uoty.rskpppfp.top - urlscan.io

Summary

This website contacted 1 IPs in 1 countries across 2 domains to perform 7 HTTP transactions. The main IP is 2606:4700:3036::6815:2d1e, located in United States and belongs to CLOUDFLARENET, US. The main domain is uoty.rskpppfp.top.
TLS certificate: Issued by WE1 on August 18th 2024. Valid for: 3 months.

This is the only time uoty.rskpppfp.top was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: USPS (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2606:4700:10:... 2606:4700:10::ac43:8ee	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	2606:4700:303... 2606:4700:3036::6815:2d1e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	1

1 2606:4700:10::ac43:8ee (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

cutt.ly	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2606:4700:3036::6815:2d1e (United States)

ASN13335 (CLOUDFLARENET, US)

uoty.rskpppfp.top	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	rskpppfp.top uoty.rskpppfp.top	21 KB
1	cutt.ly 1 redirects cutt.ly — Cisco Umbrella Rank: 43283	423 B
7	2

	Domain	Requested by
7	uoty.rskpppfp.top	uoty.rskpppfp.top
1	cutt.ly	1 redirects
7	2

This site contains no links.

Subject Issuer	Validity	Valid
rskpppfp.top WE1	`2024-08-18` - `2024-11-16`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://uoty.rskpppfp.top/size/applicant?url=3&umbrella=45&moon=6f73afe67a8c8f4079&rose=61
Frame ID: CB35AFEEFD97E1BADDD4AA0620065E21
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Loading

Page URL History Show full URLs

https://cutt.ly/TeT7ufu9?tAv=AiEfCTvD79 HTTP 301
https://uoty.rskpppfp.top/size/applicant?url=3&umbrella=45&moon=6f73afe67a8c8f4079&rose=61 Page URL

