tracciamento-up01.cfolks.pl Open in urlscan Pro
185.208.164.122 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://einsac.com.pe/par
Effective URL:
https://tracciamento-up01.cfolks.pl/ch/UPS-CH/
Submission: On February 10 via api (February 10th 2024, 9:58:13 am UTC) from BG — Scanned from CH

Summary HTTP 13 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 4 domains to perform 13 HTTP transactions. The main IP is 185.208.164.122, located in Poland and belongs to CF-GDA, PL. The main domain is tracciamento-up01.cfolks.pl.
TLS certificate: Issued by Certum Domain Validation CA SHA2 on July 31st 2023. Valid for: a year.

This is the only time tracciamento-up01.cfolks.pl was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: UPS (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
2 2	205.251.139.139 205.251.139.139	11042 (NTHL) (NTHL)
11	185.208.164.122 185.208.164.122	41079 (CF-GDA) (CF-GDA)
1	142.250.186.106 142.250.186.106	15169 (GOOGLE) (GOOGLE)
1	142.250.185.67 142.250.185.67	15169 (GOOGLE) (GOOGLE)
13	3

2 205.251.139.139 (United States) 2 redirects

ASN11042 (NTHL, US)
PTR: kamari.nocdirect.com

einsac.com.pe	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 185.208.164.122 (Poland)

ASN41079 (CF-GDA, PL)
PTR: s22.cyber-folks.pl

tracciamento-up01.cfolks.pl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.106 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s06-in-f10.1e100.net

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.67 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s48-in-f3.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	cfolks.pl tracciamento-up01.cfolks.pl	598 KB
2	einsac.com.pe 2 redirects einsac.com.pe	731 B
1	gstatic.com fonts.gstatic.com	43 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 31	2 KB
13	4

	Domain	Requested by
11	tracciamento-up01.cfolks.pl	tracciamento-up01.cfolks.pl
2	einsac.com.pe	2 redirects
1	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	tracciamento-up01.cfolks.pl
13	4

This site contains no links.

Subject Issuer	Validity	Valid
*.cfolks.pl Certum Domain Validation CA SHA2	`2023-07-31` - `2024-07-30`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://tracciamento-up01.cfolks.pl/ch/UPS-CH/
Frame ID: 886DFAF4BDFBBAB0C5C82F3DB9ACEFFC
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Detailed Tracking

Page URL History Show full URLs

https://einsac.com.pe/par HTTP 301
https://einsac.com.pe/par/ HTTP 302
https://tracciamento-up01.cfolks.pl/ch/UPS-CH/ Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

13
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

643 kB
Transfer

1965 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://einsac.com.pe/par HTTP 301
https://einsac.com.pe/par/ HTTP 302
https://tracciamento-up01.cfolks.pl/ch/UPS-CH/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
tracciamento-up01.cfolks.pl/ch/UPS-CH/
Redirect Chain

https://einsac.com.pe/par
https://einsac.com.pe/par/
https://tracciamento-up01.cfolks.pl/ch/UPS-CH/

25 KB
4 KB

968ms
613ms

Document
text/html

185.208.164.122
CF-GDA

General

Check archive.org

Show headers Download Go to

Full URL: https://tracciamento-up01.cfolks.pl/ch/UPS-CH/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.208.164.122 , Poland, ASN41079 (CF-GDA, PL),
Reverse DNS: s22.cyber-folks.pl
Software: LiteSpeed /
Resource Hash: 00f951503ad0f7b79d4fe90bc3a47a99e315bda5b8c0fc0332e9e071b67e8644

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
accept-language: de-CH,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
cache-control: no-store, no-cache, must-revalidate
content-encoding: br
content-length: 4059
content-type: text/html; charset=UTF-8
date: Sat, 10 Feb 2024 09:58:07 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: LiteSpeed
vary: Accept-Encoding,User-Agent

Redirect headers

Cache-Control: no-store, no-cache, must-revalidate
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Date: Sat, 10 Feb 2024 09:58:05 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive: timeout=5, max=99
Pragma: no-cache
Server: Apache
Transfer-Encoding: chunked
X-Endurance-Cache-Level: 0
X-nginx-cache: WordPress
location: https://tracciamento-up01.cfolks.pl/ch/UPS-CH/

