ups-uk.com Open in urlscan Pro
2606:4700:3034::6815:c29 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://ups-uk.com/
Effective URL:
https://ups-uk.com/
Submission: On June 25 via api (June 25th 2024, 9:55:34 am UTC) from GB — Scanned from GB

Summary HTTP 14 Redirects Links 12 Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 3 domains to perform 14 HTTP transactions. The main IP is 2606:4700:3034::6815:c29, located in United States and belongs to CLOUDFLARENET, US. The main domain is ups-uk.com.
TLS certificate: Issued by WE1 on June 23rd 2024. Valid for: 3 months.

This is the only time ups-uk.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: UPS (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
10	2606:4700:303... 2606:4700:3034::6815:c29	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	38.114.100.52 38.114.100.52	398343 (BAXET-GROUP) (BAXET-GROUP)
2	2a02:26f0:710... 2a02:26f0:7100:8ae::353a	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
14	4

10 2606:4700:3034::6815:c29 (United States)

ASN13335 (CLOUDFLARENET, US)

ups-uk.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 38.114.100.52 (Dallas, United States)

ASN398343 (BAXET-GROUP, US)

ca-admin.enterpriseservers.cc	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:7100:8ae::353a (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

www.ups.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	ups-uk.com ups-uk.com	677 KB
2	ups.com www.ups.com — Cisco Umbrella Rank: 8735	2 KB
2	enterpriseservers.cc ca-admin.enterpriseservers.cc	358 B
14	3

	Domain	Requested by
10	ups-uk.com	ups-uk.com
2	www.ups.com
2	ca-admin.enterpriseservers.cc	ups-uk.com
14	3

This site contains links to these domains. Also see Links.

Domain
www.ups.com
about.ups.com
www.jobs-ups.com
www.facebook.com
twitter.com
www.linkedin.com
www.youtube.com

Subject Issuer	Validity	Valid
ups-uk.com WE1	`2024-06-23` - `2024-09-21`	3 months	crt.sh
ca-admin.enterpriseservers.cc R10	`2024-06-15` - `2024-09-13`	3 months	crt.sh
www.ups.com COMODO ECC Organization Validation Secure Server CA	`2024-03-14` - `2025-03-14`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://ups-uk.com/
Frame ID: DEA794C8205B20D85003C8B6A4EC6A88
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://ups-uk.com/ HTTP 307
https://ups-uk.com/ Page URL

Detected technologies

Vue.js (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

<[^>]+\sdata-v(?:ue)?-

Page Statistics

14
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

716 kB
Transfer

2075 kB
Size

0
Cookies

12 Outgoing links

These are links going to different origins than the main page.

URL: https://www.ups.com/gb/en/Home.page

Search URL Search Domain Scan URL

URL: https://www.ups.com/lasso/logout?returnto=https%3A%2F%2Fwww.ups.com%2Fship%3Floc%3Den_GB
Title: Log Out

Search URL Search Domain Scan URL

URL: https://www.ups.com/track?loc=en_GB
Title: Tracking

Search URL Search Domain Scan URL

URL: https://www.ups.com/ship?loc=en_GB
Title: Shipping

Search URL Search Domain Scan URL

URL: https://www.ups.com/marketingpreferences/emailsubscription?loc=en_GB
Title: Communication Preferences

Search URL Search Domain Scan URL

URL: https://about.ups.com/be/en/home.html
Title: About UPSOpen the link in a new window

Search URL Search Domain Scan URL

URL: https://www.ups.com/us/en/supplychain/Home.page
Title: Supply Chain SolutionsOpen the link in a new window

Search URL Search Domain Scan URL

URL: https://www.jobs-ups.com/location
Title: UPS JobsOpen the link in a new window

Search URL Search Domain Scan URL

URL: https://www.facebook.com/ups.uk
Title: FacebookOpen the link in a new window

Search URL Search Domain Scan URL

URL: https://twitter.com/UPS_UK
Title: TwitterOpen the link in a new window

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/ups
Title: LinkedInOpen the link in a new window

