urlscan.io logo urlscan.io
SecurityTrails logo

transaction-valide.cf Open in urlscan Pro
185.27.134.126  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://transaction-valide.cf/france/
Effective URL: https://transaction-valide.cf/france/?i=1
Submission Tags: phishing malicious Search All
Submission: On November 16 via api from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 14 HTTP transactions. The main IP is 185.27.134.126, located in United Kingdom and belongs to WILDCARD-AS Wildcard UK Limited, GB. The main domain is transaction-valide.cf.
TLS certificate: Issued by Let's Encrypt Authority X3 on November 14th 2020. Valid for: 3 months.
This is the only time transaction-valide.cf was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic (Online) PayPal (Financial)

Domain & IP information

IP Address AS Autonomous System
14 185.27.134.126 34119 (WILDCARD-...)
14 1
Apex Domain
Subdomains		 Transfer
14 transaction-valide.cf
transaction-valide.cf
773 KB
14 1
Domain Requested by
14 transaction-valide.cf transaction-valide.cf
14 1

This site contains no links.

Subject Issuer Validity Valid
transaction-valide.cf
Let's Encrypt Authority X3		 2020-11-14 -
2021-02-12		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://transaction-valide.cf/france/?i=1
Frame ID: 29E31026FC0787FCE0F2C82C963548C1
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://transaction-valide.cf/france/ Page URL
  2. https://transaction-valide.cf/france/?i=1 Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

14
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

773 kB
Transfer

2420 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://transaction-valide.cf/france/ Page URL
  2. https://transaction-valide.cf/france/?i=1 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
transaction-valide.cf/france/ 		840 B
698 B 		Document
General
Check archive.org
Download Go to
Full URL
https://transaction-valide.cf/france/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.27.134.126 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB),
Reverse DNS
Software
nginx /
Resource Hash
7f597448e29fdc9637b1108d034e04dfef99af141f45d31ed70a9d7b11104157

Request headers

:method
GET
:authority
transaction-valide.cf
:scheme
https
:path
/france/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
server
nginx
date
Mon, 16 Nov 2020 12:42:42 GMT
content-type
text/html
vary
Accept-Encoding
expires
Thu, 01 Jan 1970 00:00:01 GMT
cache-control
no-cache
content-encoding
gzip
aes.js
transaction-valide.cf/ 		30 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://transaction-valide.cf/aes.js
Requested by
Host: transaction-valide.cf
URL: https://transaction-valide.cf/france/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.27.134.126 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB),
Reverse DNS
Software
nginx /
Resource Hash
d2701c86a2a31a641520e72121749dbbabeed4b1a59aece20bbf14f9c9de82bc

Request headers

Referer
https://transaction-valide.cf/france/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 16 Nov 2020 12:42:42 GMT
last-modified
Sat, 08 Aug 2015 08:12:26 GMT
server
nginx
etag
"55c5b9ea-79e6"
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
31206
Primary Request /
transaction-valide.cf/france/ 		3 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://transaction-valide.cf/france/?i=1
Requested by
Host: transaction-valide.cf
URL: https://transaction-valide.cf/france/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.27.134.126 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB),
Reverse DNS
Software
nginx /
Resource Hash
8bbd145a6cb5138b5ae10715289ed2e353e377da675b78911d451b5f46c14425

Request headers

:method
GET
:authority
transaction-valide.cf
:scheme
https
:path
/france/?i=1
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
same-origin
sec-fetch-mode
navigate
sec-fetch-dest
document
referer
https://transaction-valide.cf/france/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
__test=8308130079644f516b7e8364c9b3715d
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://transaction-valide.cf/france/

Response headers

status
200
server
nginx
date
Mon, 16 Nov 2020 12:42:42 GMT
content-type
text/html; charset=UTF-8
vary
Accept-Encoding
cache-control
max-age=0
expires
Mon, 16 Nov 2020 12:42:42 GMT
content-encoding
gzip
main.ltr.css
transaction-valide.cf/france/public/css/ 		223 KB
49 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://transaction-valide.cf/france/public/css/main.ltr.css
Requested by
Host: transaction-valide.cf
URL: https://transaction-valide.cf/france/?i=1
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.27.134.126 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB),
Reverse DNS
Software
nginx /
Resource Hash
faec9ed110442b1bab4a3692ec7a310f86a3aed09b61258c44713f4627fb6b8b

Request headers

Referer
https://transaction-valide.cf/france/?i=1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 16 Nov 2020 12:42:42 GMT
content-encoding
gzip
last-modified
Sat, 14 Nov 2020 10:49:39 GMT
server
nginx
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
max-age=2592000, public, proxy-revalidate, public, proxy-revalidate, must-revalidate
expires
Wed, 16 Dec 2020 12:42:42 GMT
page.c9a650b6b85d7c2bdddc.css
transaction-valide.cf/france/public/css/ 		172 KB
35 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://transaction-valide.cf/france/public/css/page.c9a650b6b85d7c2bdddc.css
Requested by
Host: transaction-valide.cf
URL: https://transaction-valide.cf/france/?i=1
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.27.134.126 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB),
Reverse DNS
Software
nginx /
Resource Hash
1b611d92b1d5c816e3631f907f49586d69680541610b24ec40a22ec2a73db80a

Request headers

Referer
https://transaction-valide.cf/france/?i=1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 16 Nov 2020 12:42:42 GMT
content-encoding
gzip
last-modified
Sat, 14 Nov 2020 10:49:40 GMT
server
nginx
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
max-age=2592000, public, proxy-revalidate, public, proxy-revalidate, must-revalidate
expires
Wed, 16 Dec 2020 12:42:42 GMT
contextualLogin.css
transaction-valide.cf/france/public/css/ 		105 KB
20 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://transaction-valide.cf/france/public/css/contextualLogin.css
Requested by
Host: transaction-valide.cf
URL: https://transaction-valide.cf/france/?i=1
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.27.134.126 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB),
Reverse DNS
Software
nginx /
Resource Hash
1944b8a80dac73a3c4641821488699715239a5edc0c017cc7f3c27fc95caa0a8

Request headers

Referer
https://transaction-valide.cf/france/?i=1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 16 Nov 2020 12:42:42 GMT
content-encoding
gzip
last-modified
Sat, 14 Nov 2020 10:49:38 GMT
server
nginx
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
max-age=2592000, public, proxy-revalidate, public, proxy-revalidate, must-revalidate
expires
Wed, 16 Dec 2020 12:42:42 GMT
success-animation_2x.gif
transaction-valide.cf/france/public/img/ 		33 KB
33 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://transaction-valide.cf/france/public/img/success-animation_2x.gif
Requested by
Host: transaction-valide.cf
URL: https://transaction-valide.cf/france/?i=1
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.27.134.126 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB),
Reverse DNS
Software
nginx /
Resource Hash
99e5d5d3c19503d0d25fffd4d82f7c4b35c1bb87b6c2e2f53ef2beb820174dc8

Request headers

Referer
https://transaction-valide.cf/france/?i=1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 16 Nov 2020 12:42:42 GMT
last-modified
Sat, 14 Nov 2020 10:50:31 GMT
server
nginx
content-type
image/gif
status
200
cache-control
max-age=2592000, public, proxy-revalidate, public, proxy-revalidate
accept-ranges
bytes
content-length
33621
expires
Wed, 16 Dec 2020 12:42:42 GMT
vx-lib.min.js
transaction-valide.cf/france/public/js/ 		9 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://transaction-valide.cf/france/public/js/vx-lib.min.js
Requested by
Host: transaction-valide.cf
URL: https://transaction-valide.cf/france/?i=1
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.27.134.126 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB),
Reverse DNS
Software
nginx /
Resource Hash
f043b2877f74c808428d890e23848d9bc996363bc1ec4c9181b36aa001012d2d

Request headers

Referer
https://transaction-valide.cf/france/?i=1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 16 Nov 2020 12:42:42 GMT
content-encoding
gzip
last-modified
Sat, 14 Nov 2020 10:50:47 GMT
server
nginx
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=2592000, public, proxy-revalidate, public, proxy-revalidate, must-revalidate
expires
Wed, 16 Dec 2020 12:42:42 GMT
vendor.js
transaction-valide.cf/france/public/js/ 		889 KB
290 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://transaction-valide.cf/france/public/js/vendor.js
Requested by
Host: transaction-valide.cf
URL: https://transaction-valide.cf/france/?i=1
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.27.134.126 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB),
Reverse DNS
Software
nginx /
Resource Hash
0f866e33e0052a7791648151f590ab82ae78b42fb1c66ac6d4b3bd1e6304ecb1

Request headers

Referer
https://transaction-valide.cf/france/?i=1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 16 Nov 2020 12:42:42 GMT
content-encoding
gzip
last-modified
Sat, 14 Nov 2020 10:50:51 GMT
server
nginx
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=2592000, public, proxy-revalidate, public, proxy-revalidate, must-revalidate
expires
Wed, 16 Dec 2020 12:42:42 GMT
flowBundle.js
transaction-valide.cf/france/public/js/ 		875 KB
255 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://transaction-valide.cf/france/public/js/flowBundle.js
Requested by
Host: transaction-valide.cf
URL: https://transaction-valide.cf/france/?i=1
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.27.134.126 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB),
Reverse DNS
Software
nginx /
Resource Hash
cd708f0de021ca42b742fd5b20debbefeb48a8a5f566b74b6014f8d72c521554