GET
H2 200 bootstrap.min.css
tracciamento-up01.cfolks.pl/ch/UPS-CH/files/ 152 KB
20 KB 207ms
193ms Stylesheet
text/css 185.208.164.122
CF-GDA

General

Check archive.org

Show headers Download Go to

Full URL: https://tracciamento-up01.cfolks.pl/ch/UPS-CH/files/bootstrap.min.css
Requested by: Host: tracciamento-up01.cfolks.pl
URL: https://tracciamento-up01.cfolks.pl/ch/UPS-CH/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.208.164.122 , Poland, ASN41079 (CF-GDA, PL),
Reverse DNS: s22.cyber-folks.pl
Software: LiteSpeed /
Resource Hash: 7633b7c0c97d19e682feee8afa2738523fcb2a14544a550572caeecd2eefe66b

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://tracciamento-up01.cfolks.pl/ch/UPS-CH/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Sat, 10 Feb 2024 09:58:08 GMT
content-encoding: br
last-modified: Sat, 25 Feb 2023 19:02:30 GMT
server: LiteSpeed
etag: "260c5-63fa5b46-ea98f9fc56aea8ba;br"
vary: Accept-Encoding,User-Agent
content-type: text/css
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 20356
expires: Sat, 17 Feb 2024 09:58:08 GMT

GET
H2 200 helpers.css
tracciamento-up01.cfolks.pl/ch/UPS-CH/files/ 41 KB
3 KB 257ms
246ms Stylesheet
text/css 185.208.164.122
CF-GDA

General

Check archive.org

Show headers Download Go to

Full URL: https://tracciamento-up01.cfolks.pl/ch/UPS-CH/files/helpers.css
Requested by: Host: tracciamento-up01.cfolks.pl
URL: https://tracciamento-up01.cfolks.pl/ch/UPS-CH/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.208.164.122 , Poland, ASN41079 (CF-GDA, PL),
Reverse DNS: s22.cyber-folks.pl
Software: LiteSpeed /
Resource Hash: 1c7070cf33da6adcb7a6b9ff7eb6e06fd8f64958622d61569b990e8b92c58615

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://tracciamento-up01.cfolks.pl/ch/UPS-CH/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Sat, 10 Feb 2024 09:58:08 GMT
content-encoding: br
last-modified: Sat, 25 Feb 2023 19:02:30 GMT
server: LiteSpeed
etag: "a3ab-63fa5b46-40a8df1fbcb0a9ed;br"
vary: Accept-Encoding,User-Agent
content-type: text/css
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 2890
expires: Sat, 17 Feb 2024 09:58:08 GMT

GET
H2 200 style.css
tracciamento-up01.cfolks.pl/ch/UPS-CH/files/ 8 KB
2 KB 257ms
247ms Stylesheet
text/css 185.208.164.122
CF-GDA

General

Check archive.org

Show headers Download Go to

Full URL: https://tracciamento-up01.cfolks.pl/ch/UPS-CH/files/style.css
Requested by: Host: tracciamento-up01.cfolks.pl
URL: https://tracciamento-up01.cfolks.pl/ch/UPS-CH/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.208.164.122 , Poland, ASN41079 (CF-GDA, PL),
Reverse DNS: s22.cyber-folks.pl
Software: LiteSpeed /
Resource Hash: 35ccf96afa38eef03d12ef3443d2082b375464c2e86f922343685e6f8cec689a

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://tracciamento-up01.cfolks.pl/ch/UPS-CH/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Sat, 10 Feb 2024 09:58:08 GMT
content-encoding: br
last-modified: Sat, 25 Feb 2023 19:02:30 GMT
server: LiteSpeed
etag: "1ee4-63fa5b46-a0d4872ef70acf62;br"
vary: Accept-Encoding,User-Agent
content-type: text/css
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 1594
expires: Sat, 17 Feb 2024 09:58:08 GMT

