drugs-is-drops-shopzilla.trycloudflare.com
Open in
urlscan Pro
104.17.123.55
Malicious Activity!
Public Scan
Effective URL: https://drugs-is-drops-shopzilla.trycloudflare.com/login.html.php
Submission Tags: https://sinking.yachts sinking-yachts phishing Search All
Submission: On January 03 via api from CZ — Scanned from IS
Summary
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on April 28th 2023. Valid for: a year.
This is the only time drugs-is-drops-shopzilla.trycloudflare.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Venmo (Financial)Community Verdicts: Malicious — 1 votes Show Verdicts
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
5 | 104.17.123.55 104.17.123.55 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a03:2880:f08... 2a03:2880:f083:9:face:b00c:0:3 | 32934 (FACEBOOK) (FACEBOOK) | |
6 | 52.84.150.58 52.84.150.58 | 16509 (AMAZON-02) (AMAZON-02) | |
2 | 2a04:4e42:200... 2a04:4e42:200::645 | 54113 (FASTLY) (FASTLY) | |
1 | 65.9.95.41 65.9.95.41 | 16509 (AMAZON-02) (AMAZON-02) | |
2 | 2a04:4e42::645 2a04:4e42::645 | 54113 (FASTLY) (FASTLY) | |
18 | 7 |
ASN32934 (FACEBOOK, US)
connect.facebook.net |
ASN16509 (AMAZON-02, US)
PTR: server-65-9-95-41.prg50.r.cloudfront.net
cdn.plaid.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
venmo.com
venmo.com — Cisco Umbrella Rank: 14555 |
|
5 |
trycloudflare.com
drugs-is-drops-shopzilla.trycloudflare.com |
95 KB |
4 |
mparticle.com
jssdkcdns.mparticle.com — Cisco Umbrella Rank: 8531 identity.mparticle.com — Cisco Umbrella Rank: 2904 |
44 KB |
1 |
plaid.com
cdn.plaid.com — Cisco Umbrella Rank: 25631 |
43 KB |
1 |
facebook.net
connect.facebook.net — Cisco Umbrella Rank: 240 |
86 KB |
18 | 5 |
Domain | Requested by | |
---|---|---|
6 | venmo.com |
drugs-is-drops-shopzilla.trycloudflare.com
|
5 | drugs-is-drops-shopzilla.trycloudflare.com |
drugs-is-drops-shopzilla.trycloudflare.com
|
2 | identity.mparticle.com |
jssdkcdns.mparticle.com
|
2 | jssdkcdns.mparticle.com |
drugs-is-drops-shopzilla.trycloudflare.com
|
1 | cdn.plaid.com |
drugs-is-drops-shopzilla.trycloudflare.com
|
1 | connect.facebook.net |
drugs-is-drops-shopzilla.trycloudflare.com
|
18 | 6 |
This site contains links to these domains. Also see Links.
Domain |
---|
venmo.com |
account.venmo.com |
blog.venmo.com |
help.venmo.com |
itunes.apple.com |
play.google.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-04-28 - 2024-04-27 |
a year | crt.sh |
*.facebook.com DigiCert SHA2 High Assurance Server CA |
2023-10-13 - 2024-01-11 |
3 months | crt.sh |
ops.venmo.com DigiCert SHA2 Extended Validation Server CA |
2023-04-21 - 2024-05-21 |
a year | crt.sh |
jssdkcdns.mparticle.com Go Daddy Secure Certificate Authority - G2 |
2023-05-02 - 2024-06-02 |
a year | crt.sh |
secure.plaid.com DigiCert EV RSA CA G2 |
2023-03-09 - 2024-04-08 |
a year | crt.sh |
identity.mparticle.com Go Daddy Secure Certificate Authority - G2 |
2023-05-08 - 2024-06-08 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://drugs-is-drops-shopzilla.trycloudflare.com/login.html.php
Frame ID: 3629646B4317AA004ECFB78E42212A10
Requests: 18 HTTP requests in this frame
Screenshot
Page Title
VenmoMenu ButtonPage URL History Show full URLs
- https://drugs-is-drops-shopzilla.trycloudflare.com/ Page URL
- https://drugs-is-drops-shopzilla.trycloudflare.com/login.html.php Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- \.php(?:$|\?)
Facebook (Widgets) Expand
Detected patterns
- //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js
Google Analytics (Analytics) Expand
Detected patterns
- google-analytics\.com/(?:ga|urchin|analytics)\.js
TrackJs (Analytics) Expand
Detected patterns
- tracker\.js
Page Statistics
22 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Title: How Venmo Works
Search URL Search Domain Scan URL
Title: Business
Search URL Search Domain Scan URL
Title: Debit Card
Search URL Search Domain Scan URL
Title: Security
Search URL Search Domain Scan URL
Title: Contact Us
Search URL Search Domain Scan URL
Title: Sign In
Search URL Search Domain Scan URL
Title: Forgot Password?
