www.paypal-powered.ga

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 6 HTTP transactions. The main IP is 66.155.22.49, located in Atlanta, United States and belongs to PEER1 - Cogeco Peer 1, CA. The main domain is www.paypal-powered.ga.
TLS certificate: Issued by Let's Encrypt Authority X3 on November 12th 2017. Valid for: 3 months.

This is the only time www.paypal-powered.ga was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic (Online) PayPal (Financial)

Domain & IP information

	IP Address		AS Autonomous System
2 8	66.155.22.49 66.155.22.49		13768 (PEER1) (PEER1 - Cogeco Peer 1)
6	1

8 66.155.22.49 (Atlanta, United States) 2 redirects

ASN13768 (PEER1 - Cogeco Peer 1, CA)
PTR: vps.sabredevelopment.co.uk

www.paypal-powered.ga	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	paypal-powered.ga 2 redirects www.paypal-powered.ga	138 KB
6	1

	Domain	Requested by
8	www.paypal-powered.ga	2 redirects www.paypal-powered.ga
6	1

This site contains no links.

Subject Issuer	Validity	Valid
paypal-powered.ga Let's Encrypt Authority X3	`2017-11-12` - `2018-02-10`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.paypal-powered.ga/verification/myaccount/websc_login/?country.x=&locale.x=en_
Frame ID: 19035.1
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://www.paypal-powered.ga/verification/ HTTP 302
https://www.paypal-powered.ga/verification/referrer.php?MTUwMDU1MTQy=secured HTTP 302
https://www.paypal-powered.ga/verification/myaccount/websc_login/?country.x=&locale.x=en_ Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Page Statistics

