7b6e759d-6816-4fbf-95a1-e5f1bf8d5a83.htmlpasta.com Open in urlscan Pro
2a03:b0c0:3:d0::35:d001 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://7b6e759d-6816-4fbf-95a1-e5f1bf8d5a83.htmlpasta.com/
Submission: On August 30 via manual (August 30th 2019, 7:46:58 am UTC) from NL

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 7 IPs in 4 countries across 10 domains to perform 8 HTTP transactions. The main IP is 2a03:b0c0:3:d0::35:d001, located in Frankfurt am Main, Germany and belongs to DIGITALOCEAN-ASN - DigitalOcean, LLC, US. The main domain is 7b6e759d-6816-4fbf-95a1-e5f1bf8d5a83.htmlpasta.com.
TLS certificate: Issued by COMODO RSA Domain Validation Secure S... on February 20th 2018. Valid for: 3 years.

This is the only time 7b6e759d-6816-4fbf-95a1-e5f1bf8d5a83.htmlpasta.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Email (Online)

Domain & IP information

	IP Address	AS Autonomous System
1	2a03:b0c0:3:d... 2a03:b0c0:3:d0::35:d001	14061 (DIGITALOC...) (DIGITALOCEAN-ASN - DigitalOcean)
2 2	2606:4700:10:... 2606:4700:10::6814:da2a	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
2	192.3.2.50 192.3.2.50	36352 (AS-COLOCR...) (AS-COLOCROSSING - ColoCrossing)
1	52.23.2.88 52.23.2.88	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1 2	2a00:1450:400... 2a00:1450:4001:814::200e	15169 (GOOGLE) (GOOGLE - Google LLC)
1	104.109.59.177 104.109.59.177	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 1	2a00:1450:400... 2a00:1450:400c:c04::9c	15169 (GOOGLE) (GOOGLE - Google LLC)
1 1	2a00:1450:400... 2a00:1450:4001:818::2004	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a00:1450:400... 2a00:1450:4001:821::2003	15169 (GOOGLE) (GOOGLE - Google LLC)
8	7

1 2a03:b0c0:3:d0::35:d001 (Frankfurt am Main, Germany)

ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US)

7b6e759d-6816-4fbf-95a1-e5f1bf8d5a83.htmlpasta.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:10::6814:da2a (United States) 2 redirects

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

tinyurl.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.3.2.50 (Washington, United States)

ASN36352 (AS-COLOCROSSING - ColoCrossing, US)
PTR: wgh7.whogohost.com

defaultz.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.23.2.88 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-52-23-2-88.compute-1.amazonaws.com

www.sendtric.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:814::200e (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE - Google LLC, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.109.59.177 (Netherlands)

ASN20940 (AKAMAI-ASN1, US)
PTR: a104-109-59-177.deploy.static.akamaitechnologies.com

img.purch.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c04::9c (Brussels, Belgium) 1 redirects

ASN15169 (GOOGLE - Google LLC, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:818::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE - Google LLC, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:821::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	google-analytics.com 1 redirects www.google-analytics.com	18 KB
2	defaultz.xyz defaultz.xyz	10 KB
2	tinyurl.com 2 redirects tinyurl.com	427 B
1	google.de www.google.de	109 B
1	google.com 1 redirects www.google.com	190 B
1	doubleclick.net 1 redirects stats.g.doubleclick.net	159 B
1	purch.com img.purch.com	53 KB
1	sendtric.com www.sendtric.com	82 KB
1	htmlpasta.com 7b6e759d-6816-4fbf-95a1-e5f1bf8d5a83.htmlpasta.com	865 B
0	googleapis.com Failed fonts.googleapis.com Failed
8	10

