mail.paxful-claim.com Open in urlscan Pro
198.187.29.151 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://mail.paxful-claim.com/
Submission Tags: phishing
Submission: On April 29 via api (April 29th 2021, 11:29:01 am UTC) from US

Summary HTTP 17 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 6 IPs in 3 countries across 5 domains to perform 17 HTTP transactions. The main IP is 198.187.29.151, located in United States and belongs to NAMECHEAP-NET, US. The main domain is mail.paxful-claim.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on May 7th 2020. Valid for: 2 years.

This is the only time mail.paxful-claim.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Paxful (Crypto Exchange)

Domain & IP information

	IP Address	AS Autonomous System
9	198.187.29.151 198.187.29.151	22612 (NAMECHEAP...) (NAMECHEAP-NET)
1	2a00:1450:400... 2a00:1450:4001:803::200a	15169 (GOOGLE) (GOOGLE)
2	52.30.83.119 52.30.83.119	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:20c... 2600:9000:20c8:4c00:1:149e:16c0:93a1	16509 (AMAZON-02) (AMAZON-02)
3	2a00:1450:400... 2a00:1450:4001:801::2003	15169 (GOOGLE) (GOOGLE)
1	54.235.83.248 54.235.83.248	14618 (AMAZON-AES) (AMAZON-AES)
17	6

9 198.187.29.151 (United States)

ASN22612 (NAMECHEAP-NET, US)
PTR: server128-4.web-hosting.com

mail.paxful-claim.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:803::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.30.83.119 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-30-83-119.eu-west-1.compute.amazonaws.com

api.geetest.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:20c8:4c00:1:149e:16c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

static.geetest.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:801::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.235.83.248 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-235-83-248.compute-1.amazonaws.com

api.ipify.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	paxful-claim.com mail.paxful-claim.com	109 KB
3	gstatic.com fonts.gstatic.com	32 KB
3	geetest.com api.geetest.com static.geetest.com	6 KB
1	ipify.org api.ipify.org	261 B
1	googleapis.com fonts.googleapis.com	1 KB
17	5

	Domain	Requested by
9	mail.paxful-claim.com	mail.paxful-claim.com
3	fonts.gstatic.com	fonts.googleapis.com
2	api.geetest.com	mail.paxful-claim.com
1	api.ipify.org	mail.paxful-claim.com
1	static.geetest.com	mail.paxful-claim.com
1	fonts.googleapis.com	mail.paxful-claim.com
17	6

This site contains links to these domains. Also see Links.

Domain
paxful.com

Subject Issuer	Validity	Valid
*.web-hosting.com Sectigo RSA Domain Validation Secure Server CA	`2020-05-07` - `2022-04-05`	2 years	crt.sh
upload.video.google.com GTS CA 1C3	`2021-04-13` - `2021-07-06`	3 months	crt.sh
*.geetest.com GeoTrust TLS DV RSA Mixed SHA256 2020 CA-1	`2021-01-28` - `2022-01-28`	a year	crt.sh
*.gstatic.com GTS CA 1O1	`2021-03-23` - `2021-06-15`	3 months	crt.sh
*.ipify.org Sectigo RSA Domain Validation Secure Server CA	`2021-01-19` - `2022-02-19`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://mail.paxful-claim.com/
Frame ID: 928C7D15DF735F398CE452A622C2FAFF
Requests: 17 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Page Statistics

17
Requests

47 %
HTTPS

50 %
IPv6

5
Domains

6
Subdomains

6
IPs

3
Countries

148 kB
Transfer

744 kB
Size

0
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://paxful.com/

Search URL Search Domain Scan URL

URL: https://paxful.com/forgot-password?locale=en
Title: Forgot password?

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
mail.paxful-claim.com/ 28 KB
8 KB 543ms
184ms Document
text/html 198.187.29.151
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://mail.paxful-claim.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 198.187.29.151 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: server128-4.web-hosting.com
Software: Apache /
Resource Hash: cf4894dcbad595ca6c89c82773962caa441cdc757170cfca9fd5c883f9fe3ce2

Request headers

:method: GET
:authority: mail.paxful-claim.com
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1

Response headers

date: Thu, 29 Apr 2021 11:28:44 GMT
server: Apache
last-modified: Wed, 28 Apr 2021 16:09:07 GMT
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-length: 7825
content-type: text/html

