www.roypandawa.com
Open in
urlscan Pro
45.64.1.64
Malicious Activity!
Public Scan
Submission: On December 14 via automatic, source phishtank
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on November 6th 2019. Valid for: 3 months.
This is the only time www.roypandawa.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: PayPal (Financial)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
5 | 45.64.1.64 45.64.1.64 | 55660 (MWN-AS-ID...) (MWN-AS-ID PT Master Web Network) | |
1 | 2a00:1450:400... 2a00:1450:4001:80b::200a | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
9 | 2.21.38.79 2.21.38.79 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
15 | 3 |
ASN55660 (MWN-AS-ID PT Master Web Network, ID)
PTR: cl46064x.c.maintenis.com
www.roypandawa.com |
ASN15169 (GOOGLE - Google LLC, US)
ajax.googleapis.com |
ASN20940 (AKAMAI-ASN1, US)
PTR: a2-21-38-79.deploy.static.akamaitechnologies.com
www.paypalobjects.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
paypalobjects.com
www.paypalobjects.com |
85 KB |
5 |
roypandawa.com
www.roypandawa.com |
63 KB |
1 |
googleapis.com
ajax.googleapis.com |
33 KB |
15 | 3 |
Domain | Requested by | |
---|---|---|
9 | www.paypalobjects.com |
www.roypandawa.com
|
5 | www.roypandawa.com |
www.roypandawa.com
|
1 | ajax.googleapis.com |
www.roypandawa.com
|
15 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
roypandawa.com cPanel, Inc. Certification Authority |
2019-11-06 - 2020-02-04 |
3 months | crt.sh |
*.storage.googleapis.com GTS CA 1O1 |
2019-11-13 - 2020-02-05 |
3 months | crt.sh |
www.paypal.com DigiCert SHA2 Extended Validation Server CA |
2019-09-10 - 2020-08-18 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.roypandawa.com/language/en-GB/review/issues/ad61a742d9fdf9c37cd7eebda1b8789d/en/
Frame ID: 206C98A8732281ED3A433B7E9AE8CA08
Requests: 15 HTTP requests in this frame
Screenshot
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
RequireJS (JavaScript Frameworks) Expand
Detected patterns
- script /require.*\.js/i
Modernizr (JavaScript Libraries) Expand
Detected patterns
- script /([\d.]+)?\/modernizr(?:.([\d.]+))?.*\.js/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
15 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
Cookie set
/
www.roypandawa.com/language/en-GB/review/issues/ad61a742d9fdf9c37cd7eebda1b8789d/en/ |
3 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/1/ |
94 KB 33 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
appp.css
www.roypandawa.com/language/en-GB/review/issues/ad61a742d9fdf9c37cd7eebda1b8789d/en/css/ |
32 KB 32 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
modernizr-2.6.1.js
www.roypandawa.com/language/en-GB/review/issues/ad61a742d9fdf9c37cd7eebda1b8789d/en/js/ |
4 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
uaTKEW4R.jpeg
www.roypandawa.com/language/en-GB/review/issues/ad61a742d9fdf9c37cd7eebda1b8789d/en/css/shared/secret/ |
9 KB 9 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
require.js
www.roypandawa.com/language/en-GB/review/issues/ad61a742d9fdf9c37cd7eebda1b8789d/en/js/ |
15 KB 15 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
momgram@2x.png
www.paypalobjects.com/images/shared/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ui-sprite.png
www.paypalobjects.com/webstatic/mktg/consumer/onboarding/ |
24 KB 24 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
config.js
www.paypalobjects.com/web/res/6fa/104e08d2db783086036be0a2875e2/js/ |
1 KB 872 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app.js
www.paypalobjects.com/web/res/6fa/104e08d2db783086036be0a2875e2/js/ |
148 KB 51 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dust-core.js
www.paypalobjects.com/web/res/6fa/104e08d2db783086036be0a2875e2/js/lib/ |
11 KB 4 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
authcaptcha.js
www.paypalobjects.com/web/res/6fa/104e08d2db783086036be0a2875e2/js/view/ |
1 KB 957 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pageView.js
www.paypalobjects.com/web/res/6fa/104e08d2db783086036be0a2875e2/js/view/ |
962 B 829 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
validation.js
www.paypalobjects.com/web/res/6fa/104e08d2db783086036be0a2875e2/js/widgets/ |
693 B 669 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
errorDisplay.js
www.paypalobjects.com/web/res/6fa/104e08d2db783086036be0a2875e2/js/widgets/ |
2 KB 1 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: PayPal (Financial)17 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| $ function| jQuery function| killCopy function| reEnable object| html5 object| Modernizr function| requirejs function| require function| define function| extend object| dust function| _ object| Backbone object| PAYPAL object| jQuery1800087966137275571341 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
www.roypandawa.com/ | Name: PHPSESSID Value: 7ho4c141f33i70b06gur7acnn7 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
www.paypalobjects.com
www.roypandawa.com
2.21.38.79
2a00:1450:4001:80b::200a
45.64.1.64
051139e3768ed3f9945e6fb8e5eab3ac3aeef767ebff4b334363dcdcadf9e3b9
1c9dd1b0663ba2324632f0ffebb21112a92f039305241661c289c88af523cb1a
3cdde1cfd70cd4425b138b265e552cdac280e8c00e1641f60e5282fbc3a86ee5
40727ba59e18f85868f5f57b3204d781d871587872857fedeb15458a77c888fe
41a43cd0ee12087cc864fc89adc7abe76b9d4e3ce6bf55434fa8f51d1ec827a8
4678bdde985ba57d66411269ea0daf52656baa86864507bf03e1e518a588b318
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441
667ccee8cd470db4499d3ed71d49e45efccfcb75d892de0a52bd344b92621959
7549618e528fd1eccd42defb37f7b18d7330813a4c7214f5b9660f7a6c23032b
7cebc338f5a4d0edb110b7826007f53e8cdb2a3ba0be5521b6b3f1aeff23e807
9ae927e459c587f559aa319d12fae764ac24f0e29d16d470702296890cd99889
a6c3bff965978df8093c3a29f7071c21d7439a212af41e7b40ce70d94d6bcc44
b9c1fbd8f6b13011e0c3e0e9ca294884f09dc3ec0c305b41f567bf9b088aebbe
c007d73792ac2d25882bfbb573e700e721a0adacfab947e6a0b64a61991fecf0
c75ecbd81b7ee731db3a9fb59d6b25b2d7f20ba2a0277a68e856d117c7ebce54