ulop.jqweykwu.top - urlscan.io

Summary

This website contacted 1 IPs in 1 countries across 2 domains to perform 7 HTTP transactions. The main IP is 2606:4700:3034::ac43:8552, located in United States and belongs to CLOUDFLARENET, US. The main domain is ulop.jqweykwu.top.
TLS certificate: Issued by WE1 on August 18th 2024. Valid for: 3 months.

This is the only time ulop.jqweykwu.top was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: USPS (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2606:4700:10:... 2606:4700:10::6816:e8	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	2606:4700:303... 2606:4700:3034::ac43:8552	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	1

1 2606:4700:10::6816:e8 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

cutt.ly	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2606:4700:3034::ac43:8552 (United States)

ASN13335 (CLOUDFLARENET, US)

ulop.jqweykwu.top	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	jqweykwu.top ulop.jqweykwu.top	21 KB
1	cutt.ly 1 redirects cutt.ly — Cisco Umbrella Rank: 43283	414 B
7	2

	Domain	Requested by
7	ulop.jqweykwu.top	ulop.jqweykwu.top
1	cutt.ly	1 redirects
7	2

This site contains no links.

Subject Issuer	Validity	Valid
jqweykwu.top WE1	`2024-08-18` - `2024-11-16`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://ulop.jqweykwu.top/?notebook=27&airplane=2m1l&sun=60ea44a3f53c7ab6can1
Frame ID: 8A82683D24F52F295A5A8401704478BA
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Loading

Page URL History Show full URLs

https://cutt.ly/LeYqvS0Q?qVL=yxTPCrhwCV HTTP 301
https://ulop.jqweykwu.top/?notebook=27&airplane=2m1l&sun=60ea44a3f53c7ab6can1 Page URL

