www.securitypsd2.work
Open in
urlscan Pro
198.187.29.28
Malicious Activity!
Public Scan
Submission: On March 24 via manual from IT
Summary
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on March 24th 2021. Valid for: a year.
This is the only time www.securitypsd2.work was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Unicredit (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
10 | 198.187.29.28 198.187.29.28 | 22612 (NAMECHEAP...) (NAMECHEAP-NET) | |
1 | 2a02:6ea0:c70... 2a02:6ea0:c700::1 | 60068 (CDN77 (^_^)/) (CDN77 (^_^)/) | |
1 | 3.120.72.169 3.120.72.169 | 16509 (AMAZON-02) (AMAZON-02) | |
4 | 2a02:6ea0:c70... 2a02:6ea0:c700::4 | 60068 (CDN77 (^_^)/) (CDN77 (^_^)/) | |
16 | 4 |
ASN22612 (NAMECHEAP-NET, US)
PTR: server125-4.web-hosting.com
www.securitypsd2.work |
ASN16509 (AMAZON-02, US)
PTR: ec2-3-120-72-169.eu-central-1.compute.amazonaws.com
bootstrap.smartsuppchat.com |
ASN60068 (CDN77 (^_^)/, GB)
widget-v2.smartsuppcdn.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
securitypsd2.work
www.securitypsd2.work |
81 KB |
4 |
smartsuppcdn.com
widget-v2.smartsuppcdn.com |
213 KB |
2 |
smartsuppchat.com
www.smartsuppchat.com bootstrap.smartsuppchat.com |
8 KB |
16 | 3 |
Domain | Requested by | |
---|---|---|
10 | www.securitypsd2.work |
www.securitypsd2.work
|
4 | widget-v2.smartsuppcdn.com |
www.smartsuppchat.com
|
1 | bootstrap.smartsuppchat.com |
www.smartsuppchat.com
|
1 | www.smartsuppchat.com |
www.securitypsd2.work
|
16 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
securitypsd2.work Sectigo RSA Domain Validation Secure Server CA |
2021-03-24 - 2022-03-24 |
a year | crt.sh |
*.smartsuppchat.com RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1 |
2020-12-02 - 2021-12-30 |
a year | crt.sh |
*.smartsuppcdn.com RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1 |
2020-11-03 - 2021-12-04 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
https://www.securitypsd2.work/info/index.php
Frame ID: 9CF66DF4E441DBB4007D086D7958C091
Requests: 13 HTTP requests in this frame
Frame:
https://widget-v2.smartsuppcdn.com/static/js/runtime-main.9015c3b6.js
Frame ID: C0B15C7A08A519EB57F38602B6D943B9
Requests: 3 HTTP requests in this frame
Screenshot
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- url /\.php(?:$|\?)/i
Apache (Web Servers) Expand
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery[.-]([\d.]*\d)[^/]*\.js/i
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
16 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
index.php
www.securitypsd2.work/info/ |
11 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
info.css
www.securitypsd2.work/info/ |
2 KB 516 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
index.css
www.securitypsd2.work/info/ |
48 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.4.1.min.js
www.securitypsd2.work/info/ |
86 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wb.validation.min.js
www.securitypsd2.work/info/ |
5 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cards.png
www.securitypsd2.work/info/images/ |
24 KB 24 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
555555555.PNG
www.securitypsd2.work/info/images/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dddded.png
www.securitypsd2.work/info/images/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
666.PNG
www.securitypsd2.work/info/images/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo-splash-msite.png
www.securitypsd2.work/info/images/ |
7 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
loader.js
www.smartsuppchat.com/ |
21 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
958c6b03b241f55e415e9964dbc437c30571c6f8.json
bootstrap.smartsuppchat.com/widget/ |
720 B 964 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
asset-manifest.json
widget-v2.smartsuppcdn.com/ |
1 KB 629 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
runtime-main.9015c3b6.js
widget-v2.smartsuppcdn.com/static/js/ Frame C0B1 |
2 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
3.cfe41dd7.chunk.js
widget-v2.smartsuppcdn.com/static/js/ Frame C0B1 |
655 KB 185 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.42faf620.chunk.js
widget-v2.smartsuppcdn.com/static/js/ Frame C0B1 |
105 KB 26 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Unicredit (Banking)18 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery object| _smartsupp function| smartsupp function| setImmediate function| clearImmediate boolean| SMARTSUPP_LOADED object| $smartsupp0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bootstrap.smartsuppchat.com
widget-v2.smartsuppcdn.com
www.securitypsd2.work
www.smartsuppchat.com
198.187.29.28
2a02:6ea0:c700::1
2a02:6ea0:c700::4
3.120.72.169
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
0d17c2653e761f1126a917064534a4dcdc2ad5a8bd8d583ded616674299c14e3
332fc5e3f71edeb87a18c7924f4c5c7bbe1a32cc5ed574ef3ea7b4f01522cdb5
4e9ca5f803ed21b3fd73d60bb42865026b4936860cddbe38b620701051d87c17
5d23d098ed011a35b11dde8cf45e3110df0278d0219b46c11b462cb96f014e28
6a0cdd31e615a40be4ab4ca5bd5d51fa7a2a1c30925ab2da2ed9088711d8e90f
742f6610b290a15741967b15ce7aed885187a652778ffa3e043186e9240eb8f0
8f8e56923bc181c0931f12a3dc8ed9b0d8b31da1677a2d0b2b30c806e7691afa
97eeb3dfa47efa7aafbaf073eaf579b71c9ee1f885d4f7a070d8eeeb1114dd7e
ae37203e459097921d3f7fc742c14de33a50430b86823a195460f844e2cea722
b5508f6f33b952058df84ae8bf6496265f9d498c7dccb4fd806a3c4bd68f8a1c
bd48a199abdc6399e7571e7f2a712e2a55b1b1cdab4f519582ac08ca35b63249
c9a12f0f7c13c6b0d39e3bc04026f633fa08d81ceefa9174ccf9f6184a8d0e69
d2773e2b9f7c75bb45ddcab6cef2bec5ca176f4e48cbf97bede173154d05b71b
d34f217c1ae477c4e2f3d091188c1af407a6d933aaf37af045060b7bba44357b
e62e38d3cda262687803f85dcfeb47f8a8960e01a4f493475b95bf0be235481f