modulo.52-47-145-200.cprapid.com Open in urlscan Pro
52.47.145.200 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://ab.gl/loginprofilo
Effective URL:
https://modulo.52-47-145-200.cprapid.com/it/
Submission: On February 28 via api (February 28th 2023, 4:46:40 pm UTC) from US — Scanned from IT

Summary HTTP 11 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 6 IPs in 4 countries across 6 domains to perform 11 HTTP transactions. The main IP is 52.47.145.200, located in Paris, France and belongs to AMAZON-02, US. The main domain is modulo.52-47-145-200.cprapid.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on February 27th 2023. Valid for: 3 months.

This is the only time modulo.52-47-145-200.cprapid.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: BNP Paribas (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 1	141.136.46.104 141.136.46.104	47583 (AS-HOSTINGER) (AS-HOSTINGER)
1	52.47.145.200 52.47.145.200	16509 (AMAZON-02) (AMAZON-02)
1	2a02:6ea0:f40... 2a02:6ea0:f400::4	60068 (CDN77 ^_^) (CDN77 ^_^)
1	3.124.23.62 3.124.23.62	16509 (AMAZON-02) (AMAZON-02)
7	2a02:6ea0:c70... 2a02:6ea0:c700::18	60068 (CDN77 ^_^) (CDN77 ^_^)
1	18.195.68.253 18.195.68.253	16509 (AMAZON-02) (AMAZON-02)
11	6

1 141.136.46.104 (Asheville, United States) 1 redirects

ASN47583 (AS-HOSTINGER, CY)

ab.gl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.47.145.200 (Paris, France)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-47-145-200.eu-west-3.compute.amazonaws.com

modulo.52-47-145-200.cprapid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:6ea0:f400::4 (Zagreb, Croatia)

ASN60068 (CDN77 ^_^, GB)

www.smartsuppchat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.124.23.62 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-124-23-62.eu-central-1.compute.amazonaws.com

bootstrap.smartsuppchat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a02:6ea0:c700::18 (Frankfurt am Main, Germany)

ASN60068 (CDN77 ^_^, GB)

widget-v2.smartsuppcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
rec.smartlook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
translations.smartsuppcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.195.68.253 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-195-68-253.eu-central-1.compute.amazonaws.com

websocket-visitors.smartsupp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	smartsuppcdn.com widget-v2.smartsuppcdn.com — Cisco Umbrella Rank: 48125 translations.smartsuppcdn.com — Cisco Umbrella Rank: 51904	194 KB
2	smartlook.com rec.smartlook.com — Cisco Umbrella Rank: 23270	18 KB
2	smartsuppchat.com www.smartsuppchat.com — Cisco Umbrella Rank: 47601 bootstrap.smartsuppchat.com — Cisco Umbrella Rank: 43523	6 KB
1	smartsupp.com websocket-visitors.smartsupp.com — Cisco Umbrella Rank: 39328	230 B
1	cprapid.com modulo.52-47-145-200.cprapid.com	440 KB
1	ab.gl 1 redirects ab.gl	573 B
11	6

	Domain	Requested by
4	widget-v2.smartsuppcdn.com	www.smartsuppchat.com
2	rec.smartlook.com	widget-v2.smartsuppcdn.com rec.smartlook.com
1	websocket-visitors.smartsupp.com	widget-v2.smartsuppcdn.com
1	translations.smartsuppcdn.com	widget-v2.smartsuppcdn.com
1	bootstrap.smartsuppchat.com	www.smartsuppchat.com
1	www.smartsuppchat.com	modulo.52-47-145-200.cprapid.com
1	modulo.52-47-145-200.cprapid.com
1	ab.gl	1 redirects
11	8

This site contains links to these domains. Also see Links.

Domain
banking.bnl.it

Subject Issuer	Validity	Valid
modulo.52-47-145-200.cprapid.com cPanel, Inc. Certification Authority	`2023-02-27` - `2023-05-28`	3 months	crt.sh
*.smartsuppchat.com RapidSSL Global TLS RSA4096 SHA256 2022 CA1	`2022-11-30` - `2023-12-29`	a year	crt.sh
*.smartsuppcdn.com RapidSSL Global TLS RSA4096 SHA256 2022 CA1	`2022-10-19` - `2023-11-19`	a year	crt.sh
1610534878.rsc.cdn77.org R3	`2023-01-11` - `2023-04-11`	3 months	crt.sh
*.smartsupp.com Amazon RSA 2048 M01	`2023-02-14` - `2023-11-22`	9 months	crt.sh

This page contains 2 frames:

Primary Page: https://modulo.52-47-145-200.cprapid.com/it/
Frame ID: 3C69013B2018BF732879B065D6993667
Requests: 7 HTTP requests in this frame

Frame: https://widget-v2.smartsuppcdn.com/static/js/runtime-main.476fedce.js
Frame ID: 7143477A1D199DCBBA27E39D80E22B4B
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

BNL Login

Page URL History Show full URLs

https://ab.gl/loginprofilo HTTP 301
https://modulo.52-47-145-200.cprapid.com/it/ Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Page Statistics

11
Requests

100 %
HTTPS

33 %
IPv6

6
Domains

8
Subdomains

6
IPs

4
Countries

658 kB
Transfer

1174 kB
Size

5
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://banking.bnl.it/rsc/SupportingFiles/numero-cliente.gif
Title: Dove trovi il tuo numero Cliente

Search URL Search Domain Scan URL

URL: https://banking.bnl.it/rsc/SupportingFiles/pin.gif
Title: Dove trovi il PIN

Search URL Search Domain Scan URL

URL: https://banking.bnl.it/pubblica/RecuperoNumeroCliente
Title: Recupera Online il Numero Cliente

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://ab.gl/loginprofilo HTTP 301
https://modulo.52-47-145-200.cprapid.com/it/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
modulo.52-47-145-200.cprapid.com/it/
Redirect Chain

https://ab.gl/loginprofilo
https://modulo.52-47-145-200.cprapid.com/it/

439 KB
440 KB

1002ms
217ms

Document
text/html

52.47.145.200
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://modulo.52-47-145-200.cprapid.com/it/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.47.145.200 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-47-145-200.eu-west-3.compute.amazonaws.com
Software: Apache /
Resource Hash: 25423c378a1b20e98bce53677561ebeb4ed07cb22789a4669cb9f77275892754

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
accept-language: it-IT,it;q=0.9

Response headers

Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Date: Tue, 28 Feb 2023 16:46:35 GMT
Keep-Alive: timeout=5, max=100
Server: Apache
Transfer-Encoding: chunked

Redirect headers

access-control-allow-headers: Content-Type
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
cache-control: no-store, no-cache, must-revalidate
content-length: 0
content-security-policy: upgrade-insecure-requests
content-type: text/html; charset=UTF-8
date: Tue, 28 Feb 2023 16:46:34 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
location: https://modulo.52-47-145-200.cprapid.com/it/
platform: hostinger
pragma: no-cache
server: LiteSpeed
x-powered-by: PHP/7.4.30

GET
DATA 200
OK truncated
/ 7 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 99543d933ae6c6b53aa79a42deb665f785cba48b798e0420ae34e835a588f018

Request headers

accept-language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Content-Type: image/png

GET
H2 200 loader.js Show response
www.smartsuppchat.com/ 19 KB
6 KB 169ms
39ms Script
application/javascript 2a02:6ea0:f400::4
CDN77 ^_^

General

Check archive.org

Show headers Download Go to

Full URL: https://www.smartsuppchat.com/loader.js?
Requested by: Host: modulo.52-47-145-200.cprapid.com
URL: https://modulo.52-47-145-200.cprapid.com/it/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:f400::4 Zagreb, Croatia, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash: 827004400366298b1c2019b75c57558f2d1618bc0b27bbd2b8e03df251cfc3db

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://modulo.52-47-145-200.cprapid.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

x-77-pop: zagrebHR
date: Tue, 28 Feb 2023 16:46:35 GMT
content-encoding: gzip
x-cache: HIT
x-77-cache: HIT
x-age: 50
x-77-nzt: AamW8ooavKL/MgAAAA
x-accel-expires: @1677602805
last-modified: Wed, 28 Dec 2022 13:18:33 GMT
server: CDN77-Turbo
etag: W/"63ac4229-4b9b"
x-77-nzt-ray: bcd92b1fb07d1788eb2ffe63263c4d33
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=300, public, s-maxage=60
expires: Wed, 28 Dec 2022 13:25:20 GMT

GET
H2 200 9508a0d8a676cdaa2041c52a4153c54dc6cb1ed9.json Show response
bootstrap.smartsuppchat.com/widget/ 1 KB
709 B 325ms
233ms XHR
application/json 3.124.23.62
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://bootstrap.smartsuppchat.com/widget/9508a0d8a676cdaa2041c52a4153c54dc6cb1ed9.json
Requested by: Host: www.smartsuppchat.com
URL: https://www.smartsuppchat.com/loader.js?
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.124.23.62 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-23-62.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: ca54a2bc2597b545deb5153ebe241552f6da280e8ade53bb9cd20244229184b1

Request headers

Referer: https://modulo.52-47-145-200.cprapid.com/
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
Content-Type: text/plain

Response headers

x-version: b320280dbaf559c71e48a1dd6c0a783124d40cac
date: Tue, 28 Feb 2023 16:46:36 GMT
content-encoding: br
x-hit: redis
etag: "4d9-Tt6QtpIGgVhKpZqykjVB1ehjQhc"
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=0, must-revalidate

GET
H2 200 asset-manifest.json Show response
widget-v2.smartsuppcdn.com/ 2 KB
763 B 166ms
42ms XHR
application/json 2a02:6ea0:c700::18
CDN77 ^_^

General

Check archive.org

Show headers Download Go to

Full URL: https://widget-v2.smartsuppcdn.com/asset-manifest.json
Requested by: Host: www.smartsuppchat.com
URL: https://www.smartsuppchat.com/loader.js?
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c700::18 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash: 3c22a548522722679df65b3fe11b4852396ccd5a3684f611d7980738c50464fc

Request headers

Referer: https://modulo.52-47-145-200.cprapid.com/
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
Content-Type: text/plain

Response headers

x-77-pop: frankfurtDE
date: Tue, 28 Feb 2023 16:46:36 GMT
content-encoding: gzip
x-cache: HIT
x-77-cache: HIT
x-age: 10
x-77-nzt: AZySIRmBJKD/CgAAAA
x-accel-expires: @1677602846
last-modified: Mon, 13 Feb 2023 08:33:32 GMT
server: CDN77-Turbo
etag: W/"63e9f5dc-6ce"
x-77-nzt-ray: cf878727b69943f3ec2ffe638b8cce15
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=300, public, s-maxage=60
expires: Mon, 13 Feb 2023 09:26:15 GMT

GET
H2 200 runtime-main.476fedce.js Show response
widget-v2.smartsuppcdn.com/static/js/ Frame 7143 2 KB
2 KB 109ms
35ms Script
application/javascript 2a02:6ea0:c700::18
CDN77 ^_^

General

Check archive.org

Show headers Download Go to

Full URL: https://widget-v2.smartsuppcdn.com/static/js/runtime-main.476fedce.js
Requested by: Host: www.smartsuppchat.com
URL: https://www.smartsuppchat.com/loader.js?
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c700::18 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash: 36699b912ca380a373d5de1978a2055e6112c7727e6b5041d66a77a6be407b50

Request headers

accept-language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

x-77-pop: frankfurtDE
date: Tue, 28 Feb 2023 16:46:36 GMT
content-encoding: gzip
x-cache: HIT
x-77-cache: HIT
x-age: 1322721
x-77-nzt: AZySIRntz9j/4S4UAA
x-accel-expires: @1707816075
last-modified: Mon, 13 Feb 2023 08:33:32 GMT
server: CDN77-Turbo
etag: W/"63e9f5dc-9bd"
x-77-nzt-ray: cf8787273395f2f6ec2ffe63941bce1c
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable
expires: Tue, 13 Feb 2024 09:21:15 GMT

GET
H2 200 6.80b8e19c.chunk.js Show response
widget-v2.smartsuppcdn.com/static/js/ Frame 7143 525 KB
159 KB 145ms
71ms Script
application/javascript 2a02:6ea0:c700::18
CDN77 ^_^

General

Check archive.org

Show headers Download Go to

Full URL: https://widget-v2.smartsuppcdn.com/static/js/6.80b8e19c.chunk.js
Requested by: Host: www.smartsuppchat.com
URL: https://www.smartsuppchat.com/loader.js?
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c700::18 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash: f4123664f2a6fb1437f5dae6df0748307b6baa8243c11fe364ddc8f409556575

Request headers

accept-language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

x-77-pop: frankfurtDE
date: Tue, 28 Feb 2023 16:46:36 GMT
content-encoding: gzip
x-cache: HIT
x-77-cache: HIT
x-age: 1322721
x-77-nzt: AZySIRnJ4yX/4S4UAA
x-accel-expires: @1707816075
last-modified: Mon, 13 Feb 2023 08:33:32 GMT
server: CDN77-Turbo
etag: W/"63e9f5dc-8338c"
x-77-nzt-ray: cf8787273395f2f6ec2ffe630b7fd51c
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable
expires: Tue, 13 Feb 2024 09:21:15 GMT

GET
H2 200 main.3c944932.chunk.js Show response
widget-v2.smartsuppcdn.com/static/js/ Frame 7143 115 KB
30 KB 184ms
111ms Script
application/javascript 2a02:6ea0:c700::18
CDN77 ^_^

