support-paypal.com
Open in
urlscan Pro
2606:4700:3034::ac43:b465
Malicious Activity!
Public Scan
Effective URL: https://support-paypal.com/de/start/a1b2c3/77a35d598fd2ca2e39e1921e03076b28/login/?index=56768&feeder=432e53a8af868ea0d2cf6...
Submission: On March 04 via manual from US — Scanned from DE
Summary
TLS certificate: Issued by GTS CA 1P5 on February 28th 2024. Valid for: 3 months.
This is the only time support-paypal.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: PayPal (Financial)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
4 22 | 2606:4700:303... 2606:4700:3034::ac43:b465 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 2 | 2606:4700:303... 2606:4700:3030::6815:1231 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 192.229.221.25 192.229.221.25 | () () | |
23 | 3 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
24 |
support-paypal.com
6 redirects
support-paypal.com |
166 KB |
1 |
paypalobjects.com
www.paypalobjects.com |
108 KB |
23 | 2 |
Domain | Requested by | |
---|---|---|
24 | support-paypal.com |
6 redirects
support-paypal.com
|
1 | www.paypalobjects.com |
support-paypal.com
|
23 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
support-paypal.com GTS CA 1P5 |
2024-02-28 - 2024-05-28 |
3 months | crt.sh |
www.paypal.com DigiCert SHA2 Extended Validation Server CA |
2023-10-12 - 2024-10-31 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://support-paypal.com/de/start/a1b2c3/77a35d598fd2ca2e39e1921e03076b28/login/?index=56768&feeder=432e53a8af868ea0d2cf622a9818a2cdffa5d48d
Frame ID: FCF338D1900BDE22D52F4ACDB6E5C006
Requests: 23 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://support-paypal.com/de/start
HTTP 301
http://support-paypal.com/de/start/ HTTP 301
https://support-paypal.com/de/start/ HTTP 302
https://support-paypal.com/de/start/white.php?index=56768&feeder=432e53a8af868ea0d2cf622a9818a2cdffa5d48d Page URL
-
https://support-paypal.com/de/start/a1b2c3/77a35d598fd2ca2e39e1921e03076b28?index=56768&feeder=432e53a8...
HTTP 301
http://support-paypal.com/de/start/a1b2c3/77a35d598fd2ca2e39e1921e03076b28/?index=56768&feeder=432e53a... HTTP 301
https://support-paypal.com/de/start/a1b2c3/77a35d598fd2ca2e39e1921e03076b28/?index=56768&feeder=432e53a... HTTP 302
https://support-paypal.com/de/start/a1b2c3/77a35d598fd2ca2e39e1921e03076b28/login/?index=56768&feeder=4... Page URL
Detected technologies
AngularJS (JavaScript Frameworks) ExpandDetected patterns
- \bangular.{0,32}\.js
PayPal (Payment Processors) Expand
Detected patterns
- paypalobjects\.com
Font Awesome (Font Scripts) Expand
Detected patterns
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://support-paypal.com/de/start
HTTP 301
http://support-paypal.com/de/start/ HTTP 301
https://support-paypal.com/de/start/ HTTP 302
https://support-paypal.com/de/start/white.php?index=56768&feeder=432e53a8af868ea0d2cf622a9818a2cdffa5d48d Page URL
-
https://support-paypal.com/de/start/a1b2c3/77a35d598fd2ca2e39e1921e03076b28?index=56768&feeder=432e53a8af868ea0d2cf622a9818a2cdffa5d48d
HTTP 301
http://support-paypal.com/de/start/a1b2c3/77a35d598fd2ca2e39e1921e03076b28/?index=56768&feeder=432e53a8af868ea0d2cf622a9818a2cdffa5d48d HTTP 301
https://support-paypal.com/de/start/a1b2c3/77a35d598fd2ca2e39e1921e03076b28/?index=56768&feeder=432e53a8af868ea0d2cf622a9818a2cdffa5d48d HTTP 302
https://support-paypal.com/de/start/a1b2c3/77a35d598fd2ca2e39e1921e03076b28/login/?index=56768&feeder=432e53a8af868ea0d2cf622a9818a2cdffa5d48d Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://support-paypal.com/de/start HTTP 301
- http://support-paypal.com/de/start/ HTTP 301
- https://support-paypal.com/de/start/ HTTP 302
- https://support-paypal.com/de/start/white.php?index=56768&feeder=432e53a8af868ea0d2cf622a9818a2cdffa5d48d
23 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H3 |
white.php
support-paypal.com/de/start/ Redirect Chain
|
787 B 951 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Primary Request
/
support-paypal.com/de/start/a1b2c3/77a35d598fd2ca2e39e1921e03076b28/login/ Redirect Chain
|
6 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
jquery.min.js
support-paypal.com/de/start/bower_components/jquery/dist/ |
85 KB 31 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
ua-parser.min.js
support-paypal.com/de/start/bower_components/ua-parser-js/dist/ |
17 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
font-awesome.min.css
