p2.87-121-47-199.cprapid.com Open in urlscan Pro
87.121.47.199 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://p2.87-121-47-199.cprapid.com/
Submission: On July 29 via automatic, source phishtank (July 29th 2023, 10:23:44 am UTC) — Scanned from DE

Summary HTTP 16 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 3 domains to perform 16 HTTP transactions. The main IP is 87.121.47.199, located in Bulgaria and belongs to . The main domain is p2.87-121-47-199.cprapid.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on July 20th 2023. Valid for: 3 months.

This is the only time p2.87-121-47-199.cprapid.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Poste Italiane (Online)

Domain & IP information

	IP Address	AS Autonomous System
9	87.121.47.199 87.121.47.199	46308 () ()
1	2a02:6ea0:c70... 2a02:6ea0:c700::19	60068 (CDN77 ^_^) (CDN77 ^_^)
1	18.184.49.126 18.184.49.126	16509 (AMAZON-02) (AMAZON-02)
5	2a02:6ea0:c70... 2a02:6ea0:c700::10	60068 (CDN77 ^_^) (CDN77 ^_^)
16	4

9 87.121.47.199 (Bulgaria)

ASN46308 ()

p2.87-121-47-199.cprapid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:6ea0:c700::19 (Frankfurt am Main, Germany)

ASN60068 (CDN77 ^_^, GB)

www.smartsuppchat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.184.49.126 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-184-49-126.eu-central-1.compute.amazonaws.com

bootstrap.smartsuppchat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a02:6ea0:c700::10 (Frankfurt am Main, Germany)

ASN60068 (CDN77 ^_^, GB)

widget-v3.smartsuppcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
translations.smartsuppcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	cprapid.com p2.87-121-47-199.cprapid.com	554 KB
5	smartsuppcdn.com widget-v3.smartsuppcdn.com — Cisco Umbrella Rank: 58610 translations.smartsuppcdn.com — Cisco Umbrella Rank: 61197	87 KB
2	smartsuppchat.com www.smartsuppchat.com — Cisco Umbrella Rank: 55891 bootstrap.smartsuppchat.com — Cisco Umbrella Rank: 50753	7 KB
16	3

	Domain	Requested by
9	p2.87-121-47-199.cprapid.com	p2.87-121-47-199.cprapid.com
4	widget-v3.smartsuppcdn.com	www.smartsuppchat.com
1	translations.smartsuppcdn.com	widget-v3.smartsuppcdn.com
1	bootstrap.smartsuppchat.com	www.smartsuppchat.com
1	www.smartsuppchat.com	p2.87-121-47-199.cprapid.com
16	5

This site contains no links.

Subject Issuer	Validity	Valid
p2.87-121-47-199.cprapid.com cPanel, Inc. Certification Authority	`2023-07-20` - `2023-10-18`	3 months	crt.sh
*.smartsuppchat.com RapidSSL Global TLS RSA4096 SHA256 2022 CA1	`2022-11-30` - `2023-12-29`	a year	crt.sh
*.smartsuppcdn.com RapidSSL Global TLS RSA4096 SHA256 2022 CA1	`2022-10-19` - `2023-11-19`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://p2.87-121-47-199.cprapid.com/
Frame ID: D7572B8DF977087D5740E6E70B0A45C2
Requests: 12 HTTP requests in this frame

Frame: https://widget-v3.smartsuppcdn.com/assets/main-8c985b09.js
Frame ID: D6E5ED55F9A37D1596FDD847C0288DCC
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Accedi

