urlscan.io logo urlscan.io
SecurityTrails logo

paypal.com.cgi-bin.webscr.cmd.login.submit.dispatch.150.canfix.it Open in urlscan Pro
185.53.178.52  Public Scan

Go To Rescan Add Verdict Report
URL: http://paypal.com.cgi-bin.webscr.cmd.login.submit.dispatch.150.canfix.it/webscr.htm
Submission Tags: phishing malicious Search All
Submission: On February 19 via api from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 2 countries across 4 domains to perform 7 HTTP transactions. The main IP is 185.53.178.52, located in Germany and belongs to TEAMINTERNET-AS, DE. The main domain is paypal.com.cgi-bin.webscr.cmd.login.submit.dispatch.150.canfix.it.
This is the only time paypal.com.cgi-bin.webscr.cmd.login.submit.dispatch.150.canfix.it was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 185.53.178.52 61969 (TEAMINTER...)
1 2a00:1450:400... 15169 (GOOGLE)
3 2600:9000:218... 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
7 5
Domain Requested by
3 d1lxhc4jvstzrp.cloudfront.net paypal.com.cgi-bin.webscr.cmd.login.submit.dispatch.150.canfix.it
1 fonts.googleapis.com paypal.com.cgi-bin.webscr.cmd.login.submit.dispatch.150.canfix.it
1 www.google.com paypal.com.cgi-bin.webscr.cmd.login.submit.dispatch.150.canfix.it
1 paypal.com.cgi-bin.webscr.cmd.login.submit.dispatch.150.canfix.it d1lxhc4jvstzrp.cloudfront.net
7 4

This site contains no links.

Subject Issuer Validity Valid
upload.video.google.com
GTS CA 1O1		 2021-01-26 -
2021-04-20		 3 months crt.sh

This page contains 1 frames:

Primary Page: http://paypal.com.cgi-bin.webscr.cmd.login.submit.dispatch.150.canfix.it/webscr.htm
Frame ID: C5E3BB63C145907E97813FEE43DBE7BE
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

7
Requests

14 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

5
IPs

2
Countries

76 kB
Transfer

192 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 5
  • http://paypal.com.cgi-bin.webscr.cmd.login.submit.dispatch.150.canfix.it/track.php?domain=canfix.it&toggle=browserjs&uid=MTYxMzc0NDM0Ny45MzcxOmRjYTZmZDIwZTA1Yzk1NjM0NTdmMTcxOWEwZmMwYTAxNzBmODYwODFkOGIwY2U2ZTE4ZGI4ZDEzNDA0NTJjNTg6NjAyZmM4ZGJlNGM4MQ%3D%3D HTTP 301
  • https://paypal.com.cgi-bin.webscr.cmd.login.submit.dispatch.150.canfix.it:8005/track.php?domain=canfix.it&toggle=browserjs&uid=MTYxMzc0NDM0Ny45MzcxOmRjYTZmZDIwZTA1Yzk1NjM0NTdmMTcxOWEwZmMwYTAxNzBmODYwODFkOGIwY2U2ZTE4ZGI4ZDEzNDA0NTJjNTg6NjAyZmM4ZGJlNGM4MQ%3D%3D

7 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request webscr.htm
paypal.com.cgi-bin.webscr.cmd.login.submit.dispatch.150.canfix.it/ 		11 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://paypal.com.cgi-bin.webscr.cmd.login.submit.dispatch.150.canfix.it/webscr.htm
Protocol
HTTP/1.1
Server
185.53.178.52 , Germany, ASN61969 (TEAMINTERNET-AS, DE),
Reverse DNS
Software
nginx /
Resource Hash
d07cd353921489ea4b163f3fce3b8b1b321a86c4b94b4c8742d6c726bcec2948

