levering-tracking.net Open in urlscan Pro
91.212.166.145  Malicious Activity! Public Scan

URL: https://levering-tracking.net/
Submission: On August 04 via manual from NL — Scanned from NL

Summary

This website contacted 5 IPs in 3 countries across 3 domains to perform 26 HTTP transactions. The main IP is 91.212.166.145, located in Russian Federation and belongs to PROTON66, RU. The main domain is levering-tracking.net.
TLS certificate: Issued by R10 on July 20th 2024. Valid for: 3 months.
This is the only time levering-tracking.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: UPS (Transportation)

Domain & IP information

IP Address AS Autonomous System
5 91.212.166.145 198953 (PROTON66)
7 2a02:26f0:480... 20940 (AKAMAI-ASN1)
1 2606:4700::68... 13335 (CLOUDFLAR...)
4 172.67.139.119 13335 (CLOUDFLAR...)
26 5
Apex Domain
Subdomains
Transfer
7 ups.com
www.ups.com — Cisco Umbrella Rank: 14527 Failed
179 KB
5 fontawesome.com
kit.fontawesome.com — Cisco Umbrella Rank: 3618
ka-f.fontawesome.com — Cisco Umbrella Rank: 7493
35 KB
5 levering-tracking.net
levering-tracking.net
7 KB
26 3
Domain Requested by
7 www.ups.com levering-tracking.net
5 levering-tracking.net levering-tracking.net
4 ka-f.fontawesome.com kit.fontawesome.com
1 kit.fontawesome.com levering-tracking.net
26 4

This site contains links to these domains. Also see Links.

Domain
www.ups.com
Subject Issuer Validity Valid
levering-tracking.net
R10
2024-07-20 -
2024-10-18
3 months crt.sh
www.ups.com
COMODO ECC Organization Validation Secure Server CA
2024-03-14 -
2025-03-14
a year crt.sh
*.fontawesome.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2024-07-30 -
2025-01-27
6 months crt.sh
ka-f.fontawesome.com
WE1
2024-07-01 -
2024-09-29
3 months crt.sh

This page contains 1 frames:

Primary Page: https://levering-tracking.net/
Frame ID: 84F9889CE7BFF7092FBAAB88211D894B
Requests: 28 HTTP requests in this frame

Screenshot

Page Title

Wereldwijde verzend- en logistieke diensten | UPS

Detected technologies

Overall confidence: 100%
Detected patterns
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • kit\.fontawesome\.com/([0-9a-z]+).js

Page Statistics

26
Requests

65 %
HTTPS

50 %
IPv6

3
Domains

4
Subdomains

5
IPs

3
Countries

223 kB
Transfer

691 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

26 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
levering-tracking.net/
41 KB
6 KB
Document
General
Full URL
https://levering-tracking.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
91.212.166.145 , Russian Federation, ASN198953 (PROTON66, RU),
Reverse DNS
Software
nginx / PHP/8.2.21 PleskLin
Resource Hash
83c8e8a86f49907492cd7aa03b0f829160dcd5998f81b8f6f0eae1c4d5b41548

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

cache-control
no-store, no-cache, must-revalidate
content-encoding
br
content-type
text/html; charset=UTF-8
date
Sun, 04 Aug 2024 17:34:11 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
pragma
no-cache
server
nginx
x-powered-by
PHP/8.2.21 PleskLin
Roboto-Light.ttf
levering-tracking.net/assets/resources/webcontent/styles/fonts/
0
0
Font
General
Full URL
https://levering-tracking.net/assets/resources/webcontent/styles/fonts/Roboto-Light.ttf
Requested by
Host: levering-tracking.net
URL: https://levering-tracking.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
91.212.166.145 , Russian Federation, ASN198953 (PROTON66, RU),
Reverse DNS
Software
nginx /
Resource Hash

Request headers

Referer
https://levering-tracking.net/
Origin
https://levering-tracking.net
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Sun, 04 Aug 2024 17:34:11 GMT
content-encoding
br
last-modified
Sat, 20 Jul 2024 21:43:25 GMT
server
nginx
etag
W/"328-61db4b3a717b5"
content-type
text/html
Roboto-Regular.woff
www.ups.com/assets/resources/webcontent/styles/fonts/
0
0

