en.baikal-planet.ru
Open in
urlscan Pro
81.177.140.121
Malicious Activity!
Public Scan
Submission Tags: phishing malicious Search All
Submission: On October 23 via api from US
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on August 27th 2020. Valid for: 3 months.
This is the only time en.baikal-planet.ru was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: PayPal (Financial)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
12 | 81.177.140.121 81.177.140.121 | 8342 (RTCOMM-AS) (RTCOMM-AS) | |
1 | 2a00:1450:400... 2a00:1450:4001:801::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 104.111.228.123 104.111.228.123 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
1 | 2a00:1450:400... 2a00:1450:4001:808::2003 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:81f::2003 | 15169 (GOOGLE) (GOOGLE) | |
16 | 5 |
ASN16625 (AKAMAI-AS, US)
PTR: a104-111-228-123.deploy.static.akamaitechnologies.com
www.paypalobjects.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
baikal-planet.ru
en.baikal-planet.ru |
409 KB |
2 |
gstatic.com
fonts.gstatic.com |
16 KB |
1 |
paypalobjects.com
www.paypalobjects.com |
49 KB |
1 |
googleapis.com
fonts.googleapis.com |
687 B |
16 | 4 |
Domain | Requested by | |
---|---|---|
12 | en.baikal-planet.ru |
en.baikal-planet.ru
|
2 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | www.paypalobjects.com |
en.baikal-planet.ru
|
1 | fonts.googleapis.com |
en.baikal-planet.ru
|
16 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.baikal-planet.ru Let's Encrypt Authority X3 |
2020-08-27 - 2020-11-25 |
3 months | crt.sh |
upload.video.google.com GTS CA 1O1 |
2020-09-22 - 2020-12-15 |
3 months | crt.sh |
www.paypal.com DigiCert SHA2 Extended Validation Server CA |
2020-01-09 - 2022-01-12 |
2 years | crt.sh |
*.gstatic.com GTS CA 1O1 |
2020-09-22 - 2020-12-15 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://en.baikal-planet.ru/modules/locale/tests/translations/YY2X92NBPQSOK96123VVPSKOFDOCKCkKOAfr/cs/customer_center/xBanana-MotherFucker614/myaccount/identity/
Frame ID: CC5F8DEAA6C27D17F733E2F31E9ADEF0
Requests: 16 HTTP requests in this frame
Screenshot
Detected technologies
Google Font API (Font Scripts) ExpandDetected patterns
- html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
16 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
en.baikal-planet.ru/modules/locale/tests/translations/YY2X92NBPQSOK96123VVPSKOFDOCKCkKOAfr/cs/customer_center/xBanana-MotherFucker614/myaccount/identity/ |
8 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
3 KB 687 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
G-xBanana.css
en.baikal-planet.ru/modules/locale/tests/translations/YY2X92NBPQSOK96123VVPSKOFDOCKCkKOAfr/cs/customer_center/xBanana-MotherFucker614/lib/css/ |
50 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
U1-xBanana.css
en.baikal-planet.ru/modules/locale/tests/translations/YY2X92NBPQSOK96123VVPSKOFDOCKCkKOAfr/cs/customer_center/xBanana-MotherFucker614/myaccount/identity/INC/ |
27 KB 13 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.js
en.baikal-planet.ru/modules/locale/tests/translations/YY2X92NBPQSOK96123VVPSKOFDOCKCkKOAfr/cs/customer_center/xBanana-MotherFucker614/lib/js/ |
84 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.validate.js
en.baikal-planet.ru/modules/locale/tests/translations/YY2X92NBPQSOK96123VVPSKOFDOCKCkKOAfr/cs/customer_center/xBanana-MotherFucker614/lib/js/ |
45 KB 12 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.filer.js
en.baikal-planet.ru/modules/locale/tests/translations/YY2X92NBPQSOK96123VVPSKOFDOCKCkKOAfr/cs/customer_center/xBanana-MotherFucker614/myaccount/identity/INC/ |
