www.raydper.com Open in urlscan Pro
206.188.193.196  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response www.raydper.com/8g4z/pp/	3 KB 1 KB	372ms 372ms	Document text/html	206.188.193.196 Defense.Net
General Check archive.org Show headers Download Go to Full URL http://www.raydper.com/8g4z/pp/?em=%26ses=ce1577c1290d0e1a68bf584133fb4e29 Protocol HTTP/1.1 Server 206.188.193.196 Jacksonville, United States, ASN55002 (DEFENSE-NET - Defense.Net, Inc, US), Reverse DNS vux.netsolhost.com Software openresty/1.11.2.4 / PHP/5.6.17-pl0-gentoo Resource Hash 6b983536c4ef7f8a4ad57e0026f647b506ad355a63a75512ca252e6b20554a6c Request headers Host www.raydper.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Server openresty/1.11.2.4 Date Sun, 03 Feb 2019 18:16:16 GMT Content-Type text/html; charset=UTF-8 Transfer-Encoding chunked Connection keep-alive Vary Accept-Encoding X-Powered-By PHP/5.6.17-pl0-gentoo X-Webcom-Cache-Status BYPASS Content-Encoding gzip
GET H/1.1	200 OK	i3v.css www.raydper.com/8g4z/pp/t7i/	39 KB 10 KB	157ms 156ms	Stylesheet text/css	206.188.193.196 Defense.Net
General Check archive.org Show headers Download Go to Full URL http://www.raydper.com/8g4z/pp/t7i/i3v.css Requested by Host: www.raydper.com URL: http://www.raydper.com/8g4z/pp/?em=%26ses=ce1577c1290d0e1a68bf584133fb4e29 Protocol HTTP/1.1 Server 206.188.193.196 Jacksonville, United States, ASN55002 (DEFENSE-NET - Defense.Net, Inc, US), Reverse DNS vux.netsolhost.com Software openresty/1.11.2.4 / Resource Hash ae2870cf0b512eeb61930ae6224c06e309a0e6c333608ce0fa63a97303e72c14 Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www.raydper.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/css,*/*;q=0.1 Referer http://www.raydper.com/8g4z/pp/?em=%26ses=ce1577c1290d0e1a68bf584133fb4e29 Connection keep-alive Cache-Control no-cache Referer http://www.raydper.com/8g4z/pp/?em=%26ses=ce1577c1290d0e1a68bf584133fb4e29 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Sun, 03 Feb 2019 18:16:17 GMT Content-Encoding gzip Last-Modified Thu, 11 May 2017 10:52:00 GMT Server openresty/1.11.2.4 X-Webcom-Cache-Status BYPASS ETag W/"628cd6bd-9bd5-54f3d60d93400" Vary Accept-Encoding Content-Type text/css Transfer-Encoding chunked Connection keep-alive
GET H/1.1	200 OK	1.js Show response www.raydper.com/8g4z/pp/	12 KB 3 KB	137ms 137ms	Script application/javascript	206.188.193.196 Defense.Net
General Check archive.org Show headers Download Go to Full URL http://www.raydper.com/8g4z/pp/1.js Requested by Host: www.raydper.com URL: http://www.raydper.com/8g4z/pp/?em=%26ses=ce1577c1290d0e1a68bf584133fb4e29 Protocol HTTP/1.1 Server 206.188.193.196 Jacksonville, United States, ASN55002 (DEFENSE-NET - Defense.Net, Inc, US), Reverse DNS vux.netsolhost.com Software openresty/1.11.2.4 / Resource Hash 344ce7ae9a0179e949d1daf2b1811828294ec092ebdd622a7d8f2f379e801823 Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www.raydper.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept */* Referer http://www.raydper.com/8g4z/pp/?em=%26ses=ce1577c1290d0e1a68bf584133fb4e29 Connection keep-alive Cache-Control no-cache Referer http://www.raydper.com/8g4z/pp/?em=%26ses=ce1577c1290d0e1a68bf584133fb4e29 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Sun, 03 Feb 2019 18:16:17 GMT Content-Encoding gzip Last-Modified Mon, 30 Sep 2013 22:00:00 GMT Server openresty/1.11.2.4 X-Webcom-Cache-Status BYPASS ETag W/"630a700b-301b-4e7a0f51dd800" Vary Accept-Encoding Content-Type application/javascript Transfer-Encoding chunked Connection keep-alive
GET H/1.1	200 OK	sim-logo-129x32.svg www.raydper.com/8g4z/pp/t7i/	5 KB 5 KB	153ms 153ms	Image image/svg+xml	206.188.193.196 Defense.Net
General Check archive.org Show headers Download Go to Show image Full URL http://www.raydper.com/8g4z/pp/t7i/sim-logo-129x32.svg Requested by Host: www.raydper.com URL: http://www.raydper.com/8g4z/pp/?em=%26ses=ce1577c1290d0e1a68bf584133fb4e29 Protocol HTTP/1.1 Server 206.188.193.196 Jacksonville, United States, ASN55002 (DEFENSE-NET - Defense.Net, Inc, US), Reverse DNS vux.netsolhost.com Software openresty/1.11.2.4 / Resource Hash e7732075c1658de8aa753e0eee55aaaa03d3bd2d4cb59cf77ee5ecbf52977ae2 Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www.raydper.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept image/webp,image/apng,image/*,*/*;q=0.8 Referer http://www.raydper.com/8g4z/pp/t7i/i3v.css Connection keep-alive Cache-Control no-cache Referer http://www.raydper.com/8g4z/pp/t7i/i3v.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Sun, 03 Feb 2019 18:16:17 GMT Last-Modified Thu, 11 May 2017 10:20:00 GMT Server openresty/1.11.2.4 X-Webcom-Cache-Status BYPASS ETag "63514e61-132c-54f3cee685400" Content-Type image/svg+xml Connection keep-alive Accept-Ranges bytes Content-Length 4908

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online) PayPal (Financial)

17 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask function| Validator function| set_addnl_vfunction function| clear_all_validations function| form_submit_handler function| add_validation function| ValidationDesc function| vdesc_validate function| ValidationSet function| add_validationdesc function| vset_validate function| validateEmailv2 function| mod10 function| V2validateData object| frmvalidator

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

www.raydper.com
206.188.193.196
344ce7ae9a0179e949d1daf2b1811828294ec092ebdd622a7d8f2f379e801823
6b983536c4ef7f8a4ad57e0026f647b506ad355a63a75512ca252e6b20554a6c
ae2870cf0b512eeb61930ae6224c06e309a0e6c333608ce0fa63a97303e72c14
e7732075c1658de8aa753e0eee55aaaa03d3bd2d4cb59cf77ee5ecbf52977ae2