drugs-is-drops-shopzilla.trycloudflare.com Open in urlscan Pro
104.17.123.55 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://drugs-is-drops-shopzilla.trycloudflare.com/
Effective URL:
http://drugs-is-drops-shopzilla.trycloudflare.com/login.html.php
Submission: On January 03 via api (January 3rd 2024, 7:48:02 pm UTC) from US — Scanned from IS

Summary HTTP 17 Redirects Links 22 Behaviour Indicators

Summary

This website contacted 8 IPs in 3 countries across 5 domains to perform 17 HTTP transactions. The main IP is 104.17.123.55, located in and belongs to CLOUDFLARENET, US. The main domain is drugs-is-drops-shopzilla.trycloudflare.com.

This is the only time drugs-is-drops-shopzilla.trycloudflare.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Venmo (Financial)

Domain & IP information

	IP Address	AS Autonomous System
5	104.17.123.55 104.17.123.55	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a03:2880:f08... 2a03:2880:f083:9:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
5	52.84.150.58 52.84.150.58	16509 (AMAZON-02) (AMAZON-02)
1	2a04:4e42:200... 2a04:4e42:200::645	54113 (FASTLY) (FASTLY)
1	13.32.121.98 13.32.121.98	16509 (AMAZON-02) (AMAZON-02)
1	2a04:4e42:600... 2a04:4e42:600::645	54113 (FASTLY) (FASTLY)
2	2a04:4e42::645 2a04:4e42::645	54113 (FASTLY) (FASTLY)
17	8

5 104.17.123.55 (None, )

ASN13335 (CLOUDFLARENET, US)

drugs-is-drops-shopzilla.trycloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f083:9:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 52.84.150.58 (United States)

ASN16509 (AMAZON-02, US)

venmo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:200::645 (United States)

ASN54113 (FASTLY, US)

jssdkcdns.mparticle.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.32.121.98 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-121-98.fra60.r.cloudfront.net

cdn.plaid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:600::645 (United States)

ASN54113 (FASTLY, US)

jssdkcdn.mparticle.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a04:4e42::645 (United States)

ASN54113 (FASTLY, US)

identity.mparticle.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	venmo.com venmo.com — Cisco Umbrella Rank: 14555
5	trycloudflare.com drugs-is-drops-shopzilla.trycloudflare.com	96 KB
4	mparticle.com jssdkcdns.mparticle.com — Cisco Umbrella Rank: 8531 jssdkcdn.mparticle.com — Cisco Umbrella Rank: 576523 identity.mparticle.com — Cisco Umbrella Rank: 2904	44 KB
1	plaid.com cdn.plaid.com — Cisco Umbrella Rank: 25631	43 KB
1	facebook.net connect.facebook.net — Cisco Umbrella Rank: 240	87 KB
17	5

	Domain	Requested by
5	venmo.com	drugs-is-drops-shopzilla.trycloudflare.com
5	drugs-is-drops-shopzilla.trycloudflare.com	drugs-is-drops-shopzilla.trycloudflare.com
2	identity.mparticle.com	jssdkcdns.mparticle.com
1	jssdkcdn.mparticle.com	drugs-is-drops-shopzilla.trycloudflare.com
1	cdn.plaid.com	drugs-is-drops-shopzilla.trycloudflare.com
1	jssdkcdns.mparticle.com	drugs-is-drops-shopzilla.trycloudflare.com
1	connect.facebook.net	drugs-is-drops-shopzilla.trycloudflare.com
17	7

This site contains links to these domains. Also see Links.

Domain
venmo.com
account.venmo.com
blog.venmo.com
help.venmo.com
itunes.apple.com
play.google.com

Subject Issuer	Validity	Valid
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-10-13` - `2024-01-11`	3 months	crt.sh
ops.venmo.com DigiCert SHA2 Extended Validation Server CA	`2023-04-21` - `2024-05-21`	a year	crt.sh
jssdkcdns.mparticle.com Go Daddy Secure Certificate Authority - G2	`2023-05-02` - `2024-06-02`	a year	crt.sh
secure.plaid.com DigiCert EV RSA CA G2	`2023-03-09` - `2024-04-08`	a year	crt.sh
identity.mparticle.com Go Daddy Secure Certificate Authority - G2	`2023-05-08` - `2024-06-08`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://drugs-is-drops-shopzilla.trycloudflare.com/login.html.php
Frame ID: 9A2200CD1E59D48727061DF09A185469
Requests: 17 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

