urlscan.io logo urlscan.io
SecurityTrails logo

outlet.bgschool.bg Open in urlscan Pro
77.77.151.80  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/updatebilling.php
Submission: On April 03 via manual from BG
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 21 HTTP transactions. The main IP is 77.77.151.80, located in Bulgaria and belongs to ICN-, BG. The main domain is outlet.bgschool.bg.
This is the only time outlet.bgschool.bg was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: PayPal (Financial)

Domain & IP information

IP Address AS Autonomous System
15 77.77.151.80 49699 (ICN-)
1 2a00:1450:400... 15169 (GOOGLE)
5 23.210.248.89 16625 (AKAMAI-AS)
21 3
Domain Requested by
15 outlet.bgschool.bg outlet.bgschool.bg
5 www.paypalobjects.com outlet.bgschool.bg
1 ajax.googleapis.com outlet.bgschool.bg
21 3

This site contains no links.

Subject Issuer Validity Valid
*.storage.googleapis.com
GTS CA 1O1		 2020-03-03 -
2020-05-26		 3 months crt.sh
www.paypal.com
DigiCert SHA2 Extended Validation Server CA		 2020-01-09 -
2022-01-12		 2 years crt.sh

This page contains 1 frames:

Primary Page: http://outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/updatebilling.php
Frame ID: 073189D4E302D2078C324ED51C33C939
Requests: 21 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • url /\.php(?:$|\?)/i
Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Overall confidence: 100%
Detected patterns
  • script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

21
Requests

29 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

898 kB
Transfer

929 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

21 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request Cookie set updatebilling.php
outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/ 		25 KB
25 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/updatebilling.php
Protocol
HTTP/1.1
Server
77.77.151.80 , Bulgaria, ASN49699 (ICN-, BG),
Reverse DNS
bgschool.bg
Software
ws-httpd / PHP/5.4.45
Resource Hash
e02787f2e02ed52ef1a737c4d417c9302f785d4a51178b3cccea58385134c6c3

Request headers

Host
outlet.bgschool.bg
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Fri, 03 Apr 2020 14:18:50 GMT
Content-Type
text/html
Transfer-Encoding
chunked
Connection
keep-alive
X-Powered-By
PHP/5.4.45
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma
no-cache
Set-Cookie
PHPSESSID=a8582681dea06f4592c05d60a1f3a780; path=/
Server
ws-httpd
X-ActiveCache-status
MISS
ys_app.ltr.css
outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/YSASSETS/css/ 		287 KB
288 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/YSASSETS/css/ys_app.ltr.css
Requested by
Host: outlet.bgschool.bg
URL: http://outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/updatebilling.php
Protocol
HTTP/1.1
Server
77.77.151.80 , Bulgaria, ASN49699 (ICN-, BG),
Reverse DNS
bgschool.bg
Software
ws-httpd /
Resource Hash
2132859bb0ef10e8130e805c0df89044392c1233284bb489844ff1bc19fc227b

Request headers

Referer
http://outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/updatebilling.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Fri, 03 Apr 2020 14:18:50 GMT
Last-Modified
Tue, 08 Aug 2017 22:36:07 GMT
Server
ws-httpd
X-ActiveCache-status
BYPASS
Content-Type
text/css
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
294244
ys_ppl-sans.css
outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/YSASSETS/css/ 		5 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/YSASSETS/css/ys_ppl-sans.css
Requested by
Host: outlet.bgschool.bg
URL: http://outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/updatebilling.php
Protocol
HTTP/1.1
Server
77.77.151.80 , Bulgaria, ASN49699 (ICN-, BG),
Reverse DNS
bgschool.bg
Software
ws-httpd /
Resource Hash
9600c17aa3b630f23242bcfa3762ce4de45776e3092efda870b7e23ecee79d72

