login.45-12-253-40.cprapid.com Open in urlscan Pro
45.12.253.40 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://login.45-12-253-40.cprapid.com/
Submission Tags: @ecarlesi threat #phishing #posteitaliane Search All
Submission: On October 02 via api (October 2nd 2023, 1:38:02 pm UTC) from PL — Scanned from PL

Summary HTTP 16 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 2 countries across 3 domains to perform 16 HTTP transactions. The main IP is 45.12.253.40, located in Amsterdam, Netherlands and belongs to AS_DELIS, US. The main domain is login.45-12-253-40.cprapid.com.

This is the only time login.45-12-253-40.cprapid.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Poste Italiane (Online)

Domain & IP information

	IP Address	AS Autonomous System
9	45.12.253.40 45.12.253.40	211252 (AS_DELIS) (AS_DELIS)
1	156.146.33.141 156.146.33.141	60068 (CDN77 ^_^) (CDN77 ^_^)
1	18.158.207.158 18.158.207.158	16509 (AMAZON-02) (AMAZON-02)
4	195.181.175.40 195.181.175.40	60068 (CDN77 ^_^) (CDN77 ^_^)
1	195.181.175.41 195.181.175.41	60068 (CDN77 ^_^) (CDN77 ^_^)
16	5

9 45.12.253.40 (Amsterdam, Netherlands)

ASN211252 (AS_DELIS, US)

login.45-12-253-40.cprapid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 156.146.33.141 (Frankfurt am Main, Germany)

ASN60068 (CDN77 ^_^, GB)
PTR: 663193551.fra.cdn77.com

www.smartsuppchat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.158.207.158 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-158-207-158.eu-central-1.compute.amazonaws.com

bootstrap.smartsuppchat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 195.181.175.40 (Frankfurt am Main, Germany)

ASN60068 (CDN77 ^_^, GB)
PTR: 824291365.fra.cdn77.com

widget-v3.smartsuppcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 195.181.175.41 (Frankfurt am Main, Germany)

ASN60068 (CDN77 ^_^, GB)
PTR: 824291365.fra.cdn77.com

translations.smartsuppcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	cprapid.com login.45-12-253-40.cprapid.com	554 KB
5	smartsuppcdn.com widget-v3.smartsuppcdn.com — Cisco Umbrella Rank: 67374 translations.smartsuppcdn.com — Cisco Umbrella Rank: 68920	95 KB
2	smartsuppchat.com www.smartsuppchat.com — Cisco Umbrella Rank: 62950 bootstrap.smartsuppchat.com — Cisco Umbrella Rank: 60027	7 KB
16	3

	Domain	Requested by
9	login.45-12-253-40.cprapid.com	login.45-12-253-40.cprapid.com
4	widget-v3.smartsuppcdn.com	www.smartsuppchat.com
1	translations.smartsuppcdn.com	widget-v3.smartsuppcdn.com
1	bootstrap.smartsuppchat.com	www.smartsuppchat.com
1	www.smartsuppchat.com	login.45-12-253-40.cprapid.com
16	5

This site contains no links.

Subject Issuer	Validity	Valid
*.smartsuppchat.com RapidSSL Global TLS RSA4096 SHA256 2022 CA1	`2022-11-30` - `2023-12-29`	a year	crt.sh
*.smartsuppcdn.com RapidSSL Global TLS RSA4096 SHA256 2022 CA1	`2022-10-19` - `2023-11-19`	a year	crt.sh

This page contains 2 frames:

Primary Page: http://login.45-12-253-40.cprapid.com/
Frame ID: D0EA0EB4FA1CAB7108DBC501CA96279F
Requests: 12 HTTP requests in this frame

Frame: https://widget-v3.smartsuppcdn.com/assets/main-ba57143d.js
Frame ID: 74F0E19F4C49CDC37DA4C8C74C160A7A
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Accedi

