secure1-limited-account-paypal.gleeze.com

Summary

This website contacted 2 IPs in 2 countries across 3 domains to perform 6 HTTP transactions. The main IP is 104.131.21.144, located in Clifton, United States and belongs to DIGITALOCEAN-ASN, US. The main domain is secure1-limited-account-paypal.gleeze.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on August 5th 2020. Valid for: 3 months.

This is the only time secure1-limited-account-paypal.gleeze.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: PayPal (Financial)

Domain & IP information

	IP Address	AS Autonomous System
2 2	2606:4700:303... 2606:4700:3033::681b:9efb	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	104.131.21.144 104.131.21.144	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	2a00:1450:400... 2a00:1450:4001:808::2001	15169 (GOOGLE) (GOOGLE)
6	2

2 2606:4700:3033::681b:9efb (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

abre.ai	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 104.131.21.144 (Clifton, United States)

ASN14061 (DIGITALOCEAN-ASN, US)
PTR: vps.xinyuoffice.com

secure1-limited-account-paypal.gleeze.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:808::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

beltornado2020.blogspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	gleeze.com secure1-limited-account-paypal.gleeze.com	115 KB
2	abre.ai 2 redirects abre.ai	807 B
1	blogspot.com beltornado2020.blogspot.com
6	3

	Domain	Requested by
5	secure1-limited-account-paypal.gleeze.com	secure1-limited-account-paypal.gleeze.com
2	abre.ai	2 redirects
1	beltornado2020.blogspot.com	secure1-limited-account-paypal.gleeze.com
6	3

This site contains no links.

Subject Issuer	Validity	Valid
secure1-limited-account-paypal.gleeze.com cPanel, Inc. Certification Authority	`2020-08-05` - `2020-11-03`	3 months	crt.sh
misc-sni.blogspot.com GTS CA 1O1	`2020-07-07` - `2020-09-29`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://secure1-limited-account-paypal.gleeze.com/session/signin?country.x=SE&locale.x=SE_Sweden&client=830fc47f6a5a96482c8e516737890c046725e1cd
Frame ID: 3B74609BF544EF936B8B2559960AA545
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://abre.ai/bpom HTTP 301
https://abre.ai/bpom HTTP 302
https://secure1-limited-account-paypal.gleeze.com/?apsignin Page URL
https://secure1-limited-account-paypal.gleeze.com/session/signin?country.x=SE&locale.x=SE_Sweden&client=830fc47f6a5a96482c8e51... Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

6
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

115 kB
Transfer

114 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://abre.ai/bpom HTTP 301
https://abre.ai/bpom HTTP 302
https://secure1-limited-account-paypal.gleeze.com/?apsignin Page URL
https://secure1-limited-account-paypal.gleeze.com/session/signin?country.x=SE&locale.x=SE_Sweden&client=830fc47f6a5a96482c8e516737890c046725e1cd Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://abre.ai/bpom HTTP 301
https://abre.ai/bpom HTTP 302
https://secure1-limited-account-paypal.gleeze.com/?apsignin

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Cookie set / Show response
secure1-limited-account-paypal.gleeze.com/
Redirect Chain

http://abre.ai/bpom
https://abre.ai/bpom
https://secure1-limited-account-paypal.gleeze.com/?apsignin

157 B
538 B

1059ms
523ms

Document
text/html

104.131.21.144
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://secure1-limited-account-paypal.gleeze.com/?apsignin
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.131.21.144 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: vps.xinyuoffice.com
Software: Apache /
Resource Hash: 83a4e229726972ae770399d9276dfcc93c7b8af8a95c858a911078727ea69e1f

Request headers

Host: secure1-limited-account-paypal.gleeze.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 06 Aug 2020 04:47:53 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Set-Cookie: PHPSESSID=471f25c466edb584773ca3720a186bc8; path=/
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

Redirect headers

status: 302
date: Thu, 06 Aug 2020 04:47:52 GMT
content-type: text/html; charset=utf-8
set-cookie: __cfduid=d975af2f64d5334c7985da1e2c65fcf891596689272; expires=Sat, 05-Sep-20 04:47:52 GMT; path=/; domain=.abre.ai; HttpOnly; SameSite=Lax; Secure _Publicacoes_session=97839a0cfcf5a8695b3e4a71efa25c72; expires=Sun, 20 Sep 2020 04:45:20 -0000
cache-control: no-cache
location: https://secure1-limited-account-paypal.gleeze.com/?apsignin
x-runtime: 8
cf-cache-status: DYNAMIC
cf-request-id: 0463b1e5f50000c2865104c200000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 5be61f4fee7ac286-FRA

GET
H/1.1 200
OK Primary Request signin Show response
secure1-limited-account-paypal.gleeze.com/session/ 9 KB
9 KB 369ms
369ms Document
text/html 104.131.21.144
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://secure1-limited-account-paypal.gleeze.com/session/signin?country.x=SE&locale.x=SE_Sweden&client=830fc47f6a5a96482c8e516737890c046725e1cd

Requested by

Host: secure1-limited-account-paypal.gleeze.com
URL: https://secure1-limited-account-paypal.gleeze.com/?apsignin