Request headers

Referer
http://outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/updatebilling.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Fri, 03 Apr 2020 14:18:50 GMT
Last-Modified
Tue, 08 Aug 2017 22:36:07 GMT
Server
ws-httpd
X-ActiveCache-status
BYPASS
Content-Type
text/css
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
4638
ys_summary.ltr.css
outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/YSASSETS/css/ 		300 KB
301 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/YSASSETS/css/ys_summary.ltr.css
Requested by
Host: outlet.bgschool.bg
URL: http://outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/updatebilling.php
Protocol
HTTP/1.1
Server
77.77.151.80 , Bulgaria, ASN49699 (ICN-, BG),
Reverse DNS
bgschool.bg
Software
ws-httpd /
Resource Hash
39bc33f508e63450012016fb13d7c204afcf075ff2af59986127bcb88a6b8407

Request headers

Referer
http://outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/updatebilling.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Fri, 03 Apr 2020 14:18:50 GMT
Last-Modified
Tue, 08 Aug 2017 22:36:07 GMT
Server
ws-httpd
X-ActiveCache-status
BYPASS
Content-Type
text/css
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
307520
ys_app.css
outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/YSASSETS/css/ 		2 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/YSASSETS/css/ys_app.css
Requested by
Host: outlet.bgschool.bg
URL: http://outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/updatebilling.php
Protocol
HTTP/1.1
Server
77.77.151.80 , Bulgaria, ASN49699 (ICN-, BG),
Reverse DNS
bgschool.bg
Software
ws-httpd /
Resource Hash
ed31d6de23f26ffc0da51b24fd527e073c9c1ab1d1575e6d44cb515dcfc2a092

Request headers

Referer
http://outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/updatebilling.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Fri, 03 Apr 2020 14:18:50 GMT
Last-Modified
Tue, 08 Aug 2017 22:36:07 GMT
Server
ws-httpd
X-ActiveCache-status
BYPASS
Content-Type
text/css
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1963
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/1.12.4/ 		95 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/1.12.4/jquery.min.js
Requested by
Host: outlet.bgschool.bg
URL: http://outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/updatebilling.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:821::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
http://outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/updatebilling.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 23 Jan 2020 10:02:37 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
6149774
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
33951
x-xss-protection
0
last-modified
Tue, 20 Dec 2016 18:17:03 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 22 Jan 2021 10:02:37 GMT
jquery.maskedinput.js
outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/YSASSETS/js/ 		0
253 B 		Script
General
Check archive.org
Download Go to
Full URL
http://outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/YSASSETS/js/jquery.maskedinput.js
Requested by
Host: outlet.bgschool.bg
URL: http://outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/updatebilling.php
Protocol
HTTP/1.1
Server
77.77.151.80 , Bulgaria, ASN49699 (ICN-, BG),
Reverse DNS
bgschool.bg
Software
ws-httpd /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
http://outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/updatebilling.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Fri, 03 Apr 2020 14:18:50 GMT
Last-Modified
Wed, 16 Jan 2019 04:44:37 GMT
Server
ws-httpd
X-ActiveCache-status
BYPASS
Content-Type
application/javascript
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
0
information.png
outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/YSASSETS/img/ 		27 KB
27 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/YSASSETS/img/information.png
Requested by
Host: outlet.bgschool.bg
URL: http://outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/updatebilling.php
Protocol
HTTP/1.1
Server
77.77.151.80 , Bulgaria, ASN49699 (ICN-, BG),
Reverse DNS
bgschool.bg
Software
ws-httpd /
Resource Hash
feeef692825e15f82abd557ca71f54d2991e2a9945ec31b5bcd7573bf12fa907

