uskg.pcerjr.top - urlscan.io

Summary

This website contacted 1 IPs in 1 countries across 2 domains to perform 7 HTTP transactions. The main IP is 2606:4700:3035::6815:31ba, located in United States and belongs to CLOUDFLARENET, US. The main domain is uskg.pcerjr.top.
TLS certificate: Issued by WE1 on September 18th 2024. Valid for: 3 months.

This is the only time uskg.pcerjr.top was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: USPS (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2606:4700:10:... 2606:4700:10::6816:e8	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	2606:4700:303... 2606:4700:3035::6815:31ba	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	1

1 2606:4700:10::6816:e8 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

cutt.ly	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2606:4700:3035::6815:31ba (United States)

ASN13335 (CLOUDFLARENET, US)

uskg.pcerjr.top	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	pcerjr.top uskg.pcerjr.top	20 KB
1	cutt.ly 1 redirects cutt.ly — Cisco Umbrella Rank: 43283	391 B
7	2

	Domain	Requested by
7	uskg.pcerjr.top	uskg.pcerjr.top
1	cutt.ly	1 redirects
7	2

This site contains no links.

Subject Issuer	Validity	Valid
pcerjr.top WE1	`2024-09-18` - `2024-12-17`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://uskg.pcerjr.top/?keyword=748026eae7dl
Frame ID: 8A458C1CCDF6F447F4DDBE6CFCBD4CE3
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Loading

Page URL History Show full URLs

https://cutt.ly/wepPlihh?MfY=TOCTHT6Dww HTTP 301
https://uskg.pcerjr.top/?keyword=748026eae7dl Page URL

