blueksafari.com Open in urlscan Pro
157.7.107.69 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://kameidotenjin.or.jp/mailformpro/mfp.statics/audios/892374827321738912738789373/
Effective URL:
https://blueksafari.com/first/wz87678236727836278368373/ups/autil/index.php?u=358886
Submission: On July 04 via manual (July 4th 2023, 3:25:44 am UTC) from IN — Scanned from JP

Summary HTTP 20 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 20 HTTP transactions. The main IP is 157.7.107.69, located in Naritahigashi, Japan and belongs to INTERQ GMO Internet,Inc, JP. The main domain is blueksafari.com.
TLS certificate: Issued by R3 on May 13th 2023. Valid for: 3 months.

This is the only time blueksafari.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: UPS (Transportation)

Domain & IP information

	IP Address		AS Autonomous System
20	157.7.107.69 157.7.107.69		7506 (INTERQ GM...) (INTERQ GMO Internet)
20	2

20 157.7.107.69 (Naritahigashi, Japan)

ASN7506 (INTERQ GMO Internet,Inc, JP)
PTR: 157-7-107-69.virt.lolipop.jp

kameidotenjin.or.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
blueksafari.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
19	blueksafari.com blueksafari.com	321 KB
1	kameidotenjin.or.jp kameidotenjin.or.jp	390 B
20	2

	Domain	Requested by
19	blueksafari.com	blueksafari.com
1	kameidotenjin.or.jp
20	2

This site contains no links.

Subject Issuer	Validity	Valid
blueksafari.com R3	`2023-05-13` - `2023-08-11`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://blueksafari.com/first/wz87678236727836278368373/ups/autil/index.php?u=358886
Frame ID: C98D4F68DAA654A40AF50224C6B054D4
Requests: 21 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Global Shipping & Logistics Services

Page URL History Show full URLs

http://kameidotenjin.or.jp/mailformpro/mfp.statics/audios/892374827321738912738789373/ Page URL
https://blueksafari.com/first/wz87678236727836278368373/ups/ Page URL
https://blueksafari.com/first/wz87678236727836278368373/ups/autil/index.php?u=358886 Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

AngularJS (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

\bangular.{0,32}\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

20
Requests

95 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

358 kB
Transfer

1535 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://kameidotenjin.or.jp/mailformpro/mfp.statics/audios/892374827321738912738789373/ Page URL
https://blueksafari.com/first/wz87678236727836278368373/ups/ Page URL
https://blueksafari.com/first/wz87678236727836278368373/ups/autil/index.php?u=358886 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