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

16
Requests

100 %
HTTPS

50 %
IPv6

3
Domains

5
Subdomains

4
IPs

2
Countries

648 kB
Transfer

841 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response p2.87-121-47-199.cprapid.com/	6 KB 7 KB	776ms 386ms	Document text/html	87.121.47.199
General Check archive.org Show headers Download Go to Full URL https://p2.87-121-47-199.cprapid.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 87.121.47.199 , Bulgaria, ASN46308 (), Reverse DNS Software Apache / Resource Hash `8bb3d9c7732fea4af7c9e2dd895d14091859b48ee8bb6fc8eba724b27907a0a0` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Sat, 29 Jul 2023 10:23:38 GMT Keep-Alive timeout=5, max=100 Server Apache Transfer-Encoding chunked
GET H/1.1	200 OK	bootstrap.min.css p2.87-121-47-199.cprapid.com/css/	119 KB 120 KB	268ms 267ms	Stylesheet text/css	87.121.47.199
General Check archive.org Show headers Download Go to Full URL https://p2.87-121-47-199.cprapid.com/css/bootstrap.min.css Requested by Host: p2.87-121-47-199.cprapid.com URL: https://p2.87-121-47-199.cprapid.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 87.121.47.199 , Bulgaria, ASN46308 (), Reverse DNS Software Apache / Resource Hash `8b922a249c9f81562d99eee24407bf38c7feac74a10dfe712292c0b032144dfa` Request headers accept-language de-DE,de;q=0.9 Referer https://p2.87-121-47-199.cprapid.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers Date Sat, 29 Jul 2023 10:23:39 GMT Last-Modified Sun, 22 Nov 2020 13:41:24 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 122291
GET H/1.1	200 OK	css.css p2.87-121-47-199.cprapid.com/css/	206 KB 206 KB	98ms 33ms	Stylesheet text/css	87.121.47.199
General Check archive.org Show headers Download Go to Full URL https://p2.87-121-47-199.cprapid.com/css/css.css Requested by Host: p2.87-121-47-199.cprapid.com URL: https://p2.87-121-47-199.cprapid.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 87.121.47.199 , Bulgaria, ASN46308 (), Reverse DNS Software Apache / Resource Hash `6cfde476dffc41c1ba2f4a228f1f2be0052d7f67093674264506377577e4cd09` Request headers accept-language de-DE,de;q=0.9 Referer https://p2.87-121-47-199.cprapid.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers Date Sat, 29 Jul 2023 10:23:39 GMT Last-Modified Wed, 02 Mar 2022 23:19:04 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 210727
GET H/1.1	200 OK	jquery.min.js Show response p2.87-121-47-199.cprapid.com/css/	95 KB 95 KB	101ms 32ms	Script application/javascript	87.121.47.199
General Check archive.org Show headers Download Go to Full URL https://p2.87-121-47-199.cprapid.com/css/jquery.min.js Requested by Host: p2.87-121-47-199.cprapid.com URL: https://p2.87-121-47-199.cprapid.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 87.121.47.199 , Bulgaria, ASN46308 (), Reverse DNS Software Apache / Resource Hash `668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404` Request headers accept-language de-DE,de;q=0.9 Referer https://p2.87-121-47-199.cprapid.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers Date Sat, 29 Jul 2023 10:23:39 GMT Last-Modified Sun, 22 Nov 2020 13:41:24 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 97163
GET H/1.1	200 OK	logo.png p2.87-121-47-199.cprapid.com/	53 KB 53 KB	30ms 30ms	Image image/png	87.121.47.199
General Check archive.org Show headers Download Go to Show image Full URL https://p2.87-121-47-199.cprapid.com/logo.png Requested by Host: p2.87-121-47-199.cprapid.com URL: https://p2.87-121-47-199.cprapid.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 87.121.47.199 , Bulgaria, ASN46308 (), Reverse DNS Software Apache / Resource Hash `2cc5184a6d1c9f3b5f07fb1b79d4083006cc5b9a86200851eef39fd68a6406af` Request headers accept-language de-DE,de;q=0.9 Referer https://p2.87-121-47-199.cprapid.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers Date Sat, 29 Jul 2023 10:23:39 GMT Last-Modified Mon, 08 May 2023 06:01:20 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 54002
