www.paxful-vendors.com.360cubes.com Open in urlscan Pro
69.167.136.4 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.paxful-vendors.com.360cubes.com/
Submission: On January 31 via automatic, source openphish (January 31st 2022, 1:10:13 pm UTC) — Scanned from DE

Summary HTTP 18 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 2 countries across 5 domains to perform 18 HTTP transactions. The main IP is 69.167.136.4, located in United States and belongs to LIQUIDWEB, US. The main domain is www.paxful-vendors.com.360cubes.com.
TLS certificate: Issued by R3 on January 30th 2022. Valid for: 3 months.

This is the only time www.paxful-vendors.com.360cubes.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Paxful (Crypto Exchange)

Domain & IP information

	IP Address	AS Autonomous System
8	69.167.136.4 69.167.136.4	32244 (LIQUIDWEB) (LIQUIDWEB)
4	2606:4700::68... 2606:4700::6810:135e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2a00:1450:400... 2a00:1450:4001:80e::200a	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:802::2003	15169 (GOOGLE) (GOOGLE)
1	3.220.57.224 3.220.57.224	14618 (AMAZON-AES) (AMAZON-AES)
18	5

8 69.167.136.4 (United States)

ASN32244 (LIQUIDWEB, US)
PTR: host.bestukserver.com

www.paxful-vendors.com.360cubes.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700::6810:135e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:80e::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:802::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.220.57.224 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-220-57-224.compute-1.amazonaws.com

api.ipify.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	360cubes.com www.paxful-vendors.com.360cubes.com	83 KB
4	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 227	54 KB
3	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 47	3 KB
2	gstatic.com fonts.gstatic.com	75 KB
1	ipify.org api.ipify.org — Cisco Umbrella Rank: 3497	276 B
18	5

	Domain	Requested by
8	www.paxful-vendors.com.360cubes.com	www.paxful-vendors.com.360cubes.com
4	cdnjs.cloudflare.com	www.paxful-vendors.com.360cubes.com
3	fonts.googleapis.com	www.paxful-vendors.com.360cubes.com
2	fonts.gstatic.com	fonts.googleapis.com
1	api.ipify.org	www.paxful-vendors.com.360cubes.com
18	5

This site contains no links.

Subject Issuer	Validity	Valid
www.paxful-vendors.com.360cubes.com R3	`2022-01-30` - `2022-04-30`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-09-21` - `2022-09-20`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2021-12-27` - `2022-03-21`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2021-12-27` - `2022-03-21`	3 months	crt.sh
*.ipify.org Sectigo RSA Domain Validation Secure Server CA	`2021-01-19` - `2022-02-19`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.paxful-vendors.com.360cubes.com/
Frame ID: BD803F265251CFCE0CA7B9AE4D892028
Requests: 18 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Peer to Peer Bitcoin Payment Preview

Detected technologies

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

18
Requests

100 %
HTTPS

60 %
IPv6

5
Domains

5
Subdomains

5
IPs

2
Countries

215 kB
Transfer

409 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

18 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.paxful-vendors.com.360cubes.com/ 10 KB
3 KB 838ms
501ms Document
text/html 69.167.136.4
LIQUIDWEB

General

Check archive.org

Show headers Download Go to

Full URL: https://www.paxful-vendors.com.360cubes.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 69.167.136.4 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS: host.bestukserver.com
Software: Apache /
Resource Hash: ed97482ffed795ae3ac85a8917b90773e32baa7bcaae5873f475cf9ffdd4c645

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

cache-control: max-age=600
expires: Mon, 31 Jan 2022 13:20:08 GMT
vary: Accept-Encoding,User-Agent
content-encoding: gzip
content-length: 2837
content-type: text/html; charset=UTF-8
date: Mon, 31 Jan 2022 13:10:08 GMT
server: Apache

GET
H2 200 style.css
www.paxful-vendors.com.360cubes.com/ 7 KB
2 KB 128ms
127ms Stylesheet
text/css 69.167.136.4
LIQUIDWEB

General

Check archive.org

Show headers Download Go to

Full URL: https://www.paxful-vendors.com.360cubes.com/style.css
Requested by: Host: www.paxful-vendors.com.360cubes.com
URL: https://www.paxful-vendors.com.360cubes.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 69.167.136.4 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS: host.bestukserver.com
Software: Apache /
Resource Hash: 62d06e3a3c1b64e73a087816a83df8424283414332598c548cad3011a8f832ce

