fcx.gsf.temporary.site
Open in
urlscan Pro
50.6.160.120
Malicious Activity!
Public Scan
Effective URL: https://fcx.gsf.temporary.site/postcode-evri/trackMyParcelForm.php?sslchannel=true&sessionid=VimqBIcVFKhFAhBkRZc8CUuoTHhC5Re2c1...
Submission: On January 22 via api from US — Scanned from US
Summary
TLS certificate: Issued by R3 on January 20th 2024. Valid for: 3 months.
This is the only time fcx.gsf.temporary.site was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Hermes (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 2 | 162.240.165.187 162.240.165.187 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
2 9 | 50.6.160.120 50.6.160.120 | 19871 (NETWORK-S...) (NETWORK-SOLUTIONS-HOSTING) | |
7 | 1 |
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 162-240-165-187.unifiedlayer.com
mobilesredirect.rsrealty.ph | |
maskuranet.magallanessorsogon.gov.ph |
ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: 50-6-160-120.unifiedlayer.com
fcx.gsf.temporary.site |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
temporary.site
2 redirects
fcx.gsf.temporary.site |
179 KB |
1 |
magallanessorsogon.gov.ph
1 redirects
maskuranet.magallanessorsogon.gov.ph |
420 B |
1 |
rsrealty.ph
1 redirects
mobilesredirect.rsrealty.ph |
420 B |
7 | 3 |
Domain | Requested by | |
---|---|---|
9 | fcx.gsf.temporary.site |
2 redirects
fcx.gsf.temporary.site
|
1 | maskuranet.magallanessorsogon.gov.ph | 1 redirects |
1 | mobilesredirect.rsrealty.ph | 1 redirects |
7 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
autodiscover.fcx.gsf.temporary.site R3 |
2024-01-20 - 2024-04-19 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://fcx.gsf.temporary.site/postcode-evri/trackMyParcelForm.php?sslchannel=true&sessionid=VimqBIcVFKhFAhBkRZc8CUuoTHhC5Re2c1oaNCx6AF9VGgbKupily9zwdlCl2ANjon5vrloNuaEWU4sYNhLVpFkVKeJvZQi95qyteruCfbgooBP6oR00OVWKZ1q3ZWBlxC
Frame ID: 3A3C525F463EC4A6C6388FE4E6A29F07
Requests: 7 HTTP requests in this frame
Screenshot
Page Title
Evri - The New Hermes | Cheap Parcel Delivery & Courier ServicePage URL History Show full URLs
-
http://mobilesredirect.rsrealty.ph/
HTTP 302
https://maskuranet.magallanessorsogon.gov.ph/ HTTP 302
https://fcx.gsf.temporary.site/postcode-evri HTTP 301
https://fcx.gsf.temporary.site/postcode-evri/ HTTP 302
https://fcx.gsf.temporary.site/postcode-evri/trackMyParcelForm.php?sslchannel=true&sessionid=VimqBIcVFKhFAh... Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- \.php(?:$|\?)
Nuxt.js (JavaScript Frameworks) Expand
Detected patterns
- <div [^>]*id="__nuxt"
Vue.js (JavaScript Frameworks) Expand
Detected patterns
- <[^>]+\sdata-v(?:ue)?-
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://mobilesredirect.rsrealty.ph/
HTTP 302
https://maskuranet.magallanessorsogon.gov.ph/ HTTP 302
https://fcx.gsf.temporary.site/postcode-evri HTTP 301
https://fcx.gsf.temporary.site/postcode-evri/ HTTP 302
https://fcx.gsf.temporary.site/postcode-evri/trackMyParcelForm.php?sslchannel=true&sessionid=VimqBIcVFKhFAhBkRZc8CUuoTHhC5Re2c1oaNCx6AF9VGgbKupily9zwdlCl2ANjon5vrloNuaEWU4sYNhLVpFkVKeJvZQi95qyteruCfbgooBP6oR00OVWKZ1q3ZWBlxC Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
trackMyParcelForm.php
fcx.gsf.temporary.site/postcode-evri/ Redirect Chain
|
52 KB 13 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
d_main.css
fcx.gsf.temporary.site/postcode-evri/e_v_assetz/css/ |
65 KB 16 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
evri-heart.svg
fcx.gsf.temporary.site/postcode-evri/e_v_assetz/img/ |
3 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.js
fcx.gsf.temporary.site/postcode-evri/e_v_assetz/js/ |
266 KB 101 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
misc.js
fcx.gsf.temporary.site/postcode-evri/e_v_assetz/js/ |
16 KB 6 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
poppins-regular-webfont.7930357.woff2
fcx.gsf.temporary.site/postcode-evri/e_v_assetz/fonts/ |
19 KB 19 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
poppins-semibold-webfont.392d12d.woff2
fcx.gsf.temporary.site/postcode-evri/e_v_assetz/fonts/ |
19 KB 19 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Hermes (Transportation)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery object| $jscomp3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
mobilesredirect.rsrealty.ph/ | Name: PHPSESSID Value: 1b00a74bc5451407c3f6e798756b8ac8 |
|
maskuranet.magallanessorsogon.gov.ph/ | Name: PHPSESSID Value: c53bd313c3c5bb3bf70be377f843ab4f |
|
fcx.gsf.temporary.site/ | Name: PHPSESSID Value: adc3689dbcbde365f7a6f77b8c7cd050 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fcx.gsf.temporary.site
maskuranet.magallanessorsogon.gov.ph
mobilesredirect.rsrealty.ph
162.240.165.187
50.6.160.120
031c5081599c7bd31d20405cd83935c937575c5bdffcc9879136cf1fa776bc39
067b66273ba2a156d2f6ca5529e4aeb9949408e47e06bd2d38e2093edc3bbab1
475575a56670c4ab3f05ca4b001674bbea9e6cbacaf9e0c0f2527a1aacdb9731
4c812e50254002732f4cebd09bf2e54ccbe9a8d3444dcf8cfedd8dce71ef1493
5805b5c786e9d2a4ef962597ae6f2ad133b015b182ab5ff0747e1ae373a20c26
6c072d5390b0af0f25e23f3113ecd39b85222a73eabe923e3b24ce933677895e
84086bb634fc6fd223918894c6b74641811e06e84007937c5809942b7a02ddff