GET
H2 200 chunk.css
mail.paxful-claim.com/ 37 KB
7 KB 344ms
342ms Stylesheet
text/css 198.187.29.151
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://mail.paxful-claim.com/chunk.css
Requested by: Host: mail.paxful-claim.com
URL: https://mail.paxful-claim.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 198.187.29.151 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: server128-4.web-hosting.com
Software: Apache /
Resource Hash: 824d7cc2627461b270716c538bd9943cc461384850cc584d99fee6a5d371b160

Request headers

:path: /chunk.css
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: mail.paxful-claim.com
referer: https://mail.paxful-claim.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://mail.paxful-claim.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1

Response headers

date: Thu, 29 Apr 2021 11:28:44 GMT
content-encoding: gzip
last-modified: Mon, 19 Apr 2021 00:41:34 GMT
server: Apache
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 6603

GET
H2 200 main.css
mail.paxful-claim.com/ 566 KB
64 KB 349ms
348ms Stylesheet
text/css 198.187.29.151
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://mail.paxful-claim.com/main.css
Requested by: Host: mail.paxful-claim.com
URL: https://mail.paxful-claim.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 198.187.29.151 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: server128-4.web-hosting.com
Software: Apache /
Resource Hash: 0fc0b442a468b0fb3019a5ba5f81ec87c43fe09f16c0513d7fa496a8a9d3db67

Request headers

:path: /main.css
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: mail.paxful-claim.com
referer: https://mail.paxful-claim.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://mail.paxful-claim.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1

Response headers

date: Thu, 29 Apr 2021 11:28:44 GMT
content-encoding: gzip
last-modified: Mon, 19 Apr 2021 00:40:36 GMT
server: Apache
accept-ranges: bytes
vary: Accept-Encoding
content-type: text/css

GET
H2 200 css
fonts.googleapis.com/ 12 KB
1 KB 35ms
15ms Stylesheet
text/css 2a00:1450:4001:803::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Montserrat:400,500,700|Open+Sans:400,600,700&display=swap&subset=cyrillic

Requested by

Host: mail.paxful-claim.com
URL: https://mail.paxful-claim.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

35417626d8c29128917cd1c757e92189edc47b44a06124f54a577560a4d171fd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://mail.paxful-claim.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
date: Thu, 29 Apr 2021 11:28:44 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
expires: Thu, 29 Apr 2021 11:28:44 GMT

GET
H2 404 c.js
mail.paxful-claim.com/v1/c/ 0
0 184ms
183ms Script
text/html 198.187.29.151
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://mail.paxful-claim.com/v1/c/c.js?529715187284844
Requested by: Host: mail.paxful-claim.com
URL: https://mail.paxful-claim.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 198.187.29.151 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: server128-4.web-hosting.com
Software: Apache /
Resource Hash

Request headers

:path: /v1/c/c.js?529715187284844
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: mail.paxful-claim.com
referer: https://mail.paxful-claim.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://mail.paxful-claim.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1

Response headers

date: Thu, 29 Apr 2021 11:28:44 GMT
server: Apache
accept-ranges: bytes
content-type: text/html

GET
H2 200 gettype.php Show response
api.geetest.com/ 515 B
782 B 375ms
374ms Script
text/javascript 52.30.83.119
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.geetest.com/gettype.php?gt=98d799385d0804f2a40ebcb936d99ed3&callback=geetest_1610984121855
Requested by: Host: mail.paxful-claim.com
URL: https://mail.paxful-claim.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.30.83.119 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-30-83-119.eu-west-1.compute.amazonaws.com
Software: openresty /
Resource Hash: bfb305d806a9132b3ff10eef199153ab3a827777da305f18978e3a78bf93d995

Request headers

Referer: https://mail.paxful-claim.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1

Response headers

pragma: no-cache
date: Thu, 29 Apr 2021 11:28:44 GMT
server: openresty
etag: "ef1c8d44c9d0a2ca0c1ec403a57e311d742665c7"
content-type: text/javascript;charset=UTF-8
cache-control: no-cache, no-store, must-revalidate
content-length: 515
expires: 0

GET
H2 404 fullpage.9.0.2.js
mail.paxful-claim.com/https://accounts.paxful.com/static.geetest.comhttps://accounts.paxful.com/static/js/ 0
0 179ms
179ms Script
text/html 198.187.29.151
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://mail.paxful-claim.com/https://accounts.paxful.com/static.geetest.comhttps://accounts.paxful.com/static/js/fullpage.9.0.2.js
Requested by: Host: mail.paxful-claim.com
URL: https://mail.paxful-claim.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 198.187.29.151 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: server128-4.web-hosting.com
Software: Apache /
Resource Hash

