www.paxful-claim.com
Open in
urlscan Pro
142.11.217.96
Malicious Activity!
Public Scan
Submission: On April 29 via automatic, source certstream-suspicious
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on April 28th 2021. Valid for: 3 months.
This is the only time www.paxful-claim.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Paxful (Crypto Exchange)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
9 | 142.11.217.96 142.11.217.96 | 54290 (HOSTWINDS) (HOSTWINDS) | |
1 | 2a00:1450:400... 2a00:1450:4001:802::200a | 15169 (GOOGLE) (GOOGLE) | |
2 | 52.30.83.119 52.30.83.119 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2600:9000:20c... 2600:9000:20c8:7000:1:149e:16c0:93a1 | 16509 (AMAZON-02) (AMAZON-02) | |
3 | 2a00:1450:400... 2a00:1450:4001:829::2003 | 15169 (GOOGLE) (GOOGLE) | |
1 | 54.225.169.203 54.225.169.203 | 14618 (AMAZON-AES) (AMAZON-AES) | |
17 | 6 |
ASN16509 (AMAZON-02, US)
PTR: ec2-52-30-83-119.eu-west-1.compute.amazonaws.com
api.geetest.com |
ASN14618 (AMAZON-AES, US)
PTR: ec2-54-225-169-203.compute-1.amazonaws.com
api.ipify.org |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
paxful-claim.com
www.paxful-claim.com |
96 KB |
3 |
gstatic.com
fonts.gstatic.com |
48 KB |
3 |
geetest.com
api.geetest.com static.geetest.com |
6 KB |
1 |
ipify.org
api.ipify.org |
259 B |
1 |
googleapis.com
fonts.googleapis.com |
961 B |
17 | 5 |
Domain | Requested by | |
---|---|---|
9 | www.paxful-claim.com |
www.paxful-claim.com
|
3 | fonts.gstatic.com |
fonts.googleapis.com
|
2 | api.geetest.com |
www.paxful-claim.com
|
1 | api.ipify.org |
www.paxful-claim.com
|
1 | static.geetest.com |
www.paxful-claim.com
|
1 | fonts.googleapis.com |
www.paxful-claim.com
|
17 | 6 |
This site contains links to these domains. Also see Links.
Domain |
---|
paxful.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
paxful-claim.com cPanel, Inc. Certification Authority |
2021-04-28 - 2021-07-27 |
3 months | crt.sh |
upload.video.google.com GTS CA 1O1 |
2021-03-23 - 2021-06-15 |
3 months | crt.sh |
*.geetest.com GeoTrust TLS DV RSA Mixed SHA256 2020 CA-1 |
2021-01-28 - 2022-01-28 |
a year | crt.sh |
*.gstatic.com GTS CA 1O1 |
2021-03-23 - 2021-06-15 |
3 months | crt.sh |
*.ipify.org Sectigo RSA Domain Validation Secure Server CA |
2021-01-19 - 2022-02-19 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.paxful-claim.com/
Frame ID: FAD1011A8A054289E890ACD19BB7470D
Requests: 17 HTTP requests in this frame
2 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Title: Forgot password?
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
17 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
www.paxful-claim.com/ |
28 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
chunk.css
www.paxful-claim.com/ |
37 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.css
www.paxful-claim.com/ |
566 KB 53 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
12 KB 961 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
c.js
www.paxful-claim.com/v1/c/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gettype.php
api.geetest.com/ |
515 B 784 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fullpage.9.0.2.js
www.paxful-claim.com/https://accounts.paxful.com/static.geetest.comhttps://accounts.paxful.com/static/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
get.php
api.geetest.com/ |
113 B 382 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style_https.1.5.8.css
static.geetest.com/static/wind/ |
40 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
paxful.png
www.paxful-claim.com/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
link-snip.png
www.paxful-claim.com/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
side.png
www.paxful-claim.com/ |
23 KB 24 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mem8YaGs126MiZpBA-UFVZ0b.woff2
fonts.gstatic.com/s/opensans/v18/ |
14 KB 14 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mem5YaGs126MiZpBA-UNirkOUuhp.woff2
fonts.gstatic.com/s/opensans/v18/ |
15 KB 15 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
JTURjIg1_i6t8kCHKm45_dJE3gnD_g.woff2
fonts.gstatic.com/s/montserrat/v15/ |
19 KB 19 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
api.ipify.org/ |
22 B 259 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sendLocation.php
www.paxful-claim.com/ |
10 B 62 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Paxful (Crypto Exchange)15 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated object| paxful string| ip object| ipholder function| sendLocation0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
api.geetest.com
api.ipify.org
fonts.googleapis.com
fonts.gstatic.com
static.geetest.com
www.paxful-claim.com
142.11.217.96
2600:9000:20c8:7000:1:149e:16c0:93a1
2a00:1450:4001:802::200a
2a00:1450:4001:829::2003
52.30.83.119
54.225.169.203
00914bd680188fddee044d3a1df956f7a1a76ca0f730447b7272123c159bb4ff
0fc0b442a468b0fb3019a5ba5f81ec87c43fe09f16c0513d7fa496a8a9d3db67
1491de1b31182d38593bcf660c99bc6018af8e192d91663f67ec9d045a3b5ccc
247419253374924d63996b9d609528a408ffc8e32ca5fedc93b754a722443ca4
4545eb1dec25fe868d19dc292d417d8a9e41c0276d75a4eaf524a9db21aa705a
81187e0d3df15e1c775d2672c992441e890d99dd5700b9718d20b03c8d02b612
824d7cc2627461b270716c538bd9943cc461384850cc584d99fee6a5d371b160
8ba195fffe0097e44a5dd29c35c092f10039e126cc9c4113330e8bf690c2461e
9c50a96c859b9beea47b71740bd14e7f69a4df586d015f47434037f8def53b52
c419f67bf0d7e6a80a54415afed2e62c546bc43f508cea73d574aa230687fcc3
cf4894dcbad595ca6c89c82773962caa441cdc757170cfca9fd5c883f9fe3ce2
d55a682f6a24ed1240c19c178b6b8509bc4d9fac58a670c97784f5fc09166f4f
de6b5589779fa82ba1841301f56fe3d3d0d44a3150fd0c9dc9a5fd6197c2a5d5
f3686bb328c6d40820a6b481204c82668862df2e06f10f8195252827ca24c624
f47e607a8677ae0e183a44a44a47faeb32898161e272e0e95df34b10c4ab2887