Page Statistics

7
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

1
IPs

1
Countries

21 kB
Transfer

66 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://cutt.ly/LeYqvS0Q?qVL=yxTPCrhwCV HTTP 301
https://ulop.jqweykwu.top/?notebook=27&airplane=2m1l&sun=60ea44a3f53c7ab6can1 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response ulop.jqweykwu.top/ Redirect Chain https://cutt.ly/LeYqvS0Q?qVL=yxTPCrhwCV https://ulop.jqweykwu.top/?notebook=27&airplane=2m1l&sun=60ea44a3f53c7ab6can1	25 KB 6 KB	1633ms 941ms	Document text/html	2606:4700:3034::ac43:8552 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ulop.jqweykwu.top/?notebook=27&airplane=2m1l&sun=60ea44a3f53c7ab6can1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3034::ac43:8552 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / ASP.NET Resource Hash `60cd772aa35e1572dace65100b97305505658de22ee2a8ff71e6b7bc28904946` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Response headers cache-control private cf-cache-status DYNAMIC cf-ray 8c9a04b6bdfc1968-FRA content-encoding br content-type text/html; charset=utf-8 date Fri, 27 Sep 2024 08:10:39 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cQEFtAB5RHzzr%2BuB9dZjAH5mZIeznHBrvmCzqYgxnFVK%2F62SG6ML2anjT0%2BhX27t54d7Vbp4rqtElANZfrQDNpkdvrnYbLtjemJsenlWzmCJs5YsUCSpFct3gn2ARweBkOw%2Fy3eF%2F27t37JNZS9yzg%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare speculation-rules "/cdn-cgi/speculation" vary Accept-Encoding x-aspnet-version 4.0.30319 x-aspnetmvc-version 5.2 x-powered-by ASP.NET Redirect headers cache-control no-cache, no-store, must-revalidate cf-cache-status DYNAMIC cf-ray 8c9a04b19f293a52-FRA content-type text/html; charset=UTF-8 date Fri, 27 Sep 2024 08:10:37 GMT expires Thu, 19 Nov 1981 08:52:00 GMT location https://ulop.jqweykwu.top/?notebook=27&airplane=2m1l&sun=60ea44a3f53c7ab6can1 pragma no-cache referrer-policy same-origin server cloudflare strict-transport-security max-age=15552000; includeSubDomains; preload x-content-type-options nosniff x-frame-options SAMEORIGIN x-xss-protection 1; mode=block
GET H2	200	speculation ulop.jqweykwu.top/cdn-cgi/	128 B 475 B	19ms 18ms	Other application/speculationrules+json	2606:4700:3034::ac43:8552 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ulop.jqweykwu.top/cdn-cgi/speculation Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3034::ac43:8552 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `11a2142988720cd49ff000e5d488493947b3d34821301c5a706b3495b8381f7d` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://ulop.jqweykwu.top Referer https://ulop.jqweykwu.top/?notebook=27&airplane=2m1l&sun=60ea44a3f53c7ab6can1 Response headers nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RM4d3Z36t6pq3LzPQ1yckPGFiieoUNT5TW3uTokex%2Fxf3pM8FxcvmVqOrTcygdGheaa4z7iKWUEIZ5kmvKRJCOFGsY8Ur%2FM7Ag8kH%2B5oxrCNxfZHcigzZhiPohYsVQ7peBIRd0d4i16FqBLgmTUTUA%3D%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8c9a04bcad631968-FRA access-control-allow-origin https://ulop.jqweykwu.top content-length 128 date Fri, 27 Sep 2024 08:10:39 GMT content-type application/speculationrules+json vary Origin, Accept-Encoding server cloudflare
GET H2	200	i4vQHh-dnR8eCEk0.svg ulop.jqweykwu.top/bbbc1/dyUlZn5lIypeYXNeJF40LypfbiRkKiV-Z/GN4cyNjY25nQ/CQlbC9tYiE0IXppaUAlJGV8c15eKkBjfHxqK/	546 B 579 B	764ms 764ms	Image image/svg+xml	2606:4700:3034::ac43:8552 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://ulop.jqweykwu.top/bbbc1/dyUlZn5lIypeYXNeJF40LypfbiRkKiV-Z/GN4cyNjY25nQ/CQlbC9tYiE0IXppaUAlJGV8c15eKkBjfHxqK/i4vQHh-dnR8eCEk0.svg Requested by Host: ulop.jqweykwu.top URL: https://ulop.jqweykwu.top/?notebook=27&airplane=2m1l&sun=60ea44a3f53c7ab6can1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3034::ac43:8552 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / ASP.NET Resource Hash `b95f434286744e3dbaf5bc56f41d4ce2640da3038461502f7ac243a5931e9435` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://ulop.jqweykwu.top/?notebook=27&airplane=2m1l&sun=60ea44a3f53c7ab6can1 Response headers cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding br cf-cache-status MISS etag W/"c8bd85fb53a4da1:0" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=97mdqoJAA8kVx6UpiX5ibAXUoNwZTS34dGqZbTNTkWbDQE40I%2FIdkxIsKE6ca6psNLlQ%2Bw3HQRnAJhjUmCU3yZJmVpPfJwi3N%2F%2Fh6xMhb%2Fnjsi7j7qN79WBPkvlGusCMo%2BsyKcThiaZjryJ8N4A0Zg%3D%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8c9a04bcad681968-FRA date Fri, 27 Sep 2024 08:10:40 GMT content-type image/svg+xml last-modified Sun, 12 May 2024 10:05:56 GMT x-powered-by ASP.NET server cloudflare vary Accept-Encoding
