paypal-secure-center.com Open in urlscan Pro
146.185.214.143  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request wp-content Show response paypal-secure-center.com/	727 B 980 B	847ms 297ms	Document text/html	146.185.214.143 GHOST
General Check archive.org Show headers Download Go to Full URL http://paypal-secure-center.com/wp-content Protocol HTTP/1.1 Server 146.185.214.143 Sydney, Australia, ASN202422 (GHOST, LU), Reverse DNS kiwimonster004.example.com Software nginx / Resource Hash fce29e1fe6bf89c80ee27d17e1bd33bc2050ab5897bff235e3176e6f53d00661 Request headers Accept-Language de-DE,de;q=0.9 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36 Response headers Cache-Control max-age=0 no-cache Connection keep-alive Content-Length 727 Content-Type text/html; charset=utf-8 Date Thu, 31 Mar 2022 01:22:11 GMT Last-Modified Mon, 28 Mar 2022 06:35:56 GMT Server nginx
GET H/1.1	200 OK	app.6775eed8164f72ee06dec1c5e84f73d2.css paypal-secure-center.com/static/css/	902 KB 164 KB	306ms 305ms	Stylesheet text/css	146.185.214.143 GHOST
General Check archive.org Show headers Download Go to Full URL http://paypal-secure-center.com/static/css/app.6775eed8164f72ee06dec1c5e84f73d2.css Requested by Host: paypal-secure-center.com URL: http://paypal-secure-center.com/wp-content Protocol HTTP/1.1 Server 146.185.214.143 Sydney, Australia, ASN202422 (GHOST, LU), Reverse DNS kiwimonster004.example.com Software nginx / Resource Hash 77322b6d7dedc0088db9f75ad21b8cc867d8c76d774b2444a3e366abfb88a4a4 Request headers Accept-Language de-DE,de;q=0.9 Referer http://paypal-secure-center.com/wp-content User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36 Response headers Date Thu, 31 Mar 2022 01:22:11 GMT Content-Encoding gzip Last-Modified Mon, 28 Mar 2022 06:35:56 GMT Server nginx Vary Accept-Encoding X-Cache MISS Content-Type text/css; charset=utf-8 Cache-Control max-age=43200 Transfer-Encoding chunked Connection keep-alive Expires Thu, 31 Mar 2022 13:22:11 GMT
GET H/1.1	200 OK	manifest.3ad1d5771e9b13dbdad2.js Show response paypal-secure-center.com/static/js/	800 B 1 KB	304ms 303ms	Script application/javascript	146.185.214.143 GHOST
General Check archive.org Show headers Download Go to Full URL http://paypal-secure-center.com/static/js/manifest.3ad1d5771e9b13dbdad2.js Requested by Host: paypal-secure-center.com URL: http://paypal-secure-center.com/wp-content Protocol HTTP/1.1 Server 146.185.214.143 Sydney, Australia, ASN202422 (GHOST, LU), Reverse DNS kiwimonster004.example.com Software nginx / Resource Hash fcdf3becb34727e89ae7395ac70df92e4537639ae903784e201f479dd70f3ef0 Request headers Accept-Language de-DE,de;q=0.9 Referer http://paypal-secure-center.com/wp-content User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36 Response headers Date Thu, 31 Mar 2022 01:22:11 GMT Last-Modified Mon, 28 Mar 2022 06:35:56 GMT Server nginx X-Cache MISS Content-Type application/javascript; charset=utf-8 Cache-Control max-age=43200 Connection keep-alive Content-Length 800 Expires Thu, 31 Mar 2022 13:22:11 GMT
GET H/1.1	200 OK	vendor.1a0506386d0eeafc9405.js Show response paypal-secure-center.com/static/js/	4 MB 899 KB	576ms 295ms	Script application/javascript	146.185.214.143 GHOST
General Check archive.org Show headers Download Go to Full URL http://paypal-secure-center.com/static/js/vendor.1a0506386d0eeafc9405.js Requested by Host: paypal-secure-center.com URL: http://paypal-secure-center.com/wp-content Protocol HTTP/1.1 Server 146.185.214.143 Sydney, Australia, ASN202422 (GHOST, LU), Reverse DNS kiwimonster004.example.com Software nginx / Resource Hash 1471c0b82002e8eed175417e03444fa385c323d1784171e6d1a6dc6901c32228 Request headers Accept-Language de-DE,de;q=0.9 Referer http://paypal-secure-center.com/wp-content User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36 Response headers Date Thu, 31 Mar 2022 01:22:11 GMT Content-Encoding gzip Last-Modified Mon, 28 Mar 2022 06:35:56 GMT Server nginx Vary Accept-Encoding X-Cache MISS Content-Type application/javascript; charset=utf-8 Cache-Control max-age=43200 Transfer-Encoding chunked Connection keep-alive Expires Thu, 31 Mar 2022 13:22:11 GMT
GET H/1.1	200 OK	app.617bbf151160a5b1e144.js Show response paypal-secure-center.com/static/js/	96 KB 37 KB	687ms 391ms	Script application/javascript	146.185.214.143 GHOST
General Check archive.org Show headers Download Go to Full URL http://paypal-secure-center.com/static/js/app.617bbf151160a5b1e144.js Requested by Host: paypal-secure-center.com URL: http://paypal-secure-center.com/wp-content Protocol HTTP/1.1 Server 146.185.214.143 Sydney, Australia, ASN202422 (GHOST, LU), Reverse DNS kiwimonster004.example.com Software nginx / Resource Hash 3ebc007b9f6052ff95287c1c4c691e890a72a989b9c97d3cfd6466425c8e4bd9 Request headers Accept-Language de-DE,de;q=0.9 Referer http://paypal-secure-center.com/wp-content User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36 Response headers Date Thu, 31 Mar 2022 01:22:12 GMT Content-Encoding gzip Last-Modified Mon, 28 Mar 2022 06:35:56 GMT Server nginx Vary Accept-Encoding X-Cache MISS Content-Type application/javascript; charset=utf-8 Cache-Control max-age=43200 Transfer-Encoding chunked Connection keep-alive Expires Thu, 31 Mar 2022 13:22:12 GMT
GET H2	200	cityjson Show response pv.sohu.com/	77 B 236 B	3554ms 265ms	Script text/json	40.85.113.106 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://pv.sohu.com/cityjson?ie=utf-8 Requested by Host: paypal-secure-center.com URL: http://paypal-secure-center.com/wp-content Protocol H2 Security TLS 1.3, , AES_128_GCM Server 40.85.113.106 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software nginx/1.0.15 / Resource Hash 74d8a40da043c94f1a085834d877cc807b615f74dcb48905e39419e21f31e635 Request headers Accept-Language de-DE,de;q=0.9 Referer http://paypal-secure-center.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36 Response headers date Thu, 31 Mar 2022 01:22:14 GMT fss-proxy Powered by 2498351.3612473.3224384, Powered by 4347954.4610108.7765046 server nginx/1.0.15 content-length 77 content-type text/json; charset=utf-8
GET H/1.1	200 OK	getiplang Show response paypal-secure-center.com/auth/	85 B 272 B	874ms 873ms	XHR application/json	146.185.214.143 GHOST
General Check archive.org Show headers Download Go to Full URL http://paypal-secure-center.com/auth/getiplang Requested by Host: paypal-secure-center.com URL: http://paypal-secure-center.com/static/js/vendor.1a0506386d0eeafc9405.js Protocol HTTP/1.1 Server 146.185.214.143 Sydney, Australia, ASN202422 (GHOST, LU), Reverse DNS kiwimonster004.example.com Software nginx / Resource Hash 7b27416ef702ee38d8608cf59520b73320902b0ff656967754d73723d50b2255 Request headers Accept application/json, text/plain, */* Referer http://paypal-secure-center.com/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36 Response headers Date Thu, 31 Mar 2022 01:22:14 GMT Cache-Control no-cache Server nginx Connection keep-alive Content-Length 85 Content-Type application/json; charset=utf-8
GET H/1.1	200 OK	paypal-logo-129x32.svg paypal-secure-center.com/static/assets/img/	5 KB 5 KB	301ms 301ms	Image image/svg+xml	146.185.214.143 GHOST
General Check archive.org Show headers Download Go to Show image Full URL http://paypal-secure-center.com/static/assets/img/paypal-logo-129x32.svg Requested by Host: paypal-secure-center.com URL: http://paypal-secure-center.com/static/css/app.6775eed8164f72ee06dec1c5e84f73d2.css Protocol HTTP/1.1 Server 146.185.214.143 Sydney, Australia, ASN202422 (GHOST, LU), Reverse DNS kiwimonster004.example.com Software nginx / Resource Hash b3cc50b9e94bbecaaeb1079b64b8ca50616d1732824964c1cc2c5422627a0ec5 Request headers Accept-Language de-DE,de;q=0.9 Referer http://paypal-secure-center.com/static/css/app.6775eed8164f72ee06dec1c5e84f73d2.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36 Response headers Date Thu, 31 Mar 2022 01:22:14 GMT Cache-Control max-age=0, no-cache Last-Modified Mon, 28 Mar 2022 06:35:56 GMT Server nginx Connection keep-alive Content-Length 4945 Content-Type image/svg+xml

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone object| oncontextlost object| oncontextrestored function| webpackJsonp function| setImmediate function| clearImmediate object| __core-js_shared__ object| returnCitySN

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

paypal-secure-center.com
pv.sohu.com
146.185.214.143
40.85.113.106
1471c0b82002e8eed175417e03444fa385c323d1784171e6d1a6dc6901c32228
3ebc007b9f6052ff95287c1c4c691e890a72a989b9c97d3cfd6466425c8e4bd9
74d8a40da043c94f1a085834d877cc807b615f74dcb48905e39419e21f31e635
77322b6d7dedc0088db9f75ad21b8cc867d8c76d774b2444a3e366abfb88a4a4
7b27416ef702ee38d8608cf59520b73320902b0ff656967754d73723d50b2255
b3cc50b9e94bbecaaeb1079b64b8ca50616d1732824964c1cc2c5422627a0ec5
fcdf3becb34727e89ae7395ac70df92e4537639ae903784e201f479dd70f3ef0
fce29e1fe6bf89c80ee27d17e1bd33bc2050ab5897bff235e3176e6f53d00661