safe-dellivery.info Open in urlscan Pro
178.208.83.20  Malicious Activity! Public Scan

URL: https://safe-dellivery.info/cash26595520
Submission: On February 09 via api from PL

Summary

This website contacted 6 IPs in 3 countries across 5 domains to perform 12 HTTP transactions. The main IP is 178.208.83.20, located in Russian Federation and belongs to MCHOST-AS McHost LLC, Moscow, Russia, RU. The main domain is safe-dellivery.info.
TLS certificate: Issued by R3 on February 1st 2021. Valid for: 3 months.
This is the only time safe-dellivery.info was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: OLX Group (E-commerce)

Domain & IP information

IP Address AS Autonomous System
2 178.208.83.20 207384 (MCHOST-AS...)
1 2a02:6ea0:c70... 60068 (CDN77 (^_^)/)
1 2a00:1450:400... 15169 (GOOGLE)
1 65.9.94.28 16509 (AMAZON-02)
1 3.120.69.250 16509 (AMAZON-02)
6 2a02:6ea0:c70... 60068 (CDN77 (^_^)/)
12 6
Domain Requested by
6 widget-v2.smartsuppcdn.com www.smartsuppchat.com
widget-v2.smartsuppcdn.com
2 safe-dellivery.info safe-dellivery.info
1 bootstrap.smartsuppchat.com www.smartsuppchat.com
1 ireland.apollo.olxcdn.com safe-dellivery.info
1 fonts.gstatic.com safe-dellivery.info
1 www.smartsuppchat.com safe-dellivery.info
12 6

This site contains no links.

Subject Issuer Validity Valid
safe-dellivery.info
R3
2021-02-01 -
2021-05-02
3 months crt.sh
*.smartsuppchat.com
RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1
2020-12-02 -
2021-12-30
a year crt.sh
*.gstatic.com
GTS CA 1O1
2021-01-19 -
2021-04-13
3 months crt.sh
apollo.olxcdn.com
Amazon
2020-03-17 -
2021-04-17
a year crt.sh
*.smartsuppcdn.com
RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1
2020-11-03 -
2021-12-04
a year crt.sh

This page contains 2 frames:

Primary Page: https://safe-dellivery.info/cash26595520
Frame ID: 0B97EAE565026B457AD7E878D222B772
Requests: 7 HTTP requests in this frame

Frame: https://widget-v2.smartsuppcdn.com/static/js/runtime-main.2f26b054.js
Frame ID: 40AF48FAA8B4F1551C6243F4ACBD36B3
Requests: 5 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

12
Requests

100 %
HTTPS

50 %
IPv6

5
Domains

6
Subdomains

6
IPs

3
Countries

280 kB
Transfer

926 kB
Size

2
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request cash26595520
safe-dellivery.info/
80 KB
12 KB
Document
General
Full URL
https://safe-dellivery.info/cash26595520
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
178.208.83.20 , Russian Federation, ASN207384 (MCHOST-AS McHost LLC, Moscow, Russia, RU),
Reverse DNS
s16.h.mchost.ru
Software
nginx / PHP/7.1.21
Resource Hash
658b8b25f30607a885d170269307ff3e82eb04f74a2d57bf3bb7b4288e1e936f

Request headers

:method
GET
:authority
safe-dellivery.info
:scheme
https
:path
/cash26595520
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

server
nginx
date
Tue, 09 Feb 2021 15:10:51 GMT
content-type
text/html
vary
Accept-Encoding
x-powered-by
PHP/7.1.21
set-cookie
52c04454754170d9ea4dd76867619c2f=0JTQsNC90LjRjywgQ2FwaXRhbCBSZWdpb24sINCa0L7Qv9C10L3Qs9Cw0LPQtdC9; expires=Tue, 23-Feb-2021 15:10:51 GMT; Max-Age=1209600; path=/ 0800fc577294c34e0b28ad2839435945=MGZjNmY2MTUyODNiYjJmMmIzNGZjYmYyMDQ1NDA2YTI%3D; expires=Tue, 23-Feb-2021 15:10:51 GMT; Max-Age=1209600; path=/
content-encoding
gzip
TXWQg8F.png
safe-dellivery.info/img/
8 KB
8 KB
Image
General
Full URL
https://safe-dellivery.info/img/TXWQg8F.png
Requested by
Host: safe-dellivery.info
URL: https://safe-dellivery.info/cash26595520
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
178.208.83.20 , Russian Federation, ASN207384 (MCHOST-AS McHost LLC, Moscow, Russia, RU),
Reverse DNS
s16.h.mchost.ru
Software
nginx /
Resource Hash
3edbb9a2008194b4696102d304685475a474c11949ce202725a02b4659d309eb

