paypal.com.0.login-confirmation.account-security.b696836d2e2dd458ecdccc67a28ed7f4.231.hyd.me/CBIBSWeb/start.do/fd2f455cd1b5d9ba7e2a2eb4385b8b2d/
185.53.177.52200 OK 2.4 kB URL User Request GET HTTP/1.1 paypal.com.0.login-confirmation.account-security.b696836d2e2dd458ecdccc67a28ed7f4.231.hyd.me/CBIBSWeb/start.do/fd2f455cd1b5d9ba7e2a2eb4385b8b2d/
IP 185.53.177.52:80
ASN #61969 Team Internet AG
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text
Hash 3d5b9dacdadd854ea4057e730c4516e5
6a28a5748dfc4819e14a5b2895178cfa5dd57393
e5cddc749fe283d71167f88baa78dd092a20382e21d764d4ba53c7438b103808
NIDS Severity Alert suricata medium ET PHISHING Possible Paypal Phishing Domain Mar 14 2016
GET /CBIBSWeb/start.do/fd2f455cd1b5d9ba7e2a2eb4385b8b2d/ HTTP/1.1
Host: paypal.com.0.login-confirmation.account-security.b696836d2e2dd458ecdccc67a28ed7f4.231.hyd.me
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 09 Jun 2023 01:24:28 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Redirect: skenzo
X-Buckets: bucket011
X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALquDFETXRn0Hr05fUP7EJT77xYnPmRbpMy4vk8KYiHnkNpednjOANJcaXDXcKQJN0nXKZJL7TciJD8AoHXK158CAwEAAQ==_YyUDrgw8PNpHLF+k3m1LGpxd2QHZLNR0RFfx3or9cymRm503u+xT3cVPTqexsIZwLzRElkh2TWQlH/mdEkJ6fw==
X-Template: tpl_CleanPeppermintBlack_twoclick
X-Language: norwegian
Accept-CH: viewport-width, dpr, device-memory, rtt, downlink, ect, ua, ua-full-version, ua-platform, ua-platform-version, ua-arch, ua-model, ua-mobile
Accept-CH-Lifetime: 30
X-Domain: hyd.me
X-Subdomain: paypal.com.0.login-confirmation.account-security.b696836d2e2dd458ecdccc67a28ed7f4.231
Content-Encoding: gzip
c.parkingcrew.net/scripts/sale_form.js
185.53.178.30200 OK 761 B URL GET HTTP/1.1 c.parkingcrew.net/scripts/sale_form.js
IP 185.53.178.30:80
Requested by http://paypal.com.0.login-confirmation.account-security.b696836d2e2dd458ecdccc67a28ed7f4.231.hyd.me/CBIBSWeb/start.do/fd2f455cd1b5d9ba7e2a2eb4385b8b2d/
Hash 64f809e06446647e192fce8d1ec34e09
5b7ced07da42e205067afa88615317a277a4a82c
f52cbd664986ad7ed6e71c448e2d31d1a16463e4d9b7bca0c6be278649ccc4f3
GET /scripts/sale_form.js HTTP/1.1
Host: c.parkingcrew.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://paypal.com.0.login-confirmation.account-security.b696836d2e2dd458ecdccc67a28ed7f4.231.hyd.me/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 09 Jun 2023 01:24:29 GMT
Content-Type: application/javascript
Content-Length: 761
Connection: keep-alive
Last-Modified: Tue, 12 May 2020 14:25:52 GMT
ETag: "5ebab1f0-2f9"
Accept-Ranges: bytes
paypal.com.0.login-confirmation.account-security.b696836d2e2dd458ecdccc67a28ed7f4.231.hyd.me/favicon.ico
185.53.177.52200 OK 0 B URL GET HTTP/1.1 paypal.com.0.login-confirmation.account-security.b696836d2e2dd458ecdccc67a28ed7f4.231.hyd.me/favicon.ico
IP 185.53.177.52:80
ASN #61969 Team Internet AG
Requested by http://paypal.com.0.login-confirmation.account-security.b696836d2e2dd458ecdccc67a28ed7f4.231.hyd.me/CBIBSWeb/start.do/fd2f455cd1b5d9ba7e2a2eb4385b8b2d/
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /favicon.ico HTTP/1.1
Host: paypal.com.0.login-confirmation.account-security.b696836d2e2dd458ecdccc67a28ed7f4.231.hyd.me
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://paypal.com.0.login-confirmation.account-security.b696836d2e2dd458ecdccc67a28ed7f4.231.hyd.me/CBIBSWeb/start.do/fd2f455cd1b5d9ba7e2a2eb4385b8b2d/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 09 Jun 2023 01:24:29 GMT
Content-Type: image/x-icon
Content-Length: 0
Connection: keep-alive
Last-Modified: Tue, 12 May 2020 14:25:52 GMT
ETag: "5ebab1f0-0"
Accept-Ranges: bytes
ifdnzact.com/?dn=hyd.me&pid=9PO755G95
208.91.196.46403 Forbidden 272 B URL GET HTTP/1.1 ifdnzact.com/?dn=hyd.me&pid=9PO755G95
IP 208.91.196.46:80
ASN #40034 CONFLUENCE-NETWORK-INC
Requested by http://paypal.com.0.login-confirmation.account-security.b696836d2e2dd458ecdccc67a28ed7f4.231.hyd.me/CBIBSWeb/start.do/fd2f455cd1b5d9ba7e2a2eb4385b8b2d/
File type HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash 8859320b3a0c5b58d422f830c6c83fd1
529564a0e7aea113048d3840e2d72776b3e00d32
9f96d68b285d4f7e4a82ef42e626ec4f96a94c9c61a2c7fcb699a762b1abb487
GET /?dn=hyd.me&pid=9PO755G95 HTTP/1.1
Host: ifdnzact.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://paypal.com.0.login-confirmation.account-security.b696836d2e2dd458ecdccc67a28ed7f4.231.hyd.me/
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 403 Forbidden
Date: Fri, 09 Jun 2023 01:24:29 GMT
Server: Apache
Content-Length: 272
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8