drugs-is-drops-shopzilla.trycloudflare.com Open in urlscan Pro
104.17.123.55 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://drugs-is-drops-shopzilla.trycloudflare.com/
Effective URL:
http://drugs-is-drops-shopzilla.trycloudflare.com/login.html.php
Submission Tags: phisherman
Submission: On January 03 via api (January 3rd 2024, 7:15:16 pm UTC) from US — Scanned from IS

Summary HTTP 18 Redirects Links 22 Behaviour Indicators

Summary

This website contacted 6 IPs in 3 countries across 5 domains to perform 18 HTTP transactions. The main IP is 104.17.123.55, located in and belongs to CLOUDFLARENET, US. The main domain is drugs-is-drops-shopzilla.trycloudflare.com.

This is the only time drugs-is-drops-shopzilla.trycloudflare.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Venmo (Financial)

Domain & IP information

	IP Address	AS Autonomous System
5	104.17.123.55 104.17.123.55	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a03:2880:f08... 2a03:2880:f083:9:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
6	52.84.150.58 52.84.150.58	16509 (AMAZON-02) (AMAZON-02)
4	2a04:4e42:200... 2a04:4e42:200::645	54113 (FASTLY) (FASTLY)
1	65.9.95.74 65.9.95.74	16509 (AMAZON-02) (AMAZON-02)
18	6

5 104.17.123.55 (None, )

ASN13335 (CLOUDFLARENET, US)

drugs-is-drops-shopzilla.trycloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f083:9:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 52.84.150.58 (United States)

ASN16509 (AMAZON-02, US)

venmo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a04:4e42:200::645 (United States)

ASN54113 (FASTLY, US)

jssdkcdns.mparticle.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
identity.mparticle.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
jssdkcdn.mparticle.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 65.9.95.74 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-65-9-95-74.prg50.r.cloudfront.net

cdn.plaid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	venmo.com venmo.com — Cisco Umbrella Rank: 14555
5	trycloudflare.com drugs-is-drops-shopzilla.trycloudflare.com	95 KB
4	mparticle.com jssdkcdns.mparticle.com — Cisco Umbrella Rank: 8531 identity.mparticle.com — Cisco Umbrella Rank: 2904 jssdkcdn.mparticle.com — Cisco Umbrella Rank: 576523	44 KB
1	plaid.com cdn.plaid.com — Cisco Umbrella Rank: 25631	43 KB
1	facebook.net connect.facebook.net — Cisco Umbrella Rank: 240	86 KB
18	5

	Domain	Requested by
6	venmo.com	drugs-is-drops-shopzilla.trycloudflare.com
5	drugs-is-drops-shopzilla.trycloudflare.com	drugs-is-drops-shopzilla.trycloudflare.com
2	identity.mparticle.com	jssdkcdns.mparticle.com
1	jssdkcdn.mparticle.com	drugs-is-drops-shopzilla.trycloudflare.com
1	cdn.plaid.com	drugs-is-drops-shopzilla.trycloudflare.com
1	jssdkcdns.mparticle.com	drugs-is-drops-shopzilla.trycloudflare.com
1	connect.facebook.net	drugs-is-drops-shopzilla.trycloudflare.com
18	7

This site contains links to these domains. Also see Links.

Domain
venmo.com
account.venmo.com
blog.venmo.com
help.venmo.com
itunes.apple.com
play.google.com

Subject Issuer	Validity	Valid
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-10-13` - `2024-01-11`	3 months	crt.sh
ops.venmo.com DigiCert SHA2 Extended Validation Server CA	`2023-04-21` - `2024-05-21`	a year	crt.sh
jssdkcdns.mparticle.com Go Daddy Secure Certificate Authority - G2	`2023-05-02` - `2024-06-02`	a year	crt.sh
secure.plaid.com DigiCert EV RSA CA G2	`2023-03-09` - `2024-04-08`	a year	crt.sh
identity.mparticle.com Go Daddy Secure Certificate Authority - G2	`2023-05-08` - `2024-06-08`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://drugs-is-drops-shopzilla.trycloudflare.com/login.html.php
Frame ID: 15F9A0BA0B117B40A5C40BD24B7947AA
Requests: 18 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

VenmoMenu Button

Page URL History Show full URLs

http://drugs-is-drops-shopzilla.trycloudflare.com/ Page URL
http://drugs-is-drops-shopzilla.trycloudflare.com/login.html.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

TrackJs (Analytics) Expand

Overall confidence: 100%
Detected patterns

tracker\.js

Page Statistics

18
Requests

61 %
HTTPS

40 %
IPv6

5
Domains

7
Subdomains

6
IPs

3
Countries

267 kB
Transfer

729 kB
Size

0
Cookies

22 Outgoing links

These are links going to different origins than the main page.

