89-43-107-162.cprapid.com Open in urlscan Pro
89.43.107.162 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://levents.ca/as/3274-Parcel-Reschedule-UPS-Canada
Effective URL:
https://89-43-107-162.cprapid.com/ups-ca/en/gb/
Submission: On September 10 via manual (September 10th 2021, 3:17:43 pm UTC) from CA — Scanned from DE

Summary HTTP 10 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 10 HTTP transactions. The main IP is 89.43.107.162, located in Frankfurt am Main, Germany and belongs to GCORE, LU. The main domain is 89-43-107-162.cprapid.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on August 30th 2021. Valid for: 3 months.

This is the only time 89-43-107-162.cprapid.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: UPS (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
1	45.114.225.170 45.114.225.170	13768 (COGECO-PEER1) (COGECO-PEER1)
8	89.43.107.162 89.43.107.162	199524 (GCORE) (GCORE)
10	3

1 45.114.225.170 (Canada)

ASN13768 (COGECO-PEER1, CA)
PTR: lehpy351.hostpapavps.net

levents.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 89.43.107.162 (Frankfurt am Main, Germany)

ASN199524 (GCORE, LU)
PTR: aboelanwar2581.example.com

89-43-107-162.cprapid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	cprapid.com 89-43-107-162.cprapid.com	1 MB
1	levents.ca levents.ca	245 B
0	waust.at Failed waust.at Failed
10	3

	Domain	Requested by
8	89-43-107-162.cprapid.com	levents.ca 89-43-107-162.cprapid.com
1	levents.ca
0	waust.at Failed	89-43-107-162.cprapid.com
10	3

This site contains no links.

Subject Issuer	Validity	Valid
*.levents.ca R3	`2021-08-04` - `2021-11-02`	3 months	crt.sh
89-43-107-162.cprapid.com cPanel, Inc. Certification Authority	`2021-08-30` - `2021-11-28`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://89-43-107-162.cprapid.com/ups-ca/en/gb/
Frame ID: F34732F5665027322EDE7377AC82F639
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Follow My Parcel | UPS - Canada

Page URL History Show full URLs

https://levents.ca/as/3274-Parcel-Reschedule-UPS-Canada Page URL
https://89-43-107-162.cprapid.com/ups-ca/en/gb/ Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

