modulo.52-47-145-200.cprapid.com Open in urlscan Pro
52.47.145.200 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://ab.gl/loginprofilo
Effective URL:
https://modulo.52-47-145-200.cprapid.com/it/
Submission: On February 28 via automatic, source phishtank (February 28th 2023, 6:59:45 pm UTC) — Scanned from DE

Summary HTTP 11 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 6 IPs in 3 countries across 6 domains to perform 11 HTTP transactions. The main IP is 52.47.145.200, located in Paris, France and belongs to AMAZON-02, US. The main domain is modulo.52-47-145-200.cprapid.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on February 27th 2023. Valid for: 3 months.

This is the only time modulo.52-47-145-200.cprapid.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: BNP Paribas (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 1	141.136.46.104 141.136.46.104	47583 (AS-HOSTINGER) (AS-HOSTINGER)
1	52.47.145.200 52.47.145.200	16509 (AMAZON-02) (AMAZON-02)
1	2a02:6ea0:c70... 2a02:6ea0:c700::18	60068 (CDN77 ^_^) (CDN77 ^_^)
1	3.123.238.23 3.123.238.23	16509 (AMAZON-02) (AMAZON-02)
7	2a02:6ea0:c70... 2a02:6ea0:c700::11	60068 (CDN77 ^_^) (CDN77 ^_^)
1	3.122.23.117 3.122.23.117	16509 (AMAZON-02) (AMAZON-02)
11	6

1 141.136.46.104 (Asheville, United States) 1 redirects

ASN47583 (AS-HOSTINGER, CY)

ab.gl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.47.145.200 (Paris, France)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-47-145-200.eu-west-3.compute.amazonaws.com

modulo.52-47-145-200.cprapid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:6ea0:c700::18 (Frankfurt am Main, Germany)

ASN60068 (CDN77 ^_^, GB)

www.smartsuppchat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.123.238.23 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-123-238-23.eu-central-1.compute.amazonaws.com

bootstrap.smartsuppchat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a02:6ea0:c700::11 (Frankfurt am Main, Germany)

ASN60068 (CDN77 ^_^, GB)

widget-v2.smartsuppcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
rec.smartlook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
translations.smartsuppcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.122.23.117 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-122-23-117.eu-central-1.compute.amazonaws.com

websocket-visitors.smartsupp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	smartsuppcdn.com widget-v2.smartsuppcdn.com — Cisco Umbrella Rank: 48125 translations.smartsuppcdn.com — Cisco Umbrella Rank: 51904	194 KB
2	smartlook.com rec.smartlook.com — Cisco Umbrella Rank: 23270	18 KB
2	smartsuppchat.com www.smartsuppchat.com — Cisco Umbrella Rank: 47601 bootstrap.smartsuppchat.com — Cisco Umbrella Rank: 43523	6 KB
1	smartsupp.com websocket-visitors.smartsupp.com — Cisco Umbrella Rank: 39328	231 B
1	cprapid.com modulo.52-47-145-200.cprapid.com	440 KB
1	ab.gl 1 redirects ab.gl	573 B
11	6

	Domain	Requested by
4	widget-v2.smartsuppcdn.com	www.smartsuppchat.com
2	rec.smartlook.com	widget-v2.smartsuppcdn.com rec.smartlook.com
1	websocket-visitors.smartsupp.com	widget-v2.smartsuppcdn.com
1	translations.smartsuppcdn.com	widget-v2.smartsuppcdn.com
1	bootstrap.smartsuppchat.com	www.smartsuppchat.com
1	www.smartsuppchat.com	modulo.52-47-145-200.cprapid.com
1	modulo.52-47-145-200.cprapid.com
1	ab.gl	1 redirects
11	8

This site contains links to these domains. Also see Links.

Domain
banking.bnl.it

Subject Issuer	Validity	Valid
modulo.52-47-145-200.cprapid.com cPanel, Inc. Certification Authority	`2023-02-27` - `2023-05-28`	3 months	crt.sh
*.smartsuppchat.com RapidSSL Global TLS RSA4096 SHA256 2022 CA1	`2022-11-30` - `2023-12-29`	a year	crt.sh
*.smartsuppcdn.com RapidSSL Global TLS RSA4096 SHA256 2022 CA1	`2022-10-19` - `2023-11-19`	a year	crt.sh
1610534878.rsc.cdn77.org R3	`2023-01-11` - `2023-04-11`	3 months	crt.sh
*.smartsupp.com Amazon RSA 2048 M01	`2023-02-14` - `2023-11-22`	9 months	crt.sh

This page contains 2 frames:

Primary Page: https://modulo.52-47-145-200.cprapid.com/it/
Frame ID: 21621A7AC861879C97FEF83DD9EA8885
Requests: 7 HTTP requests in this frame

Frame: https://widget-v2.smartsuppcdn.com/static/js/runtime-main.476fedce.js
Frame ID: 85FE5AE219D56452A800B83EED8CC88E
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

BNL Login

Page URL History Show full URLs

https://ab.gl/loginprofilo HTTP 301
https://modulo.52-47-145-200.cprapid.com/it/ Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Page Statistics

11
Requests

100 %
HTTPS

33 %
IPv6

6
Domains

8
Subdomains

6
IPs

3
Countries

658 kB
Transfer

1174 kB
Size

3
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://banking.bnl.it/rsc/SupportingFiles/numero-cliente.gif
Title: Dove trovi il tuo numero Cliente

Search URL Search Domain Scan URL

URL: https://banking.bnl.it/rsc/SupportingFiles/pin.gif
Title: Dove trovi il PIN

Search URL Search Domain Scan URL

URL: https://banking.bnl.it/pubblica/RecuperoNumeroCliente
Title: Recupera Online il Numero Cliente

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://ab.gl/loginprofilo HTTP 301
https://modulo.52-47-145-200.cprapid.com/it/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
modulo.52-47-145-200.cprapid.com/it/
Redirect Chain

https://ab.gl/loginprofilo
https://modulo.52-47-145-200.cprapid.com/it/

439 KB
440 KB

208ms
103ms

Document
text/html

52.47.145.200
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://modulo.52-47-145-200.cprapid.com/it/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.47.145.200 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-47-145-200.eu-west-3.compute.amazonaws.com
Software: Apache /
Resource Hash: 25423c378a1b20e98bce53677561ebeb4ed07cb22789a4669cb9f77275892754

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Date: Tue, 28 Feb 2023 18:59:40 GMT
Keep-Alive: timeout=5, max=100
Server: Apache
Transfer-Encoding: chunked

Redirect headers

access-control-allow-headers: Content-Type
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
cache-control: no-store, no-cache, must-revalidate
content-length: 0
content-security-policy: upgrade-insecure-requests
content-type: text/html; charset=UTF-8
date: Tue, 28 Feb 2023 18:59:40 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
location: https://modulo.52-47-145-200.cprapid.com/it/
platform: hostinger
pragma: no-cache
server: LiteSpeed
x-powered-by: PHP/7.4.30

GET
DATA 200
OK truncated
/ 7 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 99543d933ae6c6b53aa79a42deb665f785cba48b798e0420ae34e835a588f018

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 loader.js Show response
www.smartsuppchat.com/ 19 KB
6 KB 40ms
6ms Script
application/javascript 2a02:6ea0:c700::18
CDN77 ^_^

General

Check archive.org

Show headers Download Go to

Full URL: https://www.smartsuppchat.com/loader.js?
Requested by: Host: modulo.52-47-145-200.cprapid.com
URL: https://modulo.52-47-145-200.cprapid.com/it/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c700::18 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash: 827004400366298b1c2019b75c57558f2d1618bc0b27bbd2b8e03df251cfc3db

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://modulo.52-47-145-200.cprapid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

x-77-pop: frankfurtDE
date: Tue, 28 Feb 2023 18:59:40 GMT
content-encoding: gzip
x-cache: HIT
x-77-cache: HIT
x-age: 17
x-77-nzt: AZySIRl7c6T/EQAAAA
x-accel-expires: @1677610823
last-modified: Wed, 28 Dec 2022 13:18:33 GMT
server: CDN77-Turbo
etag: W/"63ac4229-4b9b"
x-77-nzt-ray: cf878727e68ea8571c4ffe63e7d53724
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=300, public, s-maxage=60
expires: Wed, 28 Dec 2022 13:25:10 GMT

GET
H2 200 9508a0d8a676cdaa2041c52a4153c54dc6cb1ed9.json Show response
bootstrap.smartsuppchat.com/widget/ 1 KB
713 B 42ms
14ms XHR
application/json 3.123.238.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://bootstrap.smartsuppchat.com/widget/9508a0d8a676cdaa2041c52a4153c54dc6cb1ed9.json
Requested by: Host: www.smartsuppchat.com
URL: https://www.smartsuppchat.com/loader.js?
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.123.238.23 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-123-238-23.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 6e8c5fef730af7fa22ccfc18326084b511278e968a2907e7c7bfba35845efeb5