20 HTTP transactions
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	/ Show response kameidotenjin.or.jp/mailformpro/mfp.statics/audios/892374827321738912738789373/	104 B 390 B	24ms 3ms	Document text/html	157.7.107.69 INTERQ GMO Internet
General Check archive.org Show headers Download Go to Full URL http://kameidotenjin.or.jp/mailformpro/mfp.statics/audios/892374827321738912738789373/ Protocol HTTP/1.1 Server 157.7.107.69 Naritahigashi, Japan, ASN7506 (INTERQ GMO Internet,Inc, JP), Reverse DNS 157-7-107-69.virt.lolipop.jp Software Apache / PHP/5.6.21 Resource Hash `da01383d20280b6e53e0698da991296d059f00b612a38f02a40876a96a7900a2` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 accept-language jp-JP,jp;q=0.9 Response headers Accept-Ranges bytes Connection keep-alive Content-Encoding gzip Content-Length 118 Content-Type text/html; charset=UTF-8 Date Tue, 04 Jul 2023 03:25:36 GMT Server Apache Vary Range,Accept-Encoding X-Cache HIT X-Powered-By PHP/5.6.21
GET H2	200	/ blueksafari.com/first/wz87678236727836278368373/ups/	334 B 385 B	29ms 8ms	Document text/html	157.7.107.69 INTERQ GMO Internet
General Check archive.org Show headers Download Go to Full URL https://blueksafari.com/first/wz87678236727836278368373/ups/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 157.7.107.69 Naritahigashi, Japan, ASN7506 (INTERQ GMO Internet,Inc, JP), Reverse DNS 157-7-107-69.virt.lolipop.jp Software Apache / PHP/5.6.21 Resource Hash Request headers Referer http://kameidotenjin.or.jp/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 accept-language jp-JP,jp;q=0.9 Response headers accept-ranges bytes content-encoding gzip content-length 207 content-type text/html; charset=UTF-8 date Tue, 04 Jul 2023 03:25:36 GMT server Apache vary Range,Accept-Encoding x-cache HIT x-powered-by PHP/5.6.21
GET H2	200	Primary Request index.php Show response blueksafari.com/first/wz87678236727836278368373/ups/autil/	21 KB 4 KB	2143ms 2142ms	Document text/html	157.7.107.69 INTERQ GMO Internet
General Check archive.org Show headers Download Go to Full URL https://blueksafari.com/first/wz87678236727836278368373/ups/autil/index.php?u=358886 Requested by Host: blueksafari.com URL: https://blueksafari.com/first/wz87678236727836278368373/ups/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 157.7.107.69 Naritahigashi, Japan, ASN7506 (INTERQ GMO Internet,Inc, JP), Reverse DNS 157-7-107-69.virt.lolipop.jp Software Apache / PHP/5.6.21 Resource Hash `e5d83b6a16f9ecd37b07b2066baf6dc89677d4995f968e44d5ecb3b17cee70b2` Request headers Referer https://blueksafari.com/first/wz87678236727836278368373/ups/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 accept-language jp-JP,jp;q=0.9 Response headers accept-ranges none cache-control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 content-encoding gzip content-length 3888 content-type text/html; charset=UTF-8 date Tue, 04 Jul 2023 03:25:38 GMT expires Thu, 19 Nov 1981 08:52:00 GMT pragma no-cache server Apache vary Range,Accept-Encoding x-cache MISS x-powered-by PHP/5.6.21
GET H2	200	ups.vendor.54f3c2d83b58.css blueksafari.com/first/wz87678236727836278368373/ups/autil/file/	134 KB 22 KB	50ms 48ms	Stylesheet text/css	157.7.107.69 INTERQ GMO Internet
General Check archive.org Show headers Download Go to Full URL https://blueksafari.com/first/wz87678236727836278368373/ups/autil/file/ups.vendor.54f3c2d83b58.css Requested by Host: blueksafari.com URL: https://blueksafari.com/first/wz87678236727836278368373/ups/autil/index.php?u=358886 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 157.7.107.69 Naritahigashi, Japan, ASN7506 (INTERQ GMO Internet,Inc, JP), Reverse DNS 157-7-107-69.virt.lolipop.jp Software Apache / Resource Hash `45e8aa7ebbca7aa7be5e368b6b3bbb80c5f10fdccadfe603d9126c151991d022` Request headers accept-language jp-JP,jp;q=0.9 Referer https://blueksafari.com/first/wz87678236727836278368373/ups/autil/index.php?u=358886 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Tue, 04 Jul 2023 03:25:38 GMT content-encoding gzip last-modified Wed, 02 Mar 2022 14:50:40 GMT server Apache vary Range,Accept-Encoding x-cache EXPIRED content-type text/css accept-ranges bytes content-length 22638
GET H2	200	ups.styles.64d519c676ed.css blueksafari.com/first/wz87678236727836278368373/ups/autil/file/	232 KB 100 KB	63ms 61ms	Stylesheet text/css	157.7.107.69 INTERQ GMO Internet
