www.automatic-replies.net

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 6 HTTP transactions. The main IP is 89.46.106.58, located in Arezzo, Italy and belongs to ARUBA-ASN, IT. The main domain is www.automatic-replies.net.

This is the only time www.automatic-replies.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: PayPal (Financial)

Domain & IP information

	IP Address	AS Autonomous System
1 2	89.46.106.58 89.46.106.58	31034 (ARUBA-ASN) (ARUBA-ASN)
3	92.123.92.235 92.123.92.235	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	213.174.135.1 213.174.135.1	39572 (ADVANCEDH...) (ADVANCEDHOSTERS-AS)
1	54.230.128.227 54.230.128.227	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
6	4

2 89.46.106.58 (Arezzo, Italy) 1 redirects

ASN31034 (ARUBA-ASN, IT)
PTR: webx1177.aruba.it

automatic-replies.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.automatic-replies.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 92.123.92.235 (European Union)

ASN20940 (AKAMAI-ASN1, US)
PTR: a92-123-92-235.deploy.akamaitechnologies.com

www.paypalobjects.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 213.174.135.1 (Ashburn, United States)

ASN39572 (ADVANCEDHOSTERS-AS, NL)

s17.postimg.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.230.128.227 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-54-230-128-227.ams50.r.cloudfront.net

d33v4339jhl8k0.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	paypalobjects.com www.paypalobjects.com
2	automatic-replies.net 1 redirects automatic-replies.net www.automatic-replies.net	282 B
1	cloudfront.net d33v4339jhl8k0.cloudfront.net
1	postimg.org s17.postimg.org
6	4

	Domain	Requested by
3	www.paypalobjects.com	www.automatic-replies.net
1	d33v4339jhl8k0.cloudfront.net	www.automatic-replies.net
1	s17.postimg.org	www.automatic-replies.net
1	www.automatic-replies.net
1	automatic-replies.net	1 redirects
6	5

This site contains no links.

Subject Issuer	Validity	Valid
www.paypalobjects.com Symantec Class 3 EV SSL CA - G3	`2017-07-11` - `2019-09-02`	2 years	crt.sh
postimg.org Let's Encrypt Authority X3	`2017-11-03` - `2018-02-01`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://www.automatic-replies.net/en/b54364933538e13cedea3bd5e69a86b8-
Frame ID: (2C4B6348972E1BE1B9BDA446A866D06B)
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://automatic-replies.net/en/b54364933538e13cedea3bd5e69a86b8- HTTP 301
http://www.automatic-replies.net/en/b54364933538e13cedea3bd5e69a86b8- Page URL