Request headers

Referer: https://modulo.52-47-145-200.cprapid.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
Content-Type: text/plain

Response headers

x-version: b320280dbaf559c71e48a1dd6c0a783124d40cac
date: Tue, 28 Feb 2023 18:59:40 GMT
content-encoding: br
x-hit: redis
etag: "4d9-v/Pb0IQwzgEVZyH4G9sxFDjRyE0"
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=0, must-revalidate

GET
H2 200 asset-manifest.json Show response
widget-v2.smartsuppcdn.com/ 2 KB
762 B 39ms
7ms XHR
application/json 2a02:6ea0:c700::11
CDN77 ^_^

General

Check archive.org

Show headers Download Go to

Full URL: https://widget-v2.smartsuppcdn.com/asset-manifest.json
Requested by: Host: www.smartsuppchat.com
URL: https://www.smartsuppchat.com/loader.js?
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c700::11 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash: 3c22a548522722679df65b3fe11b4852396ccd5a3684f611d7980738c50464fc

Request headers

Referer: https://modulo.52-47-145-200.cprapid.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
Content-Type: text/plain

Response headers

x-77-pop: frankfurtDE
date: Tue, 28 Feb 2023 18:59:40 GMT
content-encoding: gzip
x-cache: HIT
x-77-cache: HIT
x-age: 27
x-77-nzt: AcO1rgWyr5L/GwAAAA
x-accel-expires: @1677610813
last-modified: Mon, 13 Feb 2023 08:33:32 GMT
server: CDN77-Turbo
etag: W/"63e9f5dc-6ce"
x-77-nzt-ray: 25b02131f6943bfd1c4ffe6320ea732a
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=300, public, s-maxage=60
expires: Mon, 13 Feb 2023 09:26:23 GMT

GET
H2 200 runtime-main.476fedce.js Show response
widget-v2.smartsuppcdn.com/static/js/ Frame 85FE 2 KB
2 KB 23ms
6ms Script
application/javascript 2a02:6ea0:c700::11
CDN77 ^_^

General

Check archive.org

Show headers Download Go to

Full URL: https://widget-v2.smartsuppcdn.com/static/js/runtime-main.476fedce.js
Requested by: Host: www.smartsuppchat.com
URL: https://www.smartsuppchat.com/loader.js?
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c700::11 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash: 36699b912ca380a373d5de1978a2055e6112c7727e6b5041d66a77a6be407b50

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

x-77-pop: frankfurtDE
date: Tue, 28 Feb 2023 18:59:40 GMT
content-encoding: gzip
x-cache: HIT
x-77-cache: HIT
x-age: 1330697
x-77-nzt: AcO1rgUY7Rj/CU4UAA
x-accel-expires: @1707816083
last-modified: Mon, 13 Feb 2023 08:33:32 GMT
server: CDN77-Turbo
etag: W/"63e9f5dc-9bd"
x-77-nzt-ray: 25b02131a592e6fd1c4ffe638ed8e22b
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable
expires: Tue, 13 Feb 2024 09:21:23 GMT

GET
H2 200 6.80b8e19c.chunk.js Show response
widget-v2.smartsuppcdn.com/static/js/ Frame 85FE 525 KB
159 KB 33ms
17ms Script
application/javascript 2a02:6ea0:c700::11
CDN77 ^_^

General

Check archive.org

Show headers Download Go to

Full URL: https://widget-v2.smartsuppcdn.com/static/js/6.80b8e19c.chunk.js
Requested by: Host: www.smartsuppchat.com
URL: https://www.smartsuppchat.com/loader.js?
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c700::11 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash: f4123664f2a6fb1437f5dae6df0748307b6baa8243c11fe364ddc8f409556575

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

x-77-pop: frankfurtDE
date: Tue, 28 Feb 2023 18:59:40 GMT
content-encoding: gzip
x-cache: HIT
x-77-cache: HIT
x-age: 1330697
x-77-nzt: AcO1rgVI+ur/CU4UAA
x-accel-expires: @1707816083
last-modified: Mon, 13 Feb 2023 08:33:32 GMT
server: CDN77-Turbo
etag: W/"63e9f5dc-8338c"
x-77-nzt-ray: 25b02131a592e6fd1c4ffe63a4d91b2c
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable
expires: Tue, 13 Feb 2024 09:21:23 GMT

