micuenta-paypal.xpayee.com

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 7 HTTP transactions. The main IP is 18.140.236.214, located in Singapore, Singapore and belongs to AMAZON-02, US. The main domain is micuenta-paypal.xpayee.com.
TLS certificate: Issued by R3 on February 18th 2022. Valid for: 3 months.

This is the only time micuenta-paypal.xpayee.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: PayPal (Financial)

Domain & IP information

	IP Address		AS Autonomous System
1 8	18.140.236.214 18.140.236.214		16509 (AMAZON-02) (AMAZON-02)
7	1

8 18.140.236.214 (Singapore, Singapore) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-140-236-214.ap-southeast-1.compute.amazonaws.com

micuenta-paypal.xpayee.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	xpayee.com 1 redirects micuenta-paypal.xpayee.com	47 KB
7	1

	Domain	Requested by
8	micuenta-paypal.xpayee.com	1 redirects micuenta-paypal.xpayee.com
7	1

This site contains no links.

Subject Issuer	Validity	Valid
cpanel.myaccount.xdashboard.mobi R3	`2022-02-18` - `2022-05-19`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://micuenta-paypal.xpayee.com/sign
Frame ID: EB9F20B689AD24D9D0165324448C870E
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Melden Sie sich bei Ihrem PayPal-Konto an

Page URL History Show full URLs

https://micuenta-paypal.xpayee.com/?pepek HTTP 307
https://micuenta-paypal.xpayee.com/sign Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

7
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

47 kB
Transfer

136 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://micuenta-paypal.xpayee.com/?pepek HTTP 307
https://micuenta-paypal.xpayee.com/sign Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request sign Show response micuenta-paypal.xpayee.com/ Redirect Chain https://micuenta-paypal.xpayee.com/?pepek https://micuenta-paypal.xpayee.com/sign	7 KB 2 KB	171ms 170ms	Document text/html	18.140.236.214 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://micuenta-paypal.xpayee.com/sign Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 18.140.236.214 Singapore, Singapore, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-140-236-214.ap-southeast-1.compute.amazonaws.com Software Apache / Resource Hash `337d612bb588b7070558de217be1e81b4478443e073f4389e9a27ed16113ca1f` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers Date Sun, 27 Mar 2022 15:21:07 GMT Server Apache Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate Pragma no-cache Vary Accept-Encoding Content-Encoding gzip Content-Length 2164 Keep-Alive timeout=5, max=99 Connection Keep-Alive Content-Type text/html; charset=UTF-8 Redirect headers Date Sun, 27 Mar 2022 15:21:06 GMT Server Apache Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate Pragma no-cache Location https://micuenta-paypal.xpayee.com/sign Content-Length 0 Keep-Alive timeout=5, max=100 Connection Keep-Alive Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	kntl4.css micuenta-paypal.xpayee.com/_AREA16/assets/_base/css/	15 KB 3 KB	169ms 168ms	Stylesheet text/css	18.140.236.214 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://micuenta-paypal.xpayee.com/_AREA16/assets/_base/css/kntl4.css Requested by Host: micuenta-paypal.xpayee.com URL: https://micuenta-paypal.xpayee.com/sign Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 18.140.236.214 Singapore, Singapore, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-140-236-214.ap-southeast-1.compute.amazonaws.com Software Apache / Resource Hash `b636663415405a61497732fdbc9a5416eaa187355ebb2de9ba24ec41f1b67aa7` Request headers Accept-Language de-DE,de;q=0.9 Referer https://micuenta-paypal.xpayee.com/sign User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers Date Sun, 27 Mar 2022 15:21:07 GMT Content-Encoding gzip Last-Modified Sun, 14 Nov 2021 05:02:08 GMT Server Apache Vary Accept-Encoding Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 3082
GET H/1.1	200 OK	jquery-3.3.1.min.js Show response micuenta-paypal.xpayee.com/_AREA16/assets/_base/js/	105 KB 36 KB	344ms 174ms	Script application/javascript	18.140.236.214 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://micuenta-paypal.xpayee.com/_AREA16/assets/_base/js/jquery-3.3.1.min.js Requested by Host: micuenta-paypal.xpayee.com URL: https://micuenta-paypal.xpayee.com/sign Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 18.140.236.214 Singapore, Singapore, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-140-236-214.ap-southeast-1.compute.amazonaws.com Software Apache / Resource Hash `97ecd42dea3bc998c5efd456bc13e2c45c700fba1c581961ca1481676bf08b42` Request headers Accept-Language de-DE,de;q=0.9 Referer https://micuenta-paypal.xpayee.com/sign User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers Date Sun, 27 Mar 2022 15:21:07 GMT Content-Encoding gzip Last-Modified Sun, 14 Nov 2021 05:02:08 GMT Server Apache Vary Accept-Encoding Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 36533
GET H/1.1	200 OK	kntl-bau.js Show response micuenta-paypal.xpayee.com/_AREA16/assets/_base/js/	4 KB 2 KB	670ms 168ms	Script application/javascript	18.140.236.214 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://micuenta-paypal.xpayee.com/_AREA16/assets/_base/js/kntl-bau.js Requested by Host: micuenta-paypal.xpayee.com URL: https://micuenta-paypal.xpayee.com/sign Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 18.140.236.214 Singapore, Singapore, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-140-236-214.ap-southeast-1.compute.amazonaws.com Software Apache / Resource Hash `a6c3bff965978df8093c3a29f7071c21d7439a212af41e7b40ce70d94d6bcc44` Request headers Accept-Language de-DE,de;q=0.9 Referer https://micuenta-paypal.xpayee.com/sign User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers Date Sun, 27 Mar 2022 15:21:07 GMT Content-Encoding gzip Last-Modified Sun, 14 Nov 2021 05:02:10 GMT Server Apache Vary Accept-Encoding Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 1788
GET H/1.1	200 OK	logo_official.svg micuenta-paypal.xpayee.com/_AREA16/assets/_base/img/	5 KB 2 KB	500ms 168ms	Image image/svg+xml	18.140.236.214 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://micuenta-paypal.xpayee.com/_AREA16/assets/_base/img/logo_official.svg Requested by Host: micuenta-paypal.xpayee.com URL: https://micuenta-paypal.xpayee.com/_AREA16/assets/_base/css/kntl4.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 18.140.236.214 Singapore, Singapore, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-140-236-214.ap-southeast-1.compute.amazonaws.com Software Apache / Resource Hash `b3cc50b9e94bbecaaeb1079b64b8ca50616d1732824964c1cc2c5422627a0ec5` Request headers Accept-Language de-DE,de;q=0.9 Referer https://micuenta-paypal.xpayee.com/_AREA16/assets/_base/css/kntl4.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers Date Sun, 27 Mar 2022 15:21:07 GMT Content-Encoding gzip Last-Modified Sun, 14 Nov 2021 05:02:08 GMT Server Apache Vary Accept-Encoding Content-Type image/svg+xml Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 1929
GET H/1.1	200 OK	p_small_regular.woff micuenta-paypal.xpayee.com/_AREA16/assets/_base/fonts/	328 B 506 B	327ms 169ms	Font text/html	18.140.236.214 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://micuenta-paypal.xpayee.com/_AREA16/assets/_base/fonts/p_small_regular.woff Requested by Host: micuenta-paypal.xpayee.com URL: https://micuenta-paypal.xpayee.com/_AREA16/assets/_base/css/kntl4.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 18.140.236.214 Singapore, Singapore, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-140-236-214.ap-southeast-1.compute.amazonaws.com Software Apache / Resource Hash `a4eb95ec54b014d3e836433b396b765c07bbcb5bc6b3b038acfcedb159eae096` Request headers Referer https://micuenta-paypal.xpayee.com/_AREA16/assets/_base/css/kntl4.css Origin https://micuenta-paypal.xpayee.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers Pragma no-cache Date Sun, 27 Mar 2022 15:21:07 GMT Content-Encoding gzip Server Apache Vary Accept-Encoding Content-Type text/html; charset=UTF-8 Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Keep-Alive timeout=5, max=100 Content-Length 160 Expires Thu, 19 Nov 1981 08:52:00 GMT
GET H/1.1	200 OK	p_small_light.woff micuenta-paypal.xpayee.com/_AREA16/assets/_base/fonts/	328 B 506 B	324ms 170ms	Font text/html	18.140.236.214 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://micuenta-paypal.xpayee.com/_AREA16/assets/_base/fonts/p_small_light.woff Requested by Host: micuenta-paypal.xpayee.com URL: https://micuenta-paypal.xpayee.com/_AREA16/assets/_base/css/kntl4.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 18.140.236.214 Singapore, Singapore, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-140-236-214.ap-southeast-1.compute.amazonaws.com Software Apache / Resource Hash `a4eb95ec54b014d3e836433b396b765c07bbcb5bc6b3b038acfcedb159eae096` Request headers Referer https://micuenta-paypal.xpayee.com/_AREA16/assets/_base/css/kntl4.css Origin https://micuenta-paypal.xpayee.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers Pragma no-cache Date Sun, 27 Mar 2022 15:21:07 GMT Content-Encoding gzip Server Apache Vary Accept-Encoding Content-Type text/html; charset=UTF-8 Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Keep-Alive timeout=5, max=100 Content-Length 160 Expires Thu, 19 Nov 1981 08:52:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial)

