chezpyconline.xyz Open in urlscan Pro
185.221.182.241 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://chezpyconline.xyz/
Submission: On April 20 via api (April 20th 2024, 1:28:41 am UTC) from BE — Scanned from FR

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 6 IPs in 4 countries across 5 domains to perform 9 HTTP transactions. The main IP is 185.221.182.241, located in Paris, France and belongs to PLANETHOSTER-8, CA. The main domain is chezpyconline.xyz.
TLS certificate: Issued by R3 on April 12th 2024. Valid for: 3 months.

This is the only time chezpyconline.xyz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Fedex (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
4	185.221.182.241 185.221.182.241	53589 (PLANETHOS...) (PLANETHOSTER-8)
2	104.16.85.20 104.16.85.20	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:810::200a	15169 (GOOGLE) (GOOGLE)
1	2a04:4e42:400... 2a04:4e42:400::649	54113 (FASTLY) (FASTLY)
1	2a00:1450:400... 2a00:1450:4001:82b::2003	15169 (GOOGLE) (GOOGLE)
9	6

4 185.221.182.241 (Paris, France)

ASN53589 (PLANETHOSTER-8, CA)
PTR: node124-eu.n0c.com

chezpyconline.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.16.85.20 (None, )

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:810::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:400::649 (United States)

ASN54113 (FASTLY, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	chezpyconline.xyz chezpyconline.xyz	21 KB
2	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 320	46 KB
1	gstatic.com fonts.gstatic.com	48 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 767	31 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 33	2 KB
9	5

	Domain	Requested by
4	chezpyconline.xyz	chezpyconline.xyz
2	cdn.jsdelivr.net	chezpyconline.xyz
1	fonts.gstatic.com	fonts.googleapis.com
1	code.jquery.com	chezpyconline.xyz
1	fonts.googleapis.com	chezpyconline.xyz
9	5

This site contains no links.

Subject Issuer	Validity	Valid
chezpyconline.xyz R3	`2024-04-12` - `2024-07-11`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-05-02` - `2024-05-01`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2024-03-18` - `2024-06-10`	3 months	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2023-07-11` - `2024-07-14`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2024-03-18` - `2024-06-10`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://chezpyconline.xyz/
Frame ID: 27D163A0AFE10A627A11D65DF910AE0A
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Document

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

<link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
//cdn\.jsdelivr\.net/

Page Statistics

9
Requests

100 %
HTTPS

60 %
IPv6

5
Domains

5
Subdomains

6
IPs

4
Countries

148 kB
Transfer

455 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
chezpyconline.xyz/ 7 KB
2 KB 453ms
282ms Document
text/html 185.221.182.241
PLANETHOSTER-8

General

Check archive.org

Show headers Download Go to

Full URL: https://chezpyconline.xyz/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.221.182.241 Paris, France, ASN53589 (PLANETHOSTER-8, CA),
Reverse DNS: node124-eu.n0c.com
Software: LiteSpeed /
Resource Hash: 152dd9081bd5cf5a1f7fedcb2120a4de5869f20bfa4cdc9a0e073c558f0608e8

Request headers

Accept-Language: fr-FR,fr;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Sat, 20 Apr 2024 01:28:36 GMT
server: LiteSpeed
vary: Accept-Encoding
x-tuned-by: N0C
x-turbo-charged-by: LiteSpeed

GET
H3 200 bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@5.2.3/dist/css/ 190 KB
29 KB 102ms
57ms Stylesheet
text/css 104.16.85.20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap@5.2.3/dist/css/bootstrap.min.css

Requested by

Host: chezpyconline.xyz
URL: https://chezpyconline.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.85.20 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c0bcf7898fdc3b87babca678cd19a8e3ef570e931c80a3afbffcc453738c951a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://chezpyconline.xyz/
Origin: https://chezpyconline.xyz
Accept-Language: fr-FR,fr;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 20 Apr 2024 01:28:37 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 3232540
x-jsd-version: 5.2.3
content-encoding: br
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230122-FRA, cache-lga21962-LGA
x-jsd-version-type: version
server: cloudflare
etag: W/"2f955-d5HdHzFzoNYsw5wh0q1x/I2tDnI"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qCvv%2FPOG86CZXSXSk9gQFxn%2FO64thHXAOYR%2F8ART0OlRL7R0f91jRUDZrwNnlBsU72Uu5jK8xUtxOs3SeYRRs2IcTJeHxsVHus3WoJCNfFMwbi9mrdfK40vNPe4J5XW9mJg%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cf-ray: 87715bcfdb80694c-FRA

