huspitals.ml
Open in
urlscan Pro
104.209.221.91
Malicious Activity!
Public Scan
URL:
http://huspitals.ml/Ppals/cy.htm
Submission: On December 24 via api from CA
Submission: On December 24 via api from CA
Summary
This website contacted 2 IPs
in 3 countries
across 4 domains to perform 22 HTTP transactions.
The main IP is 104.209.221.91, located in
Boydton, United States and
belongs to MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US.
The main domain is huspitals.ml.
This is the only time huspitals.ml was scanned on urlscan.io!
This is the only time huspitals.ml was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: PayPal (Financial)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 | 104.209.221.91 104.209.221.91 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation) | |
| 1 22 | 2.18.232.222 2.18.232.222 | 16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies) | |
| 1 1 | 104.109.71.98 104.109.71.98 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
| 22 | 2 |
1
104.209.221.91
(Boydton, United States)
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)
| huspitals.ml |
22
2.18.232.222
(European Union)
ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a2-18-232-222.deploy.static.akamaitechnologies.com
ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a2-18-232-222.deploy.static.akamaitechnologies.com
| www.paypalobjects.com | |
| t.paypal.com |
1
104.109.71.98
(Amsterdam, Netherlands)
ASN20940 (AKAMAI-ASN1, US)
PTR: a104-109-71-98.deploy.static.akamaitechnologies.com
ASN20940 (AKAMAI-ASN1, US)
PTR: a104-109-71-98.deploy.static.akamaitechnologies.com
| ak1s.abmr.net |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 21 |
paypalobjects.com
1 redirects
www.paypalobjects.com |
336 KB |
| 1 |
paypal.com
t.paypal.com |
687 B |
| 1 |
abmr.net
1 redirects
ak1s.abmr.net |
706 B |
| 1 |
huspitals.ml
huspitals.ml |
26 KB |
| 22 | 4 |
| Domain | Requested by | |
|---|---|---|
| 21 | www.paypalobjects.com |
1 redirects
huspitals.ml
www.paypalobjects.com |
| 1 | t.paypal.com | |
| 1 | ak1s.abmr.net | 1 redirects |
| 1 | huspitals.ml | |
| 22 | 4 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| www.paypal.com |
| www.x.com |
| www.paypal.co.uk |
| www.paypal.ca |
| www.paypal.com.au |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| www.paypal.com DigiCert SHA2 Extended Validation Server CA |
2018-08-14 - 2020-08-18 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
http://huspitals.ml/Ppals/cy.htm
Frame ID: 199B4300D8106EEA376FF36DEB8ABDEB
Requests: 22 HTTP requests in this frame
Screenshot
Detected technologies
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
PayPal
(Payment Processors)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- env /^PAYPAL$/i
Modernizr
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- env /^Modernizr$/i
SiteCatalyst
(Analytics)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- env /^s_(?:account|objectID|code|INST)$/i
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- env /^jQuery$/i
Page Statistics
32 Outgoing links
These are links going to different origins than the main page.
