urlscan.io logo urlscan.io
SecurityTrails logo

archdelta.com Open in urlscan Pro
45.60.25.223  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://archdelta.com/battlefield/BATTLEFIELD/
Effective URL: https://archdelta.com/battlefield/BATTLEFIELD/myaccount/signin/?country.x=DE&locale.x=en_DE
Submission: On June 25 via automatic, source phishtank
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 9 HTTP transactions. The main IP is 45.60.25.223, located in United States and belongs to INCAPSULA - Incapsula Inc, US. The main domain is archdelta.com.
TLS certificate: Issued by GlobalSign CloudSSL CA - SHA256 - G3 on June 12th 2019. Valid for: 6 months.
This is the only time archdelta.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: PayPal (Financial)

Domain & IP information

IP Address AS Autonomous System
1 9 45.60.25.223 19551 (INCAPSULA)
9 2
Apex Domain
Subdomains		 Transfer
9 archdelta.com
archdelta.com
61 KB
9 1
Domain Requested by
9 archdelta.com 1 redirects archdelta.com
9 1

This site contains no links.

Subject Issuer Validity Valid
incapsula.com
GlobalSign CloudSSL CA - SHA256 - G3		 2019-06-12 -
2019-12-04		 6 months crt.sh

This page contains 1 frames:

Primary Page: https://archdelta.com/battlefield/BATTLEFIELD/myaccount/signin/?country.x=DE&locale.x=en_DE
Frame ID: F78D2EC263E12ECE8FAE57CAF336AEB4
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://archdelta.com/battlefield/BATTLEFIELD/ Page URL
  2. https://archdelta.com/battlefield/BATTLEFIELD/ HTTP 302
    https://archdelta.com/battlefield/BATTLEFIELD/myaccount/signin/?country.x=DE&locale.x=en_DE Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

9
Requests

89 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

61 kB
Transfer

260 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://archdelta.com/battlefield/BATTLEFIELD/ Page URL
  2. https://archdelta.com/battlefield/BATTLEFIELD/ HTTP 302
    https://archdelta.com/battlefield/BATTLEFIELD/myaccount/signin/?country.x=DE&locale.x=en_DE Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
archdelta.com/battlefield/BATTLEFIELD/ 		210 B
543 B 		Document
General
Check archive.org
Download Go to
Full URL
https://archdelta.com/battlefield/BATTLEFIELD/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.25.223 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US),
Reverse DNS
Software
/
Resource Hash
d2f3e642df0b6c754c71f80502056d952f874ef92da84205a158c21c012f616d

Request headers

:method
GET
:authority
archdelta.com
:scheme
https
:path
/battlefield/BATTLEFIELD/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
content-type
text/html
cache-control
no-cache
content-length
210
x-iinfo
12-15374315-0 0NNN RT(1561424925420 0) q(0 -1 -1 0) r(0 -1) B10(4,314,0) U18
x-iejgwucgyu
1
set-cookie
visid_incap_2034617=lTOj4AIwTv6Nc7UKBQzC5B10EV0AAAAAQUIPAAAAAACNemCmrv9JMrQLvzoYGIV8; expires=Tue, 23 Jun 2020 09:44:00 GMT; path=/; Domain=.archdelta.com incap_ses_789_2034617=JMmEaOQH1yzI87RRRhjzCh10EV0AAAAAjvhx2yjcH8W3kYJPz4wHMg==; path=/; Domain=.archdelta.com
_Incapsula_Resource
archdelta.com/ 		151 KB
22 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://archdelta.com/_Incapsula_Resource?SWJIYLWA=5074a744e2e3d891814e9a2dace20bd4,719d34d31c8e3a6e6fffd425f7e032f3
Requested by
Host: archdelta.com
URL: https://archdelta.com/battlefield/BATTLEFIELD/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.25.223 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US),
Reverse DNS
Software
/
Resource Hash
26cd4211f9d009752b24fd5812eee650bd0798f59d87a1bd7fb382cd4dc16407

