temporary.suspecius.account.login.luxus.id Open in urlscan Pro
202.154.22.144 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://temporary.suspecius.account.login.luxus.id/myaccount/
Submission: On April 27 via automatic, source openphish (April 27th 2018, 8:27:46 pm UTC)

Summary HTTP 17 Redirects Links 2 Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 17 HTTP transactions. The main IP is 202.154.22.144, located in Jakarta, Indonesia and belongs to ERX-RADNET1-AS PT Rahajasa Media Internet, ID. The main domain is temporary.suspecius.account.login.luxus.id.
TLS certificate: Issued by cPanel, Inc. Certification Authority on April 27th 2018. Valid for: 3 months.

This is the only time temporary.suspecius.account.login.luxus.id was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: PayPal (Financial)

Domain & IP information

	IP Address		AS Autonomous System
13	202.154.22.144 202.154.22.144		4434 (ERX-RADNE...) (ERX-RADNET1-AS PT Rahajasa Media Internet)
3	2.18.233.20 2.18.233.20		16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
1	2.21.161.21 2.21.161.21		16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
17	3

13 202.154.22.144 (Jakarta, Indonesia)

ASN4434 (ERX-RADNET1-AS PT Rahajasa Media Internet, ID)
PTR: ip-22-144.indocenter.co.id

temporary.suspecius.account.login.luxus.id	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2.18.233.20 (European Union)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)

www.paypalobjects.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.21.161.21 (European Union)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)

t.paypal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
13	luxus.id temporary.suspecius.account.login.luxus.id	742 KB
3	paypalobjects.com www.paypalobjects.com	109 KB
1	paypal.com t.paypal.com	728 B
17	3

	Domain	Requested by
13	temporary.suspecius.account.login.luxus.id	temporary.suspecius.account.login.luxus.id
3	www.paypalobjects.com	temporary.suspecius.account.login.luxus.id
1	t.paypal.com
17	3

This site contains links to these domains. Also see Links.

Domain
www.paypal.com

Subject Issuer	Validity	Valid
temporary.suspecius.account.login.luxus.id cPanel, Inc. Certification Authority	`2018-04-27` - `2018-07-26`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://temporary.suspecius.account.login.luxus.id/myaccount/
Frame ID: 40294F9E21B8C44F8EDDFD1A9664E449
Requests: 17 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

UNIX (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Unix/i

OpenSSL (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

PayPal (Payment Processors) Expand

Overall confidence: 100%
Detected patterns

env /^PAYPAL$/i

RequireJS (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

script /require.*\.js/i
env /^requirejs$/i

SiteCatalyst (Analytics) Expand

Overall confidence: 100%
Detected patterns

env /^s_(?:account|objectID|code|INST)$/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

env /^jQuery$/i

Page Statistics

17
Requests

76 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

851 kB
Transfer

1120 kB
Size

1
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://www.paypal.com/gb/webapps/mpp/ua/privacy-full
Title: Log out

Search URL Search Domain Scan URL

URL: https://www.paypal.com/gb/webapps/mpp/ua/legalhub-full
Title: Legal

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
temporary.suspecius.account.login.luxus.id/myaccount/ 10 KB
10 KB 1850ms
1212ms Document
text/html 202.154.22.144
ERX-RADNET1-AS PT...

General

Check archive.org

Show headers Download Go to

Full URL: https://temporary.suspecius.account.login.luxus.id/myaccount/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 202.154.22.144 Jakarta, Indonesia, ASN4434 (ERX-RADNET1-AS PT Rahajasa Media Internet, ID),
Reverse DNS: ip-22-144.indocenter.co.id
Software: Apache/2.4.12 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4 / PHP/5.4.38
Resource Hash: b63860c8bf64aaeb9eedfe97f3f40e02e404b3ccc7d263c23bc3a6bfa014b1f9

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: temporary.suspecius.account.login.luxus.id
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Cache-Control: no-cache
Connection: keep-alive
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Fri, 27 Apr 2018 20:27:32 GMT
Server: Apache/2.4.12 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Connection: Keep-Alive
X-Powered-By: PHP/5.4.38
Transfer-Encoding: chunked
Keep-Alive: timeout=5, max=100
Content-Type: text/html

GET
H/1.1 200
OK app.css
temporary.suspecius.account.login.luxus.id/Suspicious_files/ 172 KB
172 KB 615ms
211ms Stylesheet
text/css 202.154.22.144
ERX-RADNET1-AS PT...