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

16
Requests

44 %
HTTPS

0 %
IPv6

3
Domains

5
Subdomains

5
IPs

2
Countries

656 kB
Transfer

859 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response login.45-12-253-40.cprapid.com/	6 KB 7 KB	253ms 171ms	Document text/html	45.12.253.40 AS_DELIS
General Check archive.org Show headers Download Go to Full URL http://login.45-12-253-40.cprapid.com/ Protocol HTTP/1.1 Server 45.12.253.40 Amsterdam, Netherlands, ASN211252 (AS_DELIS, US), Reverse DNS Software Apache / Resource Hash `8bb3d9c7732fea4af7c9e2dd895d14091859b48ee8bb6fc8eba724b27907a0a0` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36 accept-language pl-PL,pl;q=0.9 Response headers Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Mon, 02 Oct 2023 13:37:57 GMT Keep-Alive timeout=5, max=100 Server Apache Transfer-Encoding chunked
GET H/1.1	200 OK	bootstrap.min.css login.45-12-253-40.cprapid.com/css/	119 KB 120 KB	51ms 50ms	Stylesheet text/css	45.12.253.40 AS_DELIS
General Check archive.org Show headers Download Go to Full URL http://login.45-12-253-40.cprapid.com/css/bootstrap.min.css Requested by Host: login.45-12-253-40.cprapid.com URL: http://login.45-12-253-40.cprapid.com/ Protocol HTTP/1.1 Server 45.12.253.40 Amsterdam, Netherlands, ASN211252 (AS_DELIS, US), Reverse DNS Software Apache / Resource Hash `8b922a249c9f81562d99eee24407bf38c7feac74a10dfe712292c0b032144dfa` Request headers accept-language pl-PL,pl;q=0.9 Referer http://login.45-12-253-40.cprapid.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36 Response headers Date Mon, 02 Oct 2023 13:37:58 GMT Last-Modified Sun, 22 Nov 2020 13:41:24 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 122291
GET H/1.1	200 OK	css.css login.45-12-253-40.cprapid.com/css/	206 KB 206 KB	105ms 56ms	Stylesheet text/css	45.12.253.40 AS_DELIS
General Check archive.org Show headers Download Go to Full URL http://login.45-12-253-40.cprapid.com/css/css.css Requested by Host: login.45-12-253-40.cprapid.com URL: http://login.45-12-253-40.cprapid.com/ Protocol HTTP/1.1 Server 45.12.253.40 Amsterdam, Netherlands, ASN211252 (AS_DELIS, US), Reverse DNS Software Apache / Resource Hash `6cfde476dffc41c1ba2f4a228f1f2be0052d7f67093674264506377577e4cd09` Request headers accept-language pl-PL,pl;q=0.9 Referer http://login.45-12-253-40.cprapid.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36 Response headers Date Mon, 02 Oct 2023 13:37:58 GMT Last-Modified Wed, 02 Mar 2022 23:19:04 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 210727
GET H/1.1	200 OK	jquery.min.js Show response login.45-12-253-40.cprapid.com/css/	95 KB 95 KB	102ms 53ms	Script application/javascript	45.12.253.40 AS_DELIS
General Check archive.org Show headers Download Go to Full URL http://login.45-12-253-40.cprapid.com/css/jquery.min.js Requested by Host: login.45-12-253-40.cprapid.com URL: http://login.45-12-253-40.cprapid.com/ Protocol HTTP/1.1 Server 45.12.253.40 Amsterdam, Netherlands, ASN211252 (AS_DELIS, US), Reverse DNS Software Apache / Resource Hash `668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404` Request headers accept-language pl-PL,pl;q=0.9 Referer http://login.45-12-253-40.cprapid.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36 Response headers Date Mon, 02 Oct 2023 13:37:58 GMT Last-Modified Sun, 22 Nov 2020 13:41:24 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 97163
GET H/1.1	200 OK	logo.png login.45-12-253-40.cprapid.com/	53 KB 53 KB	54ms 53ms	Image image/png	45.12.253.40 AS_DELIS
General Check archive.org Show headers Download Go to Show image Full URL http://login.45-12-253-40.cprapid.com/logo.png Requested by Host: login.45-12-253-40.cprapid.com URL: http://login.45-12-253-40.cprapid.com/ Protocol HTTP/1.1 Server 45.12.253.40 Amsterdam, Netherlands, ASN211252 (AS_DELIS, US), Reverse DNS Software Apache / Resource Hash `2cc5184a6d1c9f3b5f07fb1b79d4083006cc5b9a86200851eef39fd68a6406af` Request headers accept-language pl-PL,pl;q=0.9 Referer http://login.45-12-253-40.cprapid.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36 Response headers Date Mon, 02 Oct 2023 13:37:58 GMT Last-Modified Mon, 08 May 2023 06:01:20 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 54002
