URL: https://payments.songtradr.com/
Submission: On February 28 via automatic, source certstream-suspicious — Scanned from DE

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 6 HTTP transactions. The main IP is 18.66.15.46, located in United States and belongs to AMAZON-02, US. The main domain is payments.songtradr.com.
TLS certificate: Issued by Amazon on July 13th 2022. Valid for: a year.
This is the only time payments.songtradr.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
5 18.66.15.46 16509 (AMAZON-02)
6 2
Apex Domain
Subdomains
Transfer
5 songtradr.com
payments.songtradr.com
204 KB
0 cloudfront.net Failed
d2wbsh8jsobsq.cloudfront.net Failed
6 2
Domain Requested by
5 payments.songtradr.com payments.songtradr.com
0 d2wbsh8jsobsq.cloudfront.net Failed payments.songtradr.com
6 2
Subject Issuer Validity Valid
payments.songtradr.com
Amazon
2022-07-13 -
2023-08-11
a year crt.sh

This page contains 1 frames:

Primary Page: https://payments.songtradr.com/
Frame ID: A001239D9A49EEF09F2CCF4C8A06F49D
Requests: 7 HTTP requests in this frame

Screenshot

Page Title

SPA Typescript Boilerplate

Detected technologies

Overall confidence: 100%
Detected patterns
  • <[^>]*class="ant-(?:btn|col|row|layout|breadcrumb|menu|pagination|steps|select|cascader|checkbox|calendar|form|input-number|input|mention|rate|radio|slider|switch|tree-select|time-picker|transfer|upload|avatar|badge|card|carousel|collapse|list|popover|tooltip|table|tabs|tag|timeline|tree|alert|modal|message|notification|progress|popconfirm|spin|anchor|back-top|divider|drawer)

Page Statistics

6
Requests

83 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

204 kB
Transfer

921 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
payments.songtradr.com/
772 B
1 KB
Document
General
Full URL
https://payments.songtradr.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.15.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-15-46.vie50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
ef4291eb301b39462054007b1342a663d4d1e65e271895dbd21c005011b3cfa4
Security Headers
Name Value
Content-Security-Policy default-src 'none'; connect-src 'self'; frame-src https://widget.paymentrails.com; font-src 'self' https://*.typekit.net data:; img-src 'self' data: https://*.gravatar.com ; manifest-src 'self'; object-src 'none'; script-src 'self' https://*.google.com https://*.gstatic.com https://www.google-analytics.com; style-src 'self' https://*.typekit.net 'unsafe-inline'
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
content-length
772
content-security-policy
default-src 'none'; connect-src 'self'; frame-src https://widget.paymentrails.com; font-src 'self' https://*.typekit.net data:; img-src 'self' data: https://*.gravatar.com ; manifest-src 'self'; object-src 'none'; script-src 'self' https://*.google.com https://*.gstatic.com https://www.google-analytics.com; style-src 'self' https://*.typekit.net 'unsafe-inline'
content-type
text/html
date
Tue, 28 Feb 2023 05:59:27 GMT
etag
"b535230157fe501d4a5c0bbab145fc6c"
last-modified
Thu, 12 Aug 2021 22:55:25 GMT
referrer-policy
same-origin
server
AmazonS3
strict-transport-security
max-age=63072000; includeSubdomains; preload
via
1.1 6d125e47c290f30bf760f976c0325c98.cloudfront.net (CloudFront)
x-amz-cf-id
hdwGwaCTMBjTgU1kc7ZhIUcXVKZkt0zWKSQzK2tQMiTIzmoo3fhxEw==
x-amz-cf-pop
VIE50-P1
x-cache
Miss from cloudfront
x-content-type-options
nosniff
x-frame-options
DENY
x-xss-protection
1; mode=block
main.806e87f4.chunk.css
payments.songtradr.com/static/css/
492 KB
63 KB
Stylesheet
General
Full URL
https://payments.songtradr.com/static/css/main.806e87f4.chunk.css
Requested by
Host: payments.songtradr.com
URL: https://payments.songtradr.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.15.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-15-46.vie50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
b13e6a37cdfb6e59f1de3ea84c163b86e9a23b7bdcc53d561bd67ba5e2cf0345
Security Headers
Name Value
Content-Security-Policy default-src 'none'; connect-src 'self'; frame-src https://widget.paymentrails.com; font-src 'self' https://*.typekit.net data:; img-src 'self' data: https://*.gravatar.com ; manifest-src 'self'; object-src 'none'; script-src 'self' https://*.google.com https://*.gstatic.com https://www.google-analytics.com; style-src 'self' https://*.typekit.net 'unsafe-inline'
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://payments.songtradr.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 28 Feb 2023 05:59:27 GMT
strict-transport-security
max-age=63072000; includeSubdomains; preload
x-content-type-options
nosniff
content-security-policy
default-src 'none'; connect-src 'self'; frame-src https://widget.paymentrails.com; font-src 'self' https://*.typekit.net data:; img-src 'self' data: https://*.gravatar.com ; manifest-src 'self'; object-src 'none'; script-src 'self' https://*.google.com https://*.gstatic.com https://www.google-analytics.com; style-src 'self' https://*.typekit.net 'unsafe-inline'
content-encoding
gzip
x-amz-cf-pop
VIE50-P1
via
1.1 6d125e47c290f30bf760f976c0325c98.cloudfront.net (CloudFront)
x-cache
Miss from cloudfront
x-xss-protection
1; mode=block
referrer-policy
same-origin
last-modified
Thu, 12 Aug 2021 22:55:26 GMT
server
AmazonS3
etag
W/"08145361a19185c260dc6641c4a90a41"
x-frame-options
DENY
vary
Accept-Encoding
content-type
text/css
x-amz-cf-id
-rX6hFfMkpowmEHK4HfJYxqgEwaYmljmVBwcXn54uk7Rl_SaNf8XsA==
runtime-main.e8ffd88b.js
payments.songtradr.com/static/js/
2 KB
2 KB
Script
General
Full URL
https://payments.songtradr.com/static/js/runtime-main.e8ffd88b.js
Requested by
Host: payments.songtradr.com
URL: https://payments.songtradr.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.15.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-15-46.vie50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
699a8908724def34ea065404a0a2d832030e49ffe761dc1afd126a1f553fe6a8
Security Headers
Name Value
Content-Security-Policy default-src 'none'; connect-src 'self'; frame-src https://widget.paymentrails.com; font-src 'self' https://*.typekit.net data:; img-src 'self' data: https://*.gravatar.com ; manifest-src 'self'; object-src 'none'; script-src 'self' https://*.google.com https://*.gstatic.com https://www.google-analytics.com; style-src 'self' https://*.typekit.net 'unsafe-inline'
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://payments.songtradr.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 28 Feb 2023 05:59:27 GMT
strict-transport-security
max-age=63072000; includeSubdomains; preload
x-content-type-options
nosniff
content-security-policy
default-src 'none'; connect-src 'self'; frame-src https://widget.paymentrails.com; font-src 'self' https://*.typekit.net data:; img-src 'self' data: https://*.gravatar.com ; manifest-src 'self'; object-src 'none'; script-src 'self' https://*.google.com https://*.gstatic.com https://www.google-analytics.com; style-src 'self' https://*.typekit.net 'unsafe-inline'
content-encoding
gzip
x-amz-cf-pop
VIE50-P1
via
1.1 6d125e47c290f30bf760f976c0325c98.cloudfront.net (CloudFront)
x-cache
Miss from cloudfront
x-xss-protection
1; mode=block
referrer-policy
same-origin
last-modified
Thu, 12 Aug 2021 22:55:26 GMT
server
AmazonS3
etag
W/"c398a38f1e56af0f7c44bce10964a031"
x-frame-options
DENY
vary
Accept-Encoding
content-type
application/javascript
x-amz-cf-id
FOXybjogq0joDtmOdVV8u4AsiFjP-z-i7qT_gAPaZP0A0jjT5PJ1Ag==
2.aea11ee5.chunk.js
payments.songtradr.com/static/js/
400 KB
126 KB
Script
General
Full URL
https://payments.songtradr.com/static/js/2.aea11ee5.chunk.js
Requested by
Host: payments.songtradr.com
URL: https://payments.songtradr.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.15.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-15-46.vie50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
c6ed6bc547bfd5f110b2e0b474f73909fb5ae4fcda3a6783af9c1e5cfd57cd43
Security Headers
Name Value
Content-Security-Policy default-src 'none'; connect-src 'self'; frame-src https://widget.paymentrails.com; font-src 'self' https://*.typekit.net data:; img-src 'self' data: https://*.gravatar.com ; manifest-src 'self'; object-src 'none'; script-src 'self' https://*.google.com https://*.gstatic.com https://www.google-analytics.com; style-src 'self' https://*.typekit.net 'unsafe-inline'
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://payments.songtradr.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 28 Feb 2023 05:59:27 GMT
strict-transport-security
max-age=63072000; includeSubdomains; preload
x-content-type-options
nosniff
content-security-policy
default-src 'none'; connect-src 'self'; frame-src https://widget.paymentrails.com; font-src 'self' https://*.typekit.net data:; img-src 'self' data: https://*.gravatar.com ; manifest-src 'self'; object-src 'none'; script-src 'self' https://*.google.com https://*.gstatic.com https://www.google-analytics.com; style-src 'self' https://*.typekit.net 'unsafe-inline'
content-encoding
gzip
x-amz-cf-pop
VIE50-P1
via
1.1 6d125e47c290f30bf760f976c0325c98.cloudfront.net (CloudFront)
x-cache
Miss from cloudfront
x-xss-protection
1; mode=block
referrer-policy
same-origin
last-modified
Thu, 12 Aug 2021 22:55:26 GMT
server
AmazonS3
etag
W/"acd3508befddcdfb6cb3b9fbc2ce6d1d"
x-frame-options
DENY
vary
Accept-Encoding
content-type
application/javascript
x-amz-cf-id
rSPGm_X6W2SXDAq9FN4wVUSmDme7bLvREOsETEKVpyzfYzmLbCSA8Q==
main.9c2f87a7.chunk.js
payments.songtradr.com/static/js/
21 KB
11 KB
Script
General
Full URL
https://payments.songtradr.com/static/js/main.9c2f87a7.chunk.js
Requested by
Host: payments.songtradr.com
URL: https://payments.songtradr.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.15.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-15-46.vie50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
c7776f023bdafb5e54c7100afb6fe4f693c8ac9a20752503acc87d773cc6b7bf
Security Headers
Name Value
Content-Security-Policy default-src 'none'; connect-src 'self'; frame-src https://widget.paymentrails.com; font-src 'self' https://*.typekit.net data:; img-src 'self' data: https://*.gravatar.com ; manifest-src 'self'; object-src 'none'; script-src 'self' https://*.google.com https://*.gstatic.com https://www.google-analytics.com; style-src 'self' https://*.typekit.net 'unsafe-inline'
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://payments.songtradr.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 28 Feb 2023 05:59:27 GMT
strict-transport-security
max-age=63072000; includeSubdomains; preload
x-content-type-options
nosniff
content-security-policy
default-src 'none'; connect-src 'self'; frame-src https://widget.paymentrails.com; font-src 'self' https://*.typekit.net data:; img-src 'self' data: https://*.gravatar.com ; manifest-src 'self'; object-src 'none'; script-src 'self' https://*.google.com https://*.gstatic.com https://www.google-analytics.com; style-src 'self' https://*.typekit.net 'unsafe-inline'
content-encoding
gzip
x-amz-cf-pop
VIE50-P1
via
1.1 6d125e47c290f30bf760f976c0325c98.cloudfront.net (CloudFront)
x-cache
Miss from cloudfront
x-xss-protection
1; mode=block
referrer-policy
same-origin
last-modified
Thu, 12 Aug 2021 22:55:26 GMT
server
AmazonS3
etag
W/"0d1fb47f091b4ec03acc5a33bc84d942"
x-frame-options
DENY
vary
Accept-Encoding
content-type
application/javascript
x-amz-cf-id
o_Cs0pv62YJ1F9nj1K_rsoEC6I20jqZqLV_crYIaU5KA2Wxueg7f_w==
truncated
/
5 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
8fe69d0338a47dbaf5875bcd6a0761c8662700aeb931d8beab7bf11a7d14be79

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Content-Type
image/png
social-footer-icons_d2020.png
d2wbsh8jsobsq.cloudfront.net/general/
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
d2wbsh8jsobsq.cloudfront.net
URL
https://d2wbsh8jsobsq.cloudfront.net/general/social-footer-icons_d2020.png

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| webpackJsonppayments-spa object| regeneratorRuntime

0 Cookies

1 Console Messages

Source Level URL
Text
security error URL: https://payments.songtradr.com/missing-info
Message:
Refused to load the image 'https://d2wbsh8jsobsq.cloudfront.net/general/social-footer-icons_d2020.png' because it violates the following Content Security Policy directive: "img-src 'self' data: https://*.gravatar.com".

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src 'none'; connect-src 'self'; frame-src https://widget.paymentrails.com; font-src 'self' https://*.typekit.net data:; img-src 'self' data: https://*.gravatar.com ; manifest-src 'self'; object-src 'none'; script-src 'self' https://*.google.com https://*.gstatic.com https://www.google-analytics.com; style-src 'self' https://*.typekit.net 'unsafe-inline'
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block