Report - mail.correos.18-192-194-2.cprapid.com/

Report Overview

Submitted URL
mail.correos.18-192-194-2.cprapid.com/
IP
18.192.194.2
ASN
#16509 AMAZON-02
Submitted
2024-04-27 03:49:02
Access
public
Website Title
Métodos de pago
Final URL
mail.correos.18-192-194-2.cprapid.com/
Tags
correos logistics phishing
urlquery detections
Phishing - Correos

Detections

urlquery
18
Network Intrusion Detection
0
Threat Detection Systems
36

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
mail.correos.18-192-194-2.cprapid.com	unknown	unknown	No data	No data	8.6 kB	552 kB	18.192.194.2
aus5.mozilla.org	2548	1998-01-24	2015-10-27	2024-04-25	512 B	1.2 kB	35.244.181.201

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2024-04-26	medium	mail.correos.18-192-194-2.cprapid.com/	Correos
2024-04-26	medium	mail.correos.18-192-194-2.cprapid.com/	Correos
2024-04-26	medium	mail.correos.18-192-194-2.cprapid.com/	Correos
2024-04-26	medium	mail.correos.18-192-194-2.cprapid.com/	Correos
2024-04-26	medium	mail.correos.18-192-194-2.cprapid.com/	Correos
2024-04-26	medium	mail.correos.18-192-194-2.cprapid.com/	Correos
2024-04-26	medium	mail.correos.18-192-194-2.cprapid.com/	Correos
2024-04-26	medium	mail.correos.18-192-194-2.cprapid.com/	Correos
2024-04-26	medium	mail.correos.18-192-194-2.cprapid.com/	Correos
2024-04-26	medium	mail.correos.18-192-194-2.cprapid.com/	Correos
2024-04-26	medium	mail.correos.18-192-194-2.cprapid.com/	Correos
2024-04-26	medium	mail.correos.18-192-194-2.cprapid.com/	Correos
2024-04-26	medium	mail.correos.18-192-194-2.cprapid.com/	Correos
2024-04-26	medium	mail.correos.18-192-194-2.cprapid.com/	Correos
2024-04-26	medium	mail.correos.18-192-194-2.cprapid.com/	Correos
2024-04-26	medium	mail.correos.18-192-194-2.cprapid.com/	Correos
2024-04-26	medium	mail.correos.18-192-194-2.cprapid.com/	Correos
2024-04-26	medium	mail.correos.18-192-194-2.cprapid.com/	Correos

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (1)

	URL	Size	First Seen	Last Seen
	mail.correos.18-192-194-2.cprapid.com/javascript/login.js	7.8 kB	2023-03-08	2024-04-27
Pretty URL mail.correos.18-192-194-2.cprapid.com/javascript/login.js IP 18.192.194.2 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-08 16:44:41 Last Seen2024-04-27 05:49:08 Times Seen48 Hash 3a16903d4dd6288f9630922a7c067ee2 78acaaed986262fc93e100446659762b116f1763 caf62e099969496a17b3d88c040407597c048f31eb5d09333b33301cdee8695e Loading...

HTTP Transactions (19)

URL IP Response Size

mail.correos.18-192-194-2.cprapid.com/

18.192.194.2

200 OK

3.9 kB

URL User Request GET HTTP/1.1
mail.correos.18-192-194-2.cprapid.com/
IP
18.192.194.2:443
ASN
#16509 AMAZON-02

Certificate
IssuerLet's Encrypt
Subjectmail.correos.18-192-194-2.cprapid.com
Fingerprint0E:6E:F1:F8:71:A6:DA:54:B9:43:61:0A:25:7E:E2:73:7A:C8:18:C0
ValidityFri, 26 Apr 2024 11:53:48 GMT - Thu, 25 Jul 2024 11:53:47 GMT

File type
HTML document, Unicode text, UTF-8 text, with CRLF line terminators
Size
3.9 kB (3945 bytes)
Hash
1d0cadaa9eb7fec589ac4fec76e87a46
5a57b1aec8517db830ff3fc07777b6f047cf81d6
8be1a2aba37c87173a49b39d3353cef057060bb1dee6793f5de6e6de173691cb

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Correos

HTTP Headers

GET / HTTP/1.1
Host: mail.correos.18-192-194-2.cprapid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 27 Apr 2024 03:48:36 GMT
Server: Apache
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

mail.correos.18-192-194-2.cprapid.com/styles/head.css

18.192.194.2

200 OK

882 B

URL GET HTTP/1.1
mail.correos.18-192-194-2.cprapid.com/styles/head.css
IP
18.192.194.2:443
ASN
#16509 AMAZON-02

Requested by
https://mail.correos.18-192-194-2.cprapid.com/
Certificate
IssuerLet's Encrypt
Subjectmail.correos.18-192-194-2.cprapid.com
Fingerprint0E:6E:F1:F8:71:A6:DA:54:B9:43:61:0A:25:7E:E2:73:7A:C8:18:C0
ValidityFri, 26 Apr 2024 11:53:48 GMT - Thu, 25 Jul 2024 11:53:47 GMT

File type
ASCII text, with CRLF line terminators
Size
882 B (882 bytes)
Hash
2b67984e981be225446ec9e947609d95
9677efd78b9b8ca93d1f57377d3069da9677d3b8
555fb6d723203f6feda4f9834849fbada17a316fbb07e80f000996cd391258ec

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Correos
OpenPhish	phishing	Correos

HTTP Headers

GET /styles/head.css HTTP/1.1
Host: mail.correos.18-192-194-2.cprapid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mail.correos.18-192-194-2.cprapid.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 27 Apr 2024 03:48:36 GMT
Server: Apache
Last-Modified: Wed, 09 Nov 2022 13:46:36 GMT
Accept-Ranges: bytes
Content-Length: 882
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/css

mail.correos.18-192-194-2.cprapid.com/styles/main.css

18.192.194.2

200 OK

5.4 kB

URL GET HTTP/1.1
mail.correos.18-192-194-2.cprapid.com/styles/main.css
IP
18.192.194.2:443
ASN
#16509 AMAZON-02

Requested by
https://mail.correos.18-192-194-2.cprapid.com/
Certificate
IssuerLet's Encrypt
Subjectmail.correos.18-192-194-2.cprapid.com
Fingerprint0E:6E:F1:F8:71:A6:DA:54:B9:43:61:0A:25:7E:E2:73:7A:C8:18:C0
ValidityFri, 26 Apr 2024 11:53:48 GMT - Thu, 25 Jul 2024 11:53:47 GMT

File type
assembler source, ASCII text, with CRLF line terminators
Size
5.4 kB (5411 bytes)
Hash
69ad3265ac37ea14014c0bd8e111cb1c
3575344b0c1839f7393a93dbdbe824a0aef32729
9412fa88bd00b693e3899e98cf9ed2cec119236572f0bf8d257c777115fcb41f

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Correos
OpenPhish	phishing	Correos

HTTP Headers

GET /styles/main.css HTTP/1.1
Host: mail.correos.18-192-194-2.cprapid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mail.correos.18-192-194-2.cprapid.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 27 Apr 2024 03:48:36 GMT
Server: Apache
Last-Modified: Thu, 10 Nov 2022 18:37:36 GMT
Accept-Ranges: bytes
Content-Length: 5411
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: text/css

mail.correos.18-192-194-2.cprapid.com/styles/corr.css

18.192.194.2

200 OK

3.8 kB

URL GET HTTP/1.1
mail.correos.18-192-194-2.cprapid.com/styles/corr.css
IP
18.192.194.2:443
ASN
#16509 AMAZON-02

Requested by
https://mail.correos.18-192-194-2.cprapid.com/
Certificate
IssuerLet's Encrypt
Subjectmail.correos.18-192-194-2.cprapid.com
Fingerprint0E:6E:F1:F8:71:A6:DA:54:B9:43:61:0A:25:7E:E2:73:7A:C8:18:C0
ValidityFri, 26 Apr 2024 11:53:48 GMT - Thu, 25 Jul 2024 11:53:47 GMT

File type
ASCII text, with CRLF line terminators
Size
3.8 kB (3817 bytes)
Hash
40470364b02ec8ac74211ee78e6bc075
147af529a090c9cabbd3a2b618d344d35722c01b
504f97f068a0abd89a9c7b18f7133415655763a1a8df67ca8f753a4869ae3352

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Correos
OpenPhish	phishing	Correos

HTTP Headers

GET /styles/corr.css HTTP/1.1
Host: mail.correos.18-192-194-2.cprapid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mail.correos.18-192-194-2.cprapid.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 27 Apr 2024 03:48:37 GMT
Server: Apache
Last-Modified: Thu, 10 Nov 2022 20:57:32 GMT
Accept-Ranges: bytes
Content-Length: 3817
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/css

mail.correos.18-192-194-2.cprapid.com/styles/responsive.css

18.192.194.2

200 OK

1.8 kB

URL GET HTTP/1.1
mail.correos.18-192-194-2.cprapid.com/styles/responsive.css
IP
18.192.194.2:443
ASN
#16509 AMAZON-02

Requested by
https://mail.correos.18-192-194-2.cprapid.com/
Certificate
IssuerLet's Encrypt
Subjectmail.correos.18-192-194-2.cprapid.com
Fingerprint0E:6E:F1:F8:71:A6:DA:54:B9:43:61:0A:25:7E:E2:73:7A:C8:18:C0
ValidityFri, 26 Apr 2024 11:53:48 GMT - Thu, 25 Jul 2024 11:53:47 GMT

File type
assembler source, ASCII text, with CRLF line terminators
Size
1.8 kB (1756 bytes)
Hash
77c87af04ba7c0ab0f7771e74c55af56
ff8ad5b99137dbc53a21335d1a0a6e970dc7d5d1
e8dd42f6deace38cd1fae720b398765001207aadccc3cc324da0a4cbbdb8f3e3

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Correos
OpenPhish	phishing	Correos

HTTP Headers

GET /styles/responsive.css HTTP/1.1
Host: mail.correos.18-192-194-2.cprapid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mail.correos.18-192-194-2.cprapid.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 27 Apr 2024 03:48:37 GMT
Server: Apache
Last-Modified: Thu, 10 Nov 2022 18:09:58 GMT
Accept-Ranges: bytes
Content-Length: 1756
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/css

mail.correos.18-192-194-2.cprapid.com/javascript/login.js

18.192.194.2

200 OK

7.8 kB

URL GET HTTP/1.1
mail.correos.18-192-194-2.cprapid.com/javascript/login.js
IP
18.192.194.2:443
ASN
#16509 AMAZON-02

Requested by
https://mail.correos.18-192-194-2.cprapid.com/
Certificate
IssuerLet's Encrypt
Subjectmail.correos.18-192-194-2.cprapid.com
Fingerprint0E:6E:F1:F8:71:A6:DA:54:B9:43:61:0A:25:7E:E2:73:7A:C8:18:C0
ValidityFri, 26 Apr 2024 11:53:48 GMT - Thu, 25 Jul 2024 11:53:47 GMT

File type
ASCII text, with CRLF line terminators
Size
7.8 kB (7839 bytes)
Hash
3a16903d4dd6288f9630922a7c067ee2
78acaaed986262fc93e100446659762b116f1763
caf62e099969496a17b3d88c040407597c048f31eb5d09333b33301cdee8695e

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Correos
OpenPhish	phishing	Correos

HTTP Headers

GET /javascript/login.js HTTP/1.1
Host: mail.correos.18-192-194-2.cprapid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mail.correos.18-192-194-2.cprapid.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 27 Apr 2024 03:48:37 GMT
Server: Apache
Last-Modified: Thu, 10 Nov 2022 11:28:18 GMT
Accept-Ranges: bytes
Content-Length: 7839
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/javascript

mail.correos.18-192-194-2.cprapid.com/images/newmast.jpg

18.192.194.2

200 OK

14 kB

URL GET HTTP/1.1
mail.correos.18-192-194-2.cprapid.com/images/newmast.jpg
IP
18.192.194.2:443
ASN
#16509 AMAZON-02

