gazikulucka.com - urlscan.io

Summary

This website contacted 2 IPs in 1 countries across 3 domains to perform 5 HTTP transactions. The main IP is 2a06:98c1:3120::3, located in United States and belongs to CLOUDFLARENET, US. The main domain is gazikulucka.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on January 24th 2024. Valid for: a year.

This is the only time gazikulucka.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: PayPal (Financial)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2606:4700:20:... 2606:4700:20::681a:2b5	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 3	2a06:98c1:312... 2a06:98c1:3120::3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	192.229.221.25 192.229.221.25	15133 (EDGECAST) (EDGECAST)
5	2

1 2606:4700:20::681a:2b5 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

han.gl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a06:98c1:3120::3 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

gazikulucka.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 192.229.221.25 (United States)

ASN15133 (EDGECAST, US)

www.paypalobjects.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	paypalobjects.com www.paypalobjects.com — Cisco Umbrella Rank: 2594	54 KB
3	gazikulucka.com 1 redirects gazikulucka.com	32 KB
1	han.gl 1 redirects han.gl	603 B
5	3

	Domain	Requested by
3	www.paypalobjects.com	gazikulucka.com
3	gazikulucka.com	1 redirects gazikulucka.com
1	han.gl	1 redirects
5	3

This site contains no links.

Subject Issuer	Validity	Valid
gazikulucka.com Cloudflare Inc ECC CA-3	`2024-01-24` - `2024-12-31`	a year	crt.sh
www.paypal.com DigiCert SHA2 Extended Validation Server CA	`2023-10-12` - `2024-10-31`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://gazikulucka.com/mail/de/
Frame ID: D0D7B4C8D6092A8BE909B253715D7D6E
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Log in to your account

Page URL History Show full URLs

https://han.gl/oEB1C HTTP 301
https://gazikulucka.com/mail/de HTTP 301
https://gazikulucka.com/mail/de/ Page URL

Detected technologies

PayPal (Payment Processors) Expand

Overall confidence: 100%
Detected patterns

paypalobjects\.com

Page Statistics

5
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

2
IPs

1
Countries

86 kB
Transfer

250 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://han.gl/oEB1C HTTP 301
https://gazikulucka.com/mail/de HTTP 301
https://gazikulucka.com/mail/de/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
gazikulucka.com/mail/de/
Redirect Chain

https://han.gl/oEB1C
https://gazikulucka.com/mail/de
https://gazikulucka.com/mail/de/

15 KB
4 KB

129ms
129ms

Document
text/html

2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://gazikulucka.com/mail/de/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PHP/7.4.33

Resource Hash

f26e99b1c1379ca47ec08315a573370b8690a9031a40fd9740372e9eacedb708

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-store, no-cache, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 869b173dc85a0496-CDG
content-encoding: br
content-type: text/html; charset=UTF-8
date: Mon, 25 Mar 2024 01:22:35 GMT
edit: Set-Cookie (.*) "$1;HttpOnly;Secure"
expect-ct: max-age=7776000, report-uri="https://gazikulucka.com/"
expires: Thu, 19 Nov 1981 08:52:00 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
referrer-policy: no-referrer-when-downgrade
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=akE6tIgVoKUXtuwJZie965n7%2BY%2BcD7fuNL5Shhv%2BDiqKIxTKA6zCDPbTdAeW5awrXeGx6H7yhe63VwApjZB%2BVGNPMQ2UjWcEezGwex7uOglNzKFIDllP34rflYlKG%2BwI2FtDlfvkkKlkJzYfvzY%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding,Accept-Encoding
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-powered-by: PHP/7.4.33
x-turbo-charged-by: LiteSpeed
x-xss-protection: 1; mode=block

Redirect headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 869b173cafc60496-CDG
content-type: text/html
date: Mon, 25 Mar 2024 01:22:35 GMT
location: https://gazikulucka.com/mail/de/
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LAjeBgsPfen452xyn%2F6mc9isA0aaqAgzrcqxKbBZuQ%2FpmqQiwLqNiKU8bdD0%2BsxRvvWfP9Kq2TuiDpR8oJVTy2pCKdfm8AreM46ZT00DgeFYbZxQajDVYiM6a3FDZ67FTY9u%2FQbUn4WikMsznq8%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
x-turbo-charged-by: LiteSpeed

GET
H3 200 main.css
gazikulucka.com/mail/de/assets/css/ 181 KB
27 KB 220ms
220ms Stylesheet
text/css 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://gazikulucka.com/mail/de/assets/css/main.css

Requested by

Host: gazikulucka.com
URL: https://gazikulucka.com/mail/de/

Protocol

H3

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e1525489907222908fe2f95c0e1633f5848ea613fbcf80576c3734d2cc6e1149

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gazikulucka.com/mail/de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

expires: Tue, 25 Mar 2025 01:22:34 GMT
date: Mon, 25 Mar 2024 01:22:36 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
last-modified: Fri, 09 Feb 2024 08:13:14 GMT
server: cloudflare
vary: Accept-Encoding,Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=31qDXiVTy4NipH%2FKO8bwn9K%2FX63Bh8TmlodDKv9sDh0kIrHii%2B76NoCEBWD90OkRpKIeB2HX61yQbS4iHxEpofYdNwgSXjdbfJcCPgBPUSFmE1ijQ6QIO9p31A%2B1DIib67JhkgxgaykH4Tkrbx8%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=UTF-8
cache-control: public, max-age=31536000
x-turbo-charged-by: LiteSpeed
cf-ray: 869b173e9bec1c40-FRA
edit: Set-Cookie (.*) "$1;HttpOnly;Secure"

