createanewdecksa-login.cf
Open in
urlscan Pro
13.238.107.0
Malicious Activity!
Public Scan
Submission Tags: phishing malicious Search All
Submission: On September 28 via api from US
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on August 20th 2020. Valid for: 3 months.
This is the only time createanewdecksa-login.cf was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: PayPal (Financial)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
7 | 13.238.107.0 13.238.107.0 | 16509 (AMAZON-02) (AMAZON-02) | |
9 | 104.111.228.123 104.111.228.123 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
1 5 | 151.101.129.21 151.101.129.21 | 54113 (FASTLY) (FASTLY) | |
2 | 104.108.36.64 104.108.36.64 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
1 2 | 64.4.245.84 64.4.245.84 | 17012 (PAYPAL) (PAYPAL) | |
1 | 104.108.34.200 104.108.34.200 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
24 | 6 |
ASN16509 (AMAZON-02, US)
PTR: awcp013.server-cpanel.com
createanewdecksa-login.cf |
ASN16625 (AKAMAI-AS, US)
PTR: a104-111-228-123.deploy.static.akamaitechnologies.com
www.paypalobjects.com |
ASN16625 (AKAMAI-AS, US)
PTR: a104-108-36-64.deploy.static.akamaitechnologies.com
c.paypal.com |
ASN16625 (AKAMAI-AS, US)
PTR: a104-108-34-200.deploy.static.akamaitechnologies.com
t.paypal.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
paypal.com
2 redirects
www.paypal.com c.paypal.com b.stats.paypal.com dub.stats.paypal.com t.paypal.com |
24 KB |
9 |
paypalobjects.com
www.paypalobjects.com |
83 KB |
7 |
createanewdecksa-login.cf
createanewdecksa-login.cf |
29 KB |
24 | 3 |
Domain | Requested by | |
---|---|---|
9 | www.paypalobjects.com |
createanewdecksa-login.cf
www.paypalobjects.com |
7 | createanewdecksa-login.cf |
www.paypalobjects.com
|
5 | www.paypal.com |
1 redirects
createanewdecksa-login.cf
|
2 | c.paypal.com |
www.paypalobjects.com
c.paypal.com |
1 | t.paypal.com | |
1 | dub.stats.paypal.com | |
1 | b.stats.paypal.com | 1 redirects |
24 | 7 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.paypal.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
createanewdecksa-login.cf cPanel, Inc. Certification Authority |
2020-08-20 - 2020-11-18 |
3 months | crt.sh |
www.paypal.com DigiCert SHA2 Extended Validation Server CA |
2020-01-09 - 2022-01-12 |
2 years | crt.sh |
c.paypal.com DigiCert SHA2 Extended Validation Server CA |
2020-01-09 - 2022-01-13 |
2 years | crt.sh |
b.stats.paypal.com DigiCert SHA2 High Assurance Server CA |
2020-03-13 - 2022-06-03 |
2 years | crt.sh |
t.paypal.com DigiCert SHA2 Extended Validation Server CA |
2020-01-09 - 2022-01-12 |
2 years | crt.sh |
This page contains 3 frames:
Primary Page:
https://createanewdecksa-login.cf/f4f9a5fb6a257b5c0becd03e215bc2b1/
Frame ID: 5F41D557DA0FEA4A769B801D016B1368
Requests: 22 HTTP requests in this frame
Frame:
https://c.paypal.com/v1/r/d/i?js_src=https://c.paypal.com/da/r/fb.js
Frame ID: 4CC1D15E03FF77B5D960B6ABB558739E
Requests: 1 HTTP requests in this frame
Frame:
https://dub.stats.paypal.com/v1/counter2.cgi?r=cD00ODRmZmEyZjZlZGY0NzkxYjU2NjI4NzRkYjhlZTgyYyZpPTEzLjIzOC4xMDcuMCZ0PTE1OTgzMDU3NjEuNzc1JmE9MjEmcz1VTklGSUVEX0xPR0lOaGd6r50HGhFjosXrldhdEHoKHeI
Frame ID: 71283D5B7BD983D08AD68BB94111E73A
Requests: 1 HTTP requests in this frame
Screenshot
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Modernizr (JavaScript Libraries) Expand
Detected patterns
- script /([\d.]+)?\/modernizr(?:.([\d.]+))?.*\.js/i
Page Statistics
13 Outgoing links
These are links going to different origins than the main page.
Title: Change
Search URL Search Domain Scan URL
Title: English
Search URL Search Domain Scan URL
Title: Français
Search URL Search Domain Scan URL
Title: Español
Search URL Search Domain Scan URL
Title: 中文
Search URL Search Domain Scan URL
Title: Reload Image
Search URL Search Domain Scan URL
Title: Having trouble logging in?
Search URL Search Domain Scan URL
Title: Sign Up
Search URL Search Domain Scan URL
Title: We can help
Search URL Search Domain Scan URL
Title: Contact Us
Search URL Search Domain Scan URL
Title: Privacy
Search URL Search Domain Scan URL
Title: Legal
Search URL Search Domain Scan URL
Title: Worldwide
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 9- https://www.paypal.com/signin/auth/createchallenge/a30672f5297f835b/recaptchav3.js?_sessionID=TJkDj-4YgCbBDARN3BmzWIeDsukCsRbX HTTP 302
- https://www.paypal.com/signin
- https://b.stats.paypal.com/v1/counter.cgi?r=cD00ODRmZmEyZjZlZGY0NzkxYjU2NjI4NzRkYjhlZTgyYyZpPTEzLjIzOC4xMDcuMCZ0PTE1OTgzMDU3NjEuNzc1JmE9MjEmcz1VTklGSUVEX0xPR0lOaGd6r50HGhFjosXrldhdEHoKHeI HTTP 302
- https://dub.stats.paypal.com/v1/counter2.cgi?r=cD00ODRmZmEyZjZlZGY0NzkxYjU2NjI4NzRkYjhlZTgyYyZpPTEzLjIzOC4xMDcuMCZ0PTE1OTgzMDU3NjEuNzc1JmE9MjEmcz1VTklGSUVEX0xPR0lOaGd6r50HGhFjosXrldhdEHoKHeI
24 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
createanewdecksa-login.cf/f4f9a5fb6a257b5c0becd03e215bc2b1/ |
25 KB 26 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ngrlCaptcha.min.js
www.paypalobjects.com/webcaptcha/ |
21 KB 6 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
contextualLogin.css
www.paypalobjects.com/web/res/82a/6ea55efbe3200eaede20808f53f78/css/ |
98 KB 16 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
modernizr-2.6.1.js
www.paypalobjects.com/web/res/82a/6ea55efbe3200eaede20808f53f78/js/lib/ |
4 KB 2 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
signin
www.paypal.com/ |
0 0 |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icon-PN-check.png
www.paypalobjects.com/images/shared/ |
1 KB 1 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
glyph_alert_critical_big-2x.png
www.paypalobjects.com/images/shared/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fn-sync-telemetry-min.js
www.paypalobjects.com/web/res/82a/6ea55efbe3200eaede20808f53f78/js/lib/ |
5 KB 3 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
signin-split.js
www.paypalobjects.com/web/res/82a/6ea55efbe3200eaede20808f53f78/js/ |
130 KB 32 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pa.js
www.paypalobjects.com/pa/js/min/ |
46 KB 18 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
signin
www.paypal.com/ Redirect Chain
|
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headersRedirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
paypal-logo-129x32.svg
www.paypalobjects.com/images/shared/ |
5 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
signin
www.paypal.com/ |
0 0 |
Media
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
signin
www.paypal.com/ |
0 0 |
Media
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
fb.js
c.paypal.com/da/r/ |
59 KB 20 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
challenge.js
createanewdecksa-login.cf/auth/createchallenge/f89af8dab699b08c/ |
315 B 515 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
client-log
createanewdecksa-login.cf/signin/ |
315 B 515 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cookie-banner
createanewdecksa-login.cf/signin/ |
315 B 515 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
load-resource
createanewdecksa-login.cf/signin/ |
315 B 515 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
i
c.paypal.com/v1/r/d/ Frame 4CC1 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
counter2.cgi
dub.stats.paypal.com/v1/ Frame 7128 Redirect Chain
|
42 B 299 B |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ts
t.paypal.com/ |
42 B 859 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
load-resource
createanewdecksa-login.cf/signin/ |
315 B 515 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
load-resource
createanewdecksa-login.cf/signin/ |
315 B 515 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: PayPal (Financial)11 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| trustedTypes boolean| paypalADSInterceptorInjected object| html5 object| Modernizr function| isEligibleIntegration object| antiClickjack object| PAYPAL function| $ object| fpti string| fptiserverurl object| _ifpti0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
b.stats.paypal.com
c.paypal.com
createanewdecksa-login.cf
dub.stats.paypal.com
t.paypal.com
www.paypal.com
www.paypalobjects.com
104.108.34.200
104.108.36.64
104.111.228.123
13.238.107.0
151.101.129.21
64.4.245.84
04748dd9a27ac47177d01a763fd68b4ca09f5b9acb4208149f2de40251d07dd2
3ccb6fb38b0f1977cec98ffee293a7d26eb040f0f399b3cdcc5ad523b68a0660
4571d2505eb051a672a61d6e1fb9a0229f790499035ce10796227cef2a28dca5
47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292
5396af5006928832517239a2145e9de4bfde558161bd68be9a4b57ea5f37acf5
655790946659ad22d9cf3a6a53adaaeebde362fe3cd46701069299d87ae804ef
6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93
743269eba97930520fffacfbab90f4468674fd06d329e45e6557d298fd16f2ed
8b202d5bd55968ce4bfc21c063166eaebe62104275ce7ec362d78b64b2581c95
a6c3bff965978df8093c3a29f7071c21d7439a212af41e7b40ce70d94d6bcc44
b3cc50b9e94bbecaaeb1079b64b8ca50616d1732824964c1cc2c5422627a0ec5
b983de83ef078e5d567be19b5724c4e9666b4f1dd4ead74b291b88d920b2a21c
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
da7f0302ab57d13f673c1a9d3d50bf87deaacf91ade58865e474cbaffb21ab3f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855