Page Statistics

7
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

1
IPs

1
Countries

21 kB
Transfer

65 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://cutt.ly/TeT7ufu9?tAv=AiEfCTvD79 HTTP 301
https://uoty.rskpppfp.top/size/applicant?url=3&umbrella=45&moon=6f73afe67a8c8f4079&rose=61 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H3	200	Primary Request applicant Show response uoty.rskpppfp.top/size/ Redirect Chain https://cutt.ly/TeT7ufu9?tAv=AiEfCTvD79 https://uoty.rskpppfp.top/size/applicant?url=3&umbrella=45&moon=6f73afe67a8c8f4079&rose=61	25 KB 6 KB	1003ms 959ms	Document text/html	2606:4700:3036::6815:2d1e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://uoty.rskpppfp.top/size/applicant?url=3&umbrella=45&moon=6f73afe67a8c8f4079&rose=61 Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3036::6815:2d1e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / ASP.NET Resource Hash `18d8f413d35b0b2ec7715dfc4a0091e982877bc8a84fed9b4d8448ba3ba49dc8` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Response headers alt-svc h3=":443"; ma=86400 cache-control private cf-cache-status DYNAMIC cf-ray 8ca3b1ea593a9215-MUC content-encoding br content-type text/html; charset=utf-8 date Sat, 28 Sep 2024 12:21:45 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=awWCg8iCc8Y0N6iQqR6ofvCzBQUbl36B34iQw4t%2BTxAIkrnVEvNCutq8qcUCtAZZv5FEVD0lgDSgcuDS8sk5UyT0s%2F%2BBbf6FnPqcQQnV1mqkQjT1IRmzavVHv6ixQZX2yky5570jFxYRrcb5O2WcWw%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare speculation-rules "/cdn-cgi/speculation" vary Accept-Encoding x-aspnet-version 4.0.30319 x-aspnetmvc-version 5.2 x-powered-by ASP.NET Redirect headers cache-control no-cache, no-store, must-revalidate cf-cache-status DYNAMIC cf-ray 8ca3b1e8bbd692a2-FRA content-type text/html; charset=UTF-8 date Sat, 28 Sep 2024 12:21:44 GMT expires Thu, 19 Nov 1981 08:52:00 GMT location https://uoty.rskpppfp.top/size/applicant?url=3&umbrella=45&moon=6f73afe67a8c8f4079&rose=61 pragma no-cache referrer-policy same-origin server cloudflare strict-transport-security max-age=15552000; includeSubDomains; preload x-content-type-options nosniff x-frame-options SAMEORIGIN x-xss-protection 1; mode=block
GET H3	200	speculation uoty.rskpppfp.top/cdn-cgi/	128 B 578 B	32ms 32ms	Other application/speculationrules+json	2606:4700:3036::6815:2d1e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://uoty.rskpppfp.top/cdn-cgi/speculation Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3036::6815:2d1e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `11a2142988720cd49ff000e5d488493947b3d34821301c5a706b3495b8381f7d` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://uoty.rskpppfp.top Referer https://uoty.rskpppfp.top/size/applicant?url=3&umbrella=45&moon=6f73afe67a8c8f4079&rose=61 Response headers nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jjclZmh0xk7v3ujVj1ZVY8oZRfgHH9b1Q86iwEaUc8KCmbbx6uqQghmKTKz5j7i9RkgvbcWU47a4VtKl%2FReru2D390V%2FfdKaYW%2FGu437%2B2tJCJOELV2c1BiAeHXXzq2pQgdo4RFsOT%2BVwDKUoBJn2g%3D%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8ca3b1f10e579215-MUC access-control-allow-origin https://uoty.rskpppfp.top alt-svc h3=":443"; ma=86400 content-length 128 date Sat, 28 Sep 2024 12:21:45 GMT content-type application/speculationrules+json vary Origin, Accept-Encoding server cloudflare
GET H3	200	5zJWVkQHxuaTR4QGkh0.svg uoty.rskpppfp.top/ca66695e/YyN0fC8qd15z/IS9mKiN6Xm0hZCoqY3wkYyF-fl5nIyVjYmVqKiRzbEAkQHw0IXZ4bmFeLyUleF8jQC/	546 B 749 B	833ms 833ms	Image image/svg+xml	2606:4700:3036::6815:2d1e CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://uoty.rskpppfp.top/ca66695e/YyN0fC8qd15z/IS9mKiN6Xm0hZCoqY3wkYyF-fl5nIyVjYmVqKiRzbEAkQHw0IXZ4bmFeLyUleF8jQC/5zJWVkQHxuaTR4QGkh0.svg Requested by Host: uoty.rskpppfp.top URL: https://uoty.rskpppfp.top/size/applicant?url=3&umbrella=45&moon=6f73afe67a8c8f4079&rose=61 Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3036::6815:2d1e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / ASP.NET Resource Hash `b95f434286744e3dbaf5bc56f41d4ce2640da3038461502f7ac243a5931e9435` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://uoty.rskpppfp.top/size/applicant?url=3&umbrella=45&moon=6f73afe67a8c8f4079&rose=61 Response headers cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding br cf-cache-status MISS etag W/"c8bd85fb53a4da1:0" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mJTuFjzxfAtW%2FFXgzNJpfw28JBA3ARme1M3QgY2yOeG8z0%2BIc5RjdRH4NakCbSscajuWmJaGIsmImXOgDJ2lwr3k0k8uzTI%2Bjvi2pxKzeJ%2BGmLOszApSynu7UrS8SZtn7jgkBGAyI3fa05txqU%2BfFA%3D%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8ca3b1f10e5b9215-MUC date Sat, 28 Sep 2024 12:21:46 GMT content-type image/svg+xml last-modified Sun, 12 May 2024 10:05:56 GMT x-powered-by ASP.NET server cloudflare vary Accept-Encoding