GET H/1.1	200 OK	img1.png login.45-12-253-40.cprapid.com/css/	6 KB 7 KB	50ms 50ms	Image image/png	45.12.253.40 AS_DELIS
General Check archive.org Show headers Download Go to Show image Full URL http://login.45-12-253-40.cprapid.com/css/img1.png Requested by Host: login.45-12-253-40.cprapid.com URL: http://login.45-12-253-40.cprapid.com/ Protocol HTTP/1.1 Server 45.12.253.40 Amsterdam, Netherlands, ASN211252 (AS_DELIS, US), Reverse DNS Software Apache / Resource Hash `cf4a172da82df7d22d9b0bea415bb6c2a2080dc6bb600f96effc73b517dcc11a` Request headers accept-language pl-PL,pl;q=0.9 Referer http://login.45-12-253-40.cprapid.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36 Response headers Date Mon, 02 Oct 2023 13:37:58 GMT Last-Modified Thu, 03 Feb 2022 13:38:04 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 6467
GET H/1.1	200 OK	ico-messages-info.png login.45-12-253-40.cprapid.com/	2 KB 2 KB	52ms 51ms	Image image/png	45.12.253.40 AS_DELIS
General Check archive.org Show headers Download Go to Show image Full URL http://login.45-12-253-40.cprapid.com/ico-messages-info.png Requested by Host: login.45-12-253-40.cprapid.com URL: http://login.45-12-253-40.cprapid.com/ Protocol HTTP/1.1 Server 45.12.253.40 Amsterdam, Netherlands, ASN211252 (AS_DELIS, US), Reverse DNS Software Apache / Resource Hash `b98b52b6f7cfb28e5e097f3bc02d50335264686a95ee79b7603737c8e78e5a7c` Request headers accept-language pl-PL,pl;q=0.9 Referer http://login.45-12-253-40.cprapid.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36 Response headers Date Mon, 02 Oct 2023 13:37:58 GMT Last-Modified Wed, 02 Mar 2022 22:57:20 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 2135
GET H2	200	loader.js Show response www.smartsuppchat.com/	19 KB 6 KB	162ms 49ms	Script application/javascript	156.146.33.141 CDN77 ^_^
General Check archive.org Show headers Download Go to Full URL https://www.smartsuppchat.com/loader.js? Requested by Host: login.45-12-253-40.cprapid.com URL: http://login.45-12-253-40.cprapid.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 156.146.33.141 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB), Reverse DNS 663193551.fra.cdn77.com Software CDN77-Turbo / Resource Hash `9e3ec8fde823fb0178e76391aa3fc10e2f277d4e50b75fb00e6c195f3dec11fe` Request headers accept-language pl-PL,pl;q=0.9 Referer http://login.45-12-253-40.cprapid.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36 Response headers x-77-pop frankfurtDE date Mon, 02 Oct 2023 13:37:58 GMT content-encoding gzip x-cache HIT x-77-cache HIT x-age 16 x-accel-date 1696253862 x-77-nzt AZySIYv/dQ7/EAAAAA x-accel-expires @1696253922 x-77-age 16 last-modified Thu, 29 Jun 2023 04:51:04 GMT server CDN77-Turbo etag W/"649d0db8-4c98" x-77-nzt-ray cf878727b2d42590b6c71a6500272723 vary Accept-Encoding content-type application/javascript cache-control max-age=300, public, s-maxage=60 expires Thu, 29 Jun 2023 04:58:30 GMT
GET H/1.1	200 OK	spinner_giallo.gif login.45-12-253-40.cprapid.com/	33 KB 33 KB	50ms 50ms	Image image/gif	45.12.253.40 AS_DELIS
General Check archive.org Show headers Download Go to Show image Full URL http://login.45-12-253-40.cprapid.com/spinner_giallo.gif Requested by Host: login.45-12-253-40.cprapid.com URL: http://login.45-12-253-40.cprapid.com/ Protocol HTTP/1.1 Server 45.12.253.40 Amsterdam, Netherlands, ASN211252 (AS_DELIS, US), Reverse DNS Software Apache / Resource Hash `ea638c8244c7a5cc50e617807b1fc35637430f976e8210ef3d560a5eb059e5f5` Request headers accept-language pl-PL,pl;q=0.9 Referer http://login.45-12-253-40.cprapid.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36 Response headers Date Mon, 02 Oct 2023 13:37:58 GMT Last-Modified Wed, 02 Mar 2022 23:10:36 GMT Server Apache Content-Type image/gif Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 33869
GET H/1.1	200 OK	Texta-Regular.woff login.45-12-253-40.cprapid.com/	32 KB 32 KB	76ms 50ms	Font font/woff	45.12.253.40 AS_DELIS