Request headers

Referer
https://transaction-valide.cf/france/?i=1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 16 Nov 2020 12:42:43 GMT
content-encoding
gzip
last-modified
Sat, 14 Nov 2020 10:50:45 GMT
server
nginx
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=2592000, public, proxy-revalidate, public, proxy-revalidate, must-revalidate
expires
Wed, 16 Dec 2020 12:42:43 GMT
pa.js
transaction-valide.cf/france/public/js/ 		41 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://transaction-valide.cf/france/public/js/pa.js
Requested by
Host: transaction-valide.cf
URL: https://transaction-valide.cf/france/?i=1
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.27.134.126 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB),
Reverse DNS
Software
nginx /
Resource Hash
fb09c511a746af8737671bd1bd11245f3607a988293c567d2403f1bbadc75e90

Request headers

Referer
https://transaction-valide.cf/france/?i=1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 16 Nov 2020 12:42:43 GMT
content-encoding
gzip
last-modified
Sat, 14 Nov 2020 10:50:41 GMT
server
nginx
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=2592000, public, proxy-revalidate, public, proxy-revalidate, must-revalidate
expires
Wed, 16 Dec 2020 12:42:43 GMT
pp_fc_mg_2x.png
transaction-valide.cf/france/public/img/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://transaction-valide.cf/france/public/img/pp_fc_mg_2x.png
Requested by
Host: transaction-valide.cf
URL: https://transaction-valide.cf/france/public/css/main.ltr.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.27.134.126 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB),
Reverse DNS
Software
nginx /
Resource Hash
6b6cee9042754f4ea2b7051ff0c27c082b14800f798ec52822957c95b0858df7

Request headers

Referer
https://transaction-valide.cf/france/public/css/main.ltr.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 16 Nov 2020 12:42:43 GMT
last-modified
Sat, 14 Nov 2020 10:50:23 GMT
server
nginx
content-type
image/png
status
200
cache-control
max-age=2592000, public, proxy-revalidate, public, proxy-revalidate
accept-ranges
bytes
content-length
3712
expires
Wed, 16 Dec 2020 12:42:43 GMT
PayPalSansBig-Light.woff2
transaction-valide.cf/france/public/fonts/ 		18 KB
18 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://transaction-valide.cf/france/public/fonts/PayPalSansBig-Light.woff2
Requested by
Host: transaction-valide.cf
URL: https://transaction-valide.cf/france/public/css/page.c9a650b6b85d7c2bdddc.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.27.134.126 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB),
Reverse DNS
Software
nginx /
Resource Hash
0d4d4b0ee4bdbbbfdf2fa8cc4c0ba0332a3798c2629cb806d249712f6a7063e3

Request headers

Origin
https://transaction-valide.cf
Referer
https://transaction-valide.cf/france/public/css/page.c9a650b6b85d7c2bdddc.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 16 Nov 2020 12:42:43 GMT
last-modified
Sat, 14 Nov 2020 10:49:48 GMT
server
nginx
status
200
cache-control
max-age=0
accept-ranges
bytes
content-length
18360
expires
Mon, 16 Nov 2020 12:42:43 GMT
PayPalSansSmall-Regular.woff2
transaction-valide.cf/france/public/fonts/ 		18 KB
18 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://transaction-valide.cf/france/public/fonts/PayPalSansSmall-Regular.woff2
Requested by
Host: transaction-valide.cf
URL: https://transaction-valide.cf/france/public/css/page.c9a650b6b85d7c2bdddc.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.27.134.126 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB),
Reverse DNS
Software
nginx /
Resource Hash
af93d1d952b2dc42c029871cbbb92988835b31c86d4f0cb6a9674b1d1714a20f

Request headers

Origin
https://transaction-valide.cf
Referer
https://transaction-valide.cf/france/public/css/page.c9a650b6b85d7c2bdddc.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 16 Nov 2020 12:42:43 GMT
last-modified
Sat, 14 Nov 2020 10:49:53 GMT
server
nginx
status
200
cache-control
max-age=0
accept-ranges
bytes
content-length
18320
expires
Mon, 16 Nov 2020 12:42:43 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online) PayPal (Financial)

20 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes object| VX object| webpackJsonp object| core object| __core-js_shared__ object| global object| System function| asap function| Observable function| setImmediate function| clearImmediate object| regeneratorRuntime boolean| _babelPolyfill object| CW object| PAYPAL object| fpti string| fptiserverurl

1 Cookies

Domain/Path Name / Value
transaction-valide.cf/ Name: __test
Value: 8308130079644f516b7e8364c9b3715d