Submitted URL: http://paypal-id-signin-customer-center-customer-locale-g-en.cf/recovery/customer_center/customer-IDPP00C828/myaccount/identity
Effective URL: http://www.freenom.link/en/index.html?lang=en
Submission Tags: phishing malicious Search All
Submission: On January 28 via api from US

Summary

This website contacted 6 IPs in 3 countries across 6 domains to perform 17 HTTP transactions. The main IP is 35.204.240.39, located in Ascension Island and belongs to GOOGLE, US. The main domain is www.freenom.link.
This is the only time www.freenom.link was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 195.20.51.70 31624 (VFMNL-AS ...)
1 1 88.198.252.121 24940 (HETZNER-AS)
1 2 35.204.240.39 15169 (GOOGLE)
3 2001:4de0:ac1... 20446 (HIGHWINDS3)
1 2a00:1450:400... 15169 (GOOGLE)
2 2001:4de0:ac1... 20446 (HIGHWINDS3)
17 6
Domain Requested by
3 maxcdn.bootstrapcdn.com www.freenom.link
2 code.jquery.com www.freenom.link
1 fonts.googleapis.com www.freenom.link
1 www.freenom.link paypal-id-signin-customer-center-customer-locale-g-en.cf
www.freenom.link
1 freenom.link 1 redirects
1 domain.dot.tk 1 redirects
1 paypal-id-signin-customer-center-customer-locale-g-en.cf
17 7

This site contains no links.

Subject Issuer Validity Valid
*.bootstrapcdn.com
Sectigo RSA Domain Validation Secure Server CA
2020-09-22 -
2021-10-12
a year crt.sh
upload.video.google.com
GTS CA 1O1
2021-01-05 -
2021-03-30
3 months crt.sh
jquery.org
Sectigo RSA Domain Validation Secure Server CA
2020-10-06 -
2021-10-16
a year crt.sh

This page contains 1 frames:

Primary Page: http://www.freenom.link/en/index.html?lang=en
Frame ID: 43E1CBDA2062DF35FFC78E9E9E5076F6
Requests: 17 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. http://paypal-id-signin-customer-center-customer-locale-g-en.cf/recovery/customer_center/customer-IDPP00C828/myaccount/identity Page URL
  2. http://domain.dot.tk/p/?d=PAYPAL-ID-SIGNIN-CUSTOMER-CENTER-CUSTOMER-LOCALE-G-EN.CF&i=194.99.105.9... HTTP 301
    http://freenom.link/?k=80808080&_=1611796911 HTTP 302
    http://www.freenom.link/en/index.html?lang=en Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

17
Requests

29 %
HTTPS

50 %
IPv6

6
Domains

7
Subdomains

6
IPs

3
Countries

124 kB
Transfer

694 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://paypal-id-signin-customer-center-customer-locale-g-en.cf/recovery/customer_center/customer-IDPP00C828/myaccount/identity Page URL
  2. http://domain.dot.tk/p/?d=PAYPAL-ID-SIGNIN-CUSTOMER-CENTER-CUSTOMER-LOCALE-G-EN.CF&i=194.99.105.99&c=48&ro=0&ref=unknown&_=1611796999204 HTTP 301
    http://freenom.link/?k=80808080&_=1611796911 HTTP 302
    http://www.freenom.link/en/index.html?lang=en Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Cookie set identity
paypal-id-signin-customer-center-customer-locale-g-en.cf/recovery/customer_center/customer-IDPP00C828/myaccount/
776 B
1 KB
Document
General
Full URL
http://paypal-id-signin-customer-center-customer-locale-g-en.cf/recovery/customer_center/customer-IDPP00C828/myaccount/identity
Protocol
HTTP/1.1
Server
195.20.51.70 , Netherlands, ASN31624 (VFMNL-AS Amsterdam Location BGP Setup, NL),
Reverse DNS
Software
nginx /
Resource Hash

Request headers

Host
paypal-id-signin-customer-center-customer-locale-g-en.cf
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Server
nginx
Date
Thu, 28 Jan 2021 01:23:20 GMT
Content-Type
text/html;charset=UTF-8
Content-Length
776
Connection
keep-alive
Cache-Control
no-cache
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Pragma
no-cache
Set-Cookie
JSESSIONID=DE444C02FDA03F939EF23A841B0B315C; Path=/; HttpOnly
X-Server
ip-172-30-2-167
Primary Request index.html
www.freenom.link/en/
Redirect Chain
  • http://domain.dot.tk/p/?d=PAYPAL-ID-SIGNIN-CUSTOMER-CENTER-CUSTOMER-LOCALE-G-EN.CF&i=194.99.105.99&c=48&ro=0&ref=unknown&_=1611796999204
  • http://freenom.link/?k=80808080&_=1611796911
  • http://www.freenom.link/en/index.html?lang=en
6 KB
3 KB
Document
General
Full URL
http://www.freenom.link/en/index.html?lang=en
Requested by
Host: paypal-id-signin-customer-center-customer-locale-g-en.cf
URL: http://paypal-id-signin-customer-center-customer-locale-g-en.cf/recovery/customer_center/customer-IDPP00C828/myaccount/identity
Protocol
HTTP/1.1
Server
35.204.240.39 , Ascension Island, ASN15169 (GOOGLE, US),
Reverse DNS
39.240.204.35.bc.googleusercontent.com
Software
nginx/1.15.8 /
Resource Hash
3ff5c184d2dd6d021b9efb2604ce3ab0a6a1c5917b115eeab02eb8fba27f41a3

Request headers

Host
www.freenom.link
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer
http://paypal-id-signin-customer-center-customer-locale-g-en.cf/recovery/customer_center/customer-IDPP00C828/myaccount/identity
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Cookie
mydottk_languagenr=0; dottyLn=en; wwwLn=en
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
http://paypal-id-signin-customer-center-customer-locale-g-en.cf/recovery/customer_center/customer-IDPP00C828/myaccount/identity

Response headers

Server
nginx/1.15.8
Date
Thu, 28 Jan 2021 01:23:35 GMT
Content-Type
text/html
Transfer-Encoding
chunked
Connection
keep-alive
X-GUploader-UploadID
ABg5-UyBsWpVRAKEJoHMqX_MS2yEjiccA33MdRNWQFUj1W2cNJnBwSmw7k1HOq8GFJHUPBFUJMe85iAdFJqNVPcWDfM
Cache-Control
max-age=3600 public
Expires
Thu, 28 Jan 2021 02:23:35 GMT
Last-Modified
Thu, 01 Jun 2017 09:26:48 GMT
ETag
W/"8872693def6083f7cf51ab8e199289ac"
x-goog-generation
1496309208790923
x-goog-metageneration
6
x-goog-stored-content-encoding
identity
x-goog-stored-content-length
5871
Content-Language
en
x-goog-hash
crc32c=VytHvQ== md5=iHJpPe9gg/fPUauOGZKJrA==
x-goog-storage-class
STANDARD
Content-Encoding
gzip

Redirect headers

Server
nginx/1.15.8
Transfer-Encoding
chunked
Connection
keep-alive
Set-Cookie
mydottk_languagenr=0; domain=.freenom.link; path=/; expires=Fri, 29-Jan-2021 01:23:35 GMT dottyLn=en; domain=.freenom.link; path=/; expires=Fri, 29-Jan-2021 01:23:35 GMT wwwLn=en; domain=.freenom.link; path=/; expires=Fri, 29-Jan-2021 01:23:35 GMT
Date
Thu, 28 Jan 2021 01:23:35 GMT
Location
http://www.freenom.link/en/index.html?lang=en
bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/
118 KB
19 KB
Stylesheet
General
Full URL
https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css
Requested by
Host: www.freenom.link
URL: http://www.freenom.link/en/index.html?lang=en
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac19::1:b:2a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
/
Resource Hash
f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Origin
http://www.freenom.link
Referer
http://www.freenom.link/en/index.html?lang=en
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 28 Jan 2021 01:23:35 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 12 Dec 2018 18:34:07 GMT
etag
"1544639647"
vary
Accept-Encoding
x-cache
HIT
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
timing-allow-origin
*
content-length
19740
css
fonts.googleapis.com/
6 KB
792 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Open+Sans:400,300,600
Requested by
Host: www.freenom.link
URL: http://www.freenom.link/en/index.html?lang=en
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
http://www.freenom.link/en/index.html?lang=en
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Thu, 28 Jan 2021 00:46:24 GMT
server
ESF
date
Thu, 28 Jan 2021 01:23:35 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Thu, 28 Jan 2021 01:23:35 GMT
lander.css
www.freenom.link/css/
0
0

