co07669.tw1.ru
Open in
urlscan Pro
2a03:6f00:1::5c35:7627
Malicious Activity!
Public Scan
Submission: On February 17 via api from US — Scanned from US
Summary
This is the only time co07669.tw1.ru was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: UPS (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
10 | 2a03:6f00:1::... 2a03:6f00:1::5c35:7627 | 9123 (TIMEWEB-AS) (TIMEWEB-AS) | |
1 | 2607:f8b0:400... 2607:f8b0:4006:81c::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 104.77.221.251 104.77.221.251 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
2 | 52.6.11.66 52.6.11.66 | 14618 (AMAZON-AES) (AMAZON-AES) | |
1 | 23.199.204.138 23.199.204.138 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
1 | 2600:1400:d:5... 2600:1400:d:5aa::11a6 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
1 | 2600:141b:e80... 2600:141b:e800:1093::11a6 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
17 | 8 |
ASN16625 (AKAMAI-AS, US)
PTR: a104-77-221-251.deploy.static.akamaitechnologies.com
www.ups.com |
ASN14618 (AMAZON-AES, US)
PTR: ec2-52-6-11-66.compute-1.amazonaws.com
mpsnare.iesnare.com |
ASN16625 (AKAMAI-AS, US)
PTR: a23-199-204-138.deploy.static.akamaitechnologies.com
cdns.gigya.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
tw1.ru
co07669.tw1.ru |
593 KB |
2 |
go-mpulse.net
s.go-mpulse.net — Cisco Umbrella Rank: 1258 c.go-mpulse.net — Cisco Umbrella Rank: 625 |
50 KB |
2 |
iesnare.com
mpsnare.iesnare.com — Cisco Umbrella Rank: 5574 |
14 KB |
1 |
gigya.com
cdns.gigya.com — Cisco Umbrella Rank: 8312 |
|
1 |
ups.com
www.ups.com — Cisco Umbrella Rank: 9205 |
1 KB |
1 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 298 |
31 KB |
17 | 6 |
Domain | Requested by | |
---|---|---|
10 | co07669.tw1.ru |
co07669.tw1.ru
|
2 | mpsnare.iesnare.com |
co07669.tw1.ru
mpsnare.iesnare.com |
1 | c.go-mpulse.net |
s.go-mpulse.net
|
1 | s.go-mpulse.net |
co07669.tw1.ru
|
1 | cdns.gigya.com |
co07669.tw1.ru
|
1 | www.ups.com |
co07669.tw1.ru
|
1 | ajax.googleapis.com |
co07669.tw1.ru
|
17 | 7 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.ups.com |
wwwapps.ups.com |
about.ups.com |
www.investors.ups.com |
www.jobs-ups.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
upload.video.google.com GTS CA 1C3 |
2023-02-01 - 2023-04-26 |
3 months | crt.sh |
www.ups.com COMODO ECC Organization Validation Secure Server CA |
2022-08-31 - 2023-08-31 |
a year | crt.sh |
mpsnare.iesnare.com DigiCert SHA2 High Assurance Server CA |
2022-04-29 - 2023-05-23 |
a year | crt.sh |
cdns.gigya.com DigiCert TLS RSA SHA256 2020 CA1 |
2022-12-07 - 2023-12-07 |
a year | crt.sh |
akstat.io DigiCert TLS Hybrid ECC SHA384 2020 CA1 |
2022-04-15 - 2023-04-19 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
http://co07669.tw1.ru/upstracking/CLfinal/UPS/Express-Delivery-ID93982347324000380/Delivery-Package-ID-638212/
Frame ID: 64CC725D613ADFAD1471607F8AC51A72
Requests: 16 HTTP requests in this frame
Frame:
https://s.go-mpulse.net/boomerang/TADEN-6MDCS-UHH5M-YHPKQ-2GBH3
Frame ID: 5A7EB7BFF70F73D90CF7D43EB5DD6C63
Requests: 2 HTTP requests in this frame
Screenshot
Page Title
UPS - United StatesDetected technologies
SAP Customer Data Cloud Sign-in (Social logins) ExpandDetected patterns
- \.gigya\.com/JS/gigya\.js
jQuery (JavaScript Libraries) Expand
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
8 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Title: Email UsOpen the link in a new window
Search URL Search Domain Scan URL
Title: Locations
Search URL Search Domain Scan URL
Title: My Profile
Search URL Search Domain Scan URL
Title: Communication Preferences
Search URL Search Domain Scan URL
Title: Media RelationsOpen the link in a new window
Search URL Search Domain Scan URL
Title: Investor RelationsOpen the link in a new window
Search URL Search Domain Scan URL
Title: CareersOpen the link in a new window
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
17 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
co07669.tw1.ru/upstracking/CLfinal/UPS/Express-Delivery-ID93982347324000380/Delivery-Package-ID-638212/ |
35 KB 9 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.5.1/ |
87 KB 31 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ups.vendor.54f3c2d83b58.css
co07669.tw1.ru/upstracking/CLfinal/UPS/Express-Delivery-ID93982347324000380/assets/css/ |
134 KB 22 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ups.styles.980b6f0cd47e.css
co07669.tw1.ru/upstracking/CLfinal/UPS/Express-Delivery-ID93982347324000380/assets/css/ |
231 KB 99 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ups.modules.7159dcc6fb29.css
co07669.tw1.ru/upstracking/CLfinal/UPS/Express-Delivery-ID93982347324000380/assets/css/ |
738 KB 82 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ups.widgets.7e2315c2b219.css
co07669.tw1.ru/upstracking/CLfinal/UPS/Express-Delivery-ID93982347324000380/assets/css/ |
69 KB 9 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
