Report - 20.104-168-101-28.cprapid.com/PayPal/login.php

Report Overview

Submitted URL
20.104-168-101-28.cprapid.com/PayPal/login.php
IP
104.168.101.28
ASN
#36352 AS-COLOCROSSING
Submitted
2024-04-18 11:39:35
Access
public
Website Title
Accedi al tuo conto PayPal
Final URL
20.104-168-101-28.cprapid.com/PayPal/login.php
Tags
usps logistics phishing
urlquery detections
Phishing - US Postal Service

Detections

urlquery
2
Network Intrusion Detection
0
Threat Detection Systems
0

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
20.104-168-101-28.cprapid.com	unknown	unknown	No data	No data	1.5 kB	182 kB	104.168.101.28
www.paypalobjects.com	1467	2005-05-12	2012-05-30	2024-04-17	2.0 kB	121 kB	151.101.194.133

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (0)

HTTP Transactions (7)

URL IP Response Size

20.104-168-101-28.cprapid.com/PayPal/login.php

104.168.101.28

200 OK

29 kB

URL User Request GET HTTP/1.1
20.104-168-101-28.cprapid.com/PayPal/login.php
IP
104.168.101.28:443
ASN
#36352 AS-COLOCROSSING

Certificate
IssuerLet's Encrypt
Subjectcpcontacts.20.104-168-101-28.cprapid.com
Fingerprint6F:5C:4C:E3:A4:80:AE:51:C7:70:DD:1B:C9:EF:FF:42:F3:8F:DC:2E
ValidityWed, 17 Apr 2024 10:05:38 GMT - Tue, 16 Jul 2024 10:05:37 GMT

File type
HTML document, Unicode text, UTF-8 text, with very long lines (1093)
Size
29 kB (29152 bytes)
Hash
17de2595d933ff49d87bae688260a799
6ea893988b193347d2bd8ff6750976c64e376351
2e1ec2f13ee660e85b2e915aa09d110f2b3886dd086914b49d9d73b957039fc5

HTTP Headers

GET /PayPal/login.php HTTP/1.1
Host: 20.104-168-101-28.cprapid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Thu, 18 Apr 2024 11:39:09 GMT
Server: Apache
Set-Cookie: COOKIE_KEY=171344034973; expires=Sun, 16-Apr-2034 11:39:09 GMT; Max-Age=315360000
COOKIE_KEY=171344034961; expires=Sun, 16-Apr-2034 11:39:09 GMT; Max-Age=315360000
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

20.104-168-101-28.cprapid.com/PayPal/Accedi%20al%20tuo%20conto%20PayPal_files/contextualLoginElementalUIv2.css

104.168.101.28

200 OK

152 kB

URL GET HTTP/1.1
20.104-168-101-28.cprapid.com/PayPal/Accedi%20al%20tuo%20conto%20PayPal_files/contextualLoginElementalUIv2.css
IP
104.168.101.28:443
ASN
#36352 AS-COLOCROSSING

Requested by
https://20.104-168-101-28.cprapid.com/PayPal/login.php
Certificate
IssuerLet's Encrypt
Subjectcpcontacts.20.104-168-101-28.cprapid.com
Fingerprint6F:5C:4C:E3:A4:80:AE:51:C7:70:DD:1B:C9:EF:FF:42:F3:8F:DC:2E
ValidityWed, 17 Apr 2024 10:05:38 GMT - Tue, 16 Jul 2024 10:05:37 GMT

File type
ASCII text, with very long lines (65536), with no line terminators
Size
152 kB (151721 bytes)
Hash
7b31b59397453daf77e24239c697131c
aaa16260469b34a558ab163549b07cd0b18dc05f
4f3ce6ed02764246b3431d0a8e1aeec9ea10915d801a4b48957ed264d98a28dd