General

Check archive.org

Show headers Download Go to

Full URL: https://temporary.suspecius.account.login.luxus.id/Suspicious_files/app.css
Requested by: Host: temporary.suspecius.account.login.luxus.id
URL: https://temporary.suspecius.account.login.luxus.id/myaccount/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 202.154.22.144 Jakarta, Indonesia, ASN4434 (ERX-RADNET1-AS PT Rahajasa Media Internet, ID),
Reverse DNS: ip-22-144.indocenter.co.id
Software: Apache/2.4.12 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4 /
Resource Hash: 417c9a56495a1a8c7022f358df0f3c265f6d5e7eb2a3452a5f52cb5b7983bf4c

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: temporary.suspecius.account.login.luxus.id
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: https://temporary.suspecius.account.login.luxus.id/myaccount/
Connection: keep-alive
Cache-Control: no-cache
Referer: https://temporary.suspecius.account.login.luxus.id/myaccount/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Fri, 27 Apr 2018 20:27:33 GMT
Last-Modified: Wed, 21 Sep 2016 07:06:52 GMT
Server: Apache/2.4.12 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
ETag: "2ae2f-53cff30867b00"
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 175663

GET
H/1.1 200
OK app.js Show response
temporary.suspecius.account.login.luxus.id/Suspicious_files/ 382 KB
382 KB 619ms
211ms Script
application/javascript 202.154.22.144
ERX-RADNET1-AS PT...

General

Check archive.org

Show headers Download Go to

Full URL: https://temporary.suspecius.account.login.luxus.id/Suspicious_files/app.js
Requested by: Host: temporary.suspecius.account.login.luxus.id
URL: https://temporary.suspecius.account.login.luxus.id/myaccount/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 202.154.22.144 Jakarta, Indonesia, ASN4434 (ERX-RADNET1-AS PT Rahajasa Media Internet, ID),
Reverse DNS: ip-22-144.indocenter.co.id
Software: Apache/2.4.12 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4 /
Resource Hash: 0a8c7553b10d35e2a00d78f83fe564c11d92deca635cda10580766b51ac47fd9

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: temporary.suspecius.account.login.luxus.id
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept: */*
Referer: https://temporary.suspecius.account.login.luxus.id/myaccount/
Connection: keep-alive
Cache-Control: no-cache
Referer: https://temporary.suspecius.account.login.luxus.id/myaccount/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Fri, 27 Apr 2018 20:27:33 GMT
Last-Modified: Sat, 24 Oct 2015 13:29:28 GMT
Server: Apache/2.4.12 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
ETag: "5f71b-522d9b7a75e00"
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 390939

GET
H/1.1 200
OK config.js Show response
temporary.suspecius.account.login.luxus.id/Suspicious_files/ 600 B
934 B 209ms
204ms Script
application/javascript 202.154.22.144
ERX-RADNET1-AS PT...

General

Check archive.org

Show headers Download Go to

Full URL: https://temporary.suspecius.account.login.luxus.id/Suspicious_files/config.js
Requested by: Host: temporary.suspecius.account.login.luxus.id
URL: https://temporary.suspecius.account.login.luxus.id/myaccount/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 202.154.22.144 Jakarta, Indonesia, ASN4434 (ERX-RADNET1-AS PT Rahajasa Media Internet, ID),
Reverse DNS: ip-22-144.indocenter.co.id
Software: Apache/2.4.12 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4 /
Resource Hash: 05b3965cbe7889bbba309939196020bc0d3d935a5d185d82f7df429f389f9696

