Report - mail.correos.18-192-194-2.cprapid.com/sms-error.php

Report Overview

Submitted URL
mail.correos.18-192-194-2.cprapid.com/sms-error.php
IP
18.192.194.2
ASN
#16509 AMAZON-02
Submitted
2024-04-26 23:05:37
Access
public
Website Title
Confirme su identidad
Final URL
mail.correos.18-192-194-2.cprapid.com/sms-error.php
Tags
correos logistics phishing
urlquery detections
Phishing - Correos

Detections

urlquery
33
Network Intrusion Detection
0
Threat Detection Systems
0

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
aus5.mozilla.org	2548	1998-01-24	2015-10-27	2024-04-25	512 B	1.2 kB	35.244.181.201
mail.correos.18-192-194-2.cprapid.com	unknown	unknown	No data	No data	7.9 kB	354 kB	18.192.194.2

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (1)

	URL	Size	First Seen	Last Seen
	mail.correos.18-192-194-2.cprapid.com/javascript/codigo.js	3.5 kB	2023-03-08	2024-04-30
Pretty URL mail.correos.18-192-194-2.cprapid.com/javascript/codigo.js IP 18.192.194.2 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-08 16:01:22 Last Seen2024-04-30 02:02:59 Times Seen95 Hash d2aa2aea5f47616001eac25175ccaaa9 4242e8ecdaa79ee8a9fccef19cd2db5ba72585aa 11b019c7cee0159e28de21da4ccd4b405901b85e22d97b7f97d851b7bb3bdda6 Loading...

HTTP Transactions (17)

URL IP Response Size

mail.correos.18-192-194-2.cprapid.com/sms-error.php

18.192.194.2

200 OK

3.4 kB

URL User Request GET HTTP/1.1
mail.correos.18-192-194-2.cprapid.com/sms-error.php
IP
18.192.194.2:443
ASN
#16509 AMAZON-02

Certificate
IssuerLet's Encrypt
Subjectmail.correos.18-192-194-2.cprapid.com
Fingerprint0E:6E:F1:F8:71:A6:DA:54:B9:43:61:0A:25:7E:E2:73:7A:C8:18:C0
ValidityFri, 26 Apr 2024 11:53:48 GMT - Thu, 25 Jul 2024 11:53:47 GMT

File type
HTML document, Unicode text, UTF-8 text, with CRLF line terminators
Size
3.4 kB (3380 bytes)
Hash
99ac2fe5366415bb40a76c46732cec7e
f586ef88b5a9aca600ae7cff4627aaf78d030786
fb455d786e5d54cef622906edaeaaa571f961924f956f7d82c597201d454e1c1

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Correos

HTTP Headers

GET /sms-error.php HTTP/1.1
Host: mail.correos.18-192-194-2.cprapid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 26 Apr 2024 23:05:12 GMT
Server: Apache
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

mail.correos.18-192-194-2.cprapid.com/styles/head.css

18.192.194.2

200 OK

882 B

URL GET HTTP/1.1
mail.correos.18-192-194-2.cprapid.com/styles/head.css
IP
18.192.194.2:443
ASN
#16509 AMAZON-02

Requested by
https://mail.correos.18-192-194-2.cprapid.com/sms-error.php
Certificate
IssuerLet's Encrypt
Subjectmail.correos.18-192-194-2.cprapid.com
Fingerprint0E:6E:F1:F8:71:A6:DA:54:B9:43:61:0A:25:7E:E2:73:7A:C8:18:C0
ValidityFri, 26 Apr 2024 11:53:48 GMT - Thu, 25 Jul 2024 11:53:47 GMT

File type
ASCII text, with CRLF line terminators
Size
882 B (882 bytes)
Hash
2b67984e981be225446ec9e947609d95
9677efd78b9b8ca93d1f57377d3069da9677d3b8
555fb6d723203f6feda4f9834849fbada17a316fbb07e80f000996cd391258ec

