payment.edidiesecure.zelle-pay.ty.sw-rpg.net Open in urlscan Pro
104.192.220.125  Malicious Activity! Public Scan

4 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response payment.edidiesecure.zelle-pay.ty.sw-rpg.net/	16 KB 5 KB	1404ms 246ms	Document text/html	104.192.220.125 GTT-BACKBONE GTT
General Check archive.org Show headers Download Go to Full URL http://payment.edidiesecure.zelle-pay.ty.sw-rpg.net/ Protocol HTTP/1.1 Server 104.192.220.125 , United States, ASN3257 (GTT-BACKBONE GTT, US), Reverse DNS sw-rpg.net Software LiteSpeed / Resource Hash 4b91eb705c47fe110694a31832494851181c29e85da7b51db9d0e060ca89da58 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Connection Keep-Alive Keep-Alive timeout=5, max=100 accept-ranges bytes content-encoding gzip content-length 4748 content-type text/html date Sat, 29 Oct 2022 13:02:06 GMT last-modified Thu, 30 Jan 2020 07:53:22 GMT server LiteSpeed vary Accept-Encoding
GET H/1.1	404 Not Found	css_t1brucSEN1mEHXG2_9ZHdmbQeaWdFDWwKmSgrcc5RQE.css www.zellepay.com/sites/default/files/css/	0 0	840ms 747ms	Stylesheet text/html	2606:4700::6810:e2e8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.zellepay.com/sites/default/files/css/css_t1brucSEN1mEHXG2_9ZHdmbQeaWdFDWwKmSgrcc5RQE.css?pon1u7 Requested by Host: payment.edidiesecure.zelle-pay.ty.sw-rpg.net URL: http://payment.edidiesecure.zelle-pay.ty.sw-rpg.net/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2606:4700::6810:e2e8 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer http://payment.edidiesecure.zelle-pay.ty.sw-rpg.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers
GET H/1.1	200 OK	zelle1.css payment.edidiesecure.zelle-pay.ty.sw-rpg.net/css/	267 KB 51 KB	215ms 214ms	Stylesheet text/css	104.192.220.125 GTT-BACKBONE GTT
General Check archive.org Show headers Download Go to Full URL http://payment.edidiesecure.zelle-pay.ty.sw-rpg.net/css/zelle1.css Requested by Host: payment.edidiesecure.zelle-pay.ty.sw-rpg.net URL: http://payment.edidiesecure.zelle-pay.ty.sw-rpg.net/ Protocol HTTP/1.1 Server 104.192.220.125 , United States, ASN3257 (GTT-BACKBONE GTT, US), Reverse DNS sw-rpg.net Software LiteSpeed / Resource Hash 0b9360da05b1b89d10634c260993f61f269bafcddc592b080c4e1ff39bf9ddfb Request headers accept-language de-DE,de;q=0.9 Referer http://payment.edidiesecure.zelle-pay.ty.sw-rpg.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Sat, 29 Oct 2022 13:02:06 GMT content-encoding gzip last-modified Fri, 10 Jan 2020 21:09:14 GMT server LiteSpeed vary Accept-Encoding content-type text/css cache-control public, max-age=604800 Connection Keep-Alive accept-ranges bytes Keep-Alive timeout=5, max=100 content-length 51548 expires Sat, 05 Nov 2022 13:02:06 GMT
GET H/1.1	404 Not Found	z_logo.svg www.zellepay.com/themes/early_warning/images/	0 0	954ms 864ms	Image text/html	2606:4700::6810:e2e8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.zellepay.com/themes/early_warning/images/z_logo.svg Requested by Host: payment.edidiesecure.zelle-pay.ty.sw-rpg.net URL: http://payment.edidiesecure.zelle-pay.ty.sw-rpg.net/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2606:4700::6810:e2e8 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer http://payment.edidiesecure.zelle-pay.ty.sw-rpg.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers
GET H/1.1	200 OK	Zelle-logo-tagline-horizontal-white-v2_2.png www.zellepay.com/sites/default/files/	14 KB 15 KB	971ms 880ms	Image image/png	2606:4700::6810:e2e8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.zellepay.com/sites/default/files/Zelle-logo-tagline-horizontal-white-v2_2.png Requested by Host: payment.edidiesecure.zelle-pay.ty.sw-rpg.net URL: http://payment.edidiesecure.zelle-pay.ty.sw-rpg.net/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2606:4700::6810:e2e8 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash fc70a9f7f04303d2d568c7345f579f6f09db537ffb61571398d2b7ecd69c21e2 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer http://payment.edidiesecure.zelle-pay.ty.sw-rpg.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers X-Cache-Hits 10 Date Sat, 29 Oct 2022 13:02:07 GMT Via varnish X-Content-Type-Options nosniff CF-Cache-Status MISS Strict-Transport-Security max-age=31536000; includeSubDomains X-Cache HIT Connection keep-alive X-AH-Environment prod Content-Length 14612 X-Request-ID v-066c2d16-564b-11ed-bb6a-3b320e30cb2e Last-Modified Thu, 01 Jan 1970 00:00:00 GMT Server cloudflare Vary Accept-Encoding Content-Type image/png Cache-Control max-age=1209600 Accept-Ranges bytes CF-RAY 761c1a8dba0590c6-FRA Expires Thu, 10 Nov 2022 22:59:34 GMT
GET H/1.1	200 OK	Zelle-logo-no-tagline-white.png www.zellepay.com/sites/default/files/2017-09/	26 KB 27 KB	1000ms 910ms	Image image/png	2606:4700::6810:e2e8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.zellepay.com/sites/default/files/2017-09/Zelle-logo-no-tagline-white.png Requested by Host: payment.edidiesecure.zelle-pay.ty.sw-rpg.net URL: http://payment.edidiesecure.zelle-pay.ty.sw-rpg.net/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2606:4700::6810:e2e8 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ca3a002b0253e4ea03269036572d68de84afcc8624db8d6d241c825814ceacf7 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer http://payment.edidiesecure.zelle-pay.ty.sw-rpg.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers X-Cache-Hits 14 Date Sat, 29 Oct 2022 13:02:07 GMT Via varnish X-Content-Type-Options nosniff CF-Cache-Status MISS Strict-Transport-Security max-age=31536000; includeSubDomains X-Cache HIT Connection keep-alive X-AH-Environment prod Content-Length 26734 X-Request-ID v-065901e6-564b-11ed-a5be-33947f62de21 Last-Modified Thu, 01 Jan 1970 00:00:00 GMT Server cloudflare Vary Accept-Encoding Content-Type image/png Cache-Control max-age=1209600 Accept-Ranges bytes CF-RAY 761c1a8dbda8915c-FRA Expires Thu, 10 Nov 2022 22:59:34 GMT
GET H/1.1	404 Not Found	ZelleSans-Demi.woff2 payment.edidiesecure.zelle-pay.ty.sw-rpg.net/themes/early_warning/fonts/ZelleSans/ZelleSans-Demi/	0 0	229ms 229ms	Font text/html	104.192.220.125 GTT-BACKBONE GTT
General Check archive.org Show headers Download Go to Full URL http://payment.edidiesecure.zelle-pay.ty.sw-rpg.net/themes/early_warning/fonts/ZelleSans/ZelleSans-Demi/ZelleSans-Demi.woff2 Requested by Host: payment.edidiesecure.zelle-pay.ty.sw-rpg.net URL: http://payment.edidiesecure.zelle-pay.ty.sw-rpg.net/css/zelle1.css Protocol HTTP/1.1 Server 104.192.220.125 , United States, ASN3257 (GTT-BACKBONE GTT, US), Reverse DNS sw-rpg.net Software LiteSpeed / Resource Hash Request headers Referer http://payment.edidiesecure.zelle-pay.ty.sw-rpg.net/css/zelle1.css Origin http://payment.edidiesecure.zelle-pay.ty.sw-rpg.net accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers pragma no-cache date Sat, 29 Oct 2022 13:02:07 GMT server LiteSpeed content-type text/html cache-control private, no-cache, no-store, must-revalidate, max-age=0 Connection Keep-Alive Keep-Alive timeout=5, max=100 content-length 1238
GET H/1.1	404 Not Found	ZelleSans.woff2 payment.edidiesecure.zelle-pay.ty.sw-rpg.net/themes/early_warning/fonts/ZelleSans/ZelleSans/	0 0	231ms 231ms	Font text/html	104.192.220.125 GTT-BACKBONE GTT