GET
H2 200 UPS_logo.svg
tracciamento-up01.cfolks.pl/ch/UPS-CH/files/ 2 KB
1 KB 157ms
156ms Image
image/svg+xml 185.208.164.122
CF-GDA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tracciamento-up01.cfolks.pl/ch/UPS-CH/files/UPS_logo.svg
Requested by: Host: tracciamento-up01.cfolks.pl
URL: https://tracciamento-up01.cfolks.pl/ch/UPS-CH/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.208.164.122 , Poland, ASN41079 (CF-GDA, PL),
Reverse DNS: s22.cyber-folks.pl
Software: LiteSpeed /
Resource Hash: a416370f6f98339e7edf9fe2c70a45bf9cfba93c0520921db47d15c27934ba88

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://tracciamento-up01.cfolks.pl/ch/UPS-CH/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Sat, 10 Feb 2024 09:58:08 GMT
content-encoding: br
last-modified: Sun, 26 Feb 2023 04:49:40 GMT
server: LiteSpeed
etag: "872-63fae4e4-cf7806164b849e8e;br"
vary: Accept-Encoding,User-Agent
content-type: image/svg+xml
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 1098
expires: Sat, 17 Feb 2024 09:58:08 GMT

GET
H2 200 err.svg
tracciamento-up01.cfolks.pl/ch/UPS-CH/files/ 509 B
304 B 158ms
157ms Image
image/svg+xml 185.208.164.122
CF-GDA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tracciamento-up01.cfolks.pl/ch/UPS-CH/files/err.svg
Requested by: Host: tracciamento-up01.cfolks.pl
URL: https://tracciamento-up01.cfolks.pl/ch/UPS-CH/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.208.164.122 , Poland, ASN41079 (CF-GDA, PL),
Reverse DNS: s22.cyber-folks.pl
Software: LiteSpeed /
Resource Hash: 38afa7317eabc2637c7a2d6e63ab2344ef1ce4abcb16e1cabae11619e885cd86

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://tracciamento-up01.cfolks.pl/ch/UPS-CH/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Sat, 10 Feb 2024 09:58:08 GMT
content-encoding: br
last-modified: Sat, 25 Feb 2023 19:02:30 GMT
server: LiteSpeed
etag: "1fd-63fa5b46-8c7198bca52c1c99;br"
vary: Accept-Encoding,User-Agent
content-type: image/svg+xml
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 243
expires: Sat, 17 Feb 2024 09:58:08 GMT

GET
H2 200 jquery-3.6.1.min.js Show response
tracciamento-up01.cfolks.pl/ch/UPS-CH/files/ 88 KB
30 KB 208ms
208ms Script
application/javascript 185.208.164.122
CF-GDA

General

Check archive.org

Show headers Download Go to

Full URL: https://tracciamento-up01.cfolks.pl/ch/UPS-CH/files/jquery-3.6.1.min.js
Requested by: Host: tracciamento-up01.cfolks.pl
URL: https://tracciamento-up01.cfolks.pl/ch/UPS-CH/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.208.164.122 , Poland, ASN41079 (CF-GDA, PL),
Reverse DNS: s22.cyber-folks.pl
Software: LiteSpeed /
Resource Hash: a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://tracciamento-up01.cfolks.pl/ch/UPS-CH/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Sat, 10 Feb 2024 09:58:08 GMT
content-encoding: br
last-modified: Sat, 25 Feb 2023 19:02:30 GMT
server: LiteSpeed
etag: "15e40-63fa5b46-bb34f5c7c2a94402;br"
vary: Accept-Encoding,User-Agent
content-type: application/javascript
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 30317
expires: Sat, 17 Feb 2024 09:58:08 GMT

GET
H2 200 bootstrap.bundle.min.js Show response
tracciamento-up01.cfolks.pl/ch/UPS-CH/files/ 77 KB
21 KB 166ms
164ms Script
application/javascript 185.208.164.122
CF-GDA

General

Check archive.org

Show headers Download Go to

Full URL: https://tracciamento-up01.cfolks.pl/ch/UPS-CH/files/bootstrap.bundle.min.js
Requested by: Host: tracciamento-up01.cfolks.pl
URL: https://tracciamento-up01.cfolks.pl/ch/UPS-CH/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.208.164.122 , Poland, ASN41079 (CF-GDA, PL),
Reverse DNS: s22.cyber-folks.pl
Software: LiteSpeed /
Resource Hash: 7e1f1503df765cca5e099891b94e318a2ef95081ba2af1eb6d417cc884bfdbfe