Roboto-Regular.woff2
www.ups.com/assets/resources/webcontent/styles/fonts/
0
0

Roboto-Regular.ttf
www.ups.com/assets/resources/webcontent/styles/fonts/
0
0

Roboto-Medium.woff
www.ups.com/assets/resources/webcontent/styles/fonts/
0
0

Roboto-Medium.woff2
www.ups.com/assets/resources/webcontent/styles/fonts/
0
0

Roboto-Medium.ttf
www.ups.com/assets/resources/webcontent/styles/fonts/
0
0

Roboto-Bold.woff
www.ups.com/assets/resources/webcontent/styles/fonts/
0
0

Roboto-Bold.woff2
www.ups.com/assets/resources/webcontent/styles/fonts/
0
0

Roboto-Bold.ttf
www.ups.com/assets/resources/webcontent/styles/fonts/
0
0

ups.vendor.161a0d161a0d.css
www.ups.com/assets/resources/webcontent/styles/
108 KB
14 KB
Stylesheet
General
Full URL
https://www.ups.com/assets/resources/webcontent/styles/ups.vendor.161a0d161a0d.css
Requested by
Host: levering-tracking.net
URL: https://levering-tracking.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:480:5b8::353a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Akamai Resource Optimizer /
Resource Hash
a549adbd193f091a69c8995eb7b34c5ec73ef15f098af300cb297f78254e1013
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://levering-tracking.net/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Sun, 04 Aug 2024 17:34:11 GMT
content-encoding
br
x-content-type-options
nosniff
strict-transport-security
max-age=63072000; includeSubDomains; preload
content-security-policy-report-only
default-src 'unsafe-inline' 'unsafe-eval' 'self' blob: data: ups.com *.ups.com *.doubleclick.net doubleclick.net googleads.g.doubleclick.net *.jquery.com jquery.com nuance.com *.nuance.com inq.com *.inq.com *.salesforce-sites.com salesforce-sites.com *.salesforceliveagent.com salesforceliveagent.com *.salesforce.com salesforce.com *.bootstrapcdn.com bootstrapcdn.com tiqcdn.com *.tiqcdn.com tealiumiq.com *.tealiumiq.com youtube.com *.youtube.com adsrvr.org *.adsrvr.org demandbase.com *.demandbase.com facebook.net *.facebook.net facebook.com *.facebook.com bing.com *.bing.com googletagmanager.com *.googletagmanager.com www.google.com google.com *.google.com fullstory.com *.fullstory.com qualtrics.com *.qualtrics.com ups.demdex.net demdex.net *.demdex.net omtrdc.net *.omtrdc.net google-analytics.com *.google-analytics.com googleadservices.com *.googleadservices.com company-target.com *.company-target.com marketo.com *.marketo.com marketo.net *.marketo.net licdn.com *.licdn.com linkedin.com *.linkedin.com blueconic.net *.blueconic.net mpsnare.iesnare.com iesnare.com *.iesnare.com virtualearth.net *.virtualearth.net iovation.com *.iovation.com cdn-apple.com *.cdn-apple.com gstatic.com *.gstatic.com googleapis.com *.googleapis.com parcelpath.com:7141 *.parcelpath.com:7141 *.ytimg.com ytimg.com everesttech.net *.everesttech.net rlcdn.com *.rlcdn.com fonts.googleapis.com fonts.gstatic.com online-metrix.net *.online-metrix.net customerfeedback.ups.com login.microsoftonline.com mktoresp.com *.mktoresp.com; frame-ancestors 'self' parcelpath.com:7141 *.parcelpath.com:7141 ups.com *.ups.com;
server-timing
cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1722792851550_35115194_56129598_39_10331_21_24_255";dur=1
content-length
12551
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
same-origin
last-modified
Mon, 29 Jul 2024 04:58:46 GMT
server
Akamai Resource Optimizer
x-frame-options
SAMEORIGIN
content-type
text/css
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
expires
Sun, 04 Aug 2024 17:34:11 GMT
ups.styles.b112d13750ec.css
www.ups.com/assets/resources/webcontent/styles/
272 KB
35 KB
Stylesheet
General
Full URL
https://www.ups.com/assets/resources/webcontent/styles/ups.styles.b112d13750ec.css
Requested by
Host: levering-tracking.net
URL: https://levering-tracking.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:480:5b8::353a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Akamai Resource Optimizer /
Resource Hash
f451530350ec58738762de87c5b9e0b9b7c99f72f8d9baa4715dd386a8e94373
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://levering-tracking.net/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Sun, 04 Aug 2024 17:34:11 GMT
content-encoding
br
x-content-type-options
nosniff
strict-transport-security
max-age=63072000; includeSubDomains; preload
server-timing
cdn-cache; desc=HIT, edge; dur=14, origin; dur=0, ak_p; desc="1722792851576_35115194_56129600_1408_10852_21_0_255";dur=1
content-length
35424
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
same-origin
last-modified
Mon, 29 Jul 2024 18:23:02 GMT
server
Akamai Resource Optimizer
x-frame-options
SAMEORIGIN
content-type
text/css
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
expires
Sun, 04 Aug 2024 17:34:11 GMT
onelink.css
levering-tracking.net/_onelink_/ups/sites/www.ups.com/
0
0
Stylesheet
General
Full URL
https://levering-tracking.net/_onelink_/ups/sites/www.ups.com/onelink.css?ts=20211109
Requested by
Host: levering-tracking.net
URL: https://levering-tracking.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
91.212.166.145 , Russian Federation, ASN198953 (PROTON66, RU),
Reverse DNS
Software
nginx /
Resource Hash