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Correos

HTTP Headers

GET /styles/head.css HTTP/1.1
Host: mail.correos.18-192-194-2.cprapid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mail.correos.18-192-194-2.cprapid.com/sms-error.php
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 26 Apr 2024 23:05:12 GMT
Server: Apache
Last-Modified: Wed, 09 Nov 2022 13:46:36 GMT
Accept-Ranges: bytes
Content-Length: 882
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/css

mail.correos.18-192-194-2.cprapid.com/styles/main.css

18.192.194.2

200 OK

5.4 kB

URL GET HTTP/1.1
mail.correos.18-192-194-2.cprapid.com/styles/main.css
IP
18.192.194.2:443
ASN
#16509 AMAZON-02

Requested by
https://mail.correos.18-192-194-2.cprapid.com/sms-error.php
Certificate
IssuerLet's Encrypt
Subjectmail.correos.18-192-194-2.cprapid.com
Fingerprint0E:6E:F1:F8:71:A6:DA:54:B9:43:61:0A:25:7E:E2:73:7A:C8:18:C0
ValidityFri, 26 Apr 2024 11:53:48 GMT - Thu, 25 Jul 2024 11:53:47 GMT

File type
assembler source, ASCII text, with CRLF line terminators
Size
5.4 kB (5411 bytes)
Hash
69ad3265ac37ea14014c0bd8e111cb1c
3575344b0c1839f7393a93dbdbe824a0aef32729
9412fa88bd00b693e3899e98cf9ed2cec119236572f0bf8d257c777115fcb41f

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Correos

HTTP Headers

GET /styles/main.css HTTP/1.1
Host: mail.correos.18-192-194-2.cprapid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mail.correos.18-192-194-2.cprapid.com/sms-error.php
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 26 Apr 2024 23:05:12 GMT
Server: Apache
Last-Modified: Thu, 10 Nov 2022 18:37:36 GMT
Accept-Ranges: bytes
Content-Length: 5411
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: text/css

mail.correos.18-192-194-2.cprapid.com/styles/responsive.css

18.192.194.2

200 OK

1.8 kB

URL GET HTTP/1.1
mail.correos.18-192-194-2.cprapid.com/styles/responsive.css
IP
18.192.194.2:443
ASN
#16509 AMAZON-02

Requested by
https://mail.correos.18-192-194-2.cprapid.com/sms-error.php
Certificate
IssuerLet's Encrypt
Subjectmail.correos.18-192-194-2.cprapid.com
Fingerprint0E:6E:F1:F8:71:A6:DA:54:B9:43:61:0A:25:7E:E2:73:7A:C8:18:C0
ValidityFri, 26 Apr 2024 11:53:48 GMT - Thu, 25 Jul 2024 11:53:47 GMT

File type
assembler source, ASCII text, with CRLF line terminators
Size
1.8 kB (1756 bytes)
Hash
77c87af04ba7c0ab0f7771e74c55af56
ff8ad5b99137dbc53a21335d1a0a6e970dc7d5d1
e8dd42f6deace38cd1fae720b398765001207aadccc3cc324da0a4cbbdb8f3e3

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Correos

HTTP Headers

GET /styles/responsive.css HTTP/1.1
Host: mail.correos.18-192-194-2.cprapid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mail.correos.18-192-194-2.cprapid.com/sms-error.php
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 26 Apr 2024 23:05:12 GMT
Server: Apache
Last-Modified: Thu, 10 Nov 2022 18:09:58 GMT
Accept-Ranges: bytes
Content-Length: 1756
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/css

mail.correos.18-192-194-2.cprapid.com/styles/codigo.Css

18.192.194.2

200 OK

572 B

URL GET HTTP/1.1
mail.correos.18-192-194-2.cprapid.com/styles/codigo.Css
IP
18.192.194.2:443
ASN
#16509 AMAZON-02

Requested by
https://mail.correos.18-192-194-2.cprapid.com/sms-error.php
Certificate
IssuerLet's Encrypt
Subjectmail.correos.18-192-194-2.cprapid.com
Fingerprint0E:6E:F1:F8:71:A6:DA:54:B9:43:61:0A:25:7E:E2:73:7A:C8:18:C0
ValidityFri, 26 Apr 2024 11:53:48 GMT - Thu, 25 Jul 2024 11:53:47 GMT

