pyusdsc.xyz Open in urlscan Pro
107.148.47.97 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://pyusdsc.xyz:3389/
Submission: On October 12 via api (October 12th 2024, 2:09:00 pm UTC) from US — Scanned from DE

Summary HTTP 16 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 1 countries across 4 domains to perform 16 HTTP transactions. The main IP is 107.148.47.97, located in United States and belongs to PEG-HK, US. The main domain is pyusdsc.xyz.
TLS certificate: Issued by R11 on October 9th 2024. Valid for: 3 months.

This is the only time pyusdsc.xyz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: PayPal (Financial)

Domain & IP information

	IP Address	AS Autonomous System
12	107.148.47.97 107.148.47.97	398478 (PEG-HK) (PEG-HK)
1	2a04:4e42::485 2a04:4e42::485	54113 (FASTLY) (FASTLY)
2	47.79.80.1 47.79.80.1	45102 (ALIBABA-C...) (ALIBABA-CN-NET Alibaba US Technology Co.)
16	4

12 107.148.47.97 (United States)

ASN398478 (PEG-HK, US)

pyusdsc.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42::485 (United States)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 47.79.80.1 (United States)

ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN)

pp-offical.oss-ap-northeast-1.aliyuncs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	pyusdsc.xyz pyusdsc.xyz	1 MB
2	aliyuncs.com pp-offical.oss-ap-northeast-1.aliyuncs.com
1	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 311	166 KB
0	dcloud.net.cn Failed cdn.dcloud.net.cn Failed
16	4

	Domain	Requested by
12	pyusdsc.xyz	pyusdsc.xyz
2	pp-offical.oss-ap-northeast-1.aliyuncs.com	pyusdsc.xyz
1	cdn.jsdelivr.net	pyusdsc.xyz
0	cdn.dcloud.net.cn Failed	pyusdsc.xyz
16	4

This site contains no links.

Subject Issuer	Validity	Valid
pyusdsc.xyz R11	`2024-10-09` - `2025-01-07`	3 months	crt.sh
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2024 Q3	`2024-07-30` - `2025-08-31`	a year	crt.sh
ap-northeast-1.oss.aliyuncs.com GlobalSign Organization Validation CA - SHA256 - G3	`2023-11-21` - `2024-12-22`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://pyusdsc.xyz:3389/
Frame ID: 07912E349F020B57967563A9448F88FC
Requests: 29 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

paypalscfs

Detected technologies

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

16
Requests

94 %
HTTPS

33 %
IPv6

4
Domains

4
Subdomains

4
IPs

1
Countries

1523 kB
Transfer

10093 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions
13 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
pyusdsc.xyz/ 2 KB
1 KB 2277ms
369ms Document
text/html 107.148.47.97
PEG-HK

General

Check archive.org

Show headers Download Go to

Full URL

https://pyusdsc.xyz:3389/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

107.148.47.97 , United States, ASN398478 (PEG-HK, US),

Reverse DNS

Software

nginx/1.22.1 /

Resource Hash

4d4ded1d6de5765fd33c06fdf26cd231a0f0775878650a40fd3f2a4e25404cc4

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000 max-age=31536000; includeSubDomains
X-Frame-Options	sameorigin

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-length: 1223
content-security-policy: frame-ancestors 'self'
content-type: text/html
date: Sat, 12 Oct 2024 14:08:53 GMT
etag: W/"6709df77-9ee"
last-modified: Sat, 12 Oct 2024 02:31:19 GMT
server: nginx/1.22.1
strict-transport-security: max-age=31536000 max-age=31536000; includeSubDomains
vary: Accept-Encoding
x-cache: BYPASS
x-frame-options: sameorigin

GET
H2 200 conf.js Show response
pyusdsc.xyz/static/ 205 B
254 B 265ms
262ms Script
application/javascript 107.148.47.97
PEG-HK

General

Check archive.org

Show headers Download Go to

Full URL

https://pyusdsc.xyz:3389/static/conf.js

Requested by

Host: pyusdsc.xyz
URL: https://pyusdsc.xyz:3389/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