VenmoMenu Button

Page URL History Show full URLs

http://drugs-is-drops-shopzilla.trycloudflare.com/ Page URL
http://drugs-is-drops-shopzilla.trycloudflare.com/login.html.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

TrackJs (Analytics) Expand

Overall confidence: 100%
Detected patterns

tracker\.js

Page Statistics

17
Requests

59 %
HTTPS

57 %
IPv6

5
Domains

7
Subdomains

8
IPs

3
Countries

269 kB
Transfer

734 kB
Size

0
Cookies

22 Outgoing links

These are links going to different origins than the main page.

URL: https://venmo.com/

Search URL Search Domain Scan URL

URL: https://venmo.com/about/product
Title: How Venmo Works

Search URL Search Domain Scan URL

URL: https://venmo.com/business
Title: Business

Search URL Search Domain Scan URL

URL: https://venmo.com/card
Title: Debit Card

Search URL Search Domain Scan URL

URL: https://venmo.com/about/security
Title: Security

Search URL Search Domain Scan URL

URL: https://venmo.com/contact-us
Title: Contact Us

Search URL Search Domain Scan URL

URL: https://venmo.com/account/sign-in
Title: Sign In

Search URL Search Domain Scan URL

URL: https://venmo.com/account/password-reset
Title: Forgot Password?

Search URL Search Domain Scan URL

URL: https://account.venmo.com/signup
Title: Sign Up

Search URL Search Domain Scan URL

URL: https://venmo.com/about/fees
Title: Our Fees

Search URL Search Domain Scan URL

URL: https://venmo.com/contact-us/
Title: Contact Us

Search URL Search Domain Scan URL

URL: https://venmo.com/team/
Title: Our Team

Search URL Search Domain Scan URL

URL: https://venmo.com/jobs
Title: Jobs

Search URL Search Domain Scan URL

URL: http://blog.venmo.com/
Title: Blog

Search URL Search Domain Scan URL

URL: https://help.venmo.com/
Title: Help Center

Search URL Search Domain Scan URL

URL: https://venmo.com/developers
Title: Developer

Search URL Search Domain Scan URL

URL: https://venmo.com/legal/us-user-agreement/
Title: Legal

Search URL Search Domain Scan URL

URL: https://venmo.com/legal/us-privacy-policy/
Title: Privacy

Search URL Search Domain Scan URL

URL: https://itunes.apple.com/us/app/venmo/id351727428?mt=8

Search URL Search Domain Scan URL

URL: https://play.google.com/store/apps/details?id=com.venmo

Search URL Search Domain Scan URL

URL: https://venmo.com/legal/us-disclosures/
Title: PayPal, Inc.’s licenses

Search URL Search Domain Scan URL

URL: http://help.venmo.com/
Title: Help

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://drugs-is-drops-shopzilla.trycloudflare.com/ Page URL
http://drugs-is-drops-shopzilla.trycloudflare.com/login.html.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK /
drugs-is-drops-shopzilla.trycloudflare.com/ 60 B
449 B 597ms
491ms Document
text/html 104.17.123.55
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://drugs-is-drops-shopzilla.trycloudflare.com/
Protocol: HTTP/1.1
Server: 104.17.123.55 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.4.33
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language: is-IS,is;q=0.9

Response headers

CF-Cache-Status: DYNAMIC
CF-Ray: 83fdc1a7ccbf5cc9-KEF
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Wed, 03 Jan 2024 19:47:57 GMT
Host: drugs-is-drops-shopzilla.trycloudflare.com
Server: cloudflare
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Powered-By: PHP/7.4.33