support-paypal.com/de/start/bower_components/font-awesome/css/ |
30 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
core_form.js
support-paypal.com/de/start/core/form/ |
16 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
core_token.js
support-paypal.com/de/start/core/token/ |
7 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
angular.min.js
support-paypal.com/de/start/bower_components/angular/ |
165 KB 59 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
core_form.css
support-paypal.com/de/start/core/form/ |
3 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
css.css
support-paypal.com/de/start/login/form/ |
624 B 781 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
fonts.css
support-paypal.com/de/start/login/ |
5 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
primary.css
support-paypal.com/de/start/login/ |
4 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
logo.svg
support-paypal.com/de/start/login/ |
1 KB 1006 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
tdg
support-paypal.com/de/start/login/ |
45 B 482 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
form.js
support-paypal.com/de/start/login/form/ |
3 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
ng.js
support-paypal.com/de/start/login/ng/ |
5 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
token.js
support-paypal.com/de/start/login/token/ |
1 KB 994 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sprite_countries_flag4.png
www.paypalobjects.com/webstatic/mktg/icons/ |
108 KB 108 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
PayPalSansBig-Regular.woff2
support-paypal.com/de/start/login/ |
38 KB 39 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
PayPalSansBig-Medium.woff2
support-paypal.com/de/start/login/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
home.php
support-paypal.com/de/start/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
home.php
support-paypal.com/de/start/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
PayPalOpen-Regular.woff2
support-paypal.com/de/start/login/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- support-paypal.com
- URL
- https://support-paypal.com/de/start/login/PayPalSansBig-Medium.woff2
- Domain
- support-paypal.com
- URL
- https://support-paypal.com/de/start/home.php?pl=token&link=Payplal&bid=77a35d598fd2ca2e39e1921e03076b28&callback=jQuery321020954865692145397_1709565378744&data=%7B%22online_bider%22%3A1%2C%22w%22%3A0%2C%22dev%22%3A3%7D&_=1709565378745
- Domain
- support-paypal.com
- URL
- https://support-paypal.com/de/start/home.php?pl=token&link=Payplal&bid=77a35d598fd2ca2e39e1921e03076b28&callback=jQuery321020954865692145397_1709565378746&data=%7B%22mes%22%3A%22User%20on%20login%20page%22%7D&_=1709565378747
- Domain
- support-paypal.com
- URL
- https://support-paypal.com/de/start/login/PayPalOpen-Regular.woff2
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: PayPal (Financial)0 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
support-paypal.com/de/start | Name: real Value: OK |
|
support-paypal.com/ | Name: bid Value: 77a35d598fd2ca2e39e1921e03076b28 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
support-paypal.com
www.paypalobjects.com
support-paypal.com
192.229.221.25
2606:4700:3030::6815:1231
2606:4700:3034::ac43:b465
0fda30cf243e7650bf3e1666eddeb4fbba6b788ede36753eda5e2964cc14c896
21f89c7c27f0eab13388645aea1eedb4a342c06333a14d74c1a10dfca04d6455
2351bbc39303736cd3a670db10427adc13c256dd6b639f0545bfd104947d3427
35f73a70cca067828be9e0a712b8b48908e1bc4490637c62bd70158f95cd6e27
4a3f837516f5144bbf9614c79b8d37332dbad4ec6f54317d5357ac1fbadcbffb
4e23ba408fa1a8870e10a23155e3911db86edba915eee9e6525c5a6cffcf5cee
62cfb054088e29a0e576b434030c236c6101af0599e6f55cfe89b35a6186fba4
6d1fcbb829fad19d85ece061e1f6f4ab0b556daf7998be1cf089c36392f4dd81
71a95aac9f1c3dc89fe24406f1ac39f3c397eccddfd092bfe9666b2408a0a26f
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
871e3d40b287df9ac62e42bb7c658136d81a2cb0e3ce6514e451641a4827d1f9
907d66973b8a86469b449cbf61d1dd0e17df8cbdb894efb6ea47cae06cd67c3f
93b238a08f88da511693559daf9fee3942bc2ff92c0d3666e2f92ade28c7fcc2
a2282c17fae39d990ffc9c7b707d6618efef6ac554b3e9611dadb841a4c16074
b0fd9efb697511c369cdfff19453d3d146166479963f53e442c4943b4e14d86f
ebf7d5ae31a4082e6eb0ae47f8acfc2f60902605c3dfafe71837f8a7c05fafb6
f11f915b0504738d878e9f2d77abc7d14e7bd6553a9000fb1e6eeafe0c7eca39
f9035e34f5734e89ddb03b601b1c0fd58323a93f176c5c7e220d7aa7a2062ed5