Request headers

Referer
https://archdelta.com/battlefield/BATTLEFIELD/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
content-encoding
gzip
cache-control
no-cache
content-length
22505
content-type
application/javascript
_Incapsula_Resource
archdelta.com/ 		29 B
55 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://archdelta.com/_Incapsula_Resource?SWHANEDL=8343175583060999747,2687398496715382720,6296592604081971082,55636
Requested by
Host: archdelta.com
URL: https://archdelta.com/battlefield/BATTLEFIELD/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.25.223 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://archdelta.com/battlefield/BATTLEFIELD/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
cache-control
no-cache
content-length
29
content-type
application/javascript
Primary Request /
archdelta.com/battlefield/BATTLEFIELD/myaccount/signin/
Redirect Chain
  • https://archdelta.com/battlefield/BATTLEFIELD/
  • https://archdelta.com/battlefield/BATTLEFIELD/myaccount/signin/?country.x=DE&locale.x=en_DE
7 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://archdelta.com/battlefield/BATTLEFIELD/myaccount/signin/?country.x=DE&locale.x=en_DE
Requested by
Host: archdelta.com
URL: https://archdelta.com/battlefield/BATTLEFIELD/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.25.223 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US),
Reverse DNS
Software
Apache /
Resource Hash
864e12dcaecd37778db2c5ae21bfd771967dcf6286eee6356674132b957f9784

Request headers

:method
GET
:authority
archdelta.com
:scheme
https
:path
/battlefield/BATTLEFIELD/myaccount/signin/?country.x=DE&locale.x=en_DE
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
referer
https://archdelta.com/battlefield/BATTLEFIELD/
accept-encoding
gzip, deflate, br
cookie
visid_incap_2034617=lTOj4AIwTv6Nc7UKBQzC5B10EV0AAAAAQUIPAAAAAACNemCmrv9JMrQLvzoYGIV8; incap_ses_789_2034617=sKrEGRObIVbI87RRRhjzCh10EV0AAAAAh/20yncc4LkptNkP5oPKHw==; PHPSESSID=18539519f3d33ea75027d8dbfd82b7a0
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://archdelta.com/battlefield/BATTLEFIELD/

Response headers

status
200
date
Tue, 25 Jun 2019 01:08:50 GMT
server
Apache
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma
no-cache
vary
Accept-Encoding
content-encoding
gzip
content-length
2460
content-type
text/html
x-iinfo
12-15375578-15374558 PNNN RT(1561424929929 0) q(0 0 0 -1) r(15 15) U12
x-cdn
Incapsula

Redirect headers

status
302
date
Tue, 25 Jun 2019 01:08:47 GMT
server
Apache
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma
no-cache
set-cookie
PHPSESSID=18539519f3d33ea75027d8dbfd82b7a0; path=/
location
myaccount/signin/?country.x=DE&locale.x=en_DE
content-length
0
content-type
text/html
x-iinfo
12-15374557-15374558 NNNN CT(158 329 0) RT(1561424926386 0) q(0 0 5 -1) r(33 33) U11
x-cdn
Incapsula
_Incapsula_Resource
archdelta.com/ 		1 B
80 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://archdelta.com/_Incapsula_Resource?SWKMTFSR=1&e=0.5955073733338745
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.25.223 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://archdelta.com/battlefield/BATTLEFIELD/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
cache-control
no-cache
content-length
1
content-type
text/plain
_Incapsula_Resource
archdelta.com/ 		0
0
L-Z118.css
archdelta.com/battlefield/BATTLEFIELD/lib/css/ 		13 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://archdelta.com/battlefield/BATTLEFIELD/lib/css/L-Z118.css
Requested by
Host: archdelta.com
URL: https://archdelta.com/battlefield/BATTLEFIELD/myaccount/signin/?country.x=DE&locale.x=en_DE
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.25.223 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US),
Reverse DNS
Software
/
Resource Hash
1bcda772b32139bbd18696ba5a08fc2da9731cecf88d6b904cb953107484f55f

