www.postalefr.jujapreparatory.ac.ke Open in urlscan Pro
169.239.252.78 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.postalefr.jujapreparatory.ac.ke/
Effective URL:
https://www.postalefr.jujapreparatory.ac.ke/laposte/
Submission: On December 01 via automatic, source certstream-suspicious (December 1st 2022, 8:13:04 am UTC) — Scanned from DE

Summary HTTP 11 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 4 countries across 5 domains to perform 11 HTTP transactions. The main IP is 169.239.252.78, located in Kenya and belongs to NODE-AFRICA, KE. The main domain is www.postalefr.jujapreparatory.ac.ke.
TLS certificate: Issued by R3 on December 1st 2022. Valid for: 3 months.

This is the only time www.postalefr.jujapreparatory.ac.ke was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Assurance Maladie (Healthcare)

Domain & IP information

	IP Address	AS Autonomous System
2 9	169.239.252.78 169.239.252.78	327997 (NODE-AFRICA) (NODE-AFRICA)
1	2606:4700:e2:... 2606:4700:e2::ac40:850f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2001:4de0:ac1... 2001:4de0:ac18::1:a:2b	20446 (STACKPATH...) (STACKPATH-CDN)
1	2a00:1450:400... 2a00:1450:4001:82b::200a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80b::2003	15169 (GOOGLE) (GOOGLE)
11	5

9 169.239.252.78 (Kenya) 2 redirects

ASN327997 (NODE-AFRICA, KE)
PTR: host-2.nodeafrica.com

www.postalefr.jujapreparatory.ac.ke	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:e2::ac40:850f (United States)

ASN13335 (CLOUDFLARENET, US)

use.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac18::1:a:2b (Netherlands)

ASN20446 (STACKPATH-CDN, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	jujapreparatory.ac.ke 2 redirects www.postalefr.jujapreparatory.ac.ke	689 KB
1	gstatic.com fonts.gstatic.com	17 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 37	1 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 680	30 KB
1	fontawesome.com use.fontawesome.com — Cisco Umbrella Rank: 908	13 KB
11	5

	Domain	Requested by
9	www.postalefr.jujapreparatory.ac.ke	2 redirects www.postalefr.jujapreparatory.ac.ke
1	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	www.postalefr.jujapreparatory.ac.ke
1	code.jquery.com	www.postalefr.jujapreparatory.ac.ke
1	use.fontawesome.com	www.postalefr.jujapreparatory.ac.ke
11	5

This site contains no links.

Subject Issuer	Validity	Valid
www.postalefr.jujapreparatory.ac.ke R3	`2022-12-01` - `2023-03-01`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-06-06` - `2023-06-05`	a year	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2022-08-03` - `2023-07-14`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2022-11-02` - `2023-01-25`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2022-11-02` - `2023-01-25`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.postalefr.jujapreparatory.ac.ke/laposte/
Frame ID: 2205DF0533D60542C5FA29B89514FF0B
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Veuillez remplir le formulaire

Page URL History Show full URLs

https://www.postalefr.jujapreparatory.ac.ke/ HTTP 302
https://www.postalefr.jujapreparatory.ac.ke/laposte HTTP 301
https://www.postalefr.jujapreparatory.ac.ke/laposte/ Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

11
Requests

100 %
HTTPS

80 %
IPv6

5
Domains

5
Subdomains

5
IPs

4
Countries

749 kB
Transfer

846 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.postalefr.jujapreparatory.ac.ke/ HTTP 302
https://www.postalefr.jujapreparatory.ac.ke/laposte HTTP 301
https://www.postalefr.jujapreparatory.ac.ke/laposte/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
www.postalefr.jujapreparatory.ac.ke/laposte/
Redirect Chain

https://www.postalefr.jujapreparatory.ac.ke/
https://www.postalefr.jujapreparatory.ac.ke/laposte
https://www.postalefr.jujapreparatory.ac.ke/laposte/

5 KB
5 KB

1251ms
1251ms

Document
text/html

169.239.252.78
NODE-AFRICA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.postalefr.jujapreparatory.ac.ke/laposte/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 169.239.252.78 , Kenya, ASN327997 (NODE-AFRICA, KE),
Reverse DNS: host-2.nodeafrica.com
Software: Apache /
Resource Hash: 49a3b99f21e82d4ca793b9804fd79c9da9dbe492727f36821a2815fcebcff571

