140.143.191.242 Open in urlscan Pro
140.143.191.242  Malicious Activity! Public Scan

Submitted URL: https://paypul.weizjzg.com/
Effective URL: http://140.143.191.242:1306/
Submission Tags: @phishunt_io
Submission: On October 23 via api from ES

Summary

This website contacted 2 IPs in 2 countries across 1 domains to perform 11 HTTP transactions. The main IP is 140.143.191.242, located in Beijing, China and belongs to CNNIC-TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited, CN. The main domain is 140.143.191.242.
This is the only time 140.143.191.242 was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: PayPal (Financial)

Domain & IP information

IP Address AS Autonomous System
1 8.210.251.47 45102 (CNNIC-ALI...)
10 140.143.191.242 45090 (CNNIC-TEN...)
11 2
Apex Domain
Subdomains
Transfer
1 weizjzg.com
paypul.weizjzg.com
959 B
11 1
Domain Requested by
1 paypul.weizjzg.com
11 1

This site contains links to these domains. Also see Links.

Domain
www.paypal.com
Subject Issuer Validity Valid
paypul.weizjzg.com
Let's Encrypt Authority X3
2020-10-22 -
2021-01-20
3 months crt.sh

This page contains 1 frames:

Primary Page: http://140.143.191.242:1306/
Frame ID: 1372AAEE76DE386EBBD62E9B97C79AE5
Requests: 11 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://paypul.weizjzg.com/ Page URL
  2. http://140.143.191.242:1306/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Overall confidence: 100%
Detected patterns
  • script /([\d.]+)?\/modernizr(?:.([\d.]+))?.*\.js/i

Page Statistics

11
Requests

9 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

2
Countries

124 kB
Transfer

301 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://paypul.weizjzg.com/ Page URL
  2. http://140.143.191.242:1306/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
/
paypul.weizjzg.com/
837 B
959 B
Document
General
Full URL
https://paypul.weizjzg.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
8.210.251.47 Singapore, Singapore, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN),
Reverse DNS
Software
nginx /
Resource Hash
f8f34f81b15482cbc715969e14248f94b3eea171c6cd9b10c8eb14cf6a7edb04

Request headers

:method
GET
:authority
paypul.weizjzg.com
:scheme
https
:path
/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
server
nginx
date
Fri, 23 Oct 2020 04:19:48 GMT
content-type
text/html
content-length
837
last-modified
Sat, 01 Aug 2020 06:34:37 GMT
etag
"5f250cfd-345"
accept-ranges
bytes
Primary Request /
140.143.191.242/
49 KB
15 KB
Document
General
Full URL
http://140.143.191.242:1306/
Requested by
Host: paypul.weizjzg.com
URL: https://paypul.weizjzg.com/
Protocol
HTTP/1.1
Server
140.143.191.242 Beijing, China, ASN45090 (CNNIC-TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited, CN),
Reverse DNS
Software
Microsoft-IIS/8.5 /
Resource Hash
ca00408f792006bfa8bcb096f7847689c2d94d911eef203fc3b725ca172e1a8b

Request headers

Host
140.143.191.242:1306
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
text/html
Content-Encoding
gzip
Last-Modified
Fri, 31 Jul 2020 03:48:16 GMT
Accept-Ranges
bytes
ETag
"cacf606ced66d61:0"
Vary
Accept-Encoding
Server
Microsoft-IIS/8.5
Date
Fri, 23 Oct 2020 04:19:50 GMT
Content-Length
15528
contextualLogin.css
140.143.191.242/style/web/res/aff/186f286f5f6f94ab71c493fbad0ac/css/
93 KB
23 KB
Stylesheet
General
Full URL
http://140.143.191.242:1306/style/web/res/aff/186f286f5f6f94ab71c493fbad0ac/css/contextualLogin.css
Requested by
Host: 140.143.191.242
URL: http://140.143.191.242:1306/
Protocol
HTTP/1.1
Server
140.143.191.242 Beijing, China, ASN45090 (CNNIC-TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited, CN),
Reverse DNS
Software
Microsoft-IIS/8.5 /
Resource Hash
bd618be0778a9eb8ca7fdaf8fcdb578bc6e14da2b096ea3518f904c39d20f4aa

