urlscan.io logo urlscan.io
SecurityTrails logo

us-paypal-login.blogspot.com Open in urlscan Pro
2a00:1450:4001:812::2001  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://us-paypal-login.blogspot.com/
Submission: On June 28 via manual from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 10 HTTP transactions. The main IP is 2a00:1450:4001:812::2001, located in Ireland and belongs to GOOGLE - Google LLC, US. The main domain is us-paypal-login.blogspot.com.
TLS certificate: Issued by Google Internet Authority G3 on June 12th 2018. Valid for: 2 months.
This is the only time us-paypal-login.blogspot.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: PayPal (Financial)

Domain & IP information

IP Address AS Autonomous System
2 2a00:1450:400... 15169 (GOOGLE)
8 2a02:4780:dea... 204915 (AWEX)
10 2
Domain Requested by
8 loftiest-milliliter.000webhostapp.com us-paypal-login.blogspot.com
2 us-paypal-login.blogspot.com us-paypal-login.blogspot.com
10 2

This site contains links to these domains. Also see Links.

Domain
www.blogger.com
Subject Issuer Validity Valid
*.googleusercontent.com
Google Internet Authority G3		 2018-06-12 -
2018-08-21		 2 months crt.sh

This page contains 1 frames:

Primary Page: https://us-paypal-login.blogspot.com/
Frame ID: 4F605D88B91BB077EF103B0483323A8E
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • url /\.blogspot\.com/i
Overall confidence: 100%
Detected patterns
  • headers server /GSE/i
Overall confidence: 100%
Detected patterns
  • headers server /GSE/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+font-awesome(?:\.min)?\.css/i
Overall confidence: 100%
Detected patterns
  • script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
  • script /jquery.*\.js/i
  • env /^jQuery$/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]+?href="[^"]+bootstrap(?:\.min)?\.css/i
  • script /(?:twitter\.github\.com\/bootstrap|bootstrap(?:\.js|\.min\.js))/i

Page Statistics

10
Requests

20 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

90 kB
Transfer

296 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
us-paypal-login.blogspot.com/ 		4 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://us-paypal-login.blogspot.com/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:812::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
GSE /
Resource Hash
723d45e660a32478800d48dc212655507d19fc24ce4424b137c0482577e46a63
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
us-paypal-login.blogspot.com
:scheme
https
:path
/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
accept-encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id
4F605D88B91BB077EF103B0483323A8E