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.paxful-vendors.com.360cubes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 31 Jan 2022 13:10:09 GMT
content-encoding: gzip
last-modified: Wed, 21 Apr 2021 05:24:38 GMT
server: Apache
vary: Accept-Encoding,User-Agent
content-type: text/css
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 1846
expires: Wed, 02 Mar 2022 13:10:09 GMT

GET
H2 200 font-awesome.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/ 30 KB
6 KB 34ms
16ms Stylesheet
text/css 2606:4700::6810:135e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css

Requested by

Host: www.paxful-vendors.com.360cubes.com
URL: https://www.paxful-vendors.com.360cubes.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.paxful-vendors.com.360cubes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 31 Jan 2022 13:10:09 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 539775
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 5631
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:10:07 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03e5f-7918"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yRLTCfwU%2FClt7eAstCn8yzNLvFZmumf%2Bbs3K%2F4eV9m%2BffkxUSdiTPe%2BozTW7ITR7hkmzBt6NxMz3pHIs%2Fy409iv71w9six6Iox6H%2FZlOr2HDWJHeMQ%2BY0FaoipubyPkWDP4Jp0yQ7PyPIIRGdSFw7i%2Fj"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6d632db2da7f9101-FRA
expires: Sat, 21 Jan 2023 13:10:09 GMT

GET
H2 200 fontawesome.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/css/ 57 KB
11 KB 46ms
28ms Stylesheet
text/css 2606:4700::6810:135e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/css/fontawesome.min.css

Requested by

Host: www.paxful-vendors.com.360cubes.com
URL: https://www.paxful-vendors.com.360cubes.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d01a2ba2805c78957e15a2958135de0f3cb88e95159dd0f6c0a032bd76b1b0e9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.paxful-vendors.com.360cubes.com/
Origin: https://www.paxful-vendors.com.360cubes.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 31 Jan 2022 13:10:09 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 537290
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 10262
timing-allow-origin: *
last-modified: Tue, 16 Mar 2021 19:29:58 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "60510736-e238"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Wx1nDa9i9NHabK%2FS32oEZJ%2BVmPFwYidOGlXHoETY0iWvGVaLBjUkh9C4KHqw%2F2iMnDcKmdO0GyRG0AKET2uxdySY04aq0VfpXD6dPHAbc3kHQ9v9NCgQK5W8O48X%2F8As9jBdgN4qFL25rF2F5Tpa3FsM"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6d632db2d86b9010-FRA
expires: Sat, 21 Jan 2023 13:10:09 GMT

GET
H2 200 all.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.1/css/ 58 KB
11 KB 37ms
19ms Stylesheet
text/css 2606:4700::6810:135e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.1/css/all.min.css

Requested by

Host: www.paxful-vendors.com.360cubes.com
URL: https://www.paxful-vendors.com.360cubes.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

af1e6edc875a382b338bb25bd7c5c3f474a7f1b36212002a5896dd06f2186325

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.paxful-vendors.com.360cubes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 31 Jan 2022 13:10:09 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 537334
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 10491
timing-allow-origin: *
last-modified: Mon, 05 Oct 2020 17:43:59 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5f7b5b5f-e7d0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cUz%2B53odjyvGm7i%2FPDEX4IJlppz2hd%2BN2cqf%2B0kDm65VAtpKW%2B2LTruSqvNE2AjIAgcri8ZuZ5MSWWSR7ixOMZIRC9hEgGVfv3dAICZzu7RXJT%2BZlimfHcN9CE7%2BibaExIEUoCYaxFhsk2E4jU8frh7Y"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6d632db2da859101-FRA
expires: Sat, 21 Jan 2023 13:10:09 GMT

GET
H2 200 paxful.png
www.paxful-vendors.com.360cubes.com/ 4 KB
4 KB 129ms
128ms Image
image/png 69.167.136.4
LIQUIDWEB

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.paxful-vendors.com.360cubes.com/paxful.png
Requested by: Host: www.paxful-vendors.com.360cubes.com
URL: https://www.paxful-vendors.com.360cubes.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 69.167.136.4 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS: host.bestukserver.com
Software: Apache /
Resource Hash: de6b5589779fa82ba1841301f56fe3d3d0d44a3150fd0c9dc9a5fd6197c2a5d5