Request headers

Host
paypal.com.cgi-bin.webscr.cmd.login.submit.dispatch.150.canfix.it
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Server
nginx
Date
Fri, 19 Feb 2021 14:19:07 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Vary
Accept-Encoding
X-Check
3c12dc4d54f8e22d666785b733b0052100c53444
X-Language
english
X-Template
tpl_CleanPeppermintBlack_twoclick
X-Buckets
bucket081
X-Adblock-Key
MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALquDFETXRn0Hr05fUP7EJT77xYnPmRbpMy4vk8KYiHnkNpednjOANJcaXDXcKQJN0nXKZJL7TciJD8AoHXK158CAwEAAQ==_qmyrDTB3xEj6L54so/Mt8Srgr1v7gGLRe2ETtlOceyesaxLRQsGSeS+dRB4Pmixnw6HG5yDruS+0FUS0E90DFw==
Content-Encoding
gzip
caf.js
www.google.com/adsense/domains/ 		172 KB
61 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://www.google.com/adsense/domains/caf.js
Requested by
Host: paypal.com.cgi-bin.webscr.cmd.login.submit.dispatch.150.canfix.it
URL: http://paypal.com.cgi-bin.webscr.cmd.login.submit.dispatch.150.canfix.it/webscr.htm
Protocol
HTTP/1.1
Server
2a00:1450:4001:80f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
http://paypal.com.cgi-bin.webscr.cmd.login.submit.dispatch.150.canfix.it/webscr.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Fri, 19 Feb 2021 14:19:07 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Server
sffe
ETag
"16867607624313885926"
Vary
Accept-Encoding
Content-Type
text/javascript; charset=UTF-8
Cache-Control
private, max-age=3600
Transfer-Encoding
chunked
Cross-Origin-Resource-Policy
cross-origin
Accept-Ranges
bytes
X-XSS-Protection
0
Expires
Fri, 19 Feb 2021 14:19:07 GMT
style.css
d1lxhc4jvstzrp.cloudfront.net/themes/assets/ 		829 B
827 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://d1lxhc4jvstzrp.cloudfront.net/themes/assets/style.css
Requested by
Host: paypal.com.cgi-bin.webscr.cmd.login.submit.dispatch.150.canfix.it
URL: http://paypal.com.cgi-bin.webscr.cmd.login.submit.dispatch.150.canfix.it/webscr.htm
Protocol
HTTP/1.1
Server
2600:9000:2182:4600:1f:4100:9540:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash

Request headers

Referer
http://paypal.com.cgi-bin.webscr.cmd.login.submit.dispatch.150.canfix.it/webscr.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 18 Feb 2021 16:28:39 GMT
Content-Encoding
gzip
Last-Modified
Tue, 12 May 2020 14:25:52 GMT
Server
nginx
Age
78628
ETag
W/"5ebab1f0-33d"
Vary
Accept-Encoding
X-Cache
Hit from cloudfront
Content-Type
text/css
Via
1.1 e7b88cadf742e342f39f17392af35c4f.cloudfront.net (CloudFront)
Connection
keep-alive
Transfer-Encoding
chunked
X-Amz-Cf-Pop
DUS51-C1
X-Amz-Cf-Id
YhMQsJVJJHVMa8VMpyTNVGidRucClzHaJVSyyac5Mi7a8e8yhn2uDQ==
style.css
d1lxhc4jvstzrp.cloudfront.net/themes/cleanPeppermint_7a82f1f3/ 		1 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://d1lxhc4jvstzrp.cloudfront.net/themes/cleanPeppermint_7a82f1f3/style.css
Requested by
Host: paypal.com.cgi-bin.webscr.cmd.login.submit.dispatch.150.canfix.it
URL: http://paypal.com.cgi-bin.webscr.cmd.login.submit.dispatch.150.canfix.it/webscr.htm
Protocol
HTTP/1.1
Server
2600:9000:2182:4600:1f:4100:9540:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash

Request headers

Referer
http://paypal.com.cgi-bin.webscr.cmd.login.submit.dispatch.150.canfix.it/webscr.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Fri, 19 Feb 2021 03:55:18 GMT
Content-Encoding
gzip
Last-Modified
Tue, 12 May 2020 14:25:52 GMT
Server
nginx
Age
37429
ETag
W/"5ebab1f0-589"
Vary
Accept-Encoding
X-Cache
Hit from cloudfront
Content-Type
text/css
Via
1.1 8033f9c6b87a03b2eca7c2db5157e10e.cloudfront.net (CloudFront)
Connection
keep-alive
Transfer-Encoding
chunked
X-Amz-Cf-Pop
DUS51-C1
X-Amz-Cf-Id
KUpx7G6YCdUxUv_6OafCRAzu3If9-_oGgZyTlvpkng4cswaO5HmPNg==
css
fonts.googleapis.com/ 		1 KB
899 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Poppins:300
Requested by
Host: paypal.com.cgi-bin.webscr.cmd.login.submit.dispatch.150.canfix.it
URL: http://paypal.com.cgi-bin.webscr.cmd.login.submit.dispatch.150.canfix.it/webscr.htm
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
http://paypal.com.cgi-bin.webscr.cmd.login.submit.dispatch.150.canfix.it/webscr.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Fri, 19 Feb 2021 13:28:18 GMT
server
ESF
date
Fri, 19 Feb 2021 14:19:07 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 19 Feb 2021 14:19:07 GMT
js3caf.js
d1lxhc4jvstzrp.cloudfront.net/scripts/ 		7 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://d1lxhc4jvstzrp.cloudfront.net/scripts/js3caf.js
Requested by
Host: paypal.com.cgi-bin.webscr.cmd.login.submit.dispatch.150.canfix.it
URL: http://paypal.com.cgi-bin.webscr.cmd.login.submit.dispatch.150.canfix.it/webscr.htm
Protocol
HTTP/1.1
Server
2600:9000:2182:4600:1f:4100:9540:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash

Request headers

Referer
http://paypal.com.cgi-bin.webscr.cmd.login.submit.dispatch.150.canfix.it/webscr.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Fri, 19 Feb 2021 02:49:46 GMT
Via
1.1 4ba9d3779ca8afc198240a34dffb07c4.cloudfront.net (CloudFront)
Last-Modified
Thu, 14 Jan 2021 10:54:01 GMT
Server
nginx
Age
41361
ETag
"600022c9-1b58"
X-Cache
Hit from cloudfront
Content-Type
application/javascript
Connection
keep-alive
X-Amz-Cf-Pop
DUS51-C1
Accept-Ranges
bytes
Content-Length
7000
X-Amz-Cf-Id
92dLmEh9j_nzWw0AUNzu0utQKVGMmNNN0fk3gmfpVzbkw_fjWxqt3A==
track.php
paypal.com.cgi-bin.webscr.cmd.login.submit.dispatch.150.canfix.it/
Redirect Chain
  • http://paypal.com.cgi-bin.webscr.cmd.login.submit.dispatch.150.canfix.it/track.php?domain=canfix.it&toggle=browserjs&uid=MTYxMzc0NDM0Ny45MzcxOmRjYTZmZDIwZTA1Yzk1NjM0NTdmMTcxOWEwZmMwYTAxNzBmODYwODFk...
  • https://paypal.com.cgi-bin.webscr.cmd.login.submit.dispatch.150.canfix.it:8005/track.php?domain=canfix.it&toggle=browserjs&uid=MTYxMzc0NDM0Ny45MzcxOmRjYTZmZDIwZTA1Yzk1NjM0NTdmMTcxOWEwZmMwYTAxNzBmOD...
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
paypal.com.cgi-bin.webscr.cmd.login.submit.dispatch.150.canfix.it
URL
https://paypal.com.cgi-bin.webscr.cmd.login.submit.dispatch.150.canfix.it:8005/track.php?domain=canfix.it&toggle=browserjs&uid=MTYxMzc0NDM0Ny45MzcxOmRjYTZmZDIwZTA1Yzk1NjM0NTdmMTcxOWEwZmMwYTAxNzBmODYwODFkOGIwY2U2ZTE4ZGI4ZDEzNDA0NTJjNTg6NjAyZmM4ZGJlNGM4MQ%3D%3D

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies