p2.95-214-27-154.cprapid.com Open in urlscan Pro
95.214.27.154 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://p2.95-214-27-154.cprapid.com/
Submission Tags: @ecarlesi threat #phishing #posteitaliane Search All
Submission: On October 20 via api (October 20th 2023, 3:35:55 pm UTC) from SG — Scanned from SG

Summary HTTP 16 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 3 countries across 3 domains to perform 16 HTTP transactions. The main IP is 95.214.27.154, located in Amsterdam, Netherlands and belongs to AS_DELIS, US. The main domain is p2.95-214-27-154.cprapid.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on October 20th 2023. Valid for: 3 months.

This is the only time p2.95-214-27-154.cprapid.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Poste Italiane (Online)

Domain & IP information

	IP Address	AS Autonomous System
9	95.214.27.154 95.214.27.154	211252 (AS_DELIS) (AS_DELIS)
1	2a02:6ea0:d10... 2a02:6ea0:d100::14	60068 (CDN77 ^_^) (CDN77 ^_^)
1	18.185.152.151 18.185.152.151	16509 (AMAZON-02) (AMAZON-02)
5	2a02:6ea0:d10... 2a02:6ea0:d100::25	60068 (CDN77 ^_^) (CDN77 ^_^)
16	4

9 95.214.27.154 (Amsterdam, Netherlands)

ASN211252 (AS_DELIS, US)

p2.95-214-27-154.cprapid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:6ea0:d100::14 (Singapore)

ASN60068 (CDN77 ^_^, GB)

www.smartsuppchat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.185.152.151 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-185-152-151.eu-central-1.compute.amazonaws.com

bootstrap.smartsuppchat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a02:6ea0:d100::25 (Singapore)

ASN60068 (CDN77 ^_^, GB)

widget-v3.smartsuppcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
translations.smartsuppcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	cprapid.com p2.95-214-27-154.cprapid.com	554 KB
5	smartsuppcdn.com widget-v3.smartsuppcdn.com — Cisco Umbrella Rank: 67588 translations.smartsuppcdn.com — Cisco Umbrella Rank: 71119	95 KB
2	smartsuppchat.com www.smartsuppchat.com — Cisco Umbrella Rank: 64161 bootstrap.smartsuppchat.com — Cisco Umbrella Rank: 57980	7 KB
16	3

	Domain	Requested by
9	p2.95-214-27-154.cprapid.com	p2.95-214-27-154.cprapid.com
4	widget-v3.smartsuppcdn.com	www.smartsuppchat.com
1	translations.smartsuppcdn.com	widget-v3.smartsuppcdn.com
1	bootstrap.smartsuppchat.com	www.smartsuppchat.com
1	www.smartsuppchat.com	p2.95-214-27-154.cprapid.com
16	5

This site contains no links.

Subject Issuer	Validity	Valid
p2.95-214-27-154.cprapid.com cPanel, Inc. Certification Authority	`2023-10-20` - `2024-01-18`	3 months	crt.sh
*.smartsuppchat.com RapidSSL Global TLS RSA4096 SHA256 2022 CA1	`2022-11-30` - `2023-12-29`	a year	crt.sh
*.smartsuppcdn.com RapidSSL Global TLS RSA4096 SHA256 2022 CA1	`2022-10-19` - `2023-11-19`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://p2.95-214-27-154.cprapid.com/
Frame ID: FE276762ED87ED5119374969FC46CDFF
Requests: 12 HTTP requests in this frame

Frame: https://widget-v3.smartsuppcdn.com/assets/main-ba57143d.js
Frame ID: 3ACF91C05A04D6417A1263946FEAB29D
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Accedi