Request headers

Referer
https://levering-tracking.net/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Sun, 04 Aug 2024 17:34:11 GMT
content-encoding
br
last-modified
Sat, 20 Jul 2024 21:43:25 GMT
server
nginx
etag
W/"328-61db4b3a717b5"
content-type
text/html
onelink.css
levering-tracking.net/_onelink_/ups/sites/www.ups.com/en2engb/
0
0
Stylesheet
General
Full URL
https://levering-tracking.net/_onelink_/ups/sites/www.ups.com/en2engb/onelink.css?ts=20210305
Requested by
Host: levering-tracking.net
URL: https://levering-tracking.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
91.212.166.145 , Russian Federation, ASN198953 (PROTON66, RU),
Reverse DNS
Software
nginx /
Resource Hash

Request headers

Referer
https://levering-tracking.net/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Sun, 04 Aug 2024 17:34:11 GMT
content-encoding
br
last-modified
Sat, 20 Jul 2024 21:43:25 GMT
server
nginx
etag
W/"328-61db4b3a717b5"
content-type
text/html
ups-logo.svg
www.ups.com/assets/resources/webcontent/images/
2 KB
1 KB
Image
General
Full URL
https://www.ups.com/assets/resources/webcontent/images/ups-logo.svg
Requested by
Host: levering-tracking.net
URL: https://levering-tracking.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:480:5b8::353a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Akamai Resource Optimizer /
Resource Hash
9f5ae3f644595dc6c5aa69ae618a108102bb62e1a38a50b89fd7af1b8ffe5eae
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://levering-tracking.net/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Sun, 04 Aug 2024 17:34:11 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=63072000; includeSubDomains; preload
server-timing
cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1722792851616_35115194_56129619_629_11326_21_0_182";dur=1
content-length
997
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
same-origin
last-modified
Mon, 29 Jul 2024 16:16:33 GMT
server
Akamai Resource Optimizer
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
expires
Sun, 04 Aug 2024 17:34:11 GMT
363d4a4d7b.js
kit.fontawesome.com/
13 KB
5 KB
Script
General
Full URL
https://kit.fontawesome.com/363d4a4d7b.js
Requested by
Host: levering-tracking.net
URL: https://levering-tracking.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:123e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f4bc18a9cf20077f92934e380fe01e608ac49860ed383a536ae4c2b659fa3226