URL: https://venmo.com/

Search URL Search Domain Scan URL

URL: https://venmo.com/about/product
Title: How Venmo Works

Search URL Search Domain Scan URL

URL: https://venmo.com/business
Title: Business

Search URL Search Domain Scan URL

URL: https://venmo.com/card
Title: Debit Card

Search URL Search Domain Scan URL

URL: https://venmo.com/about/security
Title: Security

Search URL Search Domain Scan URL

URL: https://venmo.com/contact-us
Title: Contact Us

Search URL Search Domain Scan URL

URL: https://venmo.com/account/sign-in
Title: Sign In

Search URL Search Domain Scan URL

URL: https://venmo.com/account/password-reset
Title: Forgot Password?

Search URL Search Domain Scan URL

URL: https://account.venmo.com/signup
Title: Sign Up

Search URL Search Domain Scan URL

URL: https://venmo.com/about/fees
Title: Our Fees

Search URL Search Domain Scan URL

URL: https://venmo.com/contact-us/
Title: Contact Us

Search URL Search Domain Scan URL

URL: https://venmo.com/team/
Title: Our Team

Search URL Search Domain Scan URL

URL: https://venmo.com/jobs
Title: Jobs

Search URL Search Domain Scan URL

URL: http://blog.venmo.com/
Title: Blog

Search URL Search Domain Scan URL

URL: https://help.venmo.com/
Title: Help Center

Search URL Search Domain Scan URL

URL: https://venmo.com/developers
Title: Developer

Search URL Search Domain Scan URL

URL: https://venmo.com/legal/us-user-agreement/
Title: Legal

Search URL Search Domain Scan URL

URL: https://venmo.com/legal/us-privacy-policy/
Title: Privacy

Search URL Search Domain Scan URL

URL: https://itunes.apple.com/us/app/venmo/id351727428?mt=8

Search URL Search Domain Scan URL

URL: https://play.google.com/store/apps/details?id=com.venmo

Search URL Search Domain Scan URL

URL: https://venmo.com/legal/us-disclosures/
Title: PayPal, Inc.’s licenses

Search URL Search Domain Scan URL

URL: http://help.venmo.com/
Title: Help

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://drugs-is-drops-shopzilla.trycloudflare.com/ Page URL
http://drugs-is-drops-shopzilla.trycloudflare.com/login.html.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

18 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK /
drugs-is-drops-shopzilla.trycloudflare.com/ 60 B
439 B 545ms
439ms Document
text/html 104.17.123.55
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://drugs-is-drops-shopzilla.trycloudflare.com/
Protocol: HTTP/1.1
Server: 104.17.123.55 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.4.33
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language: is-IS,is;q=0.9

Response headers

CF-Cache-Status: DYNAMIC
CF-Ray: 83fd91a85cba5cbb-KEF
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Wed, 03 Jan 2024 19:15:11 GMT
Host: drugs-is-drops-shopzilla.trycloudflare.com
Server: cloudflare
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Powered-By: PHP/7.4.33

GET
H/1.1 200
OK Primary Request login.html.php Show response
drugs-is-drops-shopzilla.trycloudflare.com/ 46 KB
8 KB 348ms
348ms Document
text/html 104.17.123.55
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://drugs-is-drops-shopzilla.trycloudflare.com/login.html.php
Requested by: Host: drugs-is-drops-shopzilla.trycloudflare.com
URL: http://drugs-is-drops-shopzilla.trycloudflare.com/
Protocol: HTTP/1.1
Server: 104.17.123.55 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.4.33
Resource Hash: 478df65ca44a25b3537b630f1da8d8bd98460bf7f89f06fa978b3daddf28508d

Request headers

Referer: http://drugs-is-drops-shopzilla.trycloudflare.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language: is-IS,is;q=0.9

Response headers

CF-Cache-Status: DYNAMIC
CF-Ray: 83fd91ab3e545cbb-KEF
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Wed, 03 Jan 2024 19:15:11 GMT
Host: drugs-is-drops-shopzilla.trycloudflare.com
Server: cloudflare
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Powered-By: PHP/7.4.33