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: temporary.suspecius.account.login.luxus.id
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept: */*
Referer: https://temporary.suspecius.account.login.luxus.id/myaccount/
Connection: keep-alive
Cache-Control: no-cache
Referer: https://temporary.suspecius.account.login.luxus.id/myaccount/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Fri, 27 Apr 2018 20:27:35 GMT
Last-Modified: Sat, 24 Oct 2015 13:29:28 GMT
Server: Apache/2.4.12 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
ETag: "258-522d9b7a75e00"
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 600

GET
H/1.1 200
OK activity.js Show response
temporary.suspecius.account.login.luxus.id/Suspicious_files/ 1 B
330 B 615ms
204ms Script
application/javascript 202.154.22.144
ERX-RADNET1-AS PT...

General

Check archive.org

Show headers Download Go to

Full URL: https://temporary.suspecius.account.login.luxus.id/Suspicious_files/activity.js
Requested by: Host: temporary.suspecius.account.login.luxus.id
URL: https://temporary.suspecius.account.login.luxus.id/myaccount/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 202.154.22.144 Jakarta, Indonesia, ASN4434 (ERX-RADNET1-AS PT Rahajasa Media Internet, ID),
Reverse DNS: ip-22-144.indocenter.co.id
Software: Apache/2.4.12 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4 /
Resource Hash: 41b805ea7ac014e23556e98bb374702a08344268f92489a02f0880849394a1e4

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: temporary.suspecius.account.login.luxus.id
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept: */*
Referer: https://temporary.suspecius.account.login.luxus.id/myaccount/
Connection: keep-alive
Cache-Control: no-cache
Referer: https://temporary.suspecius.account.login.luxus.id/myaccount/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Fri, 27 Apr 2018 20:27:35 GMT
Last-Modified: Sat, 24 Oct 2015 13:29:28 GMT
Server: Apache/2.4.12 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
ETag: "1-522d9b7a75e00"
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 1

GET
H/1.1 200
OK translateelement.css
temporary.suspecius.account.login.luxus.id/Suspicious_files/ 17 KB
18 KB 619ms
213ms Stylesheet
text/css 202.154.22.144
ERX-RADNET1-AS PT...

General

Check archive.org

Show headers Download Go to

Full URL: https://temporary.suspecius.account.login.luxus.id/Suspicious_files/translateelement.css
Requested by: Host: temporary.suspecius.account.login.luxus.id
URL: https://temporary.suspecius.account.login.luxus.id/myaccount/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 202.154.22.144 Jakarta, Indonesia, ASN4434 (ERX-RADNET1-AS PT Rahajasa Media Internet, ID),
Reverse DNS: ip-22-144.indocenter.co.id
Software: Apache/2.4.12 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4 /
Resource Hash: 89b95375e63b25663cc6e1c7304acc78439a961f9be4d3b7810fe50d57eb3f76

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: temporary.suspecius.account.login.luxus.id
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: https://temporary.suspecius.account.login.luxus.id/myaccount/
Connection: keep-alive
Cache-Control: no-cache
Referer: https://temporary.suspecius.account.login.luxus.id/myaccount/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Fri, 27 Apr 2018 20:27:33 GMT
Last-Modified: Sat, 24 Oct 2015 13:29:28 GMT
Server: Apache/2.4.12 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
ETag: "4558-522d9b7a75e00"
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 17752

GET
H/1.1 200
OK logo_paypal_106x29.png
temporary.suspecius.account.login.luxus.id/Suspicious_files/ 5 KB
5 KB 377ms
204ms Image
image/png 202.154.22.144
ERX-RADNET1-AS PT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://temporary.suspecius.account.login.luxus.id/Suspicious_files/logo_paypal_106x29.png
Requested by: Host: temporary.suspecius.account.login.luxus.id
URL: https://temporary.suspecius.account.login.luxus.id/myaccount/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 202.154.22.144 Jakarta, Indonesia, ASN4434 (ERX-RADNET1-AS PT Rahajasa Media Internet, ID),
Reverse DNS: ip-22-144.indocenter.co.id
Software: Apache/2.4.12 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4 /
Resource Hash: ab39e6288837a25d62b740906db369081f38978b23570148c28ed41f509d4fe2

