crazy-diffie.68-64-160-26.plesk.page
Open in
urlscan Pro
68.64.160.26
Malicious Activity!
Public Scan
URL:
https://crazy-diffie.68-64-160-26.plesk.page/home/ch.html
Submission: On January 20 via api from JP — Scanned from JP
Submission: On January 20 via api from JP — Scanned from JP
Summary
This website contacted 3 IPs
in 1 countries
across 3 domains to perform 19 HTTP transactions.
The main IP is 68.64.160.26, located in
United States and
belongs to GTT-BACKBONE GTT, US.
The main domain is crazy-diffie.68-64-160-26.plesk.page.
TLS certificate: Issued by R3 on January 16th 2023. Valid for: 3 months.
This is the only time crazy-diffie.68-64-160-26.plesk.page was scanned on urlscan.io!
TLS certificate: Issued by R3 on January 16th 2023. Valid for: 3 months.
This is the only time crazy-diffie.68-64-160-26.plesk.page was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: UPS (Transportation)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 15 | 68.64.160.26 68.64.160.26 | 3257 (GTT-BACKB...) (GTT-BACKBONE GTT) | |
| 3 | 2620:1ec:4a::29 2620:1ec:4a::29 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
| 1 | 52.189.67.17 52.189.67.17 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
| 19 | 3 |
15
68.64.160.26
(United States)
ASN3257 (GTT-BACKBONE GTT, US)
PTR: custody-string.woodrevue.com
ASN3257 (GTT-BACKBONE GTT, US)
PTR: custody-string.woodrevue.com
| crazy-diffie.68-64-160-26.plesk.page |
3
2620:1ec:4a::29
(United States)
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
| media-us1.digital.nuance.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 15 |
plesk.page
crazy-diffie.68-64-160-26.plesk.page |
167 KB |
| 3 |
nuance.com
media-us1.digital.nuance.com — Cisco Umbrella Rank: 7278 |
340 KB |
| 1 |
inq.com
ups.inq.com — Cisco Umbrella Rank: 9000 |
584 B |
| 19 | 3 |
| Domain | Requested by | |
|---|---|---|
| 15 | crazy-diffie.68-64-160-26.plesk.page |
crazy-diffie.68-64-160-26.plesk.page
|
| 3 | media-us1.digital.nuance.com |
crazy-diffie.68-64-160-26.plesk.page
|
| 1 | ups.inq.com |
crazy-diffie.68-64-160-26.plesk.page
|
| 19 | 3 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| www.instagram.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| crazy-diffie.68-64-160-26.plesk.page R3 |
2023-01-16 - 2023-04-16 |
3 months | crt.sh |
| *.digital.nuance.com DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
2022-09-14 - 2023-10-12 |
a year | crt.sh |
| *.inq.com DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
2022-09-14 - 2023-10-12 |
a year | crt.sh |
This page contains 5 frames:
Primary Page:
https://crazy-diffie.68-64-160-26.plesk.page/home/ch.html
Frame ID: 7184FEBF45EA72F44B3365727C8C6D9B
Requests: 15 HTTP requests in this frame
Frame:
https://crazy-diffie.68-64-160-26.plesk.page/home/index_1.html
Frame ID: FCAE3AD7D6E0090FCE1D311DEED976DE
Requests: 1 HTTP requests in this frame
Frame:
https://crazy-diffie.68-64-160-26.plesk.page/home/index_2.html
Frame ID: 6471B8EA251A8BD15DBE6F62CB9C7EA2
Requests: 1 HTTP requests in this frame
Frame:
https://crazy-diffie.68-64-160-26.plesk.page/home/index_4.html
Frame ID: 4A3E5DDB6FFD018B4CFB58B3FCCD434C
Requests: 1 HTTP requests in this frame
Frame:
https://crazy-diffie.68-64-160-26.plesk.page/home/index_3.html
Frame ID: 5CBEED94C048628BD0126DFADE8D3F73
Requests: 1 HTTP requests in this frame
1 Outgoing links
These are links going to different origins than the main page.
URL: https://www.instagram.com/UPS_Canada
Title: InstagramOpen the link in a new window
Title: InstagramOpen the link in a new window
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
19 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
ch.html
crazy-diffie.68-64-160-26.plesk.page/home/ |
49 KB 9 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
ups.vendor.54f3c2d83b58.css
crazy-diffie.68-64-160-26.plesk.page/home/ |
130 KB 18 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
ups.styles.bf03bcac6bc2.css
crazy-diffie.68-64-160-26.plesk.page/home/ |
89 KB 13 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
ups.modules.0cca12c805a5.css
crazy-diffie.68-64-160-26.plesk.page/home/ |
697 KB 69 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
ups.widgets.6611168e8d14.css
crazy-diffie.68-64-160-26.plesk.page/home/ |
69 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
ups.apps-utrk.5ebbdd.css
crazy-diffie.68-64-160-26.plesk.page/home/ |
74 KB 10 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
UPS_logo.svg
crazy-diffie.68-64-160-26.plesk.page/home/ |
2 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
icp.gif
crazy-diffie.68-64-160-26.plesk.page/home/ |
808 B 808 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
styles.7d4255341a2c49ba8357.bundle.css
crazy-diffie.68-64-160-26.plesk.page/home/ |
259 B 290 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
index_1.html
crazy-diffie.68-64-160-26.plesk.page/home/ Frame FCAE |
167 B 269 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
InqFramework.js
media-us1.digital.nuance.com/media/launch/ci/ |
0 223 KB |
Other
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
pre-acif.js
ups.inq.com/tagserver/acif/ |
0 584 B |
Other
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
acif.js
media-us1.digital.nuance.com/media/launch/acif/ |
0 112 KB |
Other
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
acif-configs.js
media-us1.digital.nuance.com/media/sites/10005649/assets/automatons/ |
0 6 KB |
Other
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
055096b75efc91eabeb7fa0fb14e24cd44ba71f4
crazy-diffie.68-64-160-26.plesk.page/home/ |
34 KB 34 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
index_2.html
crazy-diffie.68-64-160-26.plesk.page/home/ Frame 6471 |
701 B 411 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
social.jpg
crazy-diffie.68-64-160-26.plesk.page/home/ |
808 B 808 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
index_4.html
crazy-diffie.68-64-160-26.plesk.page/home/ Frame 4A3E |
241 B 310 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
index_3.html
crazy-diffie.68-64-160-26.plesk.page/home/ Frame 5CBE |
327 B 333 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: UPS (Transportation)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 object| oncontentvisibilityautostatechange0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
crazy-diffie.68-64-160-26.plesk.page
media-us1.digital.nuance.com
ups.inq.com
2620:1ec:4a::29
52.189.67.17
68.64.160.26
0130f0f5a7d2a1791fa84865db5b7f9cdcac4b0a4fbe90fef182164b65c00343
076902752ae5748c9a6a128021d95a1bddf6aac70390b3d07f4ae941571350fe
2d9668f6f97ac0527e0635f052d73111bf1119d4671b22f99076d504bd195779
73ad7a607297658ab637afdf88985c364391ef2812a4a8b06ffa49c35b6448df
9653cc7c737d874e74d4529bf9da4f5906e068cfe7994aa2ae64e7fb537ed989
ae367b01f6899231a82020e3ed74a9345832f163fc754c2bfee56842af2087d5
b6f911ba8158fafaac0e01b5c737957f9a334697c5fd7d935a68795e9d9e1c00
b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187
c694ec1f7a48dd18d33f0750a9de65ae44859aa54a9db8e25e98d7bbb1ff14cf
dca987a6fdf97b97b04fbcc2bff586ecd7637ace53b2e4e1bc4ef737ba900670
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e94f926fe32bb1db75044f07af73ade28a728efe7b16fefdd59a064514cb1316
eab4d56ac0ee5cd6a9981c73fb48e653839c1bf33169656e0137224c4c54ffaa
ec42e263cd11890be5f6aad789249f1d74c91f3be4f0f072848cab423d22e44f
f94d2ab358987555c99e0be52f450293ed78850f6c78f305b22f8327c4bc617f