residencecasanova.it
Open in
urlscan Pro
178.63.61.164
Malicious Activity!
Public Scan
Submission Tags: phishing malicious Search All
Submission: On August 18 via api from US
Summary
This is the only time residencecasanova.it was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: PayPal (Financial)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 178.63.61.164 178.63.61.164 | 24940 (HETZNER-AS) (HETZNER-AS) | |
14 | 147.185.115.71 147.185.115.71 | 395111 (KVCNET-2009) (KVCNET-2009) | |
6 | 104.111.228.123 104.111.228.123 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
3 4 | 151.101.129.21 151.101.129.21 | 54113 (FASTLY) (FASTLY) | |
23 | 5 |
ASN395111 (KVCNET-2009, US)
PTR: liberty.satu.rumahweb.com
gps-ip.xyz |
ASN16625 (AKAMAI-AS, US)
PTR: a104-111-228-123.deploy.static.akamaitechnologies.com
www.paypalobjects.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
14 |
gps-ip.xyz
gps-ip.xyz |
136 KB |
6 |
paypalobjects.com
www.paypalobjects.com |
161 KB |
4 |
paypal.com
3 redirects
www.paypal.com |
6 KB |
1 |
residencecasanova.it
residencecasanova.it |
2 KB |
23 | 4 |
Domain | Requested by | |
---|---|---|
14 | gps-ip.xyz |
residencecasanova.it
|
6 | www.paypalobjects.com |
residencecasanova.it
www.paypalobjects.com |
4 | www.paypal.com |
3 redirects
residencecasanova.it
|
1 | residencecasanova.it | |
23 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.gps-ip.xyz R3 |
2021-06-27 - 2021-09-25 |
3 months | crt.sh |
www.paypal.com DigiCert SHA2 Extended Validation Server CA |
2021-07-08 - 2022-01-11 |
6 months | crt.sh |
This page contains 1 frames:
Primary Page:
http://residencecasanova.it/netease/PayPal/home/myaccount/Uploads/
Frame ID: DBC97AE0B150F51AE44D5F3E619A6FC2
Requests: 24 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 10- https://www.paypal.com/search/js/embed.js HTTP 301
- https://www.paypal.com/us/smarthelp/home/js/embed.js HTTP 301
- https://www.paypal.com/smarthelp/home HTTP 301
- https://www.paypal.com/us/smarthelp/home
23 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
Cookie set
/
residencecasanova.it/netease/PayPal/home/myaccount/Uploads/ |
5 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.css
gps-ip.xyz/css/paypal/css/ |
178 KB 28 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.js
gps-ip.xyz/css/paypal/lib/js/ |
84 KB 29 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.validate.js
gps-ip.xyz/css/paypal/lib/js/ |
47 KB 12 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.v-form.js
gps-ip.xyz/css/paypal/lib/js/ |
4 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.mask.js
gps-ip.xyz/css/paypal/lib/js/ |
18 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
G-Z118.css
gps-ip.xyz/css/paypal/lib/css/ |
195 KB 24 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
B-Z118.css
gps-ip.xyz/css/paypal/lib/css/ |
7 KB 991 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pa.js
www.paypalobjects.com/pa/js/min/ |
56 KB 22 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
paypal-sans.css
www.paypalobjects.com/ui-web/vx-pattern-lib/2-0-5/ |
3 KB 707 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main-service-nav.css
www.paypalobjects.com/web/res/1f0/6dcd434cd566c97d0085ac711fbc4/css/ |
156 KB 26 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
home
www.paypal.com/us/smarthelp/ Redirect Chain
|
