cpctpa.net - urlscan.io

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 6 HTTP transactions. The main IP is 192.163.203.93, located in United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is cpctpa.net.
TLS certificate: Issued by cPanel, Inc. Certification Authority on March 26th 2021. Valid for: 3 months.

This is the only time cpctpa.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Office 365 (Online)

Domain & IP information

	IP Address	AS Autonomous System
1	192.163.203.93 192.163.203.93	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
3	54.230.182.199 54.230.182.199	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700:20:... 2606:4700:20::681a:625	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:813::200e	15169 (GOOGLE) (GOOGLE)
6	4

1 192.163.203.93 (United States)

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 192-163-203-93.unifiedlayer.com

cpctpa.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 54.230.182.199 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-54-230-182-199.ham50.r.cloudfront.net

d1di2lzuh97fh2.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:20::681a:625 (United States)

ASN13335 (CLOUDFLARENET, US)

pronto-core-cdn.prontomarketing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:813::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

encrypted-tbn0.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	cloudfront.net d1di2lzuh97fh2.cloudfront.net	176 KB
1	gstatic.com encrypted-tbn0.gstatic.com	7 KB
1	prontomarketing.com pronto-core-cdn.prontomarketing.com	4 KB
1	cpctpa.net cpctpa.net	4 KB
6	4

	Domain	Requested by
3	d1di2lzuh97fh2.cloudfront.net	cpctpa.net d1di2lzuh97fh2.cloudfront.net
1	encrypted-tbn0.gstatic.com	cpctpa.net
1	pronto-core-cdn.prontomarketing.com	cpctpa.net
1	cpctpa.net
6	4

This site contains no links.

Subject Issuer	Validity	Valid
cpctpa.net cPanel, Inc. Certification Authority	`2021-03-26` - `2021-06-24`	3 months	crt.sh
*.cloudfront.net DigiCert Global CA G2	`2021-02-22` - `2022-02-21`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-08-07` - `2021-08-07`	a year	crt.sh
*.gstatic.com GTS CA 1O1	`2021-03-16` - `2021-06-08`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://cpctpa.net/ClosingDoc/ClosingDisclosure/ALTA.htm
Frame ID: 99EAB7B74A2B68BC28E5711EBE7FEC64
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

6
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

191 kB
Transfer

624 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request ALTA.htm Show response
cpctpa.net/ClosingDoc/ClosingDisclosure/ 4 KB
4 KB 499ms
159ms Document
text/html 192.163.203.93
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://cpctpa.net/ClosingDoc/ClosingDisclosure/ALTA.htm
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 192.163.203.93 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 192-163-203-93.unifiedlayer.com
Software: Apache /
Resource Hash: 0af6462e9757f6fb4a8b829ef12c3c266767aa8892850460ca5bdda5906fcf02

Request headers

Host: cpctpa.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 09 Apr 2021 20:37:54 GMT
Server: Apache
Last-Modified: Wed, 08 Jan 2020 17:02:14 GMT
Accept-Ranges: bytes
Content-Length: 3661
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html

GET
H2 200 1g0f0h.css
d1di2lzuh97fh2.cloudfront.net/files/1g/1g0/ 486 KB
49 KB 114ms
44ms Stylesheet
text/css 54.230.182.199
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1di2lzuh97fh2.cloudfront.net/files/1g/1g0/1g0f0h.css?ph=7d9bff33bd
Requested by: Host: cpctpa.net
URL: https://cpctpa.net/ClosingDoc/ClosingDisclosure/ALTA.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.230.182.199 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-230-182-199.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2aab7eceb12d61aac26a9dde36be343896e4f44ba8001d308136ce1506247df6