GET
H2 200 paypal-mark-color.svg
www.paypalobjects.com/paypal-ui/logos/svg/ 1 KB
973 B 171ms
39ms Image
image/svg+xml 192.229.221.25
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.paypalobjects.com/paypal-ui/logos/svg/paypal-mark-color.svg

Requested by

Host: gazikulucka.com
URL: https://gazikulucka.com/mail/de/assets/css/main.css

Protocol

H2

Security

TLS 1.3, , AES_256_GCM

Server

192.229.221.25 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (frc/4CB4) /

Resource Hash

f9035e34f5734e89ddb03b601b1c0fd58323a93f176c5c7e220d7aa7a2062ed5

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gazikulucka.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 25 Mar 2024 01:22:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-cache: HIT
paypal-debug-id: 12ee90be25800
dc: ccg11-origin-www-1.paypal.com
content-length: 548
last-modified: Wed, 15 Jun 2022 22:33:20 GMT
server: ECAcc (frc/4CB4)
traceparent: 00-000000000000000000012ee90be25800-8f8432431226388b-01
etag: W/"62aa5e30-436"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: s-maxage=31536000, public,max-age=3600
accept-ranges: bytes
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
expires: Mon, 25 Mar 2024 02:22:36 GMT

GET
H2 200 PayPalOpen-Regular.woff2
www.paypalobjects.com/paypal-ui/fonts/ 27 KB
27 KB 172ms
41ms Font
application/font-woff2 192.229.221.25
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/paypal-ui/fonts/PayPalOpen-Regular.woff2

Requested by

Host: gazikulucka.com
URL: https://gazikulucka.com/mail/de/assets/css/main.css

Protocol

H2

Security

TLS 1.3, , AES_256_GCM

Server

192.229.221.25 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (frc/4CC0) /

Resource Hash

9ae7b95f034d76b21aaf8fcc0cdd39f4ba7ba59dd9751348a32c7e5cfdfdb6df

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://gazikulucka.com/
Origin: https://gazikulucka.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 25 Mar 2024 01:22:36 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff
x-cache: HIT
paypal-debug-id: b91a21d0ebb71
dc: ccg11-origin-www-1.paypal.com
content-length: 27457
last-modified: Thu, 02 Jun 2022 17:26:24 GMT
server: ECAcc (frc/4CC0)
traceparent: 00-0000000000000000000b91a21d0ebb71-36652096df351584-01
etag: "6298f2c0-6b41"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: s-maxage=31536000, public,max-age=3600
accept-ranges: bytes
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
expires: Mon, 25 Mar 2024 02:22:36 GMT

GET
H2 200 PayPalOpen-Bold.woff2
www.paypalobjects.com/paypal-ui/fonts/ 26 KB
26 KB 169ms
40ms Font
application/font-woff2 192.229.221.25
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/paypal-ui/fonts/PayPalOpen-Bold.woff2

Requested by

Host: gazikulucka.com
URL: https://gazikulucka.com/mail/de/assets/css/main.css

Protocol

H2

Security

TLS 1.3, , AES_256_GCM

Server

192.229.221.25 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (frc/4CE7) /

Resource Hash

9ed6dcb699f10e85624a4579731f929b5d8b91f0c73b9fc01b8893021c83f4a0

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://gazikulucka.com/
Origin: https://gazikulucka.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 25 Mar 2024 01:22:36 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff
x-cache: HIT
paypal-debug-id: 520c8371dc856
dc: ccg11-origin-www-1.paypal.com
content-length: 26700
last-modified: Thu, 02 Jun 2022 17:26:24 GMT
server: ECAcc (frc/4CE7)
traceparent: 00-0000000000000000000520c8371dc856-661c819ae2f67e8e-01
etag: "6298f2c0-684c"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: s-maxage=31536000, public,max-age=3600
accept-ranges: bytes
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
expires: Mon, 25 Mar 2024 02:22:36 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
han.gl/	1969-12-31 23:59:59	Name: PHPSESSID Value: 6blvq000hgg6fq42sjq0hskcfv
han.gl/	1970-01-20 19:22:10	Name: short_2892269 Value: 1
gazikulucka.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 78fbf72b5bdea07a3dcf73469037a858

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

gazikulucka.com
han.gl
www.paypalobjects.com
192.229.221.25
2606:4700:20::681a:2b5
2a06:98c1:3120::3
9ae7b95f034d76b21aaf8fcc0cdd39f4ba7ba59dd9751348a32c7e5cfdfdb6df
9ed6dcb699f10e85624a4579731f929b5d8b91f0c73b9fc01b8893021c83f4a0
e1525489907222908fe2f95c0e1633f5848ea613fbcf80576c3734d2cc6e1149
f26e99b1c1379ca47ec08315a573370b8690a9031a40fd9740372e9eacedb708
f9035e34f5734e89ddb03b601b1c0fd58323a93f176c5c7e220d7aa7a2062ed5

gazikulucka.com Open in urlscan Pro 2a06:98c1:3120::3 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

5 Requests

100 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

2 IPs

1 Countries

86 kBTransfer

250 kBSize

3 Cookies

0 Outgoing links

Page URL History

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

3 Cookies

Security Headers

Indicators

gazikulucka.com Open in urlscan Pro
2a06:98c1:3120::3 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

2
IPs

1
Countries

86 kB
Transfer

250 kB
Size

3
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!