Request headers

:path: /https://accounts.paxful.com/static.geetest.comhttps://accounts.paxful.com/static/js/fullpage.9.0.2.js
pragma: no-cache
origin: https://mail.paxful-claim.com
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: mail.paxful-claim.com
referer: https://mail.paxful-claim.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Origin: https://mail.paxful-claim.com
Referer: https://mail.paxful-claim.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1

Response headers

date: Thu, 29 Apr 2021 11:28:44 GMT
server: Apache
accept-ranges: bytes
content-type: text/html

GET
H2 200 get.php Show response
api.geetest.com/ 113 B
384 B 419ms
309ms Script
text/javascript 52.30.83.119
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.geetest.com/get.php?gt=98d799385d0804f2a40ebcb936d99ed3&challenge=ee1d0b7d89c459c84b3938797244f02c&lang=en&pt=0&client_type=web&w=iuujvAv42QcQjd()S1oVpeKrGJTwz4BprFNtYf(A4dDILCX)ZiaSBMH7x)1qm00hADdkHsNUOjY2jIyxAVujdNXStaNWqJUe2p83KD7HCOXoC97mejrqO4NV9cABPlmryZ4cWgs9p2LFAuk(q)S7EprPQ0CQ8waTSixnwu)1MWLolkhPtxrUdyWPpUu0GFHGiLIvkIfsY6DdGodZD9Nm4rd193gMzsu1WAklmZNp2)YyXLO0RSKVS)W4NFzYthU2GqTB)OVsYF32IXa2(kdo9LeyvUB(C8OFF5cZQvoJlGJ7JNFLWxEGb8njWSVGq0vtuDPy3XW77q)66w5zcaHQPgo)Dick1xoLErvyfdSJW6PZgMacDLOCaw3djZjvWhT2gnzlciYIQmDC01qbUELWlz4Du3043CWdYXBNwFzfFbtz(6OpkE9YjO78MmE3MsuWJD9NT2oTGvHEezMguO77rFQiIVhofZPoVhHjedodUN0xissSmbZuXBtuG1E3MHP(n7(Ijz9tHxKToVbirAaLvj0E84TRNGp61Ps5o)(J9YVGYdxJfk8(YMHEGCK)DwE8)R(4Pq26SpXsYqYGwI69XY8s5RBPa9HdNIxinzKev8UfmrfZnmhsQq1)aOhhISo(XPDiDatPvRVgmqmlwCp3dgb2N4NmLGiG5klMvg(E3bGl1yYdvcMoOrHmQvw)aTR3ONLpqABYboO7hPyZUtxbvQkq9ttjSStOolM2m5HH(rUdHMALFpXP4tCCq(WpryA4GxUFkULi2Nd4aOAIyfgGFe(BIBuepRPRn55HOtUPecZsX(ttHXNC5SmWQCoDjLCfhUoh5Mh964MiUFDYrW1CoTw6JRJZ0C1rXKfLZzLuwxOSeoz946lly8fafAg914V70s9KGTDyjrpdPHYMTiHyaYMWBUVUrChDnT5gb7KElvlD)fg1oMYNlk4jLhSr06IAMVEkzAu9lr0VFkN5kIG8gqdmFhWifjn5(7LHRtnb95Uul4Km4YorKd)q1aAFzPMnDSn(Rbp6e3xf9m)7HLxC7Eh2)VtII9ca6l3pfzVBFCmY(YDB3g5879mBq7ubrcyExjIpDI2SnEQkWdnNfdlH9(uBrFe2nAa6wv6OY8P5zaXmf8RktIu9MTfWZ52kZ1LvZuVPsmVfcXt4sGA2HYeI5lYm()IF7jdGO3OovuYn4DAURKI0X(fDnlcO7P)r26HcA6zm5XYstj6oKB(CZM653TXaiDdy8KbbBHm7SFMnaPKEwel7zqRb1kzlP0Rhvx6YBgK7YhA7GlzMCZ3BnONzJvuQlr23i4zqgHa0HOWuVCTldY9a)P(s(qWlxN363I)EcdgponkNdZyS)L3yWzLxOZXvYYZdhHeYZj7LCK1(86td9V(QG64yonnXaUvvZi7GRw3By53Nj8PxNAlFdm49FOBoGAB)4EonXbWAyxHCjhLqDBGMU)45oNUVAtNb0AAmM9UmAPqqrRY6YdrrUIuFa(erD(uwhkg2TvASWmF8vb9CabZ7ksoRiuRnmgbmupPOB7EOgUkw8UQ6dyT4ehWgOktdMVBwsWBzvtD(lXS36knm(zVonsnvRPaYLPZ4XalHETyLWcrbChXnAlmNoj4yVDgLDVCNBbLK9e0Jw9Ji3PmBDNlGdbc257vrFUggciej28KEW35ihNhTe6S)DiTlE8tg4Pj0cDUrPlloQt35kCkBQd9CCgsMGWABwctZiVDiV76UizCUMkV3ZL)TBHQ2GsxIhlUVCSsqQa16oRqkDkI6sgzItG)VJaWlo38asEmhX3b)FHVed(tCFPJiwgtBfeJH697etAfLgsk7TEaopAQK6pHjrCBdkRCwAffWcsxTPwtrDMrua3Ddr8S7NJ46zSUS49cXN4dGTGPTgOGXM47BlNAWS0fYGsAY8(uJLM3hegaVdHifKh2z4R4LvxK((mbd4x(WEKGmG)E(1W5L3iXnNqSG9A3TV6z3HltmvS25nJZOVrre)OjwmsfUC9X65P)XI6joMGG9Mj5yma6eFE4cYTRtR2DBEO8CdEe2wkU)VepYlB4w)2G8KglATLEIGeZuHsDSMd5pOMAos0u6Ynjro6eTkUY3VOhom8gKyDJ3S9BS22vyykJq9IRJz8fEimfFfOnz1tLNgxbQVC9LLp5utxL4eIXyV)gLuwUHrsRciId)vaaQxZli1XVKhoBxEV1VrEmLJ6(p6tUIu7rBZt2YSAtYbIZYXt1qh(F10UQfafxwKtPHPqUmV56fMhpWI0Knw75NimFxHYPwRBvzAoU.73f1ea5034626afadf61ff91abe1abd71dc91a91e9c5a1518b7f3e2f3ac826d8ae3e51611889e25c6c9493bb452d2c7c8e026e77a27f445bef9b936c3e57dbe1aeb0a88c4e29a0a14e446be25385f821b9604b31a21b74349d9738a5fedd1b0fbd9477316cb3923a5c109733ae7136b17f1b8ab7da688a8c7823213bb40a8a4c&callback=geetest_1610984123161
Requested by: Host: mail.paxful-claim.com
URL: https://mail.paxful-claim.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.30.83.119 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-30-83-119.eu-west-1.compute.amazonaws.com
Software: openresty /
Resource Hash: a8b269205a1d4d42ec1946bcbdcd34223805c0e822ba8802bbea6a57697161ad