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: temporary.suspecius.account.login.luxus.id
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: https://temporary.suspecius.account.login.luxus.id/myaccount/
Connection: keep-alive
Cache-Control: no-cache
Referer: https://temporary.suspecius.account.login.luxus.id/myaccount/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Fri, 27 Apr 2018 20:27:35 GMT
Last-Modified: Sat, 24 Oct 2015 13:29:28 GMT
Server: Apache/2.4.12 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
ETag: "125b-522d9b7a75e00"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 4699

GET
H/1.1 200
OK peek-shield-logo.png
temporary.suspecius.account.login.luxus.id/Suspicious_files/ 4 KB
5 KB 383ms
207ms Image
image/png 202.154.22.144
ERX-RADNET1-AS PT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://temporary.suspecius.account.login.luxus.id/Suspicious_files/peek-shield-logo.png
Requested by: Host: temporary.suspecius.account.login.luxus.id
URL: https://temporary.suspecius.account.login.luxus.id/myaccount/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 202.154.22.144 Jakarta, Indonesia, ASN4434 (ERX-RADNET1-AS PT Rahajasa Media Internet, ID),
Reverse DNS: ip-22-144.indocenter.co.id
Software: Apache/2.4.12 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4 /
Resource Hash: 6c24e9fc3844d713e81e8182d435b1ec16df0b291e559742c5842f995b2e0498

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: temporary.suspecius.account.login.luxus.id
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: https://temporary.suspecius.account.login.luxus.id/myaccount/
Connection: keep-alive
Cache-Control: no-cache
Referer: https://temporary.suspecius.account.login.luxus.id/myaccount/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Fri, 27 Apr 2018 20:27:35 GMT
Last-Modified: Sat, 24 Oct 2015 13:29:28 GMT
Server: Apache/2.4.12 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
ETag: "1158-522d9b7a75e00"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 4440

GET
H/1.1 200
OK require-spinner.js Show response
temporary.suspecius.account.login.luxus.id/Suspicious_files/ 6 KB
6 KB 214ms
209ms Script
application/javascript 202.154.22.144
ERX-RADNET1-AS PT...

General

Check archive.org

Show headers Download Go to

Full URL: https://temporary.suspecius.account.login.luxus.id/Suspicious_files/require-spinner.js
Requested by: Host: temporary.suspecius.account.login.luxus.id
URL: https://temporary.suspecius.account.login.luxus.id/myaccount/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 202.154.22.144 Jakarta, Indonesia, ASN4434 (ERX-RADNET1-AS PT Rahajasa Media Internet, ID),
Reverse DNS: ip-22-144.indocenter.co.id
Software: Apache/2.4.12 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4 /
Resource Hash: 9c0821da2aee265221ce1c392604dd4b0901e2f671b87c6c7d141e8f698d4ca7

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: temporary.suspecius.account.login.luxus.id
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept: */*
Referer: https://temporary.suspecius.account.login.luxus.id/myaccount/
Connection: keep-alive
Cache-Control: no-cache
Referer: https://temporary.suspecius.account.login.luxus.id/myaccount/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Fri, 27 Apr 2018 20:27:33 GMT
Last-Modified: Sat, 24 Oct 2015 13:29:28 GMT
Server: Apache/2.4.12 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
ETag: "16d4-522d9b7a75e00"
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 5844

GET
H/1.1 200
OK require.js Show response
temporary.suspecius.account.login.luxus.id/Suspicious_files/ 15 KB
15 KB 206ms
204ms Script
application/javascript 202.154.22.144
ERX-RADNET1-AS PT...