Requested by
https://mail.correos.18-192-194-2.cprapid.com/
Certificate
IssuerLet's Encrypt
Subjectmail.correos.18-192-194-2.cprapid.com
Fingerprint0E:6E:F1:F8:71:A6:DA:54:B9:43:61:0A:25:7E:E2:73:7A:C8:18:C0
ValidityFri, 26 Apr 2024 11:53:48 GMT - Thu, 25 Jul 2024 11:53:47 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1000x524, components 3
Size
14 kB (13533 bytes)
Hash
a1c50c99f04816ae73576a889d33386e
ff0f9e637dfb792c6a494b001d9fd921537d540a
2cc2d8990621a1b2b5d2e82a27c7d994998fe8b0fd68ee944416e95e6213cb8a

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Correos
OpenPhish	phishing	Correos

HTTP Headers

GET /images/newmast.jpg HTTP/1.1
Host: mail.correos.18-192-194-2.cprapid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mail.correos.18-192-194-2.cprapid.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 27 Apr 2024 03:48:37 GMT
Server: Apache
Last-Modified: Thu, 10 Nov 2022 18:34:58 GMT
Accept-Ranges: bytes
Content-Length: 13533
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: image/jpeg

mail.correos.18-192-194-2.cprapid.com/images/google-pay.webp

18.192.194.2

200 OK

9.1 kB

URL GET HTTP/1.1
mail.correos.18-192-194-2.cprapid.com/images/google-pay.webp
IP
18.192.194.2:443
ASN
#16509 AMAZON-02

Requested by
https://mail.correos.18-192-194-2.cprapid.com/
Certificate
IssuerLet's Encrypt
Subjectmail.correos.18-192-194-2.cprapid.com
Fingerprint0E:6E:F1:F8:71:A6:DA:54:B9:43:61:0A:25:7E:E2:73:7A:C8:18:C0
ValidityFri, 26 Apr 2024 11:53:48 GMT - Thu, 25 Jul 2024 11:53:47 GMT

File type
RIFF (little-endian) data, Web/P image, VP8 encoding, 270x80, Scaling: [none]x[none], YUV color, decoders should clamp
Size
9.1 kB (9054 bytes)
Hash
571895f0016b4cbc09a84e0006cd222e
79a62788f312715d13e16b1f5e96284a80a8dfff
9c4ce6d29c0c321c89f3729b67ca0bf38f725cecd5349e761196de74aeaf1a16

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Correos
OpenPhish	phishing	Correos

HTTP Headers

GET /images/google-pay.webp HTTP/1.1
Host: mail.correos.18-192-194-2.cprapid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mail.correos.18-192-194-2.cprapid.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 27 Apr 2024 03:48:37 GMT
Server: Apache
Last-Modified: Thu, 10 Nov 2022 18:15:58 GMT
Accept-Ranges: bytes
Content-Length: 9054
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: image/webp

mail.correos.18-192-194-2.cprapid.com/images/apple_store.webp

18.192.194.2

200 OK

8.7 kB

URL GET HTTP/1.1
mail.correos.18-192-194-2.cprapid.com/images/apple_store.webp
IP
18.192.194.2:443
ASN
#16509 AMAZON-02

Requested by
https://mail.correos.18-192-194-2.cprapid.com/
Certificate
IssuerLet's Encrypt
Subjectmail.correos.18-192-194-2.cprapid.com
Fingerprint0E:6E:F1:F8:71:A6:DA:54:B9:43:61:0A:25:7E:E2:73:7A:C8:18:C0
ValidityFri, 26 Apr 2024 11:53:48 GMT - Thu, 25 Jul 2024 11:53:47 GMT

File type
RIFF (little-endian) data, Web/P image, VP8 encoding, 250x82, Scaling: [none]x[none], YUV color, decoders should clamp
Size
8.7 kB (8738 bytes)
Hash
49954554be97abbc56bc3275a7786069
882c7547c7f27253522901b2f7e4f9e17f8a5b92
80d4aee7ef373cfc1bd320cac178b064766202d21b314b4e8d667c805c1e3e40

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Correos
OpenPhish	phishing	Correos