6
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

138 kB
Transfer

138 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.paypal-powered.ga/verification/ HTTP 302
https://www.paypal-powered.ga/verification/referrer.php?MTUwMDU1MTQy=secured HTTP 302
https://www.paypal-powered.ga/verification/myaccount/websc_login/?country.x=&locale.x=en_ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Cookie set / Show response www.paypal-powered.ga/verification/myaccount/websc_login/ Redirect Chain https://www.paypal-powered.ga/verification/ https://www.paypal-powered.ga/verification/referrer.php?MTUwMDU1MTQy=secured https://www.paypal-powered.ga/verification/myaccount/websc_login/?country.x=&locale.x=en_	7 KB 7 KB	557ms 509ms	Document text/html	66.155.22.49 Cogeco Peer 1
General Check archive.org Show headers Download Go to Full URL https://www.paypal-powered.ga/verification/myaccount/websc_login/?country.x=&locale.x=en_ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 66.155.22.49 Atlanta, United States, ASN13768 (PEER1 - Cogeco Peer 1, CA), Reverse DNS vps.sabredevelopment.co.uk Software Apache / PHP/5.4.45 Resource Hash `2705061357ff0550cc811a7296d6d59aef700018859d986eded406dbf06ff9a3` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www.paypal-powered.ga Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Cache-Control no-cache Connection keep-alive User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36 Response headers Pragma no-cache Date Fri, 17 Nov 2017 15:32:25 GMT Server Apache X-Powered-By PHP/5.4.45 Content-Type text/html Set-Cookie PHPSESSID=02c60697fd6629c4ca9e65113166bcc8; path=/ Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Connection close Content-Length 7147 Expires Thu, 19 Nov 1981 08:52:00 GMT Redirect headers location ./myaccount/websc_login/?country.x=&locale.x=en_ Date Fri, 17 Nov 2017 15:32:24 GMT Server Apache Connection close X-Powered-By PHP/5.4.45 Content-Length 0 Content-Type text/html
GET H/1.1	200 OK	hok.js Show response www.paypal-powered.ga/verification/myaccount/websc_login/	20 KB 20 KB	162ms 114ms	Script application/javascript	66.155.22.49 Cogeco Peer 1
General Check archive.org Show headers Download Go to Full URL https://www.paypal-powered.ga/verification/myaccount/websc_login/hok.js Requested by Host: www.paypal-powered.ga URL: https://www.paypal-powered.ga/verification/myaccount/websc_login/?country.x=&locale.x=en_ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 66.155.22.49 Atlanta, United States, ASN13768 (PEER1 - Cogeco Peer 1, CA), Reverse DNS vps.sabredevelopment.co.uk Software Apache / Resource Hash `847c86ae982abe9180233276125b930b4a1b6f1bd12649b0c07535c1e984def8` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www.paypal-powered.ga User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36 Accept / Referer https://www.paypal-powered.ga/verification/myaccount/websc_login/?country.x=&locale.x=en_ Cookie PHPSESSID=02c60697fd6629c4ca9e65113166bcc8 Connection keep-alive Cache-Control no-cache Referer https://www.paypal-powered.ga/verification/myaccount/websc_login/?country.x=&locale.x=en_ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36 Response headers Date Fri, 17 Nov 2017 15:32:25 GMT Last-Modified Fri, 17 Mar 2017 10:42:12 GMT Server Apache ETag "187994-4f65-54aead4876900" Content-Type application/javascript Connection close Accept-Ranges bytes Content-Length 20325
GET H/1.1	200 OK	sign_in.css www.paypal-powered.ga/verification/myaccount/css/	24 KB 24 KB	259ms 216ms	Stylesheet text/css	66.155.22.49 Cogeco Peer 1
General Check archive.org Show headers Download Go to Full URL https://www.paypal-powered.ga/verification/myaccount/css/sign_in.css Requested by Host: www.paypal-powered.ga URL: https://www.paypal-powered.ga/verification/myaccount/websc_login/?country.x=&locale.x=en_ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 66.155.22.49 Atlanta, United States, ASN13768 (PEER1 - Cogeco Peer 1, CA), Reverse DNS vps.sabredevelopment.co.uk Software Apache / Resource Hash `3290055cafa251475adbc5c824826b7848e8ed89133d3dbc73c63a0a841a1ac0` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www.paypal-powered.ga User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36 Accept text/css,/;q=0.1 Referer https://www.paypal-powered.ga/verification/myaccount/websc_login/?country.x=&locale.x=en_ Cookie PHPSESSID=02c60697fd6629c4ca9e65113166bcc8 Connection keep-alive Cache-Control no-cache Referer https://www.paypal-powered.ga/verification/myaccount/websc_login/?country.x=&locale.x=en_ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36 Response headers Date Fri, 17 Nov 2017 15:32:25 GMT Last-Modified Fri, 17 Mar 2017 10:42:12 GMT Server Apache ETag "187874-5e9f-54aead4876900" Content-Type text/css Connection close Accept-Ranges bytes Content-Length 24223
GET H/1.1	200 OK	jqury.js Show response www.paypal-powered.ga/verification/myaccount/js/	84 KB 84 KB	247ms 205ms	Script application/javascript	66.155.22.49 Cogeco Peer 1