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.131.21.144 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

vps.xinyuoffice.com

Software

Apache /

Resource Hash

653cb51ad5652f12e142a84f4a76cee4551f0a7f1d4241ad84fac7d45e2c022f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Host: secure1-limited-account-paypal.gleeze.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: document
Referer: https://secure1-limited-account-paypal.gleeze.com/?apsignin
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: PHPSESSID=471f25c466edb584773ca3720a186bc8
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://secure1-limited-account-paypal.gleeze.com/?apsignin

Response headers

Date: Thu, 06 Aug 2020 04:47:53 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK login.css
secure1-limited-account-paypal.gleeze.com/session/assets/main/styles/ 15 KB
15 KB 165ms
164ms Stylesheet
text/css 104.131.21.144
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://secure1-limited-account-paypal.gleeze.com/session/assets/main/styles/login.css

Requested by

Host: secure1-limited-account-paypal.gleeze.com
URL: https://secure1-limited-account-paypal.gleeze.com/session/signin?country.x=SE&locale.x=SE_Sweden&client=830fc47f6a5a96482c8e516737890c046725e1cd

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.131.21.144 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

vps.xinyuoffice.com

Software

Apache /

Resource Hash

1d033854a897fda22bcc140a4a99c79066d9c4229e30e531ec68620f696334a9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://secure1-limited-account-paypal.gleeze.com/session/signin?country.x=SE&locale.x=SE_Sweden&client=830fc47f6a5a96482c8e516737890c046725e1cd
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 06 Aug 2020 04:47:53 GMT
X-Content-Type-Options: nosniff
Last-Modified: Sat, 22 Feb 2020 03:17:36 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 15396
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK jquery.min.js Show response
secure1-limited-account-paypal.gleeze.com/session/assets/vendors/scripts/ 85 KB
85 KB 338ms
164ms Script
application/javascript 104.131.21.144
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://secure1-limited-account-paypal.gleeze.com/session/assets/vendors/scripts/jquery.min.js

Requested by

Host: secure1-limited-account-paypal.gleeze.com
URL: https://secure1-limited-account-paypal.gleeze.com/session/signin?country.x=SE&locale.x=SE_Sweden&client=830fc47f6a5a96482c8e516737890c046725e1cd

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.131.21.144 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

vps.xinyuoffice.com

Software

Apache /

Resource Hash

d3a518dea876de39f9e5dc1ffcdeb6c661aee25d8a62474386b664ef3bf1b40f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://secure1-limited-account-paypal.gleeze.com/session/signin?country.x=SE&locale.x=SE_Sweden&client=830fc47f6a5a96482c8e516737890c046725e1cd
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 06 Aug 2020 04:47:54 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 28 Aug 2017 15:03:08 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 86661
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK logo-129x32.svg
secure1-limited-account-paypal.gleeze.com/session/assets/main/images/ 5 KB
5 KB 162ms
161ms Image
image/svg+xml 104.131.21.144
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure1-limited-account-paypal.gleeze.com/session/assets/main/images/logo-129x32.svg

Requested by

Host: secure1-limited-account-paypal.gleeze.com
URL: https://secure1-limited-account-paypal.gleeze.com/session/signin?country.x=SE&locale.x=SE_Sweden&client=830fc47f6a5a96482c8e516737890c046725e1cd

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.131.21.144 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

vps.xinyuoffice.com

Software

Apache /

Resource Hash

b3cc50b9e94bbecaaeb1079b64b8ca50616d1732824964c1cc2c5422627a0ec5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://secure1-limited-account-paypal.gleeze.com/session/assets/main/styles/login.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 06 Aug 2020 04:47:54 GMT
X-Content-Type-Options: nosniff
Last-Modified: Sun, 24 Jun 2018 19:20:58 GMT
Server: Apache
Content-Type: image/svg+xml
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=96
Content-Length: 4945
X-XSS-Protection: 1; mode=block

GET
H2 200 /
beltornado2020.blogspot.com/ 0
0 201ms
163ms Image
text/html 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beltornado2020.blogspot.com/
Requested by: Host: secure1-limited-account-paypal.gleeze.com
URL: https://secure1-limited-account-paypal.gleeze.com/session/signin?country.x=SE&locale.x=SE_Sweden&client=830fc47f6a5a96482c8e516737890c046725e1cd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://secure1-limited-account-paypal.gleeze.com/session/assets/main/styles/login.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery function| validatePayForm

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			secure1-limited-account-paypal.gleeze.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 471f25c466edb584773ca3720a186bc8

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

abre.ai
beltornado2020.blogspot.com
secure1-limited-account-paypal.gleeze.com
104.131.21.144
2606:4700:3033::681b:9efb
2a00:1450:4001:808::2001
1d033854a897fda22bcc140a4a99c79066d9c4229e30e531ec68620f696334a9
653cb51ad5652f12e142a84f4a76cee4551f0a7f1d4241ad84fac7d45e2c022f
83a4e229726972ae770399d9276dfcc93c7b8af8a95c858a911078727ea69e1f
b3cc50b9e94bbecaaeb1079b64b8ca50616d1732824964c1cc2c5422627a0ec5
d3a518dea876de39f9e5dc1ffcdeb6c661aee25d8a62474386b664ef3bf1b40f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

secure1-limited-account-paypal.gleeze.com Open in urlscan Pro 104.131.21.144 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

6 Requests

100 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

2 IPs

2 Countries

115 kBTransfer

114 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

1 Cookies

Indicators

secure1-limited-account-paypal.gleeze.com Open in urlscan Pro
104.131.21.144 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

115 kB
Transfer

114 kB
Size

1
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!