paypal-account.mo06.xyz
Open in
urlscan Pro
2606:4700:3030::6812:2a77
Malicious Activity!
Public Scan
Submission: On October 14 via automatic, source openphish
Summary
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on October 10th 2020. Valid for: a year.
This is the only time paypal-account.mo06.xyz was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: PayPal (Financial)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
5 | 2606:4700:303... 2606:4700:3030::6812:2a77 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2a00:1450:400... 2a00:1450:4001:801::200a | 15169 (GOOGLE) (GOOGLE) | |
7 | 2 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
mo06.xyz
paypal-account.mo06.xyz |
9 KB |
2 |
googleapis.com
fonts.googleapis.com |
1 KB |
7 | 2 |
Domain | Requested by | |
---|---|---|
5 | paypal-account.mo06.xyz |
paypal-account.mo06.xyz
|
2 | fonts.googleapis.com |
paypal-account.mo06.xyz
|
7 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2020-10-10 - 2021-10-10 |
a year | crt.sh |
upload.video.google.com GTS CA 1O1 |
2020-09-22 - 2020-12-15 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://paypal-account.mo06.xyz/ysr1wkdivbsn/lxgcvhnynidwkp/qtuhemznkorsxqc1/9qu4dkhomspa1/1
Frame ID: F8D1F9F0E518DD13A3DFB36320DD1F42
Requests: 7 HTTP requests in this frame
Screenshot
Detected technologies
CloudFlare (CDN) ExpandDetected patterns
- headers server /^cloudflare$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
1
paypal-account.mo06.xyz/ysr1wkdivbsn/lxgcvhnynidwkp/qtuhemznkorsxqc1/9qu4dkhomspa1/ |
3 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
master.css
paypal-account.mo06.xyz/static/pp/css/ |
32 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
master.js
paypal-account.mo06.xyz/static/pp/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
b64.min.js
paypal-account.mo06.xyz/static/pp/js/ |
2 KB 714 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
2 KB 646 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
3 KB 707 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.svg
paypal-account.mo06.xyz/static/pp/img/ |
5 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: PayPal (Financial)7 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes object| Base64 number| c2 number| c13 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
paypal-account.mo06.xyz/ | Name: medu5a_session Value: 7gqaas1l04bd00ge7vre0qjehv4gcjfo |
|
paypal-account.mo06.xyz/ | Name: csrf_cookie_name Value: 86c7afe5e1060f6e53bb7ebf343d568f |
|
.mo06.xyz/ | Name: __cfduid Value: d4f6bc9db2d4b65de59a6326260204b171602682504 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fonts.googleapis.com
paypal-account.mo06.xyz
2606:4700:3030::6812:2a77
2a00:1450:4001:801::200a
137b0712ad6c49702b95b4971dfd73637b8ace57a394d903cd5f5be556c3b5f9
263012469d3314a4978f3dc9f9974ba0e5413a923d9e0fdaa3eb0b62879459d8
44c7a313987266137f475859395cfa30414abf12182bf74b06b33d804b0c29f9
ac067cbc5fc5402929f0df0dd5f20774e529bb620008b2993897dc0da1d6442f
b9986feccdb9b6c99cc338802fad3d6335b3fd5ecdb12ee5b3abed91e0073036
f09f6c5b8970779be19412b98e8ce4df8db12777ade87d28d20ef2b2fb92c757