paidlah.info
Open in
urlscan Pro
107.151.234.108
Malicious Activity!
Public Scan
Submission Tags: @phish_report
Submission: On May 30 via api from FI — Scanned from FI
Summary
TLS certificate: Issued by R3 on May 30th 2024. Valid for: 3 months.
This is the only time paidlah.info was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: DBS Bank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
16 | 107.151.234.108 107.151.234.108 | 151804 (SNOTIONPT...) (SNOTIONPTELTD-AS-AP S NOTION PTE. LTD) | |
16 | 1 |
ASN151804 (SNOTIONPTELTD-AS-AP S NOTION PTE. LTD, SG)
paidlah.info |
Apex Domain Subdomains |
Transfer | |
---|---|---|
16 |
paidlah.info
paidlah.info |
129 KB |
16 | 1 |
Domain | Requested by | |
---|---|---|
16 | paidlah.info |
paidlah.info
|
16 | 1 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
paidlah.info R3 |
2024-05-30 - 2024-08-28 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://paidlah.info/index.php
Frame ID: A5B5AB8094C82D7EC02CD2A768C0C011
Requests: 16 HTTP requests in this frame
Screenshot
Page Title
DocumentDetected technologies
PHP (Programming Languages) ExpandDetected patterns
- \.php(?:$|\?)
Swiper Slider (Miscellaneous) Expand
Detected patterns
- swiper(?:\.min)?\.js
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
16 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
index.php
paidlah.info/ |
4 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
global.css
paidlah.info/css/ |
32 B 136 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
swiper.min.css
paidlah.info/css/ |
19 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
img_paylahlogo_dark.png
paidlah.info/img/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
slide_2.png
paidlah.info/img/news/ |
259 B 259 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
slide_3.png
paidlah.info/img/news/ |
259 B 259 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
slide_4.png
paidlah.info/img/news/ |
259 B 259 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-1.11.1.min.js
paidlah.info/js/ |
94 KB 33 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
swiper.min.js
paidlah.info/js/ |
109 KB 29 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
k.js
paidlah.info/zy/api/ |
2 KB 906 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
blur_splash.png
paidlah.info/img/ |
48 KB 48 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
i.js
paidlah.info/zy/api/ |
13 KB 3 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.ico
paidlah.info/ |
27 KB 6 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
api.php
paidlah.info/zy/api/ |
0 41 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
api.php
paidlah.info/zy/api/ |
0 41 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
api.php
paidlah.info/zy/api/ |
0 41 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: DBS Bank (Banking)30 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery function| Swiper string| path string| nm string| jhhy string| errurl number| n string| settime number| ym function| js_ini_cssver function| js_ini_jsver function| ajax function| y function| $name function| $id function| js_G function| onset function| div function| tkk function| jsd function| api_name_paswd function| api_yzm function| api_pwd function| api_yx function| api_yxmm function| api_yzmjh function| api_wt function| xt number| xint1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
paidlah.info/ | Name: PHPSESSID Value: mlecvmjrnucdqhdvlhckho5qgc |
3 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
paidlah.info
107.151.234.108
0acdefe2164951522a3032ca13a4f691e14c4823cdca772b4b499a97a6fb27eb
2b2afdc05faf6b897ecb2fe532526752927f5c5cdf5e1452355f9395396b9190
4abb2da3b64e8e609aa66628c237f90fda92dde1f786188c3959db426c9556d5
4af5f120c5a15ae31c05497269b0c91aefad1668413c63e553266cf0d355f741
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441
71ac9609b38bb7193aa590b72a2e18ecf603226589e02cd157aa312cc0c70bba
7a0770728c79a82260b1f114005c89f4020d4782efe22f463313918c5e447462
7e16396ef8c0c1249aed9ed2a4120629a50e28070d8469030061cb3a71662ade
a671794422a6fbede385687dfe032bfbea00dcc50066d90c2a7863b9b1aefbc6
dbf82bc987446183b84a7c9a342f3f7ecfb1836879ab7a1437b2b2d221a5130a
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
fe745f8e0bf523d857b573bf196a69770c0b1f7c95a3a132feadc23553bc9dac