URL: https://www.paypal.com/uk/home
Title: Personal
Title: Personal
Search URL Search Domain Scan URL
URL: https://www.paypal.com/uk/business
Title: Business
Title: Business
Search URL Search Domain Scan URL
URL: https://www.paypal.com/uk/cgi-bin/webscr?cmd=_account-recovery&from=PayPal
Title: ? Close Forgot your email address? Enter up to 3 of your email addresses and we'll help you find your account. Get started
Title: ? Close Forgot your email address? Enter up to 3 of your email addresses and we'll help you find your account. Get started
Search URL Search Domain Scan URL
URL: https://www.paypal.com/uk/cgi-bin/webscr?cmd=_account-recovery&from=PayPal
Title: Get started
Title: Get started
Search URL Search Domain Scan URL
URL: https://www.paypal.com/uk/cgi-bin/webscr?cmd=_registration-run&from=PayPal
Title: Sign up
Title: Sign up
Search URL Search Domain Scan URL
URL: https://www.paypal.com/
Search URL Search Domain Scan URL
URL: https://www.paypal.com/uk/buy
Title: Buy
Title: Buy
Search URL Search Domain Scan URL
URL: https://www.paypal.com/uk/make-a-payment
Title: Make a payment
Title: Make a payment
Search URL Search Domain Scan URL
URL: https://www.paypal.com/uk/buying-online
Title: Buying online
Title: Buying online
Search URL Search Domain Scan URL
URL: https://www.paypal.com/uk/buying-in-shops
Title: Buying in shops
Title: Buying in shops
Search URL Search Domain Scan URL
URL: https://www.paypal.com/uk/mobile
Title: Buying on your mobile
Title: Buying on your mobile
Search URL Search Domain Scan URL
URL: https://www.paypal.com/uk/sell
Title: Sell
Title: Sell
Search URL Search Domain Scan URL
URL: https://www.paypal.com/uk/receive
Title: Request a payment
Title: Request a payment
Search URL Search Domain Scan URL
URL: https://www.paypal.com/uk/how-to-sell-online
Title: How to sell online
Title: How to sell online
Search URL Search Domain Scan URL
URL: https://www.paypal.com/uk/transfer
Title: Transfer
Title: Transfer
Search URL Search Domain Scan URL
URL: https://www.paypal.com/uk/send
Title: Send someone money
Title: Send someone money
Search URL Search Domain Scan URL
URL: https://www.paypal.com/uk/shopping
Title: Shopping
Title: Shopping
Search URL Search Domain Scan URL
URL: https://www.paypal.com/uk/cgi-bin/webscr?cmd=_registration-run
Title: Sign up
Title: Sign up
Search URL Search Domain Scan URL
URL: https://www.paypal.com/uk/cgi-bin/helpweb?cmd=_help
Title: Help
Title: Help
Search URL Search Domain Scan URL
URL: https://www.paypal.com/uk/cgi-bin/helpscr?cmd=_help&t=escalateTab
Title: Contact us
Title: Contact us
Search URL Search Domain Scan URL
URL: https://www.paypal.com/uk/fees
Title: Fees
Title: Fees
Search URL Search Domain Scan URL
URL: https://www.paypal.com/uk/safety
Title: Safety
Title: Safety
Search URL Search Domain Scan URL
URL: https://www.x.com/developers/paypal/programs/countries/uk
Title: Developers
Title: Developers
Search URL Search Domain Scan URL
URL: https://www.paypal.co.uk/blog
Title: Blog
Title: Blog
Search URL Search Domain Scan URL
URL: https://www.paypal.com/uk/about
Title: About Us
Title: About Us
Search URL Search Domain Scan URL
URL: https://www.paypal.ca/
Title: Canada
Title: Canada
Search URL Search Domain Scan URL
URL: https://www.paypal.com/mx
Title: Mexico
Title: Mexico
Search URL Search Domain Scan URL
URL: https://www.paypal.co.uk/
Title: United Kingdom
Title: United Kingdom
Search URL Search Domain Scan URL
URL: https://www.paypal.com.au/
Title: Australia
Title: Australia
Search URL Search Domain Scan URL
URL: https://www.paypal.com/uk/cgi-bin/webscr?cmd=_display-country-functionality-outside
Title: See all countries
Title: See all countries