GET
H/1.1 200
OK Primary Request login.html.php Show response
drugs-is-drops-shopzilla.trycloudflare.com/ 46 KB
8 KB 285ms
284ms Document
text/html 104.17.123.55
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://drugs-is-drops-shopzilla.trycloudflare.com/login.html.php
Requested by: Host: drugs-is-drops-shopzilla.trycloudflare.com
URL: http://drugs-is-drops-shopzilla.trycloudflare.com/
Protocol: HTTP/1.1
Server: 104.17.123.55 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.4.33
Resource Hash: 478df65ca44a25b3537b630f1da8d8bd98460bf7f89f06fa978b3daddf28508d

Request headers

Referer: http://drugs-is-drops-shopzilla.trycloudflare.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language: is-IS,is;q=0.9

Response headers

CF-Cache-Status: DYNAMIC
CF-Ray: 83fdc1aafef55cc9-KEF
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Wed, 03 Jan 2024 19:47:57 GMT
Host: drugs-is-drops-shopzilla.trycloudflare.com
Server: cloudflare
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Powered-By: PHP/7.4.33

GET
H/1.1 200
OK style.css
drugs-is-drops-shopzilla.trycloudflare.com/ 153 KB
27 KB 269ms
269ms Stylesheet
text/css 104.17.123.55
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://drugs-is-drops-shopzilla.trycloudflare.com/style.css
Requested by: Host: drugs-is-drops-shopzilla.trycloudflare.com
URL: http://drugs-is-drops-shopzilla.trycloudflare.com/login.html.php
Protocol: HTTP/1.1
Server: 104.17.123.55 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 507e7ffabad6024ea1fdc909c6be4c7530ba6a3b53a9f7d147875d9d9d9ef5ee

Request headers

accept-language: is-IS,is;q=0.9
Referer: http://drugs-is-drops-shopzilla.trycloudflare.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Date: Wed, 03 Jan 2024 19:47:57 GMT
Content-Encoding: gzip
CF-Cache-Status: DYNAMIC
Server: cloudflare
Host: drugs-is-drops-shopzilla.trycloudflare.com
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/css; charset=UTF-8
Connection: keep-alive
CF-Ray: 83fdc1accfa15cc9-KEF

GET
H/1.1 200
OK apple-app-store.png
drugs-is-drops-shopzilla.trycloudflare.com/ 42 KB
42 KB 388ms
290ms Image
image/png 104.17.123.55
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://drugs-is-drops-shopzilla.trycloudflare.com/apple-app-store.png
Requested by: Host: drugs-is-drops-shopzilla.trycloudflare.com
URL: http://drugs-is-drops-shopzilla.trycloudflare.com/login.html.php
Protocol: HTTP/1.1
Server: 104.17.123.55 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 622cd21a484947d7e042e5e581b569a88745c099ec42122427ef7be1aff44f0e

Request headers

accept-language: is-IS,is;q=0.9
Referer: http://drugs-is-drops-shopzilla.trycloudflare.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Date: Wed, 03 Jan 2024 19:47:57 GMT
CF-Cache-Status: DYNAMIC
Server: cloudflare
Host: drugs-is-drops-shopzilla.trycloudflare.com
Vary: Accept-Encoding
Content-Type: image/png
Connection: keep-alive
CF-Ray: 83fdc1ad69df5cbe-KEF
Content-Length: 42556

GET
H/1.1 200
OK google-play-badge.png
drugs-is-drops-shopzilla.trycloudflare.com/ 18 KB
18 KB 674ms
575ms Image
image/png 104.17.123.55
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://drugs-is-drops-shopzilla.trycloudflare.com/google-play-badge.png
Requested by: Host: drugs-is-drops-shopzilla.trycloudflare.com
URL: http://drugs-is-drops-shopzilla.trycloudflare.com/login.html.php
Protocol: HTTP/1.1
Server: 104.17.123.55 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 14a7270311e1c00220cb6f4a7358328c11339b7b30a3ddaadcc3626d05a6b058

Request headers

accept-language: is-IS,is;q=0.9
Referer: http://drugs-is-drops-shopzilla.trycloudflare.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Date: Wed, 03 Jan 2024 19:47:58 GMT
CF-Cache-Status: DYNAMIC
Server: cloudflare
Host: drugs-is-drops-shopzilla.trycloudflare.com
Vary: Accept-Encoding
Content-Type: image/png
Connection: keep-alive
CF-Ray: 83fdc1ad6b5d5cc7-KEF
Content-Length: 18215