UPS_logo.svg
www.ups.com/assets/resources/images/ |
2 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
snare.js
mpsnare.iesnare.com/ |
38 KB 13 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
gigya.js
cdns.gigya.com/JS/ |
0 0 |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icp.gif
co07669.tw1.ru/img/ |
196 B 196 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
TADEN-6MDCS-UHH5M-YHPKQ-2GBH3
s.go-mpulse.net/boomerang/ Frame 5A7E |
205 KB 50 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
36 KB 36 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Roboto-Light.woff
co07669.tw1.ru/upstracking/CLfinal/UPS/Express-Delivery-ID93982347324000380/assets/fonts/ |
91 KB 92 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Roboto-Regular.woff
co07669.tw1.ru/upstracking/CLfinal/UPS/Express-Delivery-ID93982347324000380/assets/fonts/ |
92 KB 92 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Roboto-Italic.woff
co07669.tw1.ru/upstracking/CLfinal/UPS/Express-Delivery-ID93982347324000380/assets/fonts/ |
97 KB 97 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo.js
mpsnare.iesnare.com/script/ |
96 B 610 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Roboto-Medium.woff
co07669.tw1.ru/upstracking/CLfinal/UPS/Express-Delivery-ID93982347324000380/assets/fonts/ |
92 KB 92 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
config.json
c.go-mpulse.net/api/ Frame 5A7E |
103 B 382 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: UPS (Transportation)88 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 boolean| credentialless object| oncontentvisibilityautostatechange function| $ function| jQuery string| BOOMR_API_key object| BOOMR number| BOOMR_lstart string| expand string| collapse string| wems_country string| wems_locale string| wems_ts string| wems_ext_locale object| obj_live_chat undefined| $location string| rightRailLabel string| io_operation string| io_bbout_element_id boolean| io_install_flash boolean| io_install_stm number| io_exclude_stm string| io_install_stm_error_handler object| bb string| bb_contents number| bb_min_time number| bb_max_time number| bb_time_incr number| bb_max_upd_time number| start_time number| bb_update_time function| waitforbb string| _i_a string| localObjectName function| __if_a function| __if_b function| __if_c object| _i_d object| _i_o object| _i_z object| _i_aa object| _i_ac object| _i_cr function| __if_d object| io_adp function| __if_e object| _i_dt function| __if_f function| iov_fl_cb function| iov_fl_fn function| iov_fl_get_value function| __if_g object| io_dp function| __if_h function| ioGetBlackbox object| io_cm function| __if_i object| _i_fm object| _i_fn object| _i_fo object| _i_dl object| _i_fp function| __if_j function| __if_k number| _i_fq function| __if_l number| _i_fs function| __if_m string| io_last_error object| IGLOO string| io_stm_cab_url string| io_flash_needs_update_handler boolean| io_enable_rip object| io_flash_blacklist object| io_flash_whitelist string| io_min_flash_in_firefox_version string| io_min_flash_in_firefox_linux_version string| io_min_flash_version string| _i_dw number| _i_g number| _i_bl undefined| pwShown function| login function| onLoad function| onLoginHandler function| onLogoutHandler object| BOOMR_mq number| BOOMR_onload2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
co07669.tw1.ru/ | Name: PHPSESSID Value: 13709e6f9296f0eb327cc13e0c472b6c |
|
mpsnare.iesnare.com/ | Name: io_token_7c6a6574-f011-4c9a-abdd-9894a102ccef Value: is2gaz7gTyfkwR2TTVIUKR8xajLw1/agvzmjp5u980M= |
3 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
c.go-mpulse.net
cdns.gigya.com
co07669.tw1.ru
mpsnare.iesnare.com
s.go-mpulse.net
www.ups.com
104.77.221.251
23.199.204.138
2600:1400:d:5aa::11a6
2600:141b:e800:1093::11a6
2607:f8b0:4006:81c::200a
2a03:6f00:1::5c35:7627
52.6.11.66
09ebd7f407439990aac227e70da23e1a819e8e30282928e324370805f480bec4
397e17bc6a5e190e792a338af96feb2675cd945cd1bf215a585f44406985f8cf
45e8aa7ebbca7aa7be5e368b6b3bbb80c5f10fdccadfe603d9126c151991d022
46fdbe261bb6243b549d1165700de6267f2adf464146950ac4515d5338c53586
4f543ad26c42709ef00a1921f7dd1aa27a1930a354ecb353196665e43dac3706
709cf508f5136673db4c21624949264d87d2235f057a218827e100066275dc8b
80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880
a3ebbe5cccfbabf1e67669b3dc6dc3792f55cf0153bc6f99a39a8d6328c24b98
a416370f6f98339e7edf9fe2c70a45bf9cfba93c0520921db47d15c27934ba88
a48e55eba408d92c3a2653ca845937678c75eabe60cad691debf89c0a2b94872
b83da05d48b4f7324391d3045040a09c4b14563aacef6ba632500b73b0206f2a
c511a38838f14cd23a3e2a7c7c9b7f2864a2a6b9e548053bb71b432a677966e2
c578b41854a095f3a7abc3f5413977d05e4e01239225ed53eb23e8c72cc19c5c
cdb62db26cdadc667ea0e9d9756f3cf7693b916c7356cee5f7770bdbff34c2e8
e6915d68e178a40ce586b0eaf76611c61c91be56afcb4a6ce4a0248ebbb1e23a
f79a125173bb6cefbbac05c2bb6712487907bf60ea66bc7272631cbd3d06a0ac
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d