GET
H2 200 main.3c944932.chunk.js Show response
widget-v2.smartsuppcdn.com/static/js/ Frame 85FE 115 KB
30 KB 28ms
12ms Script
application/javascript 2a02:6ea0:c700::11
CDN77 ^_^

General

Check archive.org

Show headers Download Go to

Full URL: https://widget-v2.smartsuppcdn.com/static/js/main.3c944932.chunk.js
Requested by: Host: www.smartsuppchat.com
URL: https://www.smartsuppchat.com/loader.js?
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c700::11 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash: 6fd15847073c063cb948b5cc2e9a1bc5976392aef4d50b9434bd50a61da59405

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

x-77-pop: frankfurtDE
date: Tue, 28 Feb 2023 18:59:40 GMT
content-encoding: gzip
x-cache: HIT
x-77-cache: HIT
x-age: 1330697
x-77-nzt: AcO1rgWorQf/CU4UAA
x-accel-expires: @1707816083
last-modified: Mon, 13 Feb 2023 08:33:32 GMT
server: CDN77-Turbo
etag: W/"63e9f5dc-1cc88"
x-77-nzt-ray: 25b02131a592e6fd1c4ffe63395ff02b
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable
expires: Tue, 13 Feb 2024 09:21:23 GMT

GET
H2 200 recorder.js Show response
rec.smartlook.com/ 3 KB
2 KB 58ms
7ms Script
application/javascript 2a02:6ea0:c700::11
CDN77 ^_^

General

Check archive.org

Show headers Download Go to

Full URL

https://rec.smartlook.com/recorder.js

Requested by

Host: widget-v2.smartsuppcdn.com
URL: https://widget-v2.smartsuppcdn.com/static/js/main.3c944932.chunk.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6ea0:c700::11 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),

Reverse DNS

Software

CDN77-Turbo /

Resource Hash

f6992885de0b28cbcf927235a4f164c9a316a4b4efaaafe53b30bd392db0172c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://modulo.52-47-145-200.cprapid.com/
Origin: https://modulo.52-47-145-200.cprapid.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

x-77-pop: frankfurtDE
date: Tue, 28 Feb 2023 18:59:40 GMT
strict-transport-security: max-age=31536000
content-encoding: gzip
x-cache: HIT
x-77-cache: HIT
cross-origin-resource-policy: cross-origin
x-age: 508
x-77-nzt: AcO1rgUayjf//AEAAA
x-accel-expires: @1677610872
last-modified: Mon, 27 Feb 2023 13:40:16 GMT
server: CDN77-Turbo
etag: W/"63fcb2c0-c4a"
x-77-nzt-ray: 25b02131948966021c4ffe6307fd1035
vary: Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=600

GET
H2 200 defaults Show response
translations.smartsuppcdn.com/api/v1/widget/translations/lang/it/ Frame 85FE 6 KB
3 KB 33ms
8ms Fetch
application/json 2a02:6ea0:c700::11
CDN77 ^_^

General

Check archive.org

Show headers Download Go to

Full URL: https://translations.smartsuppcdn.com/api/v1/widget/translations/lang/it/defaults
Requested by: Host: widget-v2.smartsuppcdn.com
URL: https://widget-v2.smartsuppcdn.com/static/js/6.80b8e19c.chunk.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c700::11 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash: 6ebcc7afa8e809193927c99f2b2f1508f1f2e85fbe580e5534e7aadc5f62dc97

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

x-77-pop: frankfurtDE
x-version: 00e9510a99a354a3e638456c70a09a41ab56ce80
date: Tue, 28 Feb 2023 18:59:40 GMT
content-encoding: gzip
x-cache: HIT
x-77-cache: HIT
x-age: 346
x-response-time: 0ms
x-77-nzt: AcO1rgUcnhj/WgEAAA
x-accel-expires: @1677611034
server: CDN77-Turbo
x-77-nzt-ray: 25b02131f6943bfd1c4ffe63a50bc533
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=600

GET
H2 200 acquire Show response
websocket-visitors.smartsupp.com/balancer/ Frame 85FE 77 B
231 B 62ms
26ms Fetch
application/json 3.122.23.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://websocket-visitors.smartsupp.com/balancer/acquire
Requested by: Host: widget-v2.smartsuppcdn.com
URL: https://widget-v2.smartsuppcdn.com/static/js/6.80b8e19c.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.122.23.117 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-122-23-117.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: fd3f51d5afd6f2bf7ad3224ff6b72194000f86fbab27f688baadfc7ae3b7380e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

access-control-allow-origin: *
x-version: 70253112abbe85f179c466b00670462138c47060
date: Tue, 28 Feb 2023 18:59:40 GMT
content-length: 77
vary: Origin
content-type: application/json; charset=utf-8

