www.support-uk-cshelp-personal.getit.ink

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 6 HTTP transactions. The main IP is 44.202.59.53, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is www.support-uk-cshelp-personal.getit.ink.
TLS certificate: Issued by E6 on November 21st 2024. Valid for: 3 months.

This is the only time www.support-uk-cshelp-personal.getit.ink was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: PayPal (Financial)

Domain & IP information

	IP Address	AS Autonomous System
4	44.202.59.53 44.202.59.53	14618 (AMAZON-AES) (AMAZON-AES)
2	192.229.221.25 192.229.221.25	15133 (EDGECAST) (EDGECAST)
6	2

4 44.202.59.53 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-44-202-59-53.compute-1.amazonaws.com

www.support-uk-cshelp-personal.getit.ink	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.229.221.25 (United States)

ASN15133 (EDGECAST, US)

www.paypalobjects.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	getit.ink www.support-uk-cshelp-personal.getit.ink	7 KB
2	paypalobjects.com www.paypalobjects.com — Cisco Umbrella Rank: 2811	5 KB
6	2

	Domain	Requested by
4	www.support-uk-cshelp-personal.getit.ink	www.support-uk-cshelp-personal.getit.ink
2	www.paypalobjects.com	www.support-uk-cshelp-personal.getit.ink
6	2

This site contains links to these domains. Also see Links.

Domain
www.paypal.com

Subject Issuer	Validity	Valid
support-uk-cshelp-personal.getit.ink E6	`2024-11-21` - `2025-02-19`	3 months	crt.sh
www.paypal.com DigiCert SHA2 Extended Validation Server CA	`2024-06-13` - `2025-06-12`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.support-uk-cshelp-personal.getit.ink/
Frame ID: F4FE92E26DBFC1319CDE94FE72E25A3B
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

paypal signin and sign up

Detected technologies

PayPal (Payment Processors) Expand

Overall confidence: 100%
Detected patterns

paypalobjects\.com

Page Statistics

6
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

12 kB
Transfer

34 kB
Size

0
Cookies

5 Outgoing links

These are links going to different origins than the main page.

URL: https://www.paypal.com/smarthelp/home
Title: Forgot password?

Search URL Search Domain Scan URL

URL: https://www.paypal.com/smarthelp/contact-us
Title: Contact Us

Search URL Search Domain Scan URL

URL: https://www.paypal.com/businesswallet/classic-fees
Title: Policy

Search URL Search Domain Scan URL

URL: https://www.paypal.com/webapps/mpp/paypal-safety-and-security
Title: Updates

Search URL Search Domain Scan URL

URL: https://www.paypal.com/webapps/mpp/about
Title: Worldwide

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.support-uk-cshelp-personal.getit.ink/ 7 KB
2 KB 834ms
167ms Document
text/html 44.202.59.53
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://www.support-uk-cshelp-personal.getit.ink/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 44.202.59.53 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-202-59-53.compute-1.amazonaws.com
Software: LiteSpeed /
Resource Hash: c9af74b80cb62f8836a170def32f9b9551ed4570e053b6c80b1a513eff242e50

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-encoding: br
content-length: 2115
content-type: text/html
date: Thu, 21 Nov 2024 09:40:01 GMT
etag: "1d87-673effc7-fd13e;br"
last-modified: Thu, 21 Nov 2024 09:39:19 GMT
server: LiteSpeed
vary: Accept-Encoding

GET
H2 200 PayPal%20signin.css
www.support-uk-cshelp-personal.getit.ink/ 20 KB
3 KB 127ms
125ms Stylesheet
text/css 44.202.59.53
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://www.support-uk-cshelp-personal.getit.ink/PayPal%20signin.css
Requested by: Host: www.support-uk-cshelp-personal.getit.ink
URL: https://www.support-uk-cshelp-personal.getit.ink/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 44.202.59.53 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-202-59-53.compute-1.amazonaws.com
Software: LiteSpeed /
Resource Hash: 8e1e2d61fda426c6aa6196093bbaadecacac973b37f17fde7dd0bcb3702a0ed7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.support-uk-cshelp-personal.getit.ink/

Response headers

cache-control: public, max-age=604800
content-encoding: br
etag: "4fed-673effd3-fd14b;br"
expires: Thu, 28 Nov 2024 09:40:01 GMT
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length: 2717
date: Thu, 21 Nov 2024 09:40:01 GMT
last-modified: Thu, 21 Nov 2024 09:39:31 GMT
content-type: text/css
vary: Accept-Encoding
server: LiteSpeed

GET
H2 200 paypal-mark-color.svg
www.paypalobjects.com/paypal-ui/logos/svg/ 709 B
847 B 260ms
47ms Image
image/svg+xml 192.229.221.25
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.paypalobjects.com/paypal-ui/logos/svg/paypal-mark-color.svg

Requested by

Host: www.support-uk-cshelp-personal.getit.ink
URL: https://www.support-uk-cshelp-personal.getit.ink/

Protocol

H2

Security

TLS 1.3, , AES_256_GCM

Server

192.229.221.25 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (frc/4CF9) /

Resource Hash

8766a4211434d2c318fbfa412ea9633b385ecf1cab6119f8894019d91ed7e027

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.support-uk-cshelp-personal.getit.ink/