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.paxful-vendors.com.360cubes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 31 Jan 2022 13:10:09 GMT
last-modified: Sat, 23 Jan 2021 01:17:28 GMT
server: Apache
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 3834
expires: Wed, 02 Mar 2022 13:10:09 GMT

GET
H2 200 lang-snip.png
www.paxful-vendors.com.360cubes.com/ 3 KB
3 KB 127ms
126ms Image
image/png 69.167.136.4
LIQUIDWEB

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.paxful-vendors.com.360cubes.com/lang-snip.png
Requested by: Host: www.paxful-vendors.com.360cubes.com
URL: https://www.paxful-vendors.com.360cubes.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 69.167.136.4 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS: host.bestukserver.com
Software: Apache /
Resource Hash: 973ec650e48d1918ca6e1a23db3ed5297cb84de9633a4a3e9972ae1ccef91be0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.paxful-vendors.com.360cubes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 31 Jan 2022 13:10:09 GMT
last-modified: Sat, 23 Jan 2021 01:17:28 GMT
server: Apache
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 2940
expires: Wed, 02 Mar 2022 13:10:09 GMT

GET
H2 200 icon.svg
www.paxful-vendors.com.360cubes.com/ 652 B
469 B 128ms
127ms Image
image/svg+xml 69.167.136.4
LIQUIDWEB

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.paxful-vendors.com.360cubes.com/icon.svg
Requested by: Host: www.paxful-vendors.com.360cubes.com
URL: https://www.paxful-vendors.com.360cubes.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 69.167.136.4 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS: host.bestukserver.com
Software: Apache /
Resource Hash: 401e9f74726c92656dfc4246a82ed5fc68ee83036c7b9f29d1c2e984c904710a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.paxful-vendors.com.360cubes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 31 Jan 2022 13:10:09 GMT
content-encoding: gzip
last-modified: Thu, 15 Apr 2021 09:05:28 GMT
server: Apache
vary: Accept-Encoding,User-Agent
content-type: image/svg+xml
cache-control: max-age=172800
accept-ranges: bytes
content-length: 366
expires: Wed, 02 Feb 2022 13:10:09 GMT

GET
H2 200 jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/2.1.3/ 82 KB
26 KB 34ms
17ms Script
application/javascript 2606:4700::6810:135e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.3/jquery.min.js

Requested by

Host: www.paxful-vendors.com.360cubes.com
URL: https://www.paxful-vendors.com.360cubes.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2051d61446d4dbffb03727031022a08c84528ab44d203a7669c101e5fbdd5515

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.paxful-vendors.com.360cubes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 31 Jan 2022 13:10:09 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 523495
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 26660
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:11:48 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ec4-14983"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FLyuXAuJ6TSS4fAFPNdu%2FKal16pa%2FUGp7mqEf1eIkiYdFWlZ4dxa98tqfKRmZcD8oIsnWOQd6fYfvoiDci7sPj56MaBz5k2909%2BuQK%2FxwWZjy%2FdZ4%2FJAUnQjVssZp1tbOTxXKYxSFHPG0aelJvCYLwQS"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6d632db2da889101-FRA
expires: Sat, 21 Jan 2023 13:10:09 GMT

GET
H2 200 ajax.js Show response
www.paxful-vendors.com.360cubes.com/ 646 B
405 B 127ms
126ms Script
application/javascript 69.167.136.4
LIQUIDWEB

General

Check archive.org

Show headers Download Go to

Full URL: https://www.paxful-vendors.com.360cubes.com/ajax.js
Requested by: Host: www.paxful-vendors.com.360cubes.com
URL: https://www.paxful-vendors.com.360cubes.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 69.167.136.4 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS: host.bestukserver.com
Software: Apache /
Resource Hash: b63d9d0966a07fc4ba4fe70ee3b0a744c8170316a65030ed296f04005330b67e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.paxful-vendors.com.360cubes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 31 Jan 2022 13:10:09 GMT
content-encoding: gzip
last-modified: Thu, 11 Mar 2021 20:57:10 GMT
server: Apache
vary: Accept-Encoding,User-Agent
content-type: application/javascript
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 331
expires: Wed, 02 Mar 2022 13:10:09 GMT

