paypal-account-transaction.com Open in urlscan Pro
5.188.33.63  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response paypal-account-transaction.com/	727 B 980 B	1102ms 187ms	Document text/html	5.188.33.63 GHOST
General Check archive.org Show headers Download Go to Full URL http://paypal-account-transaction.com/ Protocol HTTP/1.1 Server 5.188.33.63 Central, Hong Kong, ASN202422 (GHOST, LU), Reverse DNS facai678.example.com Software nginx / Resource Hash d42012c7e412c8ce71cc24ca87004fd4f24a976b8de791cdc5904bc04332851c Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Cache-Control max-age=0 no-cache Connection keep-alive Content-Length 727 Content-Type text/html; charset=utf-8 Date Sun, 17 Apr 2022 11:20:24 GMT Last-Modified Sat, 16 Apr 2022 16:27:48 GMT Server nginx
GET H/1.1	200 OK	app.068ef265af2f69ec1d6046f8360902d4.css paypal-account-transaction.com/static/css/	738 KB 137 KB	196ms 195ms	Stylesheet text/css	5.188.33.63 GHOST
General Check archive.org Show headers Download Go to Full URL http://paypal-account-transaction.com/static/css/app.068ef265af2f69ec1d6046f8360902d4.css Requested by Host: paypal-account-transaction.com URL: http://paypal-account-transaction.com/ Protocol HTTP/1.1 Server 5.188.33.63 Central, Hong Kong, ASN202422 (GHOST, LU), Reverse DNS facai678.example.com Software nginx / Resource Hash 75f08f024d616d744fcad0f1c0e711bf32bd80c259b5a48895ebf62e5672f99c Request headers accept-language de-DE,de;q=0.9 Referer http://paypal-account-transaction.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers Date Sun, 17 Apr 2022 11:20:24 GMT Content-Encoding gzip Last-Modified Sat, 16 Apr 2022 16:27:48 GMT Server nginx Vary Accept-Encoding X-Cache MISS Content-Type text/css; charset=utf-8 Cache-Control max-age=43200 Transfer-Encoding chunked Connection keep-alive Expires Sun, 17 Apr 2022 23:20:24 GMT
GET H/1.1	200 OK	manifest.3ad1d5771e9b13dbdad2.js Show response paypal-account-transaction.com/static/js/	800 B 1 KB	221ms 221ms	Script application/javascript	5.188.33.63 GHOST
General Check archive.org Show headers Download Go to Full URL http://paypal-account-transaction.com/static/js/manifest.3ad1d5771e9b13dbdad2.js Requested by Host: paypal-account-transaction.com URL: http://paypal-account-transaction.com/ Protocol HTTP/1.1 Server 5.188.33.63 Central, Hong Kong, ASN202422 (GHOST, LU), Reverse DNS facai678.example.com Software nginx / Resource Hash fcdf3becb34727e89ae7395ac70df92e4537639ae903784e201f479dd70f3ef0 Request headers accept-language de-DE,de;q=0.9 Referer http://paypal-account-transaction.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers Date Sun, 17 Apr 2022 11:20:24 GMT Last-Modified Sat, 16 Apr 2022 16:27:48 GMT Server nginx X-Cache MISS Content-Type application/javascript; charset=utf-8 Cache-Control max-age=43200 Connection keep-alive Content-Length 800 Expires Sun, 17 Apr 2022 23:20:24 GMT
GET H/1.1	200 OK	vendor.1335c66d67a2d991e3dd.js Show response paypal-account-transaction.com/static/js/	4 MB 899 KB	365ms 189ms	Script application/javascript	5.188.33.63 GHOST