Response headers

paypal-debug-id: 94461365fb7cf
content-encoding: br
etag: "66d9ab63-2c5+gzip+br"
x-content-type-options: nosniff
expires: Thu, 21 Nov 2024 10:40:02 GMT
traceparent: 00-000000000000000000094461365fb7cf-1bf39fc9bc7ff5e6-01
dc: ccg11-origin-www-1.paypal.com
x-cache: HIT
date: Thu, 21 Nov 2024 09:40:02 GMT
content-type: image/svg+xml
last-modified: Thu, 05 Sep 2024 13:00:19 GMT
vary: Accept-Encoding
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: s-maxage=31536000, public,max-age=3600
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
access-control-allow-origin: *
content-length: 422
server: ECAcc (frc/4CF9)

GET
H2 404 sprite_countries_flag6.png
www.support-uk-cshelp-personal.getit.ink/image/ 1 KB
1 KB 126ms
126ms Image
text/html 44.202.59.53
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.support-uk-cshelp-personal.getit.ink/image/sprite_countries_flag6.png
Requested by: Host: www.support-uk-cshelp-personal.getit.ink
URL: https://www.support-uk-cshelp-personal.getit.ink/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 44.202.59.53 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-202-59-53.compute-1.amazonaws.com
Software: LiteSpeed /
Resource Hash: 679e7e62b81267c93d0778083ae0fd0efe24172ff0ac581835b54165b3d9ed43

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.support-uk-cshelp-personal.getit.ink/

Response headers

cache-control: private, no-cache, max-age=0
content-encoding: gzip
pragma: no-cache
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
date: Thu, 21 Nov 2024 09:40:01 GMT
content-type: text/html
vary: Accept-Encoding
server: LiteSpeed

GET
H2 200 PayPal%20signin.js Show response
www.support-uk-cshelp-personal.getit.ink/ 1 KB
396 B 122ms
122ms Script
text/javascript 44.202.59.53
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://www.support-uk-cshelp-personal.getit.ink/PayPal%20signin.js
Requested by: Host: www.support-uk-cshelp-personal.getit.ink
URL: https://www.support-uk-cshelp-personal.getit.ink/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 44.202.59.53 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-202-59-53.compute-1.amazonaws.com
Software: LiteSpeed /
Resource Hash: 8d4f6b8b23a5982d53e33deaf218b0e19b5ba3d8b55d7fa226f1072d9f115029

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.support-uk-cshelp-personal.getit.ink/

Response headers

content-encoding: br
etag: "462-673effd3-fd14c;br"
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length: 323
date: Thu, 21 Nov 2024 09:40:01 GMT
last-modified: Thu, 21 Nov 2024 09:39:31 GMT
content-type: text/javascript
vary: Accept-Encoding
server: LiteSpeed

GET
H2 200 pp32.png
www.paypalobjects.com/webstatic/icon/ 4 KB
4 KB 65ms
65ms Other
image/png 192.229.221.25
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/webstatic/icon/pp32.png

Protocol

H2

Security

TLS 1.3, , AES_256_GCM

Server

192.229.221.25 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (frc/4CB6) /

Resource Hash

9e208d404c81e5fc7170c13b8564b1368100d668b2071b16ee14600d08519ac4

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.support-uk-cshelp-personal.getit.ink/

Response headers

paypal-debug-id: 5ae2365ab9abc
etag: "53611ccb-f84"
access-control-allow-methods: GET
x-content-type-options: nosniff
expires: Thu, 21 Nov 2024 10:40:02 GMT
traceparent: 00-00000000000000000005ae2365ab9abc-1077fffe2bf09aa0-01
dc: ccg11-origin-www-1.paypal.com
x-cache: HIT
date: Thu, 21 Nov 2024 09:40:02 GMT
content-type: image/png
last-modified: Wed, 30 Apr 2014 15:54:51 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: s-maxage=31536000, public,max-age=3600
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
accept-ch: DPR, Viewport-Width, Width, ECT, Downlink
accept-ranges: bytes
access-control-allow-origin: *
content-length: 3972
server: ECAcc (frc/4CB6)

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://www.support-uk-cshelp-personal.getit.ink/image/sprite_countries_flag6.png Message: Failed to load resource: the server responded with a status of 404 ()
recommendation	verbose	URL: https://www.support-uk-cshelp-personal.getit.ink/ Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

www.paypalobjects.com
www.support-uk-cshelp-personal.getit.ink
192.229.221.25
44.202.59.53
679e7e62b81267c93d0778083ae0fd0efe24172ff0ac581835b54165b3d9ed43
8766a4211434d2c318fbfa412ea9633b385ecf1cab6119f8894019d91ed7e027
8d4f6b8b23a5982d53e33deaf218b0e19b5ba3d8b55d7fa226f1072d9f115029
8e1e2d61fda426c6aa6196093bbaadecacac973b37f17fde7dd0bcb3702a0ed7
9e208d404c81e5fc7170c13b8564b1368100d668b2071b16ee14600d08519ac4
c9af74b80cb62f8836a170def32f9b9551ed4570e053b6c80b1a513eff242e50

www.support-uk-cshelp-personal.getit.ink Open in urlscan Pro 44.202.59.53 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

6 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

1 Countries

12 kBTransfer

34 kBSize

0 Cookies

5 Outgoing links

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

2 Console Messages

Indicators

www.support-uk-cshelp-personal.getit.ink Open in urlscan Pro
44.202.59.53 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

12 kB
Transfer

34 kB
Size

0
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!