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

16
Requests

100 %
HTTPS

50 %
IPv6

3
Domains

5
Subdomains

4
IPs

3
Countries

656 kB
Transfer

859 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response p2.95-214-27-154.cprapid.com/	6 KB 7 KB	1426ms 605ms	Document text/html	95.214.27.154 AS_DELIS
General Check archive.org Show headers Download Go to Full URL https://p2.95-214-27-154.cprapid.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 95.214.27.154 Amsterdam, Netherlands, ASN211252 (AS_DELIS, US), Reverse DNS Software Apache / Resource Hash `8bb3d9c7732fea4af7c9e2dd895d14091859b48ee8bb6fc8eba724b27907a0a0` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 accept-language zh-SG,zh;q=0.9 Response headers Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Fri, 20 Oct 2023 15:35:49 GMT Keep-Alive timeout=5, max=100 Server Apache Transfer-Encoding chunked
GET H/1.1	200 OK	bootstrap.min.css p2.95-214-27-154.cprapid.com/css/	119 KB 120 KB	173ms 172ms	Stylesheet text/css	95.214.27.154 AS_DELIS
General Check archive.org Show headers Download Go to Full URL https://p2.95-214-27-154.cprapid.com/css/bootstrap.min.css Requested by Host: p2.95-214-27-154.cprapid.com URL: https://p2.95-214-27-154.cprapid.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 95.214.27.154 Amsterdam, Netherlands, ASN211252 (AS_DELIS, US), Reverse DNS Software Apache / Resource Hash `8b922a249c9f81562d99eee24407bf38c7feac74a10dfe712292c0b032144dfa` Request headers accept-language zh-SG,zh;q=0.9 Referer https://p2.95-214-27-154.cprapid.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers Date Fri, 20 Oct 2023 15:35:49 GMT Last-Modified Sun, 22 Nov 2020 13:41:24 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 122291
GET H/1.1	200 OK	css.css p2.95-214-27-154.cprapid.com/css/	206 KB 206 KB	500ms 167ms	Stylesheet text/css	95.214.27.154 AS_DELIS
General Check archive.org Show headers Download Go to Full URL https://p2.95-214-27-154.cprapid.com/css/css.css Requested by Host: p2.95-214-27-154.cprapid.com URL: https://p2.95-214-27-154.cprapid.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 95.214.27.154 Amsterdam, Netherlands, ASN211252 (AS_DELIS, US), Reverse DNS Software Apache / Resource Hash `6cfde476dffc41c1ba2f4a228f1f2be0052d7f67093674264506377577e4cd09` Request headers accept-language zh-SG,zh;q=0.9 Referer https://p2.95-214-27-154.cprapid.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers Date Fri, 20 Oct 2023 15:35:50 GMT Last-Modified Wed, 02 Mar 2022 23:19:04 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 210727
GET H/1.1	200 OK	jquery.min.js Show response p2.95-214-27-154.cprapid.com/css/	95 KB 95 KB	499ms 166ms	Script application/javascript	95.214.27.154 AS_DELIS
General Check archive.org Show headers Download Go to Full URL https://p2.95-214-27-154.cprapid.com/css/jquery.min.js Requested by Host: p2.95-214-27-154.cprapid.com URL: https://p2.95-214-27-154.cprapid.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 95.214.27.154 Amsterdam, Netherlands, ASN211252 (AS_DELIS, US), Reverse DNS Software Apache / Resource Hash `668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404` Request headers accept-language zh-SG,zh;q=0.9 Referer https://p2.95-214-27-154.cprapid.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers Date Fri, 20 Oct 2023 15:35:50 GMT Last-Modified Sun, 22 Nov 2020 13:41:24 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 97163
GET H/1.1	200 OK	logo.png p2.95-214-27-154.cprapid.com/	53 KB 53 KB	517ms 171ms	Image image/png	95.214.27.154 AS_DELIS
General Check archive.org Show headers Download Go to Show image Full URL https://p2.95-214-27-154.cprapid.com/logo.png Requested by Host: p2.95-214-27-154.cprapid.com URL: https://p2.95-214-27-154.cprapid.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 95.214.27.154 Amsterdam, Netherlands, ASN211252 (AS_DELIS, US), Reverse DNS Software Apache / Resource Hash `2cc5184a6d1c9f3b5f07fb1b79d4083006cc5b9a86200851eef39fd68a6406af` Request headers accept-language zh-SG,zh;q=0.9 Referer https://p2.95-214-27-154.cprapid.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers Date Fri, 20 Oct 2023 15:35:50 GMT Last-Modified Mon, 08 May 2023 06:01:20 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 54002