File type
ASCII text, with CRLF line terminators
Size
572 B (572 bytes)
Hash
24d66e69130b56345df87efc6f719280
0cdd19f07446455b640665be5f4c5da8ee297c97
1fabc2b240dc75ec913233538d50e47f2244f68374b58a06050530f2f13ab3ed

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Correos

HTTP Headers

GET /styles/codigo.Css HTTP/1.1
Host: mail.correos.18-192-194-2.cprapid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mail.correos.18-192-194-2.cprapid.com/sms-error.php
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 26 Apr 2024 23:05:12 GMT
Server: Apache
Last-Modified: Thu, 10 Nov 2022 18:42:28 GMT
Accept-Ranges: bytes
Content-Length: 572
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/css

mail.correos.18-192-194-2.cprapid.com/styles/corr.css

18.192.194.2

200 OK

3.8 kB

URL GET HTTP/1.1
mail.correos.18-192-194-2.cprapid.com/styles/corr.css
IP
18.192.194.2:443
ASN
#16509 AMAZON-02

Requested by
https://mail.correos.18-192-194-2.cprapid.com/sms-error.php
Certificate
IssuerLet's Encrypt
Subjectmail.correos.18-192-194-2.cprapid.com
Fingerprint0E:6E:F1:F8:71:A6:DA:54:B9:43:61:0A:25:7E:E2:73:7A:C8:18:C0
ValidityFri, 26 Apr 2024 11:53:48 GMT - Thu, 25 Jul 2024 11:53:47 GMT

File type
ASCII text, with CRLF line terminators
Size
3.8 kB (3817 bytes)
Hash
40470364b02ec8ac74211ee78e6bc075
147af529a090c9cabbd3a2b618d344d35722c01b
504f97f068a0abd89a9c7b18f7133415655763a1a8df67ca8f753a4869ae3352

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Correos

HTTP Headers

GET /styles/corr.css HTTP/1.1
Host: mail.correos.18-192-194-2.cprapid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mail.correos.18-192-194-2.cprapid.com/sms-error.php
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 26 Apr 2024 23:05:12 GMT
Server: Apache
Last-Modified: Thu, 10 Nov 2022 20:57:32 GMT
Accept-Ranges: bytes
Content-Length: 3817
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/css

mail.correos.18-192-194-2.cprapid.com/javascript/codigo.js

18.192.194.2

200 OK

3.5 kB

URL GET HTTP/1.1
mail.correos.18-192-194-2.cprapid.com/javascript/codigo.js
IP
18.192.194.2:443
ASN
#16509 AMAZON-02

Requested by
https://mail.correos.18-192-194-2.cprapid.com/sms-error.php
Certificate
IssuerLet's Encrypt
Subjectmail.correos.18-192-194-2.cprapid.com
Fingerprint0E:6E:F1:F8:71:A6:DA:54:B9:43:61:0A:25:7E:E2:73:7A:C8:18:C0
ValidityFri, 26 Apr 2024 11:53:48 GMT - Thu, 25 Jul 2024 11:53:47 GMT

File type
ASCII text, with CRLF line terminators
Size
3.5 kB (3451 bytes)
Hash
d2aa2aea5f47616001eac25175ccaaa9
4242e8ecdaa79ee8a9fccef19cd2db5ba72585aa
11b019c7cee0159e28de21da4ccd4b405901b85e22d97b7f97d851b7bb3bdda6

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Correos

HTTP Headers

GET /javascript/codigo.js HTTP/1.1
Host: mail.correos.18-192-194-2.cprapid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mail.correos.18-192-194-2.cprapid.com/sms-error.php
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 26 Apr 2024 23:05:12 GMT
Server: Apache
Last-Modified: Thu, 10 Nov 2022 10:40:56 GMT
Accept-Ranges: bytes
Content-Length: 3451
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/javascript

mail.correos.18-192-194-2.cprapid.com/images/verified.png

18.192.194.2

200 OK

3.7 kB

URL GET HTTP/1.1
mail.correos.18-192-194-2.cprapid.com/images/verified.png
IP
18.192.194.2:443
ASN
#16509 AMAZON-02

