sec-acc-log.com Open in urlscan Pro
103.84.172.18 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://sec-acc-log.com/signin/myaccount/
Effective URL:
http://sec-acc-log.com/signin/myaccount/9bd91/home?cmd=_account-details&session=a6b10c8fcac5bab3002b0e35676897d5&dispat...
Submission: On January 26 via manual (January 26th 2018, 1:53:11 am UTC) from US

Summary HTTP 17 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 17 HTTP transactions. The main IP is 103.84.172.18, located in Bangladesh and belongs to TOMATTOSTL-AS-AP Tomattos Technologies Ltd., BD. The main domain is sec-acc-log.com.

This is the only time sec-acc-log.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: PayPal (Financial)

Domain & IP information

	IP Address		AS Autonomous System
3 16	103.84.172.18 103.84.172.18		136246 (TOMATTOST...) (TOMATTOSTL-AS-AP Tomattos Technologies Ltd.)
3	92.123.92.235 92.123.92.235		16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
1	2.21.161.21 2.21.161.21		16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
17	3

16 103.84.172.18 (Bangladesh) 3 redirects

ASN136246 (TOMATTOSTL-AS-AP Tomattos Technologies Ltd., BD)

sec-acc-log.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 92.123.92.235 (European Union)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a92-123-92-235.deploy.akamaitechnologies.com

www.paypalobjects.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.21.161.21 (European Union)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)

t.paypal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
16	sec-acc-log.com 3 redirects sec-acc-log.com	742 KB
3	paypalobjects.com www.paypalobjects.com	109 KB
1	paypal.com t.paypal.com	728 B
17	3

	Domain	Requested by
16	sec-acc-log.com	3 redirects sec-acc-log.com
3	www.paypalobjects.com	sec-acc-log.com
1	t.paypal.com
17	3

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://sec-acc-log.com/signin/myaccount/9bd91/home?cmd=_account-details&session=a6b10c8fcac5bab3002b0e35676897d5&dispatch=9a3b1865d632274d55d81711d02eaa3554fd5034
Frame ID: (30D5F63551B64A9251EB074102B16250)
Requests: 17 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://sec-acc-log.com/signin/myaccount/ HTTP 302
http://sec-acc-log.com/signin/myaccount/9bd91 HTTP 301
http://sec-acc-log.com/signin/myaccount/9bd91/ HTTP 302
http://sec-acc-log.com/signin/myaccount/9bd91/home?cmd=_account-details&session=a6b10c8fcac5bab3002... Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

PayPal (Payment Processors) Expand

Overall confidence: 100%
Detected patterns

env /^PAYPAL$/i

RequireJS (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

script /require.*\.js/i
env /^requirejs$/i

SiteCatalyst (Analytics) Expand

Overall confidence: 100%
Detected patterns

env /^s_(?:account|objectID|code|INST)$/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

env /^jQuery$/i

Page Statistics

17
Requests

0 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

850 kB
Transfer

1120 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://sec-acc-log.com/signin/myaccount/ HTTP 302
http://sec-acc-log.com/signin/myaccount/9bd91 HTTP 301
http://sec-acc-log.com/signin/myaccount/9bd91/ HTTP 302
http://sec-acc-log.com/signin/myaccount/9bd91/home?cmd=_account-details&session=a6b10c8fcac5bab3002b0e35676897d5&dispatch=9a3b1865d632274d55d81711d02eaa3554fd5034 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request home Show response sec-acc-log.com/signin/myaccount/9bd91/ Redirect Chain http://sec-acc-log.com/signin/myaccount/ http://sec-acc-log.com/signin/myaccount/9bd91 http://sec-acc-log.com/signin/myaccount/9bd91/ http://sec-acc-log.com/signin/myaccount/9bd91/home?cmd=_account-details&session=a6b10c8fcac5bab3002b0e35676897d5&dispatch=9a3b1865d632274d55d81711d02eaa3554fd5034	10 KB 10 KB	1277ms 1276ms	Document text/html	103.84.172.18 TOMATTOSTL-AS-AP ...
General Check archive.org Show headers Download Go to Full URL http://sec-acc-log.com/signin/myaccount/9bd91/home?cmd=_account-details&session=a6b10c8fcac5bab3002b0e35676897d5&dispatch=9a3b1865d632274d55d81711d02eaa3554fd5034 Protocol HTTP/1.1 Server 103.84.172.18 , Bangladesh, ASN136246 (TOMATTOSTL-AS-AP Tomattos Technologies Ltd., BD), Reverse DNS Software Apache / Resource Hash `c3f0ec5a35917d9b594c4f3abf3bb2dc0ea01496105eebf1792934333c9569cf` Request headers Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Connection keep-alive Accept-Encoding gzip, deflate Host sec-acc-log.com Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Fri, 26 Jan 2018 01:52:57 GMT Content-Encoding gzip Server Apache Vary Accept-Encoding Content-Type text/html; charset=UTF-8 Transfer-Encoding chunked Connection Keep-Alive Keep-Alive timeout=5, max=99 Redirect headers Date Fri, 26 Jan 2018 01:52:56 GMT Content-Encoding gzip Server Apache Vary Accept-Encoding Content-Type text/html; charset=UTF-8 location home?cmd=_account-details&session=a6b10c8fcac5bab3002b0e35676897d5&dispatch=9a3b1865d632274d55d81711d02eaa3554fd5034 Transfer-Encoding chunked Connection Keep-Alive Keep-Alive timeout=5, max=99
GET H/1.1	200 OK	app.css sec-acc-log.com/signin/Suspicious_files/	172 KB 172 KB	338ms 337ms	Stylesheet text/css	103.84.172.18 TOMATTOSTL-AS-AP ...
General Check archive.org Show headers Download Go to Full URL http://sec-acc-log.com/signin/Suspicious_files/app.css Requested by Host: sec-acc-log.com URL: http://sec-acc-log.com/signin/myaccount/9bd91/home?cmd=_account-details&session=a6b10c8fcac5bab3002b0e35676897d5&dispatch=9a3b1865d632274d55d81711d02eaa3554fd5034 Protocol HTTP/1.1 Server 103.84.172.18 , Bangladesh, ASN136246 (TOMATTOSTL-AS-AP Tomattos Technologies Ltd., BD), Reverse DNS Software Apache / Resource Hash `417c9a56495a1a8c7022f358df0f3c265f6d5e7eb2a3452a5f52cb5b7983bf4c` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host sec-acc-log.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept text/css,/;q=0.1 Referer http://sec-acc-log.com/signin/myaccount/9bd91/home?cmd=_account-details&session=a6b10c8fcac5bab3002b0e35676897d5&dispatch=9a3b1865d632274d55d81711d02eaa3554fd5034 Connection keep-alive Cache-Control no-cache Referer http://sec-acc-log.com/signin/myaccount/9bd91/home?cmd=_account-details&session=a6b10c8fcac5bab3002b0e35676897d5&dispatch=9a3b1865d632274d55d81711d02eaa3554fd5034 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Fri, 26 Jan 2018 01:52:58 GMT Last-Modified Wed, 21 Sep 2016 14:06:54 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 175663
GET H/1.1	200 OK	app.js Show response sec-acc-log.com/signin/Suspicious_files/	382 KB 382 KB	324ms 324ms	Script application/javascript	103.84.172.18 TOMATTOSTL-AS-AP ...
General Check archive.org Show headers Download Go to Full URL http://sec-acc-log.com/signin/Suspicious_files/app.js Requested by Host: sec-acc-log.com URL: http://sec-acc-log.com/signin/myaccount/9bd91/home?cmd=_account-details&session=a6b10c8fcac5bab3002b0e35676897d5&dispatch=9a3b1865d632274d55d81711d02eaa3554fd5034 Protocol HTTP/1.1 Server 103.84.172.18 , Bangladesh, ASN136246 (TOMATTOSTL-AS-AP Tomattos Technologies Ltd., BD), Reverse DNS Software Apache / Resource Hash `0a8c7553b10d35e2a00d78f83fe564c11d92deca635cda10580766b51ac47fd9` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host sec-acc-log.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept / Referer http://sec-acc-log.com/signin/myaccount/9bd91/home?cmd=_account-details&session=a6b10c8fcac5bab3002b0e35676897d5&dispatch=9a3b1865d632274d55d81711d02eaa3554fd5034 Connection keep-alive Cache-Control no-cache Referer http://sec-acc-log.com/signin/myaccount/9bd91/home?cmd=_account-details&session=a6b10c8fcac5bab3002b0e35676897d5&dispatch=9a3b1865d632274d55d81711d02eaa3554fd5034 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Fri, 26 Jan 2018 01:52:58 GMT Last-Modified Sat, 24 Oct 2015 20:29:28 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 390939
GET H/1.1	200 OK	config.js Show response sec-acc-log.com/signin/Suspicious_files/	600 B 855 B	689ms 350ms	Script application/javascript	103.84.172.18 TOMATTOSTL-AS-AP ...
General Check archive.org Show headers Download Go to Full URL http://sec-acc-log.com/signin/Suspicious_files/config.js Requested by Host: sec-acc-log.com URL: http://sec-acc-log.com/signin/myaccount/9bd91/home?cmd=_account-details&session=a6b10c8fcac5bab3002b0e35676897d5&dispatch=9a3b1865d632274d55d81711d02eaa3554fd5034 Protocol HTTP/1.1 Server 103.84.172.18 , Bangladesh, ASN136246 (TOMATTOSTL-AS-AP Tomattos Technologies Ltd., BD), Reverse DNS Software Apache / Resource Hash `05b3965cbe7889bbba309939196020bc0d3d935a5d185d82f7df429f389f9696` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host sec-acc-log.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept / Referer http://sec-acc-log.com/signin/myaccount/9bd91/home?cmd=_account-details&session=a6b10c8fcac5bab3002b0e35676897d5&dispatch=9a3b1865d632274d55d81711d02eaa3554fd5034 Connection keep-alive Cache-Control no-cache Referer http://sec-acc-log.com/signin/myaccount/9bd91/home?cmd=_account-details&session=a6b10c8fcac5bab3002b0e35676897d5&dispatch=9a3b1865d632274d55d81711d02eaa3554fd5034 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Fri, 26 Jan 2018 01:53:00 GMT Last-Modified Sat, 24 Oct 2015 20:29:28 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 600
GET H/1.1	200 OK	activity.js Show response sec-acc-log.com/signin/Suspicious_files/	1 B 253 B	686ms 345ms	Script application/javascript	103.84.172.18 TOMATTOSTL-AS-AP ...
General Check archive.org Show headers Download Go to Full URL http://sec-acc-log.com/signin/Suspicious_files/activity.js Requested by Host: sec-acc-log.com URL: http://sec-acc-log.com/signin/myaccount/9bd91/home?cmd=_account-details&session=a6b10c8fcac5bab3002b0e35676897d5&dispatch=9a3b1865d632274d55d81711d02eaa3554fd5034 Protocol HTTP/1.1 Server 103.84.172.18 , Bangladesh, ASN136246 (TOMATTOSTL-AS-AP Tomattos Technologies Ltd., BD), Reverse DNS Software Apache / Resource Hash `41b805ea7ac014e23556e98bb374702a08344268f92489a02f0880849394a1e4` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host sec-acc-log.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept / Referer http://sec-acc-log.com/signin/myaccount/9bd91/home?cmd=_account-details&session=a6b10c8fcac5bab3002b0e35676897d5&dispatch=9a3b1865d632274d55d81711d02eaa3554fd5034 Connection keep-alive Cache-Control no-cache Referer http://sec-acc-log.com/signin/myaccount/9bd91/home?cmd=_account-details&session=a6b10c8fcac5bab3002b0e35676897d5&dispatch=9a3b1865d632274d55d81711d02eaa3554fd5034 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Fri, 26 Jan 2018 01:53:00 GMT Last-Modified Sat, 24 Oct 2015 20:29:28 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=96 Content-Length 1
GET H/1.1	200 OK	translateelement.css sec-acc-log.com/signin/Suspicious_files/	17 KB 18 KB	643ms 327ms	Stylesheet text/css	103.84.172.18 TOMATTOSTL-AS-AP ...
General Check archive.org Show headers Download Go to Full URL http://sec-acc-log.com/signin/Suspicious_files/translateelement.css Requested by Host: sec-acc-log.com URL: http://sec-acc-log.com/signin/myaccount/9bd91/home?cmd=_account-details&session=a6b10c8fcac5bab3002b0e35676897d5&dispatch=9a3b1865d632274d55d81711d02eaa3554fd5034 Protocol HTTP/1.1 Server 103.84.172.18 , Bangladesh, ASN136246 (TOMATTOSTL-AS-AP Tomattos Technologies Ltd., BD), Reverse DNS Software Apache / Resource Hash `89b95375e63b25663cc6e1c7304acc78439a961f9be4d3b7810fe50d57eb3f76` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host sec-acc-log.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept text/css,/;q=0.1 Referer http://sec-acc-log.com/signin/myaccount/9bd91/home?cmd=_account-details&session=a6b10c8fcac5bab3002b0e35676897d5&dispatch=9a3b1865d632274d55d81711d02eaa3554fd5034 Connection keep-alive Cache-Control no-cache Referer http://sec-acc-log.com/signin/myaccount/9bd91/home?cmd=_account-details&session=a6b10c8fcac5bab3002b0e35676897d5&dispatch=9a3b1865d632274d55d81711d02eaa3554fd5034 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Fri, 26 Jan 2018 01:52:58 GMT Last-Modified Sat, 24 Oct 2015 20:29:28 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 17752
GET H/1.1	200 OK	logo_paypal_106x29.png sec-acc-log.com/signin/Suspicious_files/	5 KB 5 KB	581ms 329ms	Image image/png	103.84.172.18 TOMATTOSTL-AS-AP ...
General Check archive.org Show headers Download Go to Show image Full URL http://sec-acc-log.com/signin/Suspicious_files/logo_paypal_106x29.png Requested by Host: sec-acc-log.com URL: http://sec-acc-log.com/signin/myaccount/9bd91/home?cmd=_account-details&session=a6b10c8fcac5bab3002b0e35676897d5&dispatch=9a3b1865d632274d55d81711d02eaa3554fd5034 Protocol HTTP/1.1 Server 103.84.172.18 , Bangladesh, ASN136246 (TOMATTOSTL-AS-AP Tomattos Technologies Ltd., BD), Reverse DNS Software Apache / Resource Hash `ab39e6288837a25d62b740906db369081f38978b23570148c28ed41f509d4fe2` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host sec-acc-log.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://sec-acc-log.com/signin/myaccount/9bd91/home?cmd=_account-details&session=a6b10c8fcac5bab3002b0e35676897d5&dispatch=9a3b1865d632274d55d81711d02eaa3554fd5034 Connection keep-alive Cache-Control no-cache Referer http://sec-acc-log.com/signin/myaccount/9bd91/home?cmd=_account-details&session=a6b10c8fcac5bab3002b0e35676897d5&dispatch=9a3b1865d632274d55d81711d02eaa3554fd5034 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Fri, 26 Jan 2018 01:53:00 GMT Last-Modified Sat, 24 Oct 2015 20:29:28 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 4699
GET H/1.1	200 OK	peek-shield-logo.png sec-acc-log.com/signin/Suspicious_files/	4 KB 5 KB	652ms 343ms	Image image/png	103.84.172.18 TOMATTOSTL-AS-AP ...
General Check archive.org Show headers Download Go to Show image Full URL http://sec-acc-log.com/signin/Suspicious_files/peek-shield-logo.png Requested by Host: sec-acc-log.com URL: http://sec-acc-log.com/signin/myaccount/9bd91/home?cmd=_account-details&session=a6b10c8fcac5bab3002b0e35676897d5&dispatch=9a3b1865d632274d55d81711d02eaa3554fd5034 Protocol HTTP/1.1 Server 103.84.172.18 , Bangladesh, ASN136246 (TOMATTOSTL-AS-AP Tomattos Technologies Ltd., BD), Reverse DNS Software Apache / Resource Hash `6c24e9fc3844d713e81e8182d435b1ec16df0b291e559742c5842f995b2e0498` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host sec-acc-log.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://sec-acc-log.com/signin/myaccount/9bd91/home?cmd=_account-details&session=a6b10c8fcac5bab3002b0e35676897d5&dispatch=9a3b1865d632274d55d81711d02eaa3554fd5034 Connection keep-alive Cache-Control no-cache Referer http://sec-acc-log.com/signin/myaccount/9bd91/home?cmd=_account-details&session=a6b10c8fcac5bab3002b0e35676897d5&dispatch=9a3b1865d632274d55d81711d02eaa3554fd5034 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Fri, 26 Jan 2018 01:53:00 GMT Last-Modified Sat, 24 Oct 2015 20:29:28 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 4440
GET H/1.1	200 OK	require-spinner.js Show response sec-acc-log.com/signin/Suspicious_files/	6 KB 6 KB	669ms 344ms	Script application/javascript	103.84.172.18 TOMATTOSTL-AS-AP ...
General Check archive.org Show headers Download Go to Full URL http://sec-acc-log.com/signin/Suspicious_files/require-spinner.js Requested by Host: sec-acc-log.com URL: http://sec-acc-log.com/signin/myaccount/9bd91/home?cmd=_account-details&session=a6b10c8fcac5bab3002b0e35676897d5&dispatch=9a3b1865d632274d55d81711d02eaa3554fd5034 Protocol HTTP/1.1 Server 103.84.172.18 , Bangladesh, ASN136246 (TOMATTOSTL-AS-AP Tomattos Technologies Ltd., BD), Reverse DNS Software Apache / Resource Hash `9c0821da2aee265221ce1c392604dd4b0901e2f671b87c6c7d141e8f698d4ca7` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host sec-acc-log.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept / Referer http://sec-acc-log.com/signin/myaccount/9bd91/home?cmd=_account-details&session=a6b10c8fcac5bab3002b0e35676897d5&dispatch=9a3b1865d632274d55d81711d02eaa3554fd5034 Connection keep-alive Cache-Control no-cache Referer http://sec-acc-log.com/signin/myaccount/9bd91/home?cmd=_account-details&session=a6b10c8fcac5bab3002b0e35676897d5&dispatch=9a3b1865d632274d55d81711d02eaa3554fd5034 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Fri, 26 Jan 2018 01:52:58 GMT Last-Modified Sat, 24 Oct 2015 20:29:28 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 5844
GET H/1.1	200 OK	require.js Show response sec-acc-log.com/signin/Suspicious_files/	15 KB 15 KB	340ms 339ms	Script application/javascript	103.84.172.18 TOMATTOSTL-AS-AP ...
General Check archive.org Show headers Download Go to Full URL http://sec-acc-log.com/signin/Suspicious_files/require.js Requested by Host: sec-acc-log.com URL: http://sec-acc-log.com/signin/myaccount/9bd91/home?cmd=_account-details&session=a6b10c8fcac5bab3002b0e35676897d5&dispatch=9a3b1865d632274d55d81711d02eaa3554fd5034 Protocol HTTP/1.1 Server 103.84.172.18 , Bangladesh, ASN136246 (TOMATTOSTL-AS-AP Tomattos Technologies Ltd., BD), Reverse DNS Software Apache / Resource Hash `c007d73792ac2d25882bfbb573e700e721a0adacfab947e6a0b64a61991fecf0` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host sec-acc-log.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept / Referer http://sec-acc-log.com/signin/myaccount/9bd91/home?cmd=_account-details&session=a6b10c8fcac5bab3002b0e35676897d5&dispatch=9a3b1865d632274d55d81711d02eaa3554fd5034 Connection keep-alive Cache-Control no-cache Referer http://sec-acc-log.com/signin/myaccount/9bd91/home?cmd=_account-details&session=a6b10c8fcac5bab3002b0e35676897d5&dispatch=9a3b1865d632274d55d81711d02eaa3554fd5034 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Fri, 26 Jan 2018 01:52:59 GMT Last-Modified Sat, 24 Oct 2015 20:29:28 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 14854
GET H/1.1	200 OK	pp_jscode_080706.js Show response sec-acc-log.com/signin/Suspicious_files/	60 KB 61 KB	318ms 317ms	Script application/javascript	103.84.172.18 TOMATTOSTL-AS-AP ...
General Check archive.org Show headers Download Go to Full URL http://sec-acc-log.com/signin/Suspicious_files/pp_jscode_080706.js Requested by Host: sec-acc-log.com URL: http://sec-acc-log.com/signin/myaccount/9bd91/home?cmd=_account-details&session=a6b10c8fcac5bab3002b0e35676897d5&dispatch=9a3b1865d632274d55d81711d02eaa3554fd5034 Protocol HTTP/1.1 Server 103.84.172.18 , Bangladesh, ASN136246 (TOMATTOSTL-AS-AP Tomattos Technologies Ltd., BD), Reverse DNS Software Apache / Resource Hash `9bbf1ce51d9751054757ff383e410a379a4b1ee26527334f4add83fbfba1d36c` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host sec-acc-log.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept / Referer http://sec-acc-log.com/signin/myaccount/9bd91/home?cmd=_account-details&session=a6b10c8fcac5bab3002b0e35676897d5&dispatch=9a3b1865d632274d55d81711d02eaa3554fd5034 Connection keep-alive Cache-Control no-cache Referer http://sec-acc-log.com/signin/myaccount/9bd91/home?cmd=_account-details&session=a6b10c8fcac5bab3002b0e35676897d5&dispatch=9a3b1865d632274d55d81711d02eaa3554fd5034 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Fri, 26 Jan 2018 01:52:59 GMT Last-Modified Sat, 24 Oct 2015 20:29:28 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 61883
GET H/1.1	200 OK	pa.js Show response sec-acc-log.com/signin/Suspicious_files/	66 KB 67 KB	335ms 334ms	Script application/javascript	103.84.172.18 TOMATTOSTL-AS-AP ...
General Check archive.org Show headers Download Go to Full URL http://sec-acc-log.com/signin/Suspicious_files/pa.js Requested by Host: sec-acc-log.com URL: http://sec-acc-log.com/signin/myaccount/9bd91/home?cmd=_account-details&session=a6b10c8fcac5bab3002b0e35676897d5&dispatch=9a3b1865d632274d55d81711d02eaa3554fd5034 Protocol HTTP/1.1 Server 103.84.172.18 , Bangladesh, ASN136246 (TOMATTOSTL-AS-AP Tomattos Technologies Ltd., BD), Reverse DNS Software Apache / Resource Hash `98ecaad59fce14516bd1c79d6361e1f798a6cf3d077b68b5807adc153c5fb389` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host sec-acc-log.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept / Referer http://sec-acc-log.com/signin/myaccount/9bd91/home?cmd=_account-details&session=a6b10c8fcac5bab3002b0e35676897d5&dispatch=9a3b1865d632274d55d81711d02eaa3554fd5034 Connection keep-alive Cache-Control no-cache Referer http://sec-acc-log.com/signin/myaccount/9bd91/home?cmd=_account-details&session=a6b10c8fcac5bab3002b0e35676897d5&dispatch=9a3b1865d632274d55d81711d02eaa3554fd5034 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Fri, 26 Jan 2018 01:52:59 GMT Last-Modified Sat, 24 Oct 2015 20:29:28 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 67902
GET H/1.1	200 OK	translate_24dp.png sec-acc-log.com/signin/Suspicious_files/	825 B 1 KB	329ms 329ms	Image image/png	103.84.172.18 TOMATTOSTL-AS-AP ...
General Check archive.org Show headers Download Go to Show image Full URL http://sec-acc-log.com/signin/Suspicious_files/translate_24dp.png Requested by Host: sec-acc-log.com URL: http://sec-acc-log.com/signin/myaccount/9bd91/home?cmd=_account-details&session=a6b10c8fcac5bab3002b0e35676897d5&dispatch=9a3b1865d632274d55d81711d02eaa3554fd5034 Protocol HTTP/1.1 Server 103.84.172.18 , Bangladesh, ASN136246 (TOMATTOSTL-AS-AP Tomattos Technologies Ltd., BD), Reverse DNS Software Apache / Resource Hash `1bb2279aed6bc1438d2b17a5ffcbac9d37864582aedeeec8d301eab162b2c213` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host sec-acc-log.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://sec-acc-log.com/signin/myaccount/9bd91/home?cmd=_account-details&session=a6b10c8fcac5bab3002b0e35676897d5&dispatch=9a3b1865d632274d55d81711d02eaa3554fd5034 Connection keep-alive Cache-Control no-cache Referer http://sec-acc-log.com/signin/myaccount/9bd91/home?cmd=_account-details&session=a6b10c8fcac5bab3002b0e35676897d5&dispatch=9a3b1865d632274d55d81711d02eaa3554fd5034 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Fri, 26 Jan 2018 01:53:00 GMT Last-Modified Sat, 24 Oct 2015 20:29:28 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=96 Content-Length 825
GET S	200	app.js Show response www.paypalobjects.com/web/res/7a7/dd87ef7a2afbb69dece5be488ad19/js/	382 KB 108 KB	27ms 13ms	Script application/x-javascript	92.123.92.235 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://www.paypalobjects.com/web/res/7a7/dd87ef7a2afbb69dece5be488ad19/js/app.js Requested by Host: sec-acc-log.com URL: http://sec-acc-log.com/signin/Suspicious_files/require.js Protocol SPDY Server 92.123.92.235 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a92-123-92-235.deploy.akamaitechnologies.com Software Apache / Resource Hash `0a8c7553b10d35e2a00d78f83fe564c11d92deca635cda10580766b51ac47fd9` Request headers Referer http://sec-acc-log.com/signin/myaccount/9bd91/home?cmd=_account-details&session=a6b10c8fcac5bab3002b0e35676897d5&dispatch=9a3b1865d632274d55d81711d02eaa3554fd5034 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers date Fri, 26 Jan 2018 01:53:00 GMT x-pad avoid browser bug last-modified Thu, 08 Oct 2015 09:16:07 GMT server Apache vary Accept-Encoding content-type application/x-javascript status 200 cache-control max-age=7776000 accept-ranges bytes content-encoding gzip expires Thu, 26 Apr 2018 01:53:00 GMT
GET S	200	config.js Show response www.paypalobjects.com/web/res/7a7/dd87ef7a2afbb69dece5be488ad19/js/	600 B 774 B	19ms 6ms	Script application/x-javascript	92.123.92.235 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://www.paypalobjects.com/web/res/7a7/dd87ef7a2afbb69dece5be488ad19/js/config.js Requested by Host: sec-acc-log.com URL: http://sec-acc-log.com/signin/Suspicious_files/require.js Protocol SPDY Server 92.123.92.235 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a92-123-92-235.deploy.akamaitechnologies.com Software Apache / Resource Hash `05b3965cbe7889bbba309939196020bc0d3d935a5d185d82f7df429f389f9696` Request headers Referer http://sec-acc-log.com/signin/myaccount/9bd91/home?cmd=_account-details&session=a6b10c8fcac5bab3002b0e35676897d5&dispatch=9a3b1865d632274d55d81711d02eaa3554fd5034 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers date Fri, 26 Jan 2018 01:53:00 GMT last-modified Thu, 08 Oct 2015 09:16:07 GMT server Apache vary Accept-Encoding content-type application/x-javascript status 200 cache-control max-age=7776000 accept-ranges bytes content-length 600 expires Thu, 26 Apr 2018 01:53:00 GMT
GET S	200	activity.js Show response www.paypalobjects.com/web/res/7a7/dd87ef7a2afbb69dece5be488ad19/js/view/s12n/ato/	1 B 174 B	6ms 6ms	Script application/x-javascript	92.123.92.235 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://www.paypalobjects.com/web/res/7a7/dd87ef7a2afbb69dece5be488ad19/js/view/s12n/ato/activity.js Requested by Host: sec-acc-log.com URL: http://sec-acc-log.com/signin/Suspicious_files/require.js Protocol SPDY Server 92.123.92.235 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a92-123-92-235.deploy.akamaitechnologies.com Software Apache / Resource Hash `41b805ea7ac014e23556e98bb374702a08344268f92489a02f0880849394a1e4` Request headers Referer http://sec-acc-log.com/signin/myaccount/9bd91/home?cmd=_account-details&session=a6b10c8fcac5bab3002b0e35676897d5&dispatch=9a3b1865d632274d55d81711d02eaa3554fd5034 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers date Fri, 26 Jan 2018 01:53:00 GMT last-modified Thu, 08 Oct 2015 09:16:09 GMT server Apache vary Accept-Encoding content-type application/x-javascript status 200 cache-control max-age=7776000 accept-ranges bytes content-length 1 expires Thu, 26 Apr 2018 01:53:00 GMT
GET H/1.1	200 OK	ts t.paypal.com/	42 B 728 B	201ms 189ms	Image image/gif	2.21.161.21 Akamai Technologies
General Check archive.org Show headers Download Go to Show image Full URL https://t.paypal.com/ts?v=0.1&t=1516931581671&g=0&e=im&pgrp=main%3Asafe%3Arestriction%3Agrey-user%3A%3Aactivity&page=main%3Asafe%3Arestriction%3Agrey-user%3A%3Aactivity&tmpl=main%3Asafe%3Arestriction%3Agrey-user%3A%3Aactivity&pgst=1445743757471&calc=e27a076b6ee79&rsta=ja_JP&pgtf=Nodejs&s=ci&csci=421f92fc012d42779ac376914d59cfa2&comp=secureflownodeweb&tsrce=secureflownodeweb&pt=Suspicious%20Activities%20-%20PayPaI&cd=24&sw=1600&sh=1200&bw=1600&bh=1200&ce=1&t1=0&t1c=0&t1d=0&t1s=0&t2=1276&t3=4&t4d=2333&t4=2336&t4e=3&tt=5696 Protocol HTTP/1.1 Server 2.21.161.21 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS Software akka-http/10.0.9-PayPal-2 / Resource Hash `6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93` Request headers Referer http://sec-acc-log.com/signin/myaccount/9bd91/home?cmd=_account-details&session=a6b10c8fcac5bab3002b0e35676897d5&dispatch=9a3b1865d632274d55d81711d02eaa3554fd5034 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Pragma no-cache Date Fri, 26 Jan 2018 01:53:01 GMT Server akka-http/10.0.9-PayPal-2 P3P policyref="https://t.paypal.com/w3c/p3p.xml",CP="CAO IND OUR SAM UNI STA COR COM" HTTP_X_PP_AZ_LOCATOR slca.slc Cache-Control max-age=0, no-cache, no-store Connection keep-alive Content-Type image/gif Content-Length 42 Expires Fri, 26 Jan 2018 01:53:01 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial)

31 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| RequireSpinners function| Spinner function| requirejs function| require function| define function| $ function| jQuery object| dust object| jQuery111008096429830645204 string| sc_code_ver string| s_account object| s function| s_doPlugins string| s_code undefined| s_objectID function| s_gi function| s_giqf string| s_an function| s_sp function| s_jn function| s_rep function| s_d function| s_fe function| s_fa function| s_ft object| s_c_il number| s_c_in number| s_giq object| PAYPAL object| fpti string| fptiserverurl

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.sec-acc-log.com/	1970-01-01 00:00:00	Name: s_sess Value: %20s_ppv%3D100%3B

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: http://sec-acc-log.com/signin/myaccount/9bd91/home?cmd=_account-details&session=a6b10c8fcac5bab3002b0e35676897d5&dispatch=9a3b1865d632274d55d81711d02eaa3554fd5034(Line 45) Message: view/s12n/ato/activity loaded.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

sec-acc-log.com
t.paypal.com
www.paypalobjects.com
103.84.172.18
2.21.161.21
92.123.92.235
05b3965cbe7889bbba309939196020bc0d3d935a5d185d82f7df429f389f9696
0a8c7553b10d35e2a00d78f83fe564c11d92deca635cda10580766b51ac47fd9
1bb2279aed6bc1438d2b17a5ffcbac9d37864582aedeeec8d301eab162b2c213
417c9a56495a1a8c7022f358df0f3c265f6d5e7eb2a3452a5f52cb5b7983bf4c
41b805ea7ac014e23556e98bb374702a08344268f92489a02f0880849394a1e4
6c24e9fc3844d713e81e8182d435b1ec16df0b291e559742c5842f995b2e0498
6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93
89b95375e63b25663cc6e1c7304acc78439a961f9be4d3b7810fe50d57eb3f76
98ecaad59fce14516bd1c79d6361e1f798a6cf3d077b68b5807adc153c5fb389
9bbf1ce51d9751054757ff383e410a379a4b1ee26527334f4add83fbfba1d36c
9c0821da2aee265221ce1c392604dd4b0901e2f671b87c6c7d141e8f698d4ca7
ab39e6288837a25d62b740906db369081f38978b23570148c28ed41f509d4fe2
c007d73792ac2d25882bfbb573e700e721a0adacfab947e6a0b64a61991fecf0
c3f0ec5a35917d9b594c4f3abf3bb2dc0ea01496105eebf1792934333c9569cf