trading-paxful.com
Open in
urlscan Pro
185.34.19.129
Malicious Activity!
Public Scan
URL:
https://trading-paxful.com/
Submission: On July 08 via api from US — Scanned from DE
Submission: On July 08 via api from US — Scanned from DE
Summary
This website contacted 4 IPs
in 3 countries
across 4 domains to perform 9 HTTP transactions.
The main IP is 185.34.19.129, located in
Iraq and
belongs to NEWROZ-TELECOM-ASN, IQ.
The main domain is trading-paxful.com.
TLS certificate: Issued by R3 on May 16th 2024. Valid for: 3 months.
This is the only time trading-paxful.com was scanned on urlscan.io!
TLS certificate: Issued by R3 on May 16th 2024. Valid for: 3 months.
This is the only time trading-paxful.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Paxful (Crypto Exchange)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 6 | 185.34.19.129 185.34.19.129 | 21277 (NEWROZ-TE...) (NEWROZ-TELECOM-ASN) | |
| 1 | 2a00:1450:400... 2a00:1450:4001:831::200a | 15169 (GOOGLE) (GOOGLE) | |
| 1 | 2a04:4e42::649 2a04:4e42::649 | 54113 (FASTLY) (FASTLY) | |
| 1 | 2a00:1450:400... 2a00:1450:4001:82f::2003 | 15169 (GOOGLE) (GOOGLE) | |
| 9 | 4 |
6
185.34.19.129
(Iraq)
ASN21277 (NEWROZ-TELECOM-ASN, IQ)
PTR: relay.coreline.tech
ASN21277 (NEWROZ-TELECOM-ASN, IQ)
PTR: relay.coreline.tech
| trading-paxful.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 6 |
trading-paxful.com
trading-paxful.com |
597 KB |
| 1 |
gstatic.com
fonts.gstatic.com |
15 KB |
| 1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 1178 |
84 KB |
| 1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 108 |
981 B |
| 9 | 4 |
| Domain | Requested by | |
|---|---|---|
| 6 | trading-paxful.com |
trading-paxful.com
|
| 1 | fonts.gstatic.com |
fonts.googleapis.com
|
| 1 | code.jquery.com |
trading-paxful.com
|
| 1 | fonts.googleapis.com |
trading-paxful.com
|
| 9 | 4 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| paxful.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| trading-paxful.com R3 |
2024-05-16 - 2024-08-14 |
3 months | crt.sh |
| upload.video.google.com WR2 |
2024-06-13 - 2024-09-05 |
3 months | crt.sh |
| *.jquery.com Sectigo ECC Domain Validation Secure Server CA |
2024-06-25 - 2025-06-25 |
a year | crt.sh |
| *.gstatic.com WR2 |
2024-06-13 - 2024-09-05 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://trading-paxful.com/
Frame ID: AC1407D1BF38CBF74B8D95F2990E325C
Requests: 9 HTTP requests in this frame
Screenshot
Detected technologies
Laravel
(Web Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
Google Font API
(Font Scripts)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
2 Outgoing links
These are links going to different origins than the main page.
URL: https://paxful.com/forgot-password?locale=en
Title: Forgot password?
Title: Forgot password?
Search URL Search Domain Scan URL
URL: https://paxful.com/register?locale=en
Title: Create an Account
Title: Create an Account
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
9 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
/
trading-paxful.com/ |
17 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
main.css
trading-paxful.com/css/ |
8 MB 550 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
vendors.chunk.css
trading-paxful.com/css/ |
40 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
css2
fonts.googleapis.com/ |
2 KB 981 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery-3.6.4.js
code.jquery.com/ |
286 KB 84 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
image2.webp
trading-paxful.com/ |
1 KB 1 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCuM73w5aXo.woff2
fonts.gstatic.com/s/montserrat/v26/ |
15 KB 15 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
image.webp
trading-paxful.com/ |
32 KB 33 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
favicon.ico
trading-paxful.com/ |
0 150 B |
Other
image/vnd.microsoft.icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Paxful (Crypto Exchange)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| trading-paxful.com/ | Name: XSRF-TOKEN Value: eyJpdiI6ImtkR2pQYXQveS8vbkt5WW4vWkI3SUE9PSIsInZhbHVlIjoiOXFwTEZDUlhabVJQSmZkQVY4YmgrejRiWDl4M3BTOElLQnNINC9sWXpLNmhmYnlZWFJjUUVCcVJmNjdZRU1BaHZjaGo4ekFxVVNoOHIvQk8rdVkvRlNUaVRacFBjTVJITHRrTWcyTTZ6SlJJdEpabEY1YXMyQVVxZERzWktNQzMiLCJtYWMiOiJkNGY0ZDFjNzIwNDA0MGUyZmU0YzdiN2EzYWY4MWMwNzgxZWM5OWFiOGIwMzI0Yjg0YzYyNzI1NjQxYzVkNGJkIiwidGFnIjoiIn0%3D |
|
| trading-paxful.com/ | Name: laravel_session Value: eyJpdiI6InphYTRDTG8wR1Bhay9lZEtlSjhiSmc9PSIsInZhbHVlIjoidlpYQXZjbUlCSERqaks5dHFtVlZydWhDdUpxU2V0YTFiYis1UmwxY3BZRm56akF2MXo4YVd6NnBCM25OVnFnQXpWaG9WQVdoZWJnMDAzRUd6aFJiVnRWdUQ1d01VbmM1anN6R2NFREVIYW5RM2llNTdneFV0czA2cXc3Y2VYcGUiLCJtYWMiOiJiZmZiNTY2MDkyZDc1MGJiZGYzMTVhMGJmMDcxNTkzOTVkZDJlMWY0YWQxMzRlZmU0MzNmYTFkYTFmN2JlY2M2IiwidGFnIjoiIn0%3D |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
code.jquery.com
fonts.googleapis.com
fonts.gstatic.com
trading-paxful.com
185.34.19.129
2a00:1450:4001:82f::2003
2a00:1450:4001:831::200a
2a04:4e42::649
134f21ebaee6bd53399c56a6db3b8e30b767e8d6e0f4af10a18c71b48a395526
2bd2afc3a20345a38be4327a9b26f3ee5069d30b5940664cf069d44627f873ba
350782cf30c54fdd0e12bbcfa291a4da65ad1548a55b8a97958e00f26438919f
660b097ab7738fad88ac653ebca00855738cff0370f74adf92b0376e911f505d
6bd8c1051ca05f5061e65b7c1998d70f3c8e07e6d6bdef4488eeed44e52d8ff1
8855941884585ac3a7c2a38e7ca88234cbae8c5bc9560e635cbe8a969d19207c
a60b1ba9daa11468bf1b846e8515e51b97023f341f2962a9623b9d8aaa7904ad
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f19e42c97e5d0a32c5b539be2e1947664671ddfbdec321cde20e15d7f39416fa