www.osim.ro
Open in
urlscan Pro
193.230.133.8
Malicious Activity!
Public Scan
Submission: On March 24 via automatic, source phishtank
Summary
This is the only time www.osim.ro was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: PayPal (Financial)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 193.230.133.8 193.230.133.8 | 6830 (LGI-UPC f...) (LGI-UPC formerly known as UPC Broadband Holding B.V.) | |
20 | 104.96.4.11 104.96.4.11 | 16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies) | |
1 | 54.236.95.78 54.236.95.78 | 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com) | |
1 | 104.108.64.175 104.108.64.175 | 16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies) | |
23 | 5 |
ASN6830 (LGI-UPC formerly known as UPC Broadband Holding B.V., AT)
www.osim.ro |
ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-96-4-11.deploy.static.akamaitechnologies.com
www.paypalobjects.com |
ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-54-236-95-78.compute-1.amazonaws.com
nexus.ensighten.com |
ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-108-64-175.deploy.static.akamaitechnologies.com
t.paypal.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
20 |
paypalobjects.com
www.paypalobjects.com |
1 MB |
1 |
paypal.com
t.paypal.com |
42 B |
1 |
ensighten.com
nexus.ensighten.com |
182 B |
1 |
osim.ro
www.osim.ro |
30 KB |
23 | 4 |
Domain | Requested by | |
---|---|---|
20 | www.paypalobjects.com |
www.osim.ro
|
1 | t.paypal.com |
www.osim.ro
|
1 | nexus.ensighten.com |
www.paypalobjects.com
|
1 | www.osim.ro | |
23 | 4 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.paypal.com |
en.paypal-returns.com |
developer.paypal.com |
www.paypal-marketing.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
www.paypalobjects.com Symantec Class 3 EV SSL CA - G3 |
2015-10-12 - 2017-09-02 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
http://www.osim.ro/paypal/paypaldesk/?Omroa.b.EwaR.F.wJs.KnEFDB.osKoJEGwmDFrLobLsPaM.NdQNDbHeHNaOEwsBMwrmwdDbrRsnenLIJcobcGHHcnQwPrHQCowJLo.QoQ..NcDR.DcCwHwwRLoOwMIobB.Lbwr.arQNroKFLcrmNORKcN.b.GErNDbG.
Frame ID: 22758.1
Requests: 24 HTTP requests in this frame
29 Outgoing links
These are links going to different origins than the main page.
Title: PayPal
Search URL Search Domain Scan URL
Title: Pay on eBay
Search URL Search Domain Scan URL
Title: Pay on websites
Search URL Search Domain Scan URL
Title: Pay on the go
Search URL Search Domain Scan URL
Title: More ways to use us
Search URL Search Domain Scan URL
Title: Sell
Search URL Search Domain Scan URL
Title: Get paid on your website
Search URL Search Domain Scan URL
Title: Email an invoice
Search URL Search Domain Scan URL
Title: Request a payment
Search URL Search Domain Scan URL
Title: Send
Search URL Search Domain Scan URL
Title: Help
Search URL Search Domain Scan URL
Title: Contact
Search URL Search Domain Scan URL
Title: Sign Up
Search URL Search Domain Scan URL
Title: Activate for Free
Search URL Search Domain Scan URL
Title: Ask for a refund
Search URL Search Domain Scan URL
Title: Fees
Search URL Search Domain Scan URL
Title: Security
Search URL Search Domain Scan URL
Title: Apps
Search URL Search Domain Scan URL
Title: Shop
Search URL Search Domain Scan URL
Title: Change Language or Country
Search URL Search Domain Scan URL
Title: About
Search URL Search Domain Scan URL
Title: Blog
Search URL Search Domain Scan URL
Title: Jobs
Search URL Search Domain Scan URL
Title: Sitemap
Search URL Search Domain Scan URL
Title: Developers
Search URL Search Domain Scan URL
Title: Partners
Search URL Search Domain Scan URL
Title: Privacy
Search URL Search Domain Scan URL
Title: Legal
Search URL Search Domain Scan URL
Title: terms and conditions
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request 14- https://ak1s.abmr.net/is/www.paypalobjects.com?U=/webstatic/en_PH/mktg/wright/home/home_n1_1x.jpg&V=3-GQq8p1bLJoHXfAjjfMtDfjHW+tclbEY70q4%2fH715En+er351FHV%2fulQQe4ul2kF1&I=74A066B3F7BE56C&D=paypal...