Request headers

Referer: https://cpctpa.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Apr 2021 20:51:08 GMT
content-encoding: gzip
last-modified: Wed, 23 Sep 2020 06:55:57 GMT
server: AmazonS3
age: 344807
etag: "a0e95bead30d865e0568e839bea91130"
x-cache: Hit from cloudfront
content-type: text/css
via: 1.1 0a902401d20e3459ce96a6c687177b24.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: HAM50-C3
accept-ranges: bytes
content-length: 50226
x-amz-cf-id: k9Cetk103IOssn9eQlqc_-FZtQHq2N27Wg1ebJASeNnJtYJMuIWyCg==

GET
H2 200 Ofc365_MSNews.png
pronto-core-cdn.prontomarketing.com/2/wp-content/uploads/sites/33/2017/10/ 3 KB
4 KB 46ms
15ms Image
image/webp 2606:4700:20::681a:625
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pronto-core-cdn.prontomarketing.com/2/wp-content/uploads/sites/33/2017/10/Ofc365_MSNews.png
Requested by: Host: cpctpa.net
URL: https://cpctpa.net/ClosingDoc/ClosingDisclosure/ALTA.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:625 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 405d34d02a1cbb0605b544e1a0ebfe9249fb849bcf15a9bce978f1783e4b9bd8

Request headers

Referer: https://cpctpa.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 09 Apr 2021 20:37:54 GMT
via: 1.1 6f6de2de0e03603ac1b58353376153d3.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 190940
cf-polished: origFmt=png, origSize=8558
x-cache: Hit from cloudfront
content-disposition: inline; filename="Ofc365_MSNews.webp"
access-control-allow-methods: GET,PUT,POST,DELETE,OPTIONS
content-length: 2718
cf-request-id: 0959f4169200000609b3b56000000001
pragma: public
last-modified: Fri, 19 Jan 2018 17:02:48 GMT
server: cloudflare
etag: "5a6224b8-216e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=IG5xuW4Fj84Rb6Q%2BpRvGdlW8kw8laVoonrtrBTvo4NFDl4Muo1BIjGaZN8SfqNH6zBdVWY6qRGYFNPUBgcycyLC5ctSQ4p9KOOV1oUIXlehEHrClR8sS887XrRykOUQRy%2B8giz8ZIDUh3OxLVFCi2g%3D%3D"}]}
content-type: image/webp
access-control-allow-origin: *
expires: Fri, 22 Jun 2029 20:51:07 GMT
cache-control: public, max-age=259200000
x-amz-cf-pop: FRA56-C2
accept-ranges: bytes
cf-ray: 63d689374fd20609-FRA
access-control-allow-headers: Content-Type
x-amz-cf-id: -AK5-KQZ9OWGuSNmWYhdgkI87GLiKgQGnboey7cDFlSGaGpJnyTvXA==
cf-bgj: imgq:100,h2pri

GET
H2 200 images
encrypted-tbn0.gstatic.com/ 6 KB
7 KB 35ms
15ms Image
image/jpeg 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcQbYvwZiUq6WvMN4WiDx9XYcjal16LSHuDkf2BQUsT3G_rgZWLErQ&s

Requested by

Host: cpctpa.net
URL: https://cpctpa.net/ClosingDoc/ClosingDisclosure/ALTA.htm

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

25744fb93b0cbaff15a8537a47d1db5b3c12ceef7721ac8498606752ec77fd35

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cpctpa.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 09 Apr 2021 20:37:54 GMT
x-content-type-options: nosniff
last-modified: Sun, 16 Dec 2018 09:46:36 GMT
server: sffe
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6482
x-xss-protection: 0
expires: Sat, 09 Apr 2022 20:37:54 GMT

GET
H2 200 20dpjc.woff2
d1di2lzuh97fh2.cloudfront.net/files/20/20d/ 63 KB
64 KB 221ms
161ms Font
application/font-woff2 54.230.182.199
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1di2lzuh97fh2.cloudfront.net/files/20/20d/20dpjc.woff2
Requested by: Host: d1di2lzuh97fh2.cloudfront.net
URL: https://d1di2lzuh97fh2.cloudfront.net/files/1g/1g0/1g0f0h.css?ph=7d9bff33bd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.230.182.199 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-230-182-199.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 47107401d0adb375ab9aa167f9d62489a849d510e740a307b5a4db60e5db3562