	Domain	Requested by
2	www.google-analytics.com	1 redirects 7b6e759d-6816-4fbf-95a1-e5f1bf8d5a83.htmlpasta.com
2	defaultz.xyz	7b6e759d-6816-4fbf-95a1-e5f1bf8d5a83.htmlpasta.com
2	tinyurl.com	2 redirects
1	www.google.de	7b6e759d-6816-4fbf-95a1-e5f1bf8d5a83.htmlpasta.com
1	www.google.com	1 redirects
1	stats.g.doubleclick.net	1 redirects
1	img.purch.com	7b6e759d-6816-4fbf-95a1-e5f1bf8d5a83.htmlpasta.com
1	www.sendtric.com	7b6e759d-6816-4fbf-95a1-e5f1bf8d5a83.htmlpasta.com
1	7b6e759d-6816-4fbf-95a1-e5f1bf8d5a83.htmlpasta.com
0	fonts.googleapis.com Failed	7b6e759d-6816-4fbf-95a1-e5f1bf8d5a83.htmlpasta.com
8	10

This site contains no links.

Subject Issuer	Validity	Valid
*.htmlpasta.com COMODO RSA Domain Validation Secure Server CA	`2018-02-20` - `2021-02-19`	3 years	crt.sh
defaultz.xyz cPanel, Inc. Certification Authority	`2019-08-16` - `2019-11-14`	3 months	crt.sh
prod.sendtric.com Let's Encrypt Authority X3	`2019-07-24` - `2019-10-22`	3 months	crt.sh
*.google-analytics.com GTS CA 1O1	`2019-07-29` - `2019-10-27`	3 months	crt.sh
www.purch.com DigiCert SHA2 Secure Server CA	`2019-05-16` - `2020-05-15`	a year	crt.sh
www.google.de GTS CA 1O1	`2019-07-29` - `2019-10-27`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://7b6e759d-6816-4fbf-95a1-e5f1bf8d5a83.htmlpasta.com/
Frame ID: 6C4C15720D344DEB434EB2E8CF1BA8A4
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Ubuntu (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Ubuntu/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Page Statistics

8
Requests

88 %
HTTPS

67 %
IPv6

10
Domains

10
Subdomains

7
IPs

4
Countries

164 kB
Transfer

189 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://tinyurl.com/y3kdue63 HTTP 301
https://defaultz.xyz/wp/wp-admin/user/js/metabolic/css/form.css

Request Chain 2

https://tinyurl.com/y6sow69g HTTP 301
https://defaultz.xyz/wp/wp-admin/user/js/metabolic/js/enc.js

Request Chain 6

https://www.google-analytics.com/r/collect?v=1&_v=j79&a=1667015700&t=pageview&_s=1&dl=https%3A%2F%2F7b6e759d-6816-4fbf-95a1-e5f1bf8d5a83.htmlpasta.com%2F&dp=%2F7b6e759d-6816-4fbf-95a1-e5f1bf8d5a83.html&ul=en-us&de=windows-1252&dt=Ooops!!!%20There%20is%20Recheck&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEAB~&jid=70744696&gjid=660583040&cid=998925012.1567151202&tid=UA-75065234-3&_gid=1391632284.1567151202&_r=1&z=2113837651 HTTP 302
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-75065234-3&cid=998925012.1567151202&jid=70744696&_gid=1391632284.1567151202&gjid=660583040&_v=j79&z=2113837651 HTTP 302
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-75065234-3&cid=998925012.1567151202&jid=70744696&_v=j79&z=2113837651 HTTP 302
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-75065234-3&cid=998925012.1567151202&jid=70744696&_v=j79&z=2113837651&slf_rd=1&random=534853831

8 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
7b6e759d-6816-4fbf-95a1-e5f1bf8d5a83.htmlpasta.com/ 1 KB
865 B 144ms
6ms Document
text/html 2a03:b0c0:3:d0::35:d001
DigitalOcean

General

Check archive.org

Show headers Download Go to

Full URL: https://7b6e759d-6816-4fbf-95a1-e5f1bf8d5a83.htmlpasta.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a03:b0c0:3:d0::35:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: 602b7e9e09ecaf0b058f0c8b36efac95a6404c8c0286e14d1d21aebf29cdc93c

