www.sinsinawa.org - urlscan.io

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 6 HTTP transactions. The main IP is 2400:cb00:2048:1::6818:6853, located in United States and belongs to CLOUDFLARENET - CloudFlare, Inc., US. The main domain is www.sinsinawa.org.
TLS certificate: Issued by COMODO ECC Domain Validation Secure S... on May 17th 2017. Valid for: 7 months.

This is the only time www.sinsinawa.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: PayPal (Financial)

Domain & IP information

	IP Address		AS Autonomous System
6	2400:cb00:204... 2400:cb00:2048:1::6818:6853		13335 (CLOUDFLAR...) (CLOUDFLARENET - CloudFlare)
6	1

6 2400:cb00:2048:1::6818:6853 (United States)

ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US)

www.sinsinawa.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	sinsinawa.org www.sinsinawa.org	41 KB
6	1

	Domain	Requested by
6	www.sinsinawa.org	www.sinsinawa.org
6	1

This site contains no links.

Subject Issuer	Validity	Valid
sni176342.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2017-05-17` - `2017-12-14`	7 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.sinsinawa.org/aspnet_client/system_web/4_0_30319/servi/paypal/login.php?websrc=77dab160d987730dc452ffcdb621579a&dispatched=75&id=1356074712
Frame ID: 30464.1
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://www.sinsinawa.org/aspnet_client/system_web/4_0_30319/servi/redirection.php Page URL
https://www.sinsinawa.org/aspnet_client/system_web/4_0_30319/servi/paypal/login.php?websrc=77dab160d98... Page URL

Page Statistics

6
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

41 kB
Transfer

102 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.sinsinawa.org/aspnet_client/system_web/4_0_30319/servi/redirection.php Page URL
https://www.sinsinawa.org/aspnet_client/system_web/4_0_30319/servi/paypal/login.php?websrc=77dab160d987730dc452ffcdb621579a&dispatched=75&id=1356074712 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request 0

http://www.sinsinawa.org/aspnet_client/system_web/4_0_30319/servi/redirection.php
https://www.sinsinawa.org/aspnet_client/system_web/4_0_30319/servi/redirection.php