GET H/1.1	200 OK	img1.png p2.95-214-27-154.cprapid.com/css/	6 KB 7 KB	517ms 171ms	Image image/png	95.214.27.154 AS_DELIS
General Check archive.org Show headers Download Go to Show image Full URL https://p2.95-214-27-154.cprapid.com/css/img1.png Requested by Host: p2.95-214-27-154.cprapid.com URL: https://p2.95-214-27-154.cprapid.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 95.214.27.154 Amsterdam, Netherlands, ASN211252 (AS_DELIS, US), Reverse DNS Software Apache / Resource Hash `cf4a172da82df7d22d9b0bea415bb6c2a2080dc6bb600f96effc73b517dcc11a` Request headers accept-language zh-SG,zh;q=0.9 Referer https://p2.95-214-27-154.cprapid.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers Date Fri, 20 Oct 2023 15:35:50 GMT Last-Modified Thu, 03 Feb 2022 13:38:04 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 6467
GET H/1.1	200 OK	ico-messages-info.png p2.95-214-27-154.cprapid.com/	2 KB 2 KB	172ms 171ms	Image image/png	95.214.27.154 AS_DELIS
General Check archive.org Show headers Download Go to Show image Full URL https://p2.95-214-27-154.cprapid.com/ico-messages-info.png Requested by Host: p2.95-214-27-154.cprapid.com URL: https://p2.95-214-27-154.cprapid.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 95.214.27.154 Amsterdam, Netherlands, ASN211252 (AS_DELIS, US), Reverse DNS Software Apache / Resource Hash `b98b52b6f7cfb28e5e097f3bc02d50335264686a95ee79b7603737c8e78e5a7c` Request headers accept-language zh-SG,zh;q=0.9 Referer https://p2.95-214-27-154.cprapid.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers Date Fri, 20 Oct 2023 15:35:50 GMT Last-Modified Wed, 02 Mar 2022 22:57:20 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 2135
GET H2	200	loader.js Show response www.smartsuppchat.com/	19 KB 6 KB	232ms 3ms	Script application/javascript	2a02:6ea0:d100::14 CDN77 ^_^
General Check archive.org Show headers Download Go to Full URL https://www.smartsuppchat.com/loader.js? Requested by Host: p2.95-214-27-154.cprapid.com URL: https://p2.95-214-27-154.cprapid.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6ea0:d100::14 , Singapore, ASN60068 (CDN77 ^_^, GB), Reverse DNS Software CDN77-Turbo / Resource Hash `9e3ec8fde823fb0178e76391aa3fc10e2f277d4e50b75fb00e6c195f3dec11fe` Request headers accept-language zh-SG,zh;q=0.9 Referer https://p2.95-214-27-154.cprapid.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers x-77-pop singaporeSG date Fri, 20 Oct 2023 15:35:50 GMT content-encoding gzip x-cache HIT x-77-cache HIT x-age 5 x-accel-date 1697816145 x-77-nzt AVm7oo03Nzf/BQAAAA x-accel-expires @1697816205 x-77-age 5 last-modified Thu, 29 Jun 2023 04:51:04 GMT server CDN77-Turbo etag W/"649d0db8-4c98" x-77-nzt-ray 424d723043651be2569e32658b1b3c38 vary Accept-Encoding content-type application/javascript cache-control max-age=300, public, s-maxage=60 expires Thu, 29 Jun 2023 04:58:16 GMT
GET H/1.1	200 OK	spinner_giallo.gif p2.95-214-27-154.cprapid.com/	33 KB 33 KB	167ms 166ms	Image image/gif	95.214.27.154 AS_DELIS
General Check archive.org Show headers Download Go to Show image Full URL https://p2.95-214-27-154.cprapid.com/spinner_giallo.gif Requested by Host: p2.95-214-27-154.cprapid.com URL: https://p2.95-214-27-154.cprapid.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 95.214.27.154 Amsterdam, Netherlands, ASN211252 (AS_DELIS, US), Reverse DNS Software Apache / Resource Hash `ea638c8244c7a5cc50e617807b1fc35637430f976e8210ef3d560a5eb059e5f5` Request headers accept-language zh-SG,zh;q=0.9 Referer https://p2.95-214-27-154.cprapid.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers Date Fri, 20 Oct 2023 15:35:50 GMT Last-Modified Wed, 02 Mar 2022 23:10:36 GMT Server Apache Content-Type image/gif Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 33869
GET H/1.1	200 OK	Texta-Regular.woff p2.95-214-27-154.cprapid.com/	32 KB 32 KB	167ms 166ms	Font font/woff	95.214.27.154 AS_DELIS
