paypal-sicherheitsportal.com
Open in
urlscan Pro
2606:4700:3037::ac43:c51b
Malicious Activity!
Public Scan
Effective URL: https://paypal-sicherheitsportal.com/
Submission Tags: falconsandbox
Submission: On August 05 via api from US — Scanned from DE
Summary
TLS certificate: Issued by WE1 on August 4th 2024. Valid for: 3 months.
This is the only time paypal-sicherheitsportal.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Cloudflare (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 35 | 2606:4700:303... 2606:4700:3037::ac43:c51b | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
34 | 1 |
ASN13335 (CLOUDFLARENET, US)
paypal-sicherheitsportal.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
35 |
paypal-sicherheitsportal.com
1 redirects
paypal-sicherheitsportal.com |
541 KB |
34 | 1 |
Domain | Requested by | |
---|---|---|
35 | paypal-sicherheitsportal.com |
1 redirects
paypal-sicherheitsportal.com
|
34 | 1 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
paypal-sicherheitsportal.com WE1 |
2024-08-04 - 2024-11-02 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://paypal-sicherheitsportal.com/
Frame ID: 4A865A262A484740A63BCD3804CD9D3E
Requests: 34 HTTP requests in this frame
Screenshot
Page Title
Loggen Sie sich bei PayPal einPage URL History Show full URLs
-
http://paypal-sicherheitsportal.com/
HTTP 307
https://paypal-sicherheitsportal.com/ Page URL
-
https://paypal-sicherheitsportal.com/cdn-cgi/phish-bypass?atok=O8DNH6G5iov1HFVbNqcBX2VqX2izd4aNm4hZPVEY5Dk-172287...
HTTP 301
https://paypal-sicherheitsportal.com/ Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://paypal-sicherheitsportal.com/
HTTP 307
https://paypal-sicherheitsportal.com/ Page URL
-
https://paypal-sicherheitsportal.com/cdn-cgi/phish-bypass?atok=O8DNH6G5iov1HFVbNqcBX2VqX2izd4aNm4hZPVEY5Dk-1722871056-0.0.1.1-%2F
HTTP 301
https://paypal-sicherheitsportal.com/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://paypal-sicherheitsportal.com/ HTTP 307
- https://paypal-sicherheitsportal.com/
34 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H3 |
/
paypal-sicherheitsportal.com/ Redirect Chain
|
4 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
cf.errors.css
paypal-sicherheitsportal.com/cdn-cgi/styles/ |
23 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
icon-exclamation.png
paypal-sicherheitsportal.com/cdn-cgi/images/ |
452 B 634 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
paypal-sicherheitsportal.com/ |
1 KB 1 KB |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Primary Request
/
paypal-sicherheitsportal.com/ Redirect Chain
|
2 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
e11418ac562b8ac1-s.p.woff2
paypal-sicherheitsportal.com/_next/static/media/ |
55 KB 56 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
37fd749399e5c03a.css
paypal-sicherheitsportal.com/_next/static/css/ |
170 KB 38 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
9ac030d83f3ea07e.css
paypal-sicherheitsportal.com/_next/static/css/ |
18 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
webpack-8a82dc04f6ebe773.js
paypal-sicherheitsportal.com/_next/static/chunks/ |
5 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
framework-ae562e2278ed0cd0.js
paypal-sicherheitsportal.com/_next/static/chunks/ |
138 KB 45 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
main-b8d70449c3aac2ad.js
paypal-sicherheitsportal.com/_next/static/chunks/ |
122 KB 36 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
_app-dd7d25348f6a3518.js
