updatingmy-details.xyz
Open in
urlscan Pro
192.64.116.18
Malicious Activity!
Public Scan
Effective URL: http://updatingmy-details.xyz/signin?mikerefrig
Submission Tags: phishing malicious Search All
Submission: On January 02 via api from US
Summary
This is the only time updatingmy-details.xyz was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: PayPal (Financial)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 5.196.90.120 5.196.90.120 | 16276 (OVH) (OVH) | |
5 | 2a00:1450:400... 2a00:1450:4001:809::200e | 15169 (GOOGLE) (GOOGLE) | |
4 | 192.64.116.18 192.64.116.18 | 22612 (NAMECHEAP...) (NAMECHEAP-NET) | |
1 | 2a00:1450:400... 2a00:1450:400c:c0c::9d | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:802::200a | 15169 (GOOGLE) (GOOGLE) | |
7 | 104.111.228.123 104.111.228.123 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
20 | 7 |
ASN15169 (GOOGLE, US)
www.google-analytics.com |
ASN22612 (NAMECHEAP-NET, US)
PTR: updating-my-details.xyz
updatingmy-details.xyz |
ASN16625 (AKAMAI-AS, US)
PTR: a104-111-228-123.deploy.static.akamaitechnologies.com
www.paypalobjects.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
paypalobjects.com
www.paypalobjects.com |
189 KB |
5 |
google-analytics.com
www.google-analytics.com |
38 KB |
4 |
updatingmy-details.xyz
updatingmy-details.xyz Failed |
581 KB |
1 |
googleapis.com
fonts.googleapis.com |
660 B |
1 |
doubleclick.net
stats.g.doubleclick.net |
84 B |
1 |
agritel.com
www.agritel.com |
764 B |
20 | 6 |
Domain | Requested by | |
---|---|---|
7 | www.paypalobjects.com |
updatingmy-details.xyz
www.paypalobjects.com |
5 | www.google-analytics.com |
www.google-analytics.com
updatingmy-details.xyz |
4 | updatingmy-details.xyz |
www.agritel.com
updatingmy-details.xyz |
1 | fonts.googleapis.com |
updatingmy-details.xyz
|
1 | stats.g.doubleclick.net |
www.google-analytics.com
|
1 | www.agritel.com | |
20 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.google-analytics.com GTS CA 1O1 |
2020-11-10 - 2021-02-02 |
3 months | crt.sh |
*.g.doubleclick.net GTS CA 1O1 |
2020-11-10 - 2021-02-02 |
3 months | crt.sh |
upload.video.google.com GTS CA 1O1 |
2020-11-10 - 2021-02-02 |
3 months | crt.sh |
www.paypal.com DigiCert SHA2 Extended Validation Server CA |
2020-01-09 - 2022-01-12 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
http://updatingmy-details.xyz/signin?mikerefrig
Frame ID: 7A2A580324C16F1BD5CB5A2E25D64F85
Requests: 20 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- http://www.agritel.com/redirect.php?url=http://updatingmy-details.xyz/signin?mikerefrig Page URL
- http://updatingmy-details.xyz/signin?mikerefrig Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- url /\.php(?:$|\?)/i
Debian (Operating Systems) Expand
Detected patterns
- headers server /Debian/i
Apache (Web Servers) Expand
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Google Analytics (Analytics) Expand
Detected patterns
- script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i
Google Font API (Font Scripts) Expand
Detected patterns
- html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://www.agritel.com/redirect.php?url=http://updatingmy-details.xyz/signin?mikerefrig Page URL
- http://updatingmy-details.xyz/signin?mikerefrig Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 1- http://www.google-analytics.com/analytics.js HTTP 307
- https://www.google-analytics.com/analytics.js
- http://www.google-analytics.com/collect HTTP 307
- https://www.google-analytics.com/collect
20 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
redirect.php
www.agritel.com/ |
856 B 764 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ Redirect Chain
|
46 KB 18 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
signin
updatingmy-details.xyz/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3-Q050 |
collect
www.google-analytics.com/j/ |
4 B 389 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3-Q050 |
collect