Request headers

Referer: https://mail.paxful-claim.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1

Response headers

pragma: no-cache
date: Thu, 29 Apr 2021 11:28:44 GMT
server: openresty
etag: "5ba77f8533ba33f5f52485e493619d8d06c43bd5"
content-type: text/javascript;charset=UTF-8
cache-control: no-cache, no-store, must-revalidate
content-length: 113
expires: 0

GET
H2 200 style_https.1.5.8.css
static.geetest.com/static/wind/ 40 KB
5 KB 119ms
37ms Stylesheet
text/css 2600:9000:20c8:4c00:1:149e:16c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.geetest.com/static/wind/style_https.1.5.8.css
Requested by: Host: mail.paxful-claim.com
URL: https://mail.paxful-claim.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20c8:4c00:1:149e:16c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AliyunOSS /
Resource Hash: 8ba195fffe0097e44a5dd29c35c092f10039e126cc9c4113330e8bf690c2461e

Request headers

Referer: https://mail.paxful-claim.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1

Response headers

date: Thu, 29 Apr 2021 00:57:53 GMT
content-encoding: gzip
x-oss-request-id: 6088B3061692FC3531ECEA9A
content-md5: P7aqz9WuLTiU8vALDV8yNg==
age: 37862
x-cache: Hit from cloudfront
x-oss-object-type: Normal
last-modified: Tue, 24 Mar 2020 07:16:39 GMT
server: AliyunOSS
etag: "3FB6AACFD5AE2D3894F2F00B0D5F3236"
vary: Accept-Encoding
content-type: text/css
via: 1.1 315f537a0be356b37267f2ae21a5363d.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-oss-storage-class: Standard
x-amz-cf-pop: MAD50-C1
x-oss-hash-crc64ecma: 8727683345402674844
x-amz-cf-id: dmhM16um4Qc3YpsL82bGBn6rzAopg0moMeUOfOl5DaletVhD00iJmQ==
x-oss-server-time: 1
expires: Wed, 25 Mar 2020 07:16:37 GMT

