client-paypal-center.com Open in urlscan Pro
95.85.73.246  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response client-paypal-center.com/	44 KB 11 KB	1366ms 385ms	Document text/html	95.85.73.246 GHOST
General Check archive.org Show headers Download Go to Full URL https://client-paypal-center.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.85.73.246 Central, Hong Kong, ASN202422 (GHOST, LU), Reverse DNS heykong006.example.com Software nginx / Resource Hash 9c1a4337693e2b4589eab046f2231edd4e3d859c8bcaf0145fcc29661d2e9062 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers content-encoding gzip content-type text/html; charset=UTF-8 date Tue, 17 May 2022 11:36:54 GMT server nginx strict-transport-security max-age=31536000 vary Accept-Encoding
GET H2	200	site-jquery.min.js Show response client-paypal-center.com/admin/im/	91 KB 36 KB	194ms 193ms	Script application/javascript	95.85.73.246 GHOST
General Check archive.org Show headers Download Go to Full URL https://client-paypal-center.com/admin/im/site-jquery.min.js Requested by Host: client-paypal-center.com URL: https://client-paypal-center.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.85.73.246 Central, Hong Kong, ASN202422 (GHOST, LU), Reverse DNS heykong006.example.com Software nginx / Resource Hash 5994332aadd364a7350ad226ef61c1c75dc97372f739e01682e190be3abaf672 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://client-paypal-center.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Tue, 17 May 2022 11:36:55 GMT content-encoding gzip last-modified Mon, 23 Aug 2021 08:34:16 GMT server nginx etag W/"61235d88-16b60" vary Accept-Encoding content-type application/javascript cache-control max-age=43200 strict-transport-security max-age=31536000 expires Tue, 17 May 2022 23:36:55 GMT
GET H2	200	layui.js Show response client-paypal-center.com/admin/im/	284 KB 105 KB	384ms 384ms	Script application/javascript	95.85.73.246 GHOST
General Check archive.org Show headers Download Go to Full URL https://client-paypal-center.com/admin/im/layui.js Requested by Host: client-paypal-center.com URL: https://client-paypal-center.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.85.73.246 Central, Hong Kong, ASN202422 (GHOST, LU), Reverse DNS heykong006.example.com Software nginx / Resource Hash bbfe1536a99000acceb61f549aa59354cc596efc9f10d3843aab6b273f5adb1e Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://client-paypal-center.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Tue, 17 May 2022 11:36:55 GMT content-encoding gzip last-modified Tue, 06 Jul 2021 04:01:50 GMT server nginx etag W/"60e3d5ae-471da" vary Accept-Encoding content-type application/javascript cache-control max-age=43200 strict-transport-security max-age=31536000 expires Tue, 17 May 2022 23:36:55 GMT
GET H2	200	layer.min.css cdn.bootcdn.net/ajax/libs/layer/3.5.1/theme/default/	13 KB 3 KB	110ms 34ms	Stylesheet text/css	2606:4700:3038::6815:eac9 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.bootcdn.net/ajax/libs/layer/3.5.1/theme/default/layer.min.css Requested by Host: client-paypal-center.com URL: https://client-paypal-center.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3038::6815:eac9 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f99199228144a11b7adda7dad83f11c366ecb6f530ba8a352fb155bc0e58fc0e Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://client-paypal-center.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Tue, 17 May 2022 11:36:55 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 4565 x-cache HIT cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 timing-allow-origin * last-modified Fri, 11 Jun 2021 14:31:54 GMT server cloudflare cf-cdnjs-via cfworker/kv etag W/"60c373da-a5f" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=T0ouglkZfQ5ODwPOWQmf3C4CE8QU111f5FLYKBzF7iuY0nzTY%2BfojjOz8ZrYmRnQ8KzDH8DUE87lhHmz1ayZvxsomCrWfaigvIEILxIsO8ya9tiXNU4P364ImQHlu89CauZ2g36M"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control max-age=2678400 cf-ray 70cc0ee23ad85fdc-MRS expires Tue, 17 May 2022 22:20:50 GMT
GET H2	404	laydate.css client-paypal-center.com/admin/im/css/modules/laydate/default/	0 0	193ms 193ms	Stylesheet text/html	95.85.73.246 GHOST
General Check archive.org Show headers Download Go to Full URL https://client-paypal-center.com/admin/im/css/modules/laydate/default/laydate.css?v=5.3.1 Requested by Host: client-paypal-center.com URL: https://client-paypal-center.com/admin/im/layui.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.85.73.246 Central, Hong Kong, ASN202422 (GHOST, LU), Reverse DNS heykong006.example.com Software nginx / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer https://client-paypal-center.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Tue, 17 May 2022 11:36:56 GMT server nginx content-length 548 content-type text/html
GET H2	404	layer.css client-paypal-center.com/admin/im/css/modules/layer/default/	0 0	194ms 193ms	Stylesheet text/html	95.85.73.246 GHOST
General Check archive.org Show headers Download Go to Full URL https://client-paypal-center.com/admin/im/css/modules/layer/default/layer.css?v=3.5.1 Requested by Host: client-paypal-center.com URL: https://client-paypal-center.com/admin/im/layui.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.85.73.246 Central, Hong Kong, ASN202422 (GHOST, LU), Reverse DNS heykong006.example.com Software nginx / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer https://client-paypal-center.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Tue, 17 May 2022 11:36:56 GMT server nginx content-length 548 content-type text/html
GET H2	404	code.css client-paypal-center.com/admin/im/css/modules/	0 0	193ms 192ms	Stylesheet text/html	95.85.73.246 GHOST
General Check archive.org Show headers Download Go to Full URL https://client-paypal-center.com/admin/im/css/modules/code.css?v=2 Requested by Host: client-paypal-center.com URL: https://client-paypal-center.com/admin/im/layui.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.85.73.246 Central, Hong Kong, ASN202422 (GHOST, LU), Reverse DNS heykong006.example.com Software nginx / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer https://client-paypal-center.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Tue, 17 May 2022 11:36:56 GMT server nginx content-length 548 content-type text/html
GET H2	200	momgram@2x.png www.paypalobjects.com/images/shared/	2 KB 2 KB	68ms 8ms	Image image/png	192.229.221.25 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://www.paypalobjects.com/images/shared/momgram@2x.png Requested by Host: client-paypal-center.com URL: https://client-paypal-center.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.229.221.25 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (frc/8F52) / Resource Hash 1c9dd1b0663ba2324632f0ffebb21112a92f039305241661c289c88af523cb1a Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://client-paypal-center.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Tue, 17 May 2022 11:36:56 GMT x-content-type-options nosniff last-modified Sat, 13 Feb 2021 00:20:23 GMT accept-ch DPR, Viewport-Width, Width, ECT, Downlink etag "60271b47-7cc" strict-transport-security max-age=63072000; includeSubDomains; preload x-cache HIT content-type image/png paypal-debug-id 8bd535ae83cc3 cache-control s-maxage=31536000, public,max-age=3600 accept-ranges bytes dc ccg11-origin-www-1.paypal.com content-length 1996 server ECAcc (frc/8F52) expires Tue, 17 May 2022 12:36:56 GMT
GET H2	200	api.php Show response client-paypal-center.com/	13 B 310 B	194ms 194ms	XHR text/html	95.85.73.246 GHOST
General Check archive.org Show headers Download Go to Full URL https://client-paypal-center.com/api.php?act=ip_save&_r=0.74791390153145 Requested by Host: client-paypal-center.com URL: https://client-paypal-center.com/admin/im/site-jquery.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.85.73.246 Central, Hong Kong, ASN202422 (GHOST, LU), Reverse DNS heykong006.example.com Software nginx / Resource Hash aa3d21398252adb9f16b5208884b4da22eec9f2019a0139b114a61f178396794 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Accept */* Referer https://client-paypal-center.com/ X-Requested-With XMLHttpRequest accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers pragma no-cache date Tue, 17 May 2022 11:36:56 GMT content-encoding gzip server nginx vary Accept-Encoding content-type text/html; charset=UTF-8 cache-control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 strict-transport-security max-age=31536000 expires Thu, 19 Nov 1981 08:52:00 GMT
GET H2	200	sprite_countries_flag.png client-paypal-center.com/admin/img/	71 KB 71 KB	191ms 191ms	Image image/png	95.85.73.246 GHOST
General Check archive.org Show headers Download Go to Show image Full URL https://client-paypal-center.com/admin/img/sprite_countries_flag.png Requested by Host: client-paypal-center.com URL: https://client-paypal-center.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.85.73.246 Central, Hong Kong, ASN202422 (GHOST, LU), Reverse DNS heykong006.example.com Software nginx / Resource Hash 9c14b809ca4d5de12a569239d46ab8ef5f7ac1b3804c9801583cbafb66d3e550 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://client-paypal-center.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Tue, 17 May 2022 11:36:56 GMT last-modified Wed, 11 May 2022 13:54:36 GMT server nginx etag "627bc01c-11a80" strict-transport-security max-age=31536000 content-type image/png cache-control max-age=2592000 accept-ranges bytes content-length 72320 expires Thu, 16 Jun 2022 11:36:56 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial)