HTTP Headers

GET /PayPal/Accedi%20al%20tuo%20conto%20PayPal_files/contextualLoginElementalUIv2.css HTTP/1.1
Host: 20.104-168-101-28.cprapid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://20.104-168-101-28.cprapid.com/PayPal/login.php
Cookie: COOKIE_KEY=171344034961
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Thu, 18 Apr 2024 11:39:10 GMT
Server: Apache
Last-Modified: Mon, 09 Oct 2023 21:18:26 GMT
Accept-Ranges: bytes
Content-Length: 151721
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/css

www.paypalobjects.com/paypal-ui/logos/svg/paypal-mark-color.svg

151.101.194.133

200 OK

1.1 kB

URL GET HTTP/2
www.paypalobjects.com/paypal-ui/logos/svg/paypal-mark-color.svg
IP
151.101.194.133:443
ASN
#54113 FASTLY

Requested by
https://20.104-168-101-28.cprapid.com/PayPal/login.php
Certificate
IssuerDigiCert Inc
Subjectwww.paypalobjects.com
Fingerprint70:76:C6:51:A3:AA:3B:B3:0D:B5:6D:59:0A:A0:91:B9:3D:A8:1D:10
ValidityTue, 05 Sep 2023 00:00:00 GMT - Sat, 05 Oct 2024 23:59:59 GMT

File type
SVG Scalable Vector Graphics image
Size
1.1 kB (1078 bytes)
Hash
a3554959a54374d577eaa8c43ee24c49
a7cb0383beb6c338d9ad384d9542caf350b497e3
f9035e34f5734e89ddb03b601b1c0fd58323a93f176c5c7e220d7aa7a2062ed5

HTTP Headers

GET /paypal-ui/logos/svg/paypal-mark-color.svg HTTP/1.1
Host: www.paypalobjects.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://20.104-168-101-28.cprapid.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
cache-control: s-maxage=31536000, public,max-age=3600
content-type: image/svg+xml
etag: "62aa5e30-436"
last-modified: Wed, 15 Jun 2022 22:33:20 GMT
paypal-debug-id: 2a05f83d28e8b
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
traceparent: 00-00000000000000000002a05f83d28e8b-04274758ebe2a514-01
dc: ccg11-origin-www-1.paypal.com
via: 1.1 varnish, 1.1 varnish
log-timing: fetch=161194,misspass=92,do_stream=0
log-origin: shield=SJC,src_ip=157.52.96.47,alternate_path=0,ip=157.52.96.44,port=443,name=shield_ssl_cache_sjc10044_SJC,status=200,reason=OK,method=GET,url="/paypal-ui/logos/svg/paypal-mark-color.svg",host=www.paypalobjects.com
accept-ranges: bytes
date: Thu, 18 Apr 2024 11:39:10 GMT
x-served-by: cache-sjc10044-SJC, cache-hel1410025-HEL
x-cache: HIT, HIT
x-cache-hits: 11920, 5152
x-timer: S1713440351.605938,VS0,VE0
vary: Accept-Encoding
x-content-type-options: nosniff
access-control-allow-origin: *
strict-transport-security: max-age=31557600
content-length: 1078
X-Firefox-Spdy: h2

www.paypalobjects.com/paypal-ui/fonts/PayPalSansBig-Regular.woff2

151.101.194.133

200 OK

25 kB

URL GET HTTP/2
www.paypalobjects.com/paypal-ui/fonts/PayPalSansBig-Regular.woff2
IP
151.101.194.133:443
ASN
#54113 FASTLY

Requested by
https://20.104-168-101-28.cprapid.com/PayPal/login.php
Certificate
IssuerDigiCert Inc
Subjectwww.paypalobjects.com
Fingerprint70:76:C6:51:A3:AA:3B:B3:0D:B5:6D:59:0A:A0:91:B9:3D:A8:1D:10
ValidityTue, 05 Sep 2023 00:00:00 GMT - Sat, 05 Oct 2024 23:59:59 GMT

File type
Web Open Font Format (Version 2), CFF, length 25368, version 1.6553
Size
25 kB (25368 bytes)
Hash
186b9e5be0671c3c941a2a4966beb47a
0255bf2f48460eb212c93242740f5bef01e858c4
1f70ff447ed799a34f4c3ae37ef1f49ed4af71123ba2c2aefe354565354284be