Request headers

Referer
http://140.143.191.242:1306/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Fri, 23 Oct 2020 04:19:50 GMT
Content-Encoding
gzip
Last-Modified
Mon, 13 Apr 2020 14:20:07 GMT
Server
Microsoft-IIS/8.5
ETag
"e7b918a29e11d61:0"
Vary
Accept-Encoding
Content-Type
text/css
Accept-Ranges
bytes
Content-Length
23501
modernizr-2.6.1.js
140.143.191.242/style/web/res/aff/186f286f5f6f94ab71c493fbad0ac/js/lib/
4 KB
2 KB
Script
General
Full URL
http://140.143.191.242:1306/style/web/res/aff/186f286f5f6f94ab71c493fbad0ac/js/lib/modernizr-2.6.1.js
Requested by
Host: 140.143.191.242
URL: http://140.143.191.242:1306/
Protocol
HTTP/1.1
Server
140.143.191.242 Beijing, China, ASN45090 (CNNIC-TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited, CN),
Reverse DNS
Software
Microsoft-IIS/8.5 /
Resource Hash
a6c3bff965978df8093c3a29f7071c21d7439a212af41e7b40ce70d94d6bcc44

Request headers

Referer
http://140.143.191.242:1306/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Fri, 23 Oct 2020 04:19:52 GMT
Content-Encoding
gzip
Last-Modified
Mon, 13 Apr 2020 14:20:06 GMT
Server
Microsoft-IIS/8.5
ETag
"56209aa19e11d61:0"
Vary
Accept-Encoding
Content-Type
application/javascript
Accept-Ranges
bytes
Content-Length
2227
icon-PN-check.png
140.143.191.242/style/images/shared/
2 KB
2 KB
Image
General
Full URL
http://140.143.191.242:1306/style/images/shared/icon-PN-check.png
Requested by
Host: 140.143.191.242
URL: http://140.143.191.242:1306/
Protocol
HTTP/1.1
Server
140.143.191.242 Beijing, China, ASN45090 (CNNIC-TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited, CN),
Reverse DNS
Software
Microsoft-IIS/8.5 /
Resource Hash
4a77d272b8cf508cc4a7e0da5763faa9958e42a5554fdb5d29fc3be51d685653

Request headers

Referer
http://140.143.191.242:1306/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Fri, 23 Oct 2020 04:19:52 GMT
Last-Modified
Mon, 13 Apr 2020 14:20:19 GMT
Server
Microsoft-IIS/8.5
Accept-Ranges
bytes
ETag
"782b2ba99e11d61:0"
Content-Length
2236
Content-Type
image/png
glyph_alert_critical_big-2x.png
140.143.191.242/style/images/shared/
6 KB
6 KB
Image
General
Full URL
http://140.143.191.242:1306/style/images/shared/glyph_alert_critical_big-2x.png
Requested by
Host: 140.143.191.242
URL: http://140.143.191.242:1306/
Protocol
HTTP/1.1
Server
140.143.191.242 Beijing, China, ASN45090 (CNNIC-TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited, CN),
Reverse DNS
Software
Microsoft-IIS/8.5 /
Resource Hash
13e4806e5c517e074ab1ea26fe0f2b7b87eaa3988006f35ed0bd4c89502d0d79

Request headers

Referer
http://140.143.191.242:1306/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Fri, 23 Oct 2020 04:19:52 GMT
Last-Modified
Mon, 13 Apr 2020 14:20:17 GMT
Server
Microsoft-IIS/8.5
Accept-Ranges
bytes
ETag
"93f7cca79e11d61:0"
Content-Length
5828
Content-Type
image/png
fn-sync-telemetry-min.js
140.143.191.242/style/web/res/aff/186f286f5f6f94ab71c493fbad0ac/js/lib/
5 KB
3 KB
Script
General
Full URL
http://140.143.191.242:1306/style/web/res/aff/186f286f5f6f94ab71c493fbad0ac/js/lib/fn-sync-telemetry-min.js
Requested by
Host: 140.143.191.242
URL: http://140.143.191.242:1306/
Protocol
HTTP/1.1
Server
140.143.191.242 Beijing, China, ASN45090 (CNNIC-TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited, CN),
Reverse DNS
Software
Microsoft-IIS/8.5 /
Resource Hash
8b202d5bd55968ce4bfc21c063166eaebe62104275ce7ec362d78b64b2581c95