GET
H2 200 init.bf9bf3347494fdee4810.js Show response
rec.smartlook.com/es6/ 54 KB
16 KB 11ms
11ms Script
application/javascript 2a02:6ea0:c700::11
CDN77 ^_^

General

Check archive.org

Show headers Download Go to

Full URL

https://rec.smartlook.com/es6/init.bf9bf3347494fdee4810.js

Requested by

Host: rec.smartlook.com
URL: https://rec.smartlook.com/recorder.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6ea0:c700::11 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),

Reverse DNS

Software

CDN77-Turbo /

Resource Hash

746f3a139822580f0624c625bc62c9bd6b275f425d03879baf7e0a3019ca1a36

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://modulo.52-47-145-200.cprapid.com/
Origin: https://modulo.52-47-145-200.cprapid.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

x-77-pop: frankfurtDE
date: Tue, 28 Feb 2023 18:59:40 GMT
strict-transport-security: max-age=31536000
content-encoding: gzip
x-cache: HIT
x-77-cache: HIT
cross-origin-resource-policy: cross-origin
x-age: 103330
x-77-nzt: AcO1rgUV8Cr/opMBAA
x-accel-expires: @1709043450
last-modified: Mon, 27 Feb 2023 13:40:16 GMT
server: CDN77-Turbo
etag: W/"63fcb2c0-d9e8"
x-77-nzt-ray: 25b02131948966021c4ffe63357ac636
vary: Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000, immutable

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: BNP Paribas (Banking)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
modulo.52-47-145-200.cprapid.com/it	1970-01-20 19:36:10	Name: COOKIE_KEY Value: 167761078032
ab.gl/	1969-12-31 23:59:59	Name: PHPSESSID Value: 3464d9a3673f8be1a6386712b418bb26
ab.gl/	1970-01-20 10:01:37	Name: s_statistics_22559 Value: 0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ab.gl
bootstrap.smartsuppchat.com
modulo.52-47-145-200.cprapid.com
rec.smartlook.com
translations.smartsuppcdn.com
websocket-visitors.smartsupp.com
widget-v2.smartsuppcdn.com
www.smartsuppchat.com
141.136.46.104
2a02:6ea0:c700::11
2a02:6ea0:c700::18
3.122.23.117
3.123.238.23
52.47.145.200
25423c378a1b20e98bce53677561ebeb4ed07cb22789a4669cb9f77275892754
36699b912ca380a373d5de1978a2055e6112c7727e6b5041d66a77a6be407b50
3c22a548522722679df65b3fe11b4852396ccd5a3684f611d7980738c50464fc
6e8c5fef730af7fa22ccfc18326084b511278e968a2907e7c7bfba35845efeb5
6ebcc7afa8e809193927c99f2b2f1508f1f2e85fbe580e5534e7aadc5f62dc97
6fd15847073c063cb948b5cc2e9a1bc5976392aef4d50b9434bd50a61da59405
746f3a139822580f0624c625bc62c9bd6b275f425d03879baf7e0a3019ca1a36
827004400366298b1c2019b75c57558f2d1618bc0b27bbd2b8e03df251cfc3db
99543d933ae6c6b53aa79a42deb665f785cba48b798e0420ae34e835a588f018
f4123664f2a6fb1437f5dae6df0748307b6baa8243c11fe364ddc8f409556575
f6992885de0b28cbcf927235a4f164c9a316a4b4efaaafe53b30bd392db0172c
fd3f51d5afd6f2bf7ad3224ff6b72194000f86fbab27f688baadfc7ae3b7380e

modulo.52-47-145-200.cprapid.com Open in urlscan Pro 52.47.145.200 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

11 Requests

100 %HTTPS

33 %IPv6

6 Domains

8 Subdomains

6 IPs

3 Countries

658 kBTransfer

1174 kBSize

3 Cookies

3 Outgoing links

Page URL History

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

8 JavaScript Global Variables

3 Cookies

Indicators

modulo.52-47-145-200.cprapid.com Open in urlscan Pro
52.47.145.200 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

100 %
HTTPS

33 %
IPv6

6
Domains

8
Subdomains

6
IPs

3
Countries

658 kB
Transfer

1174 kB
Size

3
Cookies

11 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!