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sample-selfie-card.svg
gps-ip.xyz/css/paypal/img/ |
39 KB 8 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sample-photo-id-card.svg
gps-ip.xyz/css/paypal/img/ |
80 KB 16 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css.css
gps-ip.xyz/css/paypal/upl/css/ |
4 KB 768 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.fileuploader.css
gps-ip.xyz/css/paypal/upl/css/ |
16 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.fileuploader-theme-thumbnails.css
gps-ip.xyz/css/paypal/upl/css/ |
4 KB 865 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
jquery-3.1.1.min.js
gps-ip.xyz/css/paypal/upl/js/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.fileuploader.min.js
gps-ip.xyz/css/paypal/upl/js/ |
27 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
custom.js
gps-ip.xyz/css/paypal/upl/js/ |
4 KB 992 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
610 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
PayPalSansBig-Light.woff2
www.paypalobjects.com/ui-web/paypal-sans-big/1-0-0/ |
37 KB 38 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
PayPalSansSmall-Regular.woff2
www.paypalobjects.com/ui-web/paypal-sans-small/1-0-0/ |
36 KB 37 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
PayPalSansSmall-Medium.woff2
www.paypalobjects.com/ui-web/paypal-sans-small/1-0-0/ |
38 KB 38 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- gps-ip.xyz
- URL
- https://gps-ip.xyz/css/paypal/upl/js/jquery-3.1.1.min.js
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: PayPal (Financial)13 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery object| PAYPAL object| fpti string| fptiserverurl boolean| isLessthanIE100 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
gps-ip.xyz
residencecasanova.it
www.paypal.com
www.paypalobjects.com
gps-ip.xyz
104.111.228.123
147.185.115.71
151.101.129.21
178.63.61.164
15d0885f0bd68f518345d1d9ed06bf9fea395a9086c7ced201ed168c29eb0b69
1b396ed53e76c547685aee9e3a69d82ec87a76180e7fbb23769d3e8074f76e69
20db92851a8f3fcb35ca958f6347ee6857381650e2de95cd132d223b8ea877a1
2a1f1370eb7b24a307312112427dfd544fb838a8bef66babc936f5e870a22e52
2b1d89b0685427c4f90517d223cbc0a240a1fd74c60f003d71812a280b65f13a
400bbeedc9cb7c6424872b243b3f003ceac019c17fcfad8f9a2ada381de6e6b7
4619d70d7bd1b3d7572940e9ee7f31bc4c07f4c9cad6ae2d3e5b2eb555b6a2c0
4afb4b79dc68130a2d437e2362adffded06d17119631b32d19e1ea38eb8db47f
5b0762c89f2d66aca96baadb117e844c5a65a5e517a68573ae5e5f87f81ef12b
713c772fcc2ba85c923ce555b1516795c3d9525121b81cbd8bdef2a746c86cb2
7aef689677c32c8ca696e83503931620057958d58fb416e5a973f60cf581c619
88cdb84bb12b1781db7daaf74b795db1d0c25a15c50eac4edbaee39bf3c2ff52
a3b846d3c224f7d3cab0015a83152a15447aa9bae4470c1ca7f291b3a7a58dad
b337b4723a05881b0fdbc54695b0558d288b13ab9d98ff45d091e51d78fd6ed0
c241f727d0c85c180a1ccc2f3b085a43a748e09948193e09d9e3cdfcb4f8fb94
c6c94c9eaefd52e7d69296e0a56e93c77406187f5b76d9b8967d516108a8b66b
c913cf347361d7b7881beb389918d65e41e5c8d7c3943a0cb58797e0fe4c16ac
cf1f0d954cbbbcb32d170b1ff68c5b082a1086f34f2bbee825ca88b7c9fb213a
d5d721e98ba7a207ad3e0f2422170c7cdef2c02c50951096c11a3870ac7d4824
df76ffbe0fc372a2f2d9ece1ef50055b23b5cc776c4556e2533add339e63bdf8
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eb1cdb484ee2a006956c5cf2e9865b29fa5bf983006ca585ba926d22ef0f1785
fbc9938e7f80cc983bbdfe777b736364fec34f493d20a81f84b5c67b6bc0c24e