customstax.click Open in urlscan Pro
2a06:98c1:3120::3  Malicious Activity! Public Scan

Submitted URL: http://customspost.info/
Effective URL: https://customstax.click/
Submission Tags: @ecarlesi threat #phishing #postvox Search All
Submission: On October 21 via api from FR — Scanned from FR

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 14 HTTP transactions. The main IP is 2a06:98c1:3120::3, located in United States and belongs to CLOUDFLARENET, US. The main domain is customstax.click.
TLS certificate: Issued by GTS CA 1P5 on September 9th 2023. Valid for: 3 months.
This is the only time customstax.click was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: An Post (Transportation)

Domain & IP information

IP Address AS Autonomous System
1 1 2606:4700:303... 13335 (CLOUDFLAR...)
1 1 2606:4700:303... 13335 (CLOUDFLAR...)
14 2a06:98c1:312... 13335 (CLOUDFLAR...)
14 2
Apex Domain
Subdomains
Transfer
14 customstax.click
customstax.click
2 MB
2 customspost.info
customspost.info
1 KB
14 2
Domain Requested by
14 customstax.click customstax.click
2 customspost.info 2 redirects
14 2

This site contains no links.

Subject Issuer Validity Valid
customstax.click
GTS CA 1P5
2023-09-09 -
2023-12-08
3 months crt.sh

This page contains 1 frames:

Primary Page: https://customstax.click/
Frame ID: A40BB1D75F30AD8EB50BD9171411EC4E
Requests: 21 HTTP requests in this frame

Screenshot

Page Title

Track your post and parcels | Personal | An Post

Page URL History Show full URLs

  1. http://customspost.info/ HTTP 301
    https://customspost.info/ HTTP 302
    https://customstax.click/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

14
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

2273 kB
Transfer

5613 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://customspost.info/ HTTP 301
    https://customspost.info/ HTTP 302
    https://customstax.click/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
customstax.click/
Redirect Chain
  • http://customspost.info/
  • https://customspost.info/
  • https://customstax.click/
56 KB
8 KB
Document
General
Full URL
https://customstax.click/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ea6e4eeb0657eaa022da14c547528b40a17e2f84b534fb6790e12c53df57e019

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36
accept-language
fr-FR,fr;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
no-store, no-cache, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
81958b060e1d2a44-CDG
content-encoding
br
content-type
text/html; charset=UTF-8
date
Sat, 21 Oct 2023 00:56:50 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma
no-cache
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Rn2cIfw7OG1CEB15eSgb8BtrqMdSUh3TWzhLoqWRS%2Bq5l0MDtwm9%2Fr7f7KnKCfdIFHlhjzB9S794e5u8BI6qB4BU%2Bni%2BkP10hJUwTUqwkJCTQv6nF52geI%2BWbHWI9Dp6hkE7iO9pqkCr6T6il7g8"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding

Redirect headers

alt-svc
h3=":443"; ma=86400
cache-control
no-store, no-cache, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
81958b051ef92a1c-CDG
content-type
text/html; charset=UTF-8
date
Sat, 21 Oct 2023 00:56:50 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
location
https://customstax.click/
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma
no-cache
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VDXGpWSBxQ8rQJ8teRbkTy8p94UbCQtnAvSG3GO4yoHJFIl41%2Fwll1cC3GfD1zqjq0roX8%2Bu6ytXYGBW7Hl%2Frl8AYyCHShBfJoGuDIdxS%2BRHfLqadWL3YfOmp42O%2FTceTUzLgFgol2qBkriY%2FJBd"}],"group":"cf-nel","max_age":604800}
server
cloudflare
core.min.css
customstax.click/assets/
5 MB
2 MB
Stylesheet
General
Full URL
https://customstax.click/assets/core.min.css
Requested by
Host: customstax.click
URL: https://customstax.click/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5acb69db0d8275e5fa0a5000bdd413529779277177bcdf90af13a09632f59eb7

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://customstax.click/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date
Sat, 21 Oct 2023 00:56:51 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 08 Jul 2023 13:26:28 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
40
etag
W/"4f332f-5fff9b25e0900-gzip"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=N35Bq5Xul3uYp5fhv6ewxB%2BUExvBZNc4wci2zyoOHklYi3qP3uZsK9%2FxWRSN2Sp6lhQ0uwzdX16WOcPqEnUs9%2BFGyDGsxZX5GjrTjTlWJbJ31XAuHOzQbxGdRkfGY%2BBLVlzELD7XOOgPfE5H0RdY"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
81958b06be6d2a44-CDG
alt-svc
h3=":443"; ma=86400
jquery.js
customstax.click/cntdjs/
88 KB
32 KB
Script
General
Full URL
https://customstax.click/cntdjs/jquery.js
Requested by
Host: customstax.click
URL: https://customstax.click/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bde63cda98d2198a19933540edb43bb53931a352202bffe75067ac9ba722673a