Request headers

Referer
http://outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/updatebilling.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Fri, 03 Apr 2020 14:18:50 GMT
Last-Modified
Tue, 08 Aug 2017 22:36:07 GMT
Server
ws-httpd
X-ActiveCache-status
BYPASS
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
27484
worning.png
outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/YSASSETS/img/ 		445 B
687 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/YSASSETS/img/worning.png
Requested by
Host: outlet.bgschool.bg
URL: http://outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/updatebilling.php
Protocol
HTTP/1.1
Server
77.77.151.80 , Bulgaria, ASN49699 (ICN-, BG),
Reverse DNS
bgschool.bg
Software
ws-httpd /
Resource Hash
60db5bdebc470b5204dc001969958339c0cb700c36403bb2dd2abdcf2ff7ed7e

Request headers

Referer
http://outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/updatebilling.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Fri, 03 Apr 2020 14:18:50 GMT
Last-Modified
Tue, 08 Aug 2017 22:36:07 GMT
Server
ws-httpd
X-ActiveCache-status
BYPASS
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
445
ys_dowira_jquery.js
outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/YSASSETS/js/ 		0
253 B 		Script
General
Check archive.org
Download Go to
Full URL
http://outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/YSASSETS/js/ys_dowira_jquery.js
Requested by
Host: outlet.bgschool.bg
URL: http://outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/updatebilling.php
Protocol
HTTP/1.1
Server
77.77.151.80 , Bulgaria, ASN49699 (ICN-, BG),
Reverse DNS
bgschool.bg
Software
ws-httpd /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
http://outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/updatebilling.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Fri, 03 Apr 2020 14:18:51 GMT
Last-Modified
Sun, 06 Jan 2019 13:19:22 GMT
Server
ws-httpd
X-ActiveCache-status
BYPASS
Content-Type
application/javascript
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
0
ys_dowira_plugins.js
outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/YSASSETS/js/ 		0
253 B 		Script
General
Check archive.org
Download Go to
Full URL
http://outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/YSASSETS/js/ys_dowira_plugins.js
Requested by
Host: outlet.bgschool.bg
URL: http://outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/updatebilling.php
Protocol
HTTP/1.1
Server
77.77.151.80 , Bulgaria, ASN49699 (ICN-, BG),
Reverse DNS
bgschool.bg
Software
ws-httpd /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
http://outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/updatebilling.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Fri, 03 Apr 2020 14:18:51 GMT
Last-Modified
Sun, 30 Dec 2018 22:32:09 GMT
Server
ws-httpd
X-ActiveCache-status
BYPASS
Content-Type
application/javascript
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
0
ys_ppl_647892.js
outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/YSASSETS/js/ 		0
253 B 		Script
General
Check archive.org
Download Go to
Full URL
http://outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/YSASSETS/js/ys_ppl_647892.js
Requested by
Host: outlet.bgschool.bg
URL: http://outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/updatebilling.php
Protocol
HTTP/1.1
Server
77.77.151.80 , Bulgaria, ASN49699 (ICN-, BG),
Reverse DNS
bgschool.bg
Software
ws-httpd /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
http://outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/updatebilling.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Fri, 03 Apr 2020 14:18:51 GMT
Last-Modified
Fri, 27 Jul 2018 00:25:28 GMT
Server
ws-httpd
X-ActiveCache-status
BYPASS
Content-Type
application/javascript
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
0
ys_pa.js
outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/YSASSETS/js/ 		0
253 B 		Script
General
Check archive.org
Download Go to
Full URL
http://outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/YSASSETS/js/ys_pa.js
Requested by
Host: outlet.bgschool.bg
URL: http://outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/updatebilling.php
Protocol
HTTP/1.1
Server
77.77.151.80 , Bulgaria, ASN49699 (ICN-, BG),
Reverse DNS
bgschool.bg
Software
ws-httpd /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
http://outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/updatebilling.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Fri, 03 Apr 2020 14:18:51 GMT
Last-Modified