Request headers

Referer
https://safe-dellivery.info/cash26595520
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 09 Feb 2021 15:10:51 GMT
last-modified
Tue, 09 Feb 2021 12:48:29 GMT
server
nginx
etag
"6022849d-20b5"
content-type
image/png
cache-control
max-age=315360000
accept-ranges
bytes
content-length
8373
expires
Thu, 31 Dec 2037 23:55:55 GMT
loader.js
www.smartsuppchat.com/
21 KB
7 KB
Script
General
Full URL
https://www.smartsuppchat.com/loader.js?
Requested by
Host: safe-dellivery.info
URL: https://safe-dellivery.info/cash26595520
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6ea0:c700::1 , Germany, ASN60068 (CDN77 (^_^)/, GB),
Reverse DNS
Software
CDN77-Turbo /
Resource Hash
0d17c2653e761f1126a917064534a4dcdc2ad5a8bd8d583ded616674299c14e3

Request headers

Referer
https://safe-dellivery.info/cash26595520
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-77-nzt
AcO1ryxXgMLvLgAAAA==
date
Tue, 09 Feb 2021 15:10:51 GMT
content-encoding
br
etag
W/"5f741f43-522f"
last-modified
Wed, 30 Sep 2020 06:01:39 GMT
server
CDN77-Turbo
x-77-nzt-ray
5xM8pH1do4k=
x-77-cache
HIT
content-type
application/javascript
cache-control
max-age=60
x-cache
HIT
x-age
46
x-77-pop
frankfurtDE
expires
Tue, 09 Feb 2021 15:11:51 GMT
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v20/
15 KB
15 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxK.woff2
Requested by
Host: safe-dellivery.info
URL: https://safe-dellivery.info/cash26595520
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
48c3fa6f86c54f1d9bb519220713d4b0a1f8cd1a589a3c03b9fa82e98ecb13e3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://safe-dellivery.info
Referer
https://safe-dellivery.info/cash26595520
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 12:56:43 GMT
x-content-type-options
nosniff
last-modified
Wed, 24 Jul 2019 01:18:36 GMT
server
sffe
age
440048
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15736
x-xss-protection
0
expires
Fri, 04 Feb 2022 12:56:43 GMT
image;s=1000x700
ireland.apollo.olxcdn.com/v1/files/cow3fziv7w8l1-PL/
17 KB
17 KB
Image
General
Full URL
https://ireland.apollo.olxcdn.com/v1/files/cow3fziv7w8l1-PL/image;s=1000x700
Requested by
Host: safe-dellivery.info
URL: https://safe-dellivery.info/cash26595520
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.94.28 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
f516d8272f83b602057fc5b41ba70c7cad03968a4861257625426a7f689e26fc

Request headers

Referer
https://safe-dellivery.info/cash26595520
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 09 Feb 2021 13:50:06 GMT
via
1.1 cb11ca2ff3db5adbe7df4bca70e51594.cloudfront.net (CloudFront)
last-modified
Tue, 9 Feb 2021 13:50:06 GMT
age
4845
x-trace
d6985da6-8bde-404a-8b37-a72a373d6dad
etag
"cow3fziv7w8l1-PL"
access-control-allow-methods
GET, OPTIONS
content-type
image/webp
access-control-allow-origin
*
cache-control
public,max-age=604800
x-cache
Hit from cloudfront
x-amz-cf-pop
PRG50-C1
content-length
17080
x-amz-cf-id
wDjl-PLg-BB-zDmwYDzOf7_cY1jcBUL0GE4_ogGhLJXFLVkjmVK-Yw==
6020ac91886538d22605b8bdef7841ea214236cd.json
bootstrap.smartsuppchat.com/widget/
5 KB
2 KB
XHR
General
Full URL
https://bootstrap.smartsuppchat.com/widget/6020ac91886538d22605b8bdef7841ea214236cd.json
Requested by
Host: www.smartsuppchat.com
URL: https://www.smartsuppchat.com/loader.js?
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.120.69.250 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-120-69-250.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
2138747dcd3f21111c8caee49b904cf61df5cef1d924357e173b7c3ca9e310b4