General Check archive.org Show headers Download Go to Full URL https://p2.95-214-27-154.cprapid.com/Texta-Regular.woff Requested by Host: p2.95-214-27-154.cprapid.com URL: https://p2.95-214-27-154.cprapid.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 95.214.27.154 Amsterdam, Netherlands, ASN211252 (AS_DELIS, US), Reverse DNS Software Apache / Resource Hash `4563e60af72ef8d0cc8b7c64716d81610d2f6595c7f76c8069b2015a89d623e2` Request headers Referer https://p2.95-214-27-154.cprapid.com/ Origin https://p2.95-214-27-154.cprapid.com accept-language zh-SG,zh;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers Date Fri, 20 Oct 2023 15:35:50 GMT Last-Modified Tue, 15 Mar 2022 15:13:02 GMT Server Apache Content-Type font/woff Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 32376
GET H2	200	8a501f860d70f42e5100568c07885c9b3daa8ceb.json Show response bootstrap.smartsuppchat.com/widget/	1 KB 679 B	669ms 183ms	XHR application/json	18.185.152.151 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://bootstrap.smartsuppchat.com/widget/8a501f860d70f42e5100568c07885c9b3daa8ceb.json Requested by Host: www.smartsuppchat.com URL: https://www.smartsuppchat.com/loader.js? Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.185.152.151 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-185-152-151.eu-central-1.compute.amazonaws.com Software / Resource Hash `6f4d72516a6cd75b5e3863bdcc312ce716fe95e8d6e978a3a2f946561ae3beb8` Request headers Referer https://p2.95-214-27-154.cprapid.com/ accept-language zh-SG,zh;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Content-Type text/plain Response headers x-version 62713eedc1f171511be259caec0493e3a10586ea date Fri, 20 Oct 2023 15:35:51 GMT content-encoding br x-hit redis etag "4c3-+S5tih+4T0WdlTGvq5ParwVgUfY" vary Accept-Encoding content-type application/json; charset=utf-8 access-control-allow-origin * cache-control private, max-age=0, must-revalidate
GET H2	200	manifest.json Show response widget-v3.smartsuppcdn.com/	2 KB 809 B	31ms 10ms	XHR application/json	2a02:6ea0:d100::25 CDN77 ^_^
General Check archive.org Show headers Download Go to Full URL https://widget-v3.smartsuppcdn.com/manifest.json Requested by Host: www.smartsuppchat.com URL: https://www.smartsuppchat.com/loader.js? Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6ea0:d100::25 , Singapore, ASN60068 (CDN77 ^_^, GB), Reverse DNS Software CDN77-Turbo / Resource Hash `935053f0dc23286ef54a08164df83e940ff51c6b8f5ca12f66f7d94c45c5f426` Request headers Referer https://p2.95-214-27-154.cprapid.com/ accept-language zh-SG,zh;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Content-Type text/plain Response headers x-77-pop singaporeSG date Fri, 20 Oct 2023 15:35:51 GMT content-encoding gzip x-cache HIT x-77-cache HIT x-age 5 x-accel-date 1697816146 x-77-nzt AY/0IZs3Nzf/BQAAAA x-accel-expires @1697816206 x-77-age 5 last-modified Wed, 27 Sep 2023 05:10:25 GMT server CDN77-Turbo etag W/"6513b941-626" x-77-nzt-ray 31887a0bab94c21e579e326580fc0228 vary Accept-Encoding content-type application/json access-control-allow-origin * cache-control max-age=300, public, s-maxage=60 expires Wed, 27 Sep 2023 05:32:24 GMT
GET H2	200	main-ba57143d.js Show response widget-v3.smartsuppcdn.com/assets/ Frame 3ACF	91 KB 32 KB	6ms 6ms	Script application/javascript	2a02:6ea0:d100::25 CDN77 ^_^
General Check archive.org Show headers Download Go to Full URL https://widget-v3.smartsuppcdn.com/assets/main-ba57143d.js Requested by Host: www.smartsuppchat.com URL: https://www.smartsuppchat.com/loader.js? Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6ea0:d100::25 , Singapore, ASN60068 (CDN77 ^_^, GB), Reverse DNS Software CDN77-Turbo / Resource Hash `7c6aeb25a94a026b2f3cec92a5a0a0b46b03825ed140570dde1d88b59d067663` Request headers Referer Origin https://p2.95-214-27-154.cprapid.com accept-language zh-SG,zh;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers x-77-pop singaporeSG date Fri, 20 Oct 2023 15:35:51 GMT content-encoding gzip x-cache HIT x-77-cache HIT x-age 2023706 x-accel-date 1695792445 x-77-nzt AY/0IZs3Nzf/GuEeAA x-accel-expires @1727328445 x-77-age 2023706 last-modified Wed, 27 Sep 2023 05:10:25 GMT server CDN77-Turbo etag W/"6513b941-16c06" x-77-nzt-ray 31887a0bab94c21e579e32653fed5c28 vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control max-age=31536000, public, immutable expires Thu, 26 Sep 2024 05:27:25 GMT