Thu, 07 Mar 2019 07:25:26 GMT
Server
ws-httpd
X-ActiveCache-status
BYPASS
Content-Type
application/javascript
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
0
ys_appli.js
outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/YSASSETS/js/ 		0
253 B 		Script
General
Check archive.org
Download Go to
Full URL
http://outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/YSASSETS/js/ys_appli.js
Requested by
Host: outlet.bgschool.bg
URL: http://outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/updatebilling.php
Protocol
HTTP/1.1
Server
77.77.151.80 , Bulgaria, ASN49699 (ICN-, BG),
Reverse DNS
bgschool.bg
Software
ws-httpd /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
http://outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/updatebilling.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Fri, 03 Apr 2020 14:18:51 GMT
Last-Modified
Sun, 22 Jul 2018 10:11:48 GMT
Server
ws-httpd
X-ActiveCache-status
BYPASS
Content-Type
application/javascript
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
0
ys_bootstrap.js
outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/YSASSETS/js/ 		0
253 B 		Script
General
Check archive.org
Download Go to
Full URL
http://outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/YSASSETS/js/ys_bootstrap.js
Requested by
Host: outlet.bgschool.bg
URL: http://outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/updatebilling.php
Protocol
HTTP/1.1
Server
77.77.151.80 , Bulgaria, ASN49699 (ICN-, BG),
Reverse DNS
bgschool.bg
Software
ws-httpd /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
http://outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/updatebilling.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Fri, 03 Apr 2020 14:18:51 GMT
Last-Modified
Wed, 07 Nov 2018 12:19:10 GMT
Server
ws-httpd
X-ActiveCache-status
BYPASS
Content-Type
application/javascript
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
0
updatebilling.php
outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/ 		0
25 KB 		Other
General
Check archive.org
Download Go to
Full URL
http://outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/updatebilling.php
Requested by
Host: outlet.bgschool.bg
URL: http://outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/updatebilling.php
Protocol
HTTP/1.1
Server
77.77.151.80 , Bulgaria, ASN49699 (ICN-, BG),
Reverse DNS
bgschool.bg
Software
ws-httpd / PHP/5.4.45
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
http://outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/updatebilling.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 03 Apr 2020 14:18:51 GMT
Server
ws-httpd
X-Powered-By
PHP/5.4.45
Transfer-Encoding
chunked
X-ActiveCache-status
BYPASS
Content-Type
text/html
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection
keep-alive
Expires
Thu, 19 Nov 1981 08:52:00 GMT
PayPalSansBig-Regular.woff2
www.paypalobjects.com/ui-web/paypal-sans-big/1-0-0/ 		38 KB
38 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.paypalobjects.com/ui-web/paypal-sans-big/1-0-0/PayPalSansBig-Regular.woff2
Requested by
Host: outlet.bgschool.bg
URL: http://outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/updatebilling.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.210.248.89 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-210-248-89.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
2351bbc39303736cd3a670db10427adc13c256dd6b639f0545bfd104947d3427
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Referer
http://outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/YSASSETS/css/ys_ppl-sans.css
Origin
http://outlet.bgschool.bg
Sec-Fetch-Dest
font
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 03 Apr 2020 14:18:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 08 Jun 2016 16:50:06 GMT
server
Apache
access-control-allow-origin
*
vary
Accept-Encoding
content-type
application/font-woff2
status
200
cache-control
max-age=3600
strict-transport-security
max-age=31536000
accept-ranges
bytes
expires
Fri, 03 Apr 2020 15:18:51 GMT
ConsumerIcons-Regular.woff
www.paypalobjects.com/ui-web/iconfont-consumer/3-3-0/fonts/ 		35 KB
35 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.paypalobjects.com/ui-web/iconfont-consumer/3-3-0/fonts/ConsumerIcons-Regular.woff
Requested by
Host: outlet.bgschool.bg
URL: http://outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/updatebilling.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.210.248.89 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-210-248-89.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