font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.2.0/css/
21 KB
5 KB
Stylesheet
General
Full URL
http://maxcdn.bootstrapcdn.com/font-awesome/4.2.0/css/font-awesome.min.css
Requested by
Host: www.freenom.link
URL: http://www.freenom.link/en/index.html?lang=en
Protocol
HTTP/1.1
Server
2001:4de0:ac19::1:b:2a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
/
Resource Hash
0fb1bbca73646e8e2b93c82e8d8b219647b13d4b440c48e338290b9a685b8de1
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
http://www.freenom.link/en/index.html?lang=en
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 28 Jan 2021 01:23:35 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Wed, 12 Dec 2018 18:35:19 GMT
ETag
"1544639719"
Vary
Accept-Encoding
X-Cache
HIT
Content-Type
text/css; charset=utf-8
Access-Control-Allow-Origin
*
cache-control
public, max-age=31536000
Cross-Origin-Resource-Policy
cross-origin
Connection
Keep-Alive
Accept-Ranges
bytes
timing-allow-origin
*
Content-Length
5041
jquery-1.12.4.js
code.jquery.com/
287 KB
85 KB
Script
General
Full URL
https://code.jquery.com/jquery-1.12.4.js
Requested by
Host: www.freenom.link
URL: http://www.freenom.link/en/index.html?lang=en
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac19::1:b:3a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
nginx /
Resource Hash

Request headers

Referer
http://www.freenom.link/en/index.html?lang=en
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 28 Jan 2021 01:23:35 GMT
content-encoding
gzip
last-modified
Fri, 20 May 2016 17:18:54 GMT
server
nginx
etag
W/"573f46fe-47a36"
vary
Accept-Encoding
x-hw
1611797015.dop223.fr8.t,1611797015.cds208.fr8.hn,1611797015.cds227.fr8.c
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
87176
jquery-ui.js
code.jquery.com/ui/1.12.1/
219 KB
0
Script
General
Full URL
https://code.jquery.com/ui/1.12.1/jquery-ui.js
Requested by
Host: www.freenom.link
URL: http://www.freenom.link/en/index.html?lang=en
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac19::1:b:3a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
nginx /
Resource Hash

Request headers

Referer
http://www.freenom.link/en/index.html?lang=en
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 28 Jan 2021 01:23:35 GMT
content-encoding
gzip
last-modified
Wed, 14 Sep 2016 16:34:16 GMT
server
nginx
etag
W/"57d97c08-7f20a"
vary
Accept-Encoding
x-hw
1611797015.dop223.fr8.t,1611797015.cds208.fr8.hn,1611797015.cds269.fr8.c
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
124434
bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/
36 KB
10 KB
Script
General
Full URL
https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js
Requested by
Host: www.freenom.link
URL: http://www.freenom.link/en/index.html?lang=en
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac19::1:b:2a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Origin
http://www.freenom.link
Referer
http://www.freenom.link/en/index.html?lang=en
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 28 Jan 2021 01:23:35 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 12 Dec 2018 18:33:51 GMT
etag
"1544639631"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
timing-allow-origin
*
content-length
9832
dos.js
www.freenom.link/js/
0
0

searchr.js
www.freenom.link/js/
0
0

icon-dashboard.png
www.freenom.link/images.v2/
0
0

icon-plus.png
www.freenom.link/images.v2/
0
0

icon-privacy.png
www.freenom.link/images.v2/
0
0

icon-dashboard-green.png
www.freenom.link/images.v2/
0
0

network.png
www.freenom.link/images.v2/
0
0

freenom-world.png
www.freenom.link/images.v2/
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
www.freenom.link
URL
http://www.freenom.link/css/lander.css
Domain
www.freenom.link
URL
http://www.freenom.link/js/dos.js
Domain
www.freenom.link
URL
http://www.freenom.link/js/searchr.js
Domain
www.freenom.link
URL
http://www.freenom.link/images.v2/icon-dashboard.png
Domain
www.freenom.link
URL
http://www.freenom.link/images.v2/icon-plus.png
Domain
www.freenom.link
URL
http://www.freenom.link/images.v2/icon-privacy.png
Domain
www.freenom.link
URL
http://www.freenom.link/images.v2/icon-dashboard-green.png
Domain
www.freenom.link
URL
http://www.freenom.link/images.v2/network.png
Domain
www.freenom.link
URL
http://www.freenom.link/images.v2/freenom-world.png

Verdicts & Comments Add Verdict or Comment

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| trustedTypes boolean| crossOriginIsolated

1 Cookies

Domain/Path Name / Value
paypal-id-signin-customer-center-customer-locale-g-en.cf/ Name: JSESSIONID
Value: DE444C02FDA03F939EF23A841B0B315C