General

Check archive.org

Show headers Download Go to

Full URL: https://temporary.suspecius.account.login.luxus.id/Suspicious_files/require.js
Requested by: Host: temporary.suspecius.account.login.luxus.id
URL: https://temporary.suspecius.account.login.luxus.id/myaccount/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 202.154.22.144 Jakarta, Indonesia, ASN4434 (ERX-RADNET1-AS PT Rahajasa Media Internet, ID),
Reverse DNS: ip-22-144.indocenter.co.id
Software: Apache/2.4.12 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4 /
Resource Hash: c007d73792ac2d25882bfbb573e700e721a0adacfab947e6a0b64a61991fecf0

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: temporary.suspecius.account.login.luxus.id
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept: */*
Referer: https://temporary.suspecius.account.login.luxus.id/myaccount/
Connection: keep-alive
Cache-Control: no-cache
Referer: https://temporary.suspecius.account.login.luxus.id/myaccount/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Fri, 27 Apr 2018 20:27:35 GMT
Last-Modified: Sat, 24 Oct 2015 13:29:28 GMT
Server: Apache/2.4.12 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
ETag: "3a06-522d9b7a75e00"
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 14854

GET
H/1.1 200
OK pp_jscode_080706.js Show response
temporary.suspecius.account.login.luxus.id/Suspicious_files/ 60 KB
61 KB 215ms
214ms Script
application/javascript 202.154.22.144
ERX-RADNET1-AS PT...

General

Check archive.org

Show headers Download Go to

Full URL: https://temporary.suspecius.account.login.luxus.id/Suspicious_files/pp_jscode_080706.js
Requested by: Host: temporary.suspecius.account.login.luxus.id
URL: https://temporary.suspecius.account.login.luxus.id/myaccount/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 202.154.22.144 Jakarta, Indonesia, ASN4434 (ERX-RADNET1-AS PT Rahajasa Media Internet, ID),
Reverse DNS: ip-22-144.indocenter.co.id
Software: Apache/2.4.12 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4 /
Resource Hash: 9bbf1ce51d9751054757ff383e410a379a4b1ee26527334f4add83fbfba1d36c

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: temporary.suspecius.account.login.luxus.id
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept: */*
Referer: https://temporary.suspecius.account.login.luxus.id/myaccount/
Connection: keep-alive
Cache-Control: no-cache
Referer: https://temporary.suspecius.account.login.luxus.id/myaccount/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Fri, 27 Apr 2018 20:27:35 GMT
Last-Modified: Sat, 24 Oct 2015 13:29:28 GMT
Server: Apache/2.4.12 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
ETag: "f1bb-522d9b7a75e00"
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 61883

GET
H/1.1 200
OK pa.js Show response
temporary.suspecius.account.login.luxus.id/Suspicious_files/ 66 KB
67 KB 213ms
212ms Script
application/javascript 202.154.22.144
ERX-RADNET1-AS PT...

General

Check archive.org

Show headers Download Go to

Full URL: https://temporary.suspecius.account.login.luxus.id/Suspicious_files/pa.js
Requested by: Host: temporary.suspecius.account.login.luxus.id
URL: https://temporary.suspecius.account.login.luxus.id/myaccount/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 202.154.22.144 Jakarta, Indonesia, ASN4434 (ERX-RADNET1-AS PT Rahajasa Media Internet, ID),
Reverse DNS: ip-22-144.indocenter.co.id
Software: Apache/2.4.12 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4 /
Resource Hash: 98ecaad59fce14516bd1c79d6361e1f798a6cf3d077b68b5807adc153c5fb389

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: temporary.suspecius.account.login.luxus.id
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept: */*
Referer: https://temporary.suspecius.account.login.luxus.id/myaccount/
Connection: keep-alive
Cache-Control: no-cache
Referer: https://temporary.suspecius.account.login.luxus.id/myaccount/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Fri, 27 Apr 2018 20:27:35 GMT
Last-Modified: Sat, 24 Oct 2015 13:29:28 GMT
Server: Apache/2.4.12 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
ETag: "1093e-522d9b7a75e00"
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 67902