56 KB 9 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
A4F0G5Z846G.jpg
en.baikal-planet.ru/modules/locale/tests/translations/YY2X92NBPQSOK96123VVPSKOFDOCKCkKOAfr/cs/customer_center/xBanana-MotherFucker614/lib/img/ |
101 KB 102 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ppcom-white.svg
en.baikal-planet.ru/modules/locale/tests/translations/YY2X92NBPQSOK96123VVPSKOFDOCKCkKOAfr/cs/customer_center/xBanana-MotherFucker614/lib/img/ |
5 KB 5 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
superbowlAsset.png
en.baikal-planet.ru/modules/locale/tests/translations/YY2X92NBPQSOK96123VVPSKOFDOCKCkKOAfr/cs/customer_center/xBanana-MotherFucker614/lib/img/ |
17 KB 17 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
14303695_853354554765349_388275294_o.jpg
en.baikal-planet.ru/modules/locale/tests/translations/YY2X92NBPQSOK96123VVPSKOFDOCKCkKOAfr/cs/customer_center/xBanana-MotherFucker614/myaccount/identity/INC/ |
133 KB 134 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sprite_countries_flag4.png
www.paypalobjects.com/webstatic/mktg/icons/ |
48 KB 49 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
PayPalSansBig-Regular.woff2
en.baikal-planet.ru/modules/locale/tests/translations/YY2X92NBPQSOK96123VVPSKOFDOCKCkKOAfr/cs/customer_center/xBanana-MotherFucker614/lib/css/font/ |
38 KB 38 KB |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
PayPalSansBig-Light.woff2
en.baikal-planet.ru/modules/locale/tests/translations/YY2X92NBPQSOK96123VVPSKOFDOCKCkKOAfr/cs/customer_center/xBanana-MotherFucker614/lib/css/font/ |
37 KB 38 KB |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ieVl2ZhZI2eCN5jzbjEETS9weq8-19K7DQk6YvM.woff2
fonts.gstatic.com/s/robotocondensed/v19/ |
11 KB 11 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
ieVl2ZhZI2eCN5jzbjEETS9weq8-19G7DQk6YvNkeg.woff2
fonts.gstatic.com/s/robotocondensed/v19/ |
5 KB 5 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: PayPal (Financial)6 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes function| $ function| jQuery1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
en.baikal-planet.ru/ | Name: PHPSESSID Value: cc5456a9530068183fa7ca6332bd304e |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Content-Type-Options | nosniff |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
en.baikal-planet.ru
fonts.googleapis.com
fonts.gstatic.com
www.paypalobjects.com
104.111.228.123
2a00:1450:4001:801::200a
2a00:1450:4001:808::2003
2a00:1450:4001:81f::2003
81.177.140.121
06196fadd1d067e62636f730631319a131e06c8c65625d455e27f6dd50753c47
2a1f1370eb7b24a307312112427dfd544fb838a8bef66babc936f5e870a22e52
38cb9a71128d5db487a5dd3563b18a480301f160f0e1f05e98199818b40d61e2
49a1b4e1296645aa2f513c87a0e5fe56a305a7ed678c2f6499631ec1f3b35856
5618d5370657f6501beb9003d7bb77a5e3bbefac9eb2447af6666ff3d0324258
6c862f6ef6924cdd05ed4e19856ae93afaff53ce7f5c100e75f10107ecaa63f4
77c7756d36271f6280dfbb30f21bbff23562237ba57ac6b4b44b1e4df2bdcfa5
a66ae5acde6aa5a92add6680bdd5692103642584cbb7074df3f72430054cce39
b690e9792f4ced65ba995b886dd8af6fe90bfa752978ada6785de6468737765a
c51407482caa10dd8a02f21560776c509470a0159afe6a09a29e900b097ed309
d030f6633a5d0efd3f76fcf5ec98a0468c76770e618a401ffe5ddc7f6ccc844b
d11774a230aafc84e1bb3ee1f2d9279e1b2db4cbd2cce5e7797b2f689ad6287d
e35c57fad02017983d4261c8d65697ec8b312a2a19127cb93f92d1eca6408015
f256bd19248337a5534120f439ee7d8955a4bab26c19033ea6b69d64bb884e56
f58877d7f00d9ef387cf140b153ac69610956641787ec5c918054d0ad8207adc
ff6f21fe561d36c0f4a33655b639d4c935606ab47e431b43b91352d9b09778cf