www.client-paypal-secure.com Open in urlscan Pro
62.210.130.222  Malicious Activity! Public Scan

URL: https://www.client-paypal-secure.com/
Submission: On March 04 via automatic, source certstream-suspicious — Scanned from FR

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 9 HTTP transactions. The main IP is 62.210.130.222, located in Gentilly, France and belongs to Online SAS, FR. The main domain is www.client-paypal-secure.com.
TLS certificate: Issued by R3 on March 3rd 2022. Valid for: 3 months.
This is the only time www.client-paypal-secure.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: PayPal (Financial)

Domain & IP information

IP Address AS Autonomous System
9 62.210.130.222 12876 (Online SAS)
9 1
Apex Domain
Subdomains
Transfer
9 client-paypal-secure.com
www.client-paypal-secure.com
68 KB
9 1
Domain Requested by
9 www.client-paypal-secure.com www.client-paypal-secure.com
9 1

This site contains no links.

Subject Issuer Validity Valid
client-paypal-secure.com
R3
2022-03-03 -
2022-06-01
3 months crt.sh

This page contains 1 frames:

Primary Page: https://www.client-paypal-secure.com/
Frame ID: A91BE2EAF8603C3F1843846913E74962
Requests: 9 HTTP requests in this frame

Screenshot

Page Title

Connectez vous à votre compte

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

9
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

68 kB
Transfer

280 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
www.client-paypal-secure.com/
3 KB
1 KB
Document
General
Full URL
https://www.client-paypal-secure.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
62.210.130.222 Gentilly, France, ASN12876 (Online SAS, FR),
Reverse DNS
Software
nginx / PHP/8.0.16 PleskLin
Resource Hash
2cae7122df427b4521e2e5a74a69cf5b19feca0a8aa08125ef8dd08c35183a3c

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
fr-FR,fr;q=0.9

Response headers

server
nginx
date
Fri, 04 Mar 2022 09:27:45 GMT
content-type
text/html; charset=UTF-8
x-powered-by
PHP/8.0.16 PleskLin
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate
pragma
no-cache
content-encoding
br
normalize.css
www.client-paypal-secure.com/css/
8 KB
2 KB
Stylesheet
General
Full URL
https://www.client-paypal-secure.com/css/normalize.css
Requested by
Host: www.client-paypal-secure.com
URL: https://www.client-paypal-secure.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
62.210.130.222 Gentilly, France, ASN12876 (Online SAS, FR),
Reverse DNS
Software
nginx / PleskLin
Resource Hash
c13ab36ef47c80231ddd9e6774f9ada731e439a298e4a3471ad347cf5e4f36b5

Request headers

Accept-Language
fr-FR,fr;q=0.9
Referer
https://www.client-paypal-secure.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Fri, 04 Mar 2022 09:27:45 GMT
content-encoding
br
etag
W/"5d015540-1e7e"
last-modified
Wed, 12 Jun 2019 19:40:48 GMT
server
nginx
x-powered-by
PleskLin
content-type
text/css
bootstrap.min.css
www.client-paypal-secure.com/css/
118 KB
18 KB
Stylesheet
General
Full URL
https://www.client-paypal-secure.com/css/bootstrap.min.css
Requested by
Host: www.client-paypal-secure.com
URL: https://www.client-paypal-secure.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
62.210.130.222 Gentilly, France, ASN12876 (Online SAS, FR),
Reverse DNS
Software
nginx / PleskLin
Resource Hash
f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c

Request headers

Accept-Language
fr-FR,fr;q=0.9
Referer
https://www.client-paypal-secure.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Fri, 04 Mar 2022 09:27:45 GMT
content-encoding
br
etag
W/"5d015540-1d970"
last-modified
Wed, 12 Jun 2019 19:40:48 GMT
server
nginx
x-powered-by
PleskLin
content-type
text/css
font-awesome.min.css
www.client-paypal-secure.com/css/
21 KB
5 KB
Stylesheet
General
Full URL
https://www.client-paypal-secure.com/css/font-awesome.min.css
Requested by
Host: www.client-paypal-secure.com
URL: https://www.client-paypal-secure.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
62.210.130.222 Gentilly, France, ASN12876 (Online SAS, FR),
Reverse DNS
Software
nginx / PleskLin
Resource Hash
0fb1bbca73646e8e2b93c82e8d8b219647b13d4b440c48e338290b9a685b8de1