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Date: Thu, 01 Dec 2022 08:12:57 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive: timeout=5, max=98
Pragma: no-cache
Server: Apache
Transfer-Encoding: chunked

Redirect headers

Connection: Keep-Alive
Content-Length: 260
Content-Type: text/html; charset=iso-8859-1
Date: Thu, 01 Dec 2022 08:12:57 GMT
Keep-Alive: timeout=5, max=99
Location: https://www.postalefr.jujapreparatory.ac.ke/laposte/
Server: Apache

GET
H2 200 all.css
use.fontawesome.com/releases/v5.8.2/css/ 54 KB
13 KB 205ms
148ms Stylesheet
text/css 2606:4700:e2::ac40:850f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.8.2/css/all.css
Requested by: Host: www.postalefr.jujapreparatory.ac.ke
URL: https://www.postalefr.jujapreparatory.ac.ke/laposte/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e2::ac40:850f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 06d6e10886ed7de5561acab1935bce1c46174baa9cbd0bcb319aa3b69594131f

Request headers

Referer: https://www.postalefr.jujapreparatory.ac.ke/
Origin: https://www.postalefr.jujapreparatory.ac.ke
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Thu, 01 Dec 2022 08:12:59 GMT
content-encoding: br
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id: MV8DMVYG1XRD67AX
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-id-2: UR/hjMk41azA7Z7IE69dXCnJzLWLmeglumvOfuvbycydewYQD0t6Q11L+Q606rj1JcdBWkS8VBM=
last-modified: Wed, 30 Jun 2021 15:47:00 GMT
server: cloudflare
etag: W/"77cbad34e5ce95e70847b074e05faeab"
access-control-max-age: 3000
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods: GET
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SuPianJSi1c2ADzq%2B2LBzxnfh7tSWoSL43EC1aWH%2FXVK4Yh5yWqAV4%2BVrShPycy3Nlh2%2BpFmF3%2FqRms1NT7iPrGxL8CBx4yRkMkKTstidXoqSYhDRySb6G1KOaevQDk0vjexJQMVomPiBeE4CPHq2WnA"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=31556926
cf-ray: 772a5c65fc289a3c-FRA

GET
H/1.1 200
OK style_v2.css
www.postalefr.jujapreparatory.ac.ke/laposte/assets/css/ 141 KB
141 KB 194ms
193ms Stylesheet
text/css 169.239.252.78
NODE-AFRICA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.postalefr.jujapreparatory.ac.ke/laposte/assets/css/style_v2.css
Requested by: Host: www.postalefr.jujapreparatory.ac.ke
URL: https://www.postalefr.jujapreparatory.ac.ke/laposte/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 169.239.252.78 , Kenya, ASN327997 (NODE-AFRICA, KE),
Reverse DNS: host-2.nodeafrica.com
Software: Apache /
Resource Hash: d1d1b719bd3f553322c73203cb8422eb911225158d53c2f99b8167d90c63696d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.postalefr.jujapreparatory.ac.ke/laposte/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

Date: Thu, 01 Dec 2022 08:12:59 GMT
Last-Modified: Wed, 28 Sep 2022 16:59:40 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 144090

GET
H/1.1 200
OK bootstrap.css
www.postalefr.jujapreparatory.ac.ke/laposte/assets/css/ 39 KB
39 KB 193ms
193ms Stylesheet
text/css 169.239.252.78
NODE-AFRICA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.postalefr.jujapreparatory.ac.ke/laposte/assets/css/bootstrap.css
Requested by: Host: www.postalefr.jujapreparatory.ac.ke
URL: https://www.postalefr.jujapreparatory.ac.ke/laposte/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 169.239.252.78 , Kenya, ASN327997 (NODE-AFRICA, KE),
Reverse DNS: host-2.nodeafrica.com
Software: Apache /
Resource Hash: 24422be1c6a2f4f68b24ea47154cac4295988c55d842d952b621a50e84b3f675

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.postalefr.jujapreparatory.ac.ke/laposte/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

Date: Thu, 01 Dec 2022 08:12:59 GMT
Last-Modified: Wed, 28 Sep 2022 16:59:36 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 39666

