paypal-payment-au.net Open in urlscan Pro
146.185.214.128  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request admin Show response paypal-payment-au.net/	727 B 995 B	1327ms 231ms	Document text/html	146.185.214.128 GHOST
General Check archive.org Show headers Download Go to Full URL http://paypal-payment-au.net/admin Protocol HTTP/1.1 Server 146.185.214.128 Sydney, Australia, ASN202422 (GHOST, LU), Reverse DNS cooldog22581.example.com Software nginx / Resource Hash fce29e1fe6bf89c80ee27d17e1bd33bc2050ab5897bff235e3176e6f53d00661 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language jp-JP,jp;q=0.9 Response headers Server nginx Date Sat, 11 Dec 2021 12:07:10 GMT Content-Type text/html; charset=utf-8 Content-Length 727 Connection keep-alive Last-Modified Wed, 08 Dec 2021 11:37:26 GMT Cache-Control max-age=0 no-cache X-Cache MISS
GET H/1.1	200 OK	app.6775eed8164f72ee06dec1c5e84f73d2.css paypal-payment-au.net/static/css/	902 KB 164 KB	122ms 122ms	Stylesheet text/css	146.185.214.128 GHOST
General Check archive.org Show headers Download Go to Full URL http://paypal-payment-au.net/static/css/app.6775eed8164f72ee06dec1c5e84f73d2.css Requested by Host: paypal-payment-au.net URL: http://paypal-payment-au.net/admin Protocol HTTP/1.1 Server 146.185.214.128 Sydney, Australia, ASN202422 (GHOST, LU), Reverse DNS cooldog22581.example.com Software nginx / Resource Hash 77322b6d7dedc0088db9f75ad21b8cc867d8c76d774b2444a3e366abfb88a4a4 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Accept-Language jp-JP,jp;q=0.9 Referer http://paypal-payment-au.net/admin User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Sat, 11 Dec 2021 12:07:10 GMT Content-Encoding gzip Vary Accept-Encoding Last-Modified Wed, 08 Dec 2021 11:37:26 GMT Server nginx Strict-Transport-Security max-age=31536000 Content-Type text/css; charset=utf-8 Cache-Control max-age=43200 Transfer-Encoding chunked Connection keep-alive Expires Sun, 12 Dec 2021 00:07:10 GMT
GET H/1.1	200 OK	manifest.3ad1d5771e9b13dbdad2.js Show response paypal-payment-au.net/static/js/	800 B 1 KB	316ms 315ms	Script application/javascript	146.185.214.128 GHOST
General Check archive.org Show headers Download Go to Full URL http://paypal-payment-au.net/static/js/manifest.3ad1d5771e9b13dbdad2.js Requested by Host: paypal-payment-au.net URL: http://paypal-payment-au.net/admin Protocol HTTP/1.1 Server 146.185.214.128 Sydney, Australia, ASN202422 (GHOST, LU), Reverse DNS cooldog22581.example.com Software nginx / Resource Hash fcdf3becb34727e89ae7395ac70df92e4537639ae903784e201f479dd70f3ef0 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Accept-Language jp-JP,jp;q=0.9 Referer http://paypal-payment-au.net/admin User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Sat, 11 Dec 2021 12:07:10 GMT Last-Modified Wed, 08 Dec 2021 11:37:26 GMT Server nginx Strict-Transport-Security max-age=31536000 Content-Type application/javascript; charset=utf-8 Cache-Control max-age=43200 Connection keep-alive Content-Length 800 Expires Sun, 12 Dec 2021 00:07:10 GMT
GET H/1.1	200 OK	vendor.1a0506386d0eeafc9405.js Show response paypal-payment-au.net/static/js/	4 MB 899 KB	238ms 238ms	Script application/javascript	146.185.214.128 GHOST
General Check archive.org Show headers Download Go to Full URL http://paypal-payment-au.net/static/js/vendor.1a0506386d0eeafc9405.js Requested by Host: paypal-payment-au.net URL: http://paypal-payment-au.net/admin Protocol HTTP/1.1 Server 146.185.214.128 Sydney, Australia, ASN202422 (GHOST, LU), Reverse DNS cooldog22581.example.com Software nginx / Resource Hash 1471c0b82002e8eed175417e03444fa385c323d1784171e6d1a6dc6901c32228 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Accept-Language jp-JP,jp;q=0.9 Referer http://paypal-payment-au.net/admin User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Sat, 11 Dec 2021 12:07:10 GMT Content-Encoding gzip Vary Accept-Encoding Last-Modified Wed, 08 Dec 2021 11:37:26 GMT Server nginx Strict-Transport-Security max-age=31536000 Content-Type application/javascript; charset=utf-8 Cache-Control max-age=43200 Transfer-Encoding chunked Connection keep-alive Expires Sun, 12 Dec 2021 00:07:10 GMT
GET H/1.1	200 OK	app.617bbf151160a5b1e144.js Show response paypal-payment-au.net/static/js/	96 KB 37 KB	294ms 294ms	Script application/javascript	146.185.214.128 GHOST