Request headers

Accept-Language
fr-FR,fr;q=0.9
Referer
https://www.client-paypal-secure.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Fri, 04 Mar 2022 09:27:45 GMT
content-encoding
br
etag
W/"5d015540-55e0"
last-modified
Wed, 12 Jun 2019 19:40:48 GMT
server
nginx
x-powered-by
PleskLin
content-type
text/css
login.css
www.client-paypal-secure.com/css/
5 KB
1 KB
Stylesheet
General
Full URL
https://www.client-paypal-secure.com/css/login.css
Requested by
Host: www.client-paypal-secure.com
URL: https://www.client-paypal-secure.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
62.210.130.222 Gentilly, France, ASN12876 (Online SAS, FR),
Reverse DNS
Software
nginx / PleskLin
Resource Hash
123a1d5f92b2744c003a176eb36ebcb867e8c46d6bea590ebccf57cac45d4f45

Request headers

Accept-Language
fr-FR,fr;q=0.9
Referer
https://www.client-paypal-secure.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Fri, 04 Mar 2022 09:27:45 GMT
content-encoding
br
etag
W/"5d015540-15d8"
last-modified
Wed, 12 Jun 2019 19:40:48 GMT
server
nginx
x-powered-by
PleskLin
content-type
text/css
ppt.PNG
www.client-paypal-secure.com/img/
2 KB
2 KB
Image
General
Full URL
https://www.client-paypal-secure.com/img/ppt.PNG
Requested by
Host: www.client-paypal-secure.com
URL: https://www.client-paypal-secure.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
62.210.130.222 Gentilly, France, ASN12876 (Online SAS, FR),
Reverse DNS
Software
nginx / PleskLin
Resource Hash
30956198f3f7ad95a65a31f44304a35f639917b4b7f7fdea4622b9549c037cd0

Request headers

Accept-Language
fr-FR,fr;q=0.9
Referer
https://www.client-paypal-secure.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Fri, 04 Mar 2022 09:27:45 GMT
last-modified
Wed, 12 Jun 2019 19:40:48 GMT
server
nginx
x-powered-by
PleskLin
etag
"5d015540-6eb"
content-type
image/png
accept-ranges
bytes
content-length
1771
jquery-1.11.3.min.js
www.client-paypal-secure.com/js/
85 KB
29 KB
Script
General
Full URL
https://www.client-paypal-secure.com/js/jquery-1.11.3.min.js
Requested by
Host: www.client-paypal-secure.com
URL: https://www.client-paypal-secure.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
62.210.130.222 Gentilly, France, ASN12876 (Online SAS, FR),
Reverse DNS
Software
nginx / PleskLin
Resource Hash
4fe68fa216176e6d1f4580e924bafecc9f519984ecc06b1a840a08b0d88c95de

Request headers

Accept-Language
fr-FR,fr;q=0.9
Referer
https://www.client-paypal-secure.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Fri, 04 Mar 2022 09:27:45 GMT
content-encoding
br
etag
W/"5d015540-15394"
last-modified
Wed, 12 Jun 2019 19:40:48 GMT
server
nginx
x-powered-by
PleskLin
content-type
application/javascript
bootstrap.min.js
www.client-paypal-secure.com/js/
36 KB
9 KB
Script
General
Full URL
https://www.client-paypal-secure.com/js/bootstrap.min.js
Requested by
Host: www.client-paypal-secure.com
URL: https://www.client-paypal-secure.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
62.210.130.222 Gentilly, France, ASN12876 (Online SAS, FR),
Reverse DNS
Software
nginx / PleskLin
Resource Hash
53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef

Request headers

Accept-Language
fr-FR,fr;q=0.9
Referer
https://www.client-paypal-secure.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Fri, 04 Mar 2022 09:27:45 GMT
content-encoding
br
etag
W/"5d015540-90b5"
last-modified
Wed, 12 Jun 2019 19:40:48 GMT
server
nginx
x-powered-by
PleskLin
content-type
application/javascript
plugins.js
www.client-paypal-secure.com/js/
1 KB
463 B
Script
General
Full URL
https://www.client-paypal-secure.com/js/plugins.js
Requested by
Host: www.client-paypal-secure.com
URL: https://www.client-paypal-secure.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
62.210.130.222 Gentilly, France, ASN12876 (Online SAS, FR),
Reverse DNS
Software
nginx / PleskLin
Resource Hash
4cca3c5b90856b37a2c2ff884eec75ec1c5ed885341f9d67f957935248ab412b

Request headers

Accept-Language
fr-FR,fr;q=0.9
Referer
https://www.client-paypal-secure.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Fri, 04 Mar 2022 09:27:45 GMT
content-encoding
br
etag
W/"5d015540-50d"
last-modified
Wed, 12 Jun 2019 19:40:48 GMT
server
nginx
x-powered-by
PleskLin
content-type
application/javascript

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone object| oncontextlost object| oncontextrestored function| $ function| jQuery

1 Cookies

Domain/Path Name / Value
www.client-paypal-secure.com/ Name: PHPSESSID
Value: 3ne6js68bcsusb8kqndc3phmvg