General Check archive.org Show headers Download Go to Full URL http://login.45-12-253-40.cprapid.com/Texta-Regular.woff Requested by Host: login.45-12-253-40.cprapid.com URL: http://login.45-12-253-40.cprapid.com/ Protocol HTTP/1.1 Server 45.12.253.40 Amsterdam, Netherlands, ASN211252 (AS_DELIS, US), Reverse DNS Software Apache / Resource Hash `4563e60af72ef8d0cc8b7c64716d81610d2f6595c7f76c8069b2015a89d623e2` Request headers Referer http://login.45-12-253-40.cprapid.com/ Origin http://login.45-12-253-40.cprapid.com accept-language pl-PL,pl;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36 Response headers Date Mon, 02 Oct 2023 13:37:58 GMT Last-Modified Tue, 15 Mar 2022 15:13:02 GMT Server Apache Content-Type font/woff Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 32376
GET H2	200	8a501f860d70f42e5100568c07885c9b3daa8ceb.json Show response bootstrap.smartsuppchat.com/widget/	1 KB 680 B	157ms 54ms	XHR application/json	18.158.207.158 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://bootstrap.smartsuppchat.com/widget/8a501f860d70f42e5100568c07885c9b3daa8ceb.json Requested by Host: www.smartsuppchat.com URL: https://www.smartsuppchat.com/loader.js? Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.158.207.158 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-158-207-158.eu-central-1.compute.amazonaws.com Software / Resource Hash `193913d50df68862b548a83c9196d6553cdf0febc28fd5d28e255df4165125c9` Request headers Referer http://login.45-12-253-40.cprapid.com/ accept-language pl-PL,pl;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36 Content-Type text/plain Response headers x-version 62713eedc1f171511be259caec0493e3a10586ea date Mon, 02 Oct 2023 13:37:58 GMT content-encoding br x-hit redis etag "4c3-+DFqOCuAWYd5cr3YQAjZysDMWK8" vary Accept-Encoding content-type application/json; charset=utf-8 access-control-allow-origin * cache-control private, max-age=0, must-revalidate
GET H2	200	manifest.json Show response widget-v3.smartsuppcdn.com/	2 KB 811 B	161ms 49ms	XHR application/json	195.181.175.40 CDN77 ^_^
General Check archive.org Show headers Download Go to Full URL https://widget-v3.smartsuppcdn.com/manifest.json Requested by Host: www.smartsuppchat.com URL: https://www.smartsuppchat.com/loader.js? Protocol H2 Security TLS 1.3, , AES_256_GCM Server 195.181.175.40 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB), Reverse DNS 824291365.fra.cdn77.com Software CDN77-Turbo / Resource Hash `935053f0dc23286ef54a08164df83e940ff51c6b8f5ca12f66f7d94c45c5f426` Request headers Referer http://login.45-12-253-40.cprapid.com/ accept-language pl-PL,pl;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36 Content-Type text/plain Response headers x-77-pop frankfurtDE date Mon, 02 Oct 2023 13:37:58 GMT content-encoding gzip x-cache HIT x-77-cache HIT x-age 50 x-accel-date 1696253828 x-77-nzt AcO1rydk1x3/MgAAAA x-accel-expires @1696253888 x-77-age 50 last-modified Wed, 27 Sep 2023 05:10:25 GMT server CDN77-Turbo etag W/"6513b941-626" x-77-nzt-ray 25b02131919fb63cb6c71a658713f537 vary Accept-Encoding content-type application/json access-control-allow-origin * cache-control max-age=300, public, s-maxage=60 expires Wed, 27 Sep 2023 05:32:27 GMT
GET H2	200	main-ba57143d.js Show response widget-v3.smartsuppcdn.com/assets/ Frame 74F0	91 KB 32 KB	71ms 70ms	Script application/javascript	195.181.175.40 CDN77 ^_^
General Check archive.org Show headers Download Go to Full URL https://widget-v3.smartsuppcdn.com/assets/main-ba57143d.js Requested by Host: www.smartsuppchat.com URL: https://www.smartsuppchat.com/loader.js? Protocol H2 Security TLS 1.3, , AES_256_GCM Server 195.181.175.40 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB), Reverse DNS 824291365.fra.cdn77.com Software CDN77-Turbo / Resource Hash `7c6aeb25a94a026b2f3cec92a5a0a0b46b03825ed140570dde1d88b59d067663` Request headers Referer Origin http://login.45-12-253-40.cprapid.com accept-language pl-PL,pl;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36 Response headers x-77-pop frankfurtDE date Mon, 02 Oct 2023 13:37:58 GMT content-encoding gzip x-cache HIT x-77-cache HIT x-age 461431 x-accel-date 1695792447 x-77-nzt AcO1rycJSM//dwoHAA x-accel-expires @1727328447 x-77-age 461431 last-modified Wed, 27 Sep 2023 05:10:25 GMT server CDN77-Turbo etag W/"6513b941-16c06" x-77-nzt-ray 25b02131919fb63cb6c71a65a6ce3d3b vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control max-age=31536000, public, immutable expires Thu, 26 Sep 2024 05:27:27 GMT