Search URL Search Domain Scan URL

URL: https://www.youtube.com/ups
Title: YouTubeOpen the link in a new window

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://ups-uk.com/ HTTP 307
https://ups-uk.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
ups-uk.com/
Redirect Chain

http://ups-uk.com/
https://ups-uk.com/

397 B
663 B

389ms
248ms

Document
text/html

2606:4700:3034::6815:c29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ups-uk.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::6815:c29 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6f97d657b526a4c1496b6fa25ed0194c1a384d92767a189500d81af82b691d1b

Request headers

Accept-Language: en-GB,en;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 14) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.64 Mobile Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8994150accd452cc-LHR
content-encoding: br
content-type: text/html
date: Tue, 25 Jun 2024 09:55:29 GMT
last-modified: Sun, 23 Jun 2024 08:45:19 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xY1BjRvGXXmZcFr7cKN%2B1ZjF1ENz%2FwcxvZ1tOZBCCuN1onEVeAAwqhRFYXtR3MLC%2FaxdECpOnqWQ2b3aWlBd6Y5jfwwVsj96RoKwbaXWw2psEJyrTZja5Igg8LInio%2FOoNLBGDE1AQhh"}],"group":"cf-nel","max_age":604800}
server: cloudflare

Redirect headers

Location: https://ups-uk.com/
Non-Authoritative-Reason: HttpsUpgrades

GET
H2 200 index-2ec26a23.js Show response
ups-uk.com/assets/ 214 KB
84 KB 381ms
379ms Script
application/javascript 2606:4700:3034::6815:c29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ups-uk.com/assets/index-2ec26a23.js
Requested by: Host: ups-uk.com
URL: https://ups-uk.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::6815:c29 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 87d33edbc0e50f674a4eaf8d1d83834570eb10cd7df1e158ba0e69dc8d2d83a9

Request headers

Referer: https://ups-uk.com/
Origin: https://ups-uk.com
Accept-Language: en-GB,en;q=0.9;q=0.9
User-Agent: Mozilla/5.0 (Linux; Android 14) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.64 Mobile Safari/537.36

Response headers

date: Tue, 25 Jun 2024 09:55:29 GMT
content-encoding: gzip
cf-cache-status: EXPIRED
last-modified: Sun, 23 Jun 2024 08:45:24 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"6677e0a4-35808"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GlgdpBqgth%2BxFTfjEAxUeb9aJn3o0rf3GbCI3c3nI%2FmaX%2B87qjKXi8RuIIPVQsGQDSMNim0k1U1ELkTBuCzpAYWcc0o89PLp3x9XAqVxyh%2FCAIW7lqa6BmENoC8wsqhX2i2vsPah%2B91H"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=43200
cf-ray: 8994150cbec352cc-LHR
alt-svc: h3=":443"; ma=86400
expires: Tue, 25 Jun 2024 21:55:29 GMT

GET
H2 200 index-35436e4a.css
ups-uk.com/assets/ 1 MB
312 KB 361ms
361ms Stylesheet
text/css 2606:4700:3034::6815:c29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ups-uk.com/assets/index-35436e4a.css
Requested by: Host: ups-uk.com
URL: https://ups-uk.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::6815:c29 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 35436e4afde77f06406e4a71971c633e6ec5239b60b890a665e9915167e22802

Request headers

Accept-Language: en-GB,en;q=0.9;q=0.9
Referer: https://ups-uk.com/
User-Agent: Mozilla/5.0 (Linux; Android 14) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.64 Mobile Safari/537.36

Response headers

date: Tue, 25 Jun 2024 09:55:29 GMT
content-encoding: gzip
cf-cache-status: MISS
last-modified: Sun, 23 Jun 2024 08:45:27 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"6677e0a7-174bda"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=G7o3kV7FSd1%2FObHvatROyKNyGSh3IvdOxBEiWHv30%2FNpd529DZUoK%2BuFrctmyvrqy%2B7Kxy4BOCv8ym4hL68HgxF8YWb0ML%2FjwRUnr%2BR3AgGnxQ%2B8DF6Uj%2BHJjTOdK9834lVuChhnZDGN"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=43200
cf-ray: 8994150cbec252cc-LHR
alt-svc: h3=":443"; ma=86400
expires: Tue, 25 Jun 2024 21:55:29 GMT