Search URL Search Domain Scan URL
URL: https://www.paypal.com/uk/cgi-bin/webscr?cmd=p/gen/ua/policy_privacy-outside
Title: Privacy policy
Title: Privacy policy
Search URL Search Domain Scan URL
URL: https://www.paypal.com/uk/cgi-bin/webscr?cmd=p/gen/ua/ua-outside
Title: Legal agreements
Title: Legal agreements
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 10- https://www.paypalobjects.com/webstatic/i/ex_ce2/scr/scr_gray-bkgd.png HTTP 302
- https://ak1s.abmr.net/is/www.paypalobjects.com?U=/webstatic/i/ex_ce2/scr/scr_gray-bkgd.png&V=3-b6G8b5NmsjVxTTDZuccXqWCvlFZH%2f6PQkOGsRclT8VKIao460m+gELOEGhbkOj%2fY&I=BC99F9C4092FE23&D=paypalobjects.com&01AD=1& HTTP 302
- https://www.paypalobjects.com/webstatic/i/ex_ce2/scr/scr_gray-bkgd.png?01AD=3OhqpCoNq_BMN-7ZP3k2EDXnQTHo-TQXq9a57-Gj3wHKaqX3gInbN7g&01RI=BC99F9C4092FE23&01NA=na
22 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
cy.htm
huspitals.ml/Ppals/ |
25 KB 26 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
3a7fe10706977841840e4e16a475f0.css
www.paypalobjects.com/eboxapps/css/55/ |
87 KB 14 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
60bbeafcbc85a0f7883ec53f63ed67.js
www.paypalobjects.com/eboxapps/js/3c/ |
48 KB 15 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
logo_paypal_106x29.png
www.paypalobjects.com/webstatic/i/ex_ce2/logo/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
emea-shoppingbags.png
www.paypalobjects.com/webstatic/emea/i/ |
14 KB 14 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
emea-shoe-sale.png
www.paypalobjects.com/webstatic/emea/i/ |
16 KB 16 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
emea-couple.png
www.paypalobjects.com/webstatic/emea/i/ |
15 KB 15 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
6186e50147f85246590133c26ca7e0.js
www.paypalobjects.com/eboxapps/js/b1/ |
203 KB 64 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
9cd0103aa4951e13ec7b539f5d2435.js
www.paypalobjects.com/eboxapps/js/7f/ |
40 KB 12 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
pp_jscode_080706.js
www.paypalobjects.com/js/site_catalyst/ |
60 KB 23 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
pa.js
www.paypalobjects.com/pa/js/ |
34 KB 12 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
scr_gray-bkgd.png
www.paypalobjects.com/webstatic/i/ex_ce2/scr/ Redirect Chain
|
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
scr_content-bkgd.png
www.paypalobjects.com/webstatic/i/ex_ce2/scr/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
sprite_ia.png
www.paypalobjects.com/webstatic/i/ex_ce2/sprite/ |
18 KB 19 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
homepage-gradient-bottom.png
www.paypalobjects.com/webstatic/mktg/consumer/pages/home/ |
944 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
interior-gradient-top.png
www.paypalobjects.com/webstatic/mktg/consumer/gradients/ |
952 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
emea-hero-homepage-couple.jpg
www.paypalobjects.com/webstatic/emea/i/ |
96 KB 97 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
vertical-gradient-sprite.png
www.paypalobjects.com/webstatic/mktg/consumer/pages/home/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
homepage-gradient-top.png
www.paypalobjects.com/webstatic/mktg/consumer/pages/home/ |
955 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
sprite_ia.png
www.paypalobjects.com/webstatic/i/ex_ce2/sprite/ |
18 KB 19 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
icon_feedback.gif
www.paypalobjects.com/webstatic/i/ex_ce2/icon/ |
715 B 929 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ts
t.paypal.com/ |