Request headers

Referer
https://archdelta.com/battlefield/BATTLEFIELD/myaccount/signin/?country.x=DE&locale.x=en_DE
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 25 Jun 2019 01:08:51 GMT
content-encoding
gzip
last-modified
Sun, 28 Oct 2018 04:32:58 GMT
x-cdn
Incapsula
etag
"85f56c4d"
content-type
text/css
status
200
x-iinfo
12-15376105-0 0CNN RT(1561424931692 0) q(0 -1 -1 -1) r(0 -1)
cache-control
max-age=71459, public
content-length
4102
expires
Tue, 25 Jun 2019 20:59:50 GMT
jquery.js
archdelta.com/battlefield/BATTLEFIELD/lib/js/ 		84 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://archdelta.com/battlefield/BATTLEFIELD/lib/js/jquery.js
Requested by
Host: archdelta.com
URL: https://archdelta.com/battlefield/BATTLEFIELD/myaccount/signin/?country.x=DE&locale.x=en_DE
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.25.223 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US),
Reverse DNS
Software
/
Resource Hash
7be1a04972936f556a67f34a822213188b56e767d71e92daa87e6804f9947114

Request headers

Referer
https://archdelta.com/battlefield/BATTLEFIELD/myaccount/signin/?country.x=DE&locale.x=en_DE
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 25 Jun 2019 01:08:51 GMT
content-encoding
gzip
last-modified
Sun, 04 Sep 2016 10:12:42 GMT
x-cdn
Incapsula
etag
"bf9eea61"
content-type
application/javascript
status
200
x-iinfo
12-15376106-0 0CNN RT(1561424931697 0) q(0 -1 -1 -1) r(0 -1)
cache-control
max-age=71459, public
content-length
29960
expires
Tue, 25 Jun 2019 20:59:50 GMT
kl_h4aXX6987PO.svg
archdelta.com/battlefield/BATTLEFIELD/lib/img/ 		5 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://archdelta.com/battlefield/BATTLEFIELD/lib/img/kl_h4aXX6987PO.svg
Requested by
Host: archdelta.com
URL: https://archdelta.com/battlefield/BATTLEFIELD/myaccount/signin/?country.x=DE&locale.x=en_DE
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.25.223 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US),
Reverse DNS
Software
/
Resource Hash
b3cc50b9e94bbecaaeb1079b64b8ca50616d1732824964c1cc2c5422627a0ec5

Request headers

Referer
https://archdelta.com/battlefield/BATTLEFIELD/lib/css/L-Z118.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 25 Jun 2019 01:08:51 GMT
content-encoding
gzip
last-modified
Tue, 13 Sep 2016 16:20:10 GMT
x-cdn
Incapsula
etag
"0cdfe8c6"
content-type
image/svg+xml
status
200
x-iinfo
12-15376191-0 0CNN RT(1561424931919 0) q(0 -1 -1 -1) r(0 -1)
cache-control
max-age=28740, public
content-length
1929
expires
Tue, 25 Jun 2019 09:07:51 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
archdelta.com
URL
https://archdelta.com/_Incapsula_Resource?ES2LURCT=67&t=78&d=complete%20(s%3A20%2Cc%3A227%2Cr%3A5547)

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask function| $ function| jQuery

3 Cookies

Domain/Path Name / Value
archdelta.com/ Name: PHPSESSID
Value: 18539519f3d33ea75027d8dbfd82b7a0
.archdelta.com/ Name: incap_ses_789_2034617
Value: sKrEGRObIVbI87RRRhjzCh10EV0AAAAAh/20yncc4LkptNkP5oPKHw==
.archdelta.com/ Name: visid_incap_2034617
Value: lTOj4AIwTv6Nc7UKBQzC5B10EV0AAAAAQUIPAAAAAACNemCmrv9JMrQLvzoYGIV8