Request headers

Referer
https://safe-dellivery.info/cash26595520
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

x-version
87c08db96edbc2eef5837c31371d9132b3b8c4b5
date
Tue, 09 Feb 2021 15:10:51 GMT
content-encoding
br
x-hit
redis
etag
"12cb-P7bZ5GeaNH6606MXXV0wWTHiguI"
vary
Accept-Encoding
content-type
application/json; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=0, must-revalidate
asset-manifest.json
widget-v2.smartsuppcdn.com/
2 KB
687 B
XHR
General
Full URL
https://widget-v2.smartsuppcdn.com/asset-manifest.json
Requested by
Host: www.smartsuppchat.com
URL: https://www.smartsuppchat.com/loader.js?
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6ea0:c700::3 , Germany, ASN60068 (CDN77 (^_^)/, GB),
Reverse DNS
Software
CDN77-Turbo /
Resource Hash
3828727338917fd188de8a9b77f9f39b1dac314cf47f2a9305da4bd87c2864c8

Request headers

Referer
https://safe-dellivery.info/cash26595520
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

x-77-nzt
AcO1rzJiVCfvCwAAAA==
date
Tue, 09 Feb 2021 15:10:51 GMT
content-encoding
br
etag
W/"601ac3d9-69e"
last-modified
Wed, 03 Feb 2021 15:40:09 GMT
server
CDN77-Turbo
x-77-nzt-ray
69A5oEqLRGk=
x-77-cache
HIT
content-type
application/json
access-control-allow-origin
*
cache-control
max-age=300, public, s-maxage=60
x-cache
HIT
x-age
11
x-77-pop
frankfurtDE
expires
Wed, 03 Feb 2021 16:37:08 GMT
runtime-main.2f26b054.js
widget-v2.smartsuppcdn.com/static/js/ Frame 40AF
2 KB
1 KB
Script
General
Full URL
https://widget-v2.smartsuppcdn.com/static/js/runtime-main.2f26b054.js
Requested by
Host: www.smartsuppchat.com
URL: https://www.smartsuppchat.com/loader.js?
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6ea0:c700::3 , Germany, ASN60068 (CDN77 (^_^)/, GB),
Reverse DNS
Software
CDN77-Turbo /
Resource Hash
cb23bb59b65840abccc00870b66723509d50586fcbacf5a0d1290094ac35d073

Request headers

Referer
https://safe-dellivery.info/cash26595520
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-77-nzt
AcO1rzJly5Hv4dUHAA==
date
Tue, 09 Feb 2021 15:10:51 GMT
content-encoding
br
etag
W/"601ac3d9-982"
last-modified
Wed, 03 Feb 2021 15:40:09 GMT
server
CDN77-Turbo
x-77-nzt-ray
1wIjlSScEqw=
x-77-cache
HIT
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
x-cache
HIT
x-age
513505
x-77-pop
frankfurtDE
expires
Wed, 09 Feb 2022 15:10:51 GMT
3.d73e307e.chunk.js
widget-v2.smartsuppcdn.com/static/js/ Frame 40AF
662 KB
186 KB
Script
General
Full URL
https://widget-v2.smartsuppcdn.com/static/js/3.d73e307e.chunk.js
Requested by
Host: www.smartsuppchat.com
URL: https://www.smartsuppchat.com/loader.js?
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6ea0:c700::3 , Germany, ASN60068 (CDN77 (^_^)/, GB),
Reverse DNS
Software
CDN77-Turbo /
Resource Hash
52e380f61b260acedab19811f33a6abbcf56c831bc5691af67a34651a8d2abe8

Request headers

Referer
https://safe-dellivery.info/cash26595520
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-77-nzt
AcO1rzJrTrDv4dUHAA==
date
Tue, 09 Feb 2021 15:10:51 GMT
content-encoding
br
etag
W/"601ac3d9-a589c"
last-modified
Wed, 03 Feb 2021 15:40:09 GMT
server
CDN77-Turbo
x-77-nzt-ray
JaajA8ahW18=
x-77-cache
HIT
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
x-cache
HIT
x-age
513505
x-77-pop
frankfurtDE
expires
Wed, 09 Feb 2022 15:10:51 GMT
main.45858a36.chunk.js
widget-v2.smartsuppcdn.com/static/js/ Frame 40AF
106 KB
26 KB
Script
General
Full URL
https://widget-v2.smartsuppcdn.com/static/js/main.45858a36.chunk.js
Requested by
Host: www.smartsuppchat.com
URL: https://www.smartsuppchat.com/loader.js?
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6ea0:c700::3 , Germany, ASN60068 (CDN77 (^_^)/, GB),
Reverse DNS
Software
CDN77-Turbo /
Resource Hash
2b7c78aeb65f51060a453f2045bd845154e76ae1dcfbac623a4ed47af62e8165