POST
H2 200 token Show response
ca-admin.enterpriseservers.cc/api/v2/ 48 B
358 B 429ms
429ms XHR
application/json 38.114.100.52
BAXET-GROUP

General

Check archive.org

Show headers Download Go to

Full URL

https://ca-admin.enterpriseservers.cc/api/v2/token

Requested by

Host: ups-uk.com
URL: https://ups-uk.com/assets/index-2ec26a23.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

38.114.100.52 Dallas, United States, ASN398343 (BAXET-GROUP, US),

Reverse DNS

Software

Tengine /

Resource Hash

aa6c26646f144b97bf476917a2ffe7c63cbb2312b37ed2897690169d466c9c7e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept: application/json, text/plain, */*
Referer: https://ups-uk.com/
Accept-Language: en-GB,en;q=0.9;q=0.9
User-Agent: Mozilla/5.0 (Linux; Android 14) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.64 Mobile Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 25 Jun 2024 09:55:31 GMT
strict-transport-security: max-age=31536000
content-encoding: gzip
server: Tengine
access-control-max-age: 3600
vary: Accept-Encoding
access-control-allow-methods: *
content-type: application/json; charset=utf-8
access-control-allow-origin: https://ups-uk.com
access-control-allow-credentials: true

GET
H2 200 index-d727d9ba.js Show response
ups-uk.com/assets/ 9 KB
3 KB 271ms
271ms Script
application/javascript 2606:4700:3034::6815:c29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ups-uk.com/assets/index-d727d9ba.js
Requested by: Host: ups-uk.com
URL: https://ups-uk.com/assets/index-2ec26a23.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::6815:c29 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fed9a4f45ab43d1a559f2c97e84c558e94243cfce349657ae429d326b0d31a96

Request headers

Referer
Origin: https://ups-uk.com
Accept-Language: en-GB,en;q=0.9;q=0.9
User-Agent: Mozilla/5.0 (Linux; Android 14) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.64 Mobile Safari/537.36

Response headers

date: Tue, 25 Jun 2024 09:55:30 GMT
content-encoding: gzip
cf-cache-status: EXPIRED
last-modified: Sun, 23 Jun 2024 08:45:28 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"6677e0a8-254c"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YJeIRMz6jb0orgldngCFBZbvbUA6rFPala8IevvB7e6lJvZ8ULbC30oknWEGgA20qiGDHyuZjz6NUSbq%2FbIBZftWiktZA3DDLA2TmgjmK0XRuEb26cZIJPINQjZ0t6N8tAvK94emtjIQ"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=43200
cf-ray: 899415115b4852cc-LHR
alt-svc: h3=":443"; ma=86400
expires: Tue, 25 Jun 2024 21:55:30 GMT

GET
H2 200 loading-18e7b504.js Show response
ups-uk.com/assets/ 55 B
422 B 246ms
246ms Script
application/javascript 2606:4700:3034::6815:c29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ups-uk.com/assets/loading-18e7b504.js
Requested by: Host: ups-uk.com
URL: https://ups-uk.com/assets/index-2ec26a23.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::6815:c29 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a5c5048fe8510624b8f578ff9fe53e3bee825960b418bdff72e7f2911dc0d275

Request headers

Referer
Origin: https://ups-uk.com
Accept-Language: en-GB,en;q=0.9;q=0.9
User-Agent: Mozilla/5.0 (Linux; Android 14) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.64 Mobile Safari/537.36

Response headers

date: Tue, 25 Jun 2024 09:55:30 GMT
content-encoding: br
cf-cache-status: EXPIRED
last-modified: Sun, 23 Jun 2024 08:45:30 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"6677e0aa-37"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gbP7gKSz36LKYA0ChdEJ5OzdejwxfU7%2B1MFcBmjZ6w1jEFCOpsH8izuGhvGQvDarl2guPwkUDKiQQjw8OFN%2BVeMTuJK%2Bfa5Hesj%2FuaJHKG4dq%2Buhn2JDfbNFzfW2Up%2BlXNdwaR%2F32hZc"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=43200
cf-ray: 899415115b4d52cc-LHR
alt-svc: h3=":443"; ma=86400
expires: Tue, 25 Jun 2024 21:55:30 GMT

