paypal-lock-payment.com Open in urlscan Pro
92.38.176.227  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response paypal-lock-payment.com/	727 B 980 B	315ms 159ms	Document text/html	92.38.176.227 GHOST
General Check archive.org Show headers Download Go to Full URL http://paypal-lock-payment.com/ Protocol HTTP/1.1 Server 92.38.176.227 Chicago, United States, ASN202422 (GHOST, LU), Reverse DNS yuanquan004.example.com Software nginx / Resource Hash fce29e1fe6bf89c80ee27d17e1bd33bc2050ab5897bff235e3176e6f53d00661 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Accept-Language jp-JP,jp;q=0.9 Response headers Server nginx Date Sat, 19 Feb 2022 20:05:06 GMT Content-Type text/html; charset=utf-8 Content-Length 727 Connection keep-alive Last-Modified Thu, 17 Feb 2022 08:43:17 GMT Cache-Control max-age=0 no-cache
GET H/1.1	200 OK	app.6775eed8164f72ee06dec1c5e84f73d2.css paypal-lock-payment.com/static/css/	902 KB 164 KB	160ms 159ms	Stylesheet text/css	92.38.176.227 GHOST
General Check archive.org Show headers Download Go to Full URL http://paypal-lock-payment.com/static/css/app.6775eed8164f72ee06dec1c5e84f73d2.css Requested by Host: paypal-lock-payment.com URL: http://paypal-lock-payment.com/ Protocol HTTP/1.1 Server 92.38.176.227 Chicago, United States, ASN202422 (GHOST, LU), Reverse DNS yuanquan004.example.com Software nginx / Resource Hash 77322b6d7dedc0088db9f75ad21b8cc867d8c76d774b2444a3e366abfb88a4a4 Request headers Accept-Language jp-JP,jp;q=0.9 Referer http://paypal-lock-payment.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers Date Sat, 19 Feb 2022 20:05:06 GMT Content-Encoding gzip Last-Modified Thu, 17 Feb 2022 08:43:17 GMT Server nginx Vary Accept-Encoding X-Cache MISS Content-Type text/css; charset=utf-8 Cache-Control max-age=43200 Transfer-Encoding chunked Connection keep-alive Expires Sun, 20 Feb 2022 08:05:06 GMT
GET H/1.1	200 OK	manifest.3ad1d5771e9b13dbdad2.js Show response paypal-lock-payment.com/static/js/	800 B 1 KB	281ms 142ms	Script application/javascript	92.38.176.227 GHOST
General Check archive.org Show headers Download Go to Full URL http://paypal-lock-payment.com/static/js/manifest.3ad1d5771e9b13dbdad2.js Requested by Host: paypal-lock-payment.com URL: http://paypal-lock-payment.com/ Protocol HTTP/1.1 Server 92.38.176.227 Chicago, United States, ASN202422 (GHOST, LU), Reverse DNS yuanquan004.example.com Software nginx / Resource Hash fcdf3becb34727e89ae7395ac70df92e4537639ae903784e201f479dd70f3ef0 Request headers Accept-Language jp-JP,jp;q=0.9 Referer http://paypal-lock-payment.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers Date Sat, 19 Feb 2022 20:05:07 GMT Last-Modified Thu, 17 Feb 2022 08:43:17 GMT Server nginx X-Cache MISS Content-Type application/javascript; charset=utf-8 Cache-Control max-age=43200 Connection keep-alive Content-Length 800 Expires Sun, 20 Feb 2022 08:05:07 GMT
GET H/1.1	200 OK	vendor.1a0506386d0eeafc9405.js Show response paypal-lock-payment.com/static/js/	4 MB 899 KB	289ms 148ms	Script application/javascript	92.38.176.227 GHOST
General Check archive.org Show headers Download Go to Full URL http://paypal-lock-payment.com/static/js/vendor.1a0506386d0eeafc9405.js Requested by Host: paypal-lock-payment.com URL: http://paypal-lock-payment.com/ Protocol HTTP/1.1 Server 92.38.176.227 Chicago, United States, ASN202422 (GHOST, LU), Reverse DNS yuanquan004.example.com Software nginx / Resource Hash 1471c0b82002e8eed175417e03444fa385c323d1784171e6d1a6dc6901c32228 Request headers Accept-Language jp-JP,jp;q=0.9 Referer http://paypal-lock-payment.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers Date Sat, 19 Feb 2022 20:05:07 GMT Content-Encoding gzip Last-Modified Thu, 17 Feb 2022 08:43:17 GMT Server nginx Vary Accept-Encoding X-Cache MISS Content-Type application/javascript; charset=utf-8 Cache-Control max-age=43200 Transfer-Encoding chunked Connection keep-alive Expires Sun, 20 Feb 2022 08:05:07 GMT
GET H/1.1	200 OK	app.617bbf151160a5b1e144.js Show response paypal-lock-payment.com/static/js/	96 KB 37 KB	406ms 251ms	Script application/javascript	92.38.176.227 GHOST