GET
H/1.1 200
OK translate_24dp.png
temporary.suspecius.account.login.luxus.id/Suspicious_files/ 825 B
1 KB 218ms
212ms Image
image/png 202.154.22.144
ERX-RADNET1-AS PT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://temporary.suspecius.account.login.luxus.id/Suspicious_files/translate_24dp.png
Requested by: Host: temporary.suspecius.account.login.luxus.id
URL: https://temporary.suspecius.account.login.luxus.id/myaccount/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 202.154.22.144 Jakarta, Indonesia, ASN4434 (ERX-RADNET1-AS PT Rahajasa Media Internet, ID),
Reverse DNS: ip-22-144.indocenter.co.id
Software: Apache/2.4.12 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4 /
Resource Hash: 1bb2279aed6bc1438d2b17a5ffcbac9d37864582aedeeec8d301eab162b2c213

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: temporary.suspecius.account.login.luxus.id
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: https://temporary.suspecius.account.login.luxus.id/myaccount/
Connection: keep-alive
Cache-Control: no-cache
Referer: https://temporary.suspecius.account.login.luxus.id/myaccount/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Fri, 27 Apr 2018 20:27:35 GMT
Last-Modified: Sat, 24 Oct 2015 13:29:28 GMT
Server: Apache/2.4.12 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
ETag: "339-522d9b7a75e00"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 825

GET
S 200 app.js Show response
www.paypalobjects.com/web/res/7a7/dd87ef7a2afbb69dece5be488ad19/js/ 382 KB
108 KB 33ms
14ms Script
application/x-javascript 2.18.233.20
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/web/res/7a7/dd87ef7a2afbb69dece5be488ad19/js/app.js

Requested by

Host: temporary.suspecius.account.login.luxus.id
URL: https://temporary.suspecius.account.login.luxus.id/Suspicious_files/require.js

Protocol

SPDY

Server

2.18.233.20 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

Software

Apache /

Resource Hash

0a8c7553b10d35e2a00d78f83fe564c11d92deca635cda10580766b51ac47fd9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://temporary.suspecius.account.login.luxus.id/myaccount/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Fri, 27 Apr 2018 20:27:35 GMT
x-pad: avoid browser bug
x-content-type-options: nosniff
last-modified: Thu, 08 Oct 2015 09:16:07 GMT
server: Apache
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=7776000
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-encoding: gzip
expires: Thu, 26 Jul 2018 20:27:35 GMT

GET
S 200 config.js Show response
www.paypalobjects.com/web/res/7a7/dd87ef7a2afbb69dece5be488ad19/js/ 600 B
813 B 24ms
6ms Script
application/x-javascript 2.18.233.20
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/web/res/7a7/dd87ef7a2afbb69dece5be488ad19/js/config.js

Requested by

Host: temporary.suspecius.account.login.luxus.id
URL: https://temporary.suspecius.account.login.luxus.id/Suspicious_files/require.js

Protocol

SPDY

Server

2.18.233.20 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

Software

Apache /

Resource Hash

05b3965cbe7889bbba309939196020bc0d3d935a5d185d82f7df429f389f9696

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://temporary.suspecius.account.login.luxus.id/myaccount/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Fri, 27 Apr 2018 20:27:35 GMT
x-content-type-options: nosniff
last-modified: Thu, 08 Oct 2015 09:16:07 GMT
server: Apache
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=7776000
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 600
expires: Thu, 26 Jul 2018 20:27:35 GMT

GET
S 200 activity.js Show response
www.paypalobjects.com/web/res/7a7/dd87ef7a2afbb69dece5be488ad19/js/view/s12n/ato/ 1 B
213 B 7ms
6ms Script
application/x-javascript 2.18.233.20
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/web/res/7a7/dd87ef7a2afbb69dece5be488ad19/js/view/s12n/ato/activity.js

Requested by

Host: temporary.suspecius.account.login.luxus.id
URL: https://temporary.suspecius.account.login.luxus.id/Suspicious_files/require.js

Protocol

SPDY

Server

2.18.233.20 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

Software

Apache /

Resource Hash

41b805ea7ac014e23556e98bb374702a08344268f92489a02f0880849394a1e4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://temporary.suspecius.account.login.luxus.id/myaccount/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Fri, 27 Apr 2018 20:27:35 GMT
x-content-type-options: nosniff
last-modified: Thu, 08 Oct 2015 09:16:09 GMT
server: Apache
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=7776000
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 1
expires: Thu, 26 Jul 2018 20:27:35 GMT