Requested by
https://mail.correos.18-192-194-2.cprapid.com/sms-error.php
Certificate
IssuerLet's Encrypt
Subjectmail.correos.18-192-194-2.cprapid.com
Fingerprint0E:6E:F1:F8:71:A6:DA:54:B9:43:61:0A:25:7E:E2:73:7A:C8:18:C0
ValidityFri, 26 Apr 2024 11:53:48 GMT - Thu, 25 Jul 2024 11:53:47 GMT

File type
PNG image data, 303 x 114, 8-bit colormap, non-interlaced
Size
3.7 kB (3650 bytes)
Hash
b56134591e2320dd2b78d784234c9b7d
017fbc15055368e6fb3bfa7cb3b50f3459205e90
992bfa40b69d28f71cb97fdeb962c7ba01c45b6b774c069ba88827771f801184

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Correos

HTTP Headers

GET /images/verified.png HTTP/1.1
Host: mail.correos.18-192-194-2.cprapid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mail.correos.18-192-194-2.cprapid.com/sms-error.php
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 26 Apr 2024 23:05:12 GMT
Server: Apache
Last-Modified: Thu, 10 Nov 2022 20:05:14 GMT
Accept-Ranges: bytes
Content-Length: 3650
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: image/png

mail.correos.18-192-194-2.cprapid.com/images/LogoCornamusa.svg

18.192.194.2

200 OK

3.4 kB

URL GET HTTP/1.1
mail.correos.18-192-194-2.cprapid.com/images/LogoCornamusa.svg
IP
18.192.194.2:443
ASN
#16509 AMAZON-02

Requested by
https://mail.correos.18-192-194-2.cprapid.com/sms-error.php
Certificate
IssuerLet's Encrypt
Subjectmail.correos.18-192-194-2.cprapid.com
Fingerprint0E:6E:F1:F8:71:A6:DA:54:B9:43:61:0A:25:7E:E2:73:7A:C8:18:C0
ValidityFri, 26 Apr 2024 11:53:48 GMT - Thu, 25 Jul 2024 11:53:47 GMT

File type
SVG Scalable Vector Graphics image
Size
3.4 kB (3408 bytes)
Hash
cfb3473db7c1f5da4b0139cbad96481b
1b8dec32b360ac71472772abe602461050a5a887
9ca4b4430d80704711911dfc8604b4c12f6697c462cdfa1a52c0ed47c09f99da

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Correos

HTTP Headers

GET /images/LogoCornamusa.svg HTTP/1.1
Host: mail.correos.18-192-194-2.cprapid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mail.correos.18-192-194-2.cprapid.com/sms-error.php
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 26 Apr 2024 23:05:12 GMT
Server: Apache
Last-Modified: Wed, 09 Nov 2022 13:26:44 GMT
Accept-Ranges: bytes
Content-Length: 3408
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: image/svg+xml

mail.correos.18-192-194-2.cprapid.com/images/smsphone.svg

18.192.194.2

200 OK

1.3 kB

URL GET HTTP/1.1
mail.correos.18-192-194-2.cprapid.com/images/smsphone.svg
IP
18.192.194.2:443
ASN
#16509 AMAZON-02

Requested by
https://mail.correos.18-192-194-2.cprapid.com/sms-error.php
Certificate
IssuerLet's Encrypt
Subjectmail.correos.18-192-194-2.cprapid.com
Fingerprint0E:6E:F1:F8:71:A6:DA:54:B9:43:61:0A:25:7E:E2:73:7A:C8:18:C0
ValidityFri, 26 Apr 2024 11:53:48 GMT - Thu, 25 Jul 2024 11:53:47 GMT

