2-57-122-7.cprapid.com Open in urlscan Pro
2.57.122.7  Malicious Activity! Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://www.marcotrifoglio.it/nwd/rqkbyhvcsyrmlok Page URL
2. https://2-57-122-7.cprapid.com/UPS/tracking/en/gb/ Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	404	rqkbyhvcsyrmlok Show response www.marcotrifoglio.it/nwd/	212 B 281 B	224ms 69ms	Document text/html	89.46.108.18 ARUBA-ASN
General Check archive.org Show headers Download Go to Full URL https://www.marcotrifoglio.it/nwd/rqkbyhvcsyrmlok Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 89.46.108.18 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT), Reverse DNS webx1274.aruba.it Software aruba-proxy / Resource Hash f84a2df98dc874092288d7a23b8c6ee3206cfd79a790280af7e1210e424162fd Request headers :method GET :authority www.marcotrifoglio.it :scheme https :path /nwd/rqkbyhvcsyrmlok pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers server aruba-proxy date Wed, 14 Apr 2021 14:02:19 GMT content-type text/html vary Accept-Encoding content-encoding gzip
GET H/1.1	200 OK	Primary Request Cookie set / Show response 2-57-122-7.cprapid.com/UPS/tracking/en/gb/	34 KB 34 KB	332ms 129ms	Document text/html	2.57.122.7 PPTECHNOLOGY
General Check archive.org Show headers Download Go to Full URL https://2-57-122-7.cprapid.com/UPS/tracking/en/gb/ Requested by Host: www.marcotrifoglio.it URL: https://www.marcotrifoglio.it/nwd/rqkbyhvcsyrmlok Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2.57.122.7 , Romania, ASN48090 (PPTECHNOLOGY, GB), Reverse DNS Software Apache / Resource Hash fb7ddb41e73d1552d533f5f63d8a47b27487b3b548532e9c8b6267c57f38e2f6 Request headers Host 2-57-122-7.cprapid.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Sec-Fetch-Dest document Referer https://www.marcotrifoglio.it/ Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Referer https://www.marcotrifoglio.it/ Response headers Date Wed, 14 Apr 2021 14:02:19 GMT Server Apache Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate Pragma no-cache Set-Cookie PHPSESSID=b9c7e93814019c8fb062f42815e3d56b; path=/ Keep-Alive timeout=5, max=100 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	ups_004.css 2-57-122-7.cprapid.com/UPS/tracking/en/gb/assets/	133 KB 133 KB	169ms 97ms	Stylesheet text/css	2.57.122.7 PPTECHNOLOGY
General Check archive.org Show headers Download Go to Full URL https://2-57-122-7.cprapid.com/UPS/tracking/en/gb/assets/ups_004.css Requested by Host: 2-57-122-7.cprapid.com URL: https://2-57-122-7.cprapid.com/UPS/tracking/en/gb/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2.57.122.7 , Romania, ASN48090 (PPTECHNOLOGY, GB), Reverse DNS Software Apache / Resource Hash f69212c8dda9c7b958d463b414eb08a681de0ddebe7b7f5d222c33c6861bacaa Request headers Referer https://2-57-122-7.cprapid.com/UPS/tracking/en/gb/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Pragma no-cache Date Wed, 14 Apr 2021 14:02:19 GMT Last-Modified Wed, 03 Feb 2021 02:58:04 GMT Server Apache Content-Type text/css Cache-Control no-cache, no-store, must-revalidate Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 135910 Expires 0
GET H/1.1	200 OK	ups.css 2-57-122-7.cprapid.com/UPS/tracking/en/gb/assets/	203 KB 203 KB	296ms 102ms	Stylesheet text/css	2.57.122.7 PPTECHNOLOGY
General Check archive.org Show headers Download Go to Full URL https://2-57-122-7.cprapid.com/UPS/tracking/en/gb/assets/ups.css Requested by Host: 2-57-122-7.cprapid.com URL: https://2-57-122-7.cprapid.com/UPS/tracking/en/gb/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2.57.122.7 , Romania, ASN48090 (PPTECHNOLOGY, GB), Reverse DNS Software Apache / Resource Hash 10a1815b356f850e04c8bdec04edf534b4df1ce29b38cb75f0538f90fa75afb0 Request headers Referer https://2-57-122-7.cprapid.com/UPS/tracking/en/gb/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Pragma no-cache Date Wed, 14 Apr 2021 14:02:19 GMT Last-Modified Sat, 06 Feb 2021 23:45:38 GMT Server Apache Content-Type text/css Cache-Control no-cache, no-store, must-revalidate Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 207494 Expires 0
GET H/1.1	200 OK	ups_002.css 2-57-122-7.cprapid.com/UPS/tracking/en/gb/assets/	648 KB 649 KB	296ms 102ms	Stylesheet text/css	2.57.122.7 PPTECHNOLOGY
General Check archive.org Show headers Download Go to Full URL https://2-57-122-7.cprapid.com/UPS/tracking/en/gb/assets/ups_002.css Requested by Host: 2-57-122-7.cprapid.com URL: https://2-57-122-7.cprapid.com/UPS/tracking/en/gb/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2.57.122.7 , Romania, ASN48090 (PPTECHNOLOGY, GB), Reverse DNS Software Apache / Resource Hash 5655a8d691a31bf46ffb807e09321a6084857d6aa67f4ef6656b687b5fac0996 Request headers Referer https://2-57-122-7.cprapid.com/UPS/tracking/en/gb/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Pragma no-cache Date Wed, 14 Apr 2021 14:02:19 GMT Last-Modified Sat, 06 Feb 2021 23:46:46 GMT Server Apache Content-Type text/css Cache-Control no-cache, no-store, must-revalidate Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 663928 Expires 0
GET H/1.1	200 OK	ups_003.css 2-57-122-7.cprapid.com/UPS/tracking/en/gb/assets/	68 KB 68 KB	296ms 102ms	Stylesheet text/css	2.57.122.7 PPTECHNOLOGY
General Check archive.org Show headers Download Go to Full URL https://2-57-122-7.cprapid.com/UPS/tracking/en/gb/assets/ups_003.css Requested by Host: 2-57-122-7.cprapid.com URL: https://2-57-122-7.cprapid.com/UPS/tracking/en/gb/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2.57.122.7 , Romania, ASN48090 (PPTECHNOLOGY, GB), Reverse DNS Software Apache / Resource Hash 1e020fdc4c2189607c5f90806564a6b12a6a24d20bf586f964965244b62ef8d3 Request headers Referer https://2-57-122-7.cprapid.com/UPS/tracking/en/gb/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Pragma no-cache Date Wed, 14 Apr 2021 14:02:19 GMT Last-Modified Sat, 06 Feb 2021 23:46:42 GMT Server Apache Content-Type text/css Cache-Control no-cache, no-store, must-revalidate Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 69646 Expires 0