Request headers

Referer
https://levering-tracking.net/
Origin
https://levering-tracking.net
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Sun, 04 Aug 2024 17:34:11 GMT
content-encoding
gzip
cf-cache-status
HIT
server
cloudflare
age
44
vary
origin, accept-encoding, access-control-request-headers, access-control-request-method
access-control-max-age
3000
access-control-allow-methods
GET, OPTIONS
access-control-allow-origin
*
content-type
text/javascript
cache-control
max-age=60, public, stale-while-revalidate=30
cf-ray
8ae04bf99f9f0b36-AMS
access-control-allow-headers
accept, accept-langauge, content-language, content-type, fa-kit-token
x-request-id
F-d3M0Ig2Nyas2sdcmMB
icp.gif
www.ups.com/img/
43 B
434 B
Image
General
Full URL
https://www.ups.com/img/icp.gif
Requested by
Host: levering-tracking.net
URL: https://levering-tracking.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:480:5b8::353a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Apache /
Resource Hash
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://levering-tracking.net/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 04 Aug 2024 17:34:11 GMT
strict-transport-security
max-age=63072000; includeSubDomains; preload
referrer-policy
same-origin
x-content-type-options
nosniff
last-modified
Wed, 29 Apr 2015 19:29:01 GMT
server
Apache
x-frame-options
SAMEORIGIN
content-type
image/gif
cache-control
no-cache
server-timing
cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1722792851611_35115194_56129620_36_10531_21_0_182";dur=1
accept-ranges
bytes
content-length
43
x-xss-protection
1; mode=block
expires
Sun, 04 Aug 2024 17:34:11 GMT
truncated
/
3 KB
3 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6cd12cdc19493452d402a1900867561dcf31dbdc6fa6f70cc77695c973139226

Request headers

Referer
Origin
https://levering-tracking.net
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type
application/x-font-woff;charset=utf-8
free.min.css
ka-f.fontawesome.com/releases/v6.6.0/css/
94 KB
22 KB
Fetch
General
Full URL
https://ka-f.fontawesome.com/releases/v6.6.0/css/free.min.css?token=363d4a4d7b
Requested by
Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/363d4a4d7b.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.139.119 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f99c17690330c805c47da3d7592864d6acf0f73817d432447e1b0c66ad28f221

Request headers

Referer
https://levering-tracking.net/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Sun, 04 Aug 2024 17:34:11 GMT
content-encoding
gzip
via
1.1 01abec7ece24959c09067a58477de9ee.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
AMS1-P2
age
316406
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
alt-svc
h3=":443"; ma=86400
last-modified
Mon, 15 Jul 2024 22:20:40 GMT
server
cloudflare
etag
W/"4ca760f49cd8a14911c81e6c14328874"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
text/css
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UDwoqcREfT%2FURb7Ysv1%2BhMAS1g%2BWzOHn5lB3abNFD979kXzcZbuU5ImEzD0uWUIvgA0nI9EGQvvDDJNBlyWQbRbeRgFNX05MtZ2s1BMpbG41CK0s%2BlT0OknTC29e1715I7iZJ5KljA%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=31556926
vary
Accept-Encoding
cf-ray
8ae04bfafdba96f8-AMS
access-control-allow-headers
fa-kit-token
x-amz-cf-id
0WoxGI9rr_-L3XDrFHn2TnOGuLj8lckzhrjo4u-zeI5RDfHvgui6vA==
free-v4-shims.min.css
ka-f.fontawesome.com/releases/v6.6.0/css/
27 KB
5 KB
Fetch
General
Full URL
https://ka-f.fontawesome.com/releases/v6.6.0/css/free-v4-shims.min.css?token=363d4a4d7b
Requested by
Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/363d4a4d7b.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.139.119 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1ae3c19265723696f50e3226dcd43fbc7ea617697e0d7169a8e52c854ae3826c

Request headers

Referer
https://levering-tracking.net/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Sun, 04 Aug 2024 17:34:11 GMT
content-encoding
gzip
via
1.1 ee47c4d401aca1a1f5c2ee96ce3267e4.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
AMS1-P2
age
316406
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
alt-svc
h3=":443"; ma=86400
last-modified
Mon, 15 Jul 2024 22:20:39 GMT
server
cloudflare
etag
W/"5e5b0d8c7be5919570a305b6bc229a36"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
text/css
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ouOAmQNcuz2yl4o8XeZf2Zh8Nwq6TRORGLd2%2FpqnXFPu7hrfzT4m%2BpCzhBUNTAsIzb5cbeHkjrmAKaUxCfG3MUOafkEvLGhhTS2PfIJ%2BFS9KhFGzN9FWsZ%2FBozkIE4WpmfdHM1Ry2g%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=31556926
vary
Accept-Encoding
cf-ray
8ae04bfafdbe96f8-AMS
access-control-allow-headers
fa-kit-token
x-amz-cf-id
ggR1jI0jp1gMB47eaF_xbfZsXmzQHUBVObmQCW5fh1z60JNOmxFMIw==
free-v5-font-face.min.css
ka-f.fontawesome.com/releases/v6.6.0/css/
823 B
984 B
Fetch
General
Full URL
https://ka-f.fontawesome.com/releases/v6.6.0/css/free-v5-font-face.min.css?token=363d4a4d7b
Requested by
Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/363d4a4d7b.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.139.119 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7f264c31cdb355f351235359240c30acae2bbe0a43c73fa6a035123e6d953a01