GET H/1.1	200 OK	img1.png p2.87-121-47-199.cprapid.com/css/	6 KB 7 KB	32ms 32ms	Image image/png	87.121.47.199
General Check archive.org Show headers Download Go to Show image Full URL https://p2.87-121-47-199.cprapid.com/css/img1.png Requested by Host: p2.87-121-47-199.cprapid.com URL: https://p2.87-121-47-199.cprapid.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 87.121.47.199 , Bulgaria, ASN46308 (), Reverse DNS Software Apache / Resource Hash `cf4a172da82df7d22d9b0bea415bb6c2a2080dc6bb600f96effc73b517dcc11a` Request headers accept-language de-DE,de;q=0.9 Referer https://p2.87-121-47-199.cprapid.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers Date Sat, 29 Jul 2023 10:23:39 GMT Last-Modified Thu, 03 Feb 2022 13:38:04 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 6467
GET H/1.1	200 OK	ico-messages-info.png p2.87-121-47-199.cprapid.com/	2 KB 2 KB	30ms 30ms	Image image/png	87.121.47.199
General Check archive.org Show headers Download Go to Show image Full URL https://p2.87-121-47-199.cprapid.com/ico-messages-info.png Requested by Host: p2.87-121-47-199.cprapid.com URL: https://p2.87-121-47-199.cprapid.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 87.121.47.199 , Bulgaria, ASN46308 (), Reverse DNS Software Apache / Resource Hash `b98b52b6f7cfb28e5e097f3bc02d50335264686a95ee79b7603737c8e78e5a7c` Request headers accept-language de-DE,de;q=0.9 Referer https://p2.87-121-47-199.cprapid.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers Date Sat, 29 Jul 2023 10:23:39 GMT Last-Modified Wed, 02 Mar 2022 22:57:20 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 2135
GET H2	200	loader.js Show response www.smartsuppchat.com/	19 KB 6 KB	89ms 20ms	Script application/javascript	2a02:6ea0:c700::19 CDN77 ^_^
General Check archive.org Show headers Download Go to Full URL https://www.smartsuppchat.com/loader.js? Requested by Host: p2.87-121-47-199.cprapid.com URL: https://p2.87-121-47-199.cprapid.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6ea0:c700::19 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB), Reverse DNS Software CDN77-Turbo / Resource Hash `9e3ec8fde823fb0178e76391aa3fc10e2f277d4e50b75fb00e6c195f3dec11fe` Request headers accept-language de-DE,de;q=0.9 Referer https://p2.87-121-47-199.cprapid.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers x-77-pop frankfurtDE date Sat, 29 Jul 2023 10:23:39 GMT content-encoding gzip x-cache HIT x-77-cache HIT x-age 0 x-accel-date 1690626219 x-77-nzt AcO1qhHpKzb/AAAAAA x-accel-expires @1690626279 last-modified Thu, 29 Jun 2023 04:51:04 GMT server CDN77-Turbo etag W/"649d0db8-4c98" x-77-nzt-ray 4c15622469e52969abe8c4647a68c62a vary Accept-Encoding content-type application/javascript cache-control max-age=300, public, s-maxage=60 expires Thu, 29 Jun 2023 04:58:01 GMT
GET H/1.1	200 OK	spinner_giallo.gif p2.87-121-47-199.cprapid.com/	33 KB 33 KB	30ms 30ms	Image image/gif	87.121.47.199
General Check archive.org Show headers Download Go to Show image Full URL https://p2.87-121-47-199.cprapid.com/spinner_giallo.gif Requested by Host: p2.87-121-47-199.cprapid.com URL: https://p2.87-121-47-199.cprapid.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 87.121.47.199 , Bulgaria, ASN46308 (), Reverse DNS Software Apache / Resource Hash `ea638c8244c7a5cc50e617807b1fc35637430f976e8210ef3d560a5eb059e5f5` Request headers accept-language de-DE,de;q=0.9 Referer https://p2.87-121-47-199.cprapid.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers Date Sat, 29 Jul 2023 10:23:39 GMT Last-Modified Wed, 02 Mar 2022 23:10:36 GMT Server Apache Content-Type image/gif Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 33869
GET H/1.1	200 OK	Texta-Regular.woff p2.87-121-47-199.cprapid.com/	32 KB 32 KB	266ms 265ms	Font font/woff	87.121.47.199