OPTIONS
H2 200 token
ca-admin.enterpriseservers.cc/api/v2/ 0
0 588ms
238ms Preflight
application/octet-stream 38.114.100.52
BAXET-GROUP

General

Check archive.org

Show headers Download Go to

Full URL

https://ca-admin.enterpriseservers.cc/api/v2/token

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

38.114.100.52 Dallas, United States, ASN398343 (BAXET-GROUP, US),

Reverse DNS

Software

Tengine /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://ups-uk.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Linux; Android 14) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.64 Mobile Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: *
access-control-allow-origin: https://ups-uk.com
access-control-max-age: 3600
content-length: 0
content-type: application/octet-stream
date: Tue, 25 Jun 2024 09:55:30 GMT
server: Tengine
strict-transport-security: max-age=31536000

GET
H2 404 favicon.ico
ups-uk.com/ 57 KB
43 KB 383ms
382ms Other
text/html 2606:4700:3034::6815:c29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ups-uk.com/favicon.ico
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::6815:c29 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dc676cc52046a252ee86c463e49bce5b517c932ab100f21cb62e231cb3d7ed7a

Request headers

Accept-Language: en-GB,en;q=0.9;q=0.9
Referer: https://ups-uk.com/
User-Agent: Mozilla/5.0 (Linux; Android 14) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.64 Mobile Safari/537.36

Response headers

date: Tue, 25 Jun 2024 09:55:30 GMT
content-encoding: br
cf-cache-status: EXPIRED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sHEFKWLBDe2NvoNu2wQ6t3B8%2BAyw5SH7yqvYgjd69h100NHzkImdfH5SBaxsx25qVrVG9AMOy04RZV8CEvIDFwg%2FnRkEgjcJcabscTgYgwtmAHHCb0ZsXrYqGj3AG5yfGIA%2BkhesZjEE"}],"group":"cf-nel","max_age":604800}
content-type: text/html
cache-control: max-age=14400
cf-ray: 89941511cba452cc-LHR
alt-svc: h3=":443"; ma=86400

GET
H2 200 UPS_logo.svg
www.ups.com/assets/resources/images/ 2 KB
1 KB 287ms
87ms Image
image/svg+xml 2a02:26f0:7100:8ae::353a
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.ups.com/assets/resources/images/UPS_logo.svg

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:7100:8ae::353a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Akamai Resource Optimizer /

Resource Hash

a416370f6f98339e7edf9fe2c70a45bf9cfba93c0520921db47d15c27934ba88

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-GB,en;q=0.9;q=0.9
Referer: https://ups-uk.com/
User-Agent: Mozilla/5.0 (Linux; Android 14) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.64 Mobile Safari/537.36

Response headers

date: Tue, 25 Jun 2024 09:55:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1719309331319_34603383_57469986_138_12772_27_45_219";dur=1
content-length: 1086
x-xss-protection: 1; mode=block
pragma: no-cache
referrer-policy: same-origin
last-modified: Mon, 24 Jun 2024 14:04:51 GMT
server: Akamai Resource Optimizer
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
expires: Tue, 25 Jun 2024 09:55:31 GMT

GET
H2 200 loading-05eb7451.jpg
ups-uk.com/assets/ 80 KB
49 KB 356ms
356ms Image
image/jpeg 2606:4700:3034::6815:c29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ups-uk.com/assets/loading-05eb7451.jpg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::6815:c29 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 05eb745176d79ec27d52d544582483fc4d0f6378c7ed2060be24dfc4e8990668

Request headers

Accept-Language: en-GB,en;q=0.9;q=0.9
Referer: https://ups-uk.com/
User-Agent: Mozilla/5.0 (Linux; Android 14) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.64 Mobile Safari/537.36

Response headers

date: Tue, 25 Jun 2024 09:55:31 GMT
content-encoding: gzip
cf-cache-status: EXPIRED
last-modified: Sun, 23 Jun 2024 08:45:29 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"6677e0a9-13ea4"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ME9VwGLvC1nLui5bqObWOu%2BC3kCGsAYt9yPpcst0h2EdWRhz4jBDjzFQRZFk5VfgAwvZeLzRf%2BRGon24Eotsch65uYn9CIMO3gH2oqgX%2FGW07nI3anpjzXA22EyiltQ8wP6j%2FwYwh0ko"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000
cf-ray: 89941517ca0b52cc-LHR
alt-svc: h3=":443"; ma=86400
expires: Thu, 25 Jul 2024 09:55:31 GMT