File type
SVG Scalable Vector Graphics image
Size
1.3 kB (1317 bytes)
Hash
41d32eef1b116a33415af4db2b07275a
f5212e13d6fe65ee0f95f01d53b50b32474f3f5f
02d50fa51d79e9e316f1bec1e487e449bcf574ca7328ac1a8264a1f3cfe53d17

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Correos

HTTP Headers

GET /images/smsphone.svg HTTP/1.1
Host: mail.correos.18-192-194-2.cprapid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mail.correos.18-192-194-2.cprapid.com/sms-error.php
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 26 Apr 2024 23:05:12 GMT
Server: Apache
Last-Modified: Thu, 10 Nov 2022 20:15:06 GMT
Accept-Ranges: bytes
Content-Length: 1317
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: image/svg+xml

mail.correos.18-192-194-2.cprapid.com/images/footer-logo.svg

18.192.194.2

200 OK

1.5 kB

URL GET HTTP/1.1
mail.correos.18-192-194-2.cprapid.com/images/footer-logo.svg
IP
18.192.194.2:443
ASN
#16509 AMAZON-02

Requested by
https://mail.correos.18-192-194-2.cprapid.com/sms-error.php
Certificate
IssuerLet's Encrypt
Subjectmail.correos.18-192-194-2.cprapid.com
Fingerprint0E:6E:F1:F8:71:A6:DA:54:B9:43:61:0A:25:7E:E2:73:7A:C8:18:C0
ValidityFri, 26 Apr 2024 11:53:48 GMT - Thu, 25 Jul 2024 11:53:47 GMT

File type
SVG Scalable Vector Graphics image
Size
1.5 kB (1496 bytes)
Hash
afafbaf3482e83ad39a754c053c20766
1af54d4d9d60459efee51451e67eb080fc9772e9
dae58e3a35038fe1508d4ce16805960f8722fef2f68de4da845b9f48b9e969df

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Correos

HTTP Headers

GET /images/footer-logo.svg HTTP/1.1
Host: mail.correos.18-192-194-2.cprapid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mail.correos.18-192-194-2.cprapid.com/sms-error.php
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 26 Apr 2024 23:05:12 GMT
Server: Apache
Last-Modified: Thu, 10 Nov 2022 06:34:06 GMT
Accept-Ranges: bytes
Content-Length: 1496
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: image/svg+xml

mail.correos.18-192-194-2.cprapid.com/images/redsys.webp

18.192.194.2

200 OK

2.8 kB

URL GET HTTP/1.1
mail.correos.18-192-194-2.cprapid.com/images/redsys.webp
IP
18.192.194.2:443
ASN
#16509 AMAZON-02

Requested by
https://mail.correos.18-192-194-2.cprapid.com/sms-error.php
Certificate
IssuerLet's Encrypt
Subjectmail.correos.18-192-194-2.cprapid.com
Fingerprint0E:6E:F1:F8:71:A6:DA:54:B9:43:61:0A:25:7E:E2:73:7A:C8:18:C0
ValidityFri, 26 Apr 2024 11:53:48 GMT - Thu, 25 Jul 2024 11:53:47 GMT

File type
RIFF (little-endian) data, Web/P image
Size
2.8 kB (2766 bytes)
Hash
611b58c17d41d7b5f813a5c8bd3f2059
809abce49611e31ef77aec06c8f2a2ce881474cd
b1bc3e377c5a208e0aa8920d55c673e3894a70de7f8cc655587a0283bd6520ed

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Correos

HTTP Headers

GET /images/redsys.webp HTTP/1.1
Host: mail.correos.18-192-194-2.cprapid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mail.correos.18-192-194-2.cprapid.com/sms-error.php
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 26 Apr 2024 23:05:12 GMT
Server: Apache
Last-Modified: Thu, 10 Nov 2022 20:03:16 GMT
Accept-Ranges: bytes
Content-Length: 2766
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: image/webp

mail.correos.18-192-194-2.cprapid.com/fonts/CarteroRegular.otf

18.192.194.2

200 OK

38 kB

URL GET HTTP/1.1
mail.correos.18-192-194-2.cprapid.com/fonts/CarteroRegular.otf
IP
18.192.194.2:443
ASN
#16509 AMAZON-02