10
Requests

90 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

1221 kB
Transfer

1219 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://levents.ca/as/3274-Parcel-Reschedule-UPS-Canada Page URL
https://89-43-107-162.cprapid.com/ups-ca/en/gb/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	404	3274-Parcel-Reschedule-UPS-Canada Show response levents.ca/as/	209 B 245 B	5844ms 104ms	Document text/html	45.114.225.170 COGECO-PEER1
General Check archive.org Show headers Download Go to Full URL https://levents.ca/as/3274-Parcel-Reschedule-UPS-Canada Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.114.225.170 , Canada, ASN13768 (COGECO-PEER1, CA), Reverse DNS lehpy351.hostpapavps.net Software Apache / Resource Hash `92fc4df5c3c762967be5c71d851fc04c085a2f8bdbdd700c4064fdfb0362df31` Request headers :method GET :authority levents.ca :scheme https :path /as/3274-Parcel-Reschedule-UPS-Canada pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 accept-language de-DE,de;q=0.9 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers date Fri, 10 Sep 2021 15:17:32 GMT server Apache last-modified Thu, 09 Sep 2021 20:23:33 GMT accept-ranges bytes vary Accept-Encoding content-encoding br content-length 131 content-type text/html
GET H/1.1	200 OK	Primary Request Cookie set / Show response 89-43-107-162.cprapid.com/ups-ca/en/gb/	34 KB 34 KB	5767ms 88ms	Document text/html	89.43.107.162 GCORE
General Check archive.org Show headers Download Go to Full URL https://89-43-107-162.cprapid.com/ups-ca/en/gb/ Requested by Host: levents.ca URL: https://levents.ca/as/3274-Parcel-Reschedule-UPS-Canada Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 89.43.107.162 Frankfurt am Main, Germany, ASN199524 (GCORE, LU), Reverse DNS aboelanwar2581.example.com Software Apache / Resource Hash `c34af9f7fddcf50903e7ba1e342c9b722ca03bb1760e0e778beead04feac1e57` Request headers Host 89-43-107-162.cprapid.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Accept-Language de-DE,de;q=0.9 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Sec-Fetch-Dest document Referer https://levents.ca/ Accept-Encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://levents.ca/ Response headers Date Fri, 10 Sep 2021 15:17:38 GMT Server Apache Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate Pragma no-cache Set-Cookie PHPSESSID=95efa60fb4e053c803a691cb34c99119; path=/ Keep-Alive timeout=5, max=100 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	ups_004.css 89-43-107-162.cprapid.com/ups-ca/en/gb/assets/	133 KB 133 KB	95ms 59ms	Stylesheet text/css	89.43.107.162 GCORE
General Check archive.org Show headers Download Go to Full URL https://89-43-107-162.cprapid.com/ups-ca/en/gb/assets/ups_004.css Requested by Host: 89-43-107-162.cprapid.com URL: https://89-43-107-162.cprapid.com/ups-ca/en/gb/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 89.43.107.162 Frankfurt am Main, Germany, ASN199524 (GCORE, LU), Reverse DNS aboelanwar2581.example.com Software Apache / Resource Hash `f69212c8dda9c7b958d463b414eb08a681de0ddebe7b7f5d222c33c6861bacaa` Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host 89-43-107-162.cprapid.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Sec-Fetch-Mode no-cors Accept text/css,/;q=0.1 Cache-Control no-cache Sec-Fetch-Dest style Referer https://89-43-107-162.cprapid.com/ups-ca/en/gb/ Cookie PHPSESSID=95efa60fb4e053c803a691cb34c99119 Connection keep-alive Accept-Language de-DE,de;q=0.9 Referer https://89-43-107-162.cprapid.com/ups-ca/en/gb/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers Pragma no-cache Date Fri, 10 Sep 2021 15:17:38 GMT Last-Modified Wed, 03 Feb 2021 02:58:04 GMT Server Apache Content-Type text/css Cache-Control no-cache, no-store, must-revalidate Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 135910 Expires 0
GET H/1.1	200 OK	ups.css 89-43-107-162.cprapid.com/ups-ca/en/gb/assets/	203 KB 203 KB	128ms 42ms	Stylesheet text/css	89.43.107.162 GCORE
General Check archive.org Show headers Download Go to Full URL https://89-43-107-162.cprapid.com/ups-ca/en/gb/assets/ups.css Requested by Host: 89-43-107-162.cprapid.com URL: https://89-43-107-162.cprapid.com/ups-ca/en/gb/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 89.43.107.162 Frankfurt am Main, Germany, ASN199524 (GCORE, LU), Reverse DNS aboelanwar2581.example.com Software Apache / Resource Hash `10a1815b356f850e04c8bdec04edf534b4df1ce29b38cb75f0538f90fa75afb0` Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host 89-43-107-162.cprapid.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Sec-Fetch-Mode no-cors Accept text/css,/;q=0.1 Cache-Control no-cache Sec-Fetch-Dest style Referer https://89-43-107-162.cprapid.com/ups-ca/en/gb/ Cookie PHPSESSID=95efa60fb4e053c803a691cb34c99119 Connection keep-alive Accept-Language de-DE,de;q=0.9 Referer https://89-43-107-162.cprapid.com/ups-ca/en/gb/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers Pragma no-cache Date Fri, 10 Sep 2021 15:17:38 GMT Last-Modified Sat, 06 Feb 2021 23:45:38 GMT Server Apache Content-Type text/css Cache-Control no-cache, no-store, must-revalidate Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 207494 Expires 0
GET H/1.1	200 OK	ups_002.css 89-43-107-162.cprapid.com/ups-ca/en/gb/assets/	648 KB 649 KB	135ms 45ms	Stylesheet text/css	89.43.107.162 GCORE
General Check archive.org Show headers Download Go to Full URL https://89-43-107-162.cprapid.com/ups-ca/en/gb/assets/ups_002.css Requested by Host: 89-43-107-162.cprapid.com URL: https://89-43-107-162.cprapid.com/ups-ca/en/gb/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 89.43.107.162 Frankfurt am Main, Germany, ASN199524 (GCORE, LU), Reverse DNS aboelanwar2581.example.com Software Apache / Resource Hash `5655a8d691a31bf46ffb807e09321a6084857d6aa67f4ef6656b687b5fac0996` Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host 89-43-107-162.cprapid.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Sec-Fetch-Mode no-cors Accept text/css,/;q=0.1 Cache-Control no-cache Sec-Fetch-Dest style Referer https://89-43-107-162.cprapid.com/ups-ca/en/gb/ Cookie PHPSESSID=95efa60fb4e053c803a691cb34c99119 Connection keep-alive Accept-Language de-DE,de;q=0.9 Referer https://89-43-107-162.cprapid.com/ups-ca/en/gb/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers Pragma no-cache Date Fri, 10 Sep 2021 15:17:38 GMT Last-Modified Sat, 06 Feb 2021 23:46:46 GMT Server Apache Content-Type text/css Cache-Control no-cache, no-store, must-revalidate Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 663928 Expires 0
GET H/1.1	200 OK	ups_003.css 89-43-107-162.cprapid.com/ups-ca/en/gb/assets/	68 KB 68 KB	174ms 59ms	Stylesheet text/css	89.43.107.162 GCORE
General Check archive.org Show headers Download Go to Full URL https://89-43-107-162.cprapid.com/ups-ca/en/gb/assets/ups_003.css Requested by Host: 89-43-107-162.cprapid.com URL: https://89-43-107-162.cprapid.com/ups-ca/en/gb/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 89.43.107.162 Frankfurt am Main, Germany, ASN199524 (GCORE, LU), Reverse DNS aboelanwar2581.example.com Software Apache / Resource Hash `1e020fdc4c2189607c5f90806564a6b12a6a24d20bf586f964965244b62ef8d3` Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host 89-43-107-162.cprapid.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Sec-Fetch-Mode no-cors Accept text/css,/;q=0.1 Cache-Control no-cache Sec-Fetch-Dest style Referer https://89-43-107-162.cprapid.com/ups-ca/en/gb/ Cookie PHPSESSID=95efa60fb4e053c803a691cb34c99119 Connection keep-alive Accept-Language de-DE,de;q=0.9 Referer https://89-43-107-162.cprapid.com/ups-ca/en/gb/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers Pragma no-cache Date Fri, 10 Sep 2021 15:17:38 GMT Last-Modified Sat, 06 Feb 2021 23:46:42 GMT Server Apache Content-Type text/css Cache-Control no-cache, no-store, must-revalidate Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 69646 Expires 0
GET H/1.1	200 OK	UPS_logo.svg 89-43-107-162.cprapid.com/ups-ca/en/gb/assets/	2 KB 2 KB	189ms 63ms	Image image/svg+xml	89.43.107.162 GCORE
General Check archive.org Show headers Download Go to Show image Full URL https://89-43-107-162.cprapid.com/ups-ca/en/gb/assets/UPS_logo.svg Requested by Host: 89-43-107-162.cprapid.com URL: https://89-43-107-162.cprapid.com/ups-ca/en/gb/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 89.43.107.162 Frankfurt am Main, Germany, ASN199524 (GCORE, LU), Reverse DNS aboelanwar2581.example.com Software Apache / Resource Hash `b6f911ba8158fafaac0e01b5c737957f9a334697c5fd7d935a68795e9d9e1c00` Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host 89-43-107-162.cprapid.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Sec-Fetch-Mode no-cors Accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 Cache-Control* no-cache Sec-Fetch-Dest image Referer https://89-43-107-162.cprapid.com/ups-ca/en/gb/ Cookie PHPSESSID=95efa60fb4e053c803a691cb34c99119 Connection keep-alive Accept-Language de-DE,de;q=0.9 Referer https://89-43-107-162.cprapid.com/ups-ca/en/gb/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers Pragma no-cache Date Fri, 10 Sep 2021 15:17:38 GMT Last-Modified Wed, 03 Feb 2021 02:58:04 GMT Server Apache Content-Type image/svg+xml Cache-Control no-cache, no-store, must-revalidate Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 2160 Expires 0
GET H/1.1	200 OK	jquery-3.5.1.min.js Show response 89-43-107-162.cprapid.com/ups-ca/en/gb/assets/	87 KB 88 KB	154ms 64ms	Script application/javascript	89.43.107.162 GCORE
General Check archive.org Show headers Download Go to Full URL https://89-43-107-162.cprapid.com/ups-ca/en/gb/assets/jquery-3.5.1.min.js Requested by Host: 89-43-107-162.cprapid.com URL: https://89-43-107-162.cprapid.com/ups-ca/en/gb/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 89.43.107.162 Frankfurt am Main, Germany, ASN199524 (GCORE, LU), Reverse DNS aboelanwar2581.example.com Software Apache / Resource Hash `f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d` Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host 89-43-107-162.cprapid.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Sec-Fetch-Mode no-cors Accept / Cache-Control no-cache Sec-Fetch-Dest script Referer https://89-43-107-162.cprapid.com/ups-ca/en/gb/ Cookie PHPSESSID=95efa60fb4e053c803a691cb34c99119 Connection keep-alive Accept-Language de-DE,de;q=0.9 Referer https://89-43-107-162.cprapid.com/ups-ca/en/gb/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers Pragma no-cache Date Fri, 10 Sep 2021 15:17:38 GMT Last-Modified Sat, 26 Sep 2020 01:01:42 GMT Server Apache Content-Type application/javascript Cache-Control no-cache, no-store, must-revalidate Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 89476 Expires 0
GET		d.js waust.at/	0 0

