URL: https://paypal.vrfy-xx.com/lntm5owm=/
Submission: On March 15 via automatic , source openphish

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 9 HTTP transactions.
The main IP is 2606:4700:30::681c:137, located in United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is paypal.vrfy-xx.com.
The TLS certificate was issued by CloudFlare Inc ECC CA-2 on March 10th 2019 with a validity of a year.
This is the first time this domain was scanned on urlscan.io!
Potentially malicious content or behaviour on this page! Show Details
Phishing detected — Impersonating PayPal (Financial)

Domain & IP information

IP Address AS Autonomous System
9 2606:4700:30:... 13335 (CLOUDFLAR...)
9 1
Domain
Subdomains
Transfer
9 vrfy-xx.com
194 KB
9 1
Domain Requested by
9 paypal.vrfy-xx.com paypal.vrfy-xx.com
9 1

This site contains links to these domains. Also see Links.

Domain
Subject / Issuer Validity Valid
sni.cloudflaressl.com
CloudFlare Inc ECC CA-2
2019-03-10 -
2020-03-10
a year

Screenshot


Detected technologies

Web
Overall confidence: 100%
Detected patterns
  • script /jquery.*\.js/i
  • env /^jQuery$/i

Web
Overall confidence: 100%
Detected patterns
  • headers server /cloudflare/i

Web
Overall confidence: 100%
Detected patterns
  • env /^PAYPAL$/i


Stats

0
Requests

0
Ad-blocked

0
Malicious

0 %
HTTPS

0 %
IPv6

0
Domains

0
Subdomains

0
IPs

0
Countries

0 kB
Transfer

0 kB
Size

0
Cookies

9 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
/
/lntm5owm=
5 KB
4 KB
Document
General
Full URL
https://paypal.vrfy-xx.com/lntm5owm=/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681c:137 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / PHP/7.2.13
Resource Hash
e316edfbeaf49df100305c6ceaa79dc2ca3e127760da2ee606d8a0a39bb5a4e4

Request headers

:method
GET
:authority
paypal.vrfy-xx.com
:scheme
https
:path
/lntm5owm=/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status
200
date
Fri, 15 Mar 2019 03:10:43 GMT
content-type
text/html; charset=UTF-8
set-cookie
__cfduid=dad1dea7bed909feabbfff3a9c43c5dbf1552619443; expires=Sat, 14-Mar-20 03:10:43 GMT; path=/; domain=.vrfy-xx.com; HttpOnly; Secure PHPSESSID=278954b25c8449a801d8c6837febe9e9; path=/
x-powered-by
PHP/7.2.13
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate
pragma
no-cache
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
4b7b4bc2f8d9275c-FRA
content-encoding
br
inc.js
/lntm5owm=/myaccount/includes
8 KB
3 KB
Script
General
Full URL
https://paypal.vrfy-xx.com/lntm5owm=/myaccount/includes/inc.js
Requested by
Host: paypal.vrfy-xx.com
URL: https://paypal.vrfy-xx.com/lntm5owm=/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681c:137 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
6369118b817a8a0549092cce8b77d77ac7ec88cc76a66d3ed9e32e9c4f6fb23f

Request headers

:path
/lntm5owm=/myaccount/includes/inc.js
pragma
no-cache
cookie
__cfduid=dad1dea7bed909feabbfff3a9c43c5dbf1552619443; PHPSESSID=278954b25c8449a801d8c6837febe9e9
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
paypal.vrfy-xx.com
referer
https://paypal.vrfy-xx.com/lntm5owm=/
:scheme
https
:method
GET
Referer
https://paypal.vrfy-xx.com/lntm5owm=/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Fri, 15 Mar 2019 03:10:43 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 14 Mar 2019 09:43:36 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=14400
cf-ray
4b7b4bc3f921275c-FRA
expires
Fri, 15 Mar 2019 07:10:43 GMT
style.css
/conf/assests/css
85 KB
13 KB
Stylesheet
General
Full URL
https://paypal.vrfy-xx.com/conf/assests/css/style.css
Requested by
Host: paypal.vrfy-xx.com
URL: https://paypal.vrfy-xx.com/lntm5owm=/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681c:137 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
7348d3ece231f8b49d5db7ce97f0ac83493bf33b3398da3b6d279e6d32b5e856