General

Check archive.org

Show headers Download Go to

Full URL: https://widget-v2.smartsuppcdn.com/static/js/main.3c944932.chunk.js
Requested by: Host: www.smartsuppchat.com
URL: https://www.smartsuppchat.com/loader.js?
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c700::18 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash: 6fd15847073c063cb948b5cc2e9a1bc5976392aef4d50b9434bd50a61da59405

Request headers

accept-language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

x-77-pop: frankfurtDE
date: Tue, 28 Feb 2023 16:46:36 GMT
content-encoding: gzip
x-cache: HIT
x-77-cache: HIT
x-age: 1322721
x-77-nzt: AZySIRlYocf/4S4UAA
x-accel-expires: @1707816075
last-modified: Mon, 13 Feb 2023 08:33:32 GMT
server: CDN77-Turbo
etag: W/"63e9f5dc-1cc88"
x-77-nzt-ray: cf8787273395f2f6ec2ffe63c242361d
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable
expires: Tue, 13 Feb 2024 09:21:15 GMT

GET
H2 200 recorder.js Show response
rec.smartlook.com/ 3 KB
2 KB 161ms
35ms Script
application/javascript 2a02:6ea0:c700::18
CDN77 ^_^

General

Check archive.org

Show headers Download Go to

Full URL

https://rec.smartlook.com/recorder.js

Requested by

Host: widget-v2.smartsuppcdn.com
URL: https://widget-v2.smartsuppcdn.com/static/js/main.3c944932.chunk.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6ea0:c700::18 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),

Reverse DNS

Software

CDN77-Turbo /

Resource Hash

f6992885de0b28cbcf927235a4f164c9a316a4b4efaaafe53b30bd392db0172c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://modulo.52-47-145-200.cprapid.com/
Origin: https://modulo.52-47-145-200.cprapid.com
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

x-77-pop: frankfurtDE
date: Tue, 28 Feb 2023 16:46:36 GMT
strict-transport-security: max-age=31536000
content-encoding: gzip
x-cache: HIT
x-77-cache: HIT
cross-origin-resource-policy: cross-origin
x-age: 533
x-77-nzt: AZySIRk4Opb/FQIAAA
x-accel-expires: @1677602863
last-modified: Mon, 27 Feb 2023 13:40:16 GMT
server: CDN77-Turbo
etag: W/"63fcb2c0-c4a"
x-77-nzt-ray: cf878727b494f6ffec2ffe63116ea731
vary: Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=600

GET
H2 200 defaults Show response
translations.smartsuppcdn.com/api/v1/widget/translations/lang/it/ Frame 7143 6 KB
3 KB 115ms
45ms Fetch
application/json 2a02:6ea0:c700::18
CDN77 ^_^

General

Check archive.org

Show headers Download Go to

Full URL: https://translations.smartsuppcdn.com/api/v1/widget/translations/lang/it/defaults
Requested by: Host: widget-v2.smartsuppcdn.com
URL: https://widget-v2.smartsuppcdn.com/static/js/6.80b8e19c.chunk.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c700::18 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash: 6ebcc7afa8e809193927c99f2b2f1508f1f2e85fbe580e5534e7aadc5f62dc97

Request headers

accept-language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

x-77-pop: frankfurtDE
x-version: 00e9510a99a354a3e638456c70a09a41ab56ce80
date: Tue, 28 Feb 2023 16:46:36 GMT
content-encoding: gzip
x-cache: HIT
x-77-cache: HIT
x-age: 282
x-response-time: 0ms
x-77-nzt: AZySIRmCNG//GgEAAA
x-accel-expires: @1677603114
server: CDN77-Turbo
x-77-nzt-ray: cf878727b69943f3ec2ffe632332a42e
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=600

GET
H2 200 acquire Show response
websocket-visitors.smartsupp.com/balancer/ Frame 7143 76 B
230 B 145ms
42ms Fetch
application/json 18.195.68.253
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://websocket-visitors.smartsupp.com/balancer/acquire
Requested by: Host: widget-v2.smartsuppcdn.com
URL: https://widget-v2.smartsuppcdn.com/static/js/6.80b8e19c.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.195.68.253 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-68-253.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: dcd21b76d577cf3ae6c4ce82a112242d3b9cb2cc67de190e5e32ba8703a72408

Request headers

accept-language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

access-control-allow-origin: *
x-version: 70253112abbe85f179c466b00670462138c47060
date: Tue, 28 Feb 2023 16:46:36 GMT
content-length: 76
vary: Origin
content-type: application/json; charset=utf-8