- https://www.paypalobjects.com/webstatic/en_PH/mktg/wright/home/home_n1_1x.jpg?01AD=39s4BHgvetAFz36bRfnZI1elqZ0vlataUWf2uYvr2wqhFaaeamRIPUg&01RI=74A066B3F7BE56C&01NA=na
23 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
www.osim.ro/paypal/paypaldesk/ |
30 KB 30 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
1ccd3721c323f96346241b405f4654311c6c6f.css
www.paypalobjects.com/eboxapps/css/5b/ |
205 KB 37 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
fa89f17d37eb3f97e39b926835ba73c0a3fd63.css
www.paypalobjects.com/eboxapps/css/1b/ |
2 KB 600 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
c2f14fc42bce1c7b411ec063c9bc6082438ed6.css
www.paypalobjects.com/eboxapps/css/43/ |
5 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
353ab4e9884d84b9b6254883c67b0440b8b230.js
www.paypalobjects.com/eboxapps/js/79/ |
485 KB 132 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
33100d84abb37d92f0b866d6a38d4788da87ec.js
www.paypalobjects.com/eboxapps/js/42/ |
12 KB 3 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bs.js
www.paypalobjects.com/tagmgmt/ |
62 KB 18 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
pp_jscode_080706.js
www.paypalobjects.com/js/site_catalyst/ |
60 KB 24 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
pa.js
www.paypalobjects.com/pa/js/ |
74 KB 17 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headersResponse headers |
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ppcom.svg
www.paypalobjects.com/webstatic/i/logo/rebrand/ |
5 KB 5 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
PayPalSansBig-Regular.woff
www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/ |
49 KB 49 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Cookie set
APAC03429_HK_FRS_Homepage_Banner_1600X600.jpg
www.paypalobjects.com/webstatic/en_HK/mktg/wright/home/ |
140 KB 140 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
PayPalSansBig-Light.woff
www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/ |
48 KB 48 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
PayPalSansSmall-Regular.woff
www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/ |
46 KB 46 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Cookie set
home_n1_1x.jpg
www.paypalobjects.com/webstatic/en_PH/mktg/wright/home/ Redirect Chain
|
29 KB 29 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
home_n2_1x.jpg
www.paypalobjects.com/webstatic/en_PH/mktg/wright/home/ |
318 KB 318 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
PayPalSansSmall-Bold.woff
www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/ |
46 KB 46 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
home_n3_1x.jpg
www.paypalobjects.com/webstatic/en_PH/mktg/wright/home/ |
35 KB 35 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sprite_countries_flag4.png
www.paypalobjects.com/webstatic/mktg/icons/ |
68 KB 68 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
PayPalSansSmall-Light.woff
www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/ |
46 KB 46 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
serverComponent.php
nexus.ensighten.com/paypal/prod/ |
203 B 182 B |
XHR
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
pp32.png
www.paypalobjects.com/webstatic/icon/ |
4 KB 4 KB |
Other
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Cookie set
ts
t.paypal.com/ |
42 B 42 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: PayPal (Financial)0 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.osim.ro/ | Name: s_sess Value: %20s_ppv%3D38%3B%20s_cc%3Dtrue%3B%20v31%3Dmain%253Amktg%253Apersonal%253A%253Ahome%3B%20s_sq%3D%3B |
|
.osim.ro/ | Name: s_pers Value: %20s_fid%3D7B1892776FCCFECD-3B65BB7FA18C87C9%7C1553451485252%3B%20gpv_c43%3Dmain%253Amktg%253Apersonal%253A%253Ahome%7C1490381285256%3B%20tr_p1%3Dmain%253Amktg%253Apersonal%253A%253Ahome%7C1490381285258%3B%20gpv_events%3Dno%2520value%7C1490381285259%3B |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
nexus.ensighten.com
t.paypal.com
www.osim.ro
www.paypalobjects.com
104.108.64.175
104.96.4.11
193.230.133.8
54.236.95.78
052130f8341d65f7a06b8c2291fe792abc5b3381bebca28b2dd2fbe6533ec1c7
18c9428f5ed837e027c6fcf29afe9d1f63a1e1e5b53ee1dc6373cf1cd1ea22aa
1dfa004dcb20a12d0a8abb1140dde94ad99a355dd4a08b7a563f0e9e72471750
33ca16f3b5c5629d63b42300252e3fd4e1e46920f84fc49130c227cdfd3e9435
3e08798b4612ce1d4700d2fe3c953f5b56be571619153da80e6012ccd9e8eb9b
3e5e7ada07b81c61389cce569f5e54c9dec0fccf9fec0f7b25f5947bac1ecbcc
48900dd5643b29636435785b85c1deaab36a1cb1bd5dc7b9e666d6f3ee36008a
4d5c29e41277f543455e865a69634f17a2846fd001553890d5801379df3a7c47
5a74014f096b68865ee0e8860ad209f936422b998ca16ab68c0413316bd4e5cf
673fe09ebe60340aebddc7616bbe124284a8f939f68f16bfa034ac5e25d5b7d1
6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93
78d36edb4d3afcd15fca60c3025cd1647efa7a164fc6922d9f472d04a6d3f13f
843e67ad522a908162007f4b7601819a5bbfef00e38ac7aec778766da8b7b2ab
8d7c7b88c76638544187e6bd2df9a2795124e4cb876fc48915f51b8c205c2ccc
94ffc263295036858354cea9af2d7f0e45e1a030e781edd1655727c4b0eb226c
976c7eed9dfd5437a071ace8319903580350067b332c7cd0660ff4e21157a632
9b784ae48243af6f47959e810bc8fbfdd745b45c1ca82bf1764fd0bdfa96a1ac
9e208d404c81e5fc7170c13b8564b1368100d668b2071b16ee14600d08519ac4
ae79dcc3eb016922caa1d095cfd936446bc65a46bb3364b242dfc556f7e3c6a8
bb230994469278cbe80e0336a575209516879ad6a5e8cc9233956e71747de578
c599c554590d1a336ffcb9627f6caaac34b6228f60e15f5f25454bff38facb7e
ca474d8ee84b0603be74ce617ecaa3636233a565679c90e5c28bc860533ca0c7
cb8ffd809b93bec77266eb70a75f5e2a670329e5e501c6123a92a19727ebe20b
d058fc0e460ce1025734328ffeb57512ad78a12948d686257ae415eae3f4c03d