General Check archive.org Show headers Download Go to Full URL http://paypal-account-transaction.com/static/js/vendor.1335c66d67a2d991e3dd.js Requested by Host: paypal-account-transaction.com URL: http://paypal-account-transaction.com/ Protocol HTTP/1.1 Server 5.188.33.63 Central, Hong Kong, ASN202422 (GHOST, LU), Reverse DNS facai678.example.com Software nginx / Resource Hash 8d4e8460a070d9e6b9a4cc78092b8b8bfd08fc2552d7ee6c8aff3d0d7aedbb88 Request headers accept-language de-DE,de;q=0.9 Referer http://paypal-account-transaction.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers Date Sun, 17 Apr 2022 11:20:24 GMT Content-Encoding gzip Last-Modified Sat, 16 Apr 2022 16:27:48 GMT Server nginx Vary Accept-Encoding X-Cache MISS Content-Type application/javascript; charset=utf-8 Cache-Control max-age=43200 Transfer-Encoding chunked Connection keep-alive Expires Sun, 17 Apr 2022 23:20:24 GMT
GET H/1.1	200 OK	app.951c0f8e70e0a15f1331.js Show response paypal-account-transaction.com/static/js/	106 KB 38 KB	381ms 199ms	Script application/javascript	5.188.33.63 GHOST
General Check archive.org Show headers Download Go to Full URL http://paypal-account-transaction.com/static/js/app.951c0f8e70e0a15f1331.js Requested by Host: paypal-account-transaction.com URL: http://paypal-account-transaction.com/ Protocol HTTP/1.1 Server 5.188.33.63 Central, Hong Kong, ASN202422 (GHOST, LU), Reverse DNS facai678.example.com Software nginx / Resource Hash 484aebc150dd927248478b8ed2710bf6ebc472e79a7d2a4ad122b97ebbba4ff8 Request headers accept-language de-DE,de;q=0.9 Referer http://paypal-account-transaction.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers Date Sun, 17 Apr 2022 11:20:24 GMT Content-Encoding gzip Last-Modified Sat, 16 Apr 2022 16:27:48 GMT Server nginx Vary Accept-Encoding X-Cache MISS Content-Type application/javascript; charset=utf-8 Cache-Control max-age=43200 Transfer-Encoding chunked Connection keep-alive Expires Sun, 17 Apr 2022 23:20:24 GMT
GET H2	200	cityjson Show response pv.sohu.com/	77 B 236 B	928ms 256ms	Script text/json	13.69.222.243 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://pv.sohu.com/cityjson?ie=utf-8 Requested by Host: paypal-account-transaction.com URL: http://paypal-account-transaction.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.69.222.243 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software nginx/1.0.15 / Resource Hash bfa25df8a7cbeefa96c7ec7758568082bf6bdf1cfd8ea0e53a14dae1bbbff46f Request headers accept-language de-DE,de;q=0.9 Referer http://paypal-account-transaction.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers date Sun, 17 Apr 2022 11:20:24 GMT fss-proxy Powered by 2957110.4529984.3683150, Powered by 4544565.5003327.7961660 server nginx/1.0.15 content-length 77 content-type text/json; charset=utf-8
GET H/1.1	200 OK	getiplang Show response paypal-account-transaction.com/auth/	85 B 272 B	555ms 555ms	XHR application/json	5.188.33.63 GHOST
General Check archive.org Show headers Download Go to Full URL http://paypal-account-transaction.com/auth/getiplang Requested by Host: paypal-account-transaction.com URL: http://paypal-account-transaction.com/static/js/vendor.1335c66d67a2d991e3dd.js Protocol HTTP/1.1 Server 5.188.33.63 Central, Hong Kong, ASN202422 (GHOST, LU), Reverse DNS facai678.example.com Software nginx / Resource Hash 7b27416ef702ee38d8608cf59520b73320902b0ff656967754d73723d50b2255 Request headers Accept application/json, text/plain, */* Referer http://paypal-account-transaction.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers Date Sun, 17 Apr 2022 11:20:26 GMT Cache-Control no-cache Server nginx Connection keep-alive Content-Length 85 Content-Type application/json; charset=utf-8