42 B 687 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: PayPal (Financial)90 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask object| antiClickjack undefined| Tracker object| Modernizr string| jsPath string| siteCatalystPageName string| siteCatalystC7 string| siteCatalystAccountNumber string| feedback_link boolean| isPaymentFlow boolean| isSiteRedirect string| languageCode string| countryCode string| serverName string| commentCardCmd string| accountNumber string| miniBrowser string| sitefb_plus_icon string| rLogId string| showSitefbIcon string| _sp string| _rp function| _fC object| PAYPAL function| $ function| jQuery function| DP_jQuery_1545665437123 object| Iconix string| custom_var number| _poE number| _poX number| _sH object| _doc object| _w string| _ht string| _hr number| _tm number| _kp number| _sW undefined| baseurl function| O_LC function| PP_O_LC function| _fPe function| _fPx function| O_GoT function| PP_O_GoT function| Mini_O_GoT function| siteFeedBackImage function| assignSiteCatalystVars function| PayPalURL undefined| url_var undefined| url_var_temp object| paypal_url string| _ht_temp string| _hr_temp string| custom_var_temp undefined| ppbce number| getOpinionLabURL function| OpinionLabOnCloseEvent function| showpopup object| jQuery171017446361089465312 number| trident_verOffset string| sc_code_ver string| s_account object| s function| s_doPlugins string| s_code string| s_objectID function| s_gi function| s_giqf string| s_an function| s_sp function| s_jn function| s_rep function| s_d function| s_fe function| s_fa function| s_ft object| s_c_il number| s_c_in number| s_giq function| scOnload object| fpti string| fptiserverurl object| _ifpti string| readerContent string| j object| s_i_paypal2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| .huspitals.ml/ | Name: s_sess Value: %20s_ppv%3D100%3B%20s_cc%3Dtrue%3B%20v31%3Dmain%253Amktg%253Apersonal%253A%253Ahome%3B%20s_sq%3D%3B |
|
| .huspitals.ml/ | Name: s_pers Value: %20s_fid%3D4709D89D1522106A-3870789D7BB9E095%7C1608823837707%3B%20gpv_c43%3Dmain%253Amktg%253Apersonal%253A%253Ahome%7C1545667237711%3B%20tr_p1%3Dmain%253Amktg%253Apersonal%253A%253Ahome%7C1545667237714%3B%20gpv_events%3Dno%2520value%7C1545667237716%3B |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ak1s.abmr.net
huspitals.ml
t.paypal.com
www.paypalobjects.com
104.109.71.98
104.209.221.91
2.18.232.222
0a2da1b9e4aaba875a1785dbe02298c3004da77ac7065a90d340ffdff7d7d52d
0de9dc4df795b30e9fa458090c49ab8137e65a7901803c81895cef56ac543d13
18c9428f5ed837e027c6fcf29afe9d1f63a1e1e5b53ee1dc6373cf1cd1ea22aa
44394b743f692cfabfeeb2e5e5bfa82eda8b38cd8948f51e420ace08db5d377c
6905e777eb369cbb997b42ec09a2e45406b3d5f525376dd090625e6bfc910395
6c7f4c40b3d0a594b08bb341aab45af2a7b6ac1c7906eaa7d2d642d6a5a0e91f
6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93
713be2b4e284567cbe1052bf8b5e43b0e4f6cf232b4f0cb429e51c1a748bac22
8238549d499c23715725087f4d5a36d2cf6e307a349d03bed87332ea2c22d438
8989f902aac638178b44581ddfd4245ea17d61c77c450657bf752083c95c688f
ac6d3f82bae1ade3fa1962f2b07d2f75376a6993f18f1af1a60f8fb3e793a090
b1294cdd8fd123c39e49b9a69c03d4b30043395338297d1ff4c0535a39cfb239
bbf40134304a63796fa2b6a75466a19d6e675c205af5cb0c41387def3841bd04
c0232ad683e60dbba1b5909f9ca847fa56f56779c502002ce1d85759ce98f041
c4539b6d99ff1b7e97943f3dcbb3a1eb45b77b81248455e3c15f374487ddf9eb
c6cfdb3d12a4d29890050daf3a841b080ff563652d912c088023f1947a5e2951
c710afe96170cf47ae5eac49f6f69cbe39be80579b7adbad6f8e486a8e844e8e
c7c4e0e59643936db3261d9e3cf073934f1a5e0ff1c2a8d52879289d9caea034
edb1b1c07187853ea14d33c745b9fc4eb901a923c6fc1206b76af2c320f1fc49
f2c173be6a198adf60868c86f6e093f3b850bef0da34689e981fe218ad2a43a1
fb2434a896e3e106be72dbbcb361d048b3e1edc30239ae94113becd33ec4fa39