drugs-is-drops-shopzilla.trycloudflare.com
Open in
urlscan Pro
104.17.124.55
Malicious Activity!
Public Scan
Effective URL: http://drugs-is-drops-shopzilla.trycloudflare.com/login.html.php
Submission: On January 03 via api from US — Scanned from IS
Summary
This is the only time drugs-is-drops-shopzilla.trycloudflare.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Venmo (Financial)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
5 | 104.17.124.55 104.17.124.55 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a03:2880:f08... 2a03:2880:f083:9:face:b00c:0:3 | 32934 (FACEBOOK) (FACEBOOK) | |
5 | 52.84.150.38 52.84.150.38 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2a04:4e42:600... 2a04:4e42:600::645 | 54113 (FASTLY) (FASTLY) | |
1 | 52.222.144.16 52.222.144.16 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2a04:4e42:400... 2a04:4e42:400::645 | 54113 (FASTLY) (FASTLY) | |
2 | 2a04:4e42::645 2a04:4e42::645 | 54113 (FASTLY) (FASTLY) | |
17 | 8 |
ASN32934 (FACEBOOK, US)
connect.facebook.net |
ASN16509 (AMAZON-02, US)
PTR: server-52-222-144-16.mrs52.r.cloudfront.net
cdn.plaid.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
venmo.com
venmo.com — Cisco Umbrella Rank: 14555 |
|
5 |
trycloudflare.com
drugs-is-drops-shopzilla.trycloudflare.com |
95 KB |
4 |
mparticle.com
jssdkcdns.mparticle.com — Cisco Umbrella Rank: 8531 jssdkcdn.mparticle.com — Cisco Umbrella Rank: 576523 identity.mparticle.com — Cisco Umbrella Rank: 2904 |
44 KB |
1 |
plaid.com
cdn.plaid.com — Cisco Umbrella Rank: 25631 |
43 KB |
1 |
facebook.net
connect.facebook.net — Cisco Umbrella Rank: 240 |
86 KB |
17 | 5 |
Domain | Requested by | |
---|---|---|
5 | venmo.com |
drugs-is-drops-shopzilla.trycloudflare.com
|
5 | drugs-is-drops-shopzilla.trycloudflare.com |
drugs-is-drops-shopzilla.trycloudflare.com
|
2 | identity.mparticle.com |
jssdkcdns.mparticle.com
|
1 | jssdkcdn.mparticle.com |
drugs-is-drops-shopzilla.trycloudflare.com
|
1 | cdn.plaid.com |
drugs-is-drops-shopzilla.trycloudflare.com
|
1 | jssdkcdns.mparticle.com |
drugs-is-drops-shopzilla.trycloudflare.com
|
1 | connect.facebook.net |
drugs-is-drops-shopzilla.trycloudflare.com
|
17 | 7 |
This site contains links to these domains. Also see Links.
Domain |
---|
venmo.com |
account.venmo.com |
blog.venmo.com |
help.venmo.com |
itunes.apple.com |
play.google.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.facebook.com DigiCert SHA2 High Assurance Server CA |
2023-10-13 - 2024-01-11 |
3 months | crt.sh |
ops.venmo.com DigiCert SHA2 Extended Validation Server CA |
2023-04-21 - 2024-05-21 |
a year | crt.sh |
jssdkcdns.mparticle.com Go Daddy Secure Certificate Authority - G2 |
2023-05-02 - 2024-06-02 |
a year | crt.sh |
secure.plaid.com DigiCert EV RSA CA G2 |
2023-03-09 - 2024-04-08 |
a year | crt.sh |
identity.mparticle.com Go Daddy Secure Certificate Authority - G2 |
2023-05-08 - 2024-06-08 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
http://drugs-is-drops-shopzilla.trycloudflare.com/login.html.php
Frame ID: 311CB952C1512D5BF0E138C2DD90000E
Requests: 17 HTTP requests in this frame
Screenshot
Page Title
VenmoMenu ButtonPage URL History Show full URLs
- http://drugs-is-drops-shopzilla.trycloudflare.com/ Page URL
- http://drugs-is-drops-shopzilla.trycloudflare.com/login.html.php Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- \.php(?:$|\?)
Facebook (Widgets) Expand
Detected patterns
- //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js
Google Analytics (Analytics) Expand
Detected patterns
- google-analytics\.com/(?:ga|urchin|analytics)\.js
TrackJs (Analytics) Expand
Detected patterns
- tracker\.js
Page Statistics
22 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Title: How Venmo Works
Search URL Search Domain Scan URL
Title: Business
Search URL Search Domain Scan URL
Title: Debit Card
Search URL Search Domain Scan URL
Title: Security
Search URL Search Domain Scan URL
Title: Contact Us
Search URL Search Domain Scan URL
Title: Sign In
Search URL Search Domain Scan URL
Title: Forgot Password?
