urlscan.io logo urlscan.io
SecurityTrails logo

lyons.elitepreviews.ca Open in urlscan Pro
209.44.109.146  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://links.awardco.com/wf/click?upn=OEm6m-2FImaZaoccK8wLc-2Fcxi8LixsHjcrdmJlJBjk6619SDhb4RkFWIdOejIfYj1y_haKJczK5wGvw-2...
Effective URL: https://lyons.elitepreviews.ca/service/paypal.fr/
Submission: On September 11 via manual from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 6 IPs in 4 countries across 8 domains to perform 16 HTTP transactions. The main IP is 209.44.109.146, located in Montreal, Canada and belongs to NETELLIGENT - eStruxture Data Centers Inc., CA. The main domain is lyons.elitepreviews.ca.
TLS certificate: Issued by cPanel, Inc. Certification Authority on August 24th 2019. Valid for: 3 months.
This is the only time lyons.elitepreviews.ca was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: PayPal (Financial)

Domain & IP information

IP Address AS Autonomous System
1 1 167.89.118.52 11377 (SENDGRID)
1 45.15.168.56 35913 (DEDIPATH-LLC)
3 2001:4de0:ac1... 20446 (HIGHWINDS3)
1 213.133.103.12 24940 (HETZNER-AS)
1 1 67.199.248.11 395224 (BITLY-AS)
9 209.44.109.146 10929 (NETELLIGENT)
1 151.101.114.110 54113 (FASTLY)
1 162.247.242.21 23467 (NEWRELIC-...)
16 6
1    167.89.118.52 (United States)

ASN11377 (SENDGRID - SendGrid, Inc., US)
PTR: o16789118x52.outbound-mail.sendgrid.net
links.awardco.com
1    45.15.168.56 (United States)

ASN35913 (DEDIPATH-LLC - DediPath, US)
fuelax.com
3    2001:4de0:ac19::1:b:2a (Netherlands)

ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US)
maxcdn.bootstrapcdn.com
1    213.133.103.12 (Nuremberg, Germany)

ASN24940 (HETZNER-AS, DE)
PTR: iscute.moe
aww.moe
1    67.199.248.11 (United States)

ASN395224 (BITLY-AS - Bitly Inc, US)
PTR: bit.ly
bit.ly
9    209.44.109.146 (Montreal, Canada)

ASN10929 (NETELLIGENT - eStruxture Data Centers Inc., CA)
PTR: mail.box01.elitewebsitewizard.com
lyons.elitepreviews.ca
1    151.101.114.110 (Frankfurt am Main, Germany)

ASN54113 (FASTLY - Fastly, US)
js-agent.newrelic.com
1    162.247.242.21 (San Francisco, United States)

ASN23467 (NEWRELIC-AS-1 - New Relic, US)
PTR: bam-9.nr-data.net
bam.nr-data.net
Domain Requested by
9 lyons.elitepreviews.ca lyons.elitepreviews.ca
3 maxcdn.bootstrapcdn.com fuelax.com
1 bam.nr-data.net js-agent.newrelic.com
1 js-agent.newrelic.com lyons.elitepreviews.ca
1 bit.ly 1 redirects
1 aww.moe fuelax.com
1 fuelax.com
1 links.awardco.com 1 redirects
16 8

This site contains no links.

Subject Issuer Validity Valid
fuelax.com
cPanel, Inc. Certification Authority		 2019-08-18 -
2019-11-16		 3 months crt.sh
*.bootstrapcdn.com
COMODO RSA Domain Validation Secure Server CA		 2018-10-03 -
2019-10-12		 a year crt.sh
aww.moe
Let's Encrypt Authority X3		 2019-08-04 -
2019-11-02		 3 months crt.sh
lyons.elitepreviews.ca
cPanel, Inc. Certification Authority		 2019-08-24 -
2019-11-22		 3 months crt.sh
f4.shared.global.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3		 2019-04-10 -
2020-03-21		 a year crt.sh
*.nr-data.net
GeoTrust RSA CA 2018		 2018-01-11 -
2020-03-17		 2 years crt.sh

This page contains 1 frames:

Primary Page: https://lyons.elitepreviews.ca/service/paypal.fr/
Frame ID: 5D771DBABEF1879109B7FBDCAFDFFBDD
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://links.awardco.com/wf/click?upn=OEm6m-2FImaZaoccK8wLc-2Fcxi8LixsHjcrdmJlJBjk6619SDhb4RkFWIdOejI... HTTP 302
    https://fuelax.com/fr.redir.html Page URL
  2. http://bit.ly/2kprfbH HTTP 301
    https://lyons.elitepreviews.ca/service/paypal.fr/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
  • script /(?:\/([\d.]+))?(?:\/js)?\/bootstrap(?:\.min)?\.js/i
Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i
Overall confidence: 100%
Detected patterns
  • script /jquery[.-]([\d.]*\d)[^\/]*\.js/i
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

16
Requests

100 %
HTTPS

13 %
IPv6

8
Domains

8
Subdomains

6
IPs

4
Countries

162 kB
Transfer

532 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://links.awardco.com/wf/click?upn=OEm6m-2FImaZaoccK8wLc-2Fcxi8LixsHjcrdmJlJBjk6619SDhb4RkFWIdOejIfYj1y_haKJczK5wGvw-2BzEkPKhPzkALixcMkYxt-2BtdXxjOR7g4Pv4Zj6QG90txAmCTg6K2uInuK-2FfB1nmyu6F3DcphevyUe1CrhGvrjze30pK1tfI8PYAUZilsYKC72CEtqJi241VChBh41chXQK4wjPgW3v5F59RpODe3LZfw5d6tHb11furFxGzWtivsUidQonDjckXaW1aj3jnN-2Fdg844U9eEQ-3D-3D HTTP 302
    https://fuelax.com/fr.redir.html Page URL
  2. http://bit.ly/2kprfbH HTTP 301
    https://lyons.elitepreviews.ca/service/paypal.fr/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://links.awardco.com/wf/click?upn=OEm6m-2FImaZaoccK8wLc-2Fcxi8LixsHjcrdmJlJBjk6619SDhb4RkFWIdOejIfYj1y_haKJczK5wGvw-2BzEkPKhPzkALixcMkYxt-2BtdXxjOR7g4Pv4Zj6QG90txAmCTg6K2uInuK-2FfB1nmyu6F3DcphevyUe1CrhGvrjze30pK1tfI8PYAUZilsYKC72CEtqJi241VChBh41chXQK4wjPgW3v5F59RpODe3LZfw5d6tHb11furFxGzWtivsUidQonDjckXaW1aj3jnN-2Fdg844U9eEQ-3D-3D HTTP 302
  • https://fuelax.com/fr.redir.html

16 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
fr.redir.html
fuelax.com/
Redirect Chain
  • http://links.awardco.com/wf/click?upn=OEm6m-2FImaZaoccK8wLc-2Fcxi8LixsHjcrdmJlJBjk6619SDhb4RkFWIdOejIfYj1y_haKJczK5wGvw-2BzEkPKhPzkALixcMkYxt-2BtdXxjOR7g4Pv4Zj6QG90txAmCTg6K2uInuK-2FfB1nmyu6F3Dcphe...
  • https://fuelax.com/fr.redir.html
3 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://fuelax.com/fr.redir.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
45.15.168.56 , United States, ASN35913 (DEDIPATH-LLC - DediPath, US),
Reverse DNS
Software
Apache /
Resource Hash
9b8b6e6a20f6e198f478541c91b765f21e62048a57296d888a55b8921031287d

Request headers

Host
fuelax.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
none
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 11 Sep 2019 21:23:46 GMT
Server
Apache
Last-Modified
Wed, 11 Sep 2019 15:11:43 GMT
Accept-Ranges
bytes
Content-Length
3081
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Content-Type
text/html

Redirect headers

Server
nginx
Date
Wed, 11 Sep 2019 21:23:46 GMT
Content-Type
text/html; charset=utf-8
Transfer-Encoding
chunked
Connection
keep-alive
Location
https://fuelax.com/fr.redir.html
X-Robots-Tag
noindex, nofollow
bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/ 		118 KB
19 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css
Requested by
Host: fuelax.com
URL: https://fuelax.com/fr.redir.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac19::1:b:2a , Netherlands, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
Software
/
Resource Hash
f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c

Request headers

Sec-Fetch-Mode
cors
Referer
https://fuelax.com/fr.redir.html
Origin
https://fuelax.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 11 Sep 2019 21:23:46 GMT
content-encoding
gzip
last-modified
Wed, 12 Dec 2018 18:34:07 GMT
status
200
etag
"1544639647"
vary
Accept-Encoding
x-cache
HIT
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-hello-human
Say hello back! @getBootstrapCDN on Twitter
accept-ranges
bytes
timing-allow-origin
*
content-length
19740
bootstrap-theme.min.css
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/ 		23 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap-theme.min.css
Requested by
Host: fuelax.com
URL: https://fuelax.com/fr.redir.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac19::1:b:2a , Netherlands, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
Software
/
Resource Hash
653e073e97423adda5bc3917a241ee8497dd38a48f14bcde0098a4e54fd0fa5e

Request headers

Sec-Fetch-Mode
cors
Referer
https://fuelax.com/fr.redir.html
Origin
https://fuelax.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 11 Sep 2019 21:23:46 GMT
content-encoding
gzip
last-modified
Wed, 12 Dec 2018 18:34:07 GMT
status
200
etag
"1544639647"
vary
Accept-Encoding
x-cache
HIT
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-hello-human
Say hello back! @getBootstrapCDN on Twitter
accept-ranges
bytes
timing-allow-origin
*
content-length
2776
bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/ 		36 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js
Requested by
Host: fuelax.com
URL: https://fuelax.com/fr.redir.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac19::1:b:2a , Netherlands, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
Software
/
Resource Hash
53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef

Request headers

Sec-Fetch-Mode
cors
Referer
https://fuelax.com/fr.redir.html
Origin
https://fuelax.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 11 Sep 2019 21:23:46 GMT
content-encoding
gzip
last-modified
Wed, 12 Dec 2018 18:33:51 GMT
status
200
etag
"1544639631"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-hello-human
Say hello back! @getBootstrapCDN on Twitter
accept-ranges
bytes
timing-allow-origin
*
content-length
9832
jyowta.css
aww.moe/ 		42 KB
42 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://aww.moe/jyowta.css
Requested by
Host: fuelax.com
URL: https://fuelax.com/fr.redir.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
213.133.103.12 Nuremberg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
iscute.moe
Software
Caddy /
Resource Hash
18a569f10c35c4a4739a0cc5972f998cb588b6725c8641ac54a64682be0e57cd

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://fuelax.com/fr.redir.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
date
Wed, 11 Sep 2019 21:23:47 GMT
server
Caddy
x-pomf-cache-status
Cached
content-length
42829
content-type
text/plain
Primary Request Cookie set /
lyons.elitepreviews.ca/service/paypal.fr/
Redirect Chain
  • http://bit.ly/2kprfbH
  • https://lyons.elitepreviews.ca/service/paypal.fr/
9 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://lyons.elitepreviews.ca/service/paypal.fr/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.44.109.146 Montreal, Canada, ASN10929 (NETELLIGENT - eStruxture Data Centers Inc., CA),
Reverse DNS
mail.box01.elitewebsitewizard.com
Software
Apache / PHP/5.6.40
Resource Hash
d1257c75447a9105ffab61588bb6c4a4b659e49424384e155731d0a1bd2a10a8

Request headers

Host
lyons.elitepreviews.ca
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 11 Sep 2019 21:23:51 GMT
Server
Apache
X-Powered-By
PHP/5.6.40
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma
no-cache
Set-Cookie
PHPSESSID=d51321f0c6195dad2a86d5d6d3a47b05; path=/
Vary
Accept-Encoding,User-Agent
Content-Encoding
gzip
Content-Length
3805
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8

Redirect headers

Server
nginx
Date
Wed, 11 Sep 2019 21:23:51 GMT
Content-Type
text/html; charset=utf-8
Content-Length
136
Connection
keep-alive
Cache-Control
private, max-age=90
Location
https://lyons.elitepreviews.ca/service/paypal.fr/
Set-Cookie
_bit=j8blnP-a1b49313faf5c72b06-00S; Domain=bit.ly; Expires=Mon, 09 Mar 2020 21:23:51 GMT
normalize.css
lyons.elitepreviews.ca/service/paypal.fr/css/ 		8 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://lyons.elitepreviews.ca/service/paypal.fr/css/normalize.css
Requested by
Host: lyons.elitepreviews.ca
URL: https://lyons.elitepreviews.ca/service/paypal.fr/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.44.109.146 Montreal, Canada, ASN10929 (NETELLIGENT - eStruxture Data Centers Inc., CA),
Reverse DNS
mail.box01.elitewebsitewizard.com
Software
Apache /
Resource Hash
c13ab36ef47c80231ddd9e6774f9ada731e439a298e4a3471ad347cf5e4f36b5

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://lyons.elitepreviews.ca/service/paypal.fr/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 11 Sep 2019 21:23:52 GMT
Content-Encoding
gzip
Last-Modified
Fri, 20 Jul 2018 04:53:24 GMT
Server
Apache
Vary
Accept-Encoding,User-Agent
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
2102
bootstrap.min.css
lyons.elitepreviews.ca/service/paypal.fr/css/ 		118 KB
20 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://lyons.elitepreviews.ca/service/paypal.fr/css/bootstrap.min.css
Requested by
Host: lyons.elitepreviews.ca
URL: https://lyons.elitepreviews.ca/service/paypal.fr/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.44.109.146 Montreal, Canada, ASN10929 (NETELLIGENT - eStruxture Data Centers Inc., CA),
Reverse DNS
mail.box01.elitewebsitewizard.com
Software
Apache /
Resource Hash
f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://lyons.elitepreviews.ca/service/paypal.fr/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 11 Sep 2019 21:23:52 GMT
Content-Encoding
gzip
Last-Modified
Fri, 20 Jul 2018 04:53:02 GMT
Server
Apache
Vary
Accept-Encoding,User-Agent
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
19744
font-awesome.min.css
lyons.elitepreviews.ca/service/paypal.fr/css/ 		21 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://lyons.elitepreviews.ca/service/paypal.fr/css/font-awesome.min.css
Requested by
Host: lyons.elitepreviews.ca
URL: https://lyons.elitepreviews.ca/service/paypal.fr/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.44.109.146 Montreal, Canada, ASN10929 (NETELLIGENT - eStruxture Data Centers Inc., CA),
Reverse DNS
mail.box01.elitewebsitewizard.com
Software
Apache /
Resource Hash
0fb1bbca73646e8e2b93c82e8d8b219647b13d4b440c48e338290b9a685b8de1

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://lyons.elitepreviews.ca/service/paypal.fr/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 11 Sep 2019 21:23:52 GMT
Content-Encoding
gzip
Last-Modified
Sun, 30 Dec 2018 20:20:14 GMT
Server
Apache
Vary
Accept-Encoding,User-Agent
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
5042
login.css
lyons.elitepreviews.ca/service/paypal.fr/css/ 		5 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://lyons.elitepreviews.ca/service/paypal.fr/css/login.css
Requested by
Host: lyons.elitepreviews.ca
URL: https://lyons.elitepreviews.ca/service/paypal.fr/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.44.109.146 Montreal, Canada, ASN10929 (NETELLIGENT - eStruxture Data Centers Inc., CA),
Reverse DNS
mail.box01.elitewebsitewizard.com
Software
Apache /
Resource Hash
123a1d5f92b2744c003a176eb36ebcb867e8c46d6bea590ebccf57cac45d4f45

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://lyons.elitepreviews.ca/service/paypal.fr/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 11 Sep 2019 21:23:52 GMT
Content-Encoding
gzip
Last-Modified
Fri, 20 Jul 2018 04:53:14 GMT
Server
Apache
Vary
Accept-Encoding,User-Agent
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
1383
ppt.PNG
lyons.elitepreviews.ca/service/paypal.fr/img/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lyons.elitepreviews.ca/service/paypal.fr/img/ppt.PNG
Requested by
Host: lyons.elitepreviews.ca
URL: https://lyons.elitepreviews.ca/service/paypal.fr/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.44.109.146 Montreal, Canada, ASN10929 (NETELLIGENT - eStruxture Data Centers Inc., CA),
Reverse DNS
mail.box01.elitewebsitewizard.com
Software
Apache /
Resource Hash
30956198f3f7ad95a65a31f44304a35f639917b4b7f7fdea4622b9549c037cd0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://lyons.elitepreviews.ca/service/paypal.fr/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 11 Sep 2019 21:23:52 GMT
Last-Modified
Mon, 26 Feb 2018 16:31:30 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
1771
jquery-1.11.3.min.js
lyons.elitepreviews.ca/service/paypal.fr/js/ 		85 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://lyons.elitepreviews.ca/service/paypal.fr/js/jquery-1.11.3.min.js
Requested by
Host: lyons.elitepreviews.ca
URL: https://lyons.elitepreviews.ca/service/paypal.fr/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.44.109.146 Montreal, Canada, ASN10929 (NETELLIGENT - eStruxture Data Centers Inc., CA),
Reverse DNS
mail.box01.elitewebsitewizard.com
Software
Apache /
Resource Hash
4fe68fa216176e6d1f4580e924bafecc9f519984ecc06b1a840a08b0d88c95de

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://lyons.elitepreviews.ca/service/paypal.fr/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 11 Sep 2019 21:23:52 GMT
Content-Encoding
gzip
Last-Modified
Sun, 22 Jul 2018 04:39:46 GMT
Server
Apache
Vary
Accept-Encoding,User-Agent
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
30325
bootstrap.min.js
lyons.elitepreviews.ca/service/paypal.fr/js/ 		36 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://lyons.elitepreviews.ca/service/paypal.fr/js/bootstrap.min.js
Requested by
Host: lyons.elitepreviews.ca
URL: https://lyons.elitepreviews.ca/service/paypal.fr/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.44.109.146 Montreal, Canada, ASN10929 (NETELLIGENT - eStruxture Data Centers Inc., CA),
Reverse DNS
mail.box01.elitewebsitewizard.com
Software
Apache /
Resource Hash
53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://lyons.elitepreviews.ca/service/paypal.fr/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 11 Sep 2019 21:23:52 GMT
Content-Encoding
gzip
Last-Modified
Mon, 26 Feb 2018 16:31:26 GMT
Server
Apache
Vary
Accept-Encoding,User-Agent
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
9833
plugins.js
lyons.elitepreviews.ca/service/paypal.fr/js/ 		1 KB
706 B 		Script
General
Check archive.org
Download Go to
Full URL
https://lyons.elitepreviews.ca/service/paypal.fr/js/plugins.js
Requested by
Host: lyons.elitepreviews.ca
URL: https://lyons.elitepreviews.ca/service/paypal.fr/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.44.109.146 Montreal, Canada, ASN10929 (NETELLIGENT - eStruxture Data Centers Inc., CA),
Reverse DNS
mail.box01.elitewebsitewizard.com
Software
Apache /
Resource Hash
0a83ae246882910440cc1873ad058cef59425cdbbdd8debcd6ce787262780838

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://lyons.elitepreviews.ca/service/paypal.fr/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 11 Sep 2019 21:23:52 GMT
Content-Encoding
gzip
Last-Modified
Sun, 22 Jul 2018 02:43:44 GMT
Server
Apache
Vary
Accept-Encoding,User-Agent
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
394
nr-1130.min.js
js-agent.newrelic.com/ 		24 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js-agent.newrelic.com/nr-1130.min.js
Requested by
Host: lyons.elitepreviews.ca
URL: https://lyons.elitepreviews.ca/service/paypal.fr/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.110 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
0e78b8cde09dbe0fc473f87bc77ec30ccc56780398d8676cf93c4aaec432257f

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://lyons.elitepreviews.ca/service/paypal.fr/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 11 Sep 2019 21:23:52 GMT
content-encoding
gzip
x-amz-request-id
FC2E5E9385FF35C9
x-cache
HIT
status
200
content-length
9407
x-amz-id-2
3XNtuktyD4wqrPKGubF2M/YqUHo1gnfCUg2ZcA6WpCpRhqESM5LEOkXHaOHxrPCQ1vUCnpmkB8M=
x-served-by
cache-hhn4026-HHN
last-modified
Tue, 09 Jul 2019 23:52:06 GMT
server
AmazonS3
x-timer
S1568237032.340441,VS0,VE0
etag
"73f8857196b9ef7fd3b302cbc557b8ac"
vary
Accept-Encoding
content-type
application/javascript
via
1.1 varnish
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
114
94f202d03a
bam.nr-data.net/1/ 		57 B
261 B 		Script
General
Check archive.org
Download Go to
Full URL
https://bam.nr-data.net/1/94f202d03a?a=42008621&v=1130.54e767a&to=ZlZRMEBUXUYEWxJYXl8cZhZbGkBQF04PUlQeQ1IdQlRfGwNKSVhfVVZLSkJdQw%3D%3D&rst=1322&ref=https://lyons.elitepreviews.ca/service/paypal.fr/&ap=1&be=869&fe=1311&dc=1310&perf=%7B%22timing%22:%7B%22of%22:1568237031026,%22n%22:0,%22f%22:209,%22dn%22:210,%22dne%22:341,%22c%22:341,%22s%22:437,%22ce%22:540,%22rq%22:540,%22rp%22:854,%22rpe%22:855,%22dl%22:861,%22di%22:1310,%22ds%22:1310,%22de%22:1310,%22dc%22:1310,%22l%22:1310,%22le%22:1312%7D,%22navigation%22:%7B%7D%7D&fp=1218&fcp=1218&at=ShFSRghOTkg%3D&jsonp=NREUM.setToken
Requested by
Host: js-agent.newrelic.com
URL: https://js-agent.newrelic.com/nr-1130.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
162.247.242.21 San Francisco, United States, ASN23467 (NEWRELIC-AS-1 - New Relic, US),
Reverse DNS
bam-9.nr-data.net
Software
/
Resource Hash
f69a13217482dc43f25e74cfcb9391d0f06d22501f10f5cb5e413d2d98a5cd23

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://lyons.elitepreviews.ca/service/paypal.fr/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Expires
Thu, 01 Jan 1970 00:00:00 GMT
Content-Length
57
Content-Type
text/javascript;charset=ISO-8859-1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| NREUM object| newrelic function| __nr_require function| $ function| jQuery

0 Cookies

1 Console Messages

Source Level URL
Text
console-api warning URL: https://lyons.elitepreviews.ca/service/paypal.fr/js/jquery-1.11.3.min.js(Line 2)
Message:
jQuery.Deferred exception: $(...).mask is not a function