107.148.47.97 , United States, ASN398478 (PEG-HK, US),

Reverse DNS

Software

nginx/1.22.1 /

Resource Hash

d6d398abd957887a7b71877084f86f10d475296a34605cfc0a67424466020c84

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Frame-Options	sameorigin

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://pyusdsc.xyz:3389/

Response headers

content-security-policy: frame-ancestors 'self'
etag: "6709df77-cd"
accept-ranges: bytes
x-cache: HIT, policy, disk
content-length: 205
date: Sat, 12 Oct 2024 13:47:11 GMT
content-type: application/javascript
last-modified: Sat, 12 Oct 2024 13:47:11 GMT
server: nginx/1.22.1
x-frame-options: sameorigin

GET
H2 200 TronWeb.min.js Show response
cdn.jsdelivr.net/npm/tronweb@2.8.1/dist/ 680 KB
166 KB 122ms
23ms Script
application/javascript 2a04:4e42::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/tronweb@2.8.1/dist/TronWeb.min.js

Requested by

Host: pyusdsc.xyz
URL: https://pyusdsc.xyz:3389/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

7f443465eda6265fdfa690f1cac4f27d22e76134cea3ab609327c64503f8b9f7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://pyusdsc.xyz:3389/

Response headers

access-control-expose-headers: *
content-encoding: br
etag: W/"a9ffd-opWAsLsy3P8eH7ImJC9yyj3IwMk"
age: 1480086
x-content-type-options: nosniff
x-jsd-version-type: version
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache: HIT
date: Sat, 12 Oct 2024 14:08:53 GMT
content-type: application/javascript; charset=utf-8
x-served-by: cache-fra-etou8220039-FRA
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
content-length: 169067
x-jsd-version: 2.8.1

GET
H2 200 index.2da1efab.css
pyusdsc.xyz/static/ 94 KB
29 KB 264ms
262ms Stylesheet
text/css 107.148.47.97
PEG-HK

General

Check archive.org

Show headers Download Go to

Full URL

https://pyusdsc.xyz:3389/static/index.2da1efab.css

Requested by

Host: pyusdsc.xyz
URL: https://pyusdsc.xyz:3389/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

107.148.47.97 , United States, ASN398478 (PEG-HK, US),

Reverse DNS

Software

nginx/1.22.1 /

Resource Hash

e97de9a247807f12d74101e9f736250b2410be4e1ed3d17ed875e4b08cf66c83

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Frame-Options	sameorigin

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://pyusdsc.xyz:3389/

Response headers

x-frame-options: sameorigin
content-security-policy: frame-ancestors 'self'
content-encoding: gzip
etag: W/"6709df8a-178f9"
x-cache: HIT, policy, disk
date: Sat, 12 Oct 2024 13:47:11 GMT
content-type: text/css
last-modified: Sat, 12 Oct 2024 13:47:11 GMT
server: nginx/1.22.1
vary: Accept-Encoding

GET
H2 200 chunk-vendors.fb7f846c.js Show response
pyusdsc.xyz/static/js/ 3 MB
1 MB 264ms
261ms Script
application/javascript 107.148.47.97
PEG-HK

General

Check archive.org

Show headers Download Go to

Full URL

https://pyusdsc.xyz:3389/static/js/chunk-vendors.fb7f846c.js

Requested by

Host: pyusdsc.xyz
URL: https://pyusdsc.xyz:3389/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

107.148.47.97 , United States, ASN398478 (PEG-HK, US),

Reverse DNS

Software

nginx/1.22.1 /

Resource Hash

1eb5021c73acefa7a7c197be600ede6db4f85c0ec98d8a88778dd63426ac3799

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Frame-Options	sameorigin

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://pyusdsc.xyz:3389/

Response headers

x-frame-options: sameorigin
content-security-policy: frame-ancestors 'self'
content-encoding: gzip
etag: W/"6709df8b-2c8bf6"
x-cache: HIT, policy, disk
date: Sat, 12 Oct 2024 13:47:11 GMT
content-type: application/javascript
last-modified: Sat, 12 Oct 2024 13:47:22 GMT
server: nginx/1.22.1
vary: Accept-Encoding

GET
H2 200 index.65800c18.js Show response
pyusdsc.xyz/static/js/ 743 KB
255 KB 789ms
787ms Script
application/javascript 107.148.47.97
PEG-HK

General

Check archive.org

Show headers Download Go to

Full URL

https://pyusdsc.xyz:3389/static/js/index.65800c18.js

Requested by

Host: pyusdsc.xyz
URL: https://pyusdsc.xyz:3389/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

