service-fr.ddns.net
Open in
urlscan Pro
62.4.16.30
Malicious Activity!
Public Scan
Submission: On December 13 via automatic, source certstream-suspicious
Summary
TLS certificate: Issued by R3 on December 13th 2020. Valid for: 3 months.
This is the only time service-fr.ddns.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: PayPal (Financial)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
11 | 62.4.16.30 62.4.16.30 | 12876 (Online SAS) (Online SAS) | |
15 | 104.108.64.37 104.108.64.37 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
6 | 151.101.129.35 151.101.129.35 | 54113 (FASTLY) (FASTLY) | |
1 2 | 64.4.245.84 64.4.245.84 | 17012 (PAYPAL) (PAYPAL) | |
35 | 5 |
ASN16625 (AKAMAI-AS, US)
PTR: a104-108-64-37.deploy.static.akamaitechnologies.com
www.paypalobjects.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
15 |
paypalobjects.com
www.paypalobjects.com |
183 KB |
11 |
ddns.net
service-fr.ddns.net |
60 KB |
8 |
paypal.com
1 redirects
c.paypal.com b.stats.paypal.com dub.stats.paypal.com t.paypal.com |
23 KB |
0 |
Failed
function sub() { [native code] }. Failed |
|
35 | 4 |
Domain | Requested by | |
---|---|---|
15 | www.paypalobjects.com |
service-fr.ddns.net
www.paypalobjects.com |
11 | service-fr.ddns.net |
service-fr.ddns.net
www.paypalobjects.com |
3 | t.paypal.com |
service-fr.ddns.net
|
3 | c.paypal.com |
service-fr.ddns.net
c.paypal.com |
1 | dub.stats.paypal.com |
service-fr.ddns.net
|
1 | b.stats.paypal.com | 1 redirects |
0 | 192.55.233.1 Failed |
www.paypalobjects.com
|
35 | 7 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
service-fr.ddns.net R3 |
2020-12-13 - 2021-03-13 |
3 months | crt.sh |
www.paypal.com DigiCert SHA2 Extended Validation Server CA |
2020-01-09 - 2022-01-12 |
2 years | crt.sh |
c.paypal.com DigiCert SHA2 Extended Validation Server CA |
2020-06-24 - 2022-06-29 |
2 years | crt.sh |
b.stats.paypal.com DigiCert SHA2 High Assurance Server CA |
2020-03-13 - 2022-06-03 |
2 years | crt.sh |
t.paypal.com DigiCert SHA2 High Assurance Server CA |
2020-07-15 - 2022-07-20 |
2 years | crt.sh |
This page contains 5 frames:
Primary Page:
https://service-fr.ddns.net/
Frame ID: 079F1A31674D7DF824DD316854417957
Requests: 30 HTTP requests in this frame
Frame:
https://www.paypalobjects.com/web/res/dc9/99e63da7c23f04e84d0e82bce06b5/recaptcha/grcenterprise_v3.html
Frame ID: 01EE05500472F47A7BE295AC59B8BD71
Requests: 1 HTTP requests in this frame
Frame:
https://c.paypal.com/v1/r/d/i?js_src=https://c.paypal.com/da/r/fb.js
Frame ID: BAA8AC86382FC35032E9D48887118C96
Requests: 1 HTTP requests in this frame
Frame:
https://dub.stats.paypal.com/v1/counter2.cgi?r=cD01N2ZmMzViZTI3ZTk0YzAzYTU2MTk2NmZlMGIwOWVhOCZpPTgyLjEyNS4xOTAuMTEzJnQ9MTYwMTMxMzMzNi4xNTgmYT0yMSZzPVVOSUZJRURfTE9HSU5DNyzRSOryJgzaHRHwV2ffoIxKQg
Frame ID: 7ADA898E12BD32F432714372BE76AECB
Requests: 1 HTTP requests in this frame
Frame:
https://c.paypal.com/v1/r/d/i?js_src=https://c.paypal.com/da/r/fb.js
Frame ID: BDE2787D9F46334128B9A5851FFF576B
Requests: 1 HTTP requests in this frame
Screenshot
Detected technologies
UNIX (Operating Systems) ExpandDetected patterns
- headers server /Unix/i
OpenSSL (Web Server Extensions) Expand
Detected patterns
- headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i
Apache (Web Servers) Expand
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Modernizr (JavaScript Libraries) Expand
Detected patterns
- script /([\d.]+)?\/modernizr(?:.([\d.]+))?.*\.js/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 19- https://b.stats.paypal.com/v1/counter.cgi?r=cD01N2ZmMzViZTI3ZTk0YzAzYTU2MTk2NmZlMGIwOWVhOCZpPTgyLjEyNS4xOTAuMTEzJnQ9MTYwMTMxMzMzNi4xNTgmYT0yMSZzPVVOSUZJRURfTE9HSU5DNyzRSOryJgzaHRHwV2ffoIxKQg HTTP 302
