pt.18-213-154-243.cprapid.com Open in urlscan Pro
18.213.154.243 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://pt.18-213-154-243.cprapid.com/
Submission: On August 10 via api (August 10th 2023, 11:34:29 pm UTC) from JP — Scanned from JP

Summary HTTP 16 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 3 countries across 3 domains to perform 16 HTTP transactions. The main IP is 18.213.154.243, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is pt.18-213-154-243.cprapid.com.
TLS certificate: Issued by ZeroSSL RSA Domain Secure Site CA on August 10th 2023. Valid for: 3 months.

This is the only time pt.18-213-154-243.cprapid.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Poste Italiane (Online)

Domain & IP information

	IP Address	AS Autonomous System
9	18.213.154.243 18.213.154.243	14618 (AMAZON-AES) (AMAZON-AES)
1	2a02:6ea0:d30... 2a02:6ea0:d300::10	60068 (CDN77 ^_^) (CDN77 ^_^)
1	3.68.181.36 3.68.181.36	16509 (AMAZON-02) (AMAZON-02)
5	2a02:6ea0:d30... 2a02:6ea0:d300::13	60068 (CDN77 ^_^) (CDN77 ^_^)
16	4

9 18.213.154.243 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-213-154-243.compute-1.amazonaws.com

pt.18-213-154-243.cprapid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:6ea0:d300::10 (Tokyo, Japan)

ASN60068 (CDN77 ^_^, GB)

www.smartsuppchat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.68.181.36 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-68-181-36.eu-central-1.compute.amazonaws.com

bootstrap.smartsuppchat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a02:6ea0:d300::13 (Tokyo, Japan)

ASN60068 (CDN77 ^_^, GB)

widget-v3.smartsuppcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
translations.smartsuppcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	cprapid.com pt.18-213-154-243.cprapid.com	554 KB
5	smartsuppcdn.com widget-v3.smartsuppcdn.com — Cisco Umbrella Rank: 56669 translations.smartsuppcdn.com — Cisco Umbrella Rank: 59486	87 KB
2	smartsuppchat.com www.smartsuppchat.com — Cisco Umbrella Rank: 53395 bootstrap.smartsuppchat.com — Cisco Umbrella Rank: 48924	7 KB
16	3

	Domain	Requested by
9	pt.18-213-154-243.cprapid.com	pt.18-213-154-243.cprapid.com
4	widget-v3.smartsuppcdn.com	www.smartsuppchat.com
1	translations.smartsuppcdn.com	widget-v3.smartsuppcdn.com
1	bootstrap.smartsuppchat.com	www.smartsuppchat.com
1	www.smartsuppchat.com	pt.18-213-154-243.cprapid.com
16	5

This site contains no links.

Subject Issuer	Validity	Valid
pt.18-213-154-243.cprapid.com ZeroSSL RSA Domain Secure Site CA	`2023-08-10` - `2023-11-08`	3 months	crt.sh
*.smartsuppchat.com RapidSSL Global TLS RSA4096 SHA256 2022 CA1	`2022-11-30` - `2023-12-29`	a year	crt.sh
*.smartsuppcdn.com RapidSSL Global TLS RSA4096 SHA256 2022 CA1	`2022-10-19` - `2023-11-19`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://pt.18-213-154-243.cprapid.com/
Frame ID: 217EA1C5CCCB826AED67F751334392E3
Requests: 12 HTTP requests in this frame

Frame: https://widget-v3.smartsuppcdn.com/assets/main-8c985b09.js
Frame ID: 55D94BC0FBAC0E69211E08605F06E8CA
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Accedi

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

16
Requests

100 %
HTTPS

50 %
IPv6

3
Domains

5
Subdomains

4
IPs

3
Countries

648 kB
Transfer

841 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response pt.18-213-154-243.cprapid.com/	6 KB 7 KB	634ms 196ms	Document text/html	18.213.154.243 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://pt.18-213-154-243.cprapid.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 18.213.154.243 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-18-213-154-243.compute-1.amazonaws.com Software Apache / Resource Hash `8bb3d9c7732fea4af7c9e2dd895d14091859b48ee8bb6fc8eba724b27907a0a0` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 accept-language jp-JP,jp;q=0.9 Response headers Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Thu, 10 Aug 2023 23:34:24 GMT Keep-Alive timeout=5, max=100 Server Apache Transfer-Encoding chunked
GET H/1.1	200 OK	bootstrap.min.css pt.18-213-154-243.cprapid.com/css/	119 KB 120 KB	159ms 158ms	Stylesheet text/css	18.213.154.243 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://pt.18-213-154-243.cprapid.com/css/bootstrap.min.css Requested by Host: pt.18-213-154-243.cprapid.com URL: https://pt.18-213-154-243.cprapid.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 18.213.154.243 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-18-213-154-243.compute-1.amazonaws.com Software Apache / Resource Hash `8b922a249c9f81562d99eee24407bf38c7feac74a10dfe712292c0b032144dfa` Request headers accept-language jp-JP,jp;q=0.9 Referer https://pt.18-213-154-243.cprapid.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 Response headers Date Thu, 10 Aug 2023 23:34:24 GMT Last-Modified Sun, 22 Nov 2020 14:41:24 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 122291
GET H/1.1	200 OK	css.css pt.18-213-154-243.cprapid.com/css/	206 KB 206 KB	162ms 160ms	Stylesheet text/css	18.213.154.243 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://pt.18-213-154-243.cprapid.com/css/css.css Requested by Host: pt.18-213-154-243.cprapid.com URL: https://pt.18-213-154-243.cprapid.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 18.213.154.243 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-18-213-154-243.compute-1.amazonaws.com Software Apache / Resource Hash `6cfde476dffc41c1ba2f4a228f1f2be0052d7f67093674264506377577e4cd09` Request headers accept-language jp-JP,jp;q=0.9 Referer https://pt.18-213-154-243.cprapid.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 Response headers Date Thu, 10 Aug 2023 23:34:24 GMT Last-Modified Thu, 03 Mar 2022 00:19:04 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 210727
GET H/1.1	200 OK	jquery.min.js Show response pt.18-213-154-243.cprapid.com/css/	95 KB 95 KB	501ms 166ms	Script application/javascript	18.213.154.243 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://pt.18-213-154-243.cprapid.com/css/jquery.min.js Requested by Host: pt.18-213-154-243.cprapid.com URL: https://pt.18-213-154-243.cprapid.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 18.213.154.243 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-18-213-154-243.compute-1.amazonaws.com Software Apache / Resource Hash `668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404` Request headers accept-language jp-JP,jp;q=0.9 Referer https://pt.18-213-154-243.cprapid.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 Response headers Date Thu, 10 Aug 2023 23:34:25 GMT Last-Modified Sun, 22 Nov 2020 14:41:24 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 97163
GET H/1.1	200 OK	logo.png pt.18-213-154-243.cprapid.com/	53 KB 53 KB	160ms 160ms	Image image/png	18.213.154.243 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://pt.18-213-154-243.cprapid.com/logo.png Requested by Host: pt.18-213-154-243.cprapid.com URL: https://pt.18-213-154-243.cprapid.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 18.213.154.243 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-18-213-154-243.compute-1.amazonaws.com Software Apache / Resource Hash `2cc5184a6d1c9f3b5f07fb1b79d4083006cc5b9a86200851eef39fd68a6406af` Request headers accept-language jp-JP,jp;q=0.9 Referer https://pt.18-213-154-243.cprapid.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 Response headers Date Thu, 10 Aug 2023 23:34:25 GMT Last-Modified Mon, 08 May 2023 08:01:20 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 54002
GET H/1.1	200 OK	img1.png pt.18-213-154-243.cprapid.com/css/	6 KB 7 KB	160ms 160ms	Image image/png	18.213.154.243 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://pt.18-213-154-243.cprapid.com/css/img1.png Requested by Host: pt.18-213-154-243.cprapid.com URL: https://pt.18-213-154-243.cprapid.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 18.213.154.243 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-18-213-154-243.compute-1.amazonaws.com Software Apache / Resource Hash `cf4a172da82df7d22d9b0bea415bb6c2a2080dc6bb600f96effc73b517dcc11a` Request headers accept-language jp-JP,jp;q=0.9 Referer https://pt.18-213-154-243.cprapid.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 Response headers Date Thu, 10 Aug 2023 23:34:25 GMT Last-Modified Thu, 03 Feb 2022 14:38:04 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 6467
GET H/1.1	200 OK	ico-messages-info.png pt.18-213-154-243.cprapid.com/	2 KB 2 KB	166ms 166ms	Image image/png	18.213.154.243 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://pt.18-213-154-243.cprapid.com/ico-messages-info.png Requested by Host: pt.18-213-154-243.cprapid.com URL: https://pt.18-213-154-243.cprapid.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 18.213.154.243 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-18-213-154-243.compute-1.amazonaws.com Software Apache / Resource Hash `b98b52b6f7cfb28e5e097f3bc02d50335264686a95ee79b7603737c8e78e5a7c` Request headers accept-language jp-JP,jp;q=0.9 Referer https://pt.18-213-154-243.cprapid.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 Response headers Date Thu, 10 Aug 2023 23:34:25 GMT Last-Modified Wed, 02 Mar 2022 23:57:20 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 2135
GET H2	200	loader.js Show response www.smartsuppchat.com/	19 KB 6 KB	14ms 1ms	Script application/javascript	2a02:6ea0:d300::10 CDN77 ^_^
General Check archive.org Show headers Download Go to Full URL https://www.smartsuppchat.com/loader.js? Requested by Host: pt.18-213-154-243.cprapid.com URL: https://pt.18-213-154-243.cprapid.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6ea0:d300::10 Tokyo, Japan, ASN60068 (CDN77 ^_^, GB), Reverse DNS Software CDN77-Turbo / Resource Hash `9e3ec8fde823fb0178e76391aa3fc10e2f277d4e50b75fb00e6c195f3dec11fe` Request headers accept-language jp-JP,jp;q=0.9 Referer https://pt.18-213-154-243.cprapid.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 Response headers x-77-pop tokyoJP date Thu, 10 Aug 2023 23:34:25 GMT content-encoding gzip x-cache HIT x-77-cache HIT x-age 48 x-accel-date 1691710417 x-77-nzt AVm7oBQaj83/MAAAAA x-accel-expires @1691710477 last-modified Thu, 29 Jun 2023 04:51:04 GMT server CDN77-Turbo etag W/"649d0db8-4c98" x-77-nzt-ray 4c472506475d32180174d56467716233 vary Accept-Encoding content-type application/javascript cache-control max-age=300, public, s-maxage=60 expires Thu, 29 Jun 2023 04:57:33 GMT
GET H/1.1	200 OK	spinner_giallo.gif pt.18-213-154-243.cprapid.com/	33 KB 33 KB	159ms 159ms	Image image/gif	18.213.154.243 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://pt.18-213-154-243.cprapid.com/spinner_giallo.gif Requested by Host: pt.18-213-154-243.cprapid.com URL: https://pt.18-213-154-243.cprapid.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 18.213.154.243 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-18-213-154-243.compute-1.amazonaws.com Software Apache / Resource Hash `ea638c8244c7a5cc50e617807b1fc35637430f976e8210ef3d560a5eb059e5f5` Request headers accept-language jp-JP,jp;q=0.9 Referer https://pt.18-213-154-243.cprapid.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 Response headers Date Thu, 10 Aug 2023 23:34:25 GMT Last-Modified Thu, 03 Mar 2022 00:10:36 GMT Server Apache Content-Type image/gif Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 33869