General Check archive.org Show headers Download Go to Full URL http://payment.edidiesecure.zelle-pay.ty.sw-rpg.net/themes/early_warning/fonts/ZelleSans/ZelleSans/ZelleSans.woff2 Requested by Host: payment.edidiesecure.zelle-pay.ty.sw-rpg.net URL: http://payment.edidiesecure.zelle-pay.ty.sw-rpg.net/css/zelle1.css Protocol HTTP/1.1 Server 104.192.220.125 , United States, ASN3257 (GTT-BACKBONE GTT, US), Reverse DNS sw-rpg.net Software LiteSpeed / Resource Hash Request headers Referer http://payment.edidiesecure.zelle-pay.ty.sw-rpg.net/css/zelle1.css Origin http://payment.edidiesecure.zelle-pay.ty.sw-rpg.net accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers pragma no-cache date Sat, 29 Oct 2022 13:02:07 GMT server LiteSpeed content-type text/html cache-control private, no-cache, no-store, must-revalidate, max-age=0 Connection Keep-Alive Keep-Alive timeout=5, max=100 content-length 1238
GET H/1.1	404 Not Found	ZelleSans-Demi.woff payment.edidiesecure.zelle-pay.ty.sw-rpg.net/themes/early_warning/fonts/ZelleSans/ZelleSans-Demi/	0 0	234ms 233ms	Font text/html	104.192.220.125 GTT-BACKBONE GTT
General Check archive.org Show headers Download Go to Full URL http://payment.edidiesecure.zelle-pay.ty.sw-rpg.net/themes/early_warning/fonts/ZelleSans/ZelleSans-Demi/ZelleSans-Demi.woff Requested by Host: payment.edidiesecure.zelle-pay.ty.sw-rpg.net URL: http://payment.edidiesecure.zelle-pay.ty.sw-rpg.net/css/zelle1.css Protocol HTTP/1.1 Server 104.192.220.125 , United States, ASN3257 (GTT-BACKBONE GTT, US), Reverse DNS sw-rpg.net Software LiteSpeed / Resource Hash Request headers Referer http://payment.edidiesecure.zelle-pay.ty.sw-rpg.net/css/zelle1.css Origin http://payment.edidiesecure.zelle-pay.ty.sw-rpg.net accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers pragma no-cache date Sat, 29 Oct 2022 13:02:07 GMT server LiteSpeed content-type text/html cache-control private, no-cache, no-store, must-revalidate, max-age=0 Connection Keep-Alive Keep-Alive timeout=5, max=100 content-length 1238
GET H/1.1	404 Not Found	ZelleSans.woff payment.edidiesecure.zelle-pay.ty.sw-rpg.net/themes/early_warning/fonts/ZelleSans/ZelleSans/	0 0	234ms 234ms	Font text/html	104.192.220.125 GTT-BACKBONE GTT
General Check archive.org Show headers Download Go to Full URL http://payment.edidiesecure.zelle-pay.ty.sw-rpg.net/themes/early_warning/fonts/ZelleSans/ZelleSans/ZelleSans.woff Requested by Host: payment.edidiesecure.zelle-pay.ty.sw-rpg.net URL: http://payment.edidiesecure.zelle-pay.ty.sw-rpg.net/css/zelle1.css Protocol HTTP/1.1 Server 104.192.220.125 , United States, ASN3257 (GTT-BACKBONE GTT, US), Reverse DNS sw-rpg.net Software LiteSpeed / Resource Hash Request headers Referer http://payment.edidiesecure.zelle-pay.ty.sw-rpg.net/css/zelle1.css Origin http://payment.edidiesecure.zelle-pay.ty.sw-rpg.net accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers pragma no-cache date Sat, 29 Oct 2022 13:02:07 GMT server LiteSpeed content-type text/html cache-control private, no-cache, no-store, must-revalidate, max-age=0 Connection Keep-Alive Keep-Alive timeout=5, max=100 content-length 1238
GET H/1.1	404 Not Found	ZelleSans-Demi.ttf payment.edidiesecure.zelle-pay.ty.sw-rpg.net/themes/early_warning/fonts/ZelleSans/ZelleSans-Demi/	0 0	201ms 188ms	Font text/html	104.192.220.125 GTT-BACKBONE GTT