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://customstax.click/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date
Sat, 21 Oct 2023 00:56:51 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sun, 17 Sep 2023 14:31:28 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
40
etag
W/"15f86-6058ee18ef000-gzip"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EE7L6lh9%2FiXS9guJjk9FgBvvbWIedIaXD5QU9qXcvObsSXxVsrrw%2F9vHCKYv2M41BbQA7p93TNGGneaTNknc5dc%2FwDNSuPqsKQFZH0P3eQrKVs6isw6nSJoU4jEstSUKHaBgVIc1lXC9SfRCGKwB"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
81958b06be712a44-CDG
alt-svc
h3=":443"; ma=86400
jquery.mask.js
customstax.click/cntdjs/
23 KB
6 KB
Script
General
Full URL
https://customstax.click/cntdjs/jquery.mask.js
Requested by
Host: customstax.click
URL: https://customstax.click/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a199620fe981df00a825f78761d3f7c8870f8117daa4a890e08018dec386dae8

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://customstax.click/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date
Sat, 21 Oct 2023 00:56:51 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 08 Jul 2023 13:24:42 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
40
etag
W/"5a88-5fff9ac0c9a80-gzip"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ozNgPfMOFwy1WNVEB227WRqF34xvwRUbEft3KQJXDPBtKnxqT3YKee6eaFgYAHlImM91gEG6%2B9jSrAprSz7WwOI2HLBiNp2clKMSwT1k%2Fa6NdXByGv5WhQgA0%2FdxUkcjxFze%2F7Ka6IH2jQ8tr6H5"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
81958b06be722a44-CDG
alt-svc
h3=":443"; ma=86400
loading.js
customstax.click/cntdjs/
2 KB
1 KB
Script
General
Full URL
https://customstax.click/cntdjs/loading.js
Requested by
Host: customstax.click
URL: https://customstax.click/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
577839abe20e3b1915725950d51b8d7b8363ccb0b2dbaf2835075893b83739dc

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://customstax.click/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date
Sat, 21 Oct 2023 00:56:51 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 08 Jul 2023 13:24:42 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
40
etag
W/"91e-5fff9ac0c9a80-gzip"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Qgaki4wqXtg%2B6YqileCsL38AieIvJpIgAe9e2XGjkZByrNIFOOXf3Sv8dcPnPfOMlk4lgrNijOUE8MhVrvREfbeFZkJND7UDX26sBDwexPmg4NV6lRgnFQyRxX2VDN3mwC31TSnGjyfvAUfpzETN"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
81958b06be742a44-CDG
alt-svc
h3=":443"; ma=86400
styles.c14fce2ba80c26a0.css
customstax.click/reepay/
16 KB
4 KB
Stylesheet
General
Full URL
https://customstax.click/reepay/styles.c14fce2ba80c26a0.css
Requested by
Host: customstax.click
URL: https://customstax.click/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bd7d3930d3c7da4bb809eeb3cf92cc5937fd3aa1a0e61cee26cef208dda2f457

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://customstax.click/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date
Sat, 21 Oct 2023 00:56:51 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 08 Jul 2023 13:24:27 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
40
etag
W/"3f22-5fff9ab27b8c0-gzip"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=d%2B6yWvlnJnZZLExMfHwp4CI%2BVuxy9ouVNdDb%2BeUWgz%2BhoZrdBZv6Zd8K48krHRCH3Fn%2FBjer3LqDIP1dwKkQZ1mUc920zk67YhWutAGSvOk0Y2fdACjcEnGtlipmbRDTkPnNpTHkNtem%2FdcxNlDJ"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
81958b06be6e2a44-CDG
alt-svc
h3=":443"; ma=86400
infile.css
customstax.click/reepay/
18 KB
3 KB
Stylesheet
General
Full URL
https://customstax.click/reepay/infile.css
Requested by
Host: customstax.click
URL: https://customstax.click/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d4da046a6f3e5fa7da0adde486f45170afd7db9ae0261331c59fd5c59b822760

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://customstax.click/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date
Sat, 21 Oct 2023 00:56:51 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 08 Jul 2023 13:24:29 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
40
etag
W/"49a4-5fff9ab463d40-gzip"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=B%2F9SGXKxeN4gIytVnNSeHFfRAGD2V%2FtD8%2B1DQ51gYet%2Fiu%2Fpd%2BqF7gh0Jk0MMuzZmtE%2Fh7LPHbTEpmqyAFyvQ4jQ0mwF4RUVAMyjvSUOdU8wGItZ6w6dOMft9PLM8TRrB5RgQCXzIurkdsKLazNs"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
81958b06be702a44-CDG
alt-svc
h3=":443"; ma=86400
anPostLogo.svg
customstax.click/assets/
64 KB
48 KB
Image
General
Full URL
https://customstax.click/assets/anPostLogo.svg
Requested by
Host: customstax.click
URL: https://customstax.click/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
56070667e7c231cf6d86005febb13929fe5873d327926478c332e5ccfbc9073c