Request headers

Referer
https://levering-tracking.net/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Sun, 04 Aug 2024 17:34:11 GMT
via
1.1 701ed6d11cb535ec9687bbfbe3b14bc0.cloudfront.net (CloudFront)
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
AMS1-P2
age
316406
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
alt-svc
h3=":443"; ma=86400
last-modified
Mon, 15 Jul 2024 22:20:39 GMT
server
cloudflare
etag
W/"8972ae5004bc634ffa6641be3960e78a"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
text/css
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ceqCF186mIik4bFAsmwTJJFOOFi1VQ4v18w%2BLOZKe0MWu8wHKRNeTO6jeLdcTe6XKeOuXJ6rAXYbOakamEqNTFqeNGFLAWWnymh8XoniCsV2Z%2FVLsDLcUjTsByoUoG9doEDUOAbRhw%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=31556926
vary
Accept-Encoding
cf-ray
8ae04bfafdc096f8-AMS
access-control-allow-headers
fa-kit-token
x-amz-cf-id
lFbXXOHcJNj2cqEw1QadqcnaWJKfcIgChC3kSX3u2RxgQeiwFrj5og==
free-v4-font-face.min.css
ka-f.fontawesome.com/releases/v6.6.0/css/
2 KB
1 KB
Fetch
General
Full URL
https://ka-f.fontawesome.com/releases/v6.6.0/css/free-v4-font-face.min.css?token=363d4a4d7b
Requested by
Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/363d4a4d7b.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.139.119 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ddfbe9ee1f7088339a85fa25a259765ade4258c082a7921b9f569ff9616f904a

Request headers

Referer
https://levering-tracking.net/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Sun, 04 Aug 2024 17:34:11 GMT
content-encoding
gzip
via
1.1 cf8597852fd073f5b8e6fed4908fe46e.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
AMS1-P2
age
316406
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
alt-svc
h3=":443"; ma=86400
last-modified
Mon, 15 Jul 2024 22:20:39 GMT
server
cloudflare
etag
W/"a5a0c9048efb7cb5df90023064d09ba4"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
text/css
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OJXI0o8Yv3sUPvkDtbNHE31%2BxV07qQK%2BDpROcH%2F3Hb71MkOACPFwOjfJ0L%2B6I7h%2Bm0o41YatOgRQgI5ssvwihmKwhkkSBmIfOgqD3TFJRK7Uk0t3X5qx4GwIVfHox2BdYZAQln3JFQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=31556926
vary
Accept-Encoding
cf-ray
8ae04bfafdbd96f8-AMS
access-control-allow-headers
fa-kit-token
x-amz-cf-id
A4Sx3ucW0qbo9ytT_Wx2lUxpLHz1nAmjhXmUfGAFW8G340QO6Wh9iQ==
truncated
/
476 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4bee6952e3c65ca306993ac329e88cd15ae16205a3562085177910f666820232