HTTP Headers

GET /images/apple_store.webp HTTP/1.1
Host: mail.correos.18-192-194-2.cprapid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mail.correos.18-192-194-2.cprapid.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 27 Apr 2024 03:48:37 GMT
Server: Apache
Last-Modified: Thu, 10 Nov 2022 18:16:22 GMT
Accept-Ranges: bytes
Content-Length: 8738
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: image/webp

mail.correos.18-192-194-2.cprapid.com/images/galery.svg

18.192.194.2

200 OK

26 kB

URL GET HTTP/1.1
mail.correos.18-192-194-2.cprapid.com/images/galery.svg
IP
18.192.194.2:443
ASN
#16509 AMAZON-02

Requested by
https://mail.correos.18-192-194-2.cprapid.com/
Certificate
IssuerLet's Encrypt
Subjectmail.correos.18-192-194-2.cprapid.com
Fingerprint0E:6E:F1:F8:71:A6:DA:54:B9:43:61:0A:25:7E:E2:73:7A:C8:18:C0
ValidityFri, 26 Apr 2024 11:53:48 GMT - Thu, 25 Jul 2024 11:53:47 GMT

File type
SVG Scalable Vector Graphics image
Size
26 kB (25692 bytes)
Hash
9b5f566cf4ff8e696afd2ee619c3d421
4d75c86bc3c4f2b6470a4600757720cb3efb15ea
11bea3ea4d9c77c655fdbb5a8b3001c8656247fd727650429fc80a90674c6acc

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Correos
OpenPhish	phishing	Correos

HTTP Headers

GET /images/galery.svg HTTP/1.1
Host: mail.correos.18-192-194-2.cprapid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mail.correos.18-192-194-2.cprapid.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 27 Apr 2024 03:48:37 GMT
Server: Apache
Last-Modified: Thu, 10 Nov 2022 18:16:58 GMT
Accept-Ranges: bytes
Content-Length: 25692
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: image/svg+xml

mail.correos.18-192-194-2.cprapid.com/images/LogoCornamusa.svg

18.192.194.2

200 OK

3.4 kB

URL GET HTTP/1.1
mail.correos.18-192-194-2.cprapid.com/images/LogoCornamusa.svg
IP
18.192.194.2:443
ASN
#16509 AMAZON-02

Requested by
https://mail.correos.18-192-194-2.cprapid.com/
Certificate
IssuerLet's Encrypt
Subjectmail.correos.18-192-194-2.cprapid.com
Fingerprint0E:6E:F1:F8:71:A6:DA:54:B9:43:61:0A:25:7E:E2:73:7A:C8:18:C0
ValidityFri, 26 Apr 2024 11:53:48 GMT - Thu, 25 Jul 2024 11:53:47 GMT

File type
SVG Scalable Vector Graphics image
Size
3.4 kB (3408 bytes)
Hash
cfb3473db7c1f5da4b0139cbad96481b
1b8dec32b360ac71472772abe602461050a5a887
9ca4b4430d80704711911dfc8604b4c12f6697c462cdfa1a52c0ed47c09f99da

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Correos
OpenPhish	phishing	Correos

HTTP Headers

GET /images/LogoCornamusa.svg HTTP/1.1
Host: mail.correos.18-192-194-2.cprapid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mail.correos.18-192-194-2.cprapid.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 27 Apr 2024 03:48:37 GMT
Server: Apache
Last-Modified: Wed, 09 Nov 2022 13:26:44 GMT
Accept-Ranges: bytes
Content-Length: 3408
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: image/svg+xml

mail.correos.18-192-194-2.cprapid.com/images/visaa.jpg

18.192.194.2

200 OK

46 kB

URL GET HTTP/1.1
mail.correos.18-192-194-2.cprapid.com/images/visaa.jpg
IP
18.192.194.2:443
ASN
#16509 AMAZON-02

Requested by
https://mail.correos.18-192-194-2.cprapid.com/
Certificate
IssuerLet's Encrypt
Subjectmail.correos.18-192-194-2.cprapid.com
Fingerprint0E:6E:F1:F8:71:A6:DA:54:B9:43:61:0A:25:7E:E2:73:7A:C8:18:C0
ValidityFri, 26 Apr 2024 11:53:48 GMT - Thu, 25 Jul 2024 11:53:47 GMT