GET
H/1.1 200
OK style.css
drugs-is-drops-shopzilla.trycloudflare.com/ 153 KB
27 KB 280ms
279ms Stylesheet
text/css 104.17.123.55
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://drugs-is-drops-shopzilla.trycloudflare.com/style.css
Requested by: Host: drugs-is-drops-shopzilla.trycloudflare.com
URL: http://drugs-is-drops-shopzilla.trycloudflare.com/login.html.php
Protocol: HTTP/1.1
Server: 104.17.123.55 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 507e7ffabad6024ea1fdc909c6be4c7530ba6a3b53a9f7d147875d9d9d9ef5ee

Request headers

accept-language: is-IS,is;q=0.9
Referer: http://drugs-is-drops-shopzilla.trycloudflare.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Date: Wed, 03 Jan 2024 19:15:11 GMT
Content-Encoding: gzip
CF-Cache-Status: DYNAMIC
Server: cloudflare
Host: drugs-is-drops-shopzilla.trycloudflare.com
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/css; charset=UTF-8
Connection: keep-alive
CF-Ray: 83fd91ad6fca5cbb-KEF

GET
H/1.1 200
OK apple-app-store.png
drugs-is-drops-shopzilla.trycloudflare.com/ 42 KB
42 KB 405ms
309ms Image
image/png 104.17.123.55
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://drugs-is-drops-shopzilla.trycloudflare.com/apple-app-store.png
Requested by: Host: drugs-is-drops-shopzilla.trycloudflare.com
URL: http://drugs-is-drops-shopzilla.trycloudflare.com/login.html.php
Protocol: HTTP/1.1
Server: 104.17.123.55 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 622cd21a484947d7e042e5e581b569a88745c099ec42122427ef7be1aff44f0e

Request headers

accept-language: is-IS,is;q=0.9
Referer: http://drugs-is-drops-shopzilla.trycloudflare.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Date: Wed, 03 Jan 2024 19:15:11 GMT
CF-Cache-Status: DYNAMIC
Server: cloudflare
Host: drugs-is-drops-shopzilla.trycloudflare.com
Vary: Accept-Encoding
Content-Type: image/png
Connection: keep-alive
CF-Ray: 83fd91ae0e495cbe-KEF
Content-Length: 42556

GET
H/1.1 200
OK google-play-badge.png
drugs-is-drops-shopzilla.trycloudflare.com/ 18 KB
18 KB 382ms
286ms Image
image/png 104.17.123.55
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://drugs-is-drops-shopzilla.trycloudflare.com/google-play-badge.png
Requested by: Host: drugs-is-drops-shopzilla.trycloudflare.com
URL: http://drugs-is-drops-shopzilla.trycloudflare.com/login.html.php
Protocol: HTTP/1.1
Server: 104.17.123.55 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 14a7270311e1c00220cb6f4a7358328c11339b7b30a3ddaadcc3626d05a6b058

Request headers

accept-language: is-IS,is;q=0.9
Referer: http://drugs-is-drops-shopzilla.trycloudflare.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Date: Wed, 03 Jan 2024 19:15:11 GMT
CF-Cache-Status: DYNAMIC
Server: cloudflare
Host: drugs-is-drops-shopzilla.trycloudflare.com
Vary: Accept-Encoding
Content-Type: image/png
Connection: keep-alive
CF-Ray: 83fd91ae0d575cc9-KEF
Content-Length: 18215

GET
H2 200 sdk.js Show response
connect.facebook.net/en_US/ 297 KB
86 KB 323ms
104ms Script
application/x-javascript 2a03:2880:f083:9:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js?hash=a6217a1a379e9f93d6e1cfefa3a2b747

Requested by

Host: drugs-is-drops-shopzilla.trycloudflare.com
URL: http://drugs-is-drops-shopzilla.trycloudflare.com/login.html.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f083:9:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

8ff6224eeda8bcb444154f744bbb1d73cd1ef40250a1bb1759eb68281fb613f6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: http://drugs-is-drops-shopzilla.trycloudflare.com/
Origin: http://drugs-is-drops-shopzilla.trycloudflare.com
accept-language: is-IS,is;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), keyboard-map=(), picture-in-picture=(), xr-spatial-tracking=()
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 03 Jan 2024 19:15:11 GMT
content-md5: gej6idksVPA/9N2KV+OLBg==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 86864
reporting-endpoints
x-fb-debug: tJ0vcJah6LbcBNVaXie2Ko87W3oDDps0DooeBZG78P+M/0Mh9Gs0bPgwIXnXhdj825zzne1L+Yy03HyimSKQDQ==
x-fb-content-md5: e604d62c3c44ef49c50a5315dc75f773
cross-origin-opener-policy: same-origin-allow-popups
etag: "9b131a5a128eb559029f5987d32bcaa3"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
origin-agent-cluster: ?0
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
expires: Thu, 02 Jan 2025 18:51:44 GMT