- https://dub.stats.paypal.com/v1/counter2.cgi?r=cD01N2ZmMzViZTI3ZTk0YzAzYTU2MTk2NmZlMGIwOWVhOCZpPTgyLjEyNS4xOTAuMTEzJnQ9MTYwMTMxMzMzNi4xNTgmYT0yMSZzPVVOSUZJRURfTE9HSU5DNyzRSOryJgzaHRHwV2ffoIxKQg
35 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
service-fr.ddns.net/ |
56 KB 56 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gtag.js
www.paypalobjects.com/pa/mi/3p/gtag/ |
79 KB 31 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
miconfig.js
www.paypalobjects.com/pa/mi/ |
103 KB 19 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ngrlCaptcha.min.js
www.paypalobjects.com/webcaptcha/ |
21 KB 6 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
contextualLogin.css
www.paypalobjects.com/web/res/5f5/b4ec26b0ca824570d328ca6cdc49e/css/ |
98 KB 17 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
modernizr-2.6.1.js
www.paypalobjects.com/web/res/5f5/b4ec26b0ca824570d328ca6cdc49e/js/lib/ |
4 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icon-PN-check.png
www.paypalobjects.com/images/shared/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
glyph_alert_critical_big-2x.png
www.paypalobjects.com/images/shared/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fn-sync-telemetry-min.js
www.paypalobjects.com/web/res/5f5/b4ec26b0ca824570d328ca6cdc49e/js/lib/ |
5 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
signin-split.js
www.paypalobjects.com/web/res/5f5/b4ec26b0ca824570d328ca6cdc49e/js/ |
130 KB 33 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ioc.js
www.paypalobjects.com/web/res/5f5/b4ec26b0ca824570d328ca6cdc49e/js/ |
5 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pa.js
www.paypalobjects.com/pa/js/min/ |
49 KB 19 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
recaptchav3.js
service-fr.ddns.net/auth/createchallenge/1716bbc2409654d1/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
patleaf.js
www.paypalobjects.com/pa/3pjs/tl/5.6.1/ |
122 KB 42 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
patlcfg.js
www.paypalobjects.com/pa/3pjs/tl/5.6.1/ |
9 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fb.js
c.paypal.com/da/r/ |
60 KB 21 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
paypal-logo-129x32.svg
www.paypalobjects.com/images/shared/ |
5 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
recaptchav3.js
service-fr.ddns.net/auth/createchallenge/1716bbc2409654d1/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
grcenterprise_v3.html
www.paypalobjects.com/web/res/dc9/99e63da7c23f04e84d0e82bce06b5/recaptcha/ Frame 01EE |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
i
c.paypal.com/v1/r/d/ Frame BAA8 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
counter2.cgi
dub.stats.paypal.com/v1/ Frame 7ADA Redirect Chain
|
42 B 299 B |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
i
c.paypal.com/v1/r/d/ Frame BDE2 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ts
t.paypal.com/ |
42 B 660 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
tealeaftarget
service-fr.ddns.net/platform/ |
220 B 454 B |
Fetch
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS |
resourceaccesstoken
192.55.233.1/ Frame |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
client-log
service-fr.ddns.net/signin/ |
215 B 449 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
challenge.js
service-fr.ddns.net/auth/createchallenge/732ba6bcfa3f0d0e/ |
248 B 482 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