Requested by
https://mail.correos.18-192-194-2.cprapid.com/sms-error.php
Certificate
IssuerLet's Encrypt
Subjectmail.correos.18-192-194-2.cprapid.com
Fingerprint0E:6E:F1:F8:71:A6:DA:54:B9:43:61:0A:25:7E:E2:73:7A:C8:18:C0
ValidityFri, 26 Apr 2024 11:53:48 GMT - Thu, 25 Jul 2024 11:53:47 GMT

File type
OpenType font data
Size
38 kB (37756 bytes)
Hash
7795eea0ad6f4e834ff2d0e2241c451c
ad06834bf40685b1d5396167eea52cb63f7d4bd2
e3226d13f953e1ce196cf91fec6bbc878bc91eb65a768491ef90f3495e391fa1

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Correos

HTTP Headers

GET /fonts/CarteroRegular.otf HTTP/1.1
Host: mail.correos.18-192-194-2.cprapid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mail.correos.18-192-194-2.cprapid.com/styles/main.css
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 26 Apr 2024 23:05:12 GMT
Server: Apache
Last-Modified: Fri, 04 Feb 2022 21:00:56 GMT
Accept-Ranges: bytes
Content-Length: 37756
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive
Content-Type: font/otf

mail.correos.18-192-194-2.cprapid.com/images/background-login.jpg

18.192.194.2

200 OK

132 kB

URL GET HTTP/1.1
mail.correos.18-192-194-2.cprapid.com/images/background-login.jpg
IP
18.192.194.2:443
ASN
#16509 AMAZON-02

Requested by
https://mail.correos.18-192-194-2.cprapid.com/sms-error.php
Certificate
IssuerLet's Encrypt
Subjectmail.correos.18-192-194-2.cprapid.com
Fingerprint0E:6E:F1:F8:71:A6:DA:54:B9:43:61:0A:25:7E:E2:73:7A:C8:18:C0
ValidityFri, 26 Apr 2024 11:53:48 GMT - Thu, 25 Jul 2024 11:53:47 GMT

File type
JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], progressive, precision 8, 1920x1080, components 3
Size
132 kB (132523 bytes)
Hash
2df8bb420f0519564f0357ddd4cdde33
d8cfbf388b17cc4906441b14dbf8b8143281d8a1
642875617fb72743a219e89d09dca1ebb4c226cf3549c85f5d29d498e5add3c8

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Correos

HTTP Headers

GET /images/background-login.jpg HTTP/1.1
Host: mail.correos.18-192-194-2.cprapid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mail.correos.18-192-194-2.cprapid.com/sms-error.php
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 26 Apr 2024 23:05:12 GMT
Server: Apache
Last-Modified: Wed, 09 Nov 2022 13:46:58 GMT
Accept-Ranges: bytes
Content-Length: 132523
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: image/jpeg

mail.correos.18-192-194-2.cprapid.com/fonts/CarteroLight.otf

18.192.194.2

200 OK

38 kB

URL GET HTTP/1.1
mail.correos.18-192-194-2.cprapid.com/fonts/CarteroLight.otf
IP
18.192.194.2:443
ASN
#16509 AMAZON-02

Requested by
https://mail.correos.18-192-194-2.cprapid.com/sms-error.php
Certificate
IssuerLet's Encrypt
Subjectmail.correos.18-192-194-2.cprapid.com
Fingerprint0E:6E:F1:F8:71:A6:DA:54:B9:43:61:0A:25:7E:E2:73:7A:C8:18:C0
ValidityFri, 26 Apr 2024 11:53:48 GMT - Thu, 25 Jul 2024 11:53:47 GMT

File type
OpenType font data
Size
38 kB (37868 bytes)
Hash
c28e01b87bac1f47b43d5a564877a0ec
86a203e4742d57e064e2fb1e9c238798bb709a2b
94ddea49ff5c70e8c9b9eeaf22d9ed72f96abd31f2a3124b222ab9bd1de64446