GET H/1.1	200 OK	Texta-Regular.woff pt.18-213-154-243.cprapid.com/	32 KB 32 KB	204ms 160ms	Font font/woff	18.213.154.243 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://pt.18-213-154-243.cprapid.com/Texta-Regular.woff Requested by Host: pt.18-213-154-243.cprapid.com URL: https://pt.18-213-154-243.cprapid.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 18.213.154.243 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-18-213-154-243.compute-1.amazonaws.com Software Apache / Resource Hash `4563e60af72ef8d0cc8b7c64716d81610d2f6595c7f76c8069b2015a89d623e2` Request headers Referer https://pt.18-213-154-243.cprapid.com/ Origin https://pt.18-213-154-243.cprapid.com accept-language jp-JP,jp;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 Response headers Date Thu, 10 Aug 2023 23:34:25 GMT Last-Modified Tue, 15 Mar 2022 16:13:02 GMT Server Apache Content-Type font/woff Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 32376
GET H2	200	8a501f860d70f42e5100568c07885c9b3daa8ceb.json Show response bootstrap.smartsuppchat.com/widget/	1 KB 673 B	767ms 246ms	XHR application/json	3.68.181.36 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://bootstrap.smartsuppchat.com/widget/8a501f860d70f42e5100568c07885c9b3daa8ceb.json Requested by Host: www.smartsuppchat.com URL: https://www.smartsuppchat.com/loader.js? Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.68.181.36 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-68-181-36.eu-central-1.compute.amazonaws.com Software / Resource Hash `b38a7fd2a132199cfc4d27b966b1fc7d9af23a5831188272135e3dcf445e2a6c` Request headers Referer https://pt.18-213-154-243.cprapid.com/ accept-language jp-JP,jp;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 Content-Type text/plain Response headers x-version 62713eedc1f171511be259caec0493e3a10586ea date Thu, 10 Aug 2023 23:34:26 GMT content-encoding br x-hit redis etag "4a8-pGFrhd6PFB0SZzJ7kgyr7synxH0" vary Accept-Encoding content-type application/json; charset=utf-8 access-control-allow-origin * cache-control private, max-age=0, must-revalidate
GET H2	200	manifest.json Show response widget-v3.smartsuppcdn.com/	1 KB 722 B	79ms 1ms	XHR application/json	2a02:6ea0:d300::13 CDN77 ^_^
General Check archive.org Show headers Download Go to Full URL https://widget-v3.smartsuppcdn.com/manifest.json Requested by Host: www.smartsuppchat.com URL: https://www.smartsuppchat.com/loader.js? Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6ea0:d300::13 Tokyo, Japan, ASN60068 (CDN77 ^_^, GB), Reverse DNS Software CDN77-Turbo / Resource Hash `22cdac7816c18a283e0e72c65944b2d210ceb183e9beb2817c95bede6d74a443` Request headers Referer https://pt.18-213-154-243.cprapid.com/ accept-language jp-JP,jp;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 Content-Type text/plain Response headers x-77-pop tokyoJP date Thu, 10 Aug 2023 23:34:26 GMT content-encoding gzip x-cache HIT x-77-cache HIT x-age 60 x-accel-date 1691710406 x-77-nzt AVm7oB0UHVf/PAAAAA x-accel-expires @1691710466 last-modified Wed, 26 Jul 2023 09:45:25 GMT server CDN77-Turbo etag W/"64c0eb35-402" x-77-nzt-ray f5cf380c443c3db80274d564fd0ead2b vary Accept-Encoding content-type application/json access-control-allow-origin * cache-control max-age=300, public, s-maxage=60 expires Wed, 26 Jul 2023 10:08:23 GMT
GET H2	200	main-8c985b09.js Show response widget-v3.smartsuppcdn.com/assets/ Frame 55D9	100 KB 35 KB	3ms 3ms	Script application/javascript	2a02:6ea0:d300::13 CDN77 ^_^
General Check archive.org Show headers Download Go to Full URL https://widget-v3.smartsuppcdn.com/assets/main-8c985b09.js Requested by Host: www.smartsuppchat.com URL: https://www.smartsuppchat.com/loader.js? Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6ea0:d300::13 Tokyo, Japan, ASN60068 (CDN77 ^_^, GB), Reverse DNS Software CDN77-Turbo / Resource Hash `9cd071c9bc3691de8cb2448cddcc2e74386839a68b6e16e4a54fd25c72f38ce2` Request headers Referer Origin https://pt.18-213-154-243.cprapid.com accept-language jp-JP,jp;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 Response headers x-77-pop tokyoJP date Thu, 10 Aug 2023 23:34:26 GMT content-encoding gzip x-cache HIT x-77-cache HIT x-age 1344629 x-accel-date 1690365837 x-77-nzt AVm7oB3B/bP/dYQUAA x-accel-expires @1721901837 last-modified Wed, 26 Jul 2023 09:45:25 GMT server CDN77-Turbo etag W/"64c0eb35-19029" x-77-nzt-ray f5cf380c443c3db80274d5649fafcd2b vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control max-age=31536000, public, immutable expires Thu, 25 Jul 2024 10:03:57 GMT
GET H2	200	vendor-e5ec23cc.js Show response widget-v3.smartsuppcdn.com/assets/ Frame 55D9	133 KB 42 KB	6ms 6ms	Script application/javascript	2a02:6ea0:d300::13 CDN77 ^_^
General Check archive.org Show headers Download Go to Full URL https://widget-v3.smartsuppcdn.com/assets/vendor-e5ec23cc.js Requested by Host: www.smartsuppchat.com URL: https://www.smartsuppchat.com/loader.js? Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6ea0:d300::13 Tokyo, Japan, ASN60068 (CDN77 ^_^, GB), Reverse DNS Software CDN77-Turbo / Resource Hash `d40730cc03b5b45b60d867ca34925c5725ba933ca5dd2925b9c467e01db0515d` Request headers Referer Origin https://pt.18-213-154-243.cprapid.com accept-language jp-JP,jp;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 Response headers x-77-pop tokyoJP date Thu, 10 Aug 2023 23:34:26 GMT content-encoding gzip x-cache HIT x-77-cache HIT x-age 1344629 x-accel-date 1690365837 x-77-nzt AVm7oB2nPsz/dYQUAA x-accel-expires @1721901837 last-modified Wed, 26 Jul 2023 09:45:25 GMT server CDN77-Turbo etag W/"64c0eb35-21307" x-77-nzt-ray f5cf380c443c3db80274d564c3e5042c vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control max-age=31536000, public, immutable expires Thu, 25 Jul 2024 10:03:57 GMT
GET H2	200	style-2d1c9e30.css widget-v3.smartsuppcdn.com/assets/ Frame 55D9	28 KB 7 KB	8ms 8ms	Stylesheet text/css	2a02:6ea0:d300::13 CDN77 ^_^
General Check archive.org Show headers Download Go to Full URL https://widget-v3.smartsuppcdn.com/assets/style-2d1c9e30.css Requested by Host: www.smartsuppchat.com URL: https://www.smartsuppchat.com/loader.js? Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6ea0:d300::13 Tokyo, Japan, ASN60068 (CDN77 ^_^, GB), Reverse DNS Software CDN77-Turbo / Resource Hash `7a9b4687ad87ac21fc7a196eb35dc28d8a5241a1b85a90d2371f49fc5288aa0e` Request headers Referer Origin https://pt.18-213-154-243.cprapid.com accept-language jp-JP,jp;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 Response headers x-77-pop tokyoJP date Thu, 10 Aug 2023 23:34:26 GMT content-encoding gzip x-cache HIT x-77-cache HIT x-age 1344629 x-accel-date 1690365837 x-77-nzt AVm7oB2lNj7/dYQUAA x-accel-expires @1721901837 last-modified Wed, 26 Jul 2023 09:45:25 GMT server CDN77-Turbo etag W/"64c0eb35-7138" x-77-nzt-ray f5cf380c443c3db80274d564d5a63c2c vary Accept-Encoding content-type text/css access-control-allow-origin * cache-control max-age=31536000, public, immutable expires Thu, 25 Jul 2024 10:03:57 GMT
GET H2	200	defaults Show response translations.smartsuppcdn.com/api/v1/widget/translations/lang/it/ Frame 55D9	6 KB 3 KB	5ms 1ms	Fetch application/json	2a02:6ea0:d300::13 CDN77 ^_^
General Check archive.org Show headers Download Go to Full URL https://translations.smartsuppcdn.com/api/v1/widget/translations/lang/it/defaults Requested by Host: widget-v3.smartsuppcdn.com URL: https://widget-v3.smartsuppcdn.com/assets/vendor-e5ec23cc.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6ea0:d300::13 Tokyo, Japan, ASN60068 (CDN77 ^_^, GB), Reverse DNS Software CDN77-Turbo / Resource Hash `bcc7db6f5b88781193fdb980d577bd937daca8a39b2ad1b332e6be6ee3b26d10` Request headers accept-language jp-JP,jp;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 Response headers x-77-pop tokyoJP x-version 53af494c8b6bbd7be2e2e201ce09a4c9124a68bd date Thu, 10 Aug 2023 23:34:26 GMT content-encoding gzip x-cache HIT x-77-cache HIT x-age 303 x-accel-date 1691710163 x-response-time 0ms x-77-nzt AVm7oB2Akcz/LwEAAA x-accel-expires @1691710763 server CDN77-Turbo x-77-nzt-ray f5cf380c443c3db80274d56485c8eb2d vary Accept-Encoding, Origin content-type application/json; charset=utf-8 access-control-allow-origin * cache-control max-age=600