General Check archive.org Show headers Download Go to Full URL https://blueksafari.com/first/wz87678236727836278368373/ups/autil/file/ups.styles.64d519c676ed.css Requested by Host: blueksafari.com URL: https://blueksafari.com/first/wz87678236727836278368373/ups/autil/index.php?u=358886 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 157.7.107.69 Naritahigashi, Japan, ASN7506 (INTERQ GMO Internet,Inc, JP), Reverse DNS 157-7-107-69.virt.lolipop.jp Software Apache / Resource Hash `39ecde52b702df018994ef489ef5169623e63a4fe1d44a239f6e10d98ea6370f` Request headers accept-language jp-JP,jp;q=0.9 Referer https://blueksafari.com/first/wz87678236727836278368373/ups/autil/index.php?u=358886 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Tue, 04 Jul 2023 03:25:38 GMT content-encoding gzip last-modified Wed, 02 Mar 2022 14:50:40 GMT server Apache vary Range,Accept-Encoding x-cache EXPIRED content-type text/css
GET H2	200	ups.modules.6bb4323d192a.css blueksafari.com/first/wz87678236727836278368373/ups/autil/file/	741 KB 83 KB	64ms 63ms	Stylesheet text/css	157.7.107.69 INTERQ GMO Internet
General Check archive.org Show headers Download Go to Full URL https://blueksafari.com/first/wz87678236727836278368373/ups/autil/file/ups.modules.6bb4323d192a.css Requested by Host: blueksafari.com URL: https://blueksafari.com/first/wz87678236727836278368373/ups/autil/index.php?u=358886 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 157.7.107.69 Naritahigashi, Japan, ASN7506 (INTERQ GMO Internet,Inc, JP), Reverse DNS 157-7-107-69.virt.lolipop.jp Software Apache / Resource Hash `60e5b9f226bd4b00026f6fb027180ee7de99492942fae72aff3e4b9d1dc2d9ce` Request headers accept-language jp-JP,jp;q=0.9 Referer https://blueksafari.com/first/wz87678236727836278368373/ups/autil/index.php?u=358886 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Tue, 04 Jul 2023 03:25:38 GMT content-encoding gzip last-modified Wed, 02 Mar 2022 14:50:40 GMT server Apache vary Range,Accept-Encoding x-cache EXPIRED content-type text/css
GET H2	200	ups.widgets.7e2315c2b219.css blueksafari.com/first/wz87678236727836278368373/ups/autil/file/	70 KB 9 KB	41ms 40ms	Stylesheet text/css	157.7.107.69 INTERQ GMO Internet
General Check archive.org Show headers Download Go to Full URL https://blueksafari.com/first/wz87678236727836278368373/ups/autil/file/ups.widgets.7e2315c2b219.css Requested by Host: blueksafari.com URL: https://blueksafari.com/first/wz87678236727836278368373/ups/autil/index.php?u=358886 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 157.7.107.69 Naritahigashi, Japan, ASN7506 (INTERQ GMO Internet,Inc, JP), Reverse DNS 157-7-107-69.virt.lolipop.jp Software Apache / Resource Hash `cc04ef6b45a2e576cc574a68240efb7fcec45c5f99b88c7efc2db18dd5bd5a69` Request headers accept-language jp-JP,jp;q=0.9 Referer https://blueksafari.com/first/wz87678236727836278368373/ups/autil/index.php?u=358886 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Tue, 04 Jul 2023 03:25:38 GMT content-encoding gzip last-modified Thu, 03 Mar 2022 09:00:00 GMT server Apache vary Range,Accept-Encoding x-cache EXPIRED content-type text/css accept-ranges bytes content-length 8724
GET H2	200	UPS_logo.svg blueksafari.com/first/wz87678236727836278368373/ups/autil/file/	2 KB 1 KB	45ms 43ms	Image image/svg+xml	157.7.107.69 INTERQ GMO Internet
General Check archive.org Show headers Download Go to Show image Full URL https://blueksafari.com/first/wz87678236727836278368373/ups/autil/file/UPS_logo.svg Requested by Host: blueksafari.com URL: https://blueksafari.com/first/wz87678236727836278368373/ups/autil/index.php?u=358886 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 157.7.107.69 Naritahigashi, Japan, ASN7506 (INTERQ GMO Internet,Inc, JP), Reverse DNS 157-7-107-69.virt.lolipop.jp Software Apache / Resource Hash `a416370f6f98339e7edf9fe2c70a45bf9cfba93c0520921db47d15c27934ba88` Request headers accept-language jp-JP,jp;q=0.9 Referer https://blueksafari.com/first/wz87678236727836278368373/ups/autil/index.php?u=358886 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Tue, 04 Jul 2023 03:25:38 GMT content-encoding gzip last-modified Wed, 02 Mar 2022 14:50:44 GMT server Apache vary Range,Accept-Encoding x-cache MISS content-type image/svg+xml accept-ranges bytes content-length 1166
GET H2	200	jquery.min.js Show response blueksafari.com/first/wz87678236727836278368373/ups/autil/file/	95 KB 33 KB	42ms 39ms	Script application/javascript	157.7.107.69 INTERQ GMO Internet
General Check archive.org Show headers Download Go to Full URL https://blueksafari.com/first/wz87678236727836278368373/ups/autil/file/jquery.min.js Requested by Host: blueksafari.com URL: https://blueksafari.com/first/wz87678236727836278368373/ups/autil/index.php?u=358886 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 157.7.107.69 Naritahigashi, Japan, ASN7506 (INTERQ GMO Internet,Inc, JP), Reverse DNS 157-7-107-69.virt.lolipop.jp Software Apache / Resource Hash `668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404` Request headers accept-language jp-JP,jp;q=0.9 Referer https://blueksafari.com/first/wz87678236727836278368373/ups/autil/index.php?u=358886 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Tue, 04 Jul 2023 03:25:38 GMT content-encoding gzip last-modified Sun, 05 Dec 2021 22:29:12 GMT server Apache vary Range,Accept-Encoding x-cache EXPIRED content-type application/javascript accept-ranges bytes content-length 33760
GET H2	200	angular.min.js Show response blueksafari.com/first/wz87678236727836278368373/ups/autil/file/	172 KB 61 KB	47ms 45ms	Script application/javascript	157.7.107.69 INTERQ GMO Internet
General Check archive.org Show headers Download Go to Full URL https://blueksafari.com/first/wz87678236727836278368373/ups/autil/file/angular.min.js Requested by Host: blueksafari.com URL: https://blueksafari.com/first/wz87678236727836278368373/ups/autil/index.php?u=358886 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 157.7.107.69 Naritahigashi, Japan, ASN7506 (INTERQ GMO Internet,Inc, JP), Reverse DNS 157-7-107-69.virt.lolipop.jp Software Apache / Resource Hash `42f2148d4e455055a087b69e1f429de6432665922a74751311678a5086249e74` Request headers accept-language jp-JP,jp;q=0.9 Referer https://blueksafari.com/first/wz87678236727836278368373/ups/autil/index.php?u=358886 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Tue, 04 Jul 2023 03:25:38 GMT content-encoding gzip last-modified Wed, 04 Mar 2020 09:11:16 GMT server Apache vary Range,Accept-Encoding x-cache EXPIRED content-type application/javascript
GET H2	200	dirPaginate.js Show response blueksafari.com/first/wz87678236727836278368373/ups/autil/file/	31 KB 7 KB	38ms 36ms	Script application/javascript	157.7.107.69 INTERQ GMO Internet
General Check archive.org Show headers Download Go to Full URL https://blueksafari.com/first/wz87678236727836278368373/ups/autil/file/dirPaginate.js Requested by Host: blueksafari.com URL: https://blueksafari.com/first/wz87678236727836278368373/ups/autil/index.php?u=358886 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 157.7.107.69 Naritahigashi, Japan, ASN7506 (INTERQ GMO Internet,Inc, JP), Reverse DNS 157-7-107-69.virt.lolipop.jp Software Apache / Resource Hash `e61051ec0d6e12fc9d8eaf3cd4d15155f3d8de676ffe7d39f84933398875d8c8` Request headers accept-language jp-JP,jp;q=0.9 Referer https://blueksafari.com/first/wz87678236727836278368373/ups/autil/index.php?u=358886 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Tue, 04 Jul 2023 03:25:38 GMT content-encoding gzip last-modified Sun, 15 Nov 2020 07:00:28 GMT server Apache vary Range,Accept-Encoding x-cache EXPIRED content-type application/javascript accept-ranges bytes content-length 6745
GET DATA	200 OK	truncated /	36 KB 36 KB		Font application/x-font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `a48e55eba408d92c3a2653ca845937678c75eabe60cad691debf89c0a2b94872` Request headers Referer Origin https://blueksafari.com accept-language jp-JP,jp;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers Content-Type application/x-font-woff;charset=utf-8
GET H2	404	Roboto-Regular.woff blueksafari.com/assets/resources/styles/fonts/	0 0	457ms 456ms	Font text/html	157.7.107.69 INTERQ GMO Internet
General Check archive.org Show headers Download Go to Full URL https://blueksafari.com/assets/resources/styles/fonts/Roboto-Regular.woff Requested by Host: blueksafari.com URL: https://blueksafari.com/first/wz87678236727836278368373/ups/autil/file/ups.styles.64d519c676ed.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 157.7.107.69 Naritahigashi, Japan, ASN7506 (INTERQ GMO Internet,Inc, JP), Reverse DNS 157-7-107-69.virt.lolipop.jp Software Apache / PHP/5.6.21 Resource Hash Request headers Referer https://blueksafari.com/first/wz87678236727836278368373/ups/autil/file/ups.styles.64d519c676ed.css Origin https://blueksafari.com accept-language jp-JP,jp;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers content-type text/html; charset=UTF-8 date Tue, 04 Jul 2023 03:25:39 GMT cache-control no-cache, must-revalidate, max-age=0 server Apache x-powered-by PHP/5.6.21 link <https://blueksafari.com/wp-json/>; rel="https://api.w.org/" expires Wed, 11 Jan 1984 05:00:00 GMT
GET H2	404	Roboto-Medium.woff blueksafari.com/assets/resources/styles/fonts/	0 0	427ms 427ms	Font text/html	157.7.107.69 INTERQ GMO Internet