Page Statistics

6
Requests

67 %
HTTPS

0 %
IPv6

4
Domains

5
Subdomains

4
IPs

3
Countries

0 kB
Transfer

180 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://automatic-replies.net/en/b54364933538e13cedea3bd5e69a86b8- HTTP 301
http://www.automatic-replies.net/en/b54364933538e13cedea3bd5e69a86b8- Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request b54364933538e13cedea3bd5e69a86b8- Show response www.automatic-replies.net/en/ Redirect Chain http://automatic-replies.net/en/b54364933538e13cedea3bd5e69a86b8- http://www.automatic-replies.net/en/b54364933538e13cedea3bd5e69a86b8-	9 KB 0	98ms 38ms	Document text/html	89.46.106.58 ARUBA-ASN
General Check archive.org Show headers Download Go to Full URL http://www.automatic-replies.net/en/b54364933538e13cedea3bd5e69a86b8- Protocol HTTP/1.1 Server 89.46.106.58 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT), Reverse DNS webx1177.aruba.it Software aruba-proxy / Resource Hash `7ebc45de8125ecd0441e41cb1a6ba3e2ea5e8e6d974d57bafed8b53ffda4d42a` Request headers Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Connection keep-alive Accept-Encoding gzip, deflate Host www.automatic-replies.net Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers X-ServerName ipvsproxy90.ad.aruba.it Date Thu, 04 Jan 2018 22:24:22 GMT Content-Encoding gzip Last-Modified Sun, 17 Dec 2017 02:50:02 GMT Server aruba-proxy ETag W/"22dc-560804a4a0a80;560804a594cc0" Vary Accept-Encoding Content-Type text/html Transfer-Encoding chunked Connection keep-alive Redirect headers Location http://www.automatic-replies.net/en/b54364933538e13cedea3bd5e69a86b8- Date Thu, 04 Jan 2018 22:24:22 GMT X-ServerName ipvsproxy90.ad.aruba.it Server aruba-proxy Connection keep-alive Content-Length 182 Content-Type text/html
GET H2	200	app.css www.paypalobjects.com/eboxapps/css/f1/2098424bd3220ba2522b26543f3441/	116 KB 0	24ms 11ms	Stylesheet text/css	92.123.92.235 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://www.paypalobjects.com/eboxapps/css/f1/2098424bd3220ba2522b26543f3441/app.css Requested by Host: www.automatic-replies.net URL: http://www.automatic-replies.net/en/b54364933538e13cedea3bd5e69a86b8- Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 92.123.92.235 , European Union, ASN20940 (AKAMAI-ASN1, US), Reverse DNS a92-123-92-235.deploy.akamaitechnologies.com Software Apache / Resource Hash `07d8ad4cb3a4151f78452da62f1eed6efb7873ebc6431ffcabd90dfeb64908b8` Request headers :path /eboxapps/css/f1/2098424bd3220ba2522b26543f3441/app.css pragma no-cache accept-encoding gzip, deflate user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 accept text/css,/;q=0.1 cache-control no-cache :authority www.paypalobjects.com referer http://www.automatic-replies.net/en/b54364933538e13cedea3bd5e69a86b8- :scheme https :method GET Referer http://www.automatic-replies.net/en/b54364933538e13cedea3bd5e69a86b8- User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers date Thu, 04 Jan 2018 22:24:22 GMT content-encoding gzip last-modified Mon, 17 Mar 2014 23:34:53 GMT server Apache vary Accept-Encoding content-type text/css status 200 cache-control max-age=7776000 accept-ranges bytes content-length 18318 expires Wed, 04 Apr 2018 22:24:22 GMT
GET H2	200	logo_paypal_106x29.png s17.postimg.org/dikobvhbz/	983 B 0	39ms 11ms	Image image/png	213.174.135.1 ADVANCEDHOSTERS-AS
General Check archive.org Show headers Download Go to Show image Full URL https://s17.postimg.org/dikobvhbz/logo_paypal_106x29.png Requested by Host: www.automatic-replies.net URL: http://www.automatic-replies.net/en/b54364933538e13cedea3bd5e69a86b8- Protocol H2 Security TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305 Server 213.174.135.1 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL), Reverse DNS Software nginx / Resource Hash `042af5e5bcafb1c47c62475fb00a65bc522992e2bfb7a55edf243e04590dc0ba` Request headers :path /dikobvhbz/logo_paypal_106x29.png pragma no-cache accept-encoding gzip, deflate user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 accept image/webp,image/apng,image/,/;q=0.8 cache-control* no-cache :authority s17.postimg.org referer http://www.automatic-replies.net/en/b54364933538e13cedea3bd5e69a86b8- :scheme https :method GET Referer http://www.automatic-replies.net/en/b54364933538e13cedea3bd5e69a86b8- User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers date Thu, 04 Jan 2018 22:24:22 GMT server nginx status 200 content-type image/png access-control-allow-origin * expires Thu, 31 Dec 2037 23:55:55 GMT cache-control max-age=315360000 public accept-ranges bytes content-length 983 x-proxy-cache HIT
GET H/1.1	200 OK	file-tHlBk2a147.png d33v4339jhl8k0.cloudfront.net/docs/assets/55d20ae1e4b089486cadc329/images/56b226dac69791436156504d/	50 KB 0	56ms 19ms	Image image/png	54.230.128.227 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL http://d33v4339jhl8k0.cloudfront.net/docs/assets/55d20ae1e4b089486cadc329/images/56b226dac69791436156504d/file-tHlBk2a147.png Requested by Host: www.automatic-replies.net URL: http://www.automatic-replies.net/en/b54364933538e13cedea3bd5e69a86b8- Protocol HTTP/1.1 Server 54.230.128.227 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS server-54-230-128-227.ams50.r.cloudfront.net Software AmazonS3 / Resource Hash `385c73df0a61b2ecd123b010f18a6c768ffff9a8a395436fcca04663533a9e6e` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host d33v4339jhl8k0.cloudfront.net User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://www.automatic-replies.net/en/b54364933538e13cedea3bd5e69a86b8- Connection keep-alive Cache-Control no-cache Referer http://www.automatic-replies.net/en/b54364933538e13cedea3bd5e69a86b8- User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sun, 05 Nov 2017 13:18:26 GMT Via 1.1 62b561fc8f2846ecc9295346a2fcbde3.cloudfront.net (CloudFront) Last-Modified Wed, 03 Feb 2016 16:12:11 GMT Server AmazonS3 Age 56239 ETag "1f91af531589da71a76327ab25b454ff" X-Cache Hit from cloudfront Content-Type image/png Connection keep-alive Accept-Ranges bytes Content-Length 51700 X-Amz-Cf-Id MCIdlzNYW_9VUCpybl0i9lBLsexojTZ7QQiUcDGs7wnf_99tqWdghg==
GET H2	200	scr_content-bkgd.png www.paypalobjects.com/webstatic/i/ex_ce2/scr/	3 KB 0	8ms 8ms	Image image/png	92.123.92.235 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://www.paypalobjects.com/webstatic/i/ex_ce2/scr/scr_content-bkgd.png Requested by Host: www.automatic-replies.net URL: http://www.automatic-replies.net/en/b54364933538e13cedea3bd5e69a86b8- Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 92.123.92.235 , European Union, ASN20940 (AKAMAI-ASN1, US), Reverse DNS a92-123-92-235.deploy.akamaitechnologies.com Software Apache / Resource Hash `0de9dc4df795b30e9fa458090c49ab8137e65a7901803c81895cef56ac543d13` Request headers :path /webstatic/i/ex_ce2/scr/scr_content-bkgd.png pragma no-cache accept-encoding gzip, deflate user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 accept image/webp,image/apng,image/,/;q=0.8 cache-control* no-cache :authority www.paypalobjects.com referer https://www.paypalobjects.com/eboxapps/css/f1/2098424bd3220ba2522b26543f3441/app.css :scheme https :method GET Referer https://www.paypalobjects.com/eboxapps/css/f1/2098424bd3220ba2522b26543f3441/app.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers pragma no-cache date Thu, 04 Jan 2018 22:24:22 GMT last-modified Tue, 07 Jan 2014 00:36:46 GMT server Apache p3p CP="NON DSP ADM DEV PSD OUR IND STP PHY PRE NAV UNI" status 200 cache-control max-age=0, no-cache, no-store set-cookie PYPF=CT; expires=Thu, 01-Feb-2018 22:24:22 GMT; path=/; domain=.paypalobjects.com accept-ranges bytes content-type image/png content-length 2681 expires Thu, 04 Jan 2018 22:24:22 GMT
GET H2	200	interior-gradient-top.png www.paypalobjects.com/webstatic/mktg/consumer/gradients/	952 B 0	8ms 8ms	Image image/png	92.123.92.235 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://www.paypalobjects.com/webstatic/mktg/consumer/gradients/interior-gradient-top.png Requested by Host: www.automatic-replies.net URL: http://www.automatic-replies.net/en/b54364933538e13cedea3bd5e69a86b8- Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 92.123.92.235 , European Union, ASN20940 (AKAMAI-ASN1, US), Reverse DNS a92-123-92-235.deploy.akamaitechnologies.com Software Apache / Resource Hash `f2c173be6a198adf60868c86f6e093f3b850bef0da34689e981fe218ad2a43a1` Request headers :path /webstatic/mktg/consumer/gradients/interior-gradient-top.png pragma no-cache accept-encoding gzip, deflate user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 accept image/webp,image/apng,image/,/;q=0.8 cache-control* no-cache :authority www.paypalobjects.com referer https://www.paypalobjects.com/eboxapps/css/f1/2098424bd3220ba2522b26543f3441/app.css :scheme https :method GET Referer https://www.paypalobjects.com/eboxapps/css/f1/2098424bd3220ba2522b26543f3441/app.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers pragma no-cache date Thu, 04 Jan 2018 22:24:22 GMT last-modified Tue, 07 Jan 2014 00:43:12 GMT server Apache p3p CP="NON DSP ADM DEV PSD OUR IND STP PHY PRE NAV UNI" status 200 cache-control max-age=0, no-cache, no-store set-cookie PYPF=CT; expires=Thu, 01-Feb-2018 22:24:22 GMT; path=/; domain=.paypalobjects.com accept-ranges bytes content-type image/png content-length 952 expires Thu, 04 Jan 2018 22:24:22 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onafterprint object| onbeforeprint function| submitIt