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Poste Italiane (Online)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			pt.18-213-154-243.cprapid.com/	1970-01-20 23:31:10	Name: COOKIE_KEY Value: 169171046457

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bootstrap.smartsuppchat.com
pt.18-213-154-243.cprapid.com
translations.smartsuppcdn.com
widget-v3.smartsuppcdn.com
www.smartsuppchat.com
18.213.154.243
2a02:6ea0:d300::10
2a02:6ea0:d300::13
3.68.181.36
22cdac7816c18a283e0e72c65944b2d210ceb183e9beb2817c95bede6d74a443
2cc5184a6d1c9f3b5f07fb1b79d4083006cc5b9a86200851eef39fd68a6406af
4563e60af72ef8d0cc8b7c64716d81610d2f6595c7f76c8069b2015a89d623e2
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
6cfde476dffc41c1ba2f4a228f1f2be0052d7f67093674264506377577e4cd09
7a9b4687ad87ac21fc7a196eb35dc28d8a5241a1b85a90d2371f49fc5288aa0e
8b922a249c9f81562d99eee24407bf38c7feac74a10dfe712292c0b032144dfa
8bb3d9c7732fea4af7c9e2dd895d14091859b48ee8bb6fc8eba724b27907a0a0
9cd071c9bc3691de8cb2448cddcc2e74386839a68b6e16e4a54fd25c72f38ce2
9e3ec8fde823fb0178e76391aa3fc10e2f277d4e50b75fb00e6c195f3dec11fe
b38a7fd2a132199cfc4d27b966b1fc7d9af23a5831188272135e3dcf445e2a6c
b98b52b6f7cfb28e5e097f3bc02d50335264686a95ee79b7603737c8e78e5a7c
bcc7db6f5b88781193fdb980d577bd937daca8a39b2ad1b332e6be6ee3b26d10
cf4a172da82df7d22d9b0bea415bb6c2a2080dc6bb600f96effc73b517dcc11a
d40730cc03b5b45b60d867ca34925c5725ba933ca5dd2925b9c467e01db0515d
ea638c8244c7a5cc50e617807b1fc35637430f976e8210ef3d560a5eb059e5f5

pt.18-213-154-243.cprapid.com Open in urlscan Pro 18.213.154.243 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

16 Requests

100 %HTTPS

50 %IPv6

3 Domains

5 Subdomains

4 IPs

3 Countries

648 kBTransfer

841 kBSize

1 Cookies

0 Outgoing links

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

8 JavaScript Global Variables

1 Cookies

Indicators

pt.18-213-154-243.cprapid.com Open in urlscan Pro
18.213.154.243 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

100 %
HTTPS

50 %
IPv6

3
Domains

5
Subdomains

4
IPs

3
Countries

648 kB
Transfer

841 kB
Size

1
Cookies

16 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!