www.google-analytics.com/ Redirect Chain
|
35 B 73 B |
Other
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
signin
updatingmy-details.xyz/ |
808 B 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
stats.g.doubleclick.net/j/ |
1 B 84 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
app.646717df.css
updatingmy-details.xyz/css/ |
166 KB 31 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
app.44ccb1c3.js
updatingmy-details.xyz/js/ |
55 KB 13 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
chunk-vendors.1ad62e8c.js
updatingmy-details.xyz/js/ |
1 MB 535 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
2 KB 660 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
contextualLogin.css
www.paypalobjects.com/web/res/0cf/93e9a1153ea7f3f73a75f889809ea/css/ |
83 KB 15 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.ltr.css
www.paypalobjects.com/web/res/f50/21f59fb70071ff1853c2aaaf29047/css/ |
238 KB 42 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app.css
www.paypalobjects.com/web/res/282/e834c8c0d027446def0da02798e74/css/ |
129 KB 19 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
analytics.js
www.google-analytics.com/ |
46 KB 19 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
paypal-logo-129x32.svg
www.paypalobjects.com/images/shared/ |
5 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
PayPalSansSmall-Light.woff
www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/ |
46 KB 46 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
PayPalSansSmall-Regular.woff
www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/ |
46 KB 47 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
PayPalSansSmall-Regular.woff2
www.paypalobjects.com/digitalassets/c/paypal-ui/fonts/ |
18 KB 18 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3-Q050 |
collect
www.google-analytics.com/j/ |
2 B 73 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- updatingmy-details.xyz
- URL
- http://updatingmy-details.xyz/signin?mikerefrig
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: PayPal (Financial)17 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| trustedTypes boolean| crossOriginIsolated object| webpackJsonp object| __core-js_shared__ object| core object| regeneratorRuntime function| TaskRouterClient function| LookupsClient object| google_tag_data function| ga object| gaplugins boolean| ga-disable-UA-150348504-1 object| gaGlobal object| gaData3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.updatingmy-details.xyz/ | Name: _gat Value: 1 |
|
.updatingmy-details.xyz/ | Name: _gid Value: GA1.2.1022671654.1609630032 |
|
.updatingmy-details.xyz/ | Name: _ga Value: GA1.2.334721997.1609630032 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fonts.googleapis.com
stats.g.doubleclick.net
updatingmy-details.xyz
www.agritel.com
www.google-analytics.com
www.paypalobjects.com
updatingmy-details.xyz
104.111.228.123
192.64.116.18
2a00:1450:4001:802::200a
2a00:1450:4001:809::200e
2a00:1450:400c:c0c::9d
5.196.90.120
01f5044080128725f0d2758cb45cccd511b6676bb7f689ef464aaa548e74cf62
2e14d75e2d800e91fe16f73ded0de5366963c7971d7259f659672e7f0266475c
4ef1aeef83add64ee4a16d9a74853169786ec9b575de2746a40d2b59df277ded
70085906f8dbfa76fb9fea67db27635e52ed5a0e8347e885afe27879a47f61f8
843e67ad522a908162007f4b7601819a5bbfef00e38ac7aec778766da8b7b2ab
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
ae79dcc3eb016922caa1d095cfd936446bc65a46bb3364b242dfc556f7e3c6a8
af93d1d952b2dc42c029871cbbb92988835b31c86d4f0cb6a9674b1d1714a20f
b0ee4a8c97b3ef2d302dc9832a5c051fd592ce4233220c4ab8ffce17fe0fb015
b3cc50b9e94bbecaaeb1079b64b8ca50616d1732824964c1cc2c5422627a0ec5
cfa9a2dcea382799077eb020f4b9f507c3bac67e481f160325b3b66a4a902bf2
d9c91332197755dee4526c466659e26af17448f2cf68657bc78765a061a67ec4
e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b
ec247b5099d783162ef5bb83afbd99b20a5b718d85372111d8df79e0ddfd8283
f95ffb67c3bcd64463400ff6f32e06ce143b243f6c3b7df5bb542e568ab598f8