Request headers

:path
/conf/assests/css/style.css
pragma
no-cache
cookie
__cfduid=dad1dea7bed909feabbfff3a9c43c5dbf1552619443; PHPSESSID=278954b25c8449a801d8c6837febe9e9
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/css,*/*;q=0.1
cache-control
no-cache
:authority
paypal.vrfy-xx.com
referer
https://paypal.vrfy-xx.com/lntm5owm=/
:scheme
https
:method
GET
Referer
https://paypal.vrfy-xx.com/lntm5owm=/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Fri, 15 Mar 2019 03:10:43 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sun, 10 Mar 2019 20:36:27 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
public, max-age=14400
cf-ray
4b7b4bc4593d275c-FRA
expires
Fri, 15 Mar 2019 07:10:43 GMT
main-script.js
/conf/assests/js
43 KB
11 KB
Script
General
Full URL
https://paypal.vrfy-xx.com/conf/assests/js/main-script.js
Requested by
Host: paypal.vrfy-xx.com
URL: https://paypal.vrfy-xx.com/lntm5owm=/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681c:137 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
f2bfaf95a4a54d888244f7e05060cb026a3cb0c156a9a64576ff760fd567615f

Request headers

:path
/conf/assests/js/main-script.js
pragma
no-cache
cookie
__cfduid=dad1dea7bed909feabbfff3a9c43c5dbf1552619443; PHPSESSID=278954b25c8449a801d8c6837febe9e9
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
paypal.vrfy-xx.com
referer
https://paypal.vrfy-xx.com/lntm5owm=/
:scheme
https
:method
GET
Referer
https://paypal.vrfy-xx.com/lntm5owm=/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Fri, 15 Mar 2019 03:10:43 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sun, 10 Mar 2019 20:36:27 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=14400
cf-ray
4b7b4bc4593e275c-FRA
expires
Fri, 15 Mar 2019 07:10:43 GMT
jquery.additional-methods.js
/conf/assests/js
22 KB
5 KB
Script
General
Full URL
https://paypal.vrfy-xx.com/conf/assests/js/jquery.additional-methods.js
Requested by
Host: paypal.vrfy-xx.com
URL: https://paypal.vrfy-xx.com/lntm5owm=/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681c:137 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
72d04d4e4fec062d1c4ef989026f021267b61ffa1d0350855a7007e81f49bba6

Request headers

:path
/conf/assests/js/jquery.additional-methods.js
pragma
no-cache
cookie
__cfduid=dad1dea7bed909feabbfff3a9c43c5dbf1552619443; PHPSESSID=278954b25c8449a801d8c6837febe9e9
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
paypal.vrfy-xx.com
referer
https://paypal.vrfy-xx.com/lntm5owm=/
:scheme
https
:method
GET
Referer
https://paypal.vrfy-xx.com/lntm5owm=/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Fri, 15 Mar 2019 03:10:43 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sun, 10 Mar 2019 20:36:27 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=14400
cf-ray
4b7b4bc45940275c-FRA
expires
Fri, 15 Mar 2019 07:10:43 GMT
jquery.js
/conf/assests/js
286 KB
79 KB
Script
General
Full URL
https://paypal.vrfy-xx.com/conf/assests/js/jquery.js
Requested by
Host: paypal.vrfy-xx.com
URL: https://paypal.vrfy-xx.com/lntm5owm=/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681c:137 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
692d421d5c163409a5918e802f507abbaa6bec90baa454c5252977a5b3b7ff0d

Request headers

:path
/conf/assests/js/jquery.js
pragma
no-cache
cookie
__cfduid=dad1dea7bed909feabbfff3a9c43c5dbf1552619443; PHPSESSID=278954b25c8449a801d8c6837febe9e9
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
paypal.vrfy-xx.com
referer
https://paypal.vrfy-xx.com/lntm5owm=/
:scheme
https
:method
GET
Referer
https://paypal.vrfy-xx.com/lntm5owm=/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Fri, 15 Mar 2019 03:10:43 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sun, 10 Mar 2019 20:36:27 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=14400
cf-ray
4b7b4bc45941275c-FRA
expires
Fri, 15 Mar 2019 07:10:43 GMT
jquery.validate.min.js
/conf/assests/js
49 KB
13 KB
Script
General
Full URL
https://paypal.vrfy-xx.com/conf/assests/js/jquery.validate.min.js
Requested by
Host: paypal.vrfy-xx.com
URL: https://paypal.vrfy-xx.com/lntm5owm=/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681c:137 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ca1415a994b05655d3a8fb4bbae4e38cfe62cfb17ecc559d1915f60bf39deb92