General Check archive.org Show headers Download Go to Full URL https://www.paypal-powered.ga/verification/myaccount/js/jqury.js Requested by Host: www.paypal-powered.ga URL: https://www.paypal-powered.ga/verification/myaccount/websc_login/?country.x=&locale.x=en_ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 66.155.22.49 Atlanta, United States, ASN13768 (PEER1 - Cogeco Peer 1, CA), Reverse DNS vps.sabredevelopment.co.uk Software Apache / Resource Hash `2a1f1370eb7b24a307312112427dfd544fb838a8bef66babc936f5e870a22e52` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www.paypal-powered.ga User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36 Accept / Referer https://www.paypal-powered.ga/verification/myaccount/websc_login/?country.x=&locale.x=en_ Cookie PHPSESSID=02c60697fd6629c4ca9e65113166bcc8 Connection keep-alive Cache-Control no-cache Referer https://www.paypal-powered.ga/verification/myaccount/websc_login/?country.x=&locale.x=en_ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36 Response headers Date Fri, 17 Nov 2017 15:32:25 GMT Last-Modified Fri, 17 Mar 2017 10:42:12 GMT Server Apache ETag "1878f8-15147-54aead4876900" Content-Type application/javascript Connection close Accept-Ranges bytes Content-Length 86343
GET H/1.1	200 OK	login.js Show response www.paypal-powered.ga/verification/myaccount/js/	910 B 910 B	203ms 156ms	Script application/javascript	66.155.22.49 Cogeco Peer 1
General Check archive.org Show headers Download Go to Full URL https://www.paypal-powered.ga/verification/myaccount/js/login.js Requested by Host: www.paypal-powered.ga URL: https://www.paypal-powered.ga/verification/myaccount/websc_login/?country.x=&locale.x=en_ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 66.155.22.49 Atlanta, United States, ASN13768 (PEER1 - Cogeco Peer 1, CA), Reverse DNS vps.sabredevelopment.co.uk Software Apache / Resource Hash `92dd48f0faf17873c9b9f3ae2a1000d819225627ee4f1475ca54bd496f82dbdb` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www.paypal-powered.ga User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36 Accept / Referer https://www.paypal-powered.ga/verification/myaccount/websc_login/?country.x=&locale.x=en_ Cookie PHPSESSID=02c60697fd6629c4ca9e65113166bcc8 Connection keep-alive Cache-Control no-cache Referer https://www.paypal-powered.ga/verification/myaccount/websc_login/?country.x=&locale.x=en_ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36 Response headers Date Fri, 17 Nov 2017 15:32:25 GMT Last-Modified Fri, 17 Mar 2017 10:42:12 GMT Server Apache ETag "1878f9-38e-54aead4876900" Content-Type application/javascript Connection close Accept-Ranges bytes Content-Length 910
GET H/1.1	200 OK	logins.PNG www.paypal-powered.ga/verification/myaccount/img/	2 KB 2 KB	165ms 123ms	Image image/png	66.155.22.49 Cogeco Peer 1
General Check archive.org Show headers Download Go to Show image Full URL https://www.paypal-powered.ga/verification/myaccount/img/logins.PNG Requested by Host: www.paypal-powered.ga URL: https://www.paypal-powered.ga/verification/myaccount/websc_login/?country.x=&locale.x=en_ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 66.155.22.49 Atlanta, United States, ASN13768 (PEER1 - Cogeco Peer 1, CA), Reverse DNS vps.sabredevelopment.co.uk Software Apache / Resource Hash `49bb344cab7bb90d18d29713e6bdf6196160d55fb775f8e27ddf28fac3ce60ed` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www.paypal-powered.ga User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* https://www.paypal-powered.ga/verification/myaccount/css/sign_in.css Cookie PHPSESSID=02c60697fd6629c4ca9e65113166bcc8 Connection keep-alive Cache-Control no-cache Referer https://www.paypal-powered.ga/verification/myaccount/css/sign_in.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36 Response headers Date Fri, 17 Nov 2017 15:32:26 GMT Last-Modified Fri, 17 Mar 2017 10:42:12 GMT Server Apache ETag "1878b0-7a6-54aead4876900" Content-Type image/png Connection close Accept-Ranges bytes Content-Length 1958

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online) PayPal (Financial)

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.paypal-powered.ga/	1970-01-01 00:00:00	Name: PHPSESSID Value: 02c60697fd6629c4ca9e65113166bcc8

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

www.paypal-powered.ga
66.155.22.49
2705061357ff0550cc811a7296d6d59aef700018859d986eded406dbf06ff9a3
2a1f1370eb7b24a307312112427dfd544fb838a8bef66babc936f5e870a22e52
3290055cafa251475adbc5c824826b7848e8ed89133d3dbc73c63a0a841a1ac0
49bb344cab7bb90d18d29713e6bdf6196160d55fb775f8e27ddf28fac3ce60ed
847c86ae982abe9180233276125b930b4a1b6f1bd12649b0c07535c1e984def8
92dd48f0faf17873c9b9f3ae2a1000d819225627ee4f1475ca54bd496f82dbdb

www.paypal-powered.ga Open in urlscan Pro 66.155.22.49 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

6 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

138 kBTransfer

138 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

15 JavaScript Global Variables

1 Cookies

Indicators

www.paypal-powered.ga Open in urlscan Pro
66.155.22.49 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

138 kB
Transfer

138 kB
Size

1
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!