GET H/1.1	404 Not Found	social.jpg 89-43-107-162.cprapid.com/ups-ca/en/gb/assets/	10 KB 10 KB	46ms 46ms	Image text/html	89.43.107.162 GCORE
General Check archive.org Show headers Download Go to Show image Full URL https://89-43-107-162.cprapid.com/ups-ca/en/gb/assets/social.jpg Requested by Host: 89-43-107-162.cprapid.com URL: https://89-43-107-162.cprapid.com/ups-ca/en/gb/assets/ups_002.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 89.43.107.162 Frankfurt am Main, Germany, ASN199524 (GCORE, LU), Reverse DNS aboelanwar2581.example.com Software Apache / Resource Hash `b7d983078f6872ce0ff62ef1fd84bb8187a510bb7c93e1d8a873282b89f7dc34` Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host 89-43-107-162.cprapid.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Sec-Fetch-Mode no-cors Accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 Cache-Control* no-cache Sec-Fetch-Dest image Referer https://89-43-107-162.cprapid.com/ups-ca/en/gb/assets/ups_002.css Cookie PHPSESSID=95efa60fb4e053c803a691cb34c99119 Connection keep-alive Accept-Language de-DE,de;q=0.9 Referer https://89-43-107-162.cprapid.com/ups-ca/en/gb/assets/ups_002.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers Pragma no-cache Date Fri, 10 Sep 2021 15:17:39 GMT Server Apache Transfer-Encoding chunked Content-Type text/html Cache-Control no-cache, no-store, must-revalidate Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Expires 0
GET DATA	200 OK	truncated /	33 KB 33 KB		Font application/x-font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `a9a72111b2c9ad844638140ba430e0fe363e557adf8c48b0249dec84edaf65eb` Request headers Referer Origin https://89-43-107-162.cprapid.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers Content-Type application/x-font-woff;charset=utf-8