Response headers

status
200
content-type
text/html; charset=UTF-8
expires
Thu, 28 Jun 2018 23:41:48 GMT
date
Thu, 28 Jun 2018 23:41:48 GMT
cache-control
private, max-age=0
last-modified
Thu, 28 Jun 2018 03:28:01 GMT
etag
W/"8e1281b19da44c782e514bb5998fed29023d030c295194fb38973f5dd4ecba2d"
content-encoding
gzip
x-content-type-options
nosniff
x-xss-protection
1; mode=block
content-length
1641
server
GSE
alt-svc
quic=":443"; ma=2592000; v="43,42,41,39,35"
normalize.css
loftiest-milliliter.000webhostapp.com/Log/ 		8 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://loftiest-milliliter.000webhostapp.com/Log/normalize.css
Requested by
Host: us-paypal-login.blogspot.com
URL: https://us-paypal-login.blogspot.com/
Protocol
SPDY
Server
2a02:4780:dead:efe::1 , Lithuania, ASN204915 (AWEX, US),
Reverse DNS
Software
awex /
Resource Hash
c13ab36ef47c80231ddd9e6774f9ada731e439a298e4a3471ad347cf5e4f36b5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://us-paypal-login.blogspot.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 28 Jun 2018 23:41:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 28 Jun 2018 00:16:49 GMT
server
awex
content-type
text/css
status
200
x-xss-protection
1; mode=block
x-request-id
38d7f5a7aff84eb48af34117c833e223
bootstrap.min.css
loftiest-milliliter.000webhostapp.com/Log/ 		118 KB
24 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://loftiest-milliliter.000webhostapp.com/Log/bootstrap.min.css
Requested by
Host: us-paypal-login.blogspot.com
URL: https://us-paypal-login.blogspot.com/
Protocol
SPDY
Server
2a02:4780:dead:efe::1 , Lithuania, ASN204915 (AWEX, US),
Reverse DNS
Software
awex /
Resource Hash
f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://us-paypal-login.blogspot.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 28 Jun 2018 23:41:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 28 Jun 2018 00:16:38 GMT
server
awex
content-type
text/css
status
200
x-xss-protection
1; mode=block
x-request-id
d928b89bb5adc763da111a7bf1211ec2
font-awesome.min.css
loftiest-milliliter.000webhostapp.com/Log/ 		21 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://loftiest-milliliter.000webhostapp.com/Log/font-awesome.min.css
Requested by
Host: us-paypal-login.blogspot.com
URL: https://us-paypal-login.blogspot.com/
Protocol
SPDY
Server
2a02:4780:dead:efe::1 , Lithuania, ASN204915 (AWEX, US),
Reverse DNS
Software
awex /
Resource Hash
0fb1bbca73646e8e2b93c82e8d8b219647b13d4b440c48e338290b9a685b8de1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://us-paypal-login.blogspot.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 28 Jun 2018 23:41:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 28 Jun 2018 00:16:43 GMT
server
awex
content-type
text/css
status
200
x-xss-protection
1; mode=block
x-request-id
40a12b97941534cfdb53f3452669d8fd
login.css
loftiest-milliliter.000webhostapp.com/Log/ 		5 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://loftiest-milliliter.000webhostapp.com/Log/login.css
Requested by
Host: us-paypal-login.blogspot.com
URL: https://us-paypal-login.blogspot.com/
Protocol
SPDY
Server
2a02:4780:dead:efe::1 , Lithuania, ASN204915 (AWEX, US),
Reverse DNS
Software
awex /
Resource Hash
123a1d5f92b2744c003a176eb36ebcb867e8c46d6bea590ebccf57cac45d4f45
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://us-paypal-login.blogspot.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 28 Jun 2018 23:41:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 28 Jun 2018 00:16:49 GMT
server
awex
content-type
text/css
status
200
x-xss-protection
1; mode=block
x-request-id
11cbf64de6cd7d668f9f60dc46c85ada
ppt.PNG
loftiest-milliliter.000webhostapp.com/Log/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://loftiest-milliliter.000webhostapp.com/Log/ppt.PNG
Requested by
Host: us-paypal-login.blogspot.com
URL: https://us-paypal-login.blogspot.com/
Protocol
SPDY
Server
2a02:4780:dead:efe::1 , Lithuania, ASN204915 (AWEX, US),
Reverse DNS
Software
awex /
Resource Hash
30956198f3f7ad95a65a31f44304a35f639917b4b7f7fdea4622b9549c037cd0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://us-paypal-login.blogspot.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 28 Jun 2018 23:41:49 GMT
x-content-type-options
nosniff
last-modified
Thu, 28 Jun 2018 00:16:50 GMT
server
awex
content-type
image/png
status
200
accept-ranges
bytes
content-length
1771
x-xss-protection
1; mode=block
x-request-id
328bf80017ba5ca0d6bf65f623100f25
jquery-1.11.3.min.js.download
loftiest-milliliter.000webhostapp.com/Log/ 		94 KB
38 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://loftiest-milliliter.000webhostapp.com/Log/jquery-1.11.3.min.js.download
Requested by
Host: us-paypal-login.blogspot.com
URL: https://us-paypal-login.blogspot.com/
Protocol
SPDY
Server
2a02:4780:dead:efe::1 , Lithuania, ASN204915 (AWEX, US),
Reverse DNS
Software
awex /
Resource Hash
4e7e1c16e351e7bfc80cddef9f98e99113ddb0d1e201be00d53955fe62f0e523
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://us-paypal-login.blogspot.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 28 Jun 2018 23:41:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 28 Jun 2018 00:16:48 GMT
server
awex
content-type
application/javascript
status
200
x-xss-protection
1; mode=block
x-request-id
e59e1748e0372c0af201280e190dfef8
bootstrap.min.js.download
loftiest-milliliter.000webhostapp.com/Log/ 		36 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://loftiest-milliliter.000webhostapp.com/Log/bootstrap.min.js.download
Requested by
Host: us-paypal-login.blogspot.com
URL: https://us-paypal-login.blogspot.com/
Protocol
SPDY
Server
2a02:4780:dead:efe::1 , Lithuania, ASN204915 (AWEX, US),
Reverse DNS
Software
awex /
Resource Hash
53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://us-paypal-login.blogspot.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 28 Jun 2018 23:41:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 28 Jun 2018 00:16:42 GMT
server
awex
content-type
application/javascript
status
200
x-xss-protection
1; mode=block
x-request-id
43f1612248750a2b449201a6960a3fc3
plugins.js.download
loftiest-milliliter.000webhostapp.com/Log/ 		1 KB
653 B 		Script
General
Check archive.org
Download Go to
Full URL
https://loftiest-milliliter.000webhostapp.com/Log/plugins.js.download
Requested by
Host: us-paypal-login.blogspot.com
URL: https://us-paypal-login.blogspot.com/
Protocol
SPDY
Server
2a02:4780:dead:efe::1 , Lithuania, ASN204915 (AWEX, US),
Reverse DNS
Software
awex /
Resource Hash
f00f02c037ca466166cccc713ea4c609dc0b6b1345916fe4acc3db6dd6d854fd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://us-paypal-login.blogspot.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 28 Jun 2018 23:41:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 28 Jun 2018 00:16:50 GMT
server
awex
content-type
application/javascript
status
200
x-xss-protection
1; mode=block
x-request-id
8367ba5e650b474b1566c31f7a29abe5
cookienotice.js
us-paypal-login.blogspot.com/js/ 		6 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://us-paypal-login.blogspot.com/js/cookienotice.js
Requested by
Host: us-paypal-login.blogspot.com
URL: https://us-paypal-login.blogspot.com/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:812::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
068ffe90977f2b5b2dc2ef18572166e85281bd0ecb31c4902464b23db54d2568
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:path
/js/cookienotice.js
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
us-paypal-login.blogspot.com
referer
https://us-paypal-login.blogspot.com/
:scheme
https
:method
GET
Referer
https://us-paypal-login.blogspot.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 28 Jun 2018 15:10:02 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 28 Jun 2018 08:22:20 GMT
server
sffe
age
30706
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=604800
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length
2026
x-xss-protection
1; mode=block
expires
Thu, 05 Jul 2018 15:10:02 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| adsbygoogle function| $ function| jQuery object| jQuery111307931030162126886 object| cookieChoices

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block