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://tracciamento-up01.cfolks.pl/ch/UPS-CH/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Sat, 10 Feb 2024 09:58:08 GMT
content-encoding: br
last-modified: Sat, 25 Feb 2023 19:02:30 GMT
server: LiteSpeed
etag: "13397-63fa5b46-7d9032c779e45cde;br"
vary: Accept-Encoding,User-Agent
content-type: application/javascript
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 21669
expires: Sat, 17 Feb 2024 09:58:08 GMT

GET
H2 200 all.min.js Show response
tracciamento-up01.cfolks.pl/ch/UPS-CH/files/ 1 MB
513 KB 175ms
174ms Script
application/javascript 185.208.164.122
CF-GDA

General

Check archive.org

Show headers Download Go to

Full URL: https://tracciamento-up01.cfolks.pl/ch/UPS-CH/files/all.min.js
Requested by: Host: tracciamento-up01.cfolks.pl
URL: https://tracciamento-up01.cfolks.pl/ch/UPS-CH/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.208.164.122 , Poland, ASN41079 (CF-GDA, PL),
Reverse DNS: s22.cyber-folks.pl
Software: LiteSpeed /
Resource Hash: 6a769e18b06859751eaa2259044a6ff76e3ddcd6572a516d8ce3a2d7b8c7538e

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://tracciamento-up01.cfolks.pl/ch/UPS-CH/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Sat, 10 Feb 2024 09:58:08 GMT
content-encoding: br
last-modified: Sat, 25 Feb 2023 19:02:30 GMT
server: LiteSpeed
etag: "175216-63fa5b46-2fe7c0ec5b057e0b;br"
vary: Accept-Encoding,User-Agent
content-type: application/javascript
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 525309
expires: Sat, 17 Feb 2024 09:58:08 GMT

GET
H2 200 jquery.mask.min.js Show response
tracciamento-up01.cfolks.pl/ch/UPS-CH/files/ 8 KB
3 KB 175ms
174ms Script
application/javascript 185.208.164.122
CF-GDA

General

Check archive.org

Show headers Download Go to

Full URL: https://tracciamento-up01.cfolks.pl/ch/UPS-CH/files/jquery.mask.min.js
Requested by: Host: tracciamento-up01.cfolks.pl
URL: https://tracciamento-up01.cfolks.pl/ch/UPS-CH/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.208.164.122 , Poland, ASN41079 (CF-GDA, PL),
Reverse DNS: s22.cyber-folks.pl
Software: LiteSpeed /
Resource Hash: 2a0db34dc14ef4b5ce73b230701c7561e5012667a4c9cb274ecab646e1474995

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://tracciamento-up01.cfolks.pl/ch/UPS-CH/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Sat, 10 Feb 2024 09:58:08 GMT
content-encoding: br
last-modified: Sat, 25 Feb 2023 19:02:30 GMT
server: LiteSpeed
etag: "2087-63fa5b46-486fc90fc103344c;br"
vary: Accept-Encoding,User-Agent
content-type: application/javascript
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 3314
expires: Sat, 17 Feb 2024 09:58:08 GMT

GET
H3 200 js.js Show response
tracciamento-up01.cfolks.pl/ch/UPS-CH/files/ 496 B
468 B 188ms
188ms Script
application/javascript 185.208.164.122
CF-GDA

General

Check archive.org

Show headers Download Go to

Full URL: https://tracciamento-up01.cfolks.pl/ch/UPS-CH/files/js.js
Requested by: Host: tracciamento-up01.cfolks.pl
URL: https://tracciamento-up01.cfolks.pl/ch/UPS-CH/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 185.208.164.122 , Poland, ASN41079 (CF-GDA, PL),
Reverse DNS: s22.cyber-folks.pl
Software: LiteSpeed /
Resource Hash: f6ecae9999b4d4c78226a09e14df1c6ec8bcdf3473377d4e49327e6c9b6b957c