Request headers

Referer
https://safe-dellivery.info/cash26595520
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-77-nzt
AcO1rzKRZSfvHtYHAA==
date
Tue, 09 Feb 2021 15:10:51 GMT
content-encoding
br
etag
W/"601ac3d9-1a8b2"
last-modified
Wed, 03 Feb 2021 15:40:09 GMT
server
CDN77-Turbo
x-77-nzt-ray
eBxmL+dfwKQ=
x-77-cache
HIT
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000, public, immutable
x-cache
HIT
x-age
513566
x-77-pop
frankfurtDE
expires
Thu, 03 Feb 2022 16:31:25 GMT
en.json
widget-v2.smartsuppcdn.com/translates/ Frame 40AF
4 KB
2 KB
Fetch
General
Full URL
https://widget-v2.smartsuppcdn.com/translates/en.json?v=2.2.47
Requested by
Host: widget-v2.smartsuppcdn.com
URL: https://widget-v2.smartsuppcdn.com/static/js/main.45858a36.chunk.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6ea0:c700::3 , Germany, ASN60068 (CDN77 (^_^)/, GB),
Reverse DNS
Software
CDN77-Turbo /
Resource Hash
c4b98493d5eba133351da0d87d2a8a05e506031e8fd3366d56cde540ae176d77

Request headers

Referer
https://safe-dellivery.info/cash26595520
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-77-nzt
AcO1rzJJJbPv5dUHAA==
date
Tue, 09 Feb 2021 15:10:52 GMT
content-encoding
br
etag
W/"601ac39b-f94"
last-modified
Wed, 03 Feb 2021 15:39:07 GMT
server
CDN77-Turbo
x-77-nzt-ray
MbHkxFGLQdk=
x-77-cache
HIT
content-type
application/json
access-control-allow-origin
*
cache-control
max-age=31536000, public, immutable
x-cache
HIT
x-age
513509
x-77-pop
frankfurtDE
expires
Thu, 03 Feb 2022 16:32:23 GMT
pl.json
widget-v2.smartsuppcdn.com/translates/ Frame 40AF
4 KB
2 KB
Fetch
General
Full URL
https://widget-v2.smartsuppcdn.com/translates/pl.json?v=2.2.47
Requested by
Host: widget-v2.smartsuppcdn.com
URL: https://widget-v2.smartsuppcdn.com/static/js/main.45858a36.chunk.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6ea0:c700::3 , Germany, ASN60068 (CDN77 (^_^)/, GB),
Reverse DNS
Software
CDN77-Turbo /
Resource Hash
ad9e6a97f8cf1417f9470ceed366c19c668937d6b47f973a4069f5eaf24aa01b

Request headers

Referer
https://safe-dellivery.info/cash26595520
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-77-nzt
AcO1rzK8lrbv5dUHAA==
date
Tue, 09 Feb 2021 15:10:52 GMT
content-encoding
br
etag
W/"601ac39b-1110"
last-modified
Wed, 03 Feb 2021 15:39:07 GMT
server
CDN77-Turbo
x-77-nzt-ray
o7lWyOxulCI=
x-77-cache
HIT
content-type
application/json
access-control-allow-origin
*
cache-control
max-age=31536000, public, immutable
x-cache
HIT
x-age
513509
x-77-pop
frankfurtDE
expires
Thu, 03 Feb 2022 16:32:23 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: OLX Group (E-commerce)

16 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated object| _smartsupp function| smartsupp function| setImmediate function| clearImmediate boolean| SMARTSUPP_LOADED object| $smartsupp

2 Cookies

Domain/Path Name / Value
safe-dellivery.info/ Name: 0800fc577294c34e0b28ad2839435945
Value: MGZjNmY2MTUyODNiYjJmMmIzNGZjYmYyMDQ1NDA2YTI%3D
safe-dellivery.info/ Name: 52c04454754170d9ea4dd76867619c2f
Value: 0JTQsNC90LjRjywgQ2FwaXRhbCBSZWdpb24sINCa0L7Qv9C10L3Qs9Cw0LPQtdC9