d7793651ef95bfe8e9e0ca8660c9ee4e76744c40f04ee8427a388ca1005fc29b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Referer
http://outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/YSASSETS/css/ys_app.ltr.css
Origin
http://outlet.bgschool.bg
Sec-Fetch-Dest
font
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 03 Apr 2020 14:18:51 GMT
x-pad
avoid browser bug
x-content-type-options
nosniff
last-modified
Tue, 27 Oct 2015 18:54:00 GMT
server
Apache
access-control-allow-origin
*
vary
Accept-Encoding
content-type
application/x-font-woff
status
200
cache-control
max-age=3600
strict-transport-security
max-age=31536000
accept-ranges
bytes
content-length
35676
expires
Fri, 03 Apr 2020 15:18:51 GMT
PayPalSansBig-Medium.woff2
www.paypalobjects.com/ui-web/paypal-sans-big/1-0-0/ 		39 KB
39 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.paypalobjects.com/ui-web/paypal-sans-big/1-0-0/PayPalSansBig-Medium.woff2
Requested by
Host: outlet.bgschool.bg
URL: http://outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/updatebilling.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.210.248.89 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-210-248-89.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
707b984c5c13152e4eaff00bb6000a9e3050a0a086030d2a25525c8dd2bd536e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Referer
http://outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/YSASSETS/css/ys_ppl-sans.css
Origin
http://outlet.bgschool.bg
Sec-Fetch-Dest
font
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 03 Apr 2020 14:18:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 08 Jun 2016 16:50:06 GMT
server
Apache
access-control-allow-origin
*
vary
Accept-Encoding
content-type
application/font-woff2
status
200
cache-control
max-age=3600
strict-transport-security
max-age=31536000
accept-ranges
bytes
expires
Fri, 03 Apr 2020 15:18:51 GMT
PayPalSansBig-Light.woff2
www.paypalobjects.com/ui-web/paypal-sans-big/1-0-0/ 		37 KB
38 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.paypalobjects.com/ui-web/paypal-sans-big/1-0-0/PayPalSansBig-Light.woff2
Requested by
Host: outlet.bgschool.bg
URL: http://outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/updatebilling.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.210.248.89 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-210-248-89.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
4619d70d7bd1b3d7572940e9ee7f31bc4c07f4c9cad6ae2d3e5b2eb555b6a2c0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Referer
http://outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/YSASSETS/css/ys_ppl-sans.css
Origin
http://outlet.bgschool.bg
Sec-Fetch-Dest
font
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 03 Apr 2020 14:18:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 08 Jun 2016 16:50:06 GMT
server
Apache
access-control-allow-origin
*
vary
Accept-Encoding
content-type
application/font-woff2
status
200
cache-control
max-age=3600
strict-transport-security
max-age=31536000
accept-ranges
bytes
expires
Fri, 03 Apr 2020 15:18:51 GMT
PayPalSansBig-Thin.woff2
www.paypalobjects.com/ui-web/paypal-sans-big/1-0-0/ 		39 KB
39 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.paypalobjects.com/ui-web/paypal-sans-big/1-0-0/PayPalSansBig-Thin.woff2
Requested by
Host: outlet.bgschool.bg
URL: http://outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/updatebilling.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.210.248.89 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-210-248-89.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
1874ea5e78629eb0a0bac87800916d23b6a7796cc53fcb16ada872fea82b4230
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Referer
http://outlet.bgschool.bg/wp-content/plugins/ml-slider/php/cgi/YSASSETS/css/ys_ppl-sans.css
Origin
http://outlet.bgschool.bg
Sec-Fetch-Dest
font
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 03 Apr 2020 14:18:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 08 Jun 2016 16:50:03 GMT
server
Apache
access-control-allow-origin
*
vary
Accept-Encoding
content-type
application/font-woff2
status
200
cache-control
max-age=3600
strict-transport-security
max-age=31536000
accept-ranges
bytes
expires
Fri, 03 Apr 2020 15:18:51 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| $ function| jQuery function| isNumberKey function| ValidateAlpha

1 Cookies

Domain/Path Name / Value
outlet.bgschool.bg/ Name: PHPSESSID
Value: a8582681dea06f4592c05d60a1f3a780