Page Statistics

7
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

1
IPs

1
Countries

20 kB
Transfer

64 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://cutt.ly/wepPlihh?MfY=TOCTHT6Dww HTTP 301
https://uskg.pcerjr.top/?keyword=748026eae7dl Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response uskg.pcerjr.top/ Redirect Chain https://cutt.ly/wepPlihh?MfY=TOCTHT6Dww https://uskg.pcerjr.top/?keyword=748026eae7dl	23 KB 5 KB	1103ms 961ms	Document text/html	2606:4700:3035::6815:31ba CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://uskg.pcerjr.top/?keyword=748026eae7dl Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::6815:31ba , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / ASP.NET Resource Hash `96dae0825185b567d1b089685144ee8abe035a859b822d2b8b716f1374e641a0` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Response headers cache-control private cf-cache-status DYNAMIC cf-ray 8cc33d981bef2ba2-FRA content-encoding br content-type text/html; charset=utf-8 date Wed, 02 Oct 2024 08:14:45 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zgMbc8EkUX9g6q1Upp57o9qkf1hzfqGWY3xqGJp8jdOsxA4DTWJLJYVF6n6QP8uM5Rq5mWK01BB3Fq0VP5n8Kq0jzGdSdQ8RbUFEx5SvRI8khwc4IAZVBM%2FhqrsPl1HkBBkHiFoXpJS3xIjBDZA%3D"}],"group":"cf-nel","max_age":604800} server cloudflare speculation-rules "/cdn-cgi/speculation" vary Accept-Encoding x-aspnet-version 4.0.30319 x-aspnetmvc-version 5.2 x-powered-by ASP.NET Redirect headers cache-control no-cache, no-store, must-revalidate cf-cache-status DYNAMIC cf-ray 8cc33d9698a5dc4a-FRA content-type text/html; charset=UTF-8 date Wed, 02 Oct 2024 08:14:44 GMT expires Thu, 19 Nov 1981 08:52:00 GMT location https://uskg.pcerjr.top/?keyword=748026eae7dl pragma no-cache referrer-policy same-origin server cloudflare strict-transport-security max-age=15552000; includeSubDomains; preload x-content-type-options nosniff x-frame-options SAMEORIGIN x-xss-protection 1; mode=block
GET H2	200	speculation uskg.pcerjr.top/cdn-cgi/	128 B 473 B	14ms 14ms	Other application/speculationrules+json	2606:4700:3035::6815:31ba CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://uskg.pcerjr.top/cdn-cgi/speculation Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::6815:31ba , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `11a2142988720cd49ff000e5d488493947b3d34821301c5a706b3495b8381f7d` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://uskg.pcerjr.top Referer https://uskg.pcerjr.top/?keyword=748026eae7dl Response headers nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=altEJ%2BwnSGcYJh1sRTatTi5Ri8W7DUJMdO5Bajma3tTS9GbH4AI6MVCQuoUxNdHdJfi03xDnQFmzGVMv3SBdNP%2FyAxXPQKrmJ4i0fQ%2BLkCxwZYrBfq%2BzBwX9jX5HyLt2CEmWoC%2F0nDVbazrTaBc%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8cc33d9ea8032ba2-FRA access-control-allow-origin https://uskg.pcerjr.top content-length 128 date Wed, 02 Oct 2024 08:14:45 GMT content-type application/speculationrules+json vary Origin, Accept-Encoding server cloudflare
GET H2	200	ZuJH5lL0AjIWd-Y0AkLnhiJWMvfngjXnMk0.svg uskg.pcerjr.top/b90b2b/dF4qZGV-Xip8d3pkJCRjc2lqQDRtKl5eaXwhITRAXyF2eG4jL35hI3MkY/2wlJW/	546 B 645 B	767ms 766ms	Image image/svg+xml	2606:4700:3035::6815:31ba CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://uskg.pcerjr.top/b90b2b/dF4qZGV-Xip8d3pkJCRjc2lqQDRtKl5eaXwhITRAXyF2eG4jL35hI3MkY/2wlJW/ZuJH5lL0AjIWd-Y0AkLnhiJWMvfngjXnMk0.svg Requested by Host: uskg.pcerjr.top URL: https://uskg.pcerjr.top/?keyword=748026eae7dl Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::6815:31ba , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / ASP.NET Resource Hash `b95f434286744e3dbaf5bc56f41d4ce2640da3038461502f7ac243a5931e9435` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://uskg.pcerjr.top/?keyword=748026eae7dl Response headers cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding br cf-cache-status MISS etag W/"c8bd85fb53a4da1:0" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GHnBfmUTA8g9XMwk44FAWR%2FwfWYslSN9lfQAuvZp0sXE4cWBDEoKyINJL2isUnQdmD5H2BOq%2FSgx84cCg3f%2Fee4EPso4ZfLjkYgZExVqYLafJNfk7LoIaj%2FnQfu952Lh8fbI34UDe01Ql6Mj64E%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8cc33d9ea8052ba2-FRA date Wed, 02 Oct 2024 08:14:46 GMT content-type image/svg+xml last-modified Sun, 12 May 2024 10:05:56 GMT x-powered-by ASP.NET server cloudflare vary Accept-Encoding
GET H2	200	ZuJH5lL0AjIWd-Y0AkLnhiJWMvfngjXnMk0.svg uskg.pcerjr.top/b90b2b/dF4qZGV-Xip8d3pkJCRjc2lqQDRtKl5eaXwhITVAXyF2eG4jL35hI3MkY/2wlJW/	2 KB 1 KB	818ms 818ms	Image image/svg+xml	2606:4700:3035::6815:31ba CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://uskg.pcerjr.top/b90b2b/dF4qZGV-Xip8d3pkJCRjc2lqQDRtKl5eaXwhITVAXyF2eG4jL35hI3MkY/2wlJW/ZuJH5lL0AjIWd-Y0AkLnhiJWMvfngjXnMk0.svg Requested by Host: uskg.pcerjr.top URL: https://uskg.pcerjr.top/?keyword=748026eae7dl Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::6815:31ba , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / ASP.NET Resource Hash `9685d6241f41ac71741d0ee9b242779f640cd3b1e64bb9bbcfb8798c5be503b2` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://uskg.pcerjr.top/?keyword=748026eae7dl Response headers cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding br cf-cache-status MISS etag W/"ade485fb53a4da1:0" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cpr9pZjTtJU8sdl09t5o7piUNdClAtaVBsIW6fTdrDYNCQq3GEm2YxrHKxTmosWDvx4ya%2FnYnNp8mISmH3yQ0wQ4Exn7hHxhsdREbbhngXEUdHTpsBnYA1y4u%2B0tqx%2F1Zsn82WTglVKKJF%2Bo5ac%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8cc33d9ed81d2ba2-FRA date Wed, 02 Oct 2024 08:14:46 GMT content-type image/svg+xml last-modified Sun, 12 May 2024 10:05:56 GMT x-powered-by ASP.NET server cloudflare vary Accept-Encoding
GET H2	200	ZGl0fGNhbCN-fkBeXmN4ZHZ3ZXpjXiEjfA2.svg uskg.pcerjr.top/b90b2b/ZSUheCRAXiVqZipzLypAbn5-JHNeL19uJG0haTJAYyNzYi4hKiMkfiR/neC8k/	1 KB 1 KB	1206ms 1206ms	Image image/svg+xml	2606:4700:3035::6815:31ba CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://uskg.pcerjr.top/b90b2b/ZSUheCRAXiVqZipzLypAbn5-JHNeL19uJG0haTJAYyNzYi4hKiMkfiR/neC8k/ZGl0fGNhbCN-fkBeXmN4ZHZ3ZXpjXiEjfA2.svg Requested by Host: uskg.pcerjr.top URL: https://uskg.pcerjr.top/?keyword=748026eae7dl Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::6815:31ba , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / ASP.NET Resource Hash `c8b13b10e28b6b420151db578831a416b7c1805d7672eeb57e69dc697fda1e27` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://uskg.pcerjr.top/?keyword=748026eae7dl Response headers cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding br cf-cache-status MISS etag W/"697583fb53a4da1:0" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OG%2FInxrORYHEqaLoaTHgUCN1GU1jexHuGZQRE394q8xMgTeoEkiJAWOLysbHDRtZbx9XQiu9Kx4PPkbWamWWwZrGOwLX63OS2b9hRVvW%2B17L3oG%2F9XV1QQwEILZWIXObsql%2FzlD4tVBkdvyArMI%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8cc33d9ea8062ba2-FRA date Wed, 02 Oct 2024 08:14:46 GMT content-type image/svg+xml last-modified Sun, 12 May 2024 10:05:56 GMT x-powered-by ASP.NET server cloudflare vary Accept-Encoding
GET H2	200	YWN-fGNhdGclY14hKm4qQH5-ekBfL2JjJEAxaiQjISUkaQ2.png uskg.pcerjr.top/b90b2b/fF5jeHB4JCFzI2lqJC9AZCN-bi9eKiV4QCp8cyppI3xed3h8ekdAZW1-JCU0LmM3OWZlbjNeKiN/kIWwh/	5 KB 6 KB	840ms 839ms	Image image/png	2606:4700:3035::6815:31ba CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://uskg.pcerjr.top/b90b2b/fF5jeHB4JCFzI2lqJC9AZCN-bi9eKiV4QCp8cyppI3xed3h8ekdAZW1-JCU0LmM3OWZlbjNeKiN/kIWwh/YWN-fGNhdGclY14hKm4qQH5-ekBfL2JjJEAxaiQjISUkaQ2.png Requested by Host: uskg.pcerjr.top URL: https://uskg.pcerjr.top/?keyword=748026eae7dl Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::6815:31ba , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / ASP.NET Resource Hash `1cc43a97be92fddf0fe4244858f5337c80a8d350cd0afcd0c4d2004d3fded0ab` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://uskg.pcerjr.top/?keyword=748026eae7dl Response headers cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-cache-status MISS etag "617db2162a4da1:0" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hYRAs0Qo5DG3CS%2B6vQk5E07VDSXr1eaFB7Q4nKzs0BOZgKo42doLeCYW7LZr7ScMevGun87ndRzThm2E94iWqTY9api15w5T9OrhS3f%2BUjxhYmN9wcvCPhkVxchq1FiuzKMNZw9ig3HohqoihNM%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8cc33d9ed81a2ba2-FRA accept-ranges bytes content-length 5390 date Wed, 02 Oct 2024 08:14:46 GMT content-type image/png last-modified Sun, 12 May 2024 11:47:14 GMT x-powered-by ASP.NET server cloudflare vary Accept-Encoding
GET H2	200	favicon.ico uskg.pcerjr.top/	31 KB 6 KB	1055ms 1054ms	Other image/x-icon	2606:4700:3035::6815:31ba CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://uskg.pcerjr.top/favicon.ico Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::6815:31ba , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / ASP.NET Resource Hash `67fbe8ef9020e5c776aadf6801a1fef8dc563e2e4dc9ddc740af8010c0c38943` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://uskg.pcerjr.top/?keyword=748026eae7dl Response headers cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding br cf-cache-status MISS etag W/"8d495b9e8623da1:0" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=O9LI8%2BF0PM1DaGSJwkcqSGZhwmFe19gV55EUOh8sDr7Z6W9KyCNvTpZSswBrZjcH3YPQ0jYGx2njoP3hWGECPNjEyjvkR033CKuS9jQ%2FgiCsbYvN%2FXyw4%2Bdx8jXC1OWJsJaPM1Z0L7gZ7c6t1I8%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8cc33da64d212ba2-FRA date Wed, 02 Oct 2024 08:14:47 GMT content-type image/x-icon last-modified Thu, 30 Nov 2023 12:13:25 GMT x-powered-by ASP.NET server cloudflare vary Accept-Encoding