GET
H/1.1 200
OK head2.png
www.postalefr.jujapreparatory.ac.ke/laposte/assets/img/ 263 KB
264 KB 597ms
207ms Image
image/png 169.239.252.78
NODE-AFRICA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.postalefr.jujapreparatory.ac.ke/laposte/assets/img/head2.png
Requested by: Host: www.postalefr.jujapreparatory.ac.ke
URL: https://www.postalefr.jujapreparatory.ac.ke/laposte/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 169.239.252.78 , Kenya, ASN327997 (NODE-AFRICA, KE),
Reverse DNS: host-2.nodeafrica.com
Software: Apache /
Resource Hash: 1fc921ab0bd9691091f12e5e05fcd8d0fee6ad80c6f8e3ff67fd476b655e1fda

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.postalefr.jujapreparatory.ac.ke/laposte/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

Date: Thu, 01 Dec 2022 08:12:59 GMT
Last-Modified: Wed, 28 Sep 2022 16:58:40 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 269670

GET
H/1.1 200
OK header.png
www.postalefr.jujapreparatory.ac.ke/laposte/assets/img/ 20 KB
20 KB 581ms
191ms Image
image/png 169.239.252.78
NODE-AFRICA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.postalefr.jujapreparatory.ac.ke/laposte/assets/img/header.png
Requested by: Host: www.postalefr.jujapreparatory.ac.ke
URL: https://www.postalefr.jujapreparatory.ac.ke/laposte/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 169.239.252.78 , Kenya, ASN327997 (NODE-AFRICA, KE),
Reverse DNS: host-2.nodeafrica.com
Software: Apache /
Resource Hash: 85a4b44a2e1fdf1b0d50eebfbe9ea9a41a66e848ea91b80b03e4eaf5eaff285d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.postalefr.jujapreparatory.ac.ke/laposte/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

Date: Thu, 01 Dec 2022 08:12:59 GMT
Last-Modified: Wed, 28 Sep 2022 16:59:02 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 20001

GET
H/1.1 200
OK head22.png
www.postalefr.jujapreparatory.ac.ke/laposte/assets/img/ 170 KB
170 KB 609ms
199ms Image
image/png 169.239.252.78
NODE-AFRICA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.postalefr.jujapreparatory.ac.ke/laposte/assets/img/head22.png
Requested by: Host: www.postalefr.jujapreparatory.ac.ke
URL: https://www.postalefr.jujapreparatory.ac.ke/laposte/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 169.239.252.78 , Kenya, ASN327997 (NODE-AFRICA, KE),
Reverse DNS: host-2.nodeafrica.com
Software: Apache /
Resource Hash: fa7b2b25823eb65d919c1f88def18ead0133c560e66e2b01be6894829601cbc4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.postalefr.jujapreparatory.ac.ke/laposte/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

Date: Thu, 01 Dec 2022 08:12:59 GMT
Last-Modified: Wed, 28 Sep 2022 16:58:54 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 174222

GET
H2 200 jquery-3.4.1.min.js Show response
code.jquery.com/ 86 KB
30 KB 591ms
298ms Script
application/javascript 2001:4de0:ac18::1:a:2b
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.4.1.min.js
Requested by: Host: www.postalefr.jujapreparatory.ac.ke
URL: https://www.postalefr.jujapreparatory.ac.ke/laposte/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:2b , Netherlands, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software: nginx /
Resource Hash: 0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a

Request headers

Referer: https://www.postalefr.jujapreparatory.ac.ke/
Origin: https://www.postalefr.jujapreparatory.ac.ke
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Thu, 01 Dec 2022 08:12:59 GMT
content-encoding: gzip
last-modified: Fri, 12 Aug 2022 13:47:02 GMT
server: nginx
etag: W/"62f659d6-15851"
vary: Accept-Encoding
x-hw: 1669882379.dop167.fr8.t,1669882379.cds157.fr8.hn,1669882379.cds236.fr8.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 30638

GET
H2 200 css
fonts.googleapis.com/ 3 KB
1 KB 181ms
31ms Stylesheet
text/css 2a00:1450:4001:82b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans&subset=latin-ext

Requested by

Host: www.postalefr.jujapreparatory.ac.ke
URL: https://www.postalefr.jujapreparatory.ac.ke/laposte/assets/css/style_v2.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