6 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET S	200	redirection.php Show response www.sinsinawa.org/aspnet_client/system_web/4_0_30319/servi/ Redirect Chain http://www.sinsinawa.org/aspnet_client/system_web/4_0_30319/servi/redirection.php https://www.sinsinawa.org/aspnet_client/system_web/4_0_30319/servi/redirection.php	197 B 187 B	538ms 486ms	Document text/html	2400:cb00:2048:1::6818:6853 CloudFlare
General Check archive.org Show headers Download Go to Full URL https://www.sinsinawa.org/aspnet_client/system_web/4_0_30319/servi/redirection.php Protocol SPDY Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 2400:cb00:2048:1::6818:6853 , United States, ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US), Reverse DNS Software cloudflare-nginx / ASP.NET Resource Hash `db30f64b4c99ac7beacaf900c3b6f813dd9a19f52da2b0f09201847f518521cc` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers date Wed, 05 Jul 2017 05:47:09 GMT content-encoding gzip server cloudflare-nginx status 200 x-powered-by ASP.NET vary Accept-Encoding content-type text/html access-control-allow-origin * cf-ray 379807240d9727a4-FRA Redirect headers Date Wed, 05 Jul 2017 05:47:08 GMT Server cloudflare-nginx Location https://www.sinsinawa.org/aspnet_client/system_web/4_0_30319/servi/redirection.php X-Powered-By ASP.NET Transfer-Encoding chunked Content-Type text/html Access-Control-Allow-Origin * Connection keep-alive CF-RAY 3798072212f86481-FRA
GET S	200	Primary Request login.php Show response www.sinsinawa.org/aspnet_client/system_web/4_0_30319/servi/paypal/ Redirect Chain https://www.sinsinawa.org/aspnet_client/system_web/4_0_30319/servi/paypal/index.php https://www.sinsinawa.org/aspnet_client/system_web/4_0_30319/servi/paypal/login.php?websrc=77dab160d987730dc452ffcdb621579a&dispatched=75&id=1356074712	2 KB 745 B	890ms 890ms	Document text/html	2400:cb00:2048:1::6818:6853 CloudFlare
General Check archive.org Show headers Download Go to Full URL https://www.sinsinawa.org/aspnet_client/system_web/4_0_30319/servi/paypal/login.php?websrc=77dab160d987730dc452ffcdb621579a&dispatched=75&id=1356074712 Protocol SPDY Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 2400:cb00:2048:1::6818:6853 , United States, ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US), Reverse DNS Software cloudflare-nginx / ASP.NET Resource Hash `7213927bbe1d370fd246df6ead45f10f8d24e024e0c511fb06f83b6f0acb7f72` Request headers Referer https://www.sinsinawa.org/aspnet_client/system_web/4_0_30319/servi/redirection.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers pragma no-cache date Wed, 05 Jul 2017 05:47:10 GMT content-encoding gzip server cloudflare-nginx status 200 x-powered-by ASP.NET vary Accept-Encoding content-type text/html access-control-allow-origin * cache-control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 cf-ray 3798072b38e327a4-FRA expires Thu, 19 Nov 1981 08:52:00 GMT Redirect headers pragma no-cache date Wed, 05 Jul 2017 05:47:09 GMT server cloudflare-nginx status 302 x-powered-by ASP.NET location ./login.php?websrc=77dab160d987730dc452ffcdb621579a&dispatched=75&id=1356074712 content-type text/html; charset=UTF-8 access-control-allow-origin * cache-control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 cf-ray 3798072a587927a4-FRA expires Thu, 19 Nov 1981 08:52:00 GMT
GET S	200	style.css www.sinsinawa.org/aspnet_client/system_web/4_0_30319/servi/paypal/css/	4 KB 901 B	513ms 512ms	Stylesheet text/css	2400:cb00:2048:1::6818:6853 CloudFlare
General Check archive.org Show headers Download Go to Full URL https://www.sinsinawa.org/aspnet_client/system_web/4_0_30319/servi/paypal/css/style.css Requested by Host: www.sinsinawa.org URL: https://www.sinsinawa.org/aspnet_client/system_web/4_0_30319/servi/paypal/login.php?websrc=77dab160d987730dc452ffcdb621579a&dispatched=75&id=1356074712 Protocol SPDY Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 2400:cb00:2048:1::6818:6853 , United States, ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US), Reverse DNS Software cloudflare-nginx / ASP.NET Resource Hash `545270a3fe93b8f3ddfc51e30a28eb65b1ea9921d8c40f52e270e2898adbc7f1` Request headers Referer https://www.sinsinawa.org/aspnet_client/system_web/4_0_30319/servi/paypal/login.php?websrc=77dab160d987730dc452ffcdb621579a&dispatched=75&id=1356074712 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers date Wed, 05 Jul 2017 05:47:11 GMT content-encoding gzip status 200 cf-cache-status REVALIDATED last-modified Sat, 01 Jul 2017 09:35:02 GMT server cloudflare-nginx x-powered-by ASP.NET etag W/"cd80b6504df2d21:0" vary Accept-Encoding content-type text/css access-control-allow-origin * cache-control public, max-age=432000 cf-ray 37980730cc4727a4-FRA expires Mon, 10 Jul 2017 05:47:11 GMT
GET S	200	logo.svg www.sinsinawa.org/aspnet_client/system_web/4_0_30319/servi/paypal/img/	5 KB 2 KB	479ms 479ms	Image image/svg+xml	2400:cb00:2048:1::6818:6853 CloudFlare