GET H/1.1	200 OK	UPS_logo.svg 2-57-122-7.cprapid.com/UPS/tracking/en/gb/assets/	2 KB 2 KB	295ms 101ms	Image image/svg+xml	2.57.122.7 PPTECHNOLOGY
General Check archive.org Show headers Download Go to Show image Full URL https://2-57-122-7.cprapid.com/UPS/tracking/en/gb/assets/UPS_logo.svg Requested by Host: 2-57-122-7.cprapid.com URL: https://2-57-122-7.cprapid.com/UPS/tracking/en/gb/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2.57.122.7 , Romania, ASN48090 (PPTECHNOLOGY, GB), Reverse DNS Software Apache / Resource Hash b6f911ba8158fafaac0e01b5c737957f9a334697c5fd7d935a68795e9d9e1c00 Request headers Referer https://2-57-122-7.cprapid.com/UPS/tracking/en/gb/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Pragma no-cache Date Wed, 14 Apr 2021 14:02:19 GMT Last-Modified Wed, 03 Feb 2021 02:58:04 GMT Server Apache Content-Type image/svg+xml Cache-Control no-cache, no-store, must-revalidate Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 2160 Expires 0
GET H/1.1	200 OK	jquery-3.5.1.min.js Show response 2-57-122-7.cprapid.com/UPS/tracking/en/gb/assets/	87 KB 88 KB	225ms 101ms	Script application/javascript	2.57.122.7 PPTECHNOLOGY
General Check archive.org Show headers Download Go to Full URL https://2-57-122-7.cprapid.com/UPS/tracking/en/gb/assets/jquery-3.5.1.min.js Requested by Host: 2-57-122-7.cprapid.com URL: https://2-57-122-7.cprapid.com/UPS/tracking/en/gb/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2.57.122.7 , Romania, ASN48090 (PPTECHNOLOGY, GB), Reverse DNS Software Apache / Resource Hash f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d Request headers Referer https://2-57-122-7.cprapid.com/UPS/tracking/en/gb/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Pragma no-cache Date Wed, 14 Apr 2021 14:02:19 GMT Last-Modified Sat, 26 Sep 2020 01:01:42 GMT Server Apache Content-Type application/javascript Cache-Control no-cache, no-store, must-revalidate Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 89476 Expires 0
GET H2	200	d.js Show response waust.at/	13 KB 7 KB	32ms 15ms	Script application/x-javascript	2606:4700:20::681a:507 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://waust.at/d.js Requested by Host: 2-57-122-7.cprapid.com URL: https://2-57-122-7.cprapid.com/UPS/tracking/en/gb/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:507 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8fb1850e00c24b83e04ea4f41fe5774cff1d476a293fa7b35cba97827eb194cd Request headers Referer https://2-57-122-7.cprapid.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Wed, 14 Apr 2021 14:02:19 GMT content-encoding br cf-cache-status HIT nel {"max_age":604800,"report_to":"cf-nel"} age 3351 cf-request-id 097249b82500004e43de065000000001 last-modified Tue, 06 Apr 2021 06:34:30 GMT server cloudflare etag W/"606c00f6-3444" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Lit0UEWdF%2Fk41zzgy7AWk9yxLeat6BvUBpJy39S8ZIVO4nBh2cn8i%2FP%2BGx6q8XzfPwiDmAiLi%2BA8POPkXnzQTlSqvbi8W3Hck3YlHxKpVouOrwwh%2Bw%3D%3D"}],"max_age":604800} content-type application/x-javascript access-control-allow-origin * cache-control max-age=86400 cf-ray 63fd78a03b2c4e43-FRA expires Thu, 15 Apr 2021 13:06:28 GMT
GET H/1.1	404 Not Found	social.jpg 2-57-122-7.cprapid.com/UPS/tracking/en/gb/assets/	10 KB 10 KB	98ms 98ms	Image text/html	2.57.122.7 PPTECHNOLOGY
General Check archive.org Show headers Download Go to Show image Full URL https://2-57-122-7.cprapid.com/UPS/tracking/en/gb/assets/social.jpg Requested by Host: 2-57-122-7.cprapid.com URL: https://2-57-122-7.cprapid.com/UPS/tracking/en/gb/assets/ups_002.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2.57.122.7 , Romania, ASN48090 (PPTECHNOLOGY, GB), Reverse DNS Software Apache / Resource Hash ca9fbd75297665bdde6750f0bb014dfafcf048f2f6ff7c781c5d5c38719058a8 Request headers Referer https://2-57-122-7.cprapid.com/UPS/tracking/en/gb/assets/ups_002.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Pragma no-cache Date Wed, 14 Apr 2021 14:02:20 GMT Server Apache Transfer-Encoding chunked Content-Type text/html Cache-Control no-cache, no-store, must-revalidate Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Expires 0
GET DATA	200 OK	truncated /	33 KB 33 KB		Font application/x-font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash a9a72111b2c9ad844638140ba430e0fe363e557adf8c48b0249dec84edaf65eb Request headers Origin https://2-57-122-7.cprapid.com Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type application/x-font-woff;charset=utf-8
GET H2	200	/ Show response whos.amung.us/pingjs/	29 B 145 B	433ms 144ms	Script text/javascript	67.202.94.86 STEADFAST
General Check archive.org Show headers Download Go to Full URL https://whos.amung.us/pingjs/?k=gbs8q3v125&t=Follow%20My%20Parcel%20%7C%20UPS%20-%20United%20Kingdom&c=d&x=https%3A%2F%2F2-57-122-7.cprapid.com%2FUPS%2Ftracking%2Fen%2Fgb%2F&y=https%3A%2F%2Fwww.marcotrifoglio.it%2F&a=0&v=27&r=5077 Requested by Host: waust.at URL: https://waust.at/d.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 67.202.94.86 , United States, ASN32748 (STEADFAST, US), Reverse DNS amung.us Software / Resource Hash 6c8fbe67a5aed8642ac9449006d4bb4cccc40e70c8325ac400979fe89352acfe Request headers Referer https://2-57-122-7.cprapid.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Wed, 14 Apr 2021 14:02:20 GMT content-encoding gzip content-type text/javascript;charset=UTF-8
GET DATA	200 OK	truncated /	3 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 6f4587fb64cd2e7ce26ba21941c80f3ab8d28c257b73d04a87c949b32e4cde2d Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/png

