payu24.de Open in urlscan Pro
2606:4700:3032::ac43:aadb  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request KLMAO Show response payu24.de/s/	15 KB 5 KB	911ms 561ms	Document text/html	2606:4700:3032::ac43:aadb CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://payu24.de/s/KLMAO Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3032::ac43:aadb , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a9e8982ed0bddb679d0e77270b9ec81590aac0605044a3d67fe2d3cd66865d2d Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cache-control no-store, no-cache, must-revalidate cf-cache-status DYNAMIC cf-ray 75bbbc0ef9b796e4-SJC content-encoding br content-type text/html; charset=UTF-8 date Mon, 17 Oct 2022 20:20:23 GMT expires Thu, 19 Nov 1981 08:52:00 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} pragma no-cache report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FNmxVpxpVLLwZISBloSjqMAJJUybvNf18fiwLBNa9Tknpr8WrpNwqOcT0s9RFlFONtM8n8tzfRGesQOU%2FJxielElEqCDKLwZa9nVlmqSE2QZ86bQY6Dc9uhe%2BYBHghAjOuQ3Pu64QoE%3D"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding
GET H2	200	bxxuzrdTgyg.css payu24.de/assets/phishing/fb/	16 KB 4 KB	562ms 560ms	Stylesheet text/css	2606:4700:3032::ac43:aadb CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://payu24.de/assets/phishing/fb/bxxuzrdTgyg.css Requested by Host: payu24.de URL: https://payu24.de/s/KLMAO Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3032::ac43:aadb , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8c845558fef4817e2373fc03912d9c8bdf6de1f4c364ed770b1493591c7c76b3 Request headers accept-language de-DE,de;q=0.9 Referer https://payu24.de/s/KLMAO User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers date Mon, 17 Oct 2022 20:20:24 GMT content-encoding br cf-cache-status EXPIRED last-modified Sun, 04 Sep 2022 16:43:02 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"3e67-5e7dca8101180-gzip" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xQ7J%2Bgz1CzPJk2LCeQfRdGj7nvvdn28b6kvl7vfEGhOa5vCkXgDO%2B8uN5p%2BwhvpHqVuNOtE7tKQxf6C1fflPWaYyD0Hfz2UqnkMSMKJWlPg9C3nUheMirELWDTN82fSyRn%2FTuh727Mg%3D"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=14400 cf-ray 75bbbc129f4496e4-SJC alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H2	200	OssD9jBxccC.css payu24.de/assets/phishing/fb/	378 B 506 B	931ms 930ms	Stylesheet text/css	2606:4700:3032::ac43:aadb CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://payu24.de/assets/phishing/fb/OssD9jBxccC.css Requested by Host: payu24.de URL: https://payu24.de/s/KLMAO Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3032::ac43:aadb , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c9eb23c12c7eb93a1f86e7e067d11288bd139f2787c99d66b6cb7271b5edbfd1 Request headers accept-language de-DE,de;q=0.9 Referer https://payu24.de/s/KLMAO User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers date Mon, 17 Oct 2022 20:20:24 GMT content-encoding br cf-cache-status EXPIRED last-modified Sun, 04 Sep 2022 11:43:52 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"17a-5e7d87a28ce00-gzip" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HuanH1WD%2F8Z%2FFuTql514vC%2BUVaJvtLV19MkMA%2BqZrG%2FSR8icGwi0Vo7hC8QZrlVL478IyUjFoxHEA8cvBMWfklDfjdpz8qON%2FRsf7oh2NRxwBiRuYpfaJOzEDITiIJhRIpp5ZEvq1yg%3D"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=14400 cf-ray 75bbbc129f4896e4-SJC alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H2	200	uliV2kFi04_.css payu24.de/assets/phishing/fb/	7 KB 3 KB	556ms 555ms	Stylesheet text/css	2606:4700:3032::ac43:aadb CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://payu24.de/assets/phishing/fb/uliV2kFi04_.css Requested by Host: payu24.de URL: https://payu24.de/s/KLMAO Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3032::ac43:aadb , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2f40d07930ba7f79e309c01bbb7ca57329baf1e00c44f6aff6e01bc581409e5c Request headers accept-language de-DE,de;q=0.9 Referer https://payu24.de/s/KLMAO User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers date Mon, 17 Oct 2022 20:20:24 GMT content-encoding br cf-cache-status EXPIRED last-modified Sun, 04 Sep 2022 11:43:51 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"1c34-5e7d87a198bc0-gzip" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ppv%2FNtz6wL1dO6QaFAGrMRgOYKV0ZJ9S5ff0MAZIZ3Ua4GgLzz7fs5z%2BDVEOKVmGqcVPdwHmfA8mJ14661DaLmjbFF3VC9yg57%2B4bt1YWi3DdlMKLxiEZ2e%2BH6ERuquwvatJL5TTQNY%3D"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=14400 cf-ray 75bbbc129f4996e4-SJC alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H2	200	l8544TqYVTV.css payu24.de/assets/phishing/fb/	12 KB 4 KB	745ms 744ms	Stylesheet text/css	2606:4700:3032::ac43:aadb CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://payu24.de/assets/phishing/fb/l8544TqYVTV.css Requested by Host: payu24.de URL: https://payu24.de/s/KLMAO Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3032::ac43:aadb , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6cf02f15e26b941cf30e738b3236d7622aaf841c4279000e40bedc83f0b130a9 Request headers accept-language de-DE,de;q=0.9 Referer https://payu24.de/s/KLMAO User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers date Mon, 17 Oct 2022 20:20:24 GMT content-encoding br cf-cache-status EXPIRED last-modified Sun, 04 Sep 2022 16:42:18 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"2f19-5e7dca570ae80-gzip" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WefyupLasgPgYtrsJaEeB8Uincf38nOMIqzJOZnAj%2Fl2FuqgzLKwtd1NvF%2BTRZGOW%2Fsw4gJvMlJktweRO5u%2Foi3WNOLegIfjMIbrN7Z5XOdyKROHz4H%2FF7Xn0FQopg1Wqm9dmCUMa%2Fc%3D"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=14400 cf-ray 75bbbc129f4c96e4-SJC alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H2	200	kl_w5gQwgre.css payu24.de/assets/phishing/fb/	17 KB 5 KB	746ms 745ms	Stylesheet text/css	2606:4700:3032::ac43:aadb CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://payu24.de/assets/phishing/fb/kl_w5gQwgre.css Requested by Host: payu24.de URL: https://payu24.de/s/KLMAO Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3032::ac43:aadb , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5b4b6350b1914eda783dac1b2e4d93aea44fcbedeae8c98b1b6597ca6d85506c Request headers accept-language de-DE,de;q=0.9 Referer https://payu24.de/s/KLMAO User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers date Mon, 17 Oct 2022 20:20:24 GMT content-encoding br cf-cache-status EXPIRED last-modified Fri, 09 Sep 2022 11:35:07 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"4419-5e83cf012d0c0-gzip" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TOlU%2FH8q6JtI0C%2BE3324lEemKFKVI%2B%2BJbisT5vepMtvHGCh0Mjc28wXsUozyI5YM6q5xSPz%2FPE5zlFJzE96qhI33OiNQpm5FPAGPwqw1KoVF13wKWHmljA2SXlJZfB1ZBXOp4YSjVHY%3D"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=14400 cf-ray 75bbbc129f5196e4-SJC alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H2	200	dF5SId3UHWd.svg payu24.de/assets/phishing/fb/	2 KB 1 KB	725ms 725ms	Image image/svg+xml	2606:4700:3032::ac43:aadb CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://payu24.de/assets/phishing/fb/dF5SId3UHWd.svg Requested by Host: payu24.de URL: https://payu24.de/s/KLMAO Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3032::ac43:aadb , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9531e96099e973b3d1c291f3e60419d8fe4730f46de8a492fccd2b4c962c96ce Request headers accept-language de-DE,de;q=0.9 Referer https://payu24.de/s/KLMAO User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers date Mon, 17 Oct 2022 20:20:24 GMT content-encoding br cf-cache-status REVALIDATED last-modified Sun, 04 Sep 2022 11:43:51 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"951-5e7d87a198bc0" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ps%2BcLCcVTTTU6lEi%2BcjtTAXd75%2BXmDrR0g%2FegDXcrThoRgHjDObanVIdvG0M6fQoDzDwVWop7Kz0KBaNQB5eyjkJ5YE%2F5HpPy6CGzVrbXcOW0cXlKM02bHg5Mwj7mxkgU3nS5bqP6ps%3D"}],"group":"cf-nel","max_age":604800} content-type image/svg+xml cache-control max-age=14400 cf-ray 75bbbc12bf9096e4-SJC alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H3	200	O7nelmd9XSI.png payu24.de/assets/phishing/fb/	95 B 608 B	103ms 102ms	Image image/png	2606:4700:3032::ac43:aadb CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://payu24.de/assets/phishing/fb/O7nelmd9XSI.png Requested by Host: payu24.de URL: https://payu24.de/assets/phishing/fb/bxxuzrdTgyg.css Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3032::ac43:aadb , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c0f9968d0fa5f4deff86babccd6df52306138314607a6f3f0acd2e7afc783d1c Request headers accept-language de-DE,de;q=0.9 Referer https://payu24.de/assets/phishing/fb/bxxuzrdTgyg.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers date Mon, 17 Oct 2022 20:20:25 GMT cf-cache-status MISS last-modified Sun, 04 Sep 2022 16:39:19 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag "5f-5e7dc9ac55bc0" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=A%2BDq%2Bncb2ZMv7F7U7ARFugZ4HRvrBDzbsW1f7JpSJaHNNWoKXLpoCPuyQyTnQ4EjjFmo28Zl6VwdM0NDbojpk6JPi4XSeWBSywRvynzRZo%2BjuSAMOfCgOvRLEQzw86oxHt7%2Bozlmtk0%3D"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=14400 accept-ranges bytes cf-ray 75bbbc17fee9bb83-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 95
GET H3	200	VcstZr4fYTz.png payu24.de/assets/phishing/fb/	7 KB 8 KB	125ms 124ms	Image image/png	2606:4700:3032::ac43:aadb CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://payu24.de/assets/phishing/fb/VcstZr4fYTz.png Requested by Host: payu24.de URL: https://payu24.de/assets/phishing/fb/l8544TqYVTV.css Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3032::ac43:aadb , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a8dd4f4fdc807c57cc2d03b79f8eb13096f28a6557ca6ef670946e3e66f847e3 Request headers accept-language de-DE,de;q=0.9 Referer https://payu24.de/assets/phishing/fb/l8544TqYVTV.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers date Mon, 17 Oct 2022 20:20:25 GMT cf-cache-status MISS last-modified Sun, 04 Sep 2022 16:39:40 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag "1de1-5e7dc9c05cb00" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RTWfLFVOFX7ngjmWELedYUAA9nqNvvJl3LAbe%2BtAgMSqBx6rPzo5aBItRccJj8PNgqusj5%2Fs30s12gQIBRAeOhw6Ron8rbZSgqdSNPDuPtJZEJUdVG9wSFheEp6kuzHooFian3JNyXw%3D"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=14400 accept-ranges bytes cf-ray 75bbbc17fef5bb83-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 7649

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			payu24.de/	1969-12-31 23:59:59	Name: PHPSESSID Value: k1ga834v48fq9005vvkiun1882

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

payu24.de
2606:4700:3032::ac43:aadb
2f40d07930ba7f79e309c01bbb7ca57329baf1e00c44f6aff6e01bc581409e5c
5b4b6350b1914eda783dac1b2e4d93aea44fcbedeae8c98b1b6597ca6d85506c
6cf02f15e26b941cf30e738b3236d7622aaf841c4279000e40bedc83f0b130a9
8c845558fef4817e2373fc03912d9c8bdf6de1f4c364ed770b1493591c7c76b3
9531e96099e973b3d1c291f3e60419d8fe4730f46de8a492fccd2b4c962c96ce
a8dd4f4fdc807c57cc2d03b79f8eb13096f28a6557ca6ef670946e3e66f847e3
a9e8982ed0bddb679d0e77270b9ec81590aac0605044a3d67fe2d3cd66865d2d
c0f9968d0fa5f4deff86babccd6df52306138314607a6f3f0acd2e7afc783d1c
c9eb23c12c7eb93a1f86e7e067d11288bd139f2787c99d66b6cb7271b5edbfd1