HTTP Headers

GET /paypal-ui/fonts/PayPalSansBig-Regular.woff2 HTTP/1.1
Host: www.paypalobjects.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://20.104-168-101-28.cprapid.com
DNT: 1
Connection: keep-alive
Referer: https://20.104-168-101-28.cprapid.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
cache-control: s-maxage=31536000, public,max-age=3600
etag: "60271cda-6318"
last-modified: Sat, 13 Feb 2021 00:27:06 GMT
paypal-debug-id: ce1e2cfaf196c
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
traceparent: 00-0000000000000000000ce1e2cfaf196c-6e26d0bee88f417d-01
dc: ccg11-origin-www-1.paypal.com
via: 1.1 varnish, 1.1 varnish
log-timing: fetch=164366,misspass=77,do_stream=0
log-origin: shield=SJC,src_ip=157.52.96.146,alternate_path=0,ip=157.52.96.146,port=443,name=shield_ssl_cache_sjc1000146_SJC,status=200,reason=OK,method=GET,url="/paypal-ui/fonts/PayPalSansBig-Regular.woff2",host=www.paypalobjects.com
accept-ranges: bytes
date: Thu, 18 Apr 2024 11:39:10 GMT
x-served-by: cache-sjc1000146-SJC, cache-hel1410024-HEL
x-cache: HIT, HIT
x-cache-hits: 7135, 473
x-timer: S1713440351.612338,VS0,VE0
x-content-type-options: nosniff
access-control-allow-origin: *
content-type: application/font-woff2
strict-transport-security: max-age=31557600
content-length: 25368
X-Firefox-Spdy: h2

20.104-168-101-28.cprapid.com/favicon.ico

104.168.101.28

404 Not Found

315 B

URL GET HTTP/1.1
20.104-168-101-28.cprapid.com/favicon.ico
IP
104.168.101.28:443
ASN
#36352 AS-COLOCROSSING

Requested by
https://20.104-168-101-28.cprapid.com/PayPal/login.php
Certificate
IssuerLet's Encrypt
Subjectcpcontacts.20.104-168-101-28.cprapid.com
Fingerprint6F:5C:4C:E3:A4:80:AE:51:C7:70:DD:1B:C9:EF:FF:42:F3:8F:DC:2E
ValidityWed, 17 Apr 2024 10:05:38 GMT - Tue, 16 Jul 2024 10:05:37 GMT

File type
HTML document, ASCII text
Size
315 B (315 bytes)
Hash
a34ac19f4afae63adc5d2f7bc970c07f
a82190fc530c265aa40a045c21770d967f4767b8
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - US Postal Service

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: 20.104-168-101-28.cprapid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://20.104-168-101-28.cprapid.com/PayPal/login.php
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
Date: Thu, 18 Apr 2024 11:39:10 GMT
Server: Apache
Content-Length: 315
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1

www.paypalobjects.com/webstatic/mktg/icons/sprite_countries_flag4.png

151.101.194.133

200 OK

72 kB

URL GET HTTP/2
www.paypalobjects.com/webstatic/mktg/icons/sprite_countries_flag4.png
IP
151.101.194.133:443
ASN
#54113 FASTLY

Requested by
https://20.104-168-101-28.cprapid.com/PayPal/login.php
Certificate
IssuerDigiCert Inc
Subjectwww.paypalobjects.com
Fingerprint70:76:C6:51:A3:AA:3B:B3:0D:B5:6D:59:0A:A0:91:B9:3D:A8:1D:10
ValidityTue, 05 Sep 2023 00:00:00 GMT - Sat, 05 Oct 2024 23:59:59 GMT

File type
PNG image data, 22 x 7296, 8-bit/color RGBA, non-interlaced
Size
72 kB (72320 bytes)
Hash
d3682f00301178fccd9afd06ec46be69
93aef919da3bd70dd4acd0b31658775f6ad15d51
9c14b809ca4d5de12a569239d46ab8ef5f7ac1b3804c9801583cbafb66d3e550