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://customstax.click/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date
Sat, 21 Oct 2023 00:56:51 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 08 Jul 2023 13:25:50 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
40
etag
W/"10052-5fff9b01a3380"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NIwQkVZDuhPdDDry6cRoQ8LGaZQMmXSIKzEgQivXpQj9G7Wm0BNG%2B97cnF7AcE4GthjXXkvURq%2BDqf2RY65L29ww1elZXcrRlrjSHY9Fmza%2B2Z2cmfqbH%2FMTqJ2xcmNJxq%2BDW81aI2iwDho6z5sj"}],"group":"cf-nel","max_age":604800}
content-type
image/svg+xml
cache-control
max-age=14400
cf-ray
81958b06be752a44-CDG
alt-svc
h3=":443"; ma=86400
loadblack.svg
customstax.click/reepay/
2 KB
865 B
Image
General
Full URL
https://customstax.click/reepay/loadblack.svg
Requested by
Host: customstax.click
URL: https://customstax.click/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d32cb065414482445f33d9dfba971f8bbd224bf159d03d7e75668bafcb05f1ad

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://customstax.click/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date
Sat, 21 Oct 2023 00:56:51 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 08 Jul 2023 13:24:35 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
40
etag
W/"69d-5fff9aba1cac0"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZFLjnTbzMnozE4h25xDyWM706nMpAXogcVx1zSSa1OZSuADcs1qrL4rJsehHm5FGiN55Y7klqRXpV7SnYAunERfuHLFVQYAnorPL3nfwdMpOChDh6Oylm8ifbvpe3ypKBfoUCOQGBaXiu%2FSl2yCX"}],"group":"cf-nel","max_age":604800}
content-type
image/svg+xml
cache-control
max-age=14400
cf-ray
81958b06be762a44-CDG
alt-svc
h3=":443"; ma=86400
truncated
/
339 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
db5cf0db08370f66dfe81f2c25aa8b4d07cb193f62977789ce1dab2c9f6132ee

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf8
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e841c6f5f8f054f298a9e19a91e0df68808eb3a903a6cb579575429f6872950e

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf8
truncated
/
591 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7cd0db0364af9c5f016833323e7a4c884a3a5b6c7ed5c4878693c658710e6c1e

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf8
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f9f472a3d07ae1e0266ee943531b5f9112275284c02b6c6458ae2f44024e1b3f

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
588 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
752d28e0ed8ba234bf1e696f47c756c8a8843f6940229eba6bbf5bf464f22999

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf8
truncated
/
191 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
37f2ae330fef28c671b6cbf03d88ef430cd67e41da243dd638551b3d1fa19700

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

Content-Type
image/png
truncated
/
575 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ab82606ba85a53c62dfa7833280a45861b1dc60627a2cec4e4ab52dfb7a3fb8b

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf8
rawline-400.ea42a37247439622.woff2
customstax.click/reepay/
79 KB
80 KB
Font
General
Full URL
https://customstax.click/reepay/rawline-400.ea42a37247439622.woff2
Requested by
Host: customstax.click
URL: https://customstax.click/reepay/styles.c14fce2ba80c26a0.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8e9d1aba37a102665016fffea61a124e6c385d6783d6cef869f9910c6115a401

Request headers

Referer
https://customstax.click/reepay/styles.c14fce2ba80c26a0.css
Origin
https://customstax.click
accept-language
fr-FR,fr;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date
Sat, 21 Oct 2023 00:56:51 GMT
cf-cache-status
REVALIDATED
last-modified
Sat, 08 Jul 2023 13:24:34 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"13d80-5fff9ab928880"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2Bta1dJfLCApJVhpB4rQ9762TtQtibjZLg6Q5tuXISg10vqBxty3XENtEr5ZlmMR8OejrWhFzDytYX%2BROhf%2B1FbwZbRp1Kqn2vu8tnmeSTCaZ9%2Byqlx0FK67mJm7uZsVhD%2FqEewhE2SuDqy9edWzx"}],"group":"cf-nel","max_age":604800}
content-type
font/woff2
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
81958b086aa23cf3-CDG
alt-svc
h3=":443"; ma=86400
content-length
81280
AnPostSans-Bold.woff2
customstax.click/webfonts/
0
0
Font
General
Full URL
https://customstax.click/webfonts/AnPostSans-Bold.woff2
Requested by
Host: customstax.click
URL: https://customstax.click/assets/core.min.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
https://customstax.click/assets/core.min.css
Origin
https://customstax.click
accept-language
fr-FR,fr;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date
Sat, 21 Oct 2023 00:56:51 GMT
content-encoding
br
cf-cache-status
EXPIRED
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Dl13TanNLysQFPECJQsxYl2EjcAHjuMDNPkRvZb8MhyWRAppaIdQHahHPPBRboir5HuQb77x50tf%2B%2B2%2F3sXKZnCXQ6ptndLvWGqZAWRwUHGsZzwJrOuhGMLTB71V%2BnpuW6JmBMQSEHXUp1PQmm7s"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=iso-8859-1
cache-control
max-age=14400
cf-ray
81958b087aa33cf3-CDG
alt-svc
h3=":443"; ma=86400
AnPostSans-Regular.woff2
customstax.click/webfonts/
0
0
Font
General
Full URL
https://customstax.click/webfonts/AnPostSans-Regular.woff2
Requested by
Host: customstax.click
URL: https://customstax.click/assets/core.min.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
https://customstax.click/assets/core.min.css
Origin
https://customstax.click
accept-language
fr-FR,fr;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date
Sat, 21 Oct 2023 00:56:51 GMT
content-encoding
br
cf-cache-status
EXPIRED
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rSFXnYpAqcToQbqS5ynR0wCTQdEIQ1QvgFjNmKzAp5eedV2RvK7ASY9zOZUTLixaVCwiix93wDU17f3ukia8dZvptGemveazHdbQeqBLO%2BBh8va7prcCGApRGg1ccc3IplGQOxGdfvI48sOxuS9L"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=iso-8859-1
cache-control
max-age=14400
cf-ray
81958b087aa43cf3-CDG
alt-svc
h3=":443"; ma=86400
AnPostSans-Bold.woff
customstax.click/webfonts/
0
0
Font
General
Full URL
https://customstax.click/webfonts/AnPostSans-Bold.woff
Requested by
Host: customstax.click
URL: https://customstax.click/assets/core.min.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
https://customstax.click/assets/core.min.css
Origin
https://customstax.click
accept-language
fr-FR,fr;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date
Sat, 21 Oct 2023 00:56:51 GMT
content-encoding
br
cf-cache-status
EXPIRED
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AvUks81asjwzN4rsXDsSrWdx%2FgeuksAWBXAmpuz0qzpyhT4po7ieePJ8SYimytgcRYt6ABcTipnFuF%2FNkrln577s%2F7HytvvqIxwBHNc7IE2qhmYe64c0nsN7BAbfxnhoi4JVD0C459Lmlt4QUArO"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=iso-8859-1
cache-control
max-age=14400
cf-ray
81958b09ab083cf3-CDG
alt-svc
h3=":443"; ma=86400
AnPostSans-Regular.woff
customstax.click/webfonts/
0
0
Font
General
Full URL
https://customstax.click/webfonts/AnPostSans-Regular.woff
Requested by
Host: customstax.click
URL: https://customstax.click/assets/core.min.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
https://customstax.click/assets/core.min.css
Origin
https://customstax.click
accept-language
fr-FR,fr;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date
Sat, 21 Oct 2023 00:56:51 GMT
content-encoding
br
cf-cache-status
EXPIRED
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=98kvknMZJct8ntT%2B09sxqvTdG4%2F8oHt%2B09FbTpbdfSKYHSJAvmRp4NIw3kw46L81S%2FwcQCIKXrvsEgJK2i36V2KnsJnPVyPip7EZIVliFxIQPacGDB255swe3IpYFIQWEU2Qk%2BItD97Af86D5UAj"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=iso-8859-1
cache-control
max-age=14400
cf-ray
81958b09ab093cf3-CDG
alt-svc
h3=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: An Post (Transportation)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery function| check_validity function| showValue1 function| showValue2 function| showValue3

2 Cookies

Domain/Path Name / Value
customspost.info/ Name: PHPSESSID
Value: et89glktkiqrelrqhmmc78o4gs
customstax.click/ Name: PHPSESSID
Value: c6p7irvlh1b712rb6aqhqiq9cd

4 Console Messages

Source Level URL
Text
network error URL: https://customstax.click/webfonts/AnPostSans-Bold.woff2
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://customstax.click/webfonts/AnPostSans-Regular.woff2
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://customstax.click/webfonts/AnPostSans-Bold.woff
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://customstax.click/webfonts/AnPostSans-Regular.woff
Message:
Failed to load resource: the server responded with a status of 404 ()