File type
JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=1, software=Adobe Photoshop 23.1 (Macintosh)], baseline, precision 8, 800x450, components 3
Size
46 kB (46193 bytes)
Hash
91f41a575e9aeb50f4dca2ffc81f5775
1beac9fcb7f092dacf09aab901f4445d0a77f0ff
8d325e2ec62ce6a54ed92f5e7994cbcf5fc888e0b06e31d60359e58d9ea66124

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Correos
OpenPhish	phishing	Correos

HTTP Headers

GET /images/visaa.jpg HTTP/1.1
Host: mail.correos.18-192-194-2.cprapid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mail.correos.18-192-194-2.cprapid.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 27 Apr 2024 03:48:37 GMT
Server: Apache
Last-Modified: Thu, 10 Nov 2022 18:33:16 GMT
Accept-Ranges: bytes
Content-Length: 46193
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: image/jpeg

mail.correos.18-192-194-2.cprapid.com/fonts/CarteroRegular.otf

18.192.194.2

200 OK

38 kB

URL GET HTTP/1.1
mail.correos.18-192-194-2.cprapid.com/fonts/CarteroRegular.otf
IP
18.192.194.2:443
ASN
#16509 AMAZON-02

Requested by
https://mail.correos.18-192-194-2.cprapid.com/
Certificate
IssuerLet's Encrypt
Subjectmail.correos.18-192-194-2.cprapid.com
Fingerprint0E:6E:F1:F8:71:A6:DA:54:B9:43:61:0A:25:7E:E2:73:7A:C8:18:C0
ValidityFri, 26 Apr 2024 11:53:48 GMT - Thu, 25 Jul 2024 11:53:47 GMT

File type
OpenType font data
Size
38 kB (37756 bytes)
Hash
7795eea0ad6f4e834ff2d0e2241c451c
ad06834bf40685b1d5396167eea52cb63f7d4bd2
e3226d13f953e1ce196cf91fec6bbc878bc91eb65a768491ef90f3495e391fa1

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Correos
OpenPhish	phishing	Correos

HTTP Headers

GET /fonts/CarteroRegular.otf HTTP/1.1
Host: mail.correos.18-192-194-2.cprapid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mail.correos.18-192-194-2.cprapid.com/styles/main.css
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 27 Apr 2024 03:48:37 GMT
Server: Apache
Last-Modified: Fri, 04 Feb 2022 21:00:56 GMT
Accept-Ranges: bytes
Content-Length: 37756
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: font/otf

mail.correos.18-192-194-2.cprapid.com/images/footer-logo.svg

18.192.194.2

200 OK

1.5 kB

URL GET HTTP/1.1
mail.correos.18-192-194-2.cprapid.com/images/footer-logo.svg
IP
18.192.194.2:443
ASN
#16509 AMAZON-02

Requested by
https://mail.correos.18-192-194-2.cprapid.com/
Certificate
IssuerLet's Encrypt
Subjectmail.correos.18-192-194-2.cprapid.com
Fingerprint0E:6E:F1:F8:71:A6:DA:54:B9:43:61:0A:25:7E:E2:73:7A:C8:18:C0
ValidityFri, 26 Apr 2024 11:53:48 GMT - Thu, 25 Jul 2024 11:53:47 GMT

File type
SVG Scalable Vector Graphics image
Size
1.5 kB (1496 bytes)
Hash
afafbaf3482e83ad39a754c053c20766
1af54d4d9d60459efee51451e67eb080fc9772e9
dae58e3a35038fe1508d4ce16805960f8722fef2f68de4da845b9f48b9e969df

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Correos
OpenPhish	phishing	Correos