17 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			micuenta-paypal.xpayee.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 02b6859ec524cbe3097a53279a13edeb

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://micuenta-paypal.xpayee.com/sign Message: Failed to decode downloaded font: https://micuenta-paypal.xpayee.com/_AREA16/assets/_base/fonts/p_small_regular.woff
other	warning	URL: https://micuenta-paypal.xpayee.com/sign Message: OTS parsing error: invalid sfntVersion: 218774561
other	warning	URL: https://micuenta-paypal.xpayee.com/sign Message: Failed to decode downloaded font: https://micuenta-paypal.xpayee.com/_AREA16/assets/_base/fonts/p_small_light.woff
other	warning	URL: https://micuenta-paypal.xpayee.com/sign Message: OTS parsing error: invalid sfntVersion: 218774561

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

micuenta-paypal.xpayee.com
18.140.236.214
337d612bb588b7070558de217be1e81b4478443e073f4389e9a27ed16113ca1f
97ecd42dea3bc998c5efd456bc13e2c45c700fba1c581961ca1481676bf08b42
a4eb95ec54b014d3e836433b396b765c07bbcb5bc6b3b038acfcedb159eae096
a6c3bff965978df8093c3a29f7071c21d7439a212af41e7b40ce70d94d6bcc44
b3cc50b9e94bbecaaeb1079b64b8ca50616d1732824964c1cc2c5422627a0ec5
b636663415405a61497732fdbc9a5416eaa187355ebb2de9ba24ec41f1b67aa7

micuenta-paypal.xpayee.com Open in urlscan Pro 18.140.236.214 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

7 Requests

0 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

47 kBTransfer

136 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

17 JavaScript Global Variables

1 Cookies

4 Console Messages

Indicators

micuenta-paypal.xpayee.com Open in urlscan Pro
18.140.236.214 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

47 kB
Transfer

136 kB
Size

1
Cookies

7 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!