GET
H2 200 sdk.js Show response
connect.facebook.net/en_US/ 302 KB
87 KB 317ms
105ms Script
application/x-javascript 2a03:2880:f083:9:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js?hash=a6217a1a379e9f93d6e1cfefa3a2b747

Requested by

Host: drugs-is-drops-shopzilla.trycloudflare.com
URL: http://drugs-is-drops-shopzilla.trycloudflare.com/login.html.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f083:9:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

106ac857529a4be9260b44cdb5dfe02dd144a1bdb771b0a0062451e07dfa376a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: http://drugs-is-drops-shopzilla.trycloudflare.com/
Origin: http://drugs-is-drops-shopzilla.trycloudflare.com
accept-language: is-IS,is;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), keyboard-map=(), picture-in-picture=(), xr-spatial-tracking=()
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 03 Jan 2024 19:47:57 GMT
content-md5: cd1NVBFRGqjPInE69cfw+A==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 88316
reporting-endpoints
x-fb-debug: BkSr/rXhsRsBX96pbS68fY+kPFO5ysvInNcIzOjFyQvoYejhvq7pqjaWWkoCpKreFl5RXiOtxZxFl8DGjeBmOQ==
x-fb-content-md5: cc2fb16af900317d7012c2aecb939e1b
cross-origin-opener-policy: same-origin-allow-popups
etag: "195f5a8b1cf008c0287781449f88c234"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
expires: Thu, 02 Jan 2025 19:20:49 GMT

GET
H2 404 link-initialize.js
venmo.com//cdn.plaid.com/link/v2/stable/ 0
0 433ms
218ms Script
text/plain 52.84.150.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://venmo.com//cdn.plaid.com/link/v2/stable/link-initialize.js

Requested by

Host: drugs-is-drops-shopzilla.trycloudflare.com
URL: http://drugs-is-drops-shopzilla.trycloudflare.com/login.html.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.84.150.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx / Express

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: is-IS,is;q=0.9
Referer: http://drugs-is-drops-shopzilla.trycloudflare.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Wed, 03 Jan 2024 19:47:57 GMT
strict-transport-security: max-age=31536000
via: 1.1 6642832e0f3e501fb9fdc5f35d4351d8.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: AMS54-C1
x-powered-by: Express
x-frame-options: SAMEORIGIN
x-cache: Error from cloudfront
cache-control: no-cache
x-envoy-upstream-service-time: 3
content-length: 0
x-amz-cf-id: llpu_SJjs4TecaSYNJztWhFVH-VDwl1te2Rb8tH86eBx5tb7PR6_Ag==

GET
H2 404 tracker.js
venmo.com//d2zah9y47r7bi2.cloudfront.net/releases/current/ 0
0 451ms
236ms Script
text/plain 52.84.150.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://venmo.com//d2zah9y47r7bi2.cloudfront.net/releases/current/tracker.js

Requested by

Host: drugs-is-drops-shopzilla.trycloudflare.com
URL: http://drugs-is-drops-shopzilla.trycloudflare.com/login.html.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.84.150.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx / Express

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: is-IS,is;q=0.9
Referer: http://drugs-is-drops-shopzilla.trycloudflare.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Wed, 03 Jan 2024 19:47:57 GMT
strict-transport-security: max-age=31536000
via: 1.1 6642832e0f3e501fb9fdc5f35d4351d8.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: AMS54-C1
x-powered-by: Express
x-frame-options: SAMEORIGIN
x-cache: Error from cloudfront
cache-control: no-cache
x-envoy-upstream-service-time: 7
content-length: 0
x-amz-cf-id: L8cbN0dRNXZgMMYDraMqvOAtUrZFlCGkHl-6U-n-E_kCdkKMg_OJ7g==