GET H/1.1	200 OK	momgram.png paypal-account-transaction.com/static/assets/img/	2 KB 2 KB	194ms 194ms	Image image/png	5.188.33.63 GHOST
General Check archive.org Show headers Download Go to Show image Full URL http://paypal-account-transaction.com/static/assets/img/momgram.png Requested by Host: paypal-account-transaction.com URL: http://paypal-account-transaction.com/static/css/app.068ef265af2f69ec1d6046f8360902d4.css Protocol HTTP/1.1 Server 5.188.33.63 Central, Hong Kong, ASN202422 (GHOST, LU), Reverse DNS facai678.example.com Software nginx / Resource Hash b3f1bf1d5e25838bcad8535a2b700486644f4ea888e46c77d3e82783cb9da1b4 Request headers accept-language de-DE,de;q=0.9 Referer http://paypal-account-transaction.com/static/css/app.068ef265af2f69ec1d6046f8360902d4.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers Date Sun, 17 Apr 2022 11:20:25 GMT Last-Modified Sat, 16 Apr 2022 16:27:48 GMT Server nginx X-Cache MISS Content-Type image/png Cache-Control max-age=43200 Connection keep-alive Content-Length 1768 Expires Sun, 17 Apr 2022 23:20:25 GMT
GET H/1.1	200 OK	sprite_countries_flag4.d3682f0.png paypal-account-transaction.com/static/img/	71 KB 71 KB	192ms 192ms	Image image/png	5.188.33.63 GHOST
General Check archive.org Show headers Download Go to Show image Full URL http://paypal-account-transaction.com/static/img/sprite_countries_flag4.d3682f0.png Requested by Host: paypal-account-transaction.com URL: http://paypal-account-transaction.com/static/css/app.068ef265af2f69ec1d6046f8360902d4.css Protocol HTTP/1.1 Server 5.188.33.63 Central, Hong Kong, ASN202422 (GHOST, LU), Reverse DNS facai678.example.com Software nginx / Resource Hash 9c14b809ca4d5de12a569239d46ab8ef5f7ac1b3804c9801583cbafb66d3e550 Request headers accept-language de-DE,de;q=0.9 Referer http://paypal-account-transaction.com/static/css/app.068ef265af2f69ec1d6046f8360902d4.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers Date Sun, 17 Apr 2022 11:20:25 GMT Last-Modified Sat, 16 Apr 2022 16:27:48 GMT Server nginx X-Cache MISS Content-Type image/png Cache-Control max-age=43200 Connection keep-alive Content-Length 72320 Expires Sun, 17 Apr 2022 23:20:25 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone object| oncontextlost object| oncontextrestored function| webpackJsonp function| setImmediate function| clearImmediate object| __core-js_shared__ object| returnCitySN

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

paypal-account-transaction.com
pv.sohu.com
13.69.222.243
5.188.33.63
484aebc150dd927248478b8ed2710bf6ebc472e79a7d2a4ad122b97ebbba4ff8
75f08f024d616d744fcad0f1c0e711bf32bd80c259b5a48895ebf62e5672f99c
7b27416ef702ee38d8608cf59520b73320902b0ff656967754d73723d50b2255
8d4e8460a070d9e6b9a4cc78092b8b8bfd08fc2552d7ee6c8aff3d0d7aedbb88
9c14b809ca4d5de12a569239d46ab8ef5f7ac1b3804c9801583cbafb66d3e550
b3f1bf1d5e25838bcad8535a2b700486644f4ea888e46c77d3e82783cb9da1b4
bfa25df8a7cbeefa96c7ec7758568082bf6bdf1cfd8ea0e53a14dae1bbbff46f
d42012c7e412c8ce71cc24ca87004fd4f24a976b8de791cdc5904bc04332851c
fcdf3becb34727e89ae7395ac70df92e4537639ae903784e201f479dd70f3ef0