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

automatic-replies.net
d33v4339jhl8k0.cloudfront.net
s17.postimg.org
www.automatic-replies.net
www.paypalobjects.com
213.174.135.1
54.230.128.227
89.46.106.58
92.123.92.235
042af5e5bcafb1c47c62475fb00a65bc522992e2bfb7a55edf243e04590dc0ba
07d8ad4cb3a4151f78452da62f1eed6efb7873ebc6431ffcabd90dfeb64908b8
0de9dc4df795b30e9fa458090c49ab8137e65a7901803c81895cef56ac543d13
385c73df0a61b2ecd123b010f18a6c768ffff9a8a395436fcca04663533a9e6e
7ebc45de8125ecd0441e41cb1a6ba3e2ea5e8e6d974d57bafed8b53ffda4d42a
f2c173be6a198adf60868c86f6e093f3b850bef0da34689e981fe218ad2a43a1

www.automatic-replies.net Open in urlscan Pro 89.46.106.58 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

6 Requests

67 %HTTPS

0 %IPv6

4 Domains

5 Subdomains

4 IPs

3 Countries

0 kBTransfer

180 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

0 Cookies

Indicators

www.automatic-replies.net Open in urlscan Pro
89.46.106.58 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

67 %
HTTPS

0 %
IPv6

4
Domains

5
Subdomains

4
IPs

3
Countries

0 kB
Transfer

180 kB
Size

0
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!