paypal-us.osaka - urlscan.io

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 6 HTTP transactions. The main IP is 157.7.142.240, located in Japan and belongs to INTERQ GMO Internet,Inc, JP. The main domain is paypal-us.osaka.
TLS certificate: Issued by R3 on May 29th 2023. Valid for: 3 months.

This is the only time paypal-us.osaka was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: PayPay (Financial)

Domain & IP information

	IP Address		AS Autonomous System
6	157.7.142.240 157.7.142.240		7506 (INTERQ GM...) (INTERQ GMO Internet)
6	2

6 157.7.142.240 (Japan)

ASN7506 (INTERQ GMO Internet,Inc, JP)
PTR: v157-7-142-240.myvps.jp

paypal-us.osaka	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	paypal-us.osaka paypal-us.osaka	424 KB
6	1

	Domain	Requested by
6	paypal-us.osaka	paypal-us.osaka
6	1

This site contains no links.

Subject Issuer	Validity	Valid
paypal-us.osaka R3	`2023-05-29` - `2023-08-27`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://paypal-us.osaka/
Frame ID: CF09D4A4581EF34406E8BFE4376E1CC5
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

React App

Page Statistics

6
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

424 kB
Transfer

425 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response paypal-us.osaka/	3 KB 3 KB	853ms 181ms	Document text/html	157.7.142.240 INTERQ GMO Internet
General Check archive.org Show headers Download Go to Full URL https://paypal-us.osaka/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 157.7.142.240 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP), Reverse DNS v157-7-142-240.myvps.jp Software nginx/1.24.0 / Resource Hash `93527905a6fb6f1df573606cd34f14bcd967489295b38cb5e9df4c281a9e712c` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 accept-language en-US,en;q=0.9 Response headers Accept-Ranges bytes Connection keep-alive Content-Length 3083 Content-Type text/html Date Mon, 29 May 2023 22:29:53 GMT ETag "64745151-c0b" Last-Modified Mon, 29 May 2023 07:16:33 GMT Server nginx/1.24.0
GET H/1.1	200 OK	2.86a5f087.chunk.css paypal-us.osaka/static/css/	2 KB 2 KB	182ms 181ms	Stylesheet text/css	157.7.142.240 INTERQ GMO Internet
General Check archive.org Show headers Download Go to Full URL https://paypal-us.osaka/static/css/2.86a5f087.chunk.css Requested by Host: paypal-us.osaka URL: https://paypal-us.osaka/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 157.7.142.240 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP), Reverse DNS v157-7-142-240.myvps.jp Software nginx/1.24.0 / Resource Hash `65a31a3be0c1eccc2e2c67312e0119ec03d115a523f3654a3cd8d4471f7f7f1e` Request headers accept-language en-US,en;q=0.9 Referer https://paypal-us.osaka/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers Date Mon, 29 May 2023 22:29:53 GMT Last-Modified Mon, 29 May 2023 07:02:45 GMT Server nginx/1.24.0 ETag "64744e15-8bc" Content-Type text/css Connection keep-alive Accept-Ranges bytes Content-Length 2236
GET H/1.1	200 OK	main.6dea0f05.chunk.css paypal-us.osaka/static/css/	362 B 599 B	363ms 180ms	Stylesheet text/css	157.7.142.240 INTERQ GMO Internet
General Check archive.org Show headers Download Go to Full URL https://paypal-us.osaka/static/css/main.6dea0f05.chunk.css Requested by Host: paypal-us.osaka URL: https://paypal-us.osaka/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 157.7.142.240 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP), Reverse DNS v157-7-142-240.myvps.jp Software nginx/1.24.0 / Resource Hash `30df240fbcb2c562b3cdc57ae479575c842bd908977a1b39bcfc903a0bc13a89` Request headers accept-language en-US,en;q=0.9 Referer https://paypal-us.osaka/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers Date Mon, 29 May 2023 22:29:53 GMT Last-Modified Mon, 29 May 2023 07:02:45 GMT Server nginx/1.24.0 ETag "64744e15-16a" Content-Type text/css Connection keep-alive Accept-Ranges bytes Content-Length 362
GET H/1.1	200 OK	2.424afacc.chunk.js Show response paypal-us.osaka/static/js/	389 KB 389 KB	702ms 350ms	Script application/javascript	157.7.142.240 INTERQ GMO Internet
General Check archive.org Show headers Download Go to Full URL https://paypal-us.osaka/static/js/2.424afacc.chunk.js Requested by Host: paypal-us.osaka URL: https://paypal-us.osaka/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 157.7.142.240 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP), Reverse DNS v157-7-142-240.myvps.jp Software nginx/1.24.0 / Resource Hash `13187c6ba86d465012c4ae228e9e065222e5c34805e5f4ce038b32305a4641d0` Request headers accept-language en-US,en;q=0.9 Referer https://paypal-us.osaka/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers Date Mon, 29 May 2023 22:29:53 GMT Last-Modified Mon, 29 May 2023 07:16:33 GMT Server nginx/1.24.0 ETag "64745151-6124c" Content-Type application/javascript Connection keep-alive Accept-Ranges bytes Content-Length 397900
GET H/1.1	200 OK	main.4d133ebf.chunk.js Show response paypal-us.osaka/static/js/	13 KB 13 KB	724ms 361ms	Script application/javascript	157.7.142.240 INTERQ GMO Internet
General Check archive.org Show headers Download Go to Full URL https://paypal-us.osaka/static/js/main.4d133ebf.chunk.js Requested by Host: paypal-us.osaka URL: https://paypal-us.osaka/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 157.7.142.240 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP), Reverse DNS v157-7-142-240.myvps.jp Software nginx/1.24.0 / Resource Hash `68973fac8387c8f7cf566b1b939139d6446521a31ed5a665a8fd0802f087c052` Request headers accept-language en-US,en;q=0.9 Referer https://paypal-us.osaka/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers Date Mon, 29 May 2023 22:29:53 GMT Last-Modified Mon, 29 May 2023 07:16:33 GMT Server nginx/1.24.0 ETag "64745151-325d" Content-Type application/javascript Connection keep-alive Accept-Ranges bytes Content-Length 12893
GET DATA	200 OK	truncated /	3 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `5ae82ced18f26ecb4117409ff2d4bdda73abde9f5a0e20ac42a8fa1ac9b34585` Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers Content-Type image/png
GET H/1.1	200 OK	roboto-latin-400-normal.176f8f5b.woff2 paypal-us.osaka/static/media/	15 KB 16 KB	176ms 176ms	Font font/woff2	157.7.142.240 INTERQ GMO Internet
General Check archive.org Show headers Download Go to Full URL https://paypal-us.osaka/static/media/roboto-latin-400-normal.176f8f5b.woff2 Requested by Host: paypal-us.osaka URL: https://paypal-us.osaka/static/css/2.86a5f087.chunk.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 157.7.142.240 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP), Reverse DNS v157-7-142-240.myvps.jp Software nginx/1.24.0 / Resource Hash `48c3fa6f86c54f1d9bb519220713d4b0a1f8cd1a589a3c03b9fa82e98ecb13e3` Request headers Referer https://paypal-us.osaka/static/css/2.86a5f087.chunk.css Origin https://paypal-us.osaka accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers Date Mon, 29 May 2023 22:29:54 GMT Last-Modified Mon, 29 May 2023 07:02:45 GMT Server nginx/1.24.0 ETag "64744e15-3d78" Content-Type font/woff2 Connection keep-alive Accept-Ranges bytes Content-Length 15736