General Check archive.org Show headers Download Go to Full URL http://payment.edidiesecure.zelle-pay.ty.sw-rpg.net/themes/early_warning/fonts/ZelleSans/ZelleSans-Demi/ZelleSans-Demi.ttf Requested by Host: payment.edidiesecure.zelle-pay.ty.sw-rpg.net URL: http://payment.edidiesecure.zelle-pay.ty.sw-rpg.net/css/zelle1.css Protocol HTTP/1.1 Server 104.192.220.125 , United States, ASN3257 (GTT-BACKBONE GTT, US), Reverse DNS sw-rpg.net Software LiteSpeed / Resource Hash Request headers Referer http://payment.edidiesecure.zelle-pay.ty.sw-rpg.net/css/zelle1.css Origin http://payment.edidiesecure.zelle-pay.ty.sw-rpg.net accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers pragma no-cache date Sat, 29 Oct 2022 13:02:07 GMT server LiteSpeed content-type text/html cache-control private, no-cache, no-store, must-revalidate, max-age=0 Connection Keep-Alive Keep-Alive timeout=5, max=100 content-length 1238
GET H/1.1	404 Not Found	ZelleSans.ttf payment.edidiesecure.zelle-pay.ty.sw-rpg.net/themes/early_warning/fonts/ZelleSans/ZelleSans/	0 0	195ms 189ms	Font text/html	104.192.220.125 GTT-BACKBONE GTT
General Check archive.org Show headers Download Go to Full URL http://payment.edidiesecure.zelle-pay.ty.sw-rpg.net/themes/early_warning/fonts/ZelleSans/ZelleSans/ZelleSans.ttf Requested by Host: payment.edidiesecure.zelle-pay.ty.sw-rpg.net URL: http://payment.edidiesecure.zelle-pay.ty.sw-rpg.net/css/zelle1.css Protocol HTTP/1.1 Server 104.192.220.125 , United States, ASN3257 (GTT-BACKBONE GTT, US), Reverse DNS sw-rpg.net Software LiteSpeed / Resource Hash Request headers Referer http://payment.edidiesecure.zelle-pay.ty.sw-rpg.net/css/zelle1.css Origin http://payment.edidiesecure.zelle-pay.ty.sw-rpg.net accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers pragma no-cache date Sat, 29 Oct 2022 13:02:07 GMT server LiteSpeed content-type text/html cache-control private, no-cache, no-store, must-revalidate, max-age=0 Connection Keep-Alive Keep-Alive timeout=5, max=100 content-length 1238

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Zelle (Banking)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch object| navigation

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.zellepay.com/	1969-12-31 23:59:59	Name: __cfruid Value: 5066c79985f51a6221284b610c7bbf6c067cf465-1667048527

8 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://www.zellepay.com/sites/default/files/css/css_t1brucSEN1mEHXG2_9ZHdmbQeaWdFDWwKmSgrcc5RQE.css?pon1u7 Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://www.zellepay.com/themes/early_warning/images/z_logo.svg Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: http://payment.edidiesecure.zelle-pay.ty.sw-rpg.net/themes/early_warning/fonts/ZelleSans/ZelleSans-Demi/ZelleSans-Demi.woff2 Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: http://payment.edidiesecure.zelle-pay.ty.sw-rpg.net/themes/early_warning/fonts/ZelleSans/ZelleSans/ZelleSans.woff2 Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: http://payment.edidiesecure.zelle-pay.ty.sw-rpg.net/themes/early_warning/fonts/ZelleSans/ZelleSans-Demi/ZelleSans-Demi.woff Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: http://payment.edidiesecure.zelle-pay.ty.sw-rpg.net/themes/early_warning/fonts/ZelleSans/ZelleSans/ZelleSans.woff Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: http://payment.edidiesecure.zelle-pay.ty.sw-rpg.net/themes/early_warning/fonts/ZelleSans/ZelleSans-Demi/ZelleSans-Demi.ttf Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: http://payment.edidiesecure.zelle-pay.ty.sw-rpg.net/themes/early_warning/fonts/ZelleSans/ZelleSans/ZelleSans.ttf Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

payment.edidiesecure.zelle-pay.ty.sw-rpg.net
www.zellepay.com
104.192.220.125
2606:4700::6810:e2e8
0b9360da05b1b89d10634c260993f61f269bafcddc592b080c4e1ff39bf9ddfb
4b91eb705c47fe110694a31832494851181c29e85da7b51db9d0e060ca89da58
ca3a002b0253e4ea03269036572d68de84afcc8624db8d6d241c825814ceacf7
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
fc70a9f7f04303d2d568c7345f579f6f09db537ffb61571398d2b7ecd69c21e2