GET H3	200	5zJWVkQHxuaTV4QGkh0.svg uoty.rskpppfp.top/ca66695e/YyN0fC8qd15z/IS9mKiN6Xm0hZCoqY3wkYyF-fl5nIyVjYmVqKiRzbEAkQHw0IXZ4bmFeLyUleF8jQC/	2 KB 1 KB	847ms 846ms	Image image/svg+xml	2606:4700:3036::6815:2d1e CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://uoty.rskpppfp.top/ca66695e/YyN0fC8qd15z/IS9mKiN6Xm0hZCoqY3wkYyF-fl5nIyVjYmVqKiRzbEAkQHw0IXZ4bmFeLyUleF8jQC/5zJWVkQHxuaTV4QGkh0.svg Requested by Host: uoty.rskpppfp.top URL: https://uoty.rskpppfp.top/size/applicant?url=3&umbrella=45&moon=6f73afe67a8c8f4079&rose=61 Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3036::6815:2d1e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / ASP.NET Resource Hash `9685d6241f41ac71741d0ee9b242779f640cd3b1e64bb9bbcfb8798c5be503b2` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://uoty.rskpppfp.top/size/applicant?url=3&umbrella=45&moon=6f73afe67a8c8f4079&rose=61 Response headers cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding br cf-cache-status MISS etag W/"ade485fb53a4da1:0" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5cOb3TYbb9V0TjgtJmfrcfqku%2FX%2FhjeNJITacUsnqvsXKt39o8lobna7wwp7nAGXWzmIEDt1mzXcbIK27%2FrnWvZzuxZ8%2BEUF5BSrUymFgUwYDt45RZSiDM8Xoq6ImcfaN8cq2yDdrLyk6MRWJGZRww%3D%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8ca3b1f13e7c9215-MUC date Sat, 28 Sep 2024 12:21:46 GMT content-type image/svg+xml last-modified Sun, 12 May 2024 10:05:56 GMT x-powered-by ASP.NET server cloudflare vary Accept-Encoding
GET H3	200	3dm54JXRnZiFzfGkqZGMqIw2.svg uoty.rskpppfp.top/ca66695e/I0BAfi9eaXNf/fCV6JGN4QEBkQHMjeGMkI3wkYjJqfCohbSoqYX4lLi9jZW5eISEhXmwvZSV/	1 KB 1 KB	1362ms 1362ms	Image image/svg+xml	2606:4700:3036::6815:2d1e CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://uoty.rskpppfp.top/ca66695e/I0BAfi9eaXNf/fCV6JGN4QEBkQHMjeGMkI3wkYjJqfCohbSoqYX4lLi9jZW5eISEhXmwvZSV/3dm54JXRnZiFzfGkqZGMqIw2.svg Requested by Host: uoty.rskpppfp.top URL: https://uoty.rskpppfp.top/size/applicant?url=3&umbrella=45&moon=6f73afe67a8c8f4079&rose=61 Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3036::6815:2d1e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / ASP.NET Resource Hash `c8b13b10e28b6b420151db578831a416b7c1805d7672eeb57e69dc697fda1e27` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://uoty.rskpppfp.top/size/applicant?url=3&umbrella=45&moon=6f73afe67a8c8f4079&rose=61 Response headers cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding br cf-cache-status MISS etag W/"697583fb53a4da1:0" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FICco7Uk0AnKOWSt%2B3x8VSMc6YVBpwW8HN9Z1IIO5qQP1wG0IQhhCNqsJgeTQBxxRLgUgGx4OTB6PmC7jqoXCUOkcvJVrW9ntBuVA1JPOLfvx1n7Tg9Mcnex7WskUK4OI%2Fr33BxqWcSGUFNScbl%2FCA%3D%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8ca3b1f10e5f9215-MUC date Sat, 28 Sep 2024 12:21:47 GMT content-type image/svg+xml last-modified Sun, 12 May 2024 10:05:56 GMT x-powered-by ASP.NET server cloudflare vary Accept-Encoding
GET H3	200	kxJGJnM3wlJWpeXiNAbWFfIyN4JA2.png uoty.rskpppfp.top/ca66695e/eCF6YyovIWNu/fiF8aXohfnwvJSM3R2xkQCN3JF5jJSN-c2NhJGRmfiR4bl5waWMqKnNeLjRuXmVAIXR4OS9lfCpAaiohQGMlI2/	5 KB 6 KB	846ms 846ms	Image image/png	2606:4700:3036::6815:2d1e CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://uoty.rskpppfp.top/ca66695e/eCF6YyovIWNu/fiF8aXohfnwvJSM3R2xkQCN3JF5jJSN-c2NhJGRmfiR4bl5waWMqKnNeLjRuXmVAIXR4OS9lfCpAaiohQGMlI2/kxJGJnM3wlJWpeXiNAbWFfIyN4JA2.png Requested by Host: uoty.rskpppfp.top URL: https://uoty.rskpppfp.top/size/applicant?url=3&umbrella=45&moon=6f73afe67a8c8f4079&rose=61 Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3036::6815:2d1e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / ASP.NET Resource Hash `1cc43a97be92fddf0fe4244858f5337c80a8d350cd0afcd0c4d2004d3fded0ab` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://uoty.rskpppfp.top/size/applicant?url=3&umbrella=45&moon=6f73afe67a8c8f4079&rose=61 Response headers cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-cache-status MISS etag "617db2162a4da1:0" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GW8vMFyQsYKRqHQm%2BKrOJROz%2FfCmJN16fFIxu%2BKTnEa2TB92HsEuO%2B0yukGwY1vv%2FUZz5pHO%2FVmzxuj3Gz5yckOhB4SmNv2t%2BACI1Yt3k2VEhX9t8jfcTNJUReECBvvYiB0NEOEPSXlBJdSMZihjww%3D%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8ca3b1f13e7b9215-MUC accept-ranges bytes content-length 5390 date Sat, 28 Sep 2024 12:21:46 GMT content-type image/png last-modified Sun, 12 May 2024 11:47:14 GMT x-powered-by ASP.NET server cloudflare vary Accept-Encoding
GET H3	200	favicon.ico uoty.rskpppfp.top/	31 KB 6 KB	1083ms 1082ms	Other image/x-icon	2606:4700:3036::6815:2d1e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://uoty.rskpppfp.top/favicon.ico Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3036::6815:2d1e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / ASP.NET Resource Hash `67fbe8ef9020e5c776aadf6801a1fef8dc563e2e4dc9ddc740af8010c0c38943` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://uoty.rskpppfp.top/size/applicant?url=3&umbrella=45&moon=6f73afe67a8c8f4079&rose=61 Response headers cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding br cf-cache-status MISS etag W/"8d495b9e8623da1:0" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sGUGJlGmTcsIUqfDqDRMKU9ppJ6GmqtwiRpEUPgYGnAg4oVCjNI0G4TWU3wjQscme5FlNyRB%2FmdIpFZSp4MxDf9m9e5ldSopREF8wrNmUKXQ%2B1RDRHQbzjuskL%2Bw9hr4AsPi80GdvC5%2Bhn6uE1BvEA%3D%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8ca3b1f99d9d9215-MUC alt-svc h3=":443"; ma=86400 date Sat, 28 Sep 2024 12:21:48 GMT content-type image/x-icon last-modified Thu, 30 Nov 2023 12:13:25 GMT x-powered-by ASP.NET server cloudflare vary Accept-Encoding