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type
image/svg+xml
find-location-returns-G-appteaser-1358036008-Q422-MQ.png
www.ups.com/assets/resources/webcontent/images/
28 KB
28 KB
Image
General
Full URL
https://www.ups.com/assets/resources/webcontent/images/find-location-returns-G-appteaser-1358036008-Q422-MQ.png
Requested by
Host: levering-tracking.net
URL: https://levering-tracking.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:480:5b8::353a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Akamai Image Manager /
Resource Hash
7f1107318d09848819a9b52f5fa921bda2a652a9a31a6898b6f4f1ea69d5a68e
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://levering-tracking.net/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Sun, 04 Aug 2024 17:34:11 GMT
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Thu, 13 Apr 2023 00:39:55 GMT
server
Akamai Image Manager
x-frame-options
SAMEORIGIN
content-type
image/avif
cache-control
private, no-transform, max-age=43200
server-timing
cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1722792851668_35115194_56129638_72_12122_21_0_146";dur=1
content-length
28649
x-xss-protection
1; mode=block
expires
Mon, 05 Aug 2024 05:34:11 GMT
how-to-ship-package-B-1219741-Q123.jpg
www.ups.com/assets/resources/webcontent/images/
51 KB
51 KB
Image
General
Full URL
https://www.ups.com/assets/resources/webcontent/images/how-to-ship-package-B-1219741-Q123.jpg
Requested by
Host: levering-tracking.net
URL: https://levering-tracking.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:480:5b8::353a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Akamai Image Manager /
Resource Hash
b8d445634b92fafabd359305e3b45f4b096e74b12988a230501cced71359c703
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://levering-tracking.net/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Sun, 04 Aug 2024 17:34:11 GMT
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Thu, 13 Apr 2023 00:40:11 GMT
x-serial
1572
server
Akamai Image Manager
x-check-cacheable
YES
x-frame-options
SAMEORIGIN
content-type
image/avif
cache-control
private, no-transform, max-age=43200
server-timing
cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1722792851667_35115194_56129639_45_12353_21_0_146";dur=1
content-length
51793
x-xss-protection
1; mode=block
expires
Mon, 05 Aug 2024 05:34:11 GMT
my-choice-for-business-hero-G-1195053380-Q422.jpg
www.ups.com/assets/resources/webcontent/images/
48 KB
49 KB
Image
General
Full URL
https://www.ups.com/assets/resources/webcontent/images/my-choice-for-business-hero-G-1195053380-Q422.jpg
Requested by
Host: levering-tracking.net
URL: https://levering-tracking.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:480:5b8::353a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Akamai Image Manager /
Resource Hash
4c6ff4fc7f370d5b6362881947696e01da612c312a647654621f9b11840c2d02
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://levering-tracking.net/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Sun, 04 Aug 2024 17:34:11 GMT
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-content-type-options
nosniff
x-check-cacheable
YES
x-serial
302
server
Akamai Image Manager
last-modified
Tue, 15 Nov 2022 21:46:19 GMT
x-frame-options
SAMEORIGIN
content-type
image/webp
cache-control
private, no-transform, max-age=43200
server-timing
cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1722792851667_35115194_56129640_44_12411_21_0_146";dur=1
content-length
49544
x-xss-protection
1; mode=block
expires
Mon, 05 Aug 2024 05:34:11 GMT
favicon.ico
levering-tracking.net/
808 B
501 B
Other
General
Full URL
https://levering-tracking.net/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
91.212.166.145 , Russian Federation, ASN198953 (PROTON66, RU),
Reverse DNS
Software
nginx /
Resource Hash
b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187

Request headers

Referer
https://levering-tracking.net/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Sun, 04 Aug 2024 17:34:11 GMT
content-encoding
br
last-modified
Sat, 20 Jul 2024 21:43:25 GMT
server
nginx
etag
W/"328-61db4b3a717b5"
content-type
text/html

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
www.ups.com
URL
https://www.ups.com/assets/resources/webcontent/styles/fonts/Roboto-Regular.woff
Domain
www.ups.com
URL
https://www.ups.com/assets/resources/webcontent/styles/fonts/Roboto-Regular.woff2
Domain
www.ups.com
URL
https://www.ups.com/assets/resources/webcontent/styles/fonts/Roboto-Regular.ttf
Domain
www.ups.com
URL
https://www.ups.com/assets/resources/webcontent/styles/fonts/Roboto-Medium.woff
Domain
www.ups.com
URL
https://www.ups.com/assets/resources/webcontent/styles/fonts/Roboto-Medium.woff2
Domain
www.ups.com
URL
https://www.ups.com/assets/resources/webcontent/styles/fonts/Roboto-Medium.ttf
Domain
www.ups.com
URL
https://www.ups.com/assets/resources/webcontent/styles/fonts/Roboto-Bold.woff
Domain
www.ups.com
URL
https://www.ups.com/assets/resources/webcontent/styles/fonts/Roboto-Bold.woff2
Domain
www.ups.com
URL
https://www.ups.com/assets/resources/webcontent/styles/fonts/Roboto-Bold.ttf