GET
H2 200 css2
fonts.googleapis.com/ 5 KB
812 B 131ms
49ms Stylesheet
text/css 2a00:1450:4001:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Montserrat&family=Open+Sans&display=swap

Requested by

Host: www.paxful-vendors.com.360cubes.com
URL: https://www.paxful-vendors.com.360cubes.com/style.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

0774c144388028b95b3cfd7f13850dbe84c0f173df3aa9106f8e595edf34c991

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.paxful-vendors.com.360cubes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 31 Jan 2022 12:58:37 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 31 Jan 2022 13:10:09 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 31 Jan 2022 13:10:09 GMT

GET
H2 200 css2
fonts.googleapis.com/ 5 KB
749 B 131ms
50ms Stylesheet
text/css 2a00:1450:4001:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Open+Sans:wght@400;600&display=swap

Requested by

Host: www.paxful-vendors.com.360cubes.com
URL: https://www.paxful-vendors.com.360cubes.com/style.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

000f368e166bff7134f2c0ff890f75cd706b90c0de1a9a0be5d0c6f464d8c13e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.paxful-vendors.com.360cubes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 31 Jan 2022 11:40:27 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 31 Jan 2022 13:10:09 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 31 Jan 2022 13:10:09 GMT

GET
H2 200 css2
fonts.googleapis.com/ 3 KB
1 KB 129ms
49ms Stylesheet
text/css 2a00:1450:4001:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Montserrat:wght@400;700&display=swap

Requested by

Host: www.paxful-vendors.com.360cubes.com
URL: https://www.paxful-vendors.com.360cubes.com/style.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

1f5dd0660ba54ce5cdf83660dab70c079ea053dbdcdb24e999e69370ce1291ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.paxful-vendors.com.360cubes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 31 Jan 2022 11:43:43 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 31 Jan 2022 13:10:09 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 31 Jan 2022 13:10:09 GMT

GET
H2 200 back.png
www.paxful-vendors.com.360cubes.com/ 70 KB
71 KB 115ms
115ms Image
image/png 69.167.136.4
LIQUIDWEB

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.paxful-vendors.com.360cubes.com/back.png
Requested by: Host: www.paxful-vendors.com.360cubes.com
URL: https://www.paxful-vendors.com.360cubes.com/style.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 69.167.136.4 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS: host.bestukserver.com
Software: Apache /
Resource Hash: c6e9d33a6b40ab141221510f0d4b5eae932d7b76b95586e5dde0b1c096a1f9f2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.paxful-vendors.com.360cubes.com/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 31 Jan 2022 13:10:09 GMT
last-modified: Thu, 15 Apr 2021 09:09:04 GMT
server: Apache
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 71786
expires: Wed, 02 Mar 2022 13:10:09 GMT

GET
H2 200 JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
fonts.gstatic.com/s/montserrat/v21/ 30 KB
30 KB 160ms
78ms Font
font/woff2 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v21/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Montserrat:wght@400;700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c8f7c04f8d691138d54380550d91349271ca19cfc0f3f6666c401cfa892a12f8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.paxful-vendors.com.360cubes.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 25 Jan 2022 19:33:06 GMT
x-content-type-options: nosniff
age: 495423
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30876
x-xss-protection: 0
last-modified: Tue, 11 Jan 2022 19:19:51 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 25 Jan 2023 19:33:06 GMT

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v27/ 44 KB
44 KB 119ms
37ms Font
font/woff2 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v27/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Open+Sans:wght@400;600&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

88915cdc03fc5b9a20aec966fe93ee38aa3fd76bfef296e41d305271b3541c96

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.paxful-vendors.com.360cubes.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 28 Jan 2022 13:52:02 GMT
x-content-type-options: nosniff
age: 256687
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44656
x-xss-protection: 0
last-modified: Thu, 28 Oct 2021 00:30:43 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Sat, 28 Jan 2023 13:52:02 GMT

GET
H/1.1 200
OK / Show response
api.ipify.org/ 24 B
276 B 322ms
108ms XHR
application/json 3.220.57.224
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://api.ipify.org/?format=json
Requested by: Host: www.paxful-vendors.com.360cubes.com
URL: https://www.paxful-vendors.com.360cubes.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 3.220.57.224 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-220-57-224.compute-1.amazonaws.com
Software: Cowboy /
Resource Hash: 42eee6398f7ac0110ce6359051983a58c06603ef42fb4b1660b9777df755f03c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.paxful-vendors.com.360cubes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Mon, 31 Jan 2022 13:10:09 GMT
Via: 1.1 vegur
Server: Cowboy
Vary: Origin
Content-Type: application/json
Access-Control-Allow-Origin: https://www.paxful-vendors.com.360cubes.com
Connection: keep-alive
Content-Length: 24

