client-paypal-center.org Open in urlscan Pro
95.85.73.246  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response client-paypal-center.org/	44 KB 11 KB	938ms 382ms	Document text/html	95.85.73.246 GHOST
General Check archive.org Show headers Download Go to Full URL https://client-paypal-center.org/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.85.73.246 Central, Hong Kong, ASN202422 (GHOST, LU), Reverse DNS heykong006.example.com Software nginx / Resource Hash 9c1a4337693e2b4589eab046f2231edd4e3d859c8bcaf0145fcc29661d2e9062 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers content-encoding gzip content-type text/html; charset=UTF-8 date Tue, 17 May 2022 10:47:33 GMT server nginx strict-transport-security max-age=31536000 vary Accept-Encoding
GET H2	200	site-jquery.min.js Show response client-paypal-center.org/admin/im/	91 KB 36 KB	199ms 199ms	Script application/javascript	95.85.73.246 GHOST
General Check archive.org Show headers Download Go to Full URL https://client-paypal-center.org/admin/im/site-jquery.min.js Requested by Host: client-paypal-center.org URL: https://client-paypal-center.org/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.85.73.246 Central, Hong Kong, ASN202422 (GHOST, LU), Reverse DNS heykong006.example.com Software nginx / Resource Hash 5994332aadd364a7350ad226ef61c1c75dc97372f739e01682e190be3abaf672 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://client-paypal-center.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Tue, 17 May 2022 10:47:33 GMT content-encoding gzip last-modified Mon, 23 Aug 2021 08:34:16 GMT server nginx etag W/"61235d88-16b60" vary Accept-Encoding content-type application/javascript cache-control max-age=43200 strict-transport-security max-age=31536000 expires Tue, 17 May 2022 22:47:33 GMT
GET H2	200	layui.js Show response client-paypal-center.org/admin/im/	284 KB 105 KB	393ms 393ms	Script application/javascript	95.85.73.246 GHOST
General Check archive.org Show headers Download Go to Full URL https://client-paypal-center.org/admin/im/layui.js Requested by Host: client-paypal-center.org URL: https://client-paypal-center.org/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.85.73.246 Central, Hong Kong, ASN202422 (GHOST, LU), Reverse DNS heykong006.example.com Software nginx / Resource Hash bbfe1536a99000acceb61f549aa59354cc596efc9f10d3843aab6b273f5adb1e Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://client-paypal-center.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Tue, 17 May 2022 10:47:33 GMT content-encoding gzip last-modified Tue, 06 Jul 2021 04:01:50 GMT server nginx etag W/"60e3d5ae-471da" vary Accept-Encoding content-type application/javascript cache-control max-age=43200 strict-transport-security max-age=31536000 expires Tue, 17 May 2022 22:47:33 GMT
GET H2	200	layer.min.css cdn.bootcdn.net/ajax/libs/layer/3.5.1/theme/default/	13 KB 3 KB	94ms 39ms	Stylesheet text/css	2606:4700:3038::6815:eac9 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.bootcdn.net/ajax/libs/layer/3.5.1/theme/default/layer.min.css Requested by Host: client-paypal-center.org URL: https://client-paypal-center.org/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3038::6815:eac9 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f99199228144a11b7adda7dad83f11c366ecb6f530ba8a352fb155bc0e58fc0e Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://client-paypal-center.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Tue, 17 May 2022 10:47:33 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 595414 x-cache HIT cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 timing-allow-origin * last-modified Fri, 11 Jun 2021 14:31:54 GMT server cloudflare cf-cdnjs-via cfworker/kv etag W/"60c373da-a5f" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mHc0Z1aHtN8M8%2BBX%2FlZDwLdkxuZz%2Fws6HdHH7kWxCZBm%2BPifieq8vXtpvb4YKPDbfrMX78GrK4mO%2BKFzevle5RbhtDY2Wopw%2FW8yj0mXEgM5GYuRqELjPaIUCgXli6FiCLCFLoqi"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control max-age=2678400 cf-ray 70cbc694ae829162-FRA expires Wed, 11 May 2022 01:23:59 GMT
GET H2	404	laydate.css client-paypal-center.org/admin/im/css/modules/laydate/default/	0 0	192ms 191ms	Stylesheet text/html	95.85.73.246 GHOST
General Check archive.org Show headers Download Go to Full URL https://client-paypal-center.org/admin/im/css/modules/laydate/default/laydate.css?v=5.3.1 Requested by Host: client-paypal-center.org URL: https://client-paypal-center.org/admin/im/layui.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.85.73.246 Central, Hong Kong, ASN202422 (GHOST, LU), Reverse DNS heykong006.example.com Software nginx / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer https://client-paypal-center.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Tue, 17 May 2022 10:47:34 GMT server nginx content-length 548 content-type text/html
GET H2	404	layer.css client-paypal-center.org/admin/im/css/modules/layer/default/	0 0	192ms 191ms	Stylesheet text/html	95.85.73.246 GHOST
General Check archive.org Show headers Download Go to Full URL https://client-paypal-center.org/admin/im/css/modules/layer/default/layer.css?v=3.5.1 Requested by Host: client-paypal-center.org URL: https://client-paypal-center.org/admin/im/layui.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.85.73.246 Central, Hong Kong, ASN202422 (GHOST, LU), Reverse DNS heykong006.example.com Software nginx / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer https://client-paypal-center.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Tue, 17 May 2022 10:47:34 GMT server nginx content-length 548 content-type text/html
GET H2	404	code.css client-paypal-center.org/admin/im/css/modules/	0 0	191ms 191ms	Stylesheet text/html	95.85.73.246 GHOST
General Check archive.org Show headers Download Go to Full URL https://client-paypal-center.org/admin/im/css/modules/code.css?v=2 Requested by Host: client-paypal-center.org URL: https://client-paypal-center.org/admin/im/layui.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.85.73.246 Central, Hong Kong, ASN202422 (GHOST, LU), Reverse DNS heykong006.example.com Software nginx / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer https://client-paypal-center.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Tue, 17 May 2022 10:47:34 GMT server nginx content-length 548 content-type text/html
GET H2	200	momgram@2x.png www.paypalobjects.com/images/shared/	2 KB 2 KB	75ms 7ms	Image image/png	151.101.194.133 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.paypalobjects.com/images/shared/momgram@2x.png Requested by Host: client-paypal-center.org URL: https://client-paypal-center.org/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.194.133 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash b3f1bf1d5e25838bcad8535a2b700486644f4ea888e46c77d3e82783cb9da1b4 Security Headers Name Value Strict-Transport-Security max-age=31557600 X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://client-paypal-center.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Tue, 17 May 2022 10:47:34 GMT via 1.1 varnish, 1.1 varnish x-content-type-options nosniff x-cache HIT, HIT fastly-io-info ifsz=1996 idim=60x74 ifmt=png ofsz=1768 odim=60x74 ofmt=png paypal-debug-id 335452ecd8460 fastly-stats io=1 dc ccg11-origin-www-1.paypal.com content-length 1768 x-served-by cache-sjc10083-SJC, cache-fra19168-FRA x-timer S1652784455.533933,VS0,VE0 etag "n1eiFwTHQZT8r7LMVF4RJSE9QNnoZS4jSUvEYSZDtgw" strict-transport-security max-age=31557600 content-type image/png cache-control public,max-age=3600 accept-ranges bytes x-cache-hits 12, 23
GET H2	200	api.php Show response client-paypal-center.org/	13 B 309 B	196ms 196ms	XHR text/html	95.85.73.246 GHOST
General Check archive.org Show headers Download Go to Full URL https://client-paypal-center.org/api.php?act=ip_save&_r=0.1588353769261921 Requested by Host: client-paypal-center.org URL: https://client-paypal-center.org/admin/im/site-jquery.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.85.73.246 Central, Hong Kong, ASN202422 (GHOST, LU), Reverse DNS heykong006.example.com Software nginx / Resource Hash aa3d21398252adb9f16b5208884b4da22eec9f2019a0139b114a61f178396794 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Accept */* Referer https://client-paypal-center.org/ X-Requested-With XMLHttpRequest accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers pragma no-cache date Tue, 17 May 2022 10:47:34 GMT content-encoding gzip server nginx vary Accept-Encoding content-type text/html; charset=UTF-8 cache-control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 strict-transport-security max-age=31536000 expires Thu, 19 Nov 1981 08:52:00 GMT
GET H2	200	sprite_countries_flag.png client-paypal-center.org/admin/img/	71 KB 71 KB	191ms 191ms	Image image/png	95.85.73.246 GHOST
General Check archive.org Show headers Download Go to Show image Full URL https://client-paypal-center.org/admin/img/sprite_countries_flag.png Requested by Host: client-paypal-center.org URL: https://client-paypal-center.org/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.85.73.246 Central, Hong Kong, ASN202422 (GHOST, LU), Reverse DNS heykong006.example.com Software nginx / Resource Hash 9c14b809ca4d5de12a569239d46ab8ef5f7ac1b3804c9801583cbafb66d3e550 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://client-paypal-center.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Tue, 17 May 2022 10:47:34 GMT last-modified Wed, 11 May 2022 13:54:36 GMT server nginx etag "627bc01c-11a80" strict-transport-security max-age=31536000 content-type image/png cache-control max-age=2592000 accept-ranges bytes content-length 72320 expires Thu, 16 Jun 2022 10:47:34 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial)