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: UPS (Transportation)

31 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery object| _wau string| wau_w_col string| wau_w_siz object| WAU_ren function| WAU_dynamic function| WAU_dynamic_request function| WAU_r_d function| WAU_insert function| WAU_la function| WAU_addCommas function| WAU_lrd function| WAU_lrs function| WAU_cps function| docReady string| ztoday string| ytoday string| ntoday object| x string| x1 string| x2

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			2-57-122-7.cprapid.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: b9c7e93814019c8fb062f42815e3d56b

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

2-57-122-7.cprapid.com
waust.at
whos.amung.us
www.marcotrifoglio.it
2.57.122.7
2606:4700:20::681a:507
67.202.94.86
89.46.108.18
10a1815b356f850e04c8bdec04edf534b4df1ce29b38cb75f0538f90fa75afb0
1e020fdc4c2189607c5f90806564a6b12a6a24d20bf586f964965244b62ef8d3
5655a8d691a31bf46ffb807e09321a6084857d6aa67f4ef6656b687b5fac0996
6c8fbe67a5aed8642ac9449006d4bb4cccc40e70c8325ac400979fe89352acfe
6f4587fb64cd2e7ce26ba21941c80f3ab8d28c257b73d04a87c949b32e4cde2d
8fb1850e00c24b83e04ea4f41fe5774cff1d476a293fa7b35cba97827eb194cd
a9a72111b2c9ad844638140ba430e0fe363e557adf8c48b0249dec84edaf65eb
b6f911ba8158fafaac0e01b5c737957f9a334697c5fd7d935a68795e9d9e1c00
ca9fbd75297665bdde6750f0bb014dfafcf048f2f6ff7c781c5d5c38719058a8
f69212c8dda9c7b958d463b414eb08a681de0ddebe7b7f5d222c33c6861bacaa
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
f84a2df98dc874092288d7a23b8c6ee3206cfd79a790280af7e1210e424162fd
fb7ddb41e73d1552d533f5f63d8a47b27487b3b548532e9c8b6267c57f38e2f6