GET
H2 200 sendLocation.php Show response
www.paxful-vendors.com.360cubes.com/ 35 B
97 B 2497ms
2497ms XHR
text/html 69.167.136.4
LIQUIDWEB

General

Check archive.org

Show headers Download Go to

Full URL: https://www.paxful-vendors.com.360cubes.com/sendLocation.php?ip=185.213.155.163
Requested by: Host: www.paxful-vendors.com.360cubes.com
URL: https://www.paxful-vendors.com.360cubes.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 69.167.136.4 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS: host.bestukserver.com
Software: Apache /
Resource Hash: 5dbf93fbc12537f77844d22318e1b8b7b63bb7b4e2cd3a6981f83619089da6fe

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.paxful-vendors.com.360cubes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 31 Jan 2022 13:10:09 GMT
cache-control: max-age=600
expires: Mon, 31 Jan 2022 13:20:09 GMT
server: Apache
content-length: 35
vary: User-Agent
content-type: text/html; charset=UTF-8

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Paxful (Crypto Exchange)

17 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.ipify.org
cdnjs.cloudflare.com
fonts.googleapis.com
fonts.gstatic.com
www.paxful-vendors.com.360cubes.com
2606:4700::6810:135e
2a00:1450:4001:802::2003
2a00:1450:4001:80e::200a
3.220.57.224
69.167.136.4
000f368e166bff7134f2c0ff890f75cd706b90c0de1a9a0be5d0c6f464d8c13e
0774c144388028b95b3cfd7f13850dbe84c0f173df3aa9106f8e595edf34c991
1f5dd0660ba54ce5cdf83660dab70c079ea053dbdcdb24e999e69370ce1291ef
2051d61446d4dbffb03727031022a08c84528ab44d203a7669c101e5fbdd5515
401e9f74726c92656dfc4246a82ed5fc68ee83036c7b9f29d1c2e984c904710a
42eee6398f7ac0110ce6359051983a58c06603ef42fb4b1660b9777df755f03c
5dbf93fbc12537f77844d22318e1b8b7b63bb7b4e2cd3a6981f83619089da6fe
62d06e3a3c1b64e73a087816a83df8424283414332598c548cad3011a8f832ce
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
88915cdc03fc5b9a20aec966fe93ee38aa3fd76bfef296e41d305271b3541c96
973ec650e48d1918ca6e1a23db3ed5297cb84de9633a4a3e9972ae1ccef91be0
af1e6edc875a382b338bb25bd7c5c3f474a7f1b36212002a5896dd06f2186325
b63d9d0966a07fc4ba4fe70ee3b0a744c8170316a65030ed296f04005330b67e
c6e9d33a6b40ab141221510f0d4b5eae932d7b76b95586e5dde0b1c096a1f9f2
c8f7c04f8d691138d54380550d91349271ca19cfc0f3f6666c401cfa892a12f8
d01a2ba2805c78957e15a2958135de0f3cb88e95159dd0f6c0a032bd76b1b0e9
de6b5589779fa82ba1841301f56fe3d3d0d44a3150fd0c9dc9a5fd6197c2a5d5
ed97482ffed795ae3ac85a8917b90773e32baa7bcaae5873f475cf9ffdd4c645

www.paxful-vendors.com.360cubes.com Open in urlscan Pro 69.167.136.4 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

18 Requests

100 %HTTPS

60 %IPv6

5 Domains

5 Subdomains

5 IPs

2 Countries

215 kBTransfer

409 kBSize

0 Cookies

0 Outgoing links

Redirected requests

18 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

17 JavaScript Global Variables

0 Cookies

Indicators

www.paxful-vendors.com.360cubes.com Open in urlscan Pro
69.167.136.4 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

18
Requests

100 %
HTTPS

60 %
IPv6

5
Domains

5
Subdomains

5
IPs

2
Countries

215 kB
Transfer

409 kB
Size

0
Cookies

18 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!