urlscan.io logo urlscan.io
SecurityTrails logo

royal-mail-update-secure-128763123128.kaisolek.com Open in urlscan Pro
2606:4700:3033::681f:51f5  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://royal-maildelivery-uk.archfabsystems.com/
Effective URL: https://royal-mail-update-secure-128763123128.kaisolek.com/r1/royal/intro.php?freq=new&topic=tx_clam&appID=pdFWBgSogIjuElWOJxLVQWCodGrSIzcQdPcerXzhyirhRpqG
Submission: On October 30 via manual from CY
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 9 HTTP transactions. The main IP is 2606:4700:3033::681f:51f5, located in United States and belongs to CLOUDFLARENET, US. The main domain is royal-mail-update-secure-128763123128.kaisolek.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on October 30th 2020. Valid for: a year.
This is the only time royal-mail-update-secure-128763123128.kaisolek.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Royal Mail (Government)

Domain & IP information

IP Address AS Autonomous System
1 1 184.168.131.241 26496 (AS-26496-...)
1 10 2606:4700:303... 13335 (CLOUDFLAR...)
9 2
Domain Requested by
9 royal-mail-update-secure-128763123128.kaisolek.com royal-mail-update-secure-128763123128.kaisolek.com
1 rdr31.kaisolek.com 1 redirects
1 royal-maildelivery-uk.archfabsystems.com 1 redirects
9 3
Subject Issuer Validity Valid
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2020-10-30 -
2021-10-29		 a year crt.sh

This page contains 2 frames:

Primary Page: https://royal-mail-update-secure-128763123128.kaisolek.com/r1/royal/intro.php?freq=new&topic=tx_clam&appID=pdFWBgSogIjuElWOJxLVQWCodGrSIzcQdPcerXzhyirhRpqG
Frame ID: 97F7C93B2C774C899B0713A1912761B7
Requests: 11 HTTP requests in this frame

Frame: https://royal-mail-update-secure-128763123128.kaisolek.com/assets/images/sending-your-item-infographic.svg
Frame ID: 09302E6A82C79A0FB55BDAD7BBA7171B
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://royal-maildelivery-uk.archfabsystems.com/ HTTP 301
    https://rdr31.kaisolek.com/r1/index.php HTTP 302
    https://royal-mail-update-secure-128763123128.kaisolek.com/r1/royal/ Page URL
  2. https://royal-mail-update-secure-128763123128.kaisolek.com/r1/royal/intro.php?freq=new&topic=tx_clam&appID=pdFWBgSogIjuElWOJxLVQWCodGrS... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /^cloudflare$/i

Page Statistics

9
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

3
Subdomains

2
IPs

1
Countries

326 kB
Transfer

854 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://royal-maildelivery-uk.archfabsystems.com/ HTTP 301
    https://rdr31.kaisolek.com/r1/index.php HTTP 302
    https://royal-mail-update-secure-128763123128.kaisolek.com/r1/royal/ Page URL
  2. https://royal-mail-update-secure-128763123128.kaisolek.com/r1/royal/intro.php?freq=new&topic=tx_clam&appID=pdFWBgSogIjuElWOJxLVQWCodGrSIzcQdPcerXzhyirhRpqG Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://royal-maildelivery-uk.archfabsystems.com/ HTTP 301
  • https://rdr31.kaisolek.com/r1/index.php HTTP 302
  • https://royal-mail-update-secure-128763123128.kaisolek.com/r1/royal/

9 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
royal-mail-update-secure-128763123128.kaisolek.com/r1/royal/
Redirect Chain
  • http://royal-maildelivery-uk.archfabsystems.com/
  • https://rdr31.kaisolek.com/r1/index.php
  • https://royal-mail-update-secure-128763123128.kaisolek.com/r1/royal/
201 B
604 B 		Document
General
Check archive.org
Download Go to
Full URL
https://royal-mail-update-secure-128763123128.kaisolek.com/r1/royal/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3033::681f:51f5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
88d25d6e324402daeca95fd546f3f21baf5a073c97b39d21ae1407765160d07c

Request headers

:method
GET
:authority
royal-mail-update-secure-128763123128.kaisolek.com
:scheme
https
:path
/r1/royal/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
__cfduid=d6ba96ca7b8950e91b99f262dd8023e071604075766
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
date
Fri, 30 Oct 2020 16:36:07 GMT
content-type
text/html; charset=UTF-8
set-cookie
PHPSESSID=385bf15clc7asf3o6s373km7bv; path=/
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate
pragma
no-cache
vary
Accept-Encoding
cf-cache-status
DYNAMIC
cf-request-id
061bf6dc640000c2f9a539f000000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=XWgD%2FGiinuPWFAU2QxHJOyVBk%2B%2Bqi75rN5hr3Ybr6FhRFkked%2FGmGeYR6k%2BXkGE41Kn3IsNDIfXn5Of6SpmMQgF%2BxTQOQR39BQByJ6CE54mz1rC8P4FMKMNIl6Xs1Hnm6KnAISSJufBp0EuxCSHaGCimm5AGC7Qsl7sqLRZteQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel
{"report_to":"cf-nel","max_age":604800}
server
cloudflare
cf-ray
5ea68da6fc65c2f9-FRA
content-encoding
br

Redirect headers

status
302
date
Fri, 30 Oct 2020 16:36:06 GMT
content-type
text/html; charset=UTF-8
set-cookie
__cfduid=d6ba96ca7b8950e91b99f262dd8023e071604075766; expires=Sun, 29-Nov-20 16:36:06 GMT; path=/; domain=.kaisolek.com; HttpOnly; SameSite=Lax; Secure
location
https://royal-mail-update-secure-128763123128.kaisolek.com/r1/royal/
cf-cache-status
DYNAMIC
cf-request-id
061bf6dc070000c2f9b9257000000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=ZdamlcVZH0KuaQjzAu2IEVjYwbfUmJ%2FdAC%2FGQtGXE4bmJ%2FvUXYCM%2B7DSjLk8BAYkmQ5akaVsamP4cvb2K4fMNP%2FGVElUdne9cTn3LnmZgDloFkEHNgxRdu7EYvn%2FMh4%3D"}],"group":"cf-nel","max_age":604800}
nel
{"report_to":"cf-nel","max_age":604800}
server
cloudflare
cf-ray
5ea68da67b20c2f9-FRA
Primary Request intro.php
royal-mail-update-secure-128763123128.kaisolek.com/r1/royal/ 		561 KB
325 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://royal-mail-update-secure-128763123128.kaisolek.com/r1/royal/intro.php?freq=new&topic=tx_clam&appID=pdFWBgSogIjuElWOJxLVQWCodGrSIzcQdPcerXzhyirhRpqG
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3033::681f:51f5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
70ed2dcb60a17c4797543531b7600186901b32df8833b841e19b3994da743806

Request headers

:method
GET
:authority
royal-mail-update-secure-128763123128.kaisolek.com
:scheme
https
:path
/r1/royal/intro.php?freq=new&topic=tx_clam&appID=pdFWBgSogIjuElWOJxLVQWCodGrSIzcQdPcerXzhyirhRpqG
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
same-origin
sec-fetch-mode
navigate
sec-fetch-dest
document
referer
https://royal-mail-update-secure-128763123128.kaisolek.com/r1/royal/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
__cfduid=d6ba96ca7b8950e91b99f262dd8023e071604075766; PHPSESSID=385bf15clc7asf3o6s373km7bv
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://royal-mail-update-secure-128763123128.kaisolek.com/r1/royal/

Response headers

status
200
date
Fri, 30 Oct 2020 16:36:07 GMT
content-type
text/html; charset=UTF-8
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate
pragma
no-cache
vary
Accept-Encoding
cf-cache-status
DYNAMIC
cf-request-id
061bf6dd6a0000c2f95d046000000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=XZV2%2BdAey7Vmanfl38daXC6vrto9qqaSYLi0ik3zLAlThD3RvzfKdRM0FhpOcHVNBD56tPm9%2B2Oqlq89GWbXwSx3hPHxD1iJJwFCgBLDIfuqSY4Jk9MCTrbRR5XJ0Ip46lM3JVL6Uob%2FcWJXX3z9%2FU7%2BimKmoQiFS%2FrreIdDLQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel
{"report_to":"cf-nel","max_age":604800}
server
cloudflare
cf-ray
5ea68da8af9cc2f9-FRA
content-encoding
br
truncated
/ 		8 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2087a094b0a427d552413baedcf0e1d92b442e44c8dd7a4c517c569b4b76c038

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		260 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2fc8c7cb39825b0c5fcf608136ac9c79aced90c297c0db611b0412848078e48e

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/jpeg
chevinstd-bold.woff2
royal-mail-update-secure-128763123128.kaisolek.com/assets/fonts/chevin/ 		0
0 		Font
General
Check archive.org
Download Go to
Full URL
https://royal-mail-update-secure-128763123128.kaisolek.com/assets/fonts/chevin/chevinstd-bold.woff2
Requested by
Host: royal-mail-update-secure-128763123128.kaisolek.com
URL: https://royal-mail-update-secure-128763123128.kaisolek.com/r1/royal/intro.php?freq=new&topic=tx_clam&appID=pdFWBgSogIjuElWOJxLVQWCodGrSIzcQdPcerXzhyirhRpqG
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3033::681f:51f5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Origin
https://royal-mail-update-secure-128763123128.kaisolek.com
Referer
https://royal-mail-update-secure-128763123128.kaisolek.com/r1/royal/intro.php?freq=new&topic=tx_clam&appID=pdFWBgSogIjuElWOJxLVQWCodGrSIzcQdPcerXzhyirhRpqG
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 30 Oct 2020 16:36:07 GMT
content-encoding
br
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Gf5z746zHjN%2BS%2BItodVXQFDl8R2HOBFDnKO531G2OaR%2B0bT0Hby%2Fh0GdqCXHaZPCtiaIpUkdmtNUqq0I3w31U%2FzVvM%2FXw4V6kXHueqHFurobYPYmWmkbtef%2Bk2FDeHRpjO1qYtri5iJoEnaFBi0H%2BCWJ%2FIZPnRqsX%2Bukekci3g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=iso-8859-1
status
404
cache-control
max-age=14400
cf-ray
5ea68dabae75c2f9-FRA
cf-request-id
061bf6df450000c2f9630d2000000001
chevinstd-medium.woff2
royal-mail-update-secure-128763123128.kaisolek.com/assets/fonts/chevin/ 		0
0 		Font
General
Check archive.org
Download Go to
Full URL
https://royal-mail-update-secure-128763123128.kaisolek.com/assets/fonts/chevin/chevinstd-medium.woff2
Requested by
Host: royal-mail-update-secure-128763123128.kaisolek.com
URL: https://royal-mail-update-secure-128763123128.kaisolek.com/r1/royal/intro.php?freq=new&topic=tx_clam&appID=pdFWBgSogIjuElWOJxLVQWCodGrSIzcQdPcerXzhyirhRpqG
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3033::681f:51f5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Origin
https://royal-mail-update-secure-128763123128.kaisolek.com
Referer
https://royal-mail-update-secure-128763123128.kaisolek.com/r1/royal/intro.php?freq=new&topic=tx_clam&appID=pdFWBgSogIjuElWOJxLVQWCodGrSIzcQdPcerXzhyirhRpqG
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 30 Oct 2020 16:36:07 GMT
content-encoding
br
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=A9bZFQVG9ETSfyWawlwdHMwVGIhR8d0i35llgKuSyPg3%2F4uIQMYdKoM2cWfRISX1PqYA9ZnENWzp99eCiFSN%2Bs5w%2B9TfRv9kuFvDxuJzdCOjnaqjuzvvZTqzVhDShawNRx708B3CZ5aQ7p%2BjNzKrYcO4kwXqL8RD%2B0luF%2FAI9w%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=iso-8859-1
status
404
cache-control
max-age=14400
cf-ray
5ea68dabae77c2f9-FRA
cf-request-id
061bf6df470000c2f99b014000000001
chevinstd-bold.woff
royal-mail-update-secure-128763123128.kaisolek.com/assets/fonts/chevin/ 		0
0 		Font
General
Check archive.org
Download Go to
Full URL
https://royal-mail-update-secure-128763123128.kaisolek.com/assets/fonts/chevin/chevinstd-bold.woff
Requested by
Host: royal-mail-update-secure-128763123128.kaisolek.com
URL: https://royal-mail-update-secure-128763123128.kaisolek.com/r1/royal/intro.php?freq=new&topic=tx_clam&appID=pdFWBgSogIjuElWOJxLVQWCodGrSIzcQdPcerXzhyirhRpqG
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3033::681f:51f5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Origin
https://royal-mail-update-secure-128763123128.kaisolek.com
Referer
https://royal-mail-update-secure-128763123128.kaisolek.com/r1/royal/intro.php?freq=new&topic=tx_clam&appID=pdFWBgSogIjuElWOJxLVQWCodGrSIzcQdPcerXzhyirhRpqG
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 30 Oct 2020 16:36:07 GMT
content-encoding
br
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=5NhW3NOcj66KBGsi1q2RKzNs7cjn4RNo0OTPga4XlvZ28QdrFMeY4Qto9QXGRgokpKSRy8OlJNDX5iLlpFNLkujn2WKK4PT%2FCN4c9lFk4wwUHIFPjdqpIpsbTDAqgG5oK3CkVl1kO7dPSLjYuy2r3aPAaSJfrdzNXTPFY6K46Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=iso-8859-1
status
404
cache-control
max-age=14400
cf-ray
5ea68dac3fdcc2f9-FRA
cf-request-id
061bf6dfa40000c2f955a5d000000001
chevinstd-medium.woff
royal-mail-update-secure-128763123128.kaisolek.com/assets/fonts/chevin/ 		0
0 		Font
General
Check archive.org
Download Go to
Full URL
https://royal-mail-update-secure-128763123128.kaisolek.com/assets/fonts/chevin/chevinstd-medium.woff
Requested by
Host: royal-mail-update-secure-128763123128.kaisolek.com
URL: https://royal-mail-update-secure-128763123128.kaisolek.com/r1/royal/intro.php?freq=new&topic=tx_clam&appID=pdFWBgSogIjuElWOJxLVQWCodGrSIzcQdPcerXzhyirhRpqG
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3033::681f:51f5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Origin
https://royal-mail-update-secure-128763123128.kaisolek.com
Referer
https://royal-mail-update-secure-128763123128.kaisolek.com/r1/royal/intro.php?freq=new&topic=tx_clam&appID=pdFWBgSogIjuElWOJxLVQWCodGrSIzcQdPcerXzhyirhRpqG
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 30 Oct 2020 16:36:07 GMT
content-encoding
br
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=XfroBX3Y6gAtLja57cT37YqOH7lOkgwp2XOVSkheIOT7UEr5XaOWMIfs%2BGpVBPoWAJkyxRpk4%2BzLDU%2BPojfj6aYvV1rpqRYlKNddFxUY1EDuorgDSWawycN2nJ%2FoEQd%2FhV%2F5fQLHX74mMkmZ02iCN8xwPlR4YF1iF3g5TCaPDw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=iso-8859-1
status
404
cache-control
max-age=14400
cf-ray
5ea68dac3fe6c2f9-FRA
cf-request-id
061bf6dfa60000c2f92801f000000001
sending-your-item-infographic.svg
royal-mail-update-secure-128763123128.kaisolek.com/assets/images/ Frame 0930 		312 B
557 B 		Document
General
Check archive.org
Download Go to
Full URL
https://royal-mail-update-secure-128763123128.kaisolek.com/assets/images/sending-your-item-infographic.svg
Requested by
Host: royal-mail-update-secure-128763123128.kaisolek.com
URL: https://royal-mail-update-secure-128763123128.kaisolek.com/r1/royal/intro.php?freq=new&topic=tx_clam&appID=pdFWBgSogIjuElWOJxLVQWCodGrSIzcQdPcerXzhyirhRpqG
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3033::681f:51f5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f9d28b02ad430da769deb6445691d341523a718f3d37245a0ff7f3b2aba19927

Request headers

:method
GET
:authority
royal-mail-update-secure-128763123128.kaisolek.com
:scheme
https
:path
/assets/images/sending-your-item-infographic.svg
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
same-origin
sec-fetch-mode
navigate
sec-fetch-dest
object
referer
https://royal-mail-update-secure-128763123128.kaisolek.com/r1/royal/intro.php?freq=new&topic=tx_clam&appID=pdFWBgSogIjuElWOJxLVQWCodGrSIzcQdPcerXzhyirhRpqG
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
__cfduid=d6ba96ca7b8950e91b99f262dd8023e071604075766; PHPSESSID=385bf15clc7asf3o6s373km7bv
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://royal-mail-update-secure-128763123128.kaisolek.com/r1/royal/intro.php?freq=new&topic=tx_clam&appID=pdFWBgSogIjuElWOJxLVQWCodGrSIzcQdPcerXzhyirhRpqG

Response headers

status
404
date
Fri, 30 Oct 2020 16:36:07 GMT
content-type
text/html; charset=iso-8859-1
cache-control
max-age=14400
cf-cache-status
EXPIRED
cf-request-id
061bf6dfa80000c2f9b81ed000000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=UE4iErSszKuIQN7VPwauk%2FoVkJv%2BU2sHA8gteB9xKWDz8qIMrMDqdThroUaFdPmhZAMApmlMZiuHlqmVxLUBoZHOG3LXDqWAkwsRfYf%2FaGcIP6YJNyNY4zbwoKdSi%2B29kUR%2BLXqac7Yxa0Qd8LBPTb%2Bf4NS77LShXiuBeTlWFQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel
{"report_to":"cf-nel","max_age":604800}
vary
Accept-Encoding
server
cloudflare
cf-ray
5ea68dac3fedc2f9-FRA
content-encoding
br
truncated
/ 		24 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
027e325b7fcf7957d891823ddf2a7873869aa9bbdb26d645324372aeffba154c

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/jpeg
chevinstd-light.woff2
royal-mail-update-secure-128763123128.kaisolek.com/assets/fonts/chevin/ 		0
0 		Font
General
Check archive.org
Download Go to
Full URL
https://royal-mail-update-secure-128763123128.kaisolek.com/assets/fonts/chevin/chevinstd-light.woff2
Requested by
Host: royal-mail-update-secure-128763123128.kaisolek.com
URL: https://royal-mail-update-secure-128763123128.kaisolek.com/r1/royal/intro.php?freq=new&topic=tx_clam&appID=pdFWBgSogIjuElWOJxLVQWCodGrSIzcQdPcerXzhyirhRpqG
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3033::681f:51f5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Origin
https://royal-mail-update-secure-128763123128.kaisolek.com
Referer
https://royal-mail-update-secure-128763123128.kaisolek.com/r1/royal/intro.php?freq=new&topic=tx_clam&appID=pdFWBgSogIjuElWOJxLVQWCodGrSIzcQdPcerXzhyirhRpqG
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 30 Oct 2020 16:36:07 GMT
content-encoding
br
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=aY6nhN0CyQokNwBHm5cBxOPYJ4UiM5Zo0HTinnAJ51OOdUw5cw%2BP4OYkRzzrydyyzDCeVvmbGW4nWx7aaUBiIZW7Bw%2FUhS%2BCty8wers%2BDv1p3NXxvoyRaIH%2BfjkMTdQB5KjO9KJi%2BcvesER9kfr0YjOsHqdXVG5yCbcwkMhPYA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=iso-8859-1
status
404
cache-control
max-age=14400
cf-ray
5ea68dac481ec2f9-FRA
cf-request-id
061bf6dfb20000c2f975abe000000001
chevinstd-light.woff
royal-mail-update-secure-128763123128.kaisolek.com/assets/fonts/chevin/ 		0
0 		Font
General
Check archive.org
Download Go to
Full URL
https://royal-mail-update-secure-128763123128.kaisolek.com/assets/fonts/chevin/chevinstd-light.woff
Requested by
Host: royal-mail-update-secure-128763123128.kaisolek.com
URL: https://royal-mail-update-secure-128763123128.kaisolek.com/r1/royal/intro.php?freq=new&topic=tx_clam&appID=pdFWBgSogIjuElWOJxLVQWCodGrSIzcQdPcerXzhyirhRpqG
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3033::681f:51f5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Origin
https://royal-mail-update-secure-128763123128.kaisolek.com
Referer
https://royal-mail-update-secure-128763123128.kaisolek.com/r1/royal/intro.php?freq=new&topic=tx_clam&appID=pdFWBgSogIjuElWOJxLVQWCodGrSIzcQdPcerXzhyirhRpqG
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 30 Oct 2020 16:36:07 GMT
content-encoding
br
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=KsRH02NKPsVVTrQRuMydJAa7ml8Ax0T5AOds1mab6l7VdTCSRxEsqXUjHuzMRzXPjzOqwqTST2Umcl4JEWvJJtXcfC3S7Prs2ajbRWASmw54f1svPRnDrJfc1JU88gbrzo88RIwQHwYjpcHqHCugvWra2xsb%2Fj8s%2FNokhGb9mg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=iso-8859-1
status
404
cache-control
max-age=14400
cf-ray
5ea68dacb8e1c2f9-FRA
cf-request-id
061bf6dff30000c2f92491e000000001

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Royal Mail (Government)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes

2 Cookies

Domain/Path Name / Value
royal-mail-update-secure-128763123128.kaisolek.com/ Name: PHPSESSID
Value: 385bf15clc7asf3o6s373km7bv
.kaisolek.com/ Name: __cfduid
Value: d6ba96ca7b8950e91b99f262dd8023e071604075766