Request headers

Referer
http://140.143.191.242:1306/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Fri, 23 Oct 2020 04:19:52 GMT
Content-Encoding
gzip
Last-Modified
Mon, 13 Apr 2020 14:20:06 GMT
Server
Microsoft-IIS/8.5
ETag
"44c657a19e11d61:0"
Vary
Accept-Encoding
Content-Type
application/javascript
Accept-Ranges
bytes
Content-Length
2812
pa.js
140.143.191.242/style/pa/js/min/
42 KB
19 KB
Script
General
Full URL
http://140.143.191.242:1306/style/pa/js/min/pa.js
Requested by
Host: 140.143.191.242
URL: http://140.143.191.242:1306/
Protocol
HTTP/1.1
Server
140.143.191.242 Beijing, China, ASN45090 (CNNIC-TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited, CN),
Reverse DNS
Software
Microsoft-IIS/8.5 /
Resource Hash
fc8fe8c5fd11fc4057ea1763b74219ed99915017c50e099dbd07a578135ca244

Request headers

Referer
http://140.143.191.242:1306/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Fri, 23 Oct 2020 04:19:52 GMT
Content-Encoding
gzip
Last-Modified
Mon, 13 Apr 2020 14:20:10 GMT
Server
Microsoft-IIS/8.5
ETag
"1d890a39e11d61:0"
Vary
Accept-Encoding
Content-Type
application/javascript
Accept-Ranges
bytes
Content-Length
19179
jquery-3.4.1.min.js
140.143.191.242/style/js/
86 KB
39 KB
Script
General
Full URL
http://140.143.191.242:1306/style/js/jquery-3.4.1.min.js
Requested by
Host: 140.143.191.242
URL: http://140.143.191.242:1306/
Protocol
HTTP/1.1
Server
140.143.191.242 Beijing, China, ASN45090 (CNNIC-TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited, CN),
Reverse DNS
Software
Microsoft-IIS/8.5 /
Resource Hash
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a

Request headers

Referer
http://140.143.191.242:1306/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Fri, 23 Oct 2020 04:19:52 GMT
Content-Encoding
gzip
Last-Modified
Mon, 13 Apr 2020 14:20:11 GMT
Server
Microsoft-IIS/8.5
ETag
"a5c938a49e11d61:0"
Vary
Accept-Encoding
Content-Type
application/javascript
Accept-Ranges
bytes
Content-Length
39419
icon_loader_med.gif
140.143.191.242/style/webstatic/checkout/hermes/
8 KB
8 KB
Image
General
Full URL
http://140.143.191.242:1306/style/webstatic/checkout/hermes/icon_loader_med.gif
Requested by
Host: 140.143.191.242
URL: http://140.143.191.242:1306/
Protocol
HTTP/1.1
Server
140.143.191.242 Beijing, China, ASN45090 (CNNIC-TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited, CN),
Reverse DNS
Software
Microsoft-IIS/8.5 /
Resource Hash
d1ae7277d8ad6c4ecfb1f2269db1cfd85a04c8e2b97a3c2bf4c65fa622fe9e08

Request headers

Referer
http://140.143.191.242:1306/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Fri, 23 Oct 2020 04:19:52 GMT
Last-Modified
Mon, 13 Apr 2020 14:20:04 GMT
Server
Microsoft-IIS/8.5
Accept-Ranges
bytes
ETag
"5b48a09e11d61:0"
Content-Length
7732
Content-Type
image/gif
paypal-logo-129x32.svg
140.143.191.242/style/images/shared/
5 KB
5 KB
Image
General
Full URL
http://140.143.191.242:1306/style/images/shared/paypal-logo-129x32.svg
Requested by
Host: 140.143.191.242
URL: http://140.143.191.242:1306/style/web/res/aff/186f286f5f6f94ab71c493fbad0ac/css/contextualLogin.css
Protocol
HTTP/1.1
Server
140.143.191.242 Beijing, China, ASN45090 (CNNIC-TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited, CN),
Reverse DNS
Software
Microsoft-IIS/8.5 /
Resource Hash
b3cc50b9e94bbecaaeb1079b64b8ca50616d1732824964c1cc2c5422627a0ec5

Request headers

Referer
http://140.143.191.242:1306/style/web/res/aff/186f286f5f6f94ab71c493fbad0ac/css/contextualLogin.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Fri, 23 Oct 2020 04:19:53 GMT
Last-Modified
Mon, 13 Apr 2020 14:20:26 GMT
Server
Microsoft-IIS/8.5
Accept-Ranges
bytes
ETag
"16136bad9e11d61:0"
Content-Length
4945
Content-Type
image/svg+xml

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| trustedTypes object| html5 object| Modernizr function| isEligibleIntegration object| antiClickjack object| PAYPAL object| fpti string| fptiserverurl function| $ function| jQuery function| footer function| isNumber

0 Cookies