GET
H2 200 mparticle.js Show response
jssdkcdns.mparticle.com/js/v2/40433222e815b743853a4bb6b7a86058/ 172 KB
43 KB 380ms
188ms Script
application/javascript 2a04:4e42:200::645
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://jssdkcdns.mparticle.com/js/v2/40433222e815b743853a4bb6b7a86058/mparticle.js
Requested by: Host: drugs-is-drops-shopzilla.trycloudflare.com
URL: http://drugs-is-drops-shopzilla.trycloudflare.com/login.html.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a04:4e42:200::645 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Kestrel /
Resource Hash: 626eafc2049eb51816280b88e68e2afeffad5ea3f9d6a94da94fc5ca076bd9a7

Request headers

accept-language: is-IS,is;q=0.9
Referer: http://drugs-is-drops-shopzilla.trycloudflare.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-served-by: cache-iad-kjyo7100080-IAD, cache-lcy-eglc8600033-LCY
date: Wed, 03 Jan 2024 19:47:57 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
server: Kestrel
age: 133
x-timer: S1704311278.791599,VS0,VE95
x-origin-name: fastlyshield--shield_ssl_cache_iad_kjyo7100080_IAD
x-cache: HIT, MISS
content-type: application/javascript
vary: Accept, Accept-Encoding
cache-control: public, max-age=3600
accept-ranges: bytes
content-length: 44027
x-cache-hits: 66, 0

GET
H2 404 analytics.js
venmo.com//www.google-analytics.com/ 0
0 434ms
219ms Script
text/plain 52.84.150.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://venmo.com//www.google-analytics.com/analytics.js

Requested by

Host: drugs-is-drops-shopzilla.trycloudflare.com
URL: http://drugs-is-drops-shopzilla.trycloudflare.com/login.html.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.84.150.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx / Express

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: is-IS,is;q=0.9
Referer: http://drugs-is-drops-shopzilla.trycloudflare.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Wed, 03 Jan 2024 19:47:57 GMT
strict-transport-security: max-age=31536000
via: 1.1 6642832e0f3e501fb9fdc5f35d4351d8.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: AMS54-C1
x-powered-by: Express
x-frame-options: SAMEORIGIN
x-cache: Error from cloudfront
cache-control: no-cache
x-envoy-upstream-service-time: 3
content-length: 0
x-amz-cf-id: TUun3MXB0qHS5Eo83MamdgQqYqnzDiN_C4fACJnk3rgR392jWQZ41w==

GET
H2 404 sdk.js
venmo.com//connect.facebook.net/en_US/ 0
0 431ms
217ms Script
text/plain 52.84.150.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://venmo.com//connect.facebook.net/en_US/sdk.js

Requested by

Host: drugs-is-drops-shopzilla.trycloudflare.com
URL: http://drugs-is-drops-shopzilla.trycloudflare.com/login.html.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.84.150.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx / Express

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: is-IS,is;q=0.9
Referer: http://drugs-is-drops-shopzilla.trycloudflare.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Wed, 03 Jan 2024 19:47:57 GMT
strict-transport-security: max-age=31536000
via: 1.1 6642832e0f3e501fb9fdc5f35d4351d8.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: AMS54-C1
x-powered-by: Express
x-frame-options: SAMEORIGIN
x-cache: Error from cloudfront
cache-control: no-cache
x-envoy-upstream-service-time: 3
content-length: 0
x-amz-cf-id: gkmhqunKvK7Qbz68Apb_k6hh0bsHnaZlAdQ2Hnx9oXDUdtOzOMFR6A==

GET auth.da057eaa579ace1ee189.min.js
venmo.com/build/js/ 0
0

GET
H2 200 link-dynamic-loader.js
cdn.plaid.com/link/2.0.1353/ 0
43 KB 331ms
114ms Other
application/javascript 13.32.121.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.plaid.com/link/2.0.1353/link-dynamic-loader.js
Requested by: Host: drugs-is-drops-shopzilla.trycloudflare.com
URL: http://drugs-is-drops-shopzilla.trycloudflare.com/login.html.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.121.98 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-121-98.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: is-IS,is;q=0.9
Referer: http://drugs-is-drops-shopzilla.trycloudflare.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Wed, 03 Jan 2024 18:52:55 GMT
x-amz-version-id: 9qd76G2EPKIhGfk67cc2E5IzSZqUxXlc
content-encoding: gzip
via: 1.1 8c08c39035033b8c904aa0e3f734d6c6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P1
age: 3303
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Fri, 22 Jul 2022 20:54:20 GMT
server: AmazonS3
etag: W/"7738fdfbead18a01d58f6c83c13259f7"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=10800
x-amz-cf-id: YcRFmJ-Y0yQxE8zVwEp1qDIN6lvBDhy2IIPyReKmL7hWkzUcVYYQKg==

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 201846346a7e06da7554b4ecd99f14bdbb011257abf42bc61bdaa8a91f122fff

Request headers

accept-language: is-IS,is;q=0.9
Referer: http://drugs-is-drops-shopzilla.trycloudflare.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 404 analytics.js
venmo.com//www.google-analytics.com/ 0
0 224ms
224ms Script
text/plain 52.84.150.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://venmo.com//www.google-analytics.com/analytics.js

Requested by

Host: drugs-is-drops-shopzilla.trycloudflare.com
URL: http://drugs-is-drops-shopzilla.trycloudflare.com/login.html.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.84.150.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx / Express

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: is-IS,is;q=0.9
Referer: http://drugs-is-drops-shopzilla.trycloudflare.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Wed, 03 Jan 2024 19:47:58 GMT
strict-transport-security: max-age=31536000
via: 1.1 6642832e0f3e501fb9fdc5f35d4351d8.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: AMS54-C1
x-powered-by: Express
x-frame-options: SAMEORIGIN
x-cache: Error from cloudfront
cache-control: no-cache
x-envoy-upstream-service-time: 3
content-length: 0
x-amz-cf-id: WFdNWnYRXJmDNlXaDwn5lCi4xiboKlbVDdxXGSOQG0VeiTRAzfm6zw==

GET
H/1.1 404
Not Found mparticle.js
jssdkcdn.mparticle.com/js/v2/40433222e815b743853a4bb6b7a86058https://venmo.com/ 0
0 200ms
92ms Script
text/plain 2a04:4e42:600::645
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: http://jssdkcdn.mparticle.com/js/v2/40433222e815b743853a4bb6b7a86058https://venmo.com/mparticle.js
Requested by: Host: drugs-is-drops-shopzilla.trycloudflare.com
URL: http://drugs-is-drops-shopzilla.trycloudflare.com/login.html.php
Protocol: HTTP/1.1
Server: 2a04:4e42:600::645 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Kestrel /
Resource Hash

Request headers

accept-language: is-IS,is;q=0.9
Referer: http://drugs-is-drops-shopzilla.trycloudflare.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

X-Served-By: cache-iad-kiad7000109-IAD, cache-lcy-eglc8600047-LCY
Date: Wed, 03 Jan 2024 19:47:58 GMT
Via: 1.1 varnish, 1.1 varnish
Server: Kestrel
Age: 439
X-Timer: S1704311278.171838,VS0,VE1
X-Origin-Name: fastlyshield--shield_ssl_cache_iad_kiad7000109_IAD
X-Cache: MISS, HIT
Content-Type: text/plain
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 527
X-Cache-Hits: 0, 1

OPTIONS
H2 204 identify
identity.mparticle.com/v1/ 0
0 314ms
92ms Preflight 2a04:4e42::645
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://identity.mparticle.com/v1/identify

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::645 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=900

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-mp-key
Access-Control-Request-Method: POST
Origin: http://drugs-is-drops-shopzilla.trycloudflare.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-headers: content-type,x-mp-key
access-control-allow-methods: POST
access-control-allow-origin: *
age: 545
date: Wed, 03 Jan 2024 19:47:58 GMT
server: Kestrel
strict-transport-security: max-age=900
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 541
x-fastly-trace-id: 1921600513
x-origin-name: 4PrgpUXX9K0sNAH1JImfyI--F_us1_origin
x-served-by: cache-lcy-eglc8600044-LCY
x-timer: S1704311278.309692,VS0,VE0

POST
H2 200 identify Show response
identity.mparticle.com/v1/ 176 B
311 B 189ms
189ms XHR
application/json 2a04:4e42::645
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://identity.mparticle.com/v1/identify

Requested by

Host: jssdkcdns.mparticle.com
URL: https://jssdkcdns.mparticle.com/js/v2/40433222e815b743853a4bb6b7a86058/mparticle.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::645 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Kestrel /