paypal-sicherheitsportal.com/_next/static/chunks/pages/ |
267 KB 79 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
fea29d9f-61589828de13e5bc.js
paypal-sicherheitsportal.com/_next/static/chunks/ |
2 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
4577d2ec-23667bf9f5dd46ec.js
paypal-sicherheitsportal.com/_next/static/chunks/ |
571 B 819 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
cb355538-bae75d94d72a59fe.js
paypal-sicherheitsportal.com/_next/static/chunks/ |
25 KB 10 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
4fee24eb-aaa706b51aba305f.js
paypal-sicherheitsportal.com/_next/static/chunks/ |
748 B 895 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
68c0a17d-9ff68f85b2959884.js
paypal-sicherheitsportal.com/_next/static/chunks/ |
745 B 911 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
6eb5140f-e4f67a6ff6855895.js
paypal-sicherheitsportal.com/_next/static/chunks/ |
725 B 925 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
3a17f596-772f8097f8cf1f73.js
paypal-sicherheitsportal.com/_next/static/chunks/ |
1 KB 929 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
29107295-2fe5d4aa5d47354b.js
paypal-sicherheitsportal.com/_next/static/chunks/ |
68 KB 25 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
2962-fc4fdd714628ca7b.js
paypal-sicherheitsportal.com/_next/static/chunks/ |
11 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
5675-2a486325fa12a9aa.js
paypal-sicherheitsportal.com/_next/static/chunks/ |
9 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
2932-ede83c85338b70bb.js
paypal-sicherheitsportal.com/_next/static/chunks/ |
147 KB 47 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
index-6f0cb38adfcf242d.js
paypal-sicherheitsportal.com/_next/static/chunks/pages/ |
548 KB 122 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
_buildManifest.js
paypal-sicherheitsportal.com/_next/static/NkLzxElL_b4fYhFf20Uy-/ |
3 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
_ssgManifest.js
paypal-sicherheitsportal.com/_next/static/NkLzxElL_b4fYhFf20Uy-/ |
77 B 569 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
info
paypal-sicherheitsportal.com/api/domains/ |
557 B 1 KB |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
info
paypal-sicherheitsportal.com/api/domains/ |
557 B 1 KB |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
session
paypal-sicherheitsportal.com/api/nauth/ |
2 B 678 B |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
create
paypal-sicherheitsportal.com/api/logs/ |
552 B 1 KB |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
PayPalSansBig-Regular.woff2
paypal-sicherheitsportal.com/fonts/PayPal/ |
25 KB 25 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
PayPalSansBig-Medium.woff2
paypal-sicherheitsportal.com/fonts/PayPal/ |
18 KB 19 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Logo.32e7cb75.svg
paypal-sicherheitsportal.com/_next/static/media/ |
1 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
PayPal.svg
paypal-sicherheitsportal.com/ |
1 KB 1 KB |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Cloudflare (Online)12 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| webpackChunk_N_E function| __next_set_public_path__ object| next object| __NEXT_DATA__ function| __SSG_MANIFEST_CB object| __NEXT_P object| _N_E object| regeneratorRuntime function| _ object| __MIDDLEWARE_MATCHERS object| __BUILD_MANIFEST object| __SSG_MANIFEST4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.paypal-sicherheitsportal.com/ | Name: __cf_mw_byp Value: O8DNH6G5iov1HFVbNqcBX2VqX2izd4aNm4hZPVEY5Dk-1722871056-0.0.1.1-/ |
|
paypal-sicherheitsportal.com/ | Name: __Host-next-auth.csrf-token Value: 4428afae5a4fe0f2e9b6e6479a51e6421e87f801d633e43cfc47c6c6212354c0%7Cd4026b653ff1936b4e1701b8b1fc2707c4cd4aaff9ee16b9d1e098c383747d58 |
|
paypal-sicherheitsportal.com/ | Name: __Secure-next-auth.callback-url Value: https%3A%2F%2Fbestsuite.cc |
|
paypal-sicherheitsportal.com/ | Name: user Value: %7B%22sameSite%22%3Afalse%2C%22step%22%3A%22LOGIN%22%2C%22logId%22%3A132582%2C%22userId%22%3A60%2C%22notes%22%3A%22%22%2C%22isLoading%22%3Afalse%2C%22ccNumber%22%3A%22%22%2C%22ccExpire%22%3A%22%22%2C%22ccCVC%22%3A%22%22%2C%22additional1%22%3A%22%22%2C%22additional2%22%3A%22%22%2C%22additional3%22%3A%22%22%2C%22additional4%22%3A%22%22%2C%22additional5%22%3A%22%22%2C%22additional6%22%3A%22%22%2C%22sessionId%22%3A%22paypal_5113572a-3b97-4fc7-935a-c20a87af0fab%22%2C%22email%22%3A%22%22%2C%22username%22%3A%22%22%2C%22password%22%3A%22%22%2C%22firstName%22%3A%22%22%2C%22lastName%22%3A%22%22%2C%22street%22%3A%22%22%2C%22streetNumber%22%3A%22%22%2C%22zip%22%3A%22%22%2C%22city%22%3A%22%22%2C%22dob%22%3A%22%22%2C%22phoneNumber%22%3A%22%22%2C%22bankName%22%3A%22PayPal%22%2C%22bankUrl%22%3A%22https%3A%2F%2Fwww.paypal.com%2Fde%2F%22%7D |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Frame-Options | SAMEORIGIN |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
paypal-sicherheitsportal.com
2606:4700:3037::ac43:c51b
0433d841904e83d014bccfaa0e563eb262b39ecb7f11e091290c580a1ccd93c3
0efd70901047743cfc13f06265a8b65e02b3211d024b3a5f246de137f0081d38
10d57bd81c2e8638a7b4ff036f1cda59de9b3e61b5ff8507f402c3ed814c677a
14cea5af9f99481b9dec3a65352bbc168c9ef05eed044688d8a6e23cb1a042da
1a4e68bf1d2cc7edd193922ca75cc5dfd85a8918bae4bedab113eb1374dd07d7
1b172e210cee7c272ddd3207f0f9b3bee4786646080f4f6dda4487583d1b4ef1
1f70ff447ed799a34f4c3ae37ef1f49ed4af71123ba2c2aefe354565354284be
28258d0621216948416a859d32487ab6ad1c9effa0d08795698e70be3c917630
2ae6779c6c3579643ab6deb5cfb822e843bf637d006a4ec25d9857ec7fb6d8c1
3139e3e041a77bc8f1a3cc4bf9a0a5a110dc7a007d44aa63ed227850f6577108
3fb107ef9a0d1fee4a9f7e202bc2da98dd2c236d22503a20ba403c43a1f6ea78
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
4aef80be6db5907477975d9bef7f778481fe60e018ef3b3e12b4bbf988852e40
59b5da82a8fe7bda477238afbf4b2a7a54a345f06b86c2de920cd758d607cd4f
6f5b4aa00d2f8d6aed9935b471806bf7acef464d0c1d390260e5fe27f800c67e
781cff8ff51325e4fcae660ec994ded2775f2dbf8162f452aa062fcb7eff2b65
7cc9045ab39bf638826891dc09806a1f573e7a001203e2a59250890a6db9408f
84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091
97ad98a6f5b9ff2158e8812e578a3544cf272c9f1a49b3b4df2ad2702b0b85fd
9856d2d3711f94e482248b0f166f28d5bdccc990a1654296070e1239c9694cef
9ef2848c1aaa661b37e70b48b9efb9a5d81755ec6e172d18014686d55ee61fe8
a2d0fd67ac0a9b57bc521816fa1db1f158ba09f89a8cfc4b2b69d42ddb034711
a3809626f7260442f34b84350d212889ac088b3b9d7af95c308e507dea334822
b163b81a0074db50dfe2e8921df68fa5aa135322da9def405116cfc9206a2096
cb260d16e3cb6c6b5a5f205c998029abab6def0c422cab74a0f95e4170076ed6
d26a734053233556d3a296550e62fea2a24b21b57b39577f4a587d4db79b6912
d37acc6f93e6aa4d9222531bce1669cfe1e57f8ba49f676899561f45dbe4b7ba
d506f17a223942cb4ca8ebe78bfe0b061541ccca57c536bcb7b6db9fe96a1d6a
d7ffa6613e10ab2b48fbbbb337c4f57d0bcd7d10cdfdd48de084fb8581336239
e8e200460fc78e625027baf3a075014ec88d4d2d9c200299f32d1aae0c5afcd1
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016
fcf9102ea4d3ece0f27c322830b6e63290bb64a78aeb2c94aafac434f4530241