paypal.sicherheit-kontakt.info
Open in
urlscan Pro
49.51.170.31
Malicious Activity!
Public Scan
URL:
https://paypal.sicherheit-kontakt.info/signin/private/bankverbindung.php
Submission: On February 02 via automatic, source openphish
Submission: On February 02 via automatic, source openphish
Summary
This website contacted 1 IPs
in 1 countries
across 1 domains to perform 11 HTTP transactions.
The main IP is 49.51.170.31, located in
Germany and
belongs to TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN.
The main domain is paypal.sicherheit-kontakt.info.
TLS certificate: Issued by Let's Encrypt Authority X3 on January 31st 2020. Valid for: 3 months.
This is the only time paypal.sicherheit-kontakt.info was scanned on urlscan.io!
TLS certificate: Issued by Let's Encrypt Authority X3 on January 31st 2020. Valid for: 3 months.
This is the only time paypal.sicherheit-kontakt.info was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: PayPal (Financial)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 11 | 49.51.170.31 49.51.170.31 | 132203 (TENCENT-N...) (TENCENT-NET-AP-CN Tencent Building) | |
| 11 | 1 |
11
49.51.170.31
(Germany)
ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN)
ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN)
| paypal.sicherheit-kontakt.info |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 11 |
sicherheit-kontakt.info
paypal.sicherheit-kontakt.info |
170 KB |
| 11 | 1 |
| Domain | Requested by | |
|---|---|---|
| 11 | paypal.sicherheit-kontakt.info |
paypal.sicherheit-kontakt.info
|
| 11 | 1 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| paypal.sicherheit-kontakt.info Let's Encrypt Authority X3 |
2020-01-31 - 2020-04-30 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://paypal.sicherheit-kontakt.info/signin/private/bankverbindung.php
Frame ID: 42D0A882F204A1740833225438D3ECBE
Requests: 11 HTTP requests in this frame
Screenshot
Detected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- url /\.php(?:$|\?)/i
Nginx
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /nginx(?:\/([\d.]+))?/i
React
(JavaScript Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- html /<[^>]+data-react/i
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- script /jquery[.-]([\d.]*\d)[^\/]*\.js/i
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
bankverbindung.php
paypal.sicherheit-kontakt.info/signin/private/ |
4 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
page.css
paypal.sicherheit-kontakt.info/signin/private/css/ |
12 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
contextualLogin.css
paypal.sicherheit-kontakt.info/signin/private/css/ |
83 KB 14 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery-1.11.3.min.js
paypal.sicherheit-kontakt.info/signin/private/js/ |
94 KB 33 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery.maskedinput.js
paypal.sicherheit-kontakt.info/signin/private/js/ |
16 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery.cookie.js
paypal.sicherheit-kontakt.info/signin/private/js/ |
4 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
main.js
paypal.sicherheit-kontakt.info/signin/private/js/ |
10 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ppcom.svg
paypal.sicherheit-kontakt.info/signin/private/img/ |
5 KB 6 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
sprite_countries_flag4.png
paypal.sicherheit-kontakt.info/signin/private/img/ |
68 KB 68 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
PayPalSansBig-Light.woff2
paypal.sicherheit-kontakt.info/signin/private/fonts/ |
18 KB 18 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
PayPalSansSmall-Regular.woff2
paypal.sicherheit-kontakt.info/signin/private/fonts/ |
18 KB 18 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: PayPal (Financial)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| $ function| jQuery0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
| Header | Value |
|---|---|
| Strict-Transport-Security | max-age=31536000; preload |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
paypal.sicherheit-kontakt.info
49.51.170.31
0d4d4b0ee4bdbbbfdf2fa8cc4c0ba0332a3798c2629cb806d249712f6a7063e3
4f6a9c99d36c51fabdd3e290c6a7fafb8252e6f34627d37d133ee9381a7880e5
5732bf7140e53c367e47b53dd0c741dbe13411a6cdbdce6eb086c24d8a4a429f
8ffb271eb7b416bcd7caa260d227fddb684048fb57e61d18c29418f66187f9cd
94ffc263295036858354cea9af2d7f0e45e1a030e781edd1655727c4b0eb226c
ae569c82c50a2972eb0453dcfef4cc4e4afdbf0dd80f55cc31f33d6fc958e816
af93d1d952b2dc42c029871cbbb92988835b31c86d4f0cb6a9674b1d1714a20f
d29b68b27478d955b9f8aada04240271ee4b785b365d74f9a6bec14e7477ffac
de10d24df34001da6a18bf138fecfb3621ee7074fe6f3fdb509fcaec915143b7
ecb916133a9376911f10bc5c659952eb0031e457f5df367cde560edbfba38fb8
f35f7177524a0cb14af5c68d1a272a1f1060ea80f0a06df7729d9bec6aeb890c