GET
H2 200 style.css
chezpyconline.xyz/css/ 160 B
152 B 63ms
61ms Stylesheet
text/css 185.221.182.241
PLANETHOSTER-8

General

Check archive.org

Show headers Download Go to

Full URL: https://chezpyconline.xyz/css/style.css
Requested by: Host: chezpyconline.xyz
URL: https://chezpyconline.xyz/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.221.182.241 Paris, France, ASN53589 (PLANETHOSTER-8, CA),
Reverse DNS: node124-eu.n0c.com
Software: Apache /
Resource Hash: 5a33848ec5decdaa04554373e62d7e980232be681f41474ed6dd581881661ff9

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://chezpyconline.xyz/
Accept-Language: fr-FR,fr;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 20 Apr 2024 01:28:37 GMT
content-encoding: br
last-modified: Tue, 12 Dec 2023 22:29:58 GMT
server: Apache
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 88

GET
H2 200 css2
fonts.googleapis.com/ 40 KB
2 KB 104ms
37ms Stylesheet
text/css 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Open+Sans:ital,wght@0,300;0,400;0,500;0,600;0,700;1,400;1,600&display=swap

Requested by

Host: chezpyconline.xyz
URL: https://chezpyconline.xyz/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

b417ab8f9b9eda1c443a6b96b9209bd8ceb3899ce74037f536be00b158619ed7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://chezpyconline.xyz/
Accept-Language: fr-FR,fr;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000
date: Sat, 20 Apr 2024 01:28:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sat, 20 Apr 2024 01:28:37 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 20 Apr 2024 01:28:37 GMT

GET
H2 200 logo.png
chezpyconline.xyz/img/ 18 KB
18 KB 61ms
60ms Image
image/png 185.221.182.241
PLANETHOSTER-8

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://chezpyconline.xyz/img/logo.png
Requested by: Host: chezpyconline.xyz
URL: https://chezpyconline.xyz/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.221.182.241 Paris, France, ASN53589 (PLANETHOSTER-8, CA),
Reverse DNS: node124-eu.n0c.com
Software: Apache /
Resource Hash: 99f7cd905d160e4bf4408195b22a893a45661a8855a0841e207d5bafe7411d90

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://chezpyconline.xyz/
Accept-Language: fr-FR,fr;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 20 Apr 2024 01:28:37 GMT
last-modified: Tue, 12 Dec 2023 22:29:59 GMT
server: Apache
accept-ranges: bytes
content-length: 17964
content-type: image/png

GET
H2 200 jquery-3.6.3.min.js Show response
code.jquery.com/ 88 KB
31 KB 64ms
17ms Script
application/javascript 2a04:4e42:400::649
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.6.3.min.js
Requested by: Host: chezpyconline.xyz
URL: https://chezpyconline.xyz/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:400::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: a6f3f0faea4b3d48e03176341bef0ed3151ffbf226d4c6635f1c6039c0500575

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://chezpyconline.xyz/
Origin: https://chezpyconline.xyz
Accept-Language: fr-FR,fr;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 20 Apr 2024 01:28:37 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
age: 1020244
x-cache: HIT, HIT
content-length: 31046
x-served-by: cache-lga13623-LGA, cache-lcy-eglc8600087-LCY
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
server: nginx
x-timer: S1713576517.090985,VS0,VE0
etag: W/"28feccc0-15f5b"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=604800
accept-ranges: bytes
x-cache-hits: 17, 43167

GET
H3 200 bootstrap.min.js Show response
cdn.jsdelivr.net/npm/bootstrap@5.2.3/dist/js/ 59 KB
17 KB 64ms
34ms Script
application/javascript 104.16.85.20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap@5.2.3/dist/js/bootstrap.min.js