Request headers

:path
/conf/assests/js/jquery.validate.min.js
pragma
no-cache
cookie
__cfduid=dad1dea7bed909feabbfff3a9c43c5dbf1552619443; PHPSESSID=278954b25c8449a801d8c6837febe9e9
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
paypal.vrfy-xx.com
referer
https://paypal.vrfy-xx.com/lntm5owm=/
:scheme
https
:method
GET
Referer
https://paypal.vrfy-xx.com/lntm5owm=/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Fri, 15 Mar 2019 03:10:43 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sun, 10 Mar 2019 20:36:27 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=14400
cf-ray
4b7b4bc45942275c-FRA
expires
Fri, 15 Mar 2019 07:10:43 GMT
logo.svg
/conf/assests/img
5 KB
2 KB
Image
General
Full URL
https://paypal.vrfy-xx.com/conf/assests/img/logo.svg
Requested by
Host: paypal.vrfy-xx.com
URL: https://paypal.vrfy-xx.com/lntm5owm=/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681c:137 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b3cc50b9e94bbecaaeb1079b64b8ca50616d1732824964c1cc2c5422627a0ec5

Request headers

:path
/conf/assests/img/logo.svg
pragma
no-cache
cookie
__cfduid=dad1dea7bed909feabbfff3a9c43c5dbf1552619443; PHPSESSID=278954b25c8449a801d8c6837febe9e9
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
paypal.vrfy-xx.com
referer
https://paypal.vrfy-xx.com/lntm5owm=/
:scheme
https
:method
GET
Referer
https://paypal.vrfy-xx.com/lntm5owm=/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Fri, 15 Mar 2019 03:10:43 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sun, 10 Mar 2019 20:36:27 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
status
200
cache-control
public, max-age=14400
cf-ray
4b7b4bc45943275c-FRA
expires
Fri, 15 Mar 2019 07:10:43 GMT
style.css
/conf/assests/css
64 KB
64 KB
Image
General
Full URL
https://paypal.vrfy-xx.com/conf/assests/css/style.css
Requested by
Host: paypal.vrfy-xx.com
URL: https://paypal.vrfy-xx.com/conf/assests/js/jquery.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681c:137 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path
/conf/assests/css/style.css
pragma
no-cache
cookie
__cfduid=dad1dea7bed909feabbfff3a9c43c5dbf1552619443; PHPSESSID=278954b25c8449a801d8c6837febe9e9
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
paypal.vrfy-xx.com
referer
https://paypal.vrfy-xx.com/conf/assests/css/style.css
:scheme
https
:method
GET
Referer
https://paypal.vrfy-xx.com/conf/assests/css/style.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Fri, 15 Mar 2019 03:10:43 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sun, 10 Mar 2019 20:36:27 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
public, max-age=14400
cf-ray
4b7b4bc4e962275c-FRA
expires
Fri, 15 Mar 2019 07:10:43 GMT

Redirect requests

There were HTTP redirects (301, 302) for the following requests:

Malicious behaviour and content

Google Safe Browsing

There was 1 malicious URLs contacted according to Google Safe Browsing! See report

SOCIAL_ENGINEERING https://paypal.vrfy-xx.com/conf/assests/css/style.css

Openphish submission Was submitted from known phishing list

Type: url
Value: https://paypal.vrfy-xx.com/lntm5owm=/ (Main page)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask object| Aes object| Base64 object| Utf8 string| gentot string| udud string| keluaran string| ctrTxt object| PAYPAL function| $ function| jQuery

2 Cookies

Domain/Path Name / Value
paypal.vrfy-xx.com/ Name: PHPSESSID
Value: 278954b25c8449a801d8c6837febe9e9
.vrfy-xx.com/ Name: __cfduid
Value: dad1dea7bed909feabbfff3a9c43c5dbf1552619443