21 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone function| getScreenDetails function| $ function| jQuery object| layui function| lay number| errors object| layer object| jQuery110108933529574983747 function| btn1 function| numberTip function| change object| mask object| timer object| hb_timer function| heart_beat function| ip_save function| is_agree function| checkSingleSubmit

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			client-paypal-center.org/	1969-12-31 23:59:59	Name: PHPSESSID Value: fm61jpipjih96js474atucrfu2

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://client-paypal-center.org/admin/im/css/modules/laydate/default/laydate.css?v=5.3.1 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://client-paypal-center.org/admin/im/css/modules/layer/default/layer.css?v=3.5.1 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://client-paypal-center.org/admin/im/css/modules/code.css?v=2 Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.bootcdn.net
client-paypal-center.org
www.paypalobjects.com
151.101.194.133
2606:4700:3038::6815:eac9
95.85.73.246
5994332aadd364a7350ad226ef61c1c75dc97372f739e01682e190be3abaf672
9c14b809ca4d5de12a569239d46ab8ef5f7ac1b3804c9801583cbafb66d3e550
9c1a4337693e2b4589eab046f2231edd4e3d859c8bcaf0145fcc29661d2e9062
aa3d21398252adb9f16b5208884b4da22eec9f2019a0139b114a61f178396794
b3f1bf1d5e25838bcad8535a2b700486644f4ea888e46c77d3e82783cb9da1b4
bbfe1536a99000acceb61f549aa59354cc596efc9f10d3843aab6b273f5adb1e
f99199228144a11b7adda7dad83f11c366ecb6f530ba8a352fb155bc0e58fc0e