www.automatic-replies.com

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 6 HTTP transactions. The main IP is 89.46.106.58, located in Arezzo, Italy and belongs to ARUBA-ASN, IT. The main domain is www.automatic-replies.com.

This is the only time www.automatic-replies.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: PayPal (Financial)

Domain & IP information

	IP Address	AS Autonomous System
1	89.46.106.58 89.46.106.58	31034 (ARUBA-ASN) (ARUBA-ASN)
3	92.123.92.235 92.123.92.235	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	213.174.135.2 213.174.135.2	39572 (ADVANCEDH...) (ADVANCEDHOSTERS-AS)
1	52.85.90.20 52.85.90.20	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
6	4

1 89.46.106.58 (Arezzo, Italy)

ASN31034 (ARUBA-ASN, IT)
PTR: webx1177.aruba.it

www.automatic-replies.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 92.123.92.235 (European Union)

ASN20940 (AKAMAI-ASN1, US)
PTR: a92-123-92-235.deploy.akamaitechnologies.com

www.paypalobjects.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 213.174.135.2 (Ashburn, United States)

ASN39572 (ADVANCEDHOSTERS-AS, NL)

s17.postimg.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.85.90.20 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-52-85-90-20.jfk6.r.cloudfront.net

d33v4339jhl8k0.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	paypalobjects.com www.paypalobjects.com	22 KB
1	cloudfront.net d33v4339jhl8k0.cloudfront.net	50 KB
1	postimg.org s17.postimg.org	992 B
1	automatic-replies.com www.automatic-replies.com
6	4

	Domain	Requested by
3	www.paypalobjects.com	www.automatic-replies.com
1	d33v4339jhl8k0.cloudfront.net	www.automatic-replies.com
1	s17.postimg.org	www.automatic-replies.com
1	www.automatic-replies.com
6	4

This site contains no links.

Subject Issuer	Validity	Valid
www.paypalobjects.com Symantec Class 3 EV SSL CA - G3	`2017-07-11` - `2019-09-02`	2 years	crt.sh
postimg.org Let's Encrypt Authority X3	`2017-11-03` - `2018-02-01`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://www.automatic-replies.com/en-us/3ef452f3086a7f5ead3aa5841637a0b5-
Frame ID: (CAADE975653D0E46CE9CECD131FF19CD)
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

6
Requests

67 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

73 kB
Transfer

180 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request 3ef452f3086a7f5ead3aa5841637a0b5- Show response www.automatic-replies.com/en-us/	9 KB 0	68ms 36ms	Document text/html	89.46.106.58 ARUBA-ASN
General Check archive.org Show headers Download Go to Full URL http://www.automatic-replies.com/en-us/3ef452f3086a7f5ead3aa5841637a0b5- Protocol HTTP/1.1 Server 89.46.106.58 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT), Reverse DNS webx1177.aruba.it Software aruba-proxy / Resource Hash `a4ed242a67570f3bc82cb379c98f7f187b17986e9da27bde6b2c55cf54c48830` Request headers Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Connection keep-alive Accept-Encoding gzip, deflate Host www.automatic-replies.com Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36 Response headers X-ServerName ipvsproxy90.ad.aruba.it Date Tue, 12 Dec 2017 18:51:38 GMT Content-Encoding gzip Last-Modified Mon, 11 Dec 2017 03:56:37 GMT Server aruba-proxy ETag W/"22f2-560088566fe8f;56005ccb7c06c" Vary Accept-Encoding Content-Type text/html Transfer-Encoding chunked Connection keep-alive
GET H2	200	app.css www.paypalobjects.com/eboxapps/css/f1/2098424bd3220ba2522b26543f3441/	116 KB 18 KB	21ms 9ms	Stylesheet text/css	92.123.92.235 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://www.paypalobjects.com/eboxapps/css/f1/2098424bd3220ba2522b26543f3441/app.css Requested by Host: www.automatic-replies.com URL: http://www.automatic-replies.com/en-us/3ef452f3086a7f5ead3aa5841637a0b5- Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 92.123.92.235 , European Union, ASN20940 (AKAMAI-ASN1, US), Reverse DNS a92-123-92-235.deploy.akamaitechnologies.com Software Apache / Resource Hash `07d8ad4cb3a4151f78452da62f1eed6efb7873ebc6431ffcabd90dfeb64908b8` Request headers :path /eboxapps/css/f1/2098424bd3220ba2522b26543f3441/app.css pragma no-cache accept-encoding gzip, deflate user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36 accept text/css,/;q=0.1 cache-control no-cache :authority www.paypalobjects.com referer http://www.automatic-replies.com/en-us/3ef452f3086a7f5ead3aa5841637a0b5- :scheme https :method GET Referer http://www.automatic-replies.com/en-us/3ef452f3086a7f5ead3aa5841637a0b5- User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36 Response headers date Tue, 12 Dec 2017 18:51:38 GMT content-encoding gzip last-modified Mon, 17 Mar 2014 23:34:53 GMT server Apache vary Accept-Encoding content-type text/css status 200 cache-control max-age=7776000 accept-ranges bytes content-length 18318 expires Mon, 12 Mar 2018 18:51:38 GMT
GET H2	200	logo_paypal_106x29.png s17.postimg.org/dikobvhbz/	983 B 992 B	19ms 6ms	Image image/png	213.174.135.2 ADVANCEDHOSTERS-AS
General Check archive.org Show headers Download Go to Show image Full URL https://s17.postimg.org/dikobvhbz/logo_paypal_106x29.png Requested by Host: www.automatic-replies.com URL: http://www.automatic-replies.com/en-us/3ef452f3086a7f5ead3aa5841637a0b5- Protocol H2 Security TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305 Server 213.174.135.2 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL), Reverse DNS Software nginx / Resource Hash `042af5e5bcafb1c47c62475fb00a65bc522992e2bfb7a55edf243e04590dc0ba` Request headers :path /dikobvhbz/logo_paypal_106x29.png pragma no-cache accept-encoding gzip, deflate user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36 accept image/webp,image/apng,image/,/;q=0.8 cache-control* no-cache :authority s17.postimg.org referer http://www.automatic-replies.com/en-us/3ef452f3086a7f5ead3aa5841637a0b5- :scheme https :method GET Referer http://www.automatic-replies.com/en-us/3ef452f3086a7f5ead3aa5841637a0b5- User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36 Response headers date Tue, 12 Dec 2017 18:51:38 GMT server nginx status 200 content-type image/png access-control-allow-origin * expires Thu, 31 Dec 2037 23:55:55 GMT cache-control max-age=315360000 public accept-ranges bytes content-length 983 x-proxy-cache HIT
GET H/1.1	200 OK	file-tHlBk2a147.png d33v4339jhl8k0.cloudfront.net/docs/assets/55d20ae1e4b089486cadc329/images/56b226dac69791436156504d/	50 KB 50 KB	196ms 95ms	Image image/png	52.85.90.20 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL http://d33v4339jhl8k0.cloudfront.net/docs/assets/55d20ae1e4b089486cadc329/images/56b226dac69791436156504d/file-tHlBk2a147.png Requested by Host: www.automatic-replies.com URL: http://www.automatic-replies.com/en-us/3ef452f3086a7f5ead3aa5841637a0b5- Protocol HTTP/1.1 Server 52.85.90.20 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS server-52-85-90-20.jfk6.r.cloudfront.net Software AmazonS3 / Resource Hash `385c73df0a61b2ecd123b010f18a6c768ffff9a8a395436fcca04663533a9e6e` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host d33v4339jhl8k0.cloudfront.net User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://www.automatic-replies.com/en-us/3ef452f3086a7f5ead3aa5841637a0b5- Connection keep-alive Cache-Control no-cache Referer http://www.automatic-replies.com/en-us/3ef452f3086a7f5ead3aa5841637a0b5- User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36 Response headers Date Thu, 07 Dec 2017 10:47:44 GMT Via 1.1 ec7268fa1110683dbc457e57c2be1475.cloudfront.net (CloudFront) Last-Modified Wed, 03 Feb 2016 16:12:11 GMT Server AmazonS3 Age 18186 ETag "1f91af531589da71a76327ab25b454ff" X-Cache Hit from cloudfront Content-Type image/png Connection keep-alive Accept-Ranges bytes Content-Length 51700 X-Amz-Cf-Id WIjHU7BkPBYq6T9IHRUgcZWizvKfR7FNbLFIlNx4mJnVtVC6tv0BaQ==
GET H2	200	scr_content-bkgd.png www.paypalobjects.com/webstatic/i/ex_ce2/scr/	3 KB 3 KB	10ms 10ms	Image image/png	92.123.92.235 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://www.paypalobjects.com/webstatic/i/ex_ce2/scr/scr_content-bkgd.png Requested by Host: www.automatic-replies.com URL: http://www.automatic-replies.com/en-us/3ef452f3086a7f5ead3aa5841637a0b5- Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 92.123.92.235 , European Union, ASN20940 (AKAMAI-ASN1, US), Reverse DNS a92-123-92-235.deploy.akamaitechnologies.com Software Apache / Resource Hash `0de9dc4df795b30e9fa458090c49ab8137e65a7901803c81895cef56ac543d13` Request headers :path /webstatic/i/ex_ce2/scr/scr_content-bkgd.png pragma no-cache accept-encoding gzip, deflate user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36 accept image/webp,image/apng,image/,/;q=0.8 cache-control* no-cache :authority www.paypalobjects.com referer https://www.paypalobjects.com/eboxapps/css/f1/2098424bd3220ba2522b26543f3441/app.css :scheme https :method GET Referer https://www.paypalobjects.com/eboxapps/css/f1/2098424bd3220ba2522b26543f3441/app.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36 Response headers pragma no-cache date Tue, 12 Dec 2017 18:51:38 GMT last-modified Tue, 07 Jan 2014 00:36:46 GMT server Apache p3p CP="NON DSP ADM DEV PSD OUR IND STP PHY PRE NAV UNI" status 200 cache-control max-age=0, no-cache, no-store set-cookie PYPF=CT; expires=Tue, 09-Jan-2018 18:51:38 GMT; path=/; domain=.paypalobjects.com accept-ranges bytes content-type image/png content-length 2681 expires Tue, 12 Dec 2017 18:51:38 GMT
GET H2	200	interior-gradient-top.png www.paypalobjects.com/webstatic/mktg/consumer/gradients/	952 B 970 B	12ms 11ms	Image image/png	92.123.92.235 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://www.paypalobjects.com/webstatic/mktg/consumer/gradients/interior-gradient-top.png Requested by Host: www.automatic-replies.com URL: http://www.automatic-replies.com/en-us/3ef452f3086a7f5ead3aa5841637a0b5- Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 92.123.92.235 , European Union, ASN20940 (AKAMAI-ASN1, US), Reverse DNS a92-123-92-235.deploy.akamaitechnologies.com Software Apache / Resource Hash `f2c173be6a198adf60868c86f6e093f3b850bef0da34689e981fe218ad2a43a1` Request headers :path /webstatic/mktg/consumer/gradients/interior-gradient-top.png pragma no-cache accept-encoding gzip, deflate user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36 accept image/webp,image/apng,image/,/;q=0.8 cache-control* no-cache :authority www.paypalobjects.com referer https://www.paypalobjects.com/eboxapps/css/f1/2098424bd3220ba2522b26543f3441/app.css :scheme https :method GET Referer https://www.paypalobjects.com/eboxapps/css/f1/2098424bd3220ba2522b26543f3441/app.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36 Response headers pragma no-cache date Tue, 12 Dec 2017 18:51:38 GMT last-modified Tue, 07 Jan 2014 00:43:12 GMT server Apache p3p CP="NON DSP ADM DEV PSD OUR IND STP PHY PRE NAV UNI" status 200 cache-control max-age=0, no-cache, no-store set-cookie PYPF=CT; expires=Tue, 09-Jan-2018 18:51:38 GMT; path=/; domain=.paypalobjects.com accept-ranges bytes content-type image/png content-length 952 expires Tue, 12 Dec 2017 18:51:38 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onafterprint object| onbeforeprint function| submitIt

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

d33v4339jhl8k0.cloudfront.net
s17.postimg.org
www.automatic-replies.com
www.paypalobjects.com
213.174.135.2
52.85.90.20
89.46.106.58
92.123.92.235
042af5e5bcafb1c47c62475fb00a65bc522992e2bfb7a55edf243e04590dc0ba
07d8ad4cb3a4151f78452da62f1eed6efb7873ebc6431ffcabd90dfeb64908b8
0de9dc4df795b30e9fa458090c49ab8137e65a7901803c81895cef56ac543d13
385c73df0a61b2ecd123b010f18a6c768ffff9a8a395436fcca04663533a9e6e
a4ed242a67570f3bc82cb379c98f7f187b17986e9da27bde6b2c55cf54c48830
f2c173be6a198adf60868c86f6e093f3b850bef0da34689e981fe218ad2a43a1

www.automatic-replies.com Open in urlscan Pro 89.46.106.58 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

6 Requests

67 %HTTPS

0 %IPv6

4 Domains

4 Subdomains

4 IPs

3 Countries

73 kBTransfer

180 kBSize

0 Cookies

0 Outgoing links

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

0 Cookies

Indicators

www.automatic-replies.com Open in urlscan Pro
89.46.106.58 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

67 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

73 kB
Transfer

180 kB
Size

0
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!