General Check archive.org Show headers Download Go to Full URL https://p2.87-121-47-199.cprapid.com/Texta-Regular.woff Requested by Host: p2.87-121-47-199.cprapid.com URL: https://p2.87-121-47-199.cprapid.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 87.121.47.199 , Bulgaria, ASN46308 (), Reverse DNS Software Apache / Resource Hash `4563e60af72ef8d0cc8b7c64716d81610d2f6595c7f76c8069b2015a89d623e2` Request headers Referer https://p2.87-121-47-199.cprapid.com/ Origin https://p2.87-121-47-199.cprapid.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers Date Sat, 29 Jul 2023 10:23:39 GMT Last-Modified Tue, 15 Mar 2022 15:13:02 GMT Server Apache Content-Type font/woff Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=96 Content-Length 32376
GET H2	200	8a501f860d70f42e5100568c07885c9b3daa8ceb.json Show response bootstrap.smartsuppchat.com/widget/	1 KB 682 B	95ms 28ms	XHR application/json	18.184.49.126 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://bootstrap.smartsuppchat.com/widget/8a501f860d70f42e5100568c07885c9b3daa8ceb.json Requested by Host: www.smartsuppchat.com URL: https://www.smartsuppchat.com/loader.js? Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.184.49.126 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-184-49-126.eu-central-1.compute.amazonaws.com Software / Resource Hash `3006d93c7c42cac37baac38cac26f67b24ce4ab812aa9a6858e371a2b308c58d` Request headers Referer https://p2.87-121-47-199.cprapid.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Content-Type text/plain Response headers x-version 62713eedc1f171511be259caec0493e3a10586ea date Sat, 29 Jul 2023 10:23:39 GMT content-encoding br x-hit redis etag "4a8-HXzSS2UTNL3tkfLXCuLfygqf5+c" vary Accept-Encoding content-type application/json; charset=utf-8 access-control-allow-origin * cache-control private, max-age=0, must-revalidate
GET H2	200	manifest.json Show response widget-v3.smartsuppcdn.com/	1 KB 725 B	90ms 30ms	XHR application/json	2a02:6ea0:c700::10 CDN77 ^_^
General Check archive.org Show headers Download Go to Full URL https://widget-v3.smartsuppcdn.com/manifest.json Requested by Host: www.smartsuppchat.com URL: https://www.smartsuppchat.com/loader.js? Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6ea0:c700::10 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB), Reverse DNS Software CDN77-Turbo / Resource Hash `22cdac7816c18a283e0e72c65944b2d210ceb183e9beb2817c95bede6d74a443` Request headers Referer https://p2.87-121-47-199.cprapid.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Content-Type text/plain Response headers x-77-pop frankfurtDE date Sat, 29 Jul 2023 10:23:39 GMT content-encoding gzip x-cache HIT x-77-cache HIT x-age 27 x-accel-date 1690626192 x-77-nzt AcO1rw78dKT/GwAAAA x-accel-expires @1690626252 last-modified Wed, 26 Jul 2023 09:45:25 GMT server CDN77-Turbo etag W/"64c0eb35-402" x-77-nzt-ray 908339302aec8ec2abe8c464bdc4d337 vary Accept-Encoding content-type application/json access-control-allow-origin * cache-control max-age=300, public, s-maxage=60 expires Wed, 26 Jul 2023 10:07:23 GMT
GET H2	200	main-8c985b09.js Show response widget-v3.smartsuppcdn.com/assets/ Frame D6E5	100 KB 35 KB	29ms 28ms	Script application/javascript	2a02:6ea0:c700::10 CDN77 ^_^
General Check archive.org Show headers Download Go to Full URL https://widget-v3.smartsuppcdn.com/assets/main-8c985b09.js Requested by Host: www.smartsuppchat.com URL: https://www.smartsuppchat.com/loader.js? Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6ea0:c700::10 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB), Reverse DNS Software CDN77-Turbo / Resource Hash `9cd071c9bc3691de8cb2448cddcc2e74386839a68b6e16e4a54fd25c72f38ce2` Request headers Referer Origin https://p2.87-121-47-199.cprapid.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers x-77-pop frankfurtDE date Sat, 29 Jul 2023 10:23:39 GMT content-encoding gzip x-cache HIT x-77-cache HIT x-age 260476 x-accel-date 1690365743 x-77-nzt AcO1rw5EFgr/fPkDAA x-accel-expires @1721901743 last-modified Wed, 26 Jul 2023 09:45:25 GMT server CDN77-Turbo etag W/"64c0eb35-19029" x-77-nzt-ray 908339302aec8ec2abe8c46400613e39 vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control max-age=31536000, public, immutable expires Thu, 25 Jul 2024 10:02:23 GMT
GET H2	200	vendor-e5ec23cc.js Show response widget-v3.smartsuppcdn.com/assets/ Frame D6E5	133 KB 42 KB	53ms 53ms	Script application/javascript	2a02:6ea0:c700::10 CDN77 ^_^
General Check archive.org Show headers Download Go to Full URL https://widget-v3.smartsuppcdn.com/assets/vendor-e5ec23cc.js Requested by Host: www.smartsuppchat.com URL: https://www.smartsuppchat.com/loader.js? Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6ea0:c700::10 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB), Reverse DNS Software CDN77-Turbo / Resource Hash `d40730cc03b5b45b60d867ca34925c5725ba933ca5dd2925b9c467e01db0515d` Request headers Referer Origin https://p2.87-121-47-199.cprapid.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers x-77-pop frankfurtDE date Sat, 29 Jul 2023 10:23:39 GMT content-encoding gzip x-cache HIT x-77-cache HIT x-age 260476 x-accel-date 1690365743 x-77-nzt AcO1rw6T6+b/fPkDAA x-accel-expires @1721901743 last-modified Wed, 26 Jul 2023 09:45:25 GMT server CDN77-Turbo etag W/"64c0eb35-21307" x-77-nzt-ray 908339302aec8ec2abe8c464415a7339 vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control max-age=31536000, public, immutable expires Thu, 25 Jul 2024 10:02:23 GMT
GET H2	200	style-2d1c9e30.css widget-v3.smartsuppcdn.com/assets/ Frame D6E5	28 KB 7 KB	21ms 20ms	Stylesheet text/css	2a02:6ea0:c700::10 CDN77 ^_^
General Check archive.org Show headers Download Go to Full URL https://widget-v3.smartsuppcdn.com/assets/style-2d1c9e30.css Requested by Host: www.smartsuppchat.com URL: https://www.smartsuppchat.com/loader.js? Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6ea0:c700::10 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB), Reverse DNS Software CDN77-Turbo / Resource Hash `7a9b4687ad87ac21fc7a196eb35dc28d8a5241a1b85a90d2371f49fc5288aa0e` Request headers Referer Origin https://p2.87-121-47-199.cprapid.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers x-77-pop frankfurtDE date Sat, 29 Jul 2023 10:23:39 GMT content-encoding gzip x-cache HIT x-77-cache HIT x-age 260415 x-accel-date 1690365804 x-77-nzt AcO1rw4HEpD/P/kDAA x-accel-expires @1721901804 last-modified Wed, 26 Jul 2023 09:45:25 GMT server CDN77-Turbo etag W/"64c0eb35-7138" x-77-nzt-ray 908339302aec8ec2abe8c464729e2f39 vary Accept-Encoding content-type text/css access-control-allow-origin * cache-control max-age=31536000, public, immutable expires Thu, 25 Jul 2024 10:03:24 GMT
GET H2	200	defaults Show response translations.smartsuppcdn.com/api/v1/widget/translations/lang/it/ Frame D6E5	6 KB 3 KB	45ms 18ms	Fetch application/json	2a02:6ea0:c700::10 CDN77 ^_^
General Check archive.org Show headers Download Go to Full URL https://translations.smartsuppcdn.com/api/v1/widget/translations/lang/it/defaults Requested by Host: widget-v3.smartsuppcdn.com URL: https://widget-v3.smartsuppcdn.com/assets/vendor-e5ec23cc.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6ea0:c700::10 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB), Reverse DNS Software CDN77-Turbo / Resource Hash `bcc7db6f5b88781193fdb980d577bd937daca8a39b2ad1b332e6be6ee3b26d10` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers x-77-pop frankfurtDE x-version 53af494c8b6bbd7be2e2e201ce09a4c9124a68bd date Sat, 29 Jul 2023 10:23:40 GMT content-encoding gzip x-cache HIT x-77-cache HIT x-age 199 x-accel-date 1690626021 x-response-time 0ms x-77-nzt AcO1rw7QYUX/xwAAAA x-accel-expires @1690626621 server CDN77-Turbo x-77-nzt-ray 908339302aec8ec2ace8c464d8577005 vary Accept-Encoding, Origin content-type application/json; charset=utf-8 access-control-allow-origin * cache-control max-age=600

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Poste Italiane (Online)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			p2.87-121-47-199.cprapid.com/	1970-01-20 23:13:06	Name: COOKIE_KEY Value: 169062621994

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bootstrap.smartsuppchat.com
p2.87-121-47-199.cprapid.com
translations.smartsuppcdn.com
widget-v3.smartsuppcdn.com
www.smartsuppchat.com
18.184.49.126
2a02:6ea0:c700::10
2a02:6ea0:c700::19
87.121.47.199
22cdac7816c18a283e0e72c65944b2d210ceb183e9beb2817c95bede6d74a443
2cc5184a6d1c9f3b5f07fb1b79d4083006cc5b9a86200851eef39fd68a6406af
3006d93c7c42cac37baac38cac26f67b24ce4ab812aa9a6858e371a2b308c58d
4563e60af72ef8d0cc8b7c64716d81610d2f6595c7f76c8069b2015a89d623e2
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
6cfde476dffc41c1ba2f4a228f1f2be0052d7f67093674264506377577e4cd09
7a9b4687ad87ac21fc7a196eb35dc28d8a5241a1b85a90d2371f49fc5288aa0e
8b922a249c9f81562d99eee24407bf38c7feac74a10dfe712292c0b032144dfa
8bb3d9c7732fea4af7c9e2dd895d14091859b48ee8bb6fc8eba724b27907a0a0
9cd071c9bc3691de8cb2448cddcc2e74386839a68b6e16e4a54fd25c72f38ce2
9e3ec8fde823fb0178e76391aa3fc10e2f277d4e50b75fb00e6c195f3dec11fe
b98b52b6f7cfb28e5e097f3bc02d50335264686a95ee79b7603737c8e78e5a7c
bcc7db6f5b88781193fdb980d577bd937daca8a39b2ad1b332e6be6ee3b26d10
cf4a172da82df7d22d9b0bea415bb6c2a2080dc6bb600f96effc73b517dcc11a
d40730cc03b5b45b60d867ca34925c5725ba933ca5dd2925b9c467e01db0515d
ea638c8244c7a5cc50e617807b1fc35637430f976e8210ef3d560a5eb059e5f5

p2.87-121-47-199.cprapid.com Open in urlscan Pro 87.121.47.199 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

16 Requests

100 %HTTPS

50 %IPv6

3 Domains

5 Subdomains

4 IPs

2 Countries

648 kBTransfer

841 kBSize

1 Cookies

0 Outgoing links

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

8 JavaScript Global Variables

1 Cookies

Indicators

p2.87-121-47-199.cprapid.com Open in urlscan Pro
87.121.47.199 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

100 %
HTTPS

50 %
IPv6

3
Domains

5
Subdomains

4
IPs

2
Countries

648 kB
Transfer

841 kB
Size

1
Cookies

16 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!