GET
H2 404 link-initialize.js
venmo.com//cdn.plaid.com/link/v2/stable/ 0
0 438ms
224ms Script
text/plain 52.84.150.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://venmo.com//cdn.plaid.com/link/v2/stable/link-initialize.js

Requested by

Host: drugs-is-drops-shopzilla.trycloudflare.com
URL: http://drugs-is-drops-shopzilla.trycloudflare.com/login.html.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.84.150.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx / Express

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: is-IS,is;q=0.9
Referer: http://drugs-is-drops-shopzilla.trycloudflare.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Wed, 03 Jan 2024 19:15:11 GMT
strict-transport-security: max-age=31536000
via: 1.1 3af85c3075e12aff72b9e148b99d6622.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: AMS54-C1
x-powered-by: Express
x-frame-options: SAMEORIGIN
x-cache: Error from cloudfront
cache-control: no-cache
x-envoy-upstream-service-time: 2
content-length: 0
x-amz-cf-id: YmIj4TF9X38KyM6J-G61pnPQkEmHTQ1ZkyHO3xu41-QO2nDYg3oCbQ==

GET
H2 404 tracker.js
venmo.com//d2zah9y47r7bi2.cloudfront.net/releases/current/ 0
0 619ms
405ms Script
text/plain 52.84.150.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://venmo.com//d2zah9y47r7bi2.cloudfront.net/releases/current/tracker.js

Requested by

Host: drugs-is-drops-shopzilla.trycloudflare.com
URL: http://drugs-is-drops-shopzilla.trycloudflare.com/login.html.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.84.150.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx / Express

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: is-IS,is;q=0.9
Referer: http://drugs-is-drops-shopzilla.trycloudflare.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Wed, 03 Jan 2024 19:15:12 GMT
strict-transport-security: max-age=31536000
via: 1.1 3af85c3075e12aff72b9e148b99d6622.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: AMS54-C1
x-powered-by: Express
x-frame-options: SAMEORIGIN
x-cache: Error from cloudfront
cache-control: no-cache
x-envoy-upstream-service-time: 4
content-length: 0
x-amz-cf-id: nDZbAsmHwHPlBEU7iIAPi9vJOsswEekDo26hqPVp6TSmCXX_qRqvTg==

GET
H2 200 mparticle.js Show response
jssdkcdns.mparticle.com/js/v2/40433222e815b743853a4bb6b7a86058/ 172 KB
43 KB 301ms
92ms Script
application/javascript 2a04:4e42:200::645
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://jssdkcdns.mparticle.com/js/v2/40433222e815b743853a4bb6b7a86058/mparticle.js
Requested by: Host: drugs-is-drops-shopzilla.trycloudflare.com
URL: http://drugs-is-drops-shopzilla.trycloudflare.com/login.html.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a04:4e42:200::645 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Kestrel /
Resource Hash: 626eafc2049eb51816280b88e68e2afeffad5ea3f9d6a94da94fc5ca076bd9a7

Request headers

accept-language: is-IS,is;q=0.9
Referer: http://drugs-is-drops-shopzilla.trycloudflare.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-served-by: cache-iad-kjyo7100080-IAD, cache-lcy-eglc8600021-LCY
date: Wed, 03 Jan 2024 19:15:11 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
server: Kestrel
age: 270
x-timer: S1704309312.833285,VS0,VE0
x-origin-name: fastlyshield--shield_ssl_cache_iad_kjyo7100080_IAD
x-cache: HIT, HIT
content-type: application/javascript
vary: Accept, Accept-Encoding
cache-control: public, max-age=3600
accept-ranges: bytes
content-length: 44027
x-cache-hits: 73, 1

GET
H2 404 analytics.js
venmo.com//www.google-analytics.com/ 0
0 435ms
222ms Script
text/plain 52.84.150.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://venmo.com//www.google-analytics.com/analytics.js

Requested by

Host: drugs-is-drops-shopzilla.trycloudflare.com
URL: http://drugs-is-drops-shopzilla.trycloudflare.com/login.html.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.84.150.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx / Express