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Correos

HTTP Headers

GET /fonts/CarteroLight.otf HTTP/1.1
Host: mail.correos.18-192-194-2.cprapid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mail.correos.18-192-194-2.cprapid.com/styles/main.css
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 26 Apr 2024 23:05:12 GMT
Server: Apache
Last-Modified: Fri, 04 Feb 2022 21:00:56 GMT
Accept-Ranges: bytes
Content-Length: 37868
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: font/otf

mail.correos.18-192-194-2.cprapid.com/images/favicon.ico

18.192.194.2

200 OK

110 kB

URL GET HTTP/1.1
mail.correos.18-192-194-2.cprapid.com/images/favicon.ico
IP
18.192.194.2:443
ASN
#16509 AMAZON-02

Requested by
https://mail.correos.18-192-194-2.cprapid.com/sms-error.php
Certificate
IssuerLet's Encrypt
Subjectmail.correos.18-192-194-2.cprapid.com
Fingerprint0E:6E:F1:F8:71:A6:DA:54:B9:43:61:0A:25:7E:E2:73:7A:C8:18:C0
ValidityFri, 26 Apr 2024 11:53:48 GMT - Thu, 25 Jul 2024 11:53:47 GMT

File type
MS Windows icon resource - 6 icons, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, -128x-128, 32 bits/pixel
Size
110 kB (110021 bytes)
Hash
349246ee336d8b2986e584a4fa436128
598b9f95458a2426bf1688d616c4f6f3fea3580e
68554c17c00a589c2b29e1f74ac5efbcd8d30252792626f5fff81955e4d89ae7

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Correos

HTTP Headers

GET /images/favicon.ico HTTP/1.1
Host: mail.correos.18-192-194-2.cprapid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mail.correos.18-192-194-2.cprapid.com/sms-error.php
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 26 Apr 2024 23:05:13 GMT
Server: Apache
Last-Modified: Tue, 08 Nov 2022 23:39:26 GMT
Accept-Ranges: bytes
Content-Length: 110021
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: image/x-icon

aus5.mozilla.org/update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-102-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml

35.244.181.201

444 B

URL
aus5.mozilla.org/update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-102-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml
IP
35.244.181.201:0
ASN
#396982 GOOGLE-CLOUD-PLATFORM

File type
XML 1.0 document, ASCII text, with very long lines (332)
Size
444 B (444 bytes)
Hash
3b324dec137a87ef7e24a30a65b13dd0
c0faa95b2f1018e264b3a14aaf50d1003e6c27b3
6cd0b591d9239fc8564627e92a804fc261951b1cbaf5fa58a8ada3cc13f51463

HTTP Headers

GET /update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-102-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml HTTP/1.1
Host: aus5.mozilla.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Cache-Control: no-cache
Pragma: no-cache
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
rule-id: unknown
rule-data-version: unknown
content-signature: x5u=https://content-signature-2.cdn.mozilla.net/chains/aus.content-signature.mozilla.org-2024-06-09-11-51-10.chain; p384ecdsa=a62SO5F0H5i1zjfG4VmmfRaAkOhmGkGHTHs7U94IT2MPtjdw4IxCfh40O0yHhwmbkuG0OmnJVe7v1mpUN_i7bNYKEEp5ywpoAb9dMithnYRJ4HT61xQkvv2tiZKlgWUV
strict-transport-security: max-age=31536000;
x-content-type-options: nosniff
content-security-policy: default-src 'none'; frame-ancestors 'none'
x-proxy-cache-status: EXPIRED
content-encoding: gzip
via: 1.1 google
date: Fri, 26 Apr 2024 23:04:03 GMT
content-type: text/xml; charset=utf-8
vary: Accept-Encoding
content-length: 444
age: 88
cache-control: public,max-age=90
alt-svc: clear
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (1)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (17)

URL User Request GET HTTP/1.1

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

Certificate

File type

Size