GET H2	200	vendor-6c9589b8.js Show response widget-v3.smartsuppcdn.com/assets/ Frame 3ACF	157 KB 52 KB	12ms 11ms	Script application/javascript	2a02:6ea0:d100::25 CDN77 ^_^
General Check archive.org Show headers Download Go to Full URL https://widget-v3.smartsuppcdn.com/assets/vendor-6c9589b8.js Requested by Host: www.smartsuppchat.com URL: https://www.smartsuppchat.com/loader.js? Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6ea0:d100::25 , Singapore, ASN60068 (CDN77 ^_^, GB), Reverse DNS Software CDN77-Turbo / Resource Hash `91d5768d3bbffe391672e9aac374ec27f2bb7250795bd8e13e3af0dc709154a8` Request headers Referer Origin https://p2.95-214-27-154.cprapid.com accept-language zh-SG,zh;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers x-77-pop singaporeSG date Fri, 20 Oct 2023 15:35:51 GMT content-encoding gzip x-cache HIT x-77-cache HIT x-age 2023706 x-accel-date 1695792445 x-77-nzt AY/0IZs3Nzf/GuEeAA x-accel-expires @1727328445 x-77-age 2023706 last-modified Wed, 27 Sep 2023 05:10:25 GMT server CDN77-Turbo etag W/"6513b941-27246" x-77-nzt-ray 31887a0bab94c21e579e32656ddd8528 vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control max-age=31536000, public, immutable expires Thu, 26 Sep 2024 05:27:25 GMT
GET H2	200	style-2a175354.css widget-v3.smartsuppcdn.com/assets/ Frame 3ACF	31 KB 7 KB	16ms 16ms	Stylesheet text/css	2a02:6ea0:d100::25 CDN77 ^_^
General Check archive.org Show headers Download Go to Full URL https://widget-v3.smartsuppcdn.com/assets/style-2a175354.css Requested by Host: www.smartsuppchat.com URL: https://www.smartsuppchat.com/loader.js? Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6ea0:d100::25 , Singapore, ASN60068 (CDN77 ^_^, GB), Reverse DNS Software CDN77-Turbo / Resource Hash `a47be5f03963969da84fceef21f13f468238f98f7c4e4f7167a7349b4285d497` Request headers Referer Origin https://p2.95-214-27-154.cprapid.com accept-language zh-SG,zh;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers x-77-pop singaporeSG date Fri, 20 Oct 2023 15:35:51 GMT content-encoding gzip x-cache HIT x-77-cache HIT x-age 2023706 x-accel-date 1695792445 x-77-nzt AY/0IZs3Nzf/GuEeAA x-accel-expires @1727328445 x-77-age 2023706 last-modified Wed, 27 Sep 2023 05:10:25 GMT server CDN77-Turbo etag W/"6513b941-7d54" x-77-nzt-ray 31887a0bab94c21e579e3265f932d628 vary Accept-Encoding content-type text/css access-control-allow-origin * cache-control max-age=31536000, public, immutable expires Thu, 26 Sep 2024 05:27:25 GMT
GET H2	200	defaults Show response translations.smartsuppcdn.com/api/v1/widget/translations/lang/it/ Frame 3ACF	6 KB 3 KB	14ms 4ms	Fetch application/json	2a02:6ea0:d100::25 CDN77 ^_^
General Check archive.org Show headers Download Go to Full URL https://translations.smartsuppcdn.com/api/v1/widget/translations/lang/it/defaults Requested by Host: widget-v3.smartsuppcdn.com URL: https://widget-v3.smartsuppcdn.com/assets/vendor-6c9589b8.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6ea0:d100::25 , Singapore, ASN60068 (CDN77 ^_^, GB), Reverse DNS Software CDN77-Turbo / Resource Hash `9a2ff9004d1e953b8613d3cc77226e06b75ed710e6c249c6704dce963e8cb678` Request headers accept-language zh-SG,zh;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers x-77-pop singaporeSG x-version 8914f448cebfac3c4084e881e9fa72c39900efaf date Fri, 20 Oct 2023 15:35:51 GMT content-encoding gzip x-cache HIT x-77-cache HIT x-age 394 x-accel-date 1697815757 x-response-time 0ms x-77-nzt AY/0IZs3Nzf/igEAAA x-accel-expires @1697816357 x-77-age 394 server CDN77-Turbo x-77-nzt-ray 31887a0bab94c21e579e3265965a772c vary Accept-Encoding, Origin content-type application/json; charset=utf-8 access-control-allow-origin * cache-control max-age=600