General Check archive.org Show headers Download Go to Full URL https://blueksafari.com/assets/resources/styles/fonts/Roboto-Medium.woff Requested by Host: blueksafari.com URL: https://blueksafari.com/first/wz87678236727836278368373/ups/autil/file/ups.styles.64d519c676ed.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 157.7.107.69 Naritahigashi, Japan, ASN7506 (INTERQ GMO Internet,Inc, JP), Reverse DNS 157-7-107-69.virt.lolipop.jp Software Apache / PHP/5.6.21 Resource Hash Request headers Referer https://blueksafari.com/first/wz87678236727836278368373/ups/autil/file/ups.styles.64d519c676ed.css Origin https://blueksafari.com accept-language jp-JP,jp;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers content-type text/html; charset=UTF-8 date Tue, 04 Jul 2023 03:25:39 GMT cache-control no-cache, must-revalidate, max-age=0 server Apache x-powered-by PHP/5.6.21 link <https://blueksafari.com/wp-json/>; rel="https://api.w.org/" expires Wed, 11 Jan 1984 05:00:00 GMT
GET H2	404	Roboto-Light.woff blueksafari.com/assets/resources/styles/fonts/	0 0	434ms 434ms	Font text/html	157.7.107.69 INTERQ GMO Internet
General Check archive.org Show headers Download Go to Full URL https://blueksafari.com/assets/resources/styles/fonts/Roboto-Light.woff Requested by Host: blueksafari.com URL: https://blueksafari.com/first/wz87678236727836278368373/ups/autil/file/ups.styles.64d519c676ed.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 157.7.107.69 Naritahigashi, Japan, ASN7506 (INTERQ GMO Internet,Inc, JP), Reverse DNS 157-7-107-69.virt.lolipop.jp Software Apache / PHP/5.6.21 Resource Hash Request headers Referer https://blueksafari.com/first/wz87678236727836278368373/ups/autil/file/ups.styles.64d519c676ed.css Origin https://blueksafari.com accept-language jp-JP,jp;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers content-type text/html; charset=UTF-8 date Tue, 04 Jul 2023 03:25:39 GMT cache-control no-cache, must-revalidate, max-age=0 server Apache x-powered-by PHP/5.6.21 link <https://blueksafari.com/wp-json/>; rel="https://api.w.org/" expires Wed, 11 Jan 1984 05:00:00 GMT
GET H2	404	Roboto-Italic.woff blueksafari.com/assets/resources/styles/fonts/	0 0	405ms 405ms	Font text/html	157.7.107.69 INTERQ GMO Internet
General Check archive.org Show headers Download Go to Full URL https://blueksafari.com/assets/resources/styles/fonts/Roboto-Italic.woff Requested by Host: blueksafari.com URL: https://blueksafari.com/first/wz87678236727836278368373/ups/autil/file/ups.styles.64d519c676ed.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 157.7.107.69 Naritahigashi, Japan, ASN7506 (INTERQ GMO Internet,Inc, JP), Reverse DNS 157-7-107-69.virt.lolipop.jp Software Apache / PHP/5.6.21 Resource Hash Request headers Referer https://blueksafari.com/first/wz87678236727836278368373/ups/autil/file/ups.styles.64d519c676ed.css Origin https://blueksafari.com accept-language jp-JP,jp;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers content-type text/html; charset=UTF-8 date Tue, 04 Jul 2023 03:25:39 GMT cache-control no-cache, must-revalidate, max-age=0 server Apache x-powered-by PHP/5.6.21 link <https://blueksafari.com/wp-json/>; rel="https://api.w.org/" expires Wed, 11 Jan 1984 05:00:00 GMT
GET H2	200	device.php Show response blueksafari.com/first/wz87678236727836278368373/ups/autil/config/	342 B 464 B	92ms 92ms	XHR text/html	157.7.107.69 INTERQ GMO Internet
General Check archive.org Show headers Download Go to Full URL https://blueksafari.com/first/wz87678236727836278368373/ups/autil/config/device.php Requested by Host: blueksafari.com URL: https://blueksafari.com/first/wz87678236727836278368373/ups/autil/file/angular.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 157.7.107.69 Naritahigashi, Japan, ASN7506 (INTERQ GMO Internet,Inc, JP), Reverse DNS 157-7-107-69.virt.lolipop.jp Software Apache / PHP/5.6.21 Resource Hash `93d1ceebf3e4165b92504c58e300f0483ade4df272692955444e24563debd4c2` Request headers Accept application/json, text/plain, / Referer https://blueksafari.com/first/wz87678236727836278368373/ups/autil/index.php?u=358886 accept-language jp-JP,jp;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Tue, 04 Jul 2023 03:25:39 GMT content-encoding gzip server Apache x-powered-by PHP/5.6.21 vary Range,Accept-Encoding x-cache MISS content-type text/html; charset=UTF-8 accept-ranges bytes content-length 286
GET H2	404	Roboto-Italic.woff2 blueksafari.com/assets/resources/styles/fonts/	0 0	424ms 423ms	Font text/html	157.7.107.69 INTERQ GMO Internet