General Check archive.org Show headers Download Go to Show image Full URL https://www.sinsinawa.org/aspnet_client/system_web/4_0_30319/servi/paypal/img/logo.svg Requested by Host: www.sinsinawa.org URL: https://www.sinsinawa.org/aspnet_client/system_web/4_0_30319/servi/paypal/login.php?websrc=77dab160d987730dc452ffcdb621579a&dispatched=75&id=1356074712 Protocol SPDY Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 2400:cb00:2048:1::6818:6853 , United States, ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US), Reverse DNS Software cloudflare-nginx / ASP.NET Resource Hash `b3cc50b9e94bbecaaeb1079b64b8ca50616d1732824964c1cc2c5422627a0ec5` Request headers Referer https://www.sinsinawa.org/aspnet_client/system_web/4_0_30319/servi/paypal/login.php?websrc=77dab160d987730dc452ffcdb621579a&dispatched=75&id=1356074712 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers date Wed, 05 Jul 2017 05:47:11 GMT content-encoding gzip status 200 cf-cache-status REVALIDATED last-modified Sat, 01 Jul 2017 09:35:02 GMT server cloudflare-nginx x-powered-by ASP.NET etag W/"b6a7bd504df2d21:0" vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * cache-control public, max-age=432000 cf-ray 37980730cc4927a4-FRA expires Mon, 10 Jul 2017 05:47:11 GMT
GET S	200	icon_loader_med.gif www.sinsinawa.org/aspnet_client/system_web/4_0_30319/servi/paypal/img/	8 KB 8 KB	518ms 518ms	Image image/gif	2400:cb00:2048:1::6818:6853 CloudFlare
General Check archive.org Show headers Download Go to Show image Full URL https://www.sinsinawa.org/aspnet_client/system_web/4_0_30319/servi/paypal/img/icon_loader_med.gif Requested by Host: www.sinsinawa.org URL: https://www.sinsinawa.org/aspnet_client/system_web/4_0_30319/servi/paypal/login.php?websrc=77dab160d987730dc452ffcdb621579a&dispatched=75&id=1356074712 Protocol SPDY Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 2400:cb00:2048:1::6818:6853 , United States, ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US), Reverse DNS Software cloudflare-nginx / ASP.NET Resource Hash `d1ae7277d8ad6c4ecfb1f2269db1cfd85a04c8e2b97a3c2bf4c65fa622fe9e08` Request headers Referer https://www.sinsinawa.org/aspnet_client/system_web/4_0_30319/servi/paypal/login.php?websrc=77dab160d987730dc452ffcdb621579a&dispatched=75&id=1356074712 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers date Wed, 05 Jul 2017 05:47:11 GMT status 200 cf-cache-status REVALIDATED last-modified Sat, 01 Jul 2017 09:35:02 GMT server cloudflare-nginx x-powered-by ASP.NET etag "1b45bb504df2d21:0" vary Accept-Encoding content-type image/gif access-control-allow-origin * cache-control public, max-age=432000 accept-ranges bytes cf-ray 37980733fdae27a4-FRA content-length 7732 expires Mon, 10 Jul 2017 05:47:11 GMT
GET S	200	jquery-3.1.1.min.js Show response www.sinsinawa.org/aspnet_client/system_web/4_0_30319/servi/paypal/js/	85 KB 29 KB	497ms 497ms	Script application/javascript	2400:cb00:2048:1::6818:6853 CloudFlare
General Check archive.org Show headers Download Go to Full URL https://www.sinsinawa.org/aspnet_client/system_web/4_0_30319/servi/paypal/js/jquery-3.1.1.min.js Requested by Host: www.sinsinawa.org URL: https://www.sinsinawa.org/aspnet_client/system_web/4_0_30319/servi/paypal/login.php?websrc=77dab160d987730dc452ffcdb621579a&dispatched=75&id=1356074712 Protocol SPDY Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 2400:cb00:2048:1::6818:6853 , United States, ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US), Reverse DNS Software cloudflare-nginx / ASP.NET Resource Hash `85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf` Request headers Referer https://www.sinsinawa.org/aspnet_client/system_web/4_0_30319/servi/paypal/login.php?websrc=77dab160d987730dc452ffcdb621579a&dispatched=75&id=1356074712 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers date Wed, 05 Jul 2017 05:47:11 GMT content-encoding gzip status 200 cf-cache-status REVALIDATED last-modified Sat, 01 Jul 2017 09:35:02 GMT server cloudflare-nginx x-powered-by ASP.NET etag W/"8070c2504df2d21:0" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control public, max-age=432000 cf-ray 37980730cc4a27a4-FRA expires Mon, 10 Jul 2017 05:47:11 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.sinsinawa.org/	1970-01-01 00:00:00	Name: PHPSESSID Value: tk4feaga9minopnksf13mtdv11
			.sinsinawa.org/	2018-07-05 05:47:08	Name: __cfduid Value: d766985b05355c9c5d0faffa295d0f2811499233628

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

www.sinsinawa.org
2400:cb00:2048:1::6818:6853
545270a3fe93b8f3ddfc51e30a28eb65b1ea9921d8c40f52e270e2898adbc7f1
7213927bbe1d370fd246df6ead45f10f8d24e024e0c511fb06f83b6f0acb7f72
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
b3cc50b9e94bbecaaeb1079b64b8ca50616d1732824964c1cc2c5422627a0ec5
d1ae7277d8ad6c4ecfb1f2269db1cfd85a04c8e2b97a3c2bf4c65fa622fe9e08
db30f64b4c99ac7beacaf900c3b6f813dd9a19f52da2b0f09201847f518521cc

www.sinsinawa.org Open in urlscan Pro 2400:cb00:2048:1::6818:6853 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

6 Requests

100 %HTTPS

100 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

41 kBTransfer

102 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

2 Cookies

Indicators

www.sinsinawa.org Open in urlscan Pro
2400:cb00:2048:1::6818:6853 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

41 kB
Transfer

102 kB
Size

2
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!