GET
H2 200 icp.gif
www.ups.com/img/ 43 B
437 B 287ms
88ms Image
image/gif 2a02:26f0:7100:8ae::353a
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.ups.com/img/icp.gif

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:7100:8ae::353a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Apache /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-GB,en;q=0.9;q=0.9
Referer: https://ups-uk.com/
User-Agent: Mozilla/5.0 (Linux; Android 14) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.64 Mobile Safari/537.36

Response headers

pragma: no-cache
date: Tue, 25 Jun 2024 09:55:31 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
referrer-policy: same-origin
x-content-type-options: nosniff
last-modified: Wed, 29 Apr 2015 19:29:01 GMT
server: Apache
x-frame-options: SAMEORIGIN
content-type: image/gif
cache-control: no-cache
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1719309331398_34603383_57469987_138_12666_27_45_146";dur=1
accept-ranges: bytes
content-length: 43
x-xss-protection: 1; mode=block
expires: Tue, 25 Jun 2024 09:55:31 GMT

GET
H2 404 social-icons-2022.png
ups-uk.com/assets/resources/images/ 1 KB
1 KB 498ms
498ms Image
text/html 2606:4700:3034::6815:c29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ups-uk.com/assets/resources/images/social-icons-2022.png
Requested by: Host: ups-uk.com
URL: https://ups-uk.com/assets/index-35436e4a.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::6815:c29 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0a7817fc8a6141b0476f14fc6699cfeeacdaf9495a56a7fec3ed0edfcf83c26a

Request headers

Accept-Language: en-GB,en;q=0.9;q=0.9
Referer: https://ups-uk.com/assets/index-35436e4a.css
User-Agent: Mozilla/5.0 (Linux; Android 14) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.64 Mobile Safari/537.36

Response headers

date: Tue, 25 Jun 2024 09:55:31 GMT
content-encoding: br
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=R4l0aJ2wAqJxe%2BbYlt%2Fa5vypcWDQL44H19SifL1UR59CPIPr9bWwaPh7dKgFp4nyltTXjxWbcMlQSlmt69gCt5pf3bqTC59QKkezFv05bQn708t1ecnDlm1dimQxe2MbEA3H%2BS1caUl%2F"}],"group":"cf-nel","max_age":604800}
content-type: text/html
cache-control: max-age=14400
cf-ray: 89941517ca1352cc-LHR
alt-svc: h3=":443"; ma=86400

GET
DATA 200
OK truncated
/ 37 KB
37 KB Font
application/x-font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 548c30fa341ffe448e2caecb863e084fefef2eec0742fc742b220a8fb603384c

Request headers

Referer
Origin: https://ups-uk.com
Accept-Language: en-GB,en;q=0.9;q=0.9
User-Agent: Mozilla/5.0 (Linux; Android 14) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.64 Mobile Safari/537.36

Response headers

Content-Type: application/x-font-woff;charset=utf-8

GET
H2 200 Roboto-Regular.woff
ups-uk.com/assets/resources/styles/fonts/ 92 KB
92 KB 467ms
467ms Font
font/woff 2606:4700:3034::6815:c29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ups-uk.com/assets/resources/styles/fonts/Roboto-Regular.woff
Requested by: Host: ups-uk.com
URL: https://ups-uk.com/assets/index-35436e4a.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::6815:c29 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c511a38838f14cd23a3e2a7c7c9b7f2864a2a6b9e548053bb71b432a677966e2

Request headers

Referer: https://ups-uk.com/assets/index-35436e4a.css
Origin: https://ups-uk.com
Accept-Language: en-GB,en;q=0.9;q=0.9
User-Agent: Mozilla/5.0 (Linux; Android 14) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.64 Mobile Safari/537.36