GET H2	200	vendor-6c9589b8.js Show response widget-v3.smartsuppcdn.com/assets/ Frame 74F0	157 KB 52 KB	139ms 138ms	Script application/javascript	195.181.175.40 CDN77 ^_^
General Check archive.org Show headers Download Go to Full URL https://widget-v3.smartsuppcdn.com/assets/vendor-6c9589b8.js Requested by Host: www.smartsuppchat.com URL: https://www.smartsuppchat.com/loader.js? Protocol H2 Security TLS 1.3, , AES_256_GCM Server 195.181.175.40 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB), Reverse DNS 824291365.fra.cdn77.com Software CDN77-Turbo / Resource Hash `91d5768d3bbffe391672e9aac374ec27f2bb7250795bd8e13e3af0dc709154a8` Request headers Referer Origin http://login.45-12-253-40.cprapid.com accept-language pl-PL,pl;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36 Response headers x-77-pop frankfurtDE date Mon, 02 Oct 2023 13:37:58 GMT content-encoding gzip x-cache HIT x-77-cache HIT x-age 461431 x-accel-date 1695792447 x-77-nzt AcO1rycP4Bj/dwoHAA x-accel-expires @1727328447 x-77-age 461431 last-modified Wed, 27 Sep 2023 05:10:25 GMT server CDN77-Turbo etag W/"6513b941-27246" x-77-nzt-ray 25b02131919fb63cb6c71a65090d833b vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control max-age=31536000, public, immutable expires Thu, 26 Sep 2024 05:27:27 GMT
GET H2	200	style-2a175354.css widget-v3.smartsuppcdn.com/assets/ Frame 74F0	31 KB 7 KB	118ms 118ms	Stylesheet text/css	195.181.175.40 CDN77 ^_^
General Check archive.org Show headers Download Go to Full URL https://widget-v3.smartsuppcdn.com/assets/style-2a175354.css Requested by Host: www.smartsuppchat.com URL: https://www.smartsuppchat.com/loader.js? Protocol H2 Security TLS 1.3, , AES_256_GCM Server 195.181.175.40 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB), Reverse DNS 824291365.fra.cdn77.com Software CDN77-Turbo / Resource Hash `a47be5f03963969da84fceef21f13f468238f98f7c4e4f7167a7349b4285d497` Request headers Referer Origin http://login.45-12-253-40.cprapid.com accept-language pl-PL,pl;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36 Response headers x-77-pop frankfurtDE date Mon, 02 Oct 2023 13:37:58 GMT content-encoding gzip x-cache HIT x-77-cache HIT x-age 461431 x-accel-date 1695792447 x-77-nzt AcO1ryeSBSX/dwoHAA x-accel-expires @1727328447 x-77-age 461431 last-modified Wed, 27 Sep 2023 05:10:25 GMT server CDN77-Turbo etag W/"6513b941-7d54" x-77-nzt-ray 25b02131919fb63cb6c71a659a66743b vary Accept-Encoding content-type text/css access-control-allow-origin * cache-control max-age=31536000, public, immutable expires Thu, 26 Sep 2024 05:27:27 GMT
GET H2	200	defaults Show response translations.smartsuppcdn.com/api/v1/widget/translations/lang/it/ Frame 74F0	6 KB 3 KB	160ms 49ms	Fetch application/json	195.181.175.41 CDN77 ^_^
General Check archive.org Show headers Download Go to Full URL https://translations.smartsuppcdn.com/api/v1/widget/translations/lang/it/defaults Requested by Host: widget-v3.smartsuppcdn.com URL: https://widget-v3.smartsuppcdn.com/assets/vendor-6c9589b8.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 195.181.175.41 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB), Reverse DNS 824291365.fra.cdn77.com Software CDN77-Turbo / Resource Hash `9a2ff9004d1e953b8613d3cc77226e06b75ed710e6c249c6704dce963e8cb678` Request headers accept-language pl-PL,pl;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36 Response headers x-77-pop frankfurtDE x-version 8914f448cebfac3c4084e881e9fa72c39900efaf date Mon, 02 Oct 2023 13:37:59 GMT content-encoding gzip x-cache HIT x-77-cache HIT x-age 266 x-accel-date 1696253613 x-response-time 0ms x-77-nzt AcO1ryd1ydT/CgEAAA x-accel-expires @1696254213 x-77-age 266 server CDN77-Turbo x-77-nzt-ray 25b02131fea12a46b7c71a65e06c5a12 vary Accept-Encoding, Origin content-type application/json; charset=utf-8 access-control-allow-origin * cache-control max-age=600