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPay (Financial)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| webpackJsonppp-app object| regeneratorRuntime number| 2f1acc6c3a606b082e5eef5e54414ffb

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

paypal-us.osaka
157.7.142.240
13187c6ba86d465012c4ae228e9e065222e5c34805e5f4ce038b32305a4641d0
30df240fbcb2c562b3cdc57ae479575c842bd908977a1b39bcfc903a0bc13a89
48c3fa6f86c54f1d9bb519220713d4b0a1f8cd1a589a3c03b9fa82e98ecb13e3
5ae82ced18f26ecb4117409ff2d4bdda73abde9f5a0e20ac42a8fa1ac9b34585
65a31a3be0c1eccc2e2c67312e0119ec03d115a523f3654a3cd8d4471f7f7f1e
68973fac8387c8f7cf566b1b939139d6446521a31ed5a665a8fd0802f087c052
93527905a6fb6f1df573606cd34f14bcd967489295b38cb5e9df4c281a9e712c

paypal-us.osaka Open in urlscan Pro 157.7.142.240 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

6 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

424 kBTransfer

425 kBSize

0 Cookies

0 Outgoing links

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

0 Cookies

Indicators

paypal-us.osaka Open in urlscan Pro
157.7.142.240 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

424 kB
Transfer

425 kB
Size

0
Cookies

6 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!