Response headers

date: Tue, 25 Jun 2024 09:55:31 GMT
cf-cache-status: MISS
last-modified: Sun, 23 Jun 2024 08:46:49 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "6677e0f9-16e58"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RMq4BAPhjzaBulJeG9KyHf6kPtgrmePMSvNEkVtxWvq8592qTqE0HVLrcXXdvoAjBgKCQJAXM31jttKORPbteXwUJ1LJsYsIub5DUz%2BtRyBViaXnVpSV9aSSQjYvgOpi40ta2VasMzWZ"}],"group":"cf-nel","max_age":604800}
content-type: font/woff
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 89941517ea2c52cc-LHR
alt-svc: h3=":443"; ma=86400
content-length: 93784

GET
H2 200 Roboto-Medium.woff
ups-uk.com/assets/resources/styles/fonts/ 92 KB
93 KB 492ms
491ms Font
font/woff 2606:4700:3034::6815:c29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ups-uk.com/assets/resources/styles/fonts/Roboto-Medium.woff
Requested by: Host: ups-uk.com
URL: https://ups-uk.com/assets/index-35436e4a.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::6815:c29 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4f543ad26c42709ef00a1921f7dd1aa27a1930a354ecb353196665e43dac3706

Request headers

Referer: https://ups-uk.com/assets/index-35436e4a.css
Origin: https://ups-uk.com
Accept-Language: en-GB,en;q=0.9;q=0.9
User-Agent: Mozilla/5.0 (Linux; Android 14) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.64 Mobile Safari/537.36

Response headers

date: Tue, 25 Jun 2024 09:55:31 GMT
cf-cache-status: EXPIRED
last-modified: Sun, 23 Jun 2024 08:46:47 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "6677e0f7-1709c"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Tet1LDsU7CZ790olt3WVQ0FjucDamDN85y5%2BKmK3GTlN3Zv3mlbhY1XmOo5lEmhIYeUbD24azB3lzDBeciZrbTb%2FZ4Yieva5dqJKxfN6D2Kepc3W2%2BuE9k6ZgYL%2FTXPcluKjX%2F8%2F7mWR"}],"group":"cf-nel","max_age":604800}
content-type: font/woff
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 89941517ea3652cc-LHR
alt-svc: h3=":443"; ma=86400
content-length: 94364

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: UPS (Transportation)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://ups-uk.com/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://ups-uk.com/assets/resources/images/social-icons-2022.png Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ca-admin.enterpriseservers.cc
ups-uk.com
www.ups.com
2606:4700:3034::6815:c29
2a02:26f0:7100:8ae::353a
38.114.100.52
05eb745176d79ec27d52d544582483fc4d0f6378c7ed2060be24dfc4e8990668
0a7817fc8a6141b0476f14fc6699cfeeacdaf9495a56a7fec3ed0edfcf83c26a
35436e4afde77f06406e4a71971c633e6ec5239b60b890a665e9915167e22802
4f543ad26c42709ef00a1921f7dd1aa27a1930a354ecb353196665e43dac3706
548c30fa341ffe448e2caecb863e084fefef2eec0742fc742b220a8fb603384c
6f97d657b526a4c1496b6fa25ed0194c1a384d92767a189500d81af82b691d1b
87d33edbc0e50f674a4eaf8d1d83834570eb10cd7df1e158ba0e69dc8d2d83a9
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a416370f6f98339e7edf9fe2c70a45bf9cfba93c0520921db47d15c27934ba88
a5c5048fe8510624b8f578ff9fe53e3bee825960b418bdff72e7f2911dc0d275
aa6c26646f144b97bf476917a2ffe7c63cbb2312b37ed2897690169d466c9c7e
c511a38838f14cd23a3e2a7c7c9b7f2864a2a6b9e548053bb71b432a677966e2
dc676cc52046a252ee86c463e49bce5b517c932ab100f21cb62e231cb3d7ed7a
fed9a4f45ab43d1a559f2c97e84c558e94243cfce349657ae429d326b0d31a96

ups-uk.com Open in urlscan Pro 2606:4700:3034::6815:c29 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

14 Requests

100 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

4 IPs

2 Countries

716 kBTransfer

2075 kBSize

0 Cookies

12 Outgoing links

Page URL History

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

10 JavaScript Global Variables

0 Cookies

2 Console Messages

Indicators

ups-uk.com Open in urlscan Pro
2606:4700:3034::6815:c29 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

716 kB
Transfer

2075 kB
Size

0
Cookies

14 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!