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: UPS (Transportation)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| FontAwesomeKitConfig

1 Cookies

Domain/Path Name / Value
levering-tracking.net/ Name: PHPSESSID
Value: us054fbdfeet7bm1j2f4a2im0c

24 Console Messages

Source Level URL
Text
rendering warning URL: https://levering-tracking.net/(Line 19)
Message:
Error parsing a meta element's content: ';' is not a valid key-value pair separator. Please use ',' instead.
network error URL: https://levering-tracking.net/assets/resources/webcontent/styles/fonts/Roboto-Light.ttf
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://levering-tracking.net/_onelink_/ups/sites/www.ups.com/onelink.css?ts=20211109
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://levering-tracking.net/_onelink_/ups/sites/www.ups.com/en2engb/onelink.css?ts=20210305
Message:
Failed to load resource: the server responded with a status of 404 ()
javascript error URL: https://levering-tracking.net/
Message:
Access to font at 'https://www.ups.com/assets/resources/webcontent/styles/fonts/Roboto-Bold.woff2' from origin 'https://levering-tracking.net' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://www.ups.com/assets/resources/webcontent/styles/fonts/Roboto-Bold.woff2
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://levering-tracking.net/
Message:
Access to font at 'https://www.ups.com/assets/resources/webcontent/styles/fonts/Roboto-Bold.woff' from origin 'https://levering-tracking.net' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://www.ups.com/assets/resources/webcontent/styles/fonts/Roboto-Bold.woff
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://levering-tracking.net/
Message:
Access to font at 'https://www.ups.com/assets/resources/webcontent/styles/fonts/Roboto-Medium.woff2' from origin 'https://levering-tracking.net' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://www.ups.com/assets/resources/webcontent/styles/fonts/Roboto-Medium.woff2
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://levering-tracking.net/(Line 205)
Message:
Access to font at 'https://www.ups.com/assets/resources/webcontent/styles/fonts/Roboto-Regular.woff' from origin 'https://levering-tracking.net' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://www.ups.com/assets/resources/webcontent/styles/fonts/Roboto-Regular.woff
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://levering-tracking.net/
Message:
Access to font at 'https://www.ups.com/assets/resources/webcontent/styles/fonts/Roboto-Bold.ttf' from origin 'https://levering-tracking.net' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://www.ups.com/assets/resources/webcontent/styles/fonts/Roboto-Bold.ttf
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://levering-tracking.net/
Message:
Access to font at 'https://www.ups.com/assets/resources/webcontent/styles/fonts/Roboto-Regular.ttf' from origin 'https://levering-tracking.net' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://www.ups.com/assets/resources/webcontent/styles/fonts/Roboto-Regular.ttf
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://levering-tracking.net/
Message:
Access to font at 'https://www.ups.com/assets/resources/webcontent/styles/fonts/Roboto-Medium.woff' from origin 'https://levering-tracking.net' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://www.ups.com/assets/resources/webcontent/styles/fonts/Roboto-Medium.woff
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://levering-tracking.net/
Message:
Access to font at 'https://www.ups.com/assets/resources/webcontent/styles/fonts/Roboto-Medium.ttf' from origin 'https://levering-tracking.net' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://www.ups.com/assets/resources/webcontent/styles/fonts/Roboto-Medium.ttf
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://levering-tracking.net/
Message:
Access to font at 'https://www.ups.com/assets/resources/webcontent/styles/fonts/Roboto-Regular.woff2' from origin 'https://levering-tracking.net' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://www.ups.com/assets/resources/webcontent/styles/fonts/Roboto-Regular.woff2
Message:
Failed to load resource: net::ERR_FAILED
network error URL: https://levering-tracking.net/favicon.ico
Message:
Failed to load resource: the server responded with a status of 404 ()
javascript warning URL: https://levering-tracking.net/
Message:
The resource https://levering-tracking.net/assets/resources/webcontent/styles/fonts/Roboto-Light.ttf was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.