General Check archive.org Show headers Download Go to Full URL https://blueksafari.com/assets/resources/styles/fonts/Roboto-Italic.woff2 Requested by Host: blueksafari.com URL: https://blueksafari.com/first/wz87678236727836278368373/ups/autil/file/ups.styles.64d519c676ed.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 157.7.107.69 Naritahigashi, Japan, ASN7506 (INTERQ GMO Internet,Inc, JP), Reverse DNS 157-7-107-69.virt.lolipop.jp Software Apache / PHP/5.6.21 Resource Hash Request headers Referer https://blueksafari.com/first/wz87678236727836278368373/ups/autil/file/ups.styles.64d519c676ed.css Origin https://blueksafari.com accept-language jp-JP,jp;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers content-type text/html; charset=UTF-8 date Tue, 04 Jul 2023 03:25:39 GMT cache-control no-cache, must-revalidate, max-age=0 server Apache x-powered-by PHP/5.6.21 link <https://blueksafari.com/wp-json/>; rel="https://api.w.org/" expires Wed, 11 Jan 1984 05:00:00 GMT
GET H2	404	Roboto-Medium.woff2 blueksafari.com/assets/resources/styles/fonts/	0 0	390ms 389ms	Font text/html	157.7.107.69 INTERQ GMO Internet
General Check archive.org Show headers Download Go to Full URL https://blueksafari.com/assets/resources/styles/fonts/Roboto-Medium.woff2 Requested by Host: blueksafari.com URL: https://blueksafari.com/first/wz87678236727836278368373/ups/autil/file/ups.styles.64d519c676ed.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 157.7.107.69 Naritahigashi, Japan, ASN7506 (INTERQ GMO Internet,Inc, JP), Reverse DNS 157-7-107-69.virt.lolipop.jp Software Apache / PHP/5.6.21 Resource Hash Request headers Referer https://blueksafari.com/first/wz87678236727836278368373/ups/autil/file/ups.styles.64d519c676ed.css Origin https://blueksafari.com accept-language jp-JP,jp;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers content-type text/html; charset=UTF-8 date Tue, 04 Jul 2023 03:25:39 GMT cache-control no-cache, must-revalidate, max-age=0 server Apache x-powered-by PHP/5.6.21 link <https://blueksafari.com/wp-json/>; rel="https://api.w.org/" expires Wed, 11 Jan 1984 05:00:00 GMT
GET H2	404	Roboto-Light.woff2 blueksafari.com/assets/resources/styles/fonts/	0 0	425ms 425ms	Font text/html	157.7.107.69 INTERQ GMO Internet
General Check archive.org Show headers Download Go to Full URL https://blueksafari.com/assets/resources/styles/fonts/Roboto-Light.woff2 Requested by Host: blueksafari.com URL: https://blueksafari.com/first/wz87678236727836278368373/ups/autil/file/ups.styles.64d519c676ed.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 157.7.107.69 Naritahigashi, Japan, ASN7506 (INTERQ GMO Internet,Inc, JP), Reverse DNS 157-7-107-69.virt.lolipop.jp Software Apache / PHP/5.6.21 Resource Hash Request headers Referer https://blueksafari.com/first/wz87678236727836278368373/ups/autil/file/ups.styles.64d519c676ed.css Origin https://blueksafari.com accept-language jp-JP,jp;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers content-type text/html; charset=UTF-8 date Tue, 04 Jul 2023 03:25:39 GMT cache-control no-cache, must-revalidate, max-age=0 server Apache x-powered-by PHP/5.6.21 link <https://blueksafari.com/wp-json/>; rel="https://api.w.org/" expires Wed, 11 Jan 1984 05:00:00 GMT
GET H2	404	Roboto-Regular.woff2 blueksafari.com/assets/resources/styles/fonts/	0 0	430ms 429ms	Font text/html	157.7.107.69 INTERQ GMO Internet
General Check archive.org Show headers Download Go to Full URL https://blueksafari.com/assets/resources/styles/fonts/Roboto-Regular.woff2 Requested by Host: blueksafari.com URL: https://blueksafari.com/first/wz87678236727836278368373/ups/autil/file/ups.styles.64d519c676ed.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 157.7.107.69 Naritahigashi, Japan, ASN7506 (INTERQ GMO Internet,Inc, JP), Reverse DNS 157-7-107-69.virt.lolipop.jp Software Apache / PHP/5.6.21 Resource Hash Request headers Referer https://blueksafari.com/first/wz87678236727836278368373/ups/autil/file/ups.styles.64d519c676ed.css Origin https://blueksafari.com accept-language jp-JP,jp;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers content-type text/html; charset=UTF-8 date Tue, 04 Jul 2023 03:25:39 GMT cache-control no-cache, must-revalidate, max-age=0 server Apache x-powered-by PHP/5.6.21 link <https://blueksafari.com/wp-json/>; rel="https://api.w.org/" expires Wed, 11 Jan 1984 05:00:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: UPS (Transportation)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			blueksafari.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 7i4nve876pnbf2n3dlb1lb8ja5