Request headers

Origin: https://cpctpa.net
Referer: https://d1di2lzuh97fh2.cloudfront.net/files/1g/1g0/1g0f0h.css?ph=7d9bff33bd
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 09 Apr 2021 20:37:55 GMT
via: 1.1 7038a0e71a25504eb98df48695c04c7a.cloudfront.net (CloudFront)
last-modified: Wed, 23 Sep 2020 07:02:11 GMT
server: AmazonS3
x-amz-cf-pop: HAM50-C3
etag: "73f0a88bbca1bec19fb1303c689d04c6"
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: max-age=31536000
x-cache: Miss from cloudfront
accept-ranges: bytes
content-length: 64632
x-amz-cf-id: POqQAQR2lzKQX7Ym2JNtiM4UMExFn8KJQMZXLrbUntqUziv7o2DJNQ==

GET
H2 200 3ncu8u.woff2
d1di2lzuh97fh2.cloudfront.net/files/3n/3nc/ 63 KB
63 KB 202ms
165ms Font
application/font-woff2 54.230.182.199
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1di2lzuh97fh2.cloudfront.net/files/3n/3nc/3ncu8u.woff2
Requested by: Host: d1di2lzuh97fh2.cloudfront.net
URL: https://d1di2lzuh97fh2.cloudfront.net/files/1g/1g0/1g0f0h.css?ph=7d9bff33bd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.230.182.199 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-230-182-199.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 1d8f5280afb7f4fa0db5cdfcb751e180788b0f0da1488309c4243ebff11a9591

Request headers

Origin: https://cpctpa.net
Referer: https://d1di2lzuh97fh2.cloudfront.net/files/1g/1g0/1g0f0h.css?ph=7d9bff33bd
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 09 Apr 2021 20:37:55 GMT
via: 1.1 7038a0e71a25504eb98df48695c04c7a.cloudfront.net (CloudFront)
last-modified: Wed, 23 Sep 2020 07:20:33 GMT
server: AmazonS3
x-amz-cf-pop: HAM50-C3
etag: "d26871e8149b5759f814fd3c7a4f784b"
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: max-age=31536000
x-cache: Miss from cloudfront
accept-ranges: bytes
content-length: 64320
x-amz-cf-id: QlraJrFIqBrYcnrC2Cn6DSW4PeIjzMaAb8kIM3B-2dIxjUcZ0Pzr-Q==

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Office 365 (Online)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cpctpa.net
d1di2lzuh97fh2.cloudfront.net
encrypted-tbn0.gstatic.com
pronto-core-cdn.prontomarketing.com
192.163.203.93
2606:4700:20::681a:625
2a00:1450:4001:813::200e
54.230.182.199
0af6462e9757f6fb4a8b829ef12c3c266767aa8892850460ca5bdda5906fcf02
1d8f5280afb7f4fa0db5cdfcb751e180788b0f0da1488309c4243ebff11a9591
25744fb93b0cbaff15a8537a47d1db5b3c12ceef7721ac8498606752ec77fd35
2aab7eceb12d61aac26a9dde36be343896e4f44ba8001d308136ce1506247df6
405d34d02a1cbb0605b544e1a0ebfe9249fb849bcf15a9bce978f1783e4b9bd8
47107401d0adb375ab9aa167f9d62489a849d510e740a307b5a4db60e5db3562

cpctpa.net Open in urlscan Pro 192.163.203.93 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

6 Requests

100 %HTTPS

50 %IPv6

4 Domains

4 Subdomains

4 IPs

2 Countries

191 kBTransfer

624 kBSize

0 Cookies

0 Outgoing links

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

10 JavaScript Global Variables

0 Cookies

Indicators

cpctpa.net Open in urlscan Pro
192.163.203.93 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

191 kB
Transfer

624 kB
Size

0
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!