GET
H/1.1 200
OK ts
t.paypal.com/ 42 B
728 B 202ms
180ms Image
image/gif 2.21.161.21
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://t.paypal.com/ts?v=0.1&t=1524860856377&g=0&e=im&pgrp=main%3Asafe%3Arestriction%3Agrey-user%3A%3Aactivity&page=main%3Asafe%3Arestriction%3Agrey-user%3A%3Aactivity&tmpl=main%3Asafe%3Arestriction%3Agrey-user%3A%3Aactivity&pgst=1445743757471&calc=e27a076b6ee79&rsta=ja_JP&pgtf=Nodejs&s=ci&csci=421f92fc012d42779ac376914d59cfa2&comp=secureflownodeweb&tsrce=secureflownodeweb&pt=Secure%20Account%20-%20PayPal&cd=24&sw=1600&sh=1200&bw=1600&bh=1200&ce=1&t1=638&t1c=638&t1d=0&t1s=427&t2=1212&t3=409&t4d=2482&t4=2487&t4e=5&tt=4338
Protocol: HTTP/1.1
Server: 2.21.161.21 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
Software: akka-http/10.0.9-PayPal-2 /
Resource Hash: 6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93

Request headers

Referer: https://temporary.suspecius.account.login.luxus.id/myaccount/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 27 Apr 2018 20:27:36 GMT
Server: akka-http/10.0.9-PayPal-2
P3P: policyref="https://t.paypal.com/w3c/p3p.xml",CP="CAO IND OUR SAM UNI STA COR COM"
HTTP_X_PP_AZ_LOCATOR: slcb.slc
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 42
Expires: Fri, 27 Apr 2018 20:27:36 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial)

32 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| RequireSpinners function| Spinner function| requirejs function| require function| define function| $ function| jQuery object| dust object| jQuery111009285747256146304 object| jQuery11100003177672080201255 string| sc_code_ver string| s_account object| s function| s_doPlugins string| s_code undefined| s_objectID function| s_gi function| s_giqf string| s_an function| s_sp function| s_jn function| s_rep function| s_d function| s_fe function| s_fa function| s_ft object| s_c_il number| s_c_in number| s_giq object| PAYPAL object| fpti string| fptiserverurl

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.luxus.id/	1969-12-31 23:59:59	Name: s_sess Value: %20s_ppv%3D100%3B

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://temporary.suspecius.account.login.luxus.id/myaccount/(Line 47) Message: view/s12n/ato/activity loaded.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

t.paypal.com
temporary.suspecius.account.login.luxus.id
www.paypalobjects.com
2.18.233.20
2.21.161.21
202.154.22.144
05b3965cbe7889bbba309939196020bc0d3d935a5d185d82f7df429f389f9696
0a8c7553b10d35e2a00d78f83fe564c11d92deca635cda10580766b51ac47fd9
1bb2279aed6bc1438d2b17a5ffcbac9d37864582aedeeec8d301eab162b2c213
417c9a56495a1a8c7022f358df0f3c265f6d5e7eb2a3452a5f52cb5b7983bf4c
41b805ea7ac014e23556e98bb374702a08344268f92489a02f0880849394a1e4
6c24e9fc3844d713e81e8182d435b1ec16df0b291e559742c5842f995b2e0498
6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93
89b95375e63b25663cc6e1c7304acc78439a961f9be4d3b7810fe50d57eb3f76
98ecaad59fce14516bd1c79d6361e1f798a6cf3d077b68b5807adc153c5fb389
9bbf1ce51d9751054757ff383e410a379a4b1ee26527334f4add83fbfba1d36c
9c0821da2aee265221ce1c392604dd4b0901e2f671b87c6c7d141e8f698d4ca7
ab39e6288837a25d62b740906db369081f38978b23570148c28ed41f509d4fe2
b63860c8bf64aaeb9eedfe97f3f40e02e404b3ccc7d263c23bc3a6bfa014b1f9
c007d73792ac2d25882bfbb573e700e721a0adacfab947e6a0b64a61991fecf0