General Check archive.org Show headers Download Go to Full URL http://paypal-lock-payment.com/static/js/app.617bbf151160a5b1e144.js Requested by Host: paypal-lock-payment.com URL: http://paypal-lock-payment.com/ Protocol HTTP/1.1 Server 92.38.176.227 Chicago, United States, ASN202422 (GHOST, LU), Reverse DNS yuanquan004.example.com Software nginx / Resource Hash 3ebc007b9f6052ff95287c1c4c691e890a72a989b9c97d3cfd6466425c8e4bd9 Request headers Accept-Language jp-JP,jp;q=0.9 Referer http://paypal-lock-payment.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers Date Sat, 19 Feb 2022 20:05:07 GMT Content-Encoding gzip Last-Modified Thu, 17 Feb 2022 08:43:17 GMT Server nginx Vary Accept-Encoding X-Cache MISS Content-Type application/javascript; charset=utf-8 Cache-Control max-age=43200 Transfer-Encoding chunked Connection keep-alive Expires Sun, 20 Feb 2022 08:05:07 GMT
GET H2	200	cityjson Show response pv.sohu.com/	82 B 241 B	182ms 85ms	Script text/json	52.175.24.208 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://pv.sohu.com/cityjson?ie=utf-8 Requested by Host: paypal-lock-payment.com URL: http://paypal-lock-payment.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.175.24.208 Central, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software nginx/1.0.15 / Resource Hash 842abbb72e56f30fbc02c08d92954de2cca18c8f558971b48f79167fa2d488a9 Request headers Accept-Language jp-JP,jp;q=0.9 Referer http://paypal-lock-payment.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Sat, 19 Feb 2022 20:05:06 GMT fss-proxy Powered by 2723489.4034219.3477941, Powered by 4412463.4740153.7828532 server nginx/1.0.15 content-length 82 content-type text/json; charset=utf-8
GET H/1.1	200 OK	getiplang Show response paypal-lock-payment.com/auth/	85 B 272 B	362ms 362ms	XHR application/json	92.38.176.227 GHOST
General Check archive.org Show headers Download Go to Full URL http://paypal-lock-payment.com/auth/getiplang Requested by Host: paypal-lock-payment.com URL: http://paypal-lock-payment.com/static/js/vendor.1a0506386d0eeafc9405.js Protocol HTTP/1.1 Server 92.38.176.227 Chicago, United States, ASN202422 (GHOST, LU), Reverse DNS yuanquan004.example.com Software nginx / Resource Hash 7b27416ef702ee38d8608cf59520b73320902b0ff656967754d73723d50b2255 Request headers Accept application/json, text/plain, */* Referer http://paypal-lock-payment.com/ Accept-Language jp-JP,jp;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers Date Sat, 19 Feb 2022 20:05:08 GMT Cache-Control no-cache Server nginx Connection keep-alive Content-Length 85 Content-Type application/json; charset=utf-8
GET H/1.1	200 OK	paypal-logo-129x32.svg paypal-lock-payment.com/static/assets/img/	5 KB 5 KB	157ms 157ms	Image image/svg+xml	92.38.176.227 GHOST
General Check archive.org Show headers Download Go to Show image Full URL http://paypal-lock-payment.com/static/assets/img/paypal-logo-129x32.svg Requested by Host: paypal-lock-payment.com URL: http://paypal-lock-payment.com/static/css/app.6775eed8164f72ee06dec1c5e84f73d2.css Protocol HTTP/1.1 Server 92.38.176.227 Chicago, United States, ASN202422 (GHOST, LU), Reverse DNS yuanquan004.example.com Software nginx / Resource Hash b3cc50b9e94bbecaaeb1079b64b8ca50616d1732824964c1cc2c5422627a0ec5 Request headers Accept-Language jp-JP,jp;q=0.9 Referer http://paypal-lock-payment.com/static/css/app.6775eed8164f72ee06dec1c5e84f73d2.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers Date Sat, 19 Feb 2022 20:05:08 GMT Cache-Control max-age=0, no-cache Last-Modified Thu, 17 Feb 2022 08:43:17 GMT Server nginx Connection keep-alive Content-Length 4945 Content-Type image/svg+xml

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone function| webpackJsonp function| setImmediate function| clearImmediate object| __core-js_shared__ object| returnCitySN

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

paypal-lock-payment.com
pv.sohu.com
52.175.24.208
92.38.176.227
1471c0b82002e8eed175417e03444fa385c323d1784171e6d1a6dc6901c32228
3ebc007b9f6052ff95287c1c4c691e890a72a989b9c97d3cfd6466425c8e4bd9
77322b6d7dedc0088db9f75ad21b8cc867d8c76d774b2444a3e366abfb88a4a4
7b27416ef702ee38d8608cf59520b73320902b0ff656967754d73723d50b2255
842abbb72e56f30fbc02c08d92954de2cca18c8f558971b48f79167fa2d488a9
b3cc50b9e94bbecaaeb1079b64b8ca50616d1732824964c1cc2c5422627a0ec5
fcdf3becb34727e89ae7395ac70df92e4537639ae903784e201f479dd70f3ef0
fce29e1fe6bf89c80ee27d17e1bd33bc2050ab5897bff235e3176e6f53d00661