8 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://blueksafari.com/assets/resources/styles/fonts/Roboto-Italic.woff Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://blueksafari.com/assets/resources/styles/fonts/Roboto-Medium.woff Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://blueksafari.com/assets/resources/styles/fonts/Roboto-Light.woff Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://blueksafari.com/assets/resources/styles/fonts/Roboto-Regular.woff Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://blueksafari.com/assets/resources/styles/fonts/Roboto-Medium.woff2 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://blueksafari.com/assets/resources/styles/fonts/Roboto-Italic.woff2 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://blueksafari.com/assets/resources/styles/fonts/Roboto-Light.woff2 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://blueksafari.com/assets/resources/styles/fonts/Roboto-Regular.woff2 Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

blueksafari.com
kameidotenjin.or.jp
157.7.107.69
39ecde52b702df018994ef489ef5169623e63a4fe1d44a239f6e10d98ea6370f
42f2148d4e455055a087b69e1f429de6432665922a74751311678a5086249e74
45e8aa7ebbca7aa7be5e368b6b3bbb80c5f10fdccadfe603d9126c151991d022
60e5b9f226bd4b00026f6fb027180ee7de99492942fae72aff3e4b9d1dc2d9ce
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
93d1ceebf3e4165b92504c58e300f0483ade4df272692955444e24563debd4c2
a416370f6f98339e7edf9fe2c70a45bf9cfba93c0520921db47d15c27934ba88
a48e55eba408d92c3a2653ca845937678c75eabe60cad691debf89c0a2b94872
cc04ef6b45a2e576cc574a68240efb7fcec45c5f99b88c7efc2db18dd5bd5a69
da01383d20280b6e53e0698da991296d059f00b612a38f02a40876a96a7900a2
e5d83b6a16f9ecd37b07b2066baf6dc89677d4995f968e44d5ecb3b17cee70b2
e61051ec0d6e12fc9d8eaf3cd4d15155f3d8de676ffe7d39f84933398875d8c8

blueksafari.com Open in urlscan Pro 157.7.107.69 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

20 Requests

95 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

1 Countries

358 kBTransfer

1535 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

20 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

6 JavaScript Global Variables

1 Cookies

8 Console Messages

Indicators

blueksafari.com Open in urlscan Pro
157.7.107.69 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

20
Requests

95 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

358 kB
Transfer

1535 kB
Size

1
Cookies

20 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!