62.1.171.226 - urlscan.io

Summary

This website contacted 3 IPs in 3 countries across 2 domains to perform 4 HTTP transactions. The main IP is 62.1.171.226, located in Greece and belongs to FORTHNET-GR Forthnet, GR. The main domain is 62.1.171.226.

This is the only time 62.1.171.226 was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: PayPal (Financial)

Domain & IP information

	IP Address	AS Autonomous System
1	62.1.171.226 62.1.171.226	1241 (FORTHNET-...) (FORTHNET-GR Forthnet)
2	95.101.184.70 95.101.184.70	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	23.45.98.207 23.45.98.207	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
4	3

1 62.1.171.226 (Greece)

ASN1241 (FORTHNET-GR Forthnet, GR)

62.1.171.226	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 95.101.184.70 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)
PTR: a95-101-184-70.deploy.static.akamaitechnologies.com

www.paypalobjects.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.45.98.207 (Netherlands)

ASN20940 (AKAMAI-ASN1, US)
PTR: a23-45-98-207.deploy.static.akamaitechnologies.com

t.paypal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	paypalobjects.com www.paypalobjects.com	2 KB
1	paypal.com t.paypal.com	814 B
4	2

	Domain	Requested by
2	www.paypalobjects.com	62.1.171.226
1	t.paypal.com	62.1.171.226
4	2

This site contains links to these domains. Also see Links.

Domain
www.paypal.com

Subject Issuer	Validity	Valid
www.paypal.com DigiCert SHA2 Extended Validation Server CA	`2020-01-09` - `2022-01-12`	2 years	crt.sh
t.paypal.com DigiCert SHA2 Extended Validation Server CA	`2020-01-09` - `2022-01-12`	2 years	crt.sh

This page contains 1 frames:

Primary Page: http://62.1.171.226:4050/communicator/showandreadmail.php?userno=66&msguid=4261573
Frame ID: 8F4B60DDF3B5485F5C5E126E1AE2B4EF
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i
headers server /php\/?([\d.]+)?/i

Windows Server (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Win32|Win64/i

OpenSSL (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

4
Requests

75 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

3
Countries

18 kB
Transfer

17 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.paypal.com/myaccount/transaction/details/94N013734R2876353?utm_source=unp&utm_medium=email&utm_campaign=PPX001066&utm_unptid=fcc653eb-6a7f-11ea-8f61-b875c01ea9f9&ppid=PPX001066&cnac=GR&rsta=en_AD&cust=04C43878SS930184N&unptid=fcc653eb-6a7f-11ea-8f61-b875c01ea9f9&calc=599c927af40f8&unp_tpcid=email-receipt-xclick-payment&page=main:email:PPX001066:::&pgrp=main:email&e=cl&mchn=em&s=ci&mail=sys&xt=Ctrl_EmailConfirmation_FooterUpdate
Title: 94N013734R2876353

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request showandreadmail.php Show response
62.1.171.226/communicator/ 15 KB
15 KB 248ms
153ms Document
text/html 62.1.171.226
FORTHNET-GR Forthnet

General

Check archive.org

Show headers Download Go to

Full URL: http://62.1.171.226:4050/communicator/showandreadmail.php?userno=66&msguid=4261573
Protocol: HTTP/1.1
Server: 62.1.171.226 , Greece, ASN1241 (FORTHNET-GR Forthnet, GR),
Reverse DNS
Software: Apache/2.4.23 (Win32) OpenSSL/1.0.2h PHP/5.6.24 / PHP/5.6.24
Resource Hash: 77fb1120ecb541be083fee672393515a3ca179fda657d35e6ed7e62c4a72dc4a

Request headers

Host: 62.1.171.226:4050
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 23 Mar 2020 03:15:19 GMT
Server: Apache/2.4.23 (Win32) OpenSSL/1.0.2h PHP/5.6.24
X-Powered-By: PHP/5.6.24
Connection: close
Content-Length: 15340
Content-Type: text/html; charset="utf-8"

GET
H2 200 logo_emailheader_113wx46h.gif
www.paypalobjects.com/en_US/i/logo/ 1 KB
1 KB 115ms
38ms Image
image/gif 95.101.184.70
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.paypalobjects.com/en_US/i/logo/logo_emailheader_113wx46h.gif

Requested by

Host: 62.1.171.226
URL: http://62.1.171.226:4050/communicator/showandreadmail.php?userno=66&msguid=4261573

Protocol

H2

Security

TLS 1.3, , AES_256_GCM

Server

95.101.184.70 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a95-101-184-70.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

2b41474a5694c455d4be840c45effb03790a57c950cef749e11b79fcca07736b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: http://62.1.171.226:4050/communicator/showandreadmail.php?userno=66&msguid=4261573
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 23 Mar 2020 03:15:20 GMT
x-content-type-options: nosniff
last-modified: Fri, 16 Aug 2019 04:57:33 GMT
server: Apache
strict-transport-security: max-age=31536000
content-type: image/gif
status: 200
cache-control: max-age=7776000
accept-ranges: bytes
content-length: 1103
expires: Sun, 21 Jun 2020 03:15:20 GMT

GET
H2 200 icon_help_16x16.gif
www.paypalobjects.com/en_US/i/icon/ 614 B
942 B 38ms
37ms Image
image/gif 95.101.184.70
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.paypalobjects.com/en_US/i/icon/icon_help_16x16.gif

Requested by

Host: 62.1.171.226
URL: http://62.1.171.226:4050/communicator/showandreadmail.php?userno=66&msguid=4261573

Protocol

H2

Security

TLS 1.3, , AES_256_GCM

Server

95.101.184.70 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a95-101-184-70.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

86a84f43563a3e72c907d0c163b518aac47b2c975f6b55ac3f46020fd8eafe14

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: http://62.1.171.226:4050/communicator/showandreadmail.php?userno=66&msguid=4261573
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Mon, 23 Mar 2020 03:15:20 GMT
x-content-type-options: nosniff
last-modified: Fri, 16 Aug 2019 04:57:33 GMT
server: Apache
strict-transport-security: max-age=31536000
p3p: CP="NON DSP ADM DEV PSD OUR IND STP PHY PRE NAV UNI"
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-type: image/gif
content-length: 614
expires: Mon, 23 Mar 2020 03:15:20 GMT

GET
H/1.1 200
OK ts
t.paypal.com/ 42 B
814 B 489ms
411ms Image
image/gif 23.45.98.207
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://t.paypal.com/ts?v=1&ppid=PPX001066&cnac=GR&rsta=en_AD&cust=04C43878SS930184N&unptid=fcc653eb-6a7f-11ea-8f61-b875c01ea9f9&calc=599c927af40f8&unp_tpcid=email-receipt-xclick-payment&page=main:email:PPX001066:::&pgrp=main:email&e=op&mchn=em&s=ci&mail=sys&xt=Ctrl_EmailConfirmation_FooterUpdate
Requested by: Host: 62.1.171.226
URL: http://62.1.171.226:4050/communicator/showandreadmail.php?userno=66&msguid=4261573
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.45.98.207 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a23-45-98-207.deploy.static.akamaitechnologies.com
Software: akka-http/10.1.11 /
Resource Hash: 6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93

Request headers

Referer: http://62.1.171.226:4050/communicator/showandreadmail.php?userno=66&msguid=4261573
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: no-cache
Date: Mon, 23 Mar 2020 03:15:20 GMT
Server: akka-http/10.1.11
P3P: policyref="https://t.paypal.com/w3c/p3p.xml",CP="CAO IND OUR SAM UNI STA COR COM"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 42
Expires: Mon, 23 Mar 2020 03:15:20 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

t.paypal.com
www.paypalobjects.com
23.45.98.207
62.1.171.226
95.101.184.70
2b41474a5694c455d4be840c45effb03790a57c950cef749e11b79fcca07736b
6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93
77fb1120ecb541be083fee672393515a3ca179fda657d35e6ed7e62c4a72dc4a
86a84f43563a3e72c907d0c163b518aac47b2c975f6b55ac3f46020fd8eafe14

62.1.171.226 Open in urlscan Pro 62.1.171.226 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

4 Requests

75 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

3 IPs

3 Countries

18 kBTransfer

17 kBSize

0 Cookies

1 Outgoing links

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

0 Cookies

Indicators

62.1.171.226 Open in urlscan Pro
62.1.171.226 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

75 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

3
Countries

18 kB
Transfer

17 kB
Size

0
Cookies

4 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!