107.148.47.97 , United States, ASN398478 (PEG-HK, US),

Reverse DNS

Software

nginx/1.22.1 /

Resource Hash

995bcf3febc682cf87b4017602cb9f0b30bc60d5985971beb621e76693435862

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Frame-Options	sameorigin

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://pyusdsc.xyz:3389/

Response headers

x-frame-options: sameorigin
content-security-policy: frame-ancestors 'self'
content-encoding: gzip
etag: W/"6709df8c-b9b8c"
x-cache: HIT, policy, disk
date: Sat, 12 Oct 2024 13:13:30 GMT
content-type: application/javascript
last-modified: Sat, 12 Oct 2024 13:13:30 GMT
server: nginx/1.22.1
vary: Accept-Encoding

GET
H2 200 pages-aHome.baf768f2.js Show response
pyusdsc.xyz/static/js/ 36 KB
17 KB 257ms
257ms Script
application/javascript 107.148.47.97
PEG-HK

General

Check archive.org

Show headers Download Go to

Full URL

https://pyusdsc.xyz:3389/static/js/pages-aHome.baf768f2.js

Requested by

Host: pyusdsc.xyz
URL: https://pyusdsc.xyz:3389/static/js/index.65800c18.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

107.148.47.97 , United States, ASN398478 (PEG-HK, US),

Reverse DNS

Software

nginx/1.22.1 /

Resource Hash

03fae2ff0c52786f6645f4e235c685774292b72cee44e552a8dbcc30f6ebeea4

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Frame-Options	sameorigin

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://pyusdsc.xyz:3389/

Response headers

x-frame-options: sameorigin
content-security-policy: frame-ancestors 'self'
content-encoding: gzip
etag: W/"6709df8c-90e5"
x-cache: HIT, policy, disk
date: Sat, 12 Oct 2024 13:17:17 GMT
content-type: application/javascript
last-modified: Sat, 12 Oct 2024 13:17:17 GMT
server: nginx/1.22.1
vary: Accept-Encoding

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0ccf8dd29c61715a6364ea9ec36d32c295e82ca837488590130c51cee298b7d3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml

GET
H2 200 sys_info_get Show response
pyusdsc.xyz/api/pp/ 410 B
820 B 379ms
378ms XHR
application/json 107.148.47.97
PEG-HK

General

Check archive.org

Show headers Download Go to

Full URL

https://pyusdsc.xyz:3389/api/pp/sys_info_get?nocache=1728742136237

Requested by

Host: pyusdsc.xyz
URL: https://pyusdsc.xyz:3389/static/js/chunk-vendors.fb7f846c.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

107.148.47.97 , United States, ASN398478 (PEG-HK, US),

Reverse DNS

Software

nginx/1.22.1 /

Resource Hash

dbb66fca3f2d22471d79811f54a86d16adb518bb33c01ee66c4fd421e67ebb9e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000, max-age=31536000; includeSubDomains
X-Frame-Options	sameorigin

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://pyusdsc.xyz:3389/

Response headers

access-control-max-age: 86400
access-control-expose-headers: Content-Length, Access-Control-Allow-Origin, Access-Control-Allow-Headers
access-control-allow-methods: GET, HEAD, POST, PATCH, PUT, DELETE
traceparent: 00-58b06dd433514c26828e5d8b2ec223cb-effd1ee0ca1896a6-00
x-cache: MISS
date: Sat, 12 Oct 2024 14:08:56 GMT
content-type: application/json; charset=utf-8
vary: Origin
x-frame-options: sameorigin
access-control-allow-headers: Content-Type, Origin, X-CSRF-Token, Authorization, AccessToken, Token, Range
strict-transport-security: max-age=31536000, max-age=31536000; includeSubDomains
content-security-policy: frame-ancestors 'self'
cache-control: no-cache
access-control-allow-credentials: true
access-control-allow-origin
content-length: 410
server: nginx/1.22.1

GET
DATA 200
OK truncated
/ 4 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4023a94b26df56040024e31a6e81172751d98e11e645edcca1a9b0f7c505e483

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 325 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1fa5d5b459e69f37a2e5163ae975c36ccdfbac6b299a25c21877b1dd3bcee6e6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H2 200 msg.df47225f.svg
pyusdsc.xyz/static/img/ 1 KB
2 KB 261ms
256ms Image
image/svg+xml 107.148.47.97
PEG-HK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pyusdsc.xyz:3389/static/img/msg.df47225f.svg