Requested by

Host: chezpyconline.xyz
URL: https://chezpyconline.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.85.20 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9bcd4d0f29dc6556ebeeff44eaa0965f0c7f7308ee58394708cce2f698cca1b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://chezpyconline.xyz/
Origin: https://chezpyconline.xyz
Accept-Language: fr-FR,fr;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 20 Apr 2024 01:28:37 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 1991501
x-jsd-version: 5.2.3
content-encoding: br
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-etou8220128-FRA, cache-lga21952-LGA
x-jsd-version-type: version
server: cloudflare
etag: W/"ebf4-hH3/iZtbz47kNOOJ4qkQuh26128"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6L5pQy8gqu%2B34V6sw5CjKeNDJ0OJawzzJnWjrh3sxnVHJGo4sI1Rk2xkJcCRH4Ynnk2PlH3%2FTpobOxQX1OoTYLMxu%2B2qgIMsa%2Bdt0Fd3vCNwvCqex7QapuN9qCXXT7ejK2U%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cf-ray: 87715bcfdb81694c-FRA

GET
DATA 200
OK truncated
/ 183 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d8c89b0459ec4d6069037002ff5d824395ff37dbf866bc4298fce22d336b182a

Request headers

Accept-Language: fr-FR,fr;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v40/ 47 KB
48 KB 93ms
26ms Font
font/woff2 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Open+Sans:ital,wght@0,300;0,400;0,500;0,600;0,700;1,400;1,600&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://fonts.googleapis.com/
Origin: https://chezpyconline.xyz
Accept-Language: fr-FR,fr;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 00:50:53 GMT
x-content-type-options: nosniff
age: 347864
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 48236
x-xss-protection: 0
last-modified: Thu, 14 Dec 2023 02:08:40 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 16 Apr 2025 00:50:53 GMT

GET
H2 200 favicon.ico
chezpyconline.xyz/img/ 5 KB
813 B 33ms
32ms Other
image/vnd.microsoft.icon 185.221.182.241
PLANETHOSTER-8

General

Check archive.org

Show headers Download Go to

Full URL: https://chezpyconline.xyz/img/favicon.ico
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.221.182.241 Paris, France, ASN53589 (PLANETHOSTER-8, CA),
Reverse DNS: node124-eu.n0c.com
Software: Apache /
Resource Hash: eab1b9a0ef942d84e3a8ed8c3e3996acb7a46af9a0b9f914ced662bcbe0e54be

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://chezpyconline.xyz/
Accept-Language: fr-FR,fr;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 20 Apr 2024 01:28:37 GMT
content-encoding: br
last-modified: Tue, 12 Dec 2023 22:29:59 GMT
server: Apache
vary: Accept-Encoding
content-type: image/vnd.microsoft.icon
accept-ranges: bytes
content-length: 763

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Fedex (Transportation)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery number| uidEvent object| bootstrap

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.jsdelivr.net
chezpyconline.xyz
code.jquery.com
fonts.googleapis.com
fonts.gstatic.com
104.16.85.20
185.221.182.241
2a00:1450:4001:810::200a
2a00:1450:4001:82b::2003
2a04:4e42:400::649
152dd9081bd5cf5a1f7fedcb2120a4de5869f20bfa4cdc9a0e073c558f0608e8
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa
5a33848ec5decdaa04554373e62d7e980232be681f41474ed6dd581881661ff9
99f7cd905d160e4bf4408195b22a893a45661a8855a0841e207d5bafe7411d90
9bcd4d0f29dc6556ebeeff44eaa0965f0c7f7308ee58394708cce2f698cca1b0
a6f3f0faea4b3d48e03176341bef0ed3151ffbf226d4c6635f1c6039c0500575
b417ab8f9b9eda1c443a6b96b9209bd8ceb3899ce74037f536be00b158619ed7
c0bcf7898fdc3b87babca678cd19a8e3ef570e931c80a3afbffcc453738c951a
d8c89b0459ec4d6069037002ff5d824395ff37dbf866bc4298fce22d336b182a
eab1b9a0ef942d84e3a8ed8c3e3996acb7a46af9a0b9f914ced662bcbe0e54be

chezpyconline.xyz Open in urlscan Pro 185.221.182.241 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

9 Requests

100 %HTTPS

60 %IPv6

5 Domains

5 Subdomains

6 IPs

4 Countries

148 kBTransfer

455 kBSize

0 Cookies

0 Outgoing links

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

0 Cookies

Indicators

chezpyconline.xyz Open in urlscan Pro
185.221.182.241 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

100 %
HTTPS

60 %
IPv6

5
Domains

5
Subdomains

6
IPs

4
Countries

148 kB
Transfer

455 kB
Size

0
Cookies

9 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!