Request headers

:method: GET
:authority: 7b6e759d-6816-4fbf-95a1-e5f1bf8d5a83.htmlpasta.com
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode: navigate
sec-fetch-user: ?1
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: none
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1

Response headers

status: 200
server: nginx/1.10.3 (Ubuntu)
date: Fri, 30 Aug 2019 07:46:39 GMT
content-type: text/html
content-length: 772
content-encoding: gzip

GET
H/1.1

200
OK

form.css
defaultz.xyz/wp/wp-admin/user/js/metabolic/css/
Redirect Chain

https://tinyurl.com/y3kdue63
https://defaultz.xyz/wp/wp-admin/user/js/metabolic/css/form.css

1 KB
2 KB

1364ms
108ms

Stylesheet
text/css

192.3.2.50
ColoCrossing

General

Check archive.org

Show headers Download Go to

Full URL: https://defaultz.xyz/wp/wp-admin/user/js/metabolic/css/form.css
Requested by: Host: 7b6e759d-6816-4fbf-95a1-e5f1bf8d5a83.htmlpasta.com
URL: https://7b6e759d-6816-4fbf-95a1-e5f1bf8d5a83.htmlpasta.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.3.2.50 Washington, United States, ASN36352 (AS-COLOCROSSING - ColoCrossing, US),
Reverse DNS: wgh7.whogohost.com
Software: Apache /
Resource Hash: c1f90e7e5d456a946e03110b6b3e75eb8cb839d8126b8adf02f932800a007e5f

Request headers

Referer: https://7b6e759d-6816-4fbf-95a1-e5f1bf8d5a83.htmlpasta.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 30 Aug 2019 07:46:41 GMT
Last-Modified: Sun, 02 Jun 2019 10:54:14 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 1527

Redirect headers

date: Fri, 30 Aug 2019 07:46:40 GMT
server: cloudflare
status: 301
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=2678400;
content-type: text/html; charset=UTF-8
location: https://defaultz.xyz/wp/wp-admin/user/js/metabolic/css/form.css
cache-control: max-age=0, no-cache, private
cf-ray: 50e526f59d6b59e2-VIE

GET
H/1.1 200
OK example_timer.gif
www.sendtric.com/ 82 KB
82 KB 574ms
113ms Image
image/gif 52.23.2.88
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.sendtric.com/example_timer.gif

Requested by

Host: 7b6e759d-6816-4fbf-95a1-e5f1bf8d5a83.htmlpasta.com
URL: https://7b6e759d-6816-4fbf-95a1-e5f1bf8d5a83.htmlpasta.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.23.2.88 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-52-23-2-88.compute-1.amazonaws.com

Software

Cowboy /

Resource Hash

fc7cc9e6fbdef23e0a212826516ec3d72161a624a9fd0a9e924a3625f70cd49d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://7b6e759d-6816-4fbf-95a1-e5f1bf8d5a83.htmlpasta.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 30 Aug 2019 07:46:39 GMT
Via: 1.1 vegur
Last-Modified: Thu, 15 Aug 2019 20:20:16 GMT
Server: Cowboy
Strict-Transport-Security: max-age=15552000; includeSubDomains
Content-Type: image/gif
Connection: keep-alive
Content-Length: 84149

GET
H/1.1

200
OK

enc.js Show response
defaultz.xyz/wp/wp-admin/user/js/metabolic/js/
Redirect Chain

https://tinyurl.com/y6sow69g
https://defaultz.xyz/wp/wp-admin/user/js/metabolic/js/enc.js

8 KB
8 KB

1454ms
108ms

Script
application/javascript

192.3.2.50
ColoCrossing

General

Check archive.org

Show headers Download Go to

Full URL: https://defaultz.xyz/wp/wp-admin/user/js/metabolic/js/enc.js
Requested by: Host: 7b6e759d-6816-4fbf-95a1-e5f1bf8d5a83.htmlpasta.com
URL: https://7b6e759d-6816-4fbf-95a1-e5f1bf8d5a83.htmlpasta.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.3.2.50 Washington, United States, ASN36352 (AS-COLOCROSSING - ColoCrossing, US),
Reverse DNS: wgh7.whogohost.com
Software: Apache /
Resource Hash: 7be0d0f013d26f5435b515e7d23bcd65a5017dd874c7b95646df565ff0677fda