HTTP Headers

GET /images/footer-logo.svg HTTP/1.1
Host: mail.correos.18-192-194-2.cprapid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mail.correos.18-192-194-2.cprapid.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 27 Apr 2024 03:48:37 GMT
Server: Apache
Last-Modified: Thu, 10 Nov 2022 06:34:06 GMT
Accept-Ranges: bytes
Content-Length: 1496
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: image/svg+xml

mail.correos.18-192-194-2.cprapid.com/images/background-login.jpg

18.192.194.2

200 OK

132 kB

URL GET HTTP/1.1
mail.correos.18-192-194-2.cprapid.com/images/background-login.jpg
IP
18.192.194.2:443
ASN
#16509 AMAZON-02

Requested by
https://mail.correos.18-192-194-2.cprapid.com/
Certificate
IssuerLet's Encrypt
Subjectmail.correos.18-192-194-2.cprapid.com
Fingerprint0E:6E:F1:F8:71:A6:DA:54:B9:43:61:0A:25:7E:E2:73:7A:C8:18:C0
ValidityFri, 26 Apr 2024 11:53:48 GMT - Thu, 25 Jul 2024 11:53:47 GMT

File type
JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], progressive, precision 8, 1920x1080, components 3
Size
132 kB (132523 bytes)
Hash
2df8bb420f0519564f0357ddd4cdde33
d8cfbf388b17cc4906441b14dbf8b8143281d8a1
642875617fb72743a219e89d09dca1ebb4c226cf3549c85f5d29d498e5add3c8

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Correos
OpenPhish	phishing	Correos

HTTP Headers

GET /images/background-login.jpg HTTP/1.1
Host: mail.correos.18-192-194-2.cprapid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mail.correos.18-192-194-2.cprapid.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 27 Apr 2024 03:48:37 GMT
Server: Apache
Last-Modified: Wed, 09 Nov 2022 13:46:58 GMT
Accept-Ranges: bytes
Content-Length: 132523
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: image/jpeg

mail.correos.18-192-194-2.cprapid.com/fonts/CarteroLight.otf

18.192.194.2

200 OK

38 kB

URL GET HTTP/1.1
mail.correos.18-192-194-2.cprapid.com/fonts/CarteroLight.otf
IP
18.192.194.2:443
ASN
#16509 AMAZON-02

Requested by
https://mail.correos.18-192-194-2.cprapid.com/
Certificate
IssuerLet's Encrypt
Subjectmail.correos.18-192-194-2.cprapid.com
Fingerprint0E:6E:F1:F8:71:A6:DA:54:B9:43:61:0A:25:7E:E2:73:7A:C8:18:C0
ValidityFri, 26 Apr 2024 11:53:48 GMT - Thu, 25 Jul 2024 11:53:47 GMT

File type
OpenType font data
Size
38 kB (37868 bytes)
Hash
c28e01b87bac1f47b43d5a564877a0ec
86a203e4742d57e064e2fb1e9c238798bb709a2b
94ddea49ff5c70e8c9b9eeaf22d9ed72f96abd31f2a3124b222ab9bd1de64446

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Correos
OpenPhish	phishing	Correos

HTTP Headers

GET /fonts/CarteroLight.otf HTTP/1.1
Host: mail.correos.18-192-194-2.cprapid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mail.correos.18-192-194-2.cprapid.com/styles/main.css
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 27 Apr 2024 03:48:37 GMT
Server: Apache
Last-Modified: Fri, 04 Feb 2022 21:00:56 GMT
Accept-Ranges: bytes
Content-Length: 37868
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: font/otf

mail.correos.18-192-194-2.cprapid.com/images/pac.png

18.192.194.2

200 OK

98 kB

URL GET HTTP/1.1
mail.correos.18-192-194-2.cprapid.com/images/pac.png
IP
18.192.194.2:443
ASN
#16509 AMAZON-02

Requested by
https://mail.correos.18-192-194-2.cprapid.com/
Certificate
IssuerLet's Encrypt
Subjectmail.correos.18-192-194-2.cprapid.com
Fingerprint0E:6E:F1:F8:71:A6:DA:54:B9:43:61:0A:25:7E:E2:73:7A:C8:18:C0
ValidityFri, 26 Apr 2024 11:53:48 GMT - Thu, 25 Jul 2024 11:53:47 GMT