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: USPS (Transportation)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			cutt.ly/	1969-12-31 23:59:59	Name: PHPSESSID Value: jqokfsms0gfetb0dn8g6ekqh3j
			uoty.rskpppfp.top/	1969-12-31 23:59:59	Name: ASP.NET_SessionId Value: ngenuk20avo0qkhuoxgsmmvx

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cutt.ly
uoty.rskpppfp.top
2606:4700:10::ac43:8ee
2606:4700:3036::6815:2d1e
11a2142988720cd49ff000e5d488493947b3d34821301c5a706b3495b8381f7d
18d8f413d35b0b2ec7715dfc4a0091e982877bc8a84fed9b4d8448ba3ba49dc8
1cc43a97be92fddf0fe4244858f5337c80a8d350cd0afcd0c4d2004d3fded0ab
67fbe8ef9020e5c776aadf6801a1fef8dc563e2e4dc9ddc740af8010c0c38943
9685d6241f41ac71741d0ee9b242779f640cd3b1e64bb9bbcfb8798c5be503b2
b95f434286744e3dbaf5bc56f41d4ce2640da3038461502f7ac243a5931e9435
c8b13b10e28b6b420151db578831a416b7c1805d7672eeb57e69dc697fda1e27

uoty.rskpppfp.top Open in urlscan Pro 2606:4700:3036::6815:2d1e Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

7 Requests

100 %HTTPS

100 %IPv6

2 Domains

2 Subdomains

1 IPs

1 Countries

21 kBTransfer

65 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

2 Cookies

Indicators

uoty.rskpppfp.top Open in urlscan Pro
2606:4700:3036::6815:2d1e Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

1
IPs

1
Countries

21 kB
Transfer

65 kB
Size

2
Cookies

7 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!