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Poste Italiane (Online)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			p2.95-214-27-154.cprapid.com/	1970-01-21 01:12:56	Name: COOKIE_KEY Value: 169781614928

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bootstrap.smartsuppchat.com
p2.95-214-27-154.cprapid.com
translations.smartsuppcdn.com
widget-v3.smartsuppcdn.com
www.smartsuppchat.com
18.185.152.151
2a02:6ea0:d100::14
2a02:6ea0:d100::25
95.214.27.154
2cc5184a6d1c9f3b5f07fb1b79d4083006cc5b9a86200851eef39fd68a6406af
4563e60af72ef8d0cc8b7c64716d81610d2f6595c7f76c8069b2015a89d623e2
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
6cfde476dffc41c1ba2f4a228f1f2be0052d7f67093674264506377577e4cd09
6f4d72516a6cd75b5e3863bdcc312ce716fe95e8d6e978a3a2f946561ae3beb8
7c6aeb25a94a026b2f3cec92a5a0a0b46b03825ed140570dde1d88b59d067663
8b922a249c9f81562d99eee24407bf38c7feac74a10dfe712292c0b032144dfa
8bb3d9c7732fea4af7c9e2dd895d14091859b48ee8bb6fc8eba724b27907a0a0
91d5768d3bbffe391672e9aac374ec27f2bb7250795bd8e13e3af0dc709154a8
935053f0dc23286ef54a08164df83e940ff51c6b8f5ca12f66f7d94c45c5f426
9a2ff9004d1e953b8613d3cc77226e06b75ed710e6c249c6704dce963e8cb678
9e3ec8fde823fb0178e76391aa3fc10e2f277d4e50b75fb00e6c195f3dec11fe
a47be5f03963969da84fceef21f13f468238f98f7c4e4f7167a7349b4285d497
b98b52b6f7cfb28e5e097f3bc02d50335264686a95ee79b7603737c8e78e5a7c
cf4a172da82df7d22d9b0bea415bb6c2a2080dc6bb600f96effc73b517dcc11a
ea638c8244c7a5cc50e617807b1fc35637430f976e8210ef3d560a5eb059e5f5

p2.95-214-27-154.cprapid.com Open in urlscan Pro 95.214.27.154 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

16 Requests

100 %HTTPS

50 %IPv6

3 Domains

5 Subdomains

4 IPs

3 Countries

656 kBTransfer

859 kBSize

1 Cookies

0 Outgoing links

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

8 JavaScript Global Variables

1 Cookies

Indicators

p2.95-214-27-154.cprapid.com Open in urlscan Pro
95.214.27.154 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

100 %
HTTPS

50 %
IPv6

3
Domains

5
Subdomains

4
IPs

3
Countries

656 kB
Transfer

859 kB
Size

1
Cookies

16 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!