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Poste Italiane (Online)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			login.45-12-253-40.cprapid.com/	1970-01-21 00:46:53	Name: COOKIE_KEY Value: 169625387812

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bootstrap.smartsuppchat.com
login.45-12-253-40.cprapid.com
translations.smartsuppcdn.com
widget-v3.smartsuppcdn.com
www.smartsuppchat.com
156.146.33.141
18.158.207.158
195.181.175.40
195.181.175.41
45.12.253.40
193913d50df68862b548a83c9196d6553cdf0febc28fd5d28e255df4165125c9
2cc5184a6d1c9f3b5f07fb1b79d4083006cc5b9a86200851eef39fd68a6406af
4563e60af72ef8d0cc8b7c64716d81610d2f6595c7f76c8069b2015a89d623e2
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
6cfde476dffc41c1ba2f4a228f1f2be0052d7f67093674264506377577e4cd09
7c6aeb25a94a026b2f3cec92a5a0a0b46b03825ed140570dde1d88b59d067663
8b922a249c9f81562d99eee24407bf38c7feac74a10dfe712292c0b032144dfa
8bb3d9c7732fea4af7c9e2dd895d14091859b48ee8bb6fc8eba724b27907a0a0
91d5768d3bbffe391672e9aac374ec27f2bb7250795bd8e13e3af0dc709154a8
935053f0dc23286ef54a08164df83e940ff51c6b8f5ca12f66f7d94c45c5f426
9a2ff9004d1e953b8613d3cc77226e06b75ed710e6c249c6704dce963e8cb678
9e3ec8fde823fb0178e76391aa3fc10e2f277d4e50b75fb00e6c195f3dec11fe
a47be5f03963969da84fceef21f13f468238f98f7c4e4f7167a7349b4285d497
b98b52b6f7cfb28e5e097f3bc02d50335264686a95ee79b7603737c8e78e5a7c
cf4a172da82df7d22d9b0bea415bb6c2a2080dc6bb600f96effc73b517dcc11a
ea638c8244c7a5cc50e617807b1fc35637430f976e8210ef3d560a5eb059e5f5

login.45-12-253-40.cprapid.com Open in urlscan Pro 45.12.253.40 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

16 Requests

44 %HTTPS

0 %IPv6

3 Domains

5 Subdomains

5 IPs

2 Countries

656 kBTransfer

859 kBSize

1 Cookies

0 Outgoing links

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

8 JavaScript Global Variables

1 Cookies

Indicators

login.45-12-253-40.cprapid.com Open in urlscan Pro
45.12.253.40 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

44 %
HTTPS

0 %
IPv6

3
Domains

5
Subdomains

5
IPs

2
Countries

656 kB
Transfer

859 kB
Size

1
Cookies

16 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!