Search URL Search Domain Scan URL
Title: Sign Up
Search URL Search Domain Scan URL
Title: Our Fees
Search URL Search Domain Scan URL
Title: Contact Us
Search URL Search Domain Scan URL
Title: Our Team
Search URL Search Domain Scan URL
Title: Jobs
Search URL Search Domain Scan URL
Title: Blog
Search URL Search Domain Scan URL
Title: Help Center
Search URL Search Domain Scan URL
Title: Developer
Search URL Search Domain Scan URL
Title: Legal
Search URL Search Domain Scan URL
Title: Privacy
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title: PayPal, Inc.’s licenses
Search URL Search Domain Scan URL
Title: Help
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://drugs-is-drops-shopzilla.trycloudflare.com/ Page URL
- http://drugs-is-drops-shopzilla.trycloudflare.com/login.html.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
17 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
drugs-is-drops-shopzilla.trycloudflare.com/ |
60 B 449 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
login.html.php
drugs-is-drops-shopzilla.trycloudflare.com/ |
46 KB 8 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style.css
drugs-is-drops-shopzilla.trycloudflare.com/ |
153 KB 27 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
apple-app-store.png
drugs-is-drops-shopzilla.trycloudflare.com/ |
42 KB 42 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
google-play-badge.png
drugs-is-drops-shopzilla.trycloudflare.com/ |
18 KB 18 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sdk.js
connect.facebook.net/en_US/ |
297 KB 86 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
link-initialize.js
venmo.com//cdn.plaid.com/link/v2/stable/ |
0 0 |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tracker.js
venmo.com//d2zah9y47r7bi2.cloudfront.net/releases/current/ |
0 0 |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mparticle.js
jssdkcdns.mparticle.com/js/v2/40433222e815b743853a4bb6b7a86058/ |
172 KB 43 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
venmo.com//www.google-analytics.com/ |
0 0 |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sdk.js
venmo.com//connect.facebook.net/en_US/ |
0 0 |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
auth.da057eaa579ace1ee189.min.js
venmo.com/build/js/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
link-dynamic-loader.js
cdn.plaid.com/link/2.0.1353/ |
0 43 KB |
Other
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
mparticle.js
jssdkcdn.mparticle.com/js/v2/40433222e815b743853a4bb6b7a86058https://venmo.com/ |
0 0 |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tracker.js
venmo.com//d2zah9y47r7bi2.cloudfront.net/releases/current/ |
0 0 |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H2 |
identify
identity.mparticle.com/v1/ |
0 0 |
Preflight
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
identify
identity.mparticle.com/v1/ |
176 B 333 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- venmo.com
- URL
- https://venmo.com/build/js/auth.da057eaa579ace1ee189.min.js
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Venmo (Financial)8 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| venmo function| fbAsyncInit string| GoogleAnalyticsObject function| ga object| mParticle object| _trackJs function| createPlaidHandler object| FB0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
8 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.plaid.com
connect.facebook.net
drugs-is-drops-shopzilla.trycloudflare.com
identity.mparticle.com
jssdkcdn.mparticle.com
jssdkcdns.mparticle.com
venmo.com
venmo.com
104.17.124.55
2a03:2880:f083:9:face:b00c:0:3
2a04:4e42:400::645
2a04:4e42:600::645
2a04:4e42::645
52.222.144.16
52.84.150.38
14a7270311e1c00220cb6f4a7358328c11339b7b30a3ddaadcc3626d05a6b058
201846346a7e06da7554b4ecd99f14bdbb011257abf42bc61bdaa8a91f122fff
3eea875bfd44307af08ae2898e2e449532629df8f81b44be27304510ed9fc9b7
478df65ca44a25b3537b630f1da8d8bd98460bf7f89f06fa978b3daddf28508d
507e7ffabad6024ea1fdc909c6be4c7530ba6a3b53a9f7d147875d9d9d9ef5ee
622cd21a484947d7e042e5e581b569a88745c099ec42122427ef7be1aff44f0e
626eafc2049eb51816280b88e68e2afeffad5ea3f9d6a94da94fc5ca076bd9a7
8ff6224eeda8bcb444154f744bbb1d73cd1ef40250a1bb1759eb68281fb613f6
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855