GET
H2 200 init.bf9bf3347494fdee4810.js Show response
rec.smartlook.com/es6/ 54 KB
16 KB 51ms
51ms Script
application/javascript 2a02:6ea0:c700::18
CDN77 ^_^

General

Check archive.org

Show headers Download Go to

Full URL

https://rec.smartlook.com/es6/init.bf9bf3347494fdee4810.js

Requested by

Host: rec.smartlook.com
URL: https://rec.smartlook.com/recorder.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6ea0:c700::18 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),

Reverse DNS

Software

CDN77-Turbo /

Resource Hash

746f3a139822580f0624c625bc62c9bd6b275f425d03879baf7e0a3019ca1a36

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://modulo.52-47-145-200.cprapid.com/
Origin: https://modulo.52-47-145-200.cprapid.com
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

x-77-pop: frankfurtDE
date: Tue, 28 Feb 2023 16:46:36 GMT
strict-transport-security: max-age=31536000
content-encoding: gzip
x-cache: HIT
x-77-cache: HIT
cross-origin-resource-policy: cross-origin
x-age: 95504
x-77-nzt: AZySIRmKLon/EHUBAA
x-accel-expires: @1709043292
last-modified: Mon, 27 Feb 2023 13:40:16 GMT
server: CDN77-Turbo
etag: W/"63fcb2c0-d9e8"
x-77-nzt-ray: cf878727b494f6ffec2ffe63b511fa33
vary: Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000, immutable

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: BNP Paribas (Banking)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

5 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
modulo.52-47-145-200.cprapid.com/it	1970-01-20 19:36:02	Name: COOKIE_KEY Value: 167760279533
ab.gl/	1969-12-31 23:59:59	Name: PHPSESSID Value: 6ee69c237aa275e06f56173141ad185d
ab.gl/	1970-01-20 10:01:29	Name: s_statistics_22559 Value: 0
modulo.52-47-145-200.cprapid.com/	1970-01-20 14:22:07	Name: ssupp.vid Value: viPpjmRS0OnK4G
modulo.52-47-145-200.cprapid.com/	1970-01-20 14:22:07	Name: ssupp.visits Value: 1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ab.gl
bootstrap.smartsuppchat.com
modulo.52-47-145-200.cprapid.com
rec.smartlook.com
translations.smartsuppcdn.com
websocket-visitors.smartsupp.com
widget-v2.smartsuppcdn.com
www.smartsuppchat.com
141.136.46.104
18.195.68.253
2a02:6ea0:c700::18
2a02:6ea0:f400::4
3.124.23.62
52.47.145.200
25423c378a1b20e98bce53677561ebeb4ed07cb22789a4669cb9f77275892754
36699b912ca380a373d5de1978a2055e6112c7727e6b5041d66a77a6be407b50
3c22a548522722679df65b3fe11b4852396ccd5a3684f611d7980738c50464fc
6ebcc7afa8e809193927c99f2b2f1508f1f2e85fbe580e5534e7aadc5f62dc97
6fd15847073c063cb948b5cc2e9a1bc5976392aef4d50b9434bd50a61da59405
746f3a139822580f0624c625bc62c9bd6b275f425d03879baf7e0a3019ca1a36
827004400366298b1c2019b75c57558f2d1618bc0b27bbd2b8e03df251cfc3db
99543d933ae6c6b53aa79a42deb665f785cba48b798e0420ae34e835a588f018
ca54a2bc2597b545deb5153ebe241552f6da280e8ade53bb9cd20244229184b1
dcd21b76d577cf3ae6c4ce82a112242d3b9cb2cc67de190e5e32ba8703a72408
f4123664f2a6fb1437f5dae6df0748307b6baa8243c11fe364ddc8f409556575
f6992885de0b28cbcf927235a4f164c9a316a4b4efaaafe53b30bd392db0172c

modulo.52-47-145-200.cprapid.com Open in urlscan Pro 52.47.145.200 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

11 Requests

100 %HTTPS

33 %IPv6

6 Domains

8 Subdomains

6 IPs

4 Countries

658 kBTransfer

1174 kBSize

5 Cookies

3 Outgoing links

Page URL History

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

8 JavaScript Global Variables

5 Cookies

Indicators

modulo.52-47-145-200.cprapid.com Open in urlscan Pro
52.47.145.200 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

100 %
HTTPS

33 %
IPv6

6
Domains

8
Subdomains

6
IPs

4
Countries

658 kB
Transfer

1174 kB
Size

5
Cookies

11 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!