Request headers

Referer: https://7b6e759d-6816-4fbf-95a1-e5f1bf8d5a83.htmlpasta.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 30 Aug 2019 07:46:41 GMT
Last-Modified: Sat, 17 Aug 2019 18:23:38 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 8087

Redirect headers

date: Fri, 30 Aug 2019 07:46:40 GMT
server: cloudflare
status: 301
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=2678400;
content-type: text/html; charset=UTF-8
location: https://defaultz.xyz/wp/wp-admin/user/js/metabolic/js/enc.js
cache-control: max-age=0, no-cache, private
cf-ray: 50e526f59d6d59e2-VIE

GET css
fonts.googleapis.com/ 0
0

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 43 KB
17 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:814::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: 7b6e759d-6816-4fbf-95a1-e5f1bf8d5a83.htmlpasta.com
URL: https://7b6e759d-6816-4fbf-95a1-e5f1bf8d5a83.htmlpasta.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://7b6e759d-6816-4fbf-95a1-e5f1bf8d5a83.htmlpasta.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 19 Aug 2019 17:22:41 GMT
server: Golfe2
age: 1244
date: Fri, 30 Aug 2019 07:25:57 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 17803
expires: Fri, 30 Aug 2019 09:25:57 GMT

GET
H2 200 aHR0cDovL21lZGlhLmJlc3RvZm1pY3JvLmNvbS9JL1YvNzkxMjM5L29yaWdpbmFsL0hlcm8tRnJlZS1FbWFpbC1TZXJ2aWNlcy0xYS5qcGc=
img.purch.com/rc/1024x393/ 53 KB
53 KB 429ms
45ms Image
image/webp 104.109.59.177
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.purch.com/rc/1024x393/aHR0cDovL21lZGlhLmJlc3RvZm1pY3JvLmNvbS9JL1YvNzkxMjM5L29yaWdpbmFsL0hlcm8tRnJlZS1FbWFpbC1TZXJ2aWNlcy0xYS5qcGc=
Requested by: Host: 7b6e759d-6816-4fbf-95a1-e5f1bf8d5a83.htmlpasta.com
URL: https://7b6e759d-6816-4fbf-95a1-e5f1bf8d5a83.htmlpasta.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.109.59.177 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a104-109-59-177.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: bb6f8e724f7c76754e7aada95cfefe0a0859dbc0b40f5e53a35901b47bf6ff72

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://7b6e759d-6816-4fbf-95a1-e5f1bf8d5a83.htmlpasta.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 30 Aug 2019 07:46:42 GMT
last-modified: Tue, 14 Aug 2018 17:23:10 GMT
server: nginx
etag: "29485ec-80c15-5736876c57b80"
x-akamai-webp: 1, 1, 1
content-type: image/webp
status: 200
cache-control: max-age=604800
x-imageresizer-blacklisted: 0
x-imageresizer-process-debug: http://127.0.0.1:80/internal/rc?uri=aHR0cDovL21lZGlhLmJlc3RvZm1pY3JvLmNvbS9JL1YvNzkxMjM5L29yaWdpbmFsL0hlcm8tRnJlZS1FbWFpbC1TZXJ2aWNlcy0xYS5qcGc=&arg1=1024&arg2=393&arg3=&arg4=&color=&format=&quality=&webp_enabled=1
accept-ranges: bytes
content-length: 54022
x-imageresizer-method: resize and crop
expires: Fri, 06 Sep 2019 07:46:42 GMT