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: waust.at
URL: https://waust.at/d.js

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: UPS (Transportation)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			89-43-107-162.cprapid.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 95efa60fb4e053c803a691cb34c99119

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://levents.ca/as/3274-Parcel-Reschedule-UPS-Canada Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://89-43-107-162.cprapid.com/ups-ca/en/gb/assets/social.jpg Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

89-43-107-162.cprapid.com
levents.ca
waust.at
waust.at
45.114.225.170
89.43.107.162
10a1815b356f850e04c8bdec04edf534b4df1ce29b38cb75f0538f90fa75afb0
1e020fdc4c2189607c5f90806564a6b12a6a24d20bf586f964965244b62ef8d3
5655a8d691a31bf46ffb807e09321a6084857d6aa67f4ef6656b687b5fac0996
92fc4df5c3c762967be5c71d851fc04c085a2f8bdbdd700c4064fdfb0362df31
a9a72111b2c9ad844638140ba430e0fe363e557adf8c48b0249dec84edaf65eb
b6f911ba8158fafaac0e01b5c737957f9a334697c5fd7d935a68795e9d9e1c00
b7d983078f6872ce0ff62ef1fd84bb8187a510bb7c93e1d8a873282b89f7dc34
c34af9f7fddcf50903e7ba1e342c9b722ca03bb1760e0e778beead04feac1e57
f69212c8dda9c7b958d463b414eb08a681de0ddebe7b7f5d222c33c6861bacaa
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

89-43-107-162.cprapid.com Open in urlscan Pro 89.43.107.162 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

10 Requests

90 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

1221 kBTransfer

1219 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

8 JavaScript Global Variables

1 Cookies

2 Console Messages

Indicators

89-43-107-162.cprapid.com Open in urlscan Pro
89.43.107.162 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

90 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

1221 kB
Transfer

1219 kB
Size

1
Cookies

10 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!