File type
PNG image data, 450 x 450, 8-bit/color RGBA, non-interlaced
Size
98 kB (98213 bytes)
Hash
622a5f8206ed7e2ebeed4d6addd265ab
ad1c0975920a6d54329957ccc92252bb4e4d6a17
0516986b26b3680d0c6bc2db5efdd48cbf55ddd4283cd8ea2108ebeec960dadc

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Correos
OpenPhish	phishing	Correos

HTTP Headers

GET /images/pac.png HTTP/1.1
Host: mail.correos.18-192-194-2.cprapid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mail.correos.18-192-194-2.cprapid.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 27 Apr 2024 03:48:37 GMT
Server: Apache
Last-Modified: Sun, 13 Nov 2022 07:12:08 GMT
Accept-Ranges: bytes
Content-Length: 98213
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: image/png

mail.correos.18-192-194-2.cprapid.com/images/favicon.ico

18.192.194.2

200 OK

110 kB

URL GET HTTP/1.1
mail.correos.18-192-194-2.cprapid.com/images/favicon.ico
IP
18.192.194.2:443
ASN
#16509 AMAZON-02

Requested by
https://mail.correos.18-192-194-2.cprapid.com/
Certificate
IssuerLet's Encrypt
Subjectmail.correos.18-192-194-2.cprapid.com
Fingerprint0E:6E:F1:F8:71:A6:DA:54:B9:43:61:0A:25:7E:E2:73:7A:C8:18:C0
ValidityFri, 26 Apr 2024 11:53:48 GMT - Thu, 25 Jul 2024 11:53:47 GMT

File type
MS Windows icon resource - 6 icons, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, -128x-128, 32 bits/pixel
Size
110 kB (110021 bytes)
Hash
349246ee336d8b2986e584a4fa436128
598b9f95458a2426bf1688d616c4f6f3fea3580e
68554c17c00a589c2b29e1f74ac5efbcd8d30252792626f5fff81955e4d89ae7

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Correos
OpenPhish	phishing	Correos

HTTP Headers

GET /images/favicon.ico HTTP/1.1
Host: mail.correos.18-192-194-2.cprapid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mail.correos.18-192-194-2.cprapid.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 27 Apr 2024 03:48:37 GMT
Server: Apache
Last-Modified: Tue, 08 Nov 2022 23:39:26 GMT
Accept-Ranges: bytes
Content-Length: 110021
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive
Content-Type: image/x-icon

aus5.mozilla.org/update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-102-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml

35.244.181.201

444 B

URL
aus5.mozilla.org/update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-102-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml
IP
35.244.181.201:0
ASN
#396982 GOOGLE-CLOUD-PLATFORM

File type
XML 1.0 document, ASCII text, with very long lines (332)
Size
444 B (444 bytes)
Hash
3b324dec137a87ef7e24a30a65b13dd0
c0faa95b2f1018e264b3a14aaf50d1003e6c27b3
6cd0b591d9239fc8564627e92a804fc261951b1cbaf5fa58a8ada3cc13f51463

HTTP Headers

GET /update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-102-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml HTTP/1.1
Host: aus5.mozilla.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Cache-Control: no-cache
Pragma: no-cache
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
rule-id: unknown
rule-data-version: unknown
content-signature: x5u=https://content-signature-2.cdn.mozilla.net/chains/aus.content-signature.mozilla.org-2024-06-09-11-51-10.chain; p384ecdsa=oKHA2QKLhgILuh3SqE--3M1dX10z-CZF4cms6IXhRLBLxlZwJqdx-ONRf_vWWDLusnOt5VoSeAd2E8-sFf0zgIoCprMD4oMftHytO319-KeDWyaHBDAUPl_VHJIZXUSK
strict-transport-security: max-age=31536000;
x-content-type-options: nosniff
content-security-policy: default-src 'none'; frame-ancestors 'none'
x-proxy-cache-status: MISS
content-encoding: gzip
via: 1.1 google
date: Sat, 27 Apr 2024 03:47:38 GMT
content-type: text/xml; charset=utf-8
vary: Accept-Encoding
content-length: 444
age: 77
cache-control: public,max-age=90
alt-svc: clear
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (1)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (19)

URL User Request GET HTTP/1.1

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

Certificate

File type

Size