8d683e97a1f23650a3e38cf3621b924ccf692f2a4204d193335ceddeb9b65353

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.postalefr.jujapreparatory.ac.ke/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 01 Dec 2022 08:13:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 01 Dec 2022 07:04:15 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 01 Dec 2022 08:13:00 GMT

GET
H/1.1 200
OK back.png
www.postalefr.jujapreparatory.ac.ke/laposte/assets/img/ 50 KB
50 KB 191ms
191ms Image
image/png 169.239.252.78
NODE-AFRICA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.postalefr.jujapreparatory.ac.ke/laposte/assets/img/back.png
Requested by: Host: www.postalefr.jujapreparatory.ac.ke
URL: https://www.postalefr.jujapreparatory.ac.ke/laposte/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 169.239.252.78 , Kenya, ASN327997 (NODE-AFRICA, KE),
Reverse DNS: host-2.nodeafrica.com
Software: Apache /
Resource Hash: e9f6ae22974508ecd4987f7fc6d60f580c938bfcb953c2d6d724933cad15cc0f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.postalefr.jujapreparatory.ac.ke/laposte/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

Date: Thu, 01 Dec 2022 08:13:00 GMT
Last-Modified: Wed, 28 Sep 2022 16:58:32 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 50836

GET
H2 200 memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2
fonts.gstatic.com/s/opensans/v34/ 16 KB
17 KB 76ms
23ms Font
font/woff2 2a00:1450:4001:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v34/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans&subset=latin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b34551ae25916c460423b82beb8e0675b27f76a9a2908f18286260fbd6de6681

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.postalefr.jujapreparatory.ac.ke
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Fri, 25 Nov 2022 17:19:31 GMT
x-content-type-options: nosniff
age: 485609
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16740
x-xss-protection: 0
last-modified: Mon, 15 Aug 2022 18:14:44 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 25 Nov 2023 17:19:31 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Assurance Maladie (Healthcare)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontentvisibilityautostatechange function| $ function| jQuery

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.postalefr.jujapreparatory.ac.ke/	1969-12-31 23:59:59	Name: PHPSESSID Value: 65h5rj3qbot92d078jvjh2oog1

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
rendering	warning	URL: https://www.postalefr.jujapreparatory.ac.ke/laposte/(Line 8) Message: The key "initial-scsle" is not recognized and ignored.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code.jquery.com
fonts.googleapis.com
fonts.gstatic.com
use.fontawesome.com
www.postalefr.jujapreparatory.ac.ke
169.239.252.78
2001:4de0:ac18::1:a:2b
2606:4700:e2::ac40:850f
2a00:1450:4001:80b::2003
2a00:1450:4001:82b::200a
06d6e10886ed7de5561acab1935bce1c46174baa9cbd0bcb319aa3b69594131f
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
1fc921ab0bd9691091f12e5e05fcd8d0fee6ad80c6f8e3ff67fd476b655e1fda
24422be1c6a2f4f68b24ea47154cac4295988c55d842d952b621a50e84b3f675
49a3b99f21e82d4ca793b9804fd79c9da9dbe492727f36821a2815fcebcff571
85a4b44a2e1fdf1b0d50eebfbe9ea9a41a66e848ea91b80b03e4eaf5eaff285d
8d683e97a1f23650a3e38cf3621b924ccf692f2a4204d193335ceddeb9b65353
b34551ae25916c460423b82beb8e0675b27f76a9a2908f18286260fbd6de6681
d1d1b719bd3f553322c73203cb8422eb911225158d53c2f99b8167d90c63696d
e9f6ae22974508ecd4987f7fc6d60f580c938bfcb953c2d6d724933cad15cc0f
fa7b2b25823eb65d919c1f88def18ead0133c560e66e2b01be6894829601cbc4

www.postalefr.jujapreparatory.ac.ke Open in urlscan Pro 169.239.252.78 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

11 Requests

100 %HTTPS

80 %IPv6

5 Domains

5 Subdomains

5 IPs

4 Countries

749 kBTransfer

846 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

www.postalefr.jujapreparatory.ac.ke Open in urlscan Pro
169.239.252.78 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

100 %
HTTPS

80 %
IPv6

5
Domains

5
Subdomains

5
IPs

4
Countries

749 kB
Transfer

846 kB
Size

1
Cookies

11 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!