Requested by

Host: pyusdsc.xyz
URL: https://pyusdsc.xyz:3389/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

107.148.47.97 , United States, ASN398478 (PEG-HK, US),

Reverse DNS

Software

nginx/1.22.1 /

Resource Hash

608d473065c6758418604a674828fcb2fbb1cb4fe7aca0d5acf1f218de6aa3ea

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Frame-Options	sameorigin

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://pyusdsc.xyz:3389/

Response headers

content-security-policy: frame-ancestors 'self'
etag: "6709df87-59a"
accept-ranges: bytes
x-cache: HIT, policy, disk
content-length: 1434
date: Sat, 12 Oct 2024 13:47:23 GMT
content-type: image/svg+xml
last-modified: Sat, 12 Oct 2024 13:47:23 GMT
server: nginx/1.22.1
x-frame-options: sameorigin

GET
H2 200 cs.36841475.svg
pyusdsc.xyz/static/img/ 1 KB
1 KB 259ms
257ms Image
image/svg+xml 107.148.47.97
PEG-HK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pyusdsc.xyz:3389/static/img/cs.36841475.svg

Requested by

Host: pyusdsc.xyz
URL: https://pyusdsc.xyz:3389/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

107.148.47.97 , United States, ASN398478 (PEG-HK, US),

Reverse DNS

Software

nginx/1.22.1 /

Resource Hash

9c50f201ba85ac2e21c7a96a4d0164603f14be4e88187d8fee8bde7482390cdd

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Frame-Options	sameorigin

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://pyusdsc.xyz:3389/

Response headers

content-security-policy: frame-ancestors 'self'
etag: "6709df7c-4dc"
accept-ranges: bytes
x-cache: HIT, policy, disk
content-length: 1244
date: Sat, 12 Oct 2024 13:47:23 GMT
content-type: image/svg+xml
last-modified: Sat, 12 Oct 2024 13:47:23 GMT
server: nginx/1.22.1
x-frame-options: sameorigin

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8451eca2f88656170afb6be081e74f47ce1cc810dc741c4ef86b9651f0d1867c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H2 200 home_0.ae546e37.svg
pyusdsc.xyz/static/img/ 4 KB
4 KB 260ms
258ms Image
image/svg+xml 107.148.47.97
PEG-HK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pyusdsc.xyz:3389/static/img/home_0.ae546e37.svg

Requested by

Host: pyusdsc.xyz
URL: https://pyusdsc.xyz:3389/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

107.148.47.97 , United States, ASN398478 (PEG-HK, US),

Reverse DNS

Software

nginx/1.22.1 /

Resource Hash

471894b84da5f200d674f3ff62791d44b642098d410ac372c13b1e0b886f9d93

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Frame-Options	sameorigin

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://pyusdsc.xyz:3389/

Response headers

content-security-policy: frame-ancestors 'self'
etag: "6709df81-10b8"
accept-ranges: bytes
x-cache: HIT, policy, disk
content-length: 4280
date: Sat, 12 Oct 2024 13:17:17 GMT
content-type: image/svg+xml
last-modified: Sat, 12 Oct 2024 13:17:17 GMT
server: nginx/1.22.1
x-frame-options: sameorigin

GET
DATA 200
OK truncated
/ 988 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 87497b7f9b268450ed8dec40efd515bd3ffd647f9fd5d6b50b5031e5357fd2ad

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 265 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1611b7288840c0e828fb65c29e1a1653ad6c48a32b5bd68a0e6c668c82a794c6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 998 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fdacc8603472a5782d203c9e4e6311d01f8500c0dc6bf1e5921d1c38af8132df

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 650 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6f9ae45dde1d01283a9086ee5616f271fa106ae06a515c8b38ed76a460a8f5e5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 310 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ae2302c7cbe652a019027bc43cd2bd5dc015a8295296093333a668ac7515ad84

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3eb4cbe545bb8c7293ce48294c456f1297ebe15bfc5b11e5517b4dd9c2441f59

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 747 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9d287037bf1c229f726aa23355d51a649061a86ad675965423428c5a7d9a0f37

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H/1.1 200
OK gif_en.gif
pp-offical.oss-ap-northeast-1.aliyuncs.com/ 1 MB
0 1399ms
539ms Image
image/gif 47.79.80.1
ALIBABA-CN-NET Al...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pp-offical.oss-ap-northeast-1.aliyuncs.com/gif_en.gif
Requested by: Host: pyusdsc.xyz
URL: https://pyusdsc.xyz:3389/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 47.79.80.1 , United States, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software: AliyunOSS /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://pyusdsc.xyz:3389/

Response headers

Content-MD5: pDh6jcQnMJFCL07oN9i0PQ==
x-oss-storage-class: Standard
ETag: "A4387A8DC4273091422F4EE837D8B43D"
x-oss-object-type: Normal
Date: Sat, 12 Oct 2024 14:08:57 GMT
x-oss-server-time: 14
Content-Disposition: attachment
Content-Type: image/gif
Last-Modified: Wed, 09 Oct 2024 15:22:03 GMT
x-oss-ec: 0048-00000113
x-oss-hash-crc64ecma: 12943021492965009390
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 9869429
x-oss-request-id: 670A82F9ACB1D33031B3B33E
x-oss-force-download: true
Server: AliyunOSS

GET
H/1.1 200
OK gif_zh.gif
pp-offical.oss-ap-northeast-1.aliyuncs.com/ 4 MB
0 1384ms
524ms Image
image/gif 47.79.80.1
ALIBABA-CN-NET Al...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pp-offical.oss-ap-northeast-1.aliyuncs.com/gif_zh.gif
Requested by: Host: pyusdsc.xyz
URL: https://pyusdsc.xyz:3389/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 47.79.80.1 , United States, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software: AliyunOSS /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://pyusdsc.xyz:3389/

Response headers

Content-MD5: /UXy1uqMIvcocjz+g3ZygQ==
x-oss-storage-class: Standard
ETag: "FD45F2D6EA8C22F728723CFE83767281"
x-oss-object-type: Normal
Date: Sat, 12 Oct 2024 14:08:57 GMT
x-oss-server-time: 3
Content-Disposition: attachment
Content-Type: image/gif
Last-Modified: Wed, 09 Oct 2024 15:21:56 GMT
x-oss-ec: 0048-00000113
x-oss-hash-crc64ecma: 16935537539966711475
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 11020684
x-oss-request-id: 670A82F9BC253035313AA7A5
x-oss-force-download: true
Server: AliyunOSS

GET
DATA 200
OK truncated
/ 236 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2b907d46fe1353c80642586f844aff1f32307edc2bfbcb2c7c440e81e3715aeb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9e509b7c503005378041ff074292c5b388ea45f275e89a823008eb2f72d2a2e0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H2 200 home_5.bee1f455.svg
pyusdsc.xyz/static/img/ 433 B
478 B 261ms
261ms Image
image/svg+xml 107.148.47.97
PEG-HK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pyusdsc.xyz:3389/static/img/home_5.bee1f455.svg

Requested by

Host: pyusdsc.xyz
URL: https://pyusdsc.xyz:3389/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

107.148.47.97 , United States, ASN398478 (PEG-HK, US),

Reverse DNS

Software

nginx/1.22.1 /

Resource Hash

58c8e5dc98475171e6a2bb92df1930597e9573f5f62fa1918485e61c190ac6f7

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Frame-Options	sameorigin

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://pyusdsc.xyz:3389/

Response headers

content-security-policy: frame-ancestors 'self'
etag: "6709df82-1b1"
accept-ranges: bytes
x-cache: HIT, policy, disk
content-length: 433
date: Sat, 12 Oct 2024 13:47:23 GMT
content-type: image/svg+xml
last-modified: Sat, 12 Oct 2024 13:47:23 GMT
server: nginx/1.22.1
x-frame-options: sameorigin

GET
H2 200 home_6.dc22dcc0.svg
pyusdsc.xyz/static/img/ 806 B
852 B 262ms
262ms Image
image/svg+xml 107.148.47.97
PEG-HK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pyusdsc.xyz:3389/static/img/home_6.dc22dcc0.svg

Requested by

Host: pyusdsc.xyz
URL: https://pyusdsc.xyz:3389/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

107.148.47.97 , United States, ASN398478 (PEG-HK, US),

Reverse DNS

Software

nginx/1.22.1 /

Resource Hash

b52d01219e88601ff6e9839b9338c56b84fc836dede3f0096a8a71978c1f13c6

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Frame-Options	sameorigin

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://pyusdsc.xyz:3389/

Response headers

content-security-policy: frame-ancestors 'self'
etag: "6709df83-326"
accept-ranges: bytes
x-cache: HIT, policy, disk
content-length: 806
date: Sat, 12 Oct 2024 13:47:23 GMT
content-type: image/svg+xml
last-modified: Sat, 12 Oct 2024 13:47:23 GMT
server: nginx/1.22.1
x-frame-options: sameorigin

GET shadow-grey.png
cdn.dcloud.net.cn/img/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: cdn.dcloud.net.cn
URL: https://cdn.dcloud.net.cn/img/shadow-grey.png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial)

19 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000 max-age=31536000; includeSubDomains
X-Frame-Options	sameorigin

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.dcloud.net.cn
cdn.jsdelivr.net
pp-offical.oss-ap-northeast-1.aliyuncs.com
pyusdsc.xyz
cdn.dcloud.net.cn
107.148.47.97
2a04:4e42::485
47.79.80.1
03fae2ff0c52786f6645f4e235c685774292b72cee44e552a8dbcc30f6ebeea4
0ccf8dd29c61715a6364ea9ec36d32c295e82ca837488590130c51cee298b7d3
1611b7288840c0e828fb65c29e1a1653ad6c48a32b5bd68a0e6c668c82a794c6
1eb5021c73acefa7a7c197be600ede6db4f85c0ec98d8a88778dd63426ac3799
1fa5d5b459e69f37a2e5163ae975c36ccdfbac6b299a25c21877b1dd3bcee6e6
2b907d46fe1353c80642586f844aff1f32307edc2bfbcb2c7c440e81e3715aeb
3eb4cbe545bb8c7293ce48294c456f1297ebe15bfc5b11e5517b4dd9c2441f59
4023a94b26df56040024e31a6e81172751d98e11e645edcca1a9b0f7c505e483
471894b84da5f200d674f3ff62791d44b642098d410ac372c13b1e0b886f9d93
4d4ded1d6de5765fd33c06fdf26cd231a0f0775878650a40fd3f2a4e25404cc4
58c8e5dc98475171e6a2bb92df1930597e9573f5f62fa1918485e61c190ac6f7
608d473065c6758418604a674828fcb2fbb1cb4fe7aca0d5acf1f218de6aa3ea
6f9ae45dde1d01283a9086ee5616f271fa106ae06a515c8b38ed76a460a8f5e5
7f443465eda6265fdfa690f1cac4f27d22e76134cea3ab609327c64503f8b9f7
8451eca2f88656170afb6be081e74f47ce1cc810dc741c4ef86b9651f0d1867c
87497b7f9b268450ed8dec40efd515bd3ffd647f9fd5d6b50b5031e5357fd2ad
995bcf3febc682cf87b4017602cb9f0b30bc60d5985971beb621e76693435862
9c50f201ba85ac2e21c7a96a4d0164603f14be4e88187d8fee8bde7482390cdd
9d287037bf1c229f726aa23355d51a649061a86ad675965423428c5a7d9a0f37
9e509b7c503005378041ff074292c5b388ea45f275e89a823008eb2f72d2a2e0
ae2302c7cbe652a019027bc43cd2bd5dc015a8295296093333a668ac7515ad84
b52d01219e88601ff6e9839b9338c56b84fc836dede3f0096a8a71978c1f13c6
d6d398abd957887a7b71877084f86f10d475296a34605cfc0a67424466020c84
dbb66fca3f2d22471d79811f54a86d16adb518bb33c01ee66c4fd421e67ebb9e
e97de9a247807f12d74101e9f736250b2410be4e1ed3d17ed875e4b08cf66c83
fdacc8603472a5782d203c9e4e6311d01f8500c0dc6bf1e5921d1c38af8132df

pyusdsc.xyz Open in urlscan Pro 107.148.47.97 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

16 Requests

94 %HTTPS

33 %IPv6

4 Domains

4 Subdomains

4 IPs

1 Countries

1523 kBTransfer

10093 kBSize

0 Cookies

0 Outgoing links

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 13 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

pyusdsc.xyz Open in urlscan Pro
107.148.47.97 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

94 %
HTTPS

33 %
IPv6

4
Domains

4
Subdomains

4
IPs

1
Countries

1523 kB
Transfer

10093 kB
Size

0
Cookies

16 HTTP transactions
13 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!