GET H2	200	i4vQHh-dnR8eCEk0.svg ulop.jqweykwu.top/bbbc1/dyUlZn5lIypeYXNeJF41LypfbiRkKiV-Z/GN4cyNjY25nQ/CQlbC9tYiE0IXppaUAlJGV8c15eKkBjfHxqK/	2 KB 1 KB	901ms 901ms	Image image/svg+xml	2606:4700:3034::ac43:8552 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://ulop.jqweykwu.top/bbbc1/dyUlZn5lIypeYXNeJF41LypfbiRkKiV-Z/GN4cyNjY25nQ/CQlbC9tYiE0IXppaUAlJGV8c15eKkBjfHxqK/i4vQHh-dnR8eCEk0.svg Requested by Host: ulop.jqweykwu.top URL: https://ulop.jqweykwu.top/?notebook=27&airplane=2m1l&sun=60ea44a3f53c7ab6can1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3034::ac43:8552 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / ASP.NET Resource Hash `9685d6241f41ac71741d0ee9b242779f640cd3b1e64bb9bbcfb8798c5be503b2` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://ulop.jqweykwu.top/?notebook=27&airplane=2m1l&sun=60ea44a3f53c7ab6can1 Response headers cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding br cf-cache-status MISS etag W/"ade485fb53a4da1:0" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qvJBPM6r0siT9vvo20AkQoaGAxlo4SJYt8IBXe%2Fu9kL3AowlplOKHFHn7h5RtEZjWeMX96%2BT%2FZQW38Jri3MY0X8Jh9r3MJbNDkuQB%2FxcUyDxk4Zp3F39KYYT%2F%2FgJ9Unyy6k5QoWcxYcKeaExpOCuog%3D%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8c9a04bccd961968-FRA date Fri, 27 Sep 2024 08:10:40 GMT content-type image/svg+xml last-modified Sun, 12 May 2024 10:05:56 GMT x-powered-by ASP.NET server cloudflare vary Accept-Encoding
GET H2	200	58fGR8c19-ai8kbA2.svg ulop.jqweykwu.top/bbbc1/bWMqeGcybl4hQCVAJGRjJSRebiF2JX/QvYyFzZipefm/UuKmUjaS8jYiVAJSpjKl54c0B6XmkkfHd4YX/	1 KB 1 KB	763ms 763ms	Image image/svg+xml	2606:4700:3034::ac43:8552 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://ulop.jqweykwu.top/bbbc1/bWMqeGcybl4hQCVAJGRjJSRebiF2JX/QvYyFzZipefm/UuKmUjaS8jYiVAJSpjKl54c0B6XmkkfHd4YX/58fGR8c19-ai8kbA2.svg Requested by Host: ulop.jqweykwu.top URL: https://ulop.jqweykwu.top/?notebook=27&airplane=2m1l&sun=60ea44a3f53c7ab6can1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3034::ac43:8552 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / ASP.NET Resource Hash `c8b13b10e28b6b420151db578831a416b7c1805d7672eeb57e69dc697fda1e27` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://ulop.jqweykwu.top/?notebook=27&airplane=2m1l&sun=60ea44a3f53c7ab6can1 Response headers cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding br cf-cache-status MISS etag W/"697583fb53a4da1:0" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hRYOwJvXPd2Rl89XLMxHtR6AnfwnbTeVm2ZwEoOVLnrKXgN8eS9JLQ0aJMy%2FDf9GP%2FVaPvlYy6H3m0X%2FPjPCGiiuGOaTB6LvdEmtoT4G5wtycYeDdIU66KIp8CUdGoc951tcwC0TI4L4iuoOKGjiNQ%3D%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8c9a04bcad691968-FRA date Fri, 27 Sep 2024 08:10:40 GMT content-type image/svg+xml last-modified Sun, 12 May 2024 10:05:56 GMT x-powered-by ASP.NET server cloudflare vary Accept-Encoding
GET H2	200	WxkQEBuYSp8c14xQA2.png ulop.jqweykwu.top/bbbc1/akBeIyQkfjl-fnQjeDd8JGMqfmRlaUAjJS4hXipzM3g/jYy93YiVHXnh/8JCoqIXoleiVeJDQlISNpZ3AvQGNqbmZ-bnhpY2NjISovbV98KmUhY/	5 KB 6 KB	780ms 780ms	Image image/png	2606:4700:3034::ac43:8552 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://ulop.jqweykwu.top/bbbc1/akBeIyQkfjl-fnQjeDd8JGMqfmRlaUAjJS4hXipzM3g/jYy93YiVHXnh/8JCoqIXoleiVeJDQlISNpZ3AvQGNqbmZ-bnhpY2NjISovbV98KmUhY/WxkQEBuYSp8c14xQA2.png Requested by Host: ulop.jqweykwu.top URL: https://ulop.jqweykwu.top/?notebook=27&airplane=2m1l&sun=60ea44a3f53c7ab6can1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3034::ac43:8552 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / ASP.NET Resource Hash `1cc43a97be92fddf0fe4244858f5337c80a8d350cd0afcd0c4d2004d3fded0ab` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://ulop.jqweykwu.top/?notebook=27&airplane=2m1l&sun=60ea44a3f53c7ab6can1 Response headers cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-cache-status MISS etag "617db2162a4da1:0" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HWjUcJtUlyHPYZfhVzlNcClHOUtA8iauD31YUrIpO1lYZL%2BWZ7%2FiR0Cgmho4tdSzzWAPO2cWQfoJILi%2BxwBZ4bQTPmWCJAS21srmrMp1d53M8lHLEKow0uRLN09msZ9pe%2Bzc%2BBIyPHRmTrklMIJv7Q%3D%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8c9a04bccd941968-FRA accept-ranges bytes content-length 5390 date Fri, 27 Sep 2024 08:10:40 GMT content-type image/png last-modified Sun, 12 May 2024 11:47:14 GMT x-powered-by ASP.NET server cloudflare vary Accept-Encoding
GET H2	200	favicon.ico ulop.jqweykwu.top/	31 KB 6 KB	1140ms 1140ms	Other image/x-icon	2606:4700:3034::ac43:8552 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ulop.jqweykwu.top/favicon.ico Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3034::ac43:8552 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / ASP.NET Resource Hash `67fbe8ef9020e5c776aadf6801a1fef8dc563e2e4dc9ddc740af8010c0c38943` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://ulop.jqweykwu.top/?notebook=27&airplane=2m1l&sun=60ea44a3f53c7ab6can1 Response headers cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding br cf-cache-status MISS etag W/"8d495b9e8623da1:0" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=149Q98Hr%2FDBRnHtwld3Y1dBwRiXt24mto9hH45zT2a4KrxfAIU7RxeoXWVDEWDP2uODhjagcAoKGvZwE%2F%2FlpB0fcXokaK9IIMe5q1SLaRL06UBw7xk7bwbeKnzcezLmepN4p1DRCFSJkcIAqEajGJA%3D%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8c9a04c27c651968-FRA date Fri, 27 Sep 2024 08:10:41 GMT content-type image/x-icon last-modified Thu, 30 Nov 2023 12:13:25 GMT x-powered-by ASP.NET server cloudflare vary Accept-Encoding