GET
H2

200

ga-audiences
www.google.de/ads/
Redirect Chain

https://www.google-analytics.com/r/collect?v=1&_v=j79&a=1667015700&t=pageview&_s=1&dl=https%3A%2F%2F7b6e759d-6816-4fbf-95a1-e5f1bf8d5a83.htmlpasta.com%2F&dp=%2F7b6e759d-6816-4fbf-95a1-e5f1bf8d5a83....
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-75065234-3&cid=998925012.1567151202&jid=70744696&_gid=1391632284.1567151202&gjid=660583040&_v=j79&z=2113837651
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-75065234-3&cid=998925012.1567151202&jid=70744696&_v=j79&z=2113837651
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-75065234-3&cid=998925012.1567151202&jid=70744696&_v=j79&z=2113837651&slf_rd=1&random=534853831

42 B
109 B

18ms
18ms

Image
image/gif

2a00:1450:4001:821::2003
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-75065234-3&cid=998925012.1567151202&jid=70744696&_v=j79&z=2113837651&slf_rd=1&random=534853831

Requested by

Host: 7b6e759d-6816-4fbf-95a1-e5f1bf8d5a83.htmlpasta.com
URL: https://7b6e759d-6816-4fbf-95a1-e5f1bf8d5a83.htmlpasta.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://7b6e759d-6816-4fbf-95a1-e5f1bf8d5a83.htmlpasta.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Aug 2019 07:46:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 30 Aug 2019 07:46:41 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
content-type: text/html; charset=UTF-8
location: https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-75065234-3&cid=998925012.1567151202&jid=70744696&_v=j79&z=2113837651&slf_rd=1&random=534853831
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: fonts.googleapis.com
URL: http://fonts.googleapis.com/css?family=Ubuntu

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

21 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.htmlpasta.com/	1970-01-19 03:19:11	Name: _gat Value: 1
.htmlpasta.com/	1970-01-19 03:20:37	Name: _gid Value: GA1.2.1391632284.1567151202
.htmlpasta.com/	1970-01-19 20:50:23	Name: _ga Value: GA1.2.998925012.1567151202

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

7b6e759d-6816-4fbf-95a1-e5f1bf8d5a83.htmlpasta.com
defaultz.xyz
fonts.googleapis.com
img.purch.com
stats.g.doubleclick.net
tinyurl.com
www.google-analytics.com
www.google.com
www.google.de
www.sendtric.com
fonts.googleapis.com
104.109.59.177
192.3.2.50
2606:4700:10::6814:da2a
2a00:1450:4001:814::200e
2a00:1450:4001:818::2004
2a00:1450:4001:821::2003
2a00:1450:400c:c04::9c
2a03:b0c0:3:d0::35:d001
52.23.2.88
602b7e9e09ecaf0b058f0c8b36efac95a6404c8c0286e14d1d21aebf29cdc93c
7be0d0f013d26f5435b515e7d23bcd65a5017dd874c7b95646df565ff0677fda
bb6f8e724f7c76754e7aada95cfefe0a0859dbc0b40f5e53a35901b47bf6ff72
c1f90e7e5d456a946e03110b6b3e75eb8cb839d8126b8adf02f932800a007e5f
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
fc7cc9e6fbdef23e0a212826516ec3d72161a624a9fd0a9e924a3625f70cd49d

7b6e759d-6816-4fbf-95a1-e5f1bf8d5a83.htmlpasta.com Open in urlscan Pro 2a03:b0c0:3:d0::35:d001 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

8 Requests

88 %HTTPS

67 %IPv6

10 Domains

10 Subdomains

7 IPs

4 Countries

164 kBTransfer

189 kBSize

3 Cookies

0 Outgoing links

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

21 JavaScript Global Variables

3 Cookies

Indicators

7b6e759d-6816-4fbf-95a1-e5f1bf8d5a83.htmlpasta.com Open in urlscan Pro
2a03:b0c0:3:d0::35:d001 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

88 %
HTTPS

67 %
IPv6

10
Domains

10
Subdomains

7
IPs

4
Countries

164 kB
Transfer

189 kB
Size

3
Cookies

8 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!