client-log
service-fr.ddns.net/signin/ |
215 B 449 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST |
resourceaccesstoken
192.55.233.1/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cookie-banner
service-fr.ddns.net/signin/ |
218 B 453 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
load-resource
service-fr.ddns.net/signin/ |
218 B 453 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ts
t.paypal.com/ |
42 B 409 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
load-resource
service-fr.ddns.net/signin/ |
218 B 452 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
load-resource
service-fr.ddns.net/signin/ |
218 B 452 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ts
t.paypal.com/ |
42 B 135 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- 192.55.233.1
- URL
- https://192.55.233.1/resourceaccesstoken
- Domain
- 192.55.233.1
- URL
- https://192.55.233.1/resourceaccesstoken
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: PayPal (Financial)42 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated object| google_tag_manager object| gDataLayer object| miconfig boolean| paypalADSInterceptorInjected object| html5 object| Modernizr function| isEligibleIntegration object| antiClickjack object| PAYPAL function| $ function| _classCallCheck function| _typeof function| _createClass number| HTTPOK string| HTTPGET string| HTTPPOST number| DEFAULT_XHR_TIMEOUT object| fpti string| fptiserverurl object| _ifpti object| pako object| TLT object| _0x162a function| _0x4fea object| d function| cfedcbfecdabd object| err2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.paypal.com/ | Name: ts_c Value: vr%3D1c3f342b32095a89%26vt%3D3fe8df102cf75ba1 |
|
.paypal.com/ | Name: ts Value: vreXpYrS%3D1702496816%26vteXpYrS%3D1607890616%26vr%3D1c3f342b32095a89%26vt%3D3fe8df102cf75ba1 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
192.55.233.1
b.stats.paypal.com
c.paypal.com
dub.stats.paypal.com
service-fr.ddns.net
t.paypal.com
www.paypalobjects.com
192.55.233.1
104.108.64.37
151.101.129.35
62.4.16.30
64.4.245.84
04748dd9a27ac47177d01a763fd68b4ca09f5b9acb4208149f2de40251d07dd2
07d4a44d248156a0e3d0c604d7359e54f3b021eeec70b7c3a1d127a141f76d97
15d132c781e7cb067695ae6dfb7ded7180ec3e0844f9c08a12a6a40488855ab3
219fe3382fabdbb0444747aa0073d75f3815cc9aba97bed4fe3ceca97afc38e8
269a602a214b0b1875f935f40204262970655e6eecc15dc383953995f34412a4
3985213ce89eec8dda7f1a9839c529647c2a8e04f8993e413ac1e44d74c25808
45a259dc75957bb09f8b2566183c0a59419c22860f29ea37df1dddde193ae34d
47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292
5396af5006928832517239a2145e9de4bfde558161bd68be9a4b57ea5f37acf5
61ce0ee4efd0b82c90eb9c78bc3c93cf9e6703ce670237bedd1f88a6af82e004
655790946659ad22d9cf3a6a53adaaeebde362fe3cd46701069299d87ae804ef
6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93
8a9922f726f64074cf4c1808503e514ff7b3e84ef82126a7529735c1866ca48f
8b202d5bd55968ce4bfc21c063166eaebe62104275ce7ec362d78b64b2581c95
a6c3bff965978df8093c3a29f7071c21d7439a212af41e7b40ce70d94d6bcc44
a75a144e003852f84285466c1d970143c2c41146ba400ba8a78fb194f636a62c
b3cc50b9e94bbecaaeb1079b64b8ca50616d1732824964c1cc2c5422627a0ec5
c6482fe77ac7dc6fc145cc367d9380b3e9ffb592ed39ca6fc560182c33612688
d2847bea03b68a100caf41aca4d972b58368b4ee956ab13dde15963d905d7c24
d6b01f43069b936092602327e968d2f39d3e364ab1e445023503979b5796067f
de538cc3b9c8787618a2229d9943a3f7b85414ae7111d5bbf70bebc20a06732e
f982a9dad50b916735a08b8e6f40efa7f97163106b18da079b144764c86a44a1
fa6420b8c711471486b7f2f3914afb6013ff8ade025edd5f952736e0b6349798