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: USPS (Transportation)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			cutt.ly/	1969-12-31 23:59:59	Name: PHPSESSID Value: ku3qaqlfurr8cgue878eoq50mh
			ulop.jqweykwu.top/	1969-12-31 23:59:59	Name: ASP.NET_SessionId Value: k1vfblo3qhyslcr53a5mkkj2

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cutt.ly
ulop.jqweykwu.top
2606:4700:10::6816:e8
2606:4700:3034::ac43:8552
11a2142988720cd49ff000e5d488493947b3d34821301c5a706b3495b8381f7d
1cc43a97be92fddf0fe4244858f5337c80a8d350cd0afcd0c4d2004d3fded0ab
60cd772aa35e1572dace65100b97305505658de22ee2a8ff71e6b7bc28904946
67fbe8ef9020e5c776aadf6801a1fef8dc563e2e4dc9ddc740af8010c0c38943
9685d6241f41ac71741d0ee9b242779f640cd3b1e64bb9bbcfb8798c5be503b2
b95f434286744e3dbaf5bc56f41d4ce2640da3038461502f7ac243a5931e9435
c8b13b10e28b6b420151db578831a416b7c1805d7672eeb57e69dc697fda1e27

ulop.jqweykwu.top Open in urlscan Pro 2606:4700:3034::ac43:8552 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

7 Requests

100 %HTTPS

100 %IPv6

2 Domains

2 Subdomains

1 IPs

1 Countries

21 kBTransfer

66 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

2 Cookies

Indicators

ulop.jqweykwu.top Open in urlscan Pro
2606:4700:3034::ac43:8552 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

1
IPs

1
Countries

21 kB
Transfer

66 kB
Size

2
Cookies

7 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!