21 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone function| getScreenDetails function| $ function| jQuery object| layui function| lay number| errors object| layer object| jQuery110102604665900657017 function| btn1 function| numberTip function| change object| mask object| timer object| hb_timer function| heart_beat function| ip_save function| is_agree function| checkSingleSubmit

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			client-paypal-center.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: unrv0nrubsbndkqgb05jr5fn66

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://client-paypal-center.com/admin/im/css/modules/laydate/default/laydate.css?v=5.3.1 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://client-paypal-center.com/admin/im/css/modules/layer/default/layer.css?v=3.5.1 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://client-paypal-center.com/admin/im/css/modules/code.css?v=2 Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.bootcdn.net
client-paypal-center.com
www.paypalobjects.com
192.229.221.25
2606:4700:3038::6815:eac9
95.85.73.246
1c9dd1b0663ba2324632f0ffebb21112a92f039305241661c289c88af523cb1a
5994332aadd364a7350ad226ef61c1c75dc97372f739e01682e190be3abaf672
9c14b809ca4d5de12a569239d46ab8ef5f7ac1b3804c9801583cbafb66d3e550
9c1a4337693e2b4589eab046f2231edd4e3d859c8bcaf0145fcc29661d2e9062
aa3d21398252adb9f16b5208884b4da22eec9f2019a0139b114a61f178396794
bbfe1536a99000acceb61f549aa59354cc596efc9f10d3843aab6b273f5adb1e
f99199228144a11b7adda7dad83f11c366ecb6f530ba8a352fb155bc0e58fc0e