reda.azq1.com
Open in
urlscan Pro
78.46.48.145
Malicious Activity!
Public Scan
URL:
https://reda.azq1.com/
Submission: On December 08 via manual from SA — Scanned from SE
Submission: On December 08 via manual from SA — Scanned from SE
Summary
This website contacted 2 IPs
in 1 countries
across 1 domains to perform 3 HTTP transactions.
The main IP is 78.46.48.145, located in
Germany and
belongs to HETZNER-AS Hetzner Online GmbH, DE.
The main domain is reda.azq1.com.
TLS certificate: Issued by R10 on October 25th 2024. Valid for: 3 months.
This is the only time reda.azq1.com was scanned on urlscan.io!
TLS certificate: Issued by R10 on October 25th 2024. Valid for: 3 months.
This is the only time reda.azq1.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Aramex (Transportation)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 3 | 78.46.48.145 78.46.48.145 | 24940 (HETZNER-A...) (HETZNER-AS Hetzner Online GmbH) | |
| 3 | 2 |
3
78.46.48.145
(Germany)
ASN24940 (HETZNER-AS Hetzner Online GmbH, DE)
PTR: static.145.48.46.78.clients.your-server.de
ASN24940 (HETZNER-AS Hetzner Online GmbH, DE)
PTR: static.145.48.46.78.clients.your-server.de
| reda.azq1.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 3 |
azq1.com
reda.azq1.com |
456 KB |
| 3 | 1 |
| Domain | Requested by | |
|---|---|---|
| 3 | reda.azq1.com |
reda.azq1.com
|
| 3 | 1 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| reda.azq1.com R10 |
2024-10-25 - 2025-01-23 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://reda.azq1.com/
Frame ID: 20D218127597D5F42509E5A3B4C4638C
Requests: 2 HTTP requests in this frame
Frame:
https://reda.azq1.com/be/?serv=
Frame ID: E7A43EE1A173439DFCE19436AA19F92A
Requests: 13 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
3 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
/
reda.azq1.com/ |
865 B 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
/
reda.azq1.com/be/ Frame E7A4 |
454 KB 455 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ Frame E7A4 |
4 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ Frame E7A4 |
7 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ Frame E7A4 |
6 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ Frame E7A4 |
1 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ Frame E7A4 |
555 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ Frame E7A4 |
1 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ Frame E7A4 |
424 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ Frame E7A4 |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ Frame E7A4 |
677 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ Frame E7A4 |
643 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ Frame E7A4 |
797 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ Frame E7A4 |
92 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
favicon.ico
reda.azq1.com/ |
315 B 479 B |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Aramex (Transportation)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 string| write_iframe0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
reda.azq1.com
78.46.48.145
26672ffc5edf4c733fafc6988864f8ad7c85ecf1bb296ac493ce1928e15f682f
2827052ff2f39ff8dc865661f7ed2a528636e3c10cbd39a819716214ffb0dfa7
2b86d8e4382ccf265ba1868a89cdc559e41468d9c501d56691e4b88bf90d2f0d
37b9f4c09ef8153cbcfe9e4e65df5eefba1fd1274d700af4e33370b4a2b7cbec
559a944338db2f3adee6be15854629b7d9042928ab9034f48438385a4d70018a
58ead390cc509331a0ef667a2ed6df336c32af6d03f3c4342d84412f776188ef
83ba66cd40ebbd3beb61d6e95dfefa745903e5eda8da8134cec74b57f981f498
8c3d3b6bfcc139819e992b2aadd3b66a38003d7a64a4817e4b252c12730d745e
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
e0447aa04943d0d047baf922ce6f286da4e50d62113aa19505f75705a9a46773
e04db9914028c55eddba015bf5dd33df57749f0f07fe7c65635fa2682c4dc4fb
e5d820987db3c395fa069e88ddaec100f7ad679ea9d425a9c0f24ad1a01d8bee
e68c19ff1d9a5a8afd8484c3f1cfb97cb69afd7f11078bc500d6f8e761f9f66f
f1e8231c6f3bf3a4cbfc92a5f8beaff846a3014c21fe8396ed212bb0d0244db9
f9351e5ce5a6bdc6c9e724e64067392d118adc10d197d2be8712c78b75f78518