Search URL Search Domain Scan URL
Title: Sign Up
Search URL Search Domain Scan URL
Title: Our Fees
Search URL Search Domain Scan URL
Title: Contact Us
Search URL Search Domain Scan URL
Title: Our Team
Search URL Search Domain Scan URL
Title: Jobs
Search URL Search Domain Scan URL
Title: Blog
Search URL Search Domain Scan URL
Title: Help Center
Search URL Search Domain Scan URL
Title: Developer
Search URL Search Domain Scan URL
Title: Legal
Search URL Search Domain Scan URL
Title: Privacy
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title: PayPal, Inc.’s licenses
Search URL Search Domain Scan URL
Title: Help
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://drugs-is-drops-shopzilla.trycloudflare.com/ Page URL
- https://drugs-is-drops-shopzilla.trycloudflare.com/login.html.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
18 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
drugs-is-drops-shopzilla.trycloudflare.com/ |
60 B 292 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
login.html.php
drugs-is-drops-shopzilla.trycloudflare.com/ |
46 KB 8 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
drugs-is-drops-shopzilla.trycloudflare.com/ |
153 KB 27 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
apple-app-store.png
drugs-is-drops-shopzilla.trycloudflare.com/ |
42 KB 42 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
google-play-badge.png
drugs-is-drops-shopzilla.trycloudflare.com/ |
18 KB 18 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sdk.js
connect.facebook.net/en_US/ |
297 KB 86 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
link-initialize.js
venmo.com//cdn.plaid.com/link/v2/stable/ |
0 0 |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tracker.js
venmo.com//d2zah9y47r7bi2.cloudfront.net/releases/current/ |
0 0 |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mparticle.js
jssdkcdns.mparticle.com/js/v2/40433222e815b743853a4bb6b7a86058/ |
172 KB 43 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
venmo.com//www.google-analytics.com/ |
0 0 |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sdk.js
venmo.com//connect.facebook.net/en_US/ |
0 0 |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
auth.da057eaa579ace1ee189.min.js
venmo.com/build/js/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
link-dynamic-loader.js
cdn.plaid.com/link/2.0.1353/ |
0 43 KB |
Other
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H2 |
identify
identity.mparticle.com/v1/ |
0 0 |
Preflight
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
identify
identity.mparticle.com/v1/ |
175 B 298 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
venmo.com//www.google-analytics.com/ |
0 0 |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mparticle.js
jssdkcdns.mparticle.com/js/v2/40433222e815b743853a4bb6b7a86058https://venmo.com/ |
0 0 |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tracker.js
venmo.com//d2zah9y47r7bi2.cloudfront.net/releases/current/ |
0 0 |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- venmo.com
- URL
- https://venmo.com/build/js/auth.da057eaa579ace1ee189.min.js
Verdicts & Comments Add Verdict or Comment
Malicious
task.url
Submitted on
January 3rd 2024, 7:12:42 pm
UTC —
From Czech Republic
Threats:
Phishing
Scam
Comment: This domain is present in the Sinking Yachts anti-phishing list. More Info: https://sinking.yachts
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Venmo (Financial)9 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture object| mParticle object| FB object| venmo function| fbAsyncInit string| GoogleAnalyticsObject function| ga object| _trackJs function| createPlaidHandler0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
9 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.plaid.com
connect.facebook.net
drugs-is-drops-shopzilla.trycloudflare.com
identity.mparticle.com
jssdkcdns.mparticle.com
venmo.com
venmo.com
104.17.123.55
2a03:2880:f083:9:face:b00c:0:3
2a04:4e42:200::645
2a04:4e42::645
52.84.150.58
65.9.95.41
070c3413dda89c89e01249113bd4dbdfb71fd6dd9ad522b97806ef1ea1491b06
14a7270311e1c00220cb6f4a7358328c11339b7b30a3ddaadcc3626d05a6b058
201846346a7e06da7554b4ecd99f14bdbb011257abf42bc61bdaa8a91f122fff
478df65ca44a25b3537b630f1da8d8bd98460bf7f89f06fa978b3daddf28508d
507e7ffabad6024ea1fdc909c6be4c7530ba6a3b53a9f7d147875d9d9d9ef5ee
622cd21a484947d7e042e5e581b569a88745c099ec42122427ef7be1aff44f0e
626eafc2049eb51816280b88e68e2afeffad5ea3f9d6a94da94fc5ca076bd9a7
8ff6224eeda8bcb444154f744bbb1d73cd1ef40250a1bb1759eb68281fb613f6
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855