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://tracciamento-up01.cfolks.pl/ch/UPS-CH/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Sat, 10 Feb 2024 09:58:08 GMT
content-encoding: br
last-modified: Sat, 25 Feb 2023 19:02:30 GMT
server: LiteSpeed
etag: "1f0-63fa5b46-28b2f91cdb62dcc6;br"
vary: Accept-Encoding,User-Agent
content-type: application/javascript
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length: 159
expires: Sat, 17 Feb 2024 09:58:08 GMT

GET
H2 200 css2
fonts.googleapis.com/ 29 KB
2 KB 735ms
152ms Stylesheet
text/css 142.250.186.106
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Open+Sans:wght@300;400;500;600;700&display=swap

Requested by

Host: tracciamento-up01.cfolks.pl
URL: https://tracciamento-up01.cfolks.pl/ch/UPS-CH/files/style.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.106 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f10.1e100.net

Software

ESF /

Resource Hash

d800f08b490677b0b0bd2597a6dc3033a198fe536decc49a15393ef73285e7b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://tracciamento-up01.cfolks.pl/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

strict-transport-security: max-age=31536000
date: Sat, 10 Feb 2024 09:58:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
expires: Sat, 10 Feb 2024 09:58:08 GMT

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-mu0SC55I.woff2
fonts.gstatic.com/s/opensans/v40/ 42 KB
43 KB 659ms
148ms Font
font/woff2 142.250.185.67
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-mu0SC55I.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Open+Sans:wght@300;400;500;600;700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.67 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f3.1e100.net

Software

sffe /

Resource Hash

94a23e7f96fbde62943e5fc93c59212f68a57d2587fe51f056d20ce802e8249c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://tracciamento-up01.cfolks.pl
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Tue, 06 Feb 2024 04:21:20 GMT
x-content-type-options: nosniff
age: 365809
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43068
x-xss-protection: 0
last-modified: Thu, 14 Dec 2023 02:05:10 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 05 Feb 2025 04:21:20 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: UPS (Transportation)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			einsac.com.pe/	1969-12-31 23:59:59	Name: PHPSESSID Value: f47c49ac4743bfd911646f3a5de2054c
			tracciamento-up01.cfolks.pl/	1969-12-31 23:59:59	Name: PHPSESSID Value: 27cf741913e46d710b34aaa9e0f234df

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

einsac.com.pe
fonts.googleapis.com
fonts.gstatic.com
tracciamento-up01.cfolks.pl
142.250.185.67
142.250.186.106
185.208.164.122
205.251.139.139
00f951503ad0f7b79d4fe90bc3a47a99e315bda5b8c0fc0332e9e071b67e8644
1c7070cf33da6adcb7a6b9ff7eb6e06fd8f64958622d61569b990e8b92c58615
2a0db34dc14ef4b5ce73b230701c7561e5012667a4c9cb274ecab646e1474995
35ccf96afa38eef03d12ef3443d2082b375464c2e86f922343685e6f8cec689a
38afa7317eabc2637c7a2d6e63ab2344ef1ce4abcb16e1cabae11619e885cd86
6a769e18b06859751eaa2259044a6ff76e3ddcd6572a516d8ce3a2d7b8c7538e
7633b7c0c97d19e682feee8afa2738523fcb2a14544a550572caeecd2eefe66b
7e1f1503df765cca5e099891b94e318a2ef95081ba2af1eb6d417cc884bfdbfe
94a23e7f96fbde62943e5fc93c59212f68a57d2587fe51f056d20ce802e8249c
a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74
a416370f6f98339e7edf9fe2c70a45bf9cfba93c0520921db47d15c27934ba88
d800f08b490677b0b0bd2597a6dc3033a198fe536decc49a15393ef73285e7b7
f6ecae9999b4d4c78226a09e14df1c6ec8bcdf3473377d4e49327e6c9b6b957c

tracciamento-up01.cfolks.pl Open in urlscan Pro 185.208.164.122 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

13 Requests

100 %HTTPS

0 %IPv6

4 Domains

4 Subdomains

3 IPs

2 Countries

643 kBTransfer

1965 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

8 JavaScript Global Variables

2 Cookies

Indicators

tracciamento-up01.cfolks.pl Open in urlscan Pro
185.208.164.122 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

643 kB
Transfer

1965 kB
Size

2
Cookies

13 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!