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: USPS (Transportation)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			cutt.ly/	1969-12-31 23:59:59	Name: PHPSESSID Value: aq7951u8g9jaf1bk3b4f2uuidj
			uskg.pcerjr.top/	1969-12-31 23:59:59	Name: ASP.NET_SessionId Value: rltuoeevu4dfwnyiknv5orte

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cutt.ly
uskg.pcerjr.top
2606:4700:10::6816:e8
2606:4700:3035::6815:31ba
11a2142988720cd49ff000e5d488493947b3d34821301c5a706b3495b8381f7d
1cc43a97be92fddf0fe4244858f5337c80a8d350cd0afcd0c4d2004d3fded0ab
67fbe8ef9020e5c776aadf6801a1fef8dc563e2e4dc9ddc740af8010c0c38943
9685d6241f41ac71741d0ee9b242779f640cd3b1e64bb9bbcfb8798c5be503b2
96dae0825185b567d1b089685144ee8abe035a859b822d2b8b716f1374e641a0
b95f434286744e3dbaf5bc56f41d4ce2640da3038461502f7ac243a5931e9435
c8b13b10e28b6b420151db578831a416b7c1805d7672eeb57e69dc697fda1e27

uskg.pcerjr.top Open in urlscan Pro 2606:4700:3035::6815:31ba Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

7 Requests

100 %HTTPS

100 %IPv6

2 Domains

2 Subdomains

1 IPs

1 Countries

20 kBTransfer

64 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

2 Cookies

Indicators

uskg.pcerjr.top Open in urlscan Pro
2606:4700:3035::6815:31ba Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

1
IPs

1
Countries

20 kB
Transfer

64 kB
Size

2
Cookies

7 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!