title: Aide
Search URL Search Domain Scan URL
URL: http://www.chronopost.fr/transport-express/livraison-colis/logout.do?pid=713&iv4Context=-1
Title: FAQ
Title: FAQ
Search URL Search Domain Scan URL
URL: http://www.chronopost.fr/transport-express/livraison-colis/loginById.do?pid=600&iv4Context=-1
Title:
Title:
Search URL Search Domain Scan URL
URL: http://www.chronopost.fr/expedier/accueilShipping.do?reinit=true&iv4Context=-1
Title: EXPEDIER
Title: EXPEDIER
Search URL Search Domain Scan URL
URL: http://www.chronopost.fr/expedier/accueilShipping.do;JSESSIONID_IV4=Y7RKrNHFsw87R9vyvLyy2G8PtPJpxlvdJLxL0X16QvVxKqQsD9TG!-177722695
Title: ENLEVER
Title: ENLEVER
Search URL Search Domain Scan URL
URL: http://www.chronopost.fr/transport-express/livraison-colis/loginById.do?pid=701&iv4Context=-1
Title: SUIVRE
Title: SUIVRE
Search URL Search Domain Scan URL
URL: http://www.chronopost.fr/transport-express/livraison-colis/loginById.do?pid=702&iv4Context=-1
Title: OFFRE CHRONOPOST
Title: OFFRE CHRONOPOST
Search URL Search Domain Scan URL
URL: http://www.chronopost.fr/transport-express/livraison-colis/loginById.do?pid=703&iv4Context=-1
Title: A PROPOS DE CHRONOPOST
Title: A PROPOS DE CHRONOPOST
Search URL Search Domain Scan URL
URL: http://www.chronopost.fr/transport-express/livraison-colis/loginById.do?urlkey=homepage
Title: English version
Title: English version
Search URL Search Domain Scan URL
URL: http://www.chronopost.fr/transport-express/livraison-colis/accueil/pid/6702
Title: Chronopost recrute
Title: Chronopost recrute
Search URL Search Domain Scan URL
URL: http://boutique.chronopost.fr/
Title: E-boutique
Title: E-boutique
Search URL Search Domain Scan URL
URL: http://www.chronopost.fr/transport-express/livraison-colis/logout.do?pid=1000&iv4Context=-1
Title: Mentions légales
Title: Mentions légales
Search URL Search Domain Scan URL
URL: http://www.chronopost.fr/transport-express/livraison-colis/logout.do?pid=714&iv4Context=-1
Title: Contact
Title: Contact
Search URL Search Domain Scan URL
URL: http://www.chronopost.fr/transport-express/livraison-colis/logout.do?pid=1523&iv4Context=-1
Title: Espace presse
Title: Espace presse
Search URL Search Domain Scan URL
URL: http://www.chronopost.fr/transport-express/livraison-colis/logout.do?pid=1425&iv4Context=-1
Title: Plan du site
Title: Plan du site
Search URL Search Domain Scan URL
URL: http://www.transport-express-colis.com/
Title: Transport express de colis
Title: Transport express de colis
Search URL Search Domain Scan URL
URL: http://www.laposte.fr/
Title: La Poste
Title: La Poste
Search URL Search Domain Scan URL
URL: http://www.geopostgroup.com/
Title: GeoPost
Title: GeoPost
Search URL Search Domain Scan URL
URL: http://timbres.laposte.fr/?prov=313
Title: La Boutique du Timbre
Title: La Boutique du Timbre
Search URL Search Domain Scan URL
URL: http://www.laposte.fr/boxecommerce
Title: Box e-commerce
Title: Box e-commerce
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
9 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
/
w2261017.tgmss.com/admin/model/localisation/188-109-106-210.188.109llbnQxL2NjdHJ1dGgub3JnL3dlYi9kdmQvQVVESU9fVFP/amz/ |
13 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
style.css
w2261017.tgmss.com/admin/model/localisation/188-109-106-210.188.109llbnQxL2NjdHJ1dGgub3JnL3dlYi9kdmQvQVVESU9fVFP/amz/poste_files/ |
61 KB 11 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
logo-chronopost-international.png
w2261017.tgmss.com/admin/model/localisation/188-109-106-210.188.109llbnQxL2NjdHJ1dGgub3JnL3dlYi9kdmQvQVVESU9fVFP/amz/poste_files/ |
7 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
double-logo.png
w2261017.tgmss.com/admin/model/localisation/188-109-106-210.188.109llbnQxL2NjdHJ1dGgub3JnL3dlYi9kdmQvQVVESU9fVFP/amz/poste_files/ |
5 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
picto-search.png
w2261017.tgmss.com/admin/model/localisation/188-109-106-210.188.109llbnQxL2NjdHJ1dGgub3JnL3dlYi9kdmQvQVVESU9fVFP/amz/images/commun/ |
9 KB 9 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
generic.png
w2261017.tgmss.com/admin/model/localisation/188-109-106-210.188.109llbnQxL2NjdHJ1dGgub3JnL3dlYi9kdmQvQVVESU9fVFP/amz/poste_files/poste_files/ |
9 KB 9 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
cvv.jpg
w2261017.tgmss.com/admin/model/localisation/188-109-106-210.188.109llbnQxL2NjdHJ1dGgub3JnL3dlYi9kdmQvQVVESU9fVFP/amz/poste_files/poste_files/ |
2 KB 2 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
PlutoSansDPDLight-Web.woff
w2261017.tgmss.com/admin/model/localisation/188-109-106-210.188.109llbnQxL2NjdHJ1dGgub3JnL3dlYi9kdmQvQVVESU9fVFP/amz/poste_files/ |
59 KB 59 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
PlutoSansDPDRegular-Web.woff
w2261017.tgmss.com/admin/model/localisation/188-109-106-210.188.109llbnQxL2NjdHJ1dGgub3JnL3dlYi9kdmQvQVVESU9fVFP/amz/poste_files/ |
59 KB 58 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: La Poste (Transportation)6 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| trustedTypes function| rplll function| rpllll function| rpl function| GetTypeNumber function| rpll3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| w2261017.tgmss.com/ | Name: OCSESSID Value: 6bd2e547befc6feba06bce5686 |
|
| .w2261017.tgmss.com/ | Name: currency Value: VND |
|
| .w2261017.tgmss.com/ | Name: language Value: vi-vn |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
w2261017.tgmss.com
45.119.83.120
18772aeed03cde3b768320d3ba30034c0dd14f51cfefa202e2b3d6f7dc7fab99
7426d959171e9d5487e3472ef516bc3f26872e266d71a66330a4cccd5c767f96
c2aa994a02dbbb19fc54decbc10ed520b2e6ee255557feab9644c20daef8e359
c64afcfa2be1d10a4375990cf4d192e4d374d4eeaad621e4721c2641d2f3e12e
e8d225538cae39e65a774cd0d7bfc7cc6127968e020aebb6d5ff20509fba3cb1
f512c14fb6a50ea849c2b56350bd4ff5d1a60c7b69afb94382c33a6c77a1b88b