GET
H2 200 paxful.png
mail.paxful-claim.com/ 4 KB
4 KB 181ms
180ms Image
image/png 198.187.29.151
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mail.paxful-claim.com/paxful.png
Requested by: Host: mail.paxful-claim.com
URL: https://mail.paxful-claim.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 198.187.29.151 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: server128-4.web-hosting.com
Software: Apache /
Resource Hash: de6b5589779fa82ba1841301f56fe3d3d0d44a3150fd0c9dc9a5fd6197c2a5d5

Request headers

:path: /paxful.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: mail.paxful-claim.com
referer: https://mail.paxful-claim.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://mail.paxful-claim.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1

Response headers

date: Thu, 29 Apr 2021 11:28:44 GMT
last-modified: Fri, 22 Jan 2021 18:57:38 GMT
server: Apache
accept-ranges: bytes
content-length: 3834
content-type: image/png

GET
H2 200 link-snip.png
mail.paxful-claim.com/ 3 KB
3 KB 180ms
180ms Image
image/png 198.187.29.151
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mail.paxful-claim.com/link-snip.png
Requested by: Host: mail.paxful-claim.com
URL: https://mail.paxful-claim.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 198.187.29.151 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: server128-4.web-hosting.com
Software: Apache /
Resource Hash: f47e607a8677ae0e183a44a44a47faeb32898161e272e0e95df34b10c4ab2887

Request headers

:path: /link-snip.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: mail.paxful-claim.com
referer: https://mail.paxful-claim.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://mail.paxful-claim.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1

Response headers

date: Thu, 29 Apr 2021 11:28:44 GMT
last-modified: Wed, 28 Apr 2021 16:09:11 GMT
server: Apache
accept-ranges: bytes
content-length: 2609
content-type: image/png

GET
H2 200 side.png
mail.paxful-claim.com/ 23 KB
23 KB 323ms
322ms Image
image/png 198.187.29.151
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mail.paxful-claim.com/side.png
Requested by: Host: mail.paxful-claim.com
URL: https://mail.paxful-claim.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 198.187.29.151 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: server128-4.web-hosting.com
Software: Apache /
Resource Hash: 247419253374924d63996b9d609528a408ffc8e32ca5fedc93b754a722443ca4

Request headers

:path: /side.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: mail.paxful-claim.com
referer: https://mail.paxful-claim.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://mail.paxful-claim.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1

Response headers

date: Thu, 29 Apr 2021 11:28:44 GMT
last-modified: Fri, 22 Jan 2021 18:57:38 GMT
server: Apache
accept-ranges: bytes
content-length: 23883
content-type: image/png

GET
H2 200 mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v18/ 9 KB
9 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v18/mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Montserrat:400,500,700|Open+Sans:400,600,700&display=swap&subset=cyrillic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://mail.paxful-claim.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1

Response headers

date: Fri, 23 Apr 2021 12:04:26 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:09:28 GMT
server: sffe
age: 516258
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9132
x-xss-protection: 0
expires: Sat, 23 Apr 2022 12:04:26 GMT

GET
H2 200 mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v18/ 9 KB
9 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v18/mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Montserrat:400,500,700|Open+Sans:400,600,700&display=swap&subset=cyrillic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b8e23a845bc6b7fd417d29182e0e38d353e64b5e12e06bb1de2b5ce063db1dcc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://mail.paxful-claim.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1

Response headers

date: Fri, 23 Apr 2021 12:47:13 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:09:49 GMT
server: sffe
age: 513691
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9180
x-xss-protection: 0
expires: Sat, 23 Apr 2022 12:47:13 GMT

GET
H2 200 JTURjIg1_i6t8kCHKm45_dJE3gnD_vx3rCs.woff2
fonts.gstatic.com/s/montserrat/v15/ 13 KB
13 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v15/JTURjIg1_i6t8kCHKm45_dJE3gnD_vx3rCs.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Montserrat:400,500,700|Open+Sans:400,600,700&display=swap&subset=cyrillic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4c6cf0709b8e52572cae1fb57128acd0a5a453c9ce99dc3712a1860ff90c6bf8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://mail.paxful-claim.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1

Response headers

date: Fri, 23 Apr 2021 03:57:01 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:11:15 GMT
server: sffe
age: 545503
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13612
x-xss-protection: 0
expires: Sat, 23 Apr 2022 03:57:01 GMT