General Check archive.org Show headers Download Go to Full URL http://paypal-payment-au.net/static/js/app.617bbf151160a5b1e144.js Requested by Host: paypal-payment-au.net URL: http://paypal-payment-au.net/admin Protocol HTTP/1.1 Server 146.185.214.128 Sydney, Australia, ASN202422 (GHOST, LU), Reverse DNS cooldog22581.example.com Software nginx / Resource Hash 3ebc007b9f6052ff95287c1c4c691e890a72a989b9c97d3cfd6466425c8e4bd9 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Accept-Language jp-JP,jp;q=0.9 Referer http://paypal-payment-au.net/admin User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Sat, 11 Dec 2021 12:07:10 GMT Content-Encoding gzip Vary Accept-Encoding Last-Modified Wed, 08 Dec 2021 11:37:26 GMT Server nginx Strict-Transport-Security max-age=31536000 Content-Type application/javascript; charset=utf-8 Cache-Control max-age=43200 Transfer-Encoding chunked Connection keep-alive Expires Sun, 12 Dec 2021 00:07:10 GMT
GET H2	200	cityjson Show response pv.sohu.com/	74 B 232 B	578ms 89ms	Script text/json	52.175.28.82 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://pv.sohu.com/cityjson?ie=utf-8 Requested by Host: paypal-payment-au.net URL: http://paypal-payment-au.net/admin Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.175.28.82 Central, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software nginx/1.0.15 / Resource Hash c5ec040111916bae063f6725e20952970e7954510c6b10107f85e87d0426a5f8 Request headers Accept-Language jp-JP,jp;q=0.9 Referer http://paypal-payment-au.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Sat, 11 Dec 2021 12:07:10 GMT fss-proxy Powered by 2826036.4267838.3552074, Powered by 4543537.5002299.7959608 server nginx/1.0.15 content-length 74 content-type text/json; charset=utf-8
GET H/1.1	200 OK	getiplang Show response paypal-payment-au.net/auth/	85 B 287 B	701ms 701ms	XHR application/json	146.185.214.128 GHOST
General Check archive.org Show headers Download Go to Full URL http://paypal-payment-au.net/auth/getiplang Requested by Host: paypal-payment-au.net URL: http://paypal-payment-au.net/static/js/vendor.1a0506386d0eeafc9405.js Protocol HTTP/1.1 Server 146.185.214.128 Sydney, Australia, ASN202422 (GHOST, LU), Reverse DNS cooldog22581.example.com Software nginx / Resource Hash 7b27416ef702ee38d8608cf59520b73320902b0ff656967754d73723d50b2255 Request headers Accept application/json, text/plain, */* Referer http://paypal-payment-au.net/ Accept-Language jp-JP,jp;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Sat, 11 Dec 2021 12:07:12 GMT Cache-Control no-cache Server nginx Connection keep-alive Content-Length 85 X-Cache MISS Content-Type application/json; charset=utf-8
GET H/1.1	200 OK	paypal-logo-129x32.svg paypal-payment-au.net/static/assets/img/	5 KB 5 KB	119ms 119ms	Image image/svg+xml	146.185.214.128 GHOST
General Check archive.org Show headers Download Go to Show image Full URL http://paypal-payment-au.net/static/assets/img/paypal-logo-129x32.svg Requested by Host: paypal-payment-au.net URL: http://paypal-payment-au.net/static/css/app.6775eed8164f72ee06dec1c5e84f73d2.css Protocol HTTP/1.1 Server 146.185.214.128 Sydney, Australia, ASN202422 (GHOST, LU), Reverse DNS cooldog22581.example.com Software nginx / Resource Hash b3cc50b9e94bbecaaeb1079b64b8ca50616d1732824964c1cc2c5422627a0ec5 Request headers Accept-Language jp-JP,jp;q=0.9 Referer http://paypal-payment-au.net/static/css/app.6775eed8164f72ee06dec1c5e84f73d2.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Sat, 11 Dec 2021 12:07:11 GMT Last-Modified Wed, 08 Dec 2021 11:37:26 GMT Server nginx X-Cache MISS Content-Type image/svg+xml Cache-Control max-age=0, no-cache Connection keep-alive Content-Length 4945

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler function| webpackJsonp function| setImmediate function| clearImmediate object| __core-js_shared__ object| returnCitySN

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

paypal-payment-au.net
pv.sohu.com
146.185.214.128
52.175.28.82
1471c0b82002e8eed175417e03444fa385c323d1784171e6d1a6dc6901c32228
3ebc007b9f6052ff95287c1c4c691e890a72a989b9c97d3cfd6466425c8e4bd9
77322b6d7dedc0088db9f75ad21b8cc867d8c76d774b2444a3e366abfb88a4a4
7b27416ef702ee38d8608cf59520b73320902b0ff656967754d73723d50b2255
b3cc50b9e94bbecaaeb1079b64b8ca50616d1732824964c1cc2c5422627a0ec5
c5ec040111916bae063f6725e20952970e7954510c6b10107f85e87d0426a5f8
fcdf3becb34727e89ae7395ac70df92e4537639ae903784e201f479dd70f3ef0
fce29e1fe6bf89c80ee27d17e1bd33bc2050ab5897bff235e3176e6f53d00661