Resource Hash

fb4fef502029b3b53ce8df96e74d5598eb3a0b7018ae7d86087fbbdf3bf93229

Security Headers

Name	Value
Strict-Transport-Security	max-age=900

Request headers

x-mp-key: 40433222e815b743853a4bb6b7a86058
Referer: http://drugs-is-drops-shopzilla.trycloudflare.com/
accept-language: is-IS,is;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Content-Type: application/json

Response headers

date: Wed, 03 Jan 2024 19:47:58 GMT
content-encoding: gzip
via: 1.1 varnish
x-mp-max-age: 86400
strict-transport-security: max-age=900
x-origin-name: 4PrgpUXX9K0sNAH1JImfyI--F_us1_origin
x-cache: MISS
x-served-by: cache-lcy-eglc8600044-LCY
server: Kestrel
x-timer: S1704311278.402492,VS0,VE92
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: *
x-fastly-trace-id: 1921601744
accept-ranges: bytes
x-cache-hits: 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: venmo.com
URL: https://venmo.com/build/js/auth.da057eaa579ace1ee189.min.js

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Venmo (Financial)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

8 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	error	URL: http://drugs-is-drops-shopzilla.trycloudflare.com/login.html.php Message: Access to script at 'https://venmo.com/build/js/auth.da057eaa579ace1ee189.min.js' from origin 'http://drugs-is-drops-shopzilla.trycloudflare.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://venmo.com/build/js/auth.da057eaa579ace1ee189.min.js Message: Failed to load resource: net::ERR_FAILED
network	error	URL: https://venmo.com//connect.facebook.net/en_US/sdk.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://venmo.com//cdn.plaid.com/link/v2/stable/link-initialize.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://venmo.com//www.google-analytics.com/analytics.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://venmo.com//d2zah9y47r7bi2.cloudfront.net/releases/current/tracker.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: http://jssdkcdn.mparticle.com/js/v2/40433222e815b743853a4bb6b7a86058https://venmo.com/mparticle.js Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://venmo.com//www.google-analytics.com/analytics.js Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.plaid.com
connect.facebook.net
drugs-is-drops-shopzilla.trycloudflare.com
identity.mparticle.com
jssdkcdn.mparticle.com
jssdkcdns.mparticle.com
venmo.com
venmo.com
104.17.123.55
13.32.121.98
2a03:2880:f083:9:face:b00c:0:3
2a04:4e42:200::645
2a04:4e42:600::645
2a04:4e42::645
52.84.150.58
106ac857529a4be9260b44cdb5dfe02dd144a1bdb771b0a0062451e07dfa376a
14a7270311e1c00220cb6f4a7358328c11339b7b30a3ddaadcc3626d05a6b058
201846346a7e06da7554b4ecd99f14bdbb011257abf42bc61bdaa8a91f122fff
478df65ca44a25b3537b630f1da8d8bd98460bf7f89f06fa978b3daddf28508d
507e7ffabad6024ea1fdc909c6be4c7530ba6a3b53a9f7d147875d9d9d9ef5ee
622cd21a484947d7e042e5e581b569a88745c099ec42122427ef7be1aff44f0e
626eafc2049eb51816280b88e68e2afeffad5ea3f9d6a94da94fc5ca076bd9a7
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
fb4fef502029b3b53ce8df96e74d5598eb3a0b7018ae7d86087fbbdf3bf93229

drugs-is-drops-shopzilla.trycloudflare.com Open in urlscan Pro 104.17.123.55 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

17 Requests

59 %HTTPS

57 %IPv6

5 Domains

7 Subdomains

8 IPs

3 Countries

269 kBTransfer

734 kBSize

0 Cookies

22 Outgoing links

Page URL History

Redirected requests

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

8 JavaScript Global Variables

0 Cookies

8 Console Messages

Indicators

drugs-is-drops-shopzilla.trycloudflare.com Open in urlscan Pro
104.17.123.55 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

17
Requests

59 %
HTTPS

57 %
IPv6

5
Domains

7
Subdomains

8
IPs

3
Countries

269 kB
Transfer

734 kB
Size

0
Cookies

17 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!