GET
H/1.1 200
OK / Show response
api.ipify.org/ 23 B
261 B 474ms
127ms XHR
application/json 54.235.83.248
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://api.ipify.org/?format=json
Requested by: Host: mail.paxful-claim.com
URL: https://mail.paxful-claim.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.235.83.248 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-235-83-248.compute-1.amazonaws.com
Software: Cowboy /
Resource Hash: 4fbe5a59196551ce3b10f83d03ffa61d274a9a07a6b588b1942a005113a0037d

Request headers

Referer: https://mail.paxful-claim.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1

Response headers

Date: Thu, 29 Apr 2021 11:28:45 GMT
Via: 1.1 vegur
Server: Cowboy
Vary: Origin
Content-Type: application/json
Access-Control-Allow-Origin: https://mail.paxful-claim.com
Connection: keep-alive
Content-Length: 23

GET
H2 200 sendLocation.php Show response
mail.paxful-claim.com/ 10 B
175 B 4861ms
4861ms XHR
text/html 198.187.29.151
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://mail.paxful-claim.com/sendLocation.php?ip=91.132.136.236
Requested by: Host: mail.paxful-claim.com
URL: https://mail.paxful-claim.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 198.187.29.151 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: server128-4.web-hosting.com
Software: Apache / PHP/7.2.34
Resource Hash: f3686bb328c6d40820a6b481204c82668862df2e06f10f8195252827ca24c624

Request headers

:path: /sendLocation.php?ip=91.132.136.236
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: mail.paxful-claim.com
referer: https://mail.paxful-claim.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://mail.paxful-claim.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1

Response headers

date: Thu, 29 Apr 2021 11:28:45 GMT
content-encoding: gzip
server: Apache
x-powered-by: PHP/7.2.34
content-length: 30
vary: Accept-Encoding
content-type: text/html; charset=UTF-8

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Paxful (Crypto Exchange)

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://mail.paxful-claim.com/(Line 538) Message: {"ip":"91.132.136.236"}
console-api	log	URL: https://mail.paxful-claim.com/(Line 550) Message: Successful

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.geetest.com
api.ipify.org
fonts.googleapis.com
fonts.gstatic.com
mail.paxful-claim.com
static.geetest.com
198.187.29.151
2600:9000:20c8:4c00:1:149e:16c0:93a1
2a00:1450:4001:801::2003
2a00:1450:4001:803::200a
52.30.83.119
54.235.83.248
0fc0b442a468b0fb3019a5ba5f81ec87c43fe09f16c0513d7fa496a8a9d3db67
247419253374924d63996b9d609528a408ffc8e32ca5fedc93b754a722443ca4
35417626d8c29128917cd1c757e92189edc47b44a06124f54a577560a4d171fd
4c6cf0709b8e52572cae1fb57128acd0a5a453c9ce99dc3712a1860ff90c6bf8
4fbe5a59196551ce3b10f83d03ffa61d274a9a07a6b588b1942a005113a0037d
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
824d7cc2627461b270716c538bd9943cc461384850cc584d99fee6a5d371b160
8ba195fffe0097e44a5dd29c35c092f10039e126cc9c4113330e8bf690c2461e
a8b269205a1d4d42ec1946bcbdcd34223805c0e822ba8802bbea6a57697161ad
b8e23a845bc6b7fd417d29182e0e38d353e64b5e12e06bb1de2b5ce063db1dcc
bfb305d806a9132b3ff10eef199153ab3a827777da305f18978e3a78bf93d995
cf4894dcbad595ca6c89c82773962caa441cdc757170cfca9fd5c883f9fe3ce2
de6b5589779fa82ba1841301f56fe3d3d0d44a3150fd0c9dc9a5fd6197c2a5d5
f3686bb328c6d40820a6b481204c82668862df2e06f10f8195252827ca24c624
f47e607a8677ae0e183a44a44a47faeb32898161e272e0e95df34b10c4ab2887

mail.paxful-claim.com Open in urlscan Pro 198.187.29.151 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

17 Requests

47 %HTTPS

50 %IPv6

5 Domains

6 Subdomains

6 IPs

3 Countries

148 kBTransfer

744 kBSize

0 Cookies

2 Outgoing links

Redirected requests

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

15 JavaScript Global Variables

0 Cookies

2 Console Messages

Indicators

mail.paxful-claim.com Open in urlscan Pro
198.187.29.151 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

17
Requests

47 %
HTTPS

50 %
IPv6

5
Domains

6
Subdomains

6
IPs

3
Countries

148 kB
Transfer

744 kB
Size

0
Cookies

17 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!