HTTP Headers

GET /webstatic/mktg/icons/sprite_countries_flag4.png HTTP/1.1
Host: www.paypalobjects.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://20.104-168-101-28.cprapid.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
cache-control: s-maxage=31536000, public,max-age=3600
content-type: image/png
dc: ccg11-origin-www-1.paypal.com
etag: "Nuylfp+to+eBvo2TUOG5pjOz26CVaqgZXN1uHvjtDMM"
fastly-io-info: ifsz=110177 idim=22x7296 ifmt=png ofsz=72320 odim=22x7296 ofmt=png
fastly-io-served-by: vpop-haf2300703
fastly-stats: io=1
paypal-debug-id: e5f152b29fa73
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
traceparent: 00-0000000000000000000e5f152b29fa73-148c9faa49f1e90b-01
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Thu, 18 Apr 2024 11:39:10 GMT
x-served-by: cache-sjc10054-SJC, cache-hel1410025-HEL
x-cache: HIT, HIT
x-cache-hits: 28, 4262
x-timer: S1713440351.645654,VS0,VE0
x-content-type-options: nosniff
strict-transport-security: max-age=31557600
content-length: 72320
X-Firefox-Spdy: h2

www.paypalobjects.com/paypal-ui/fonts/PayPalSansBig-Medium.woff2

151.101.194.133

200 OK

18 kB

URL GET HTTP/2
www.paypalobjects.com/paypal-ui/fonts/PayPalSansBig-Medium.woff2
IP
151.101.194.133:443
ASN
#54113 FASTLY

Requested by
https://20.104-168-101-28.cprapid.com/PayPal/login.php
Certificate
IssuerDigiCert Inc
Subjectwww.paypalobjects.com
Fingerprint70:76:C6:51:A3:AA:3B:B3:0D:B5:6D:59:0A:A0:91:B9:3D:A8:1D:10
ValidityTue, 05 Sep 2023 00:00:00 GMT - Sat, 05 Oct 2024 23:59:59 GMT

File type
Web Open Font Format (Version 2), TrueType, length 18508, version 1.6553
Size
18 kB (18508 bytes)
Hash
57518c06c06d691bd2def8d51db1f1c2
dab349042885997d8d08db8dc38d0b4907635e2e
2ae6779c6c3579643ab6deb5cfb822e843bf637d006a4ec25d9857ec7fb6d8c1

HTTP Headers

GET /paypal-ui/fonts/PayPalSansBig-Medium.woff2 HTTP/1.1
Host: www.paypalobjects.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://20.104-168-101-28.cprapid.com
DNT: 1
Connection: keep-alive
Referer: https://20.104-168-101-28.cprapid.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
cache-control: s-maxage=31536000, public,max-age=3600
etag: "60271cda-484c"
last-modified: Sat, 13 Feb 2021 00:27:06 GMT
paypal-debug-id: 2bf271596580
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
dc: ccg11-origin-www-1.paypal.com
log-timing: fetch=100864,misspass=117,do_stream=0
log-origin: ip=66.211.169.102,port=443,name=F_ccg01_phx_origin_www_1_paypal_com,status=200,reason=OK,method=GET,url="/paypal-ui/fonts/PayPalSansBig-Medium.woff2",host=www.paypalobjects.com,shield=SJC,src_ip=157.52.96.26,alternate_path=0
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Thu, 18 Apr 2024 11:39:10 GMT
x-served-by: cache-sjc1000128-SJC, cache-hel1410024-HEL
x-cache: HIT, HIT
x-cache-hits: 10853, 314
x-timer: S1713440351.660450,VS0,VE0
x-content-type-options: nosniff
access-control-allow-origin: *
content-type: application/font-woff2
strict-transport-security: max-age=31557600
content-length: 18508
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (0)

HTTP Transactions (7)

URL User Request GET HTTP/1.1

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash