www.paxful-claim.com Open in urlscan Pro
142.11.217.96 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.paxful-claim.com/
Submission Tags: phishing
Submission: On April 29 via api (April 29th 2021, 12:00:47 pm UTC) from US

Summary HTTP 17 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 6 IPs in 3 countries across 5 domains to perform 17 HTTP transactions. The main IP is 142.11.217.96, located in United States and belongs to HOSTWINDS, US. The main domain is www.paxful-claim.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on April 28th 2021. Valid for: 3 months.

This is the only time www.paxful-claim.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Paxful (Crypto Exchange)

Domain & IP information

	IP Address	AS Autonomous System
9	142.11.217.96 142.11.217.96	54290 (HOSTWINDS) (HOSTWINDS)
1	2a00:1450:400... 2a00:1450:4001:827::200a	15169 (GOOGLE) (GOOGLE)
2	52.30.83.119 52.30.83.119	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:20c... 2600:9000:20c8:fc00:1:149e:16c0:93a1	16509 (AMAZON-02) (AMAZON-02)
3	2a00:1450:400... 2a00:1450:4001:829::2003	15169 (GOOGLE) (GOOGLE)
1	54.225.155.255 54.225.155.255	14618 (AMAZON-AES) (AMAZON-AES)
17	6

9 142.11.217.96 (United States)

ASN54290 (HOSTWINDS, US)
PTR: beardandme.com

www.paxful-claim.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:827::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.30.83.119 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-30-83-119.eu-west-1.compute.amazonaws.com

api.geetest.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:20c8:fc00:1:149e:16c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

static.geetest.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:829::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.225.155.255 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-225-155-255.compute-1.amazonaws.com

api.ipify.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	paxful-claim.com www.paxful-claim.com	96 KB
3	gstatic.com fonts.gstatic.com	32 KB
3	geetest.com api.geetest.com static.geetest.com	6 KB
1	ipify.org api.ipify.org	260 B
1	googleapis.com fonts.googleapis.com	975 B
17	5

	Domain	Requested by
9	www.paxful-claim.com	www.paxful-claim.com
3	fonts.gstatic.com	fonts.googleapis.com
2	api.geetest.com	www.paxful-claim.com
1	api.ipify.org	www.paxful-claim.com
1	static.geetest.com	www.paxful-claim.com
1	fonts.googleapis.com	www.paxful-claim.com
17	6

This site contains links to these domains. Also see Links.

Domain
paxful.com

Subject Issuer	Validity	Valid
paxful-claim.com cPanel, Inc. Certification Authority	`2021-04-28` - `2021-07-27`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2021-04-13` - `2021-07-06`	3 months	crt.sh
*.geetest.com GeoTrust TLS DV RSA Mixed SHA256 2020 CA-1	`2021-01-28` - `2022-01-28`	a year	crt.sh
*.gstatic.com GTS CA 1O1	`2021-04-13` - `2021-07-06`	3 months	crt.sh
*.ipify.org Sectigo RSA Domain Validation Secure Server CA	`2021-01-19` - `2022-02-19`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.paxful-claim.com/
Frame ID: C095EE327F8C1B191B7569F0CBEFCA47
Requests: 17 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Page Statistics

17
Requests

100 %
HTTPS

50 %
IPv6

5
Domains

6
Subdomains

6
IPs

3
Countries

135 kB
Transfer

744 kB
Size

0
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://paxful.com/

Search URL Search Domain Scan URL

URL: https://paxful.com/forgot-password?locale=en
Title: Forgot password?

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.paxful-claim.com/ 28 KB
7 KB 640ms
185ms Document
text/html 142.11.217.96
HOSTWINDS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.paxful-claim.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 142.11.217.96 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS: beardandme.com
Software: Apache /
Resource Hash: cf4894dcbad595ca6c89c82773962caa441cdc757170cfca9fd5c883f9fe3ce2

Request headers

:method: GET
:authority: www.paxful-claim.com
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1

Response headers

date: Thu, 29 Apr 2021 12:00:25 GMT
server: Apache
last-modified: Wed, 28 Apr 2021 16:09:07 GMT
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: br
content-length: 7155
content-type: text/html

GET
H2 200 chunk.css
www.paxful-claim.com/ 37 KB
6 KB 178ms
175ms Stylesheet
text/css 142.11.217.96
HOSTWINDS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.paxful-claim.com/chunk.css
Requested by: Host: www.paxful-claim.com
URL: https://www.paxful-claim.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 142.11.217.96 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS: beardandme.com
Software: Apache /
Resource Hash: 824d7cc2627461b270716c538bd9943cc461384850cc584d99fee6a5d371b160

Request headers

:path: /chunk.css
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: www.paxful-claim.com
referer: https://www.paxful-claim.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.paxful-claim.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1

Response headers

date: Thu, 29 Apr 2021 12:00:25 GMT
content-encoding: br
last-modified: Mon, 19 Apr 2021 00:41:34 GMT
server: Apache
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 6183

GET
H2 200 main.css
www.paxful-claim.com/ 566 KB
53 KB 221ms
219ms Stylesheet
text/css 142.11.217.96
HOSTWINDS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.paxful-claim.com/main.css
Requested by: Host: www.paxful-claim.com
URL: https://www.paxful-claim.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 142.11.217.96 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS: beardandme.com
Software: Apache /
Resource Hash: 0fc0b442a468b0fb3019a5ba5f81ec87c43fe09f16c0513d7fa496a8a9d3db67

Request headers

:path: /main.css
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: www.paxful-claim.com
referer: https://www.paxful-claim.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.paxful-claim.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1

Response headers

date: Thu, 29 Apr 2021 12:00:25 GMT
content-encoding: br
last-modified: Mon, 19 Apr 2021 00:40:36 GMT
server: Apache
accept-ranges: bytes
vary: Accept-Encoding
content-type: text/css

GET
H2 200 css
fonts.googleapis.com/ 12 KB
975 B 22ms
20ms Stylesheet
text/css 2a00:1450:4001:827::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Montserrat:400,500,700|Open+Sans:400,600,700&display=swap&subset=cyrillic

Requested by

Host: www.paxful-claim.com
URL: https://www.paxful-claim.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

35417626d8c29128917cd1c757e92189edc47b44a06124f54a577560a4d171fd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.paxful-claim.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
date: Thu, 29 Apr 2021 12:00:25 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
expires: Thu, 29 Apr 2021 12:00:25 GMT

GET
H2 404 c.js
www.paxful-claim.com/v1/c/ 0
0 175ms
173ms Script
text/html 142.11.217.96
HOSTWINDS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.paxful-claim.com/v1/c/c.js?529715187284844
Requested by: Host: www.paxful-claim.com
URL: https://www.paxful-claim.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 142.11.217.96 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS: beardandme.com
Software: Apache /
Resource Hash

Request headers

:path: /v1/c/c.js?529715187284844
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.paxful-claim.com
referer: https://www.paxful-claim.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.paxful-claim.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1

Response headers

date: Thu, 29 Apr 2021 12:00:25 GMT
content-encoding: br
server: Apache
accept-ranges: bytes
content-length: 4397
vary: Accept-Encoding
content-type: text/html

GET
H2 200 gettype.php Show response
api.geetest.com/ 515 B
783 B 310ms
310ms Script
text/javascript 52.30.83.119
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.geetest.com/gettype.php?gt=98d799385d0804f2a40ebcb936d99ed3&callback=geetest_1610984121855
Requested by: Host: www.paxful-claim.com
URL: https://www.paxful-claim.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.30.83.119 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-30-83-119.eu-west-1.compute.amazonaws.com
Software: openresty /
Resource Hash: 5376ce85432db981f1bad9a3fe67b8cd715c5d770a563cca9d0a39c4e3f3bde0

Request headers

Referer: https://www.paxful-claim.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1

Response headers

pragma: no-cache
date: Thu, 29 Apr 2021 12:00:26 GMT
server: openresty
etag: "222855603f9c8c9185842d3d10f8094b50baa712"
content-type: text/javascript;charset=UTF-8
cache-control: no-cache, no-store, must-revalidate
content-length: 515
expires: 0

GET
H2 404 fullpage.9.0.2.js
www.paxful-claim.com/https://accounts.paxful.com/static.geetest.comhttps://accounts.paxful.com/static/js/ 0
0 171ms
171ms Script
text/html 142.11.217.96
HOSTWINDS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.paxful-claim.com/https://accounts.paxful.com/static.geetest.comhttps://accounts.paxful.com/static/js/fullpage.9.0.2.js
Requested by: Host: www.paxful-claim.com
URL: https://www.paxful-claim.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 142.11.217.96 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS: beardandme.com
Software: Apache /
Resource Hash

Request headers

:path: /https://accounts.paxful.com/static.geetest.comhttps://accounts.paxful.com/static/js/fullpage.9.0.2.js
pragma: no-cache
origin: https://www.paxful-claim.com
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.paxful-claim.com
referer: https://www.paxful-claim.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Origin: https://www.paxful-claim.com
Referer: https://www.paxful-claim.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1

Response headers

date: Thu, 29 Apr 2021 12:00:26 GMT
content-encoding: br
server: Apache
accept-ranges: bytes
content-length: 4419
vary: Accept-Encoding
content-type: text/html

GET
H2 200 get.php Show response
api.geetest.com/ 113 B
383 B 664ms
325ms Script
text/javascript 52.30.83.119
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.geetest.com/get.php?gt=98d799385d0804f2a40ebcb936d99ed3&challenge=ee1d0b7d89c459c84b3938797244f02c&lang=en&pt=0&client_type=web&w=iuujvAv42QcQjd()S1oVpeKrGJTwz4BprFNtYf(A4dDILCX)ZiaSBMH7x)1qm00hADdkHsNUOjY2jIyxAVujdNXStaNWqJUe2p83KD7HCOXoC97mejrqO4NV9cABPlmryZ4cWgs9p2LFAuk(q)S7EprPQ0CQ8waTSixnwu)1MWLolkhPtxrUdyWPpUu0GFHGiLIvkIfsY6DdGodZD9Nm4rd193gMzsu1WAklmZNp2)YyXLO0RSKVS)W4NFzYthU2GqTB)OVsYF32IXa2(kdo9LeyvUB(C8OFF5cZQvoJlGJ7JNFLWxEGb8njWSVGq0vtuDPy3XW77q)66w5zcaHQPgo)Dick1xoLErvyfdSJW6PZgMacDLOCaw3djZjvWhT2gnzlciYIQmDC01qbUELWlz4Du3043CWdYXBNwFzfFbtz(6OpkE9YjO78MmE3MsuWJD9NT2oTGvHEezMguO77rFQiIVhofZPoVhHjedodUN0xissSmbZuXBtuG1E3MHP(n7(Ijz9tHxKToVbirAaLvj0E84TRNGp61Ps5o)(J9YVGYdxJfk8(YMHEGCK)DwE8)R(4Pq26SpXsYqYGwI69XY8s5RBPa9HdNIxinzKev8UfmrfZnmhsQq1)aOhhISo(XPDiDatPvRVgmqmlwCp3dgb2N4NmLGiG5klMvg(E3bGl1yYdvcMoOrHmQvw)aTR3ONLpqABYboO7hPyZUtxbvQkq9ttjSStOolM2m5HH(rUdHMALFpXP4tCCq(WpryA4GxUFkULi2Nd4aOAIyfgGFe(BIBuepRPRn55HOtUPecZsX(ttHXNC5SmWQCoDjLCfhUoh5Mh964MiUFDYrW1CoTw6JRJZ0C1rXKfLZzLuwxOSeoz946lly8fafAg914V70s9KGTDyjrpdPHYMTiHyaYMWBUVUrChDnT5gb7KElvlD)fg1oMYNlk4jLhSr06IAMVEkzAu9lr0VFkN5kIG8gqdmFhWifjn5(7LHRtnb95Uul4Km4YorKd)q1aAFzPMnDSn(Rbp6e3xf9m)7HLxC7Eh2)VtII9ca6l3pfzVBFCmY(YDB3g5879mBq7ubrcyExjIpDI2SnEQkWdnNfdlH9(uBrFe2nAa6wv6OY8P5zaXmf8RktIu9MTfWZ52kZ1LvZuVPsmVfcXt4sGA2HYeI5lYm()IF7jdGO3OovuYn4DAURKI0X(fDnlcO7P)r26HcA6zm5XYstj6oKB(CZM653TXaiDdy8KbbBHm7SFMnaPKEwel7zqRb1kzlP0Rhvx6YBgK7YhA7GlzMCZ3BnONzJvuQlr23i4zqgHa0HOWuVCTldY9a)P(s(qWlxN363I)EcdgponkNdZyS)L3yWzLxOZXvYYZdhHeYZj7LCK1(86td9V(QG64yonnXaUvvZi7GRw3By53Nj8PxNAlFdm49FOBoGAB)4EonXbWAyxHCjhLqDBGMU)45oNUVAtNb0AAmM9UmAPqqrRY6YdrrUIuFa(erD(uwhkg2TvASWmF8vb9CabZ7ksoRiuRnmgbmupPOB7EOgUkw8UQ6dyT4ehWgOktdMVBwsWBzvtD(lXS36knm(zVonsnvRPaYLPZ4XalHETyLWcrbChXnAlmNoj4yVDgLDVCNBbLK9e0Jw9Ji3PmBDNlGdbc257vrFUggciej28KEW35ihNhTe6S)DiTlE8tg4Pj0cDUrPlloQt35kCkBQd9CCgsMGWABwctZiVDiV76UizCUMkV3ZL)TBHQ2GsxIhlUVCSsqQa16oRqkDkI6sgzItG)VJaWlo38asEmhX3b)FHVed(tCFPJiwgtBfeJH697etAfLgsk7TEaopAQK6pHjrCBdkRCwAffWcsxTPwtrDMrua3Ddr8S7NJ46zSUS49cXN4dGTGPTgOGXM47BlNAWS0fYGsAY8(uJLM3hegaVdHifKh2z4R4LvxK((mbd4x(WEKGmG)E(1W5L3iXnNqSG9A3TV6z3HltmvS25nJZOVrre)OjwmsfUC9X65P)XI6joMGG9Mj5yma6eFE4cYTRtR2DBEO8CdEe2wkU)VepYlB4w)2G8KglATLEIGeZuHsDSMd5pOMAos0u6Ynjro6eTkUY3VOhom8gKyDJ3S9BS22vyykJq9IRJz8fEimfFfOnz1tLNgxbQVC9LLp5utxL4eIXyV)gLuwUHrsRciId)vaaQxZli1XVKhoBxEV1VrEmLJ6(p6tUIu7rBZt2YSAtYbIZYXt1qh(F10UQfafxwKtPHPqUmV56fMhpWI0Knw75NimFxHYPwRBvzAoU.73f1ea5034626afadf61ff91abe1abd71dc91a91e9c5a1518b7f3e2f3ac826d8ae3e51611889e25c6c9493bb452d2c7c8e026e77a27f445bef9b936c3e57dbe1aeb0a88c4e29a0a14e446be25385f821b9604b31a21b74349d9738a5fedd1b0fbd9477316cb3923a5c109733ae7136b17f1b8ab7da688a8c7823213bb40a8a4c&callback=geetest_1610984123161
Requested by: Host: www.paxful-claim.com
URL: https://www.paxful-claim.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.30.83.119 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-30-83-119.eu-west-1.compute.amazonaws.com
Software: openresty /
Resource Hash: d224e13968ff475256fcda7818b6cc5c74d04f0379dbc09278e67f9b1ae2eb1c

Request headers

Referer: https://www.paxful-claim.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1

Response headers

pragma: no-cache
date: Thu, 29 Apr 2021 12:00:26 GMT
server: openresty
etag: "02d63eb28006e5d2f00979d40b7adb849127ddc7"
content-type: text/javascript;charset=UTF-8
cache-control: no-cache, no-store, must-revalidate
content-length: 113
expires: 0

GET
H2 200 style_https.1.5.8.css
static.geetest.com/static/wind/ 40 KB
5 KB 382ms
43ms Stylesheet
text/css 2600:9000:20c8:fc00:1:149e:16c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.geetest.com/static/wind/style_https.1.5.8.css
Requested by: Host: www.paxful-claim.com
URL: https://www.paxful-claim.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20c8:fc00:1:149e:16c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AliyunOSS /
Resource Hash: 8ba195fffe0097e44a5dd29c35c092f10039e126cc9c4113330e8bf690c2461e

Request headers

Referer: https://www.paxful-claim.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1

Response headers

date: Thu, 29 Apr 2021 01:01:34 GMT
content-encoding: gzip
x-oss-request-id: 6088B3061692FC3531ECEA9A
content-md5: P7aqz9WuLTiU8vALDV8yNg==
age: 39764
x-cache: Hit from cloudfront
x-oss-object-type: Normal
last-modified: Tue, 24 Mar 2020 07:16:39 GMT
server: AliyunOSS
etag: "3FB6AACFD5AE2D3894F2F00B0D5F3236"
vary: Accept-Encoding
content-type: text/css
via: 1.1 9bac09758c086d613f2c0a80dd66c7a6.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-oss-storage-class: Standard
x-amz-cf-pop: MAD50-C1
x-oss-hash-crc64ecma: 8727683345402674844
x-amz-cf-id: ZQcQhelJ8O-b0gkzsdr2GDul5c726gJqbuff2H3ysP2ZAzbNXJjiRQ==
x-oss-server-time: 1
expires: Wed, 25 Mar 2020 07:16:37 GMT

GET
H2 200 paxful.png
www.paxful-claim.com/ 4 KB
4 KB 173ms
169ms Image
image/png 142.11.217.96
HOSTWINDS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.paxful-claim.com/paxful.png
Requested by: Host: www.paxful-claim.com
URL: https://www.paxful-claim.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 142.11.217.96 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS: beardandme.com
Software: Apache /
Resource Hash: de6b5589779fa82ba1841301f56fe3d3d0d44a3150fd0c9dc9a5fd6197c2a5d5

Request headers

:path: /paxful.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.paxful-claim.com
referer: https://www.paxful-claim.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.paxful-claim.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1

Response headers

date: Thu, 29 Apr 2021 12:00:26 GMT
last-modified: Fri, 22 Jan 2021 18:57:38 GMT
server: Apache
accept-ranges: bytes
content-length: 3834
content-type: image/png

GET
H2 200 link-snip.png
www.paxful-claim.com/ 3 KB
3 KB 170ms
168ms Image
image/png 142.11.217.96
HOSTWINDS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.paxful-claim.com/link-snip.png
Requested by: Host: www.paxful-claim.com
URL: https://www.paxful-claim.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 142.11.217.96 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS: beardandme.com
Software: Apache /
Resource Hash: f47e607a8677ae0e183a44a44a47faeb32898161e272e0e95df34b10c4ab2887

Request headers

:path: /link-snip.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.paxful-claim.com
referer: https://www.paxful-claim.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.paxful-claim.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1

Response headers

date: Thu, 29 Apr 2021 12:00:26 GMT
last-modified: Wed, 28 Apr 2021 16:09:11 GMT
server: Apache
accept-ranges: bytes
content-length: 2609
content-type: image/png

GET
H2 200 side.png
www.paxful-claim.com/ 23 KB
24 KB 170ms
168ms Image
image/png 142.11.217.96
HOSTWINDS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.paxful-claim.com/side.png
Requested by: Host: www.paxful-claim.com
URL: https://www.paxful-claim.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 142.11.217.96 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS: beardandme.com
Software: Apache /
Resource Hash: 247419253374924d63996b9d609528a408ffc8e32ca5fedc93b754a722443ca4

Request headers

:path: /side.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.paxful-claim.com
referer: https://www.paxful-claim.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.paxful-claim.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1

Response headers

date: Thu, 29 Apr 2021 12:00:26 GMT
last-modified: Fri, 22 Jan 2021 18:57:38 GMT
server: Apache
accept-ranges: bytes
content-length: 23883
content-type: image/png

GET
H2 200 mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v18/ 9 KB
9 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v18/mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Montserrat:400,500,700|Open+Sans:400,600,700&display=swap&subset=cyrillic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.paxful-claim.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1

Response headers

date: Thu, 22 Apr 2021 23:11:01 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:09:28 GMT
server: sffe
age: 564565
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9132
x-xss-protection: 0
expires: Fri, 22 Apr 2022 23:11:01 GMT

GET
H2 200 mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v18/ 9 KB
9 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v18/mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Montserrat:400,500,700|Open+Sans:400,600,700&display=swap&subset=cyrillic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b8e23a845bc6b7fd417d29182e0e38d353e64b5e12e06bb1de2b5ce063db1dcc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.paxful-claim.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1

Response headers

date: Tue, 27 Apr 2021 21:46:00 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:09:49 GMT
server: sffe
age: 137666
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9180
x-xss-protection: 0
expires: Wed, 27 Apr 2022 21:46:00 GMT

GET
H2 200 JTURjIg1_i6t8kCHKm45_dJE3gnD_vx3rCs.woff2
fonts.gstatic.com/s/montserrat/v15/ 13 KB
13 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v15/JTURjIg1_i6t8kCHKm45_dJE3gnD_vx3rCs.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Montserrat:400,500,700|Open+Sans:400,600,700&display=swap&subset=cyrillic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4c6cf0709b8e52572cae1fb57128acd0a5a453c9ce99dc3712a1860ff90c6bf8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.paxful-claim.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1

Response headers

date: Thu, 22 Apr 2021 21:48:50 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:11:15 GMT
server: sffe
age: 569496
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13612
x-xss-protection: 0
expires: Fri, 22 Apr 2022 21:48:50 GMT

GET
H/1.1 200
OK / Show response
api.ipify.org/ 23 B
260 B 547ms
139ms XHR
application/json 54.225.155.255
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://api.ipify.org/?format=json
Requested by: Host: www.paxful-claim.com
URL: https://www.paxful-claim.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.225.155.255 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-225-155-255.compute-1.amazonaws.com
Software: Cowboy /
Resource Hash: 167e15285664ffb44035c9f304a3267174ed8d78cf277bf3c3a966eb34adff62

Request headers

Referer: https://www.paxful-claim.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1

Response headers

Date: Thu, 29 Apr 2021 12:00:27 GMT
Via: 1.1 vegur
Server: Cowboy
Vary: Origin
Content-Type: application/json
Access-Control-Allow-Origin: https://www.paxful-claim.com
Connection: keep-alive
Content-Length: 23

GET
H2 200 sendLocation.php Show response
www.paxful-claim.com/ 10 B
85 B 960ms
955ms XHR
text/html 142.11.217.96
HOSTWINDS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.paxful-claim.com/sendLocation.php?ip=217.138.209.76
Requested by: Host: www.paxful-claim.com
URL: https://www.paxful-claim.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 142.11.217.96 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS: beardandme.com
Software: Apache /
Resource Hash: f3686bb328c6d40820a6b481204c82668862df2e06f10f8195252827ca24c624

Request headers

:path: /sendLocation.php?ip=217.138.209.76
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: www.paxful-claim.com
referer: https://www.paxful-claim.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.paxful-claim.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1

Response headers

date: Thu, 29 Apr 2021 12:00:27 GMT
content-encoding: br
server: Apache
content-length: 14
vary: Accept-Encoding
content-type: text/html; charset=UTF-8

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Paxful (Crypto Exchange)

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://www.paxful-claim.com/(Line 538) Message: {"ip":"217.138.209.76"}
console-api	log	URL: https://www.paxful-claim.com/(Line 550) Message: Successful

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.geetest.com
api.ipify.org
fonts.googleapis.com
fonts.gstatic.com
static.geetest.com
www.paxful-claim.com
142.11.217.96
2600:9000:20c8:fc00:1:149e:16c0:93a1
2a00:1450:4001:827::200a
2a00:1450:4001:829::2003
52.30.83.119
54.225.155.255
0fc0b442a468b0fb3019a5ba5f81ec87c43fe09f16c0513d7fa496a8a9d3db67
167e15285664ffb44035c9f304a3267174ed8d78cf277bf3c3a966eb34adff62
247419253374924d63996b9d609528a408ffc8e32ca5fedc93b754a722443ca4
35417626d8c29128917cd1c757e92189edc47b44a06124f54a577560a4d171fd
4c6cf0709b8e52572cae1fb57128acd0a5a453c9ce99dc3712a1860ff90c6bf8
5376ce85432db981f1bad9a3fe67b8cd715c5d770a563cca9d0a39c4e3f3bde0
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
824d7cc2627461b270716c538bd9943cc461384850cc584d99fee6a5d371b160
8ba195fffe0097e44a5dd29c35c092f10039e126cc9c4113330e8bf690c2461e
b8e23a845bc6b7fd417d29182e0e38d353e64b5e12e06bb1de2b5ce063db1dcc
cf4894dcbad595ca6c89c82773962caa441cdc757170cfca9fd5c883f9fe3ce2
d224e13968ff475256fcda7818b6cc5c74d04f0379dbc09278e67f9b1ae2eb1c
de6b5589779fa82ba1841301f56fe3d3d0d44a3150fd0c9dc9a5fd6197c2a5d5
f3686bb328c6d40820a6b481204c82668862df2e06f10f8195252827ca24c624
f47e607a8677ae0e183a44a44a47faeb32898161e272e0e95df34b10c4ab2887

www.paxful-claim.com Open in urlscan Pro 142.11.217.96 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

17 Requests

100 %HTTPS

50 %IPv6

5 Domains

6 Subdomains

6 IPs

3 Countries

135 kBTransfer

744 kBSize

0 Cookies

2 Outgoing links

Redirected requests

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

15 JavaScript Global Variables

0 Cookies

2 Console Messages

Indicators

www.paxful-claim.com Open in urlscan Pro
142.11.217.96 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

17
Requests

100 %
HTTPS

50 %
IPv6

5
Domains

6
Subdomains

6
IPs

3
Countries

135 kB
Transfer

744 kB
Size

0
Cookies

17 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!