www.confirm-payee-review.net Open in urlscan Pro
198.54.114.39  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request index.php Show response www.confirm-payee-review.net/admin/	3 KB 2 KB	400ms 372ms	Document text/html	198.54.114.39 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL http://www.confirm-payee-review.net/admin/index.php Protocol HTTP/1.1 Server 198.54.114.39 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS business128-5.web-hosting.com Software Apache / PHP/7.2.34 Resource Hash cfb8824d96405e31f0d777aa1efad874ffd3f995c8c58f74c6b90b58006f704a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Host www.confirm-payee-review.net Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sun, 11 Apr 2021 01:15:52 GMT server Apache x-powered-by PHP/7.2.34 expires Thu, 19 Nov 1981 08:52:00 GMT cache-control no-store, no-cache, must-revalidate pragma no-cache set-cookie PHPSESSID=a644fa5ce7c12d5b54c585434f11f6a5; path=/ vary Accept-Encoding content-encoding gzip content-length 1160 content-type text/html; charset=UTF-8 x-frame-options SAMEORIGIN x-xss-protection 1; mode=block x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains; preload; referrer-policy no-referrer-when-downgrade
GET H2	200	bootstrap.min.css stackpath.bootstrapcdn.com/bootstrap/4.4.1/css/	156 KB 21 KB	40ms 22ms	Stylesheet text/css	2606:4700::6812:acf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://stackpath.bootstrapcdn.com/bootstrap/4.4.1/css/bootstrap.min.css Requested by Host: www.confirm-payee-review.net URL: http://www.confirm-payee-review.net/admin/index.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2ff5b959fa9f6b4b1d04d20a37d706e90039176ab1e2a202994d9580baeebfd6 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer http://www.confirm-payee-review.net/admin/index.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sun, 11 Apr 2021 01:15:52 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT cdn-edgestorageid 722, 617, 617 age 2699297 cdn-cachedat 2021-03-10 20:26:24 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id 096018eea800002c262504b000000001 timing-allow-origin * access-control-allow-origin * last-modified Mon, 25 Jan 2021 22:04:09 GMT server cloudflare cdn-requestpullcode 200 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/css; charset=utf-8 cdn-cache HIT vary Accept-Encoding cache-control public, max-age=31919000 cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cdn-requestid 1463cd69f9140a07f2554f9b3f382d4d cf-ray 63e05dc43fd42c26-FRA cdn-requestcountrycode DE cdn-requestpullsuccess True
GET H2	200	jquery-3.4.1.min.js Show response code.jquery.com/	86 KB 30 KB	29ms 9ms	Script application/javascript	2001:4de0:ac18::1:a:2b HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.4.1.min.js Requested by Host: www.confirm-payee-review.net URL: http://www.confirm-payee-review.net/admin/index.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac18::1:a:2b , Netherlands, ASN20446 (HIGHWINDS3, US), Reverse DNS Software nginx / Resource Hash 0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a Request headers Referer http://www.confirm-payee-review.net/admin/index.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sun, 11 Apr 2021 01:15:52 GMT content-encoding gzip last-modified Wed, 01 May 2019 21:14:27 GMT server nginx etag W/"5cca0c33-15851" vary Accept-Encoding x-hw 1618103752.dop055.fr8.t,1618103752.cds208.fr8.hn,1618103752.cds236.fr8.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 30638
GET H2	200	popper.min.js Show response cdn.jsdelivr.net/npm/popper.js@1.16.0/dist/umd/	21 KB 8 KB	23ms 5ms	Script application/javascript	2a04:4e42:1b::621 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/popper.js@1.16.0/dist/umd/popper.min.js Requested by Host: www.confirm-payee-review.net URL: http://www.confirm-payee-review.net/admin/index.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::621 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash c776195ad46333c6c9a9fe3c74502ffea9a02faf122388ea3567922cc65a3060 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer http://www.confirm-payee-review.net/admin/index.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff age 5192199 x-cache HIT, HIT cross-origin-resource-policy cross-origin content-length 7510 etag W/"5309-YvI45zNIx3656GVCan0bfeI8uy0" x-served-by cache-fra19125-FRA, cache-hhn4026-HHN date Sun, 11 Apr 2021 01:15:52 GMT vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=31536000, s-maxage=31536000, immutable accept-ranges bytes timing-allow-origin *
GET H2	200	bootstrap.min.js Show response stackpath.bootstrapcdn.com/bootstrap/4.4.1/js/	59 KB 15 KB	41ms 24ms	Script application/javascript	2606:4700::6812:acf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://stackpath.bootstrapcdn.com/bootstrap/4.4.1/js/bootstrap.min.js Requested by Host: www.confirm-payee-review.net URL: http://www.confirm-payee-review.net/admin/index.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5aa53525abc5c5200c70b3f6588388f86076cd699284c23cda64e92c372a1548 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer http://www.confirm-payee-review.net/admin/index.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sun, 11 Apr 2021 01:15:52 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT cdn-edgestorageid 632, 617, 617, 718, 718, 718 age 2699296 cdn-cachedat 2021-03-10 20:26:23 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id 096018eea800002c268cba7000000001 timing-allow-origin * access-control-allow-origin * last-modified Mon, 25 Jan 2021 22:04:09 GMT server cloudflare cdn-requestpullcode 200 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/javascript; charset=utf-8 cdn-cache HIT vary Accept-Encoding cache-control public, max-age=31919000 cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cdn-requestid 42c75f14eb4c58bfd85d715bac944829 cf-ray 63e05dc43fd52c26-FRA cdn-requestcountrycode DE cdn-requestpullsuccess True
GET H/1.1	200 OK	admin.svg www.confirm-payee-review.net/admin/files/img/	2 KB 1 KB	206ms 205ms	Image image/svg+xml	198.54.114.39 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL http://www.confirm-payee-review.net/admin/files/img/admin.svg Requested by Host: www.confirm-payee-review.net URL: http://www.confirm-payee-review.net/admin/index.php Protocol HTTP/1.1 Server 198.54.114.39 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS business128-5.web-hosting.com Software Apache / Resource Hash 257e399a86659ece27e88738715603f46ca65b1affd7175715bb56b327431055 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer http://www.confirm-payee-review.net/admin/index.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sun, 11 Apr 2021 01:15:52 GMT content-encoding gzip referrer-policy no-referrer-when-downgrade last-modified Wed, 07 Oct 2020 23:45:54 GMT server Apache x-frame-options SAMEORIGIN content-type image/svg+xml x-xss-protection 1; mode=block strict-transport-security max-age=31536000; includeSubDomains; preload; accept-ranges bytes vary Accept-Encoding content-length 1020 x-content-type-options nosniff

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Phishkit Admin (Online)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery function| Popper object| bootstrap

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.confirm-payee-review.net/	1969-12-31 23:59:59	Name: PHPSESSID Value: a644fa5ce7c12d5b54c585434f11f6a5

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.jsdelivr.net
code.jquery.com
stackpath.bootstrapcdn.com
www.confirm-payee-review.net
198.54.114.39
2001:4de0:ac18::1:a:2b
2606:4700::6812:acf
2a04:4e42:1b::621
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
257e399a86659ece27e88738715603f46ca65b1affd7175715bb56b327431055
2ff5b959fa9f6b4b1d04d20a37d706e90039176ab1e2a202994d9580baeebfd6
5aa53525abc5c5200c70b3f6588388f86076cd699284c23cda64e92c372a1548
c776195ad46333c6c9a9fe3c74502ffea9a02faf122388ea3567922cc65a3060
cfb8824d96405e31f0d777aa1efad874ffd3f995c8c58f74c6b90b58006f704a