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: is-IS,is;q=0.9
Referer: http://drugs-is-drops-shopzilla.trycloudflare.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Wed, 03 Jan 2024 19:15:11 GMT
strict-transport-security: max-age=31536000
via: 1.1 3af85c3075e12aff72b9e148b99d6622.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: AMS54-C1
x-powered-by: Express
x-frame-options: SAMEORIGIN
x-cache: Error from cloudfront
cache-control: no-cache
x-envoy-upstream-service-time: 4
content-length: 0
x-amz-cf-id: mUSuBYH2YwEn3I5DSREe17skG1yUcGikjZKC7RT7NAVrpZdtMnzHQQ==

GET
H2 404 sdk.js
venmo.com//connect.facebook.net/en_US/ 0
0 625ms
412ms Script
text/plain 52.84.150.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://venmo.com//connect.facebook.net/en_US/sdk.js

Requested by

Host: drugs-is-drops-shopzilla.trycloudflare.com
URL: http://drugs-is-drops-shopzilla.trycloudflare.com/login.html.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.84.150.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx / Express

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: is-IS,is;q=0.9
Referer: http://drugs-is-drops-shopzilla.trycloudflare.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Wed, 03 Jan 2024 19:15:12 GMT
strict-transport-security: max-age=31536000
via: 1.1 3af85c3075e12aff72b9e148b99d6622.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: AMS54-C1
x-powered-by: Express
x-frame-options: SAMEORIGIN
x-cache: Error from cloudfront
cache-control: no-cache
x-envoy-upstream-service-time: 3
content-length: 0
x-amz-cf-id: mrOKC5hNqXp8nEglOW3nJyVxu3P9ZeC2Daz_J1iGZVK6F9jwNiXR3w==

GET auth.da057eaa579ace1ee189.min.js
venmo.com/build/js/ 0
0

GET
H2 200 link-dynamic-loader.js
cdn.plaid.com/link/2.0.1353/ 0
43 KB 371ms
129ms Other
application/javascript 65.9.95.74
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.plaid.com/link/2.0.1353/link-dynamic-loader.js
Requested by: Host: drugs-is-drops-shopzilla.trycloudflare.com
URL: http://drugs-is-drops-shopzilla.trycloudflare.com/login.html.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.95.74 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-95-74.prg50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: is-IS,is;q=0.9
Referer: http://drugs-is-drops-shopzilla.trycloudflare.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Wed, 03 Jan 2024 18:52:55 GMT
x-amz-version-id: 9qd76G2EPKIhGfk67cc2E5IzSZqUxXlc
content-encoding: gzip
via: 1.1 97101640da3dcba7a2d4a3d67a31b114.cloudfront.net (CloudFront)
x-amz-cf-pop: PRG50-C1
age: 1337
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Fri, 22 Jul 2022 20:54:20 GMT
server: AmazonS3
etag: W/"7738fdfbead18a01d58f6c83c13259f7"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=10800
x-amz-cf-id: e3tUxYbSgqho-cEjdEZbmTO7OleMXk02B_qlrwS-0khsO3kRQTQkmQ==

OPTIONS
H2 204 identify
identity.mparticle.com/v1/ 0
0 304ms
91ms Preflight 2a04:4e42:200::645
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://identity.mparticle.com/v1/identify

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:200::645 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=900

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-mp-key
Access-Control-Request-Method: POST
Origin: http://drugs-is-drops-shopzilla.trycloudflare.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-headers: content-type,x-mp-key
access-control-allow-methods: POST
access-control-allow-origin: *
age: 2178
date: Wed, 03 Jan 2024 19:15:12 GMT
server: Kestrel
strict-transport-security: max-age=900
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 1910
x-fastly-trace-id: 2009755004
x-origin-name: 4PrgpUXX9K0sNAH1JImfyI--F_us1_origin
x-served-by: cache-lcy-eglc8600029-LCY
x-timer: S1704309312.242833,VS0,VE0

POST
H2 200 identify Show response
identity.mparticle.com/v1/ 175 B
300 B 188ms
187ms XHR
application/json 2a04:4e42:200::645
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://identity.mparticle.com/v1/identify

Requested by

Host: jssdkcdns.mparticle.com
URL: https://jssdkcdns.mparticle.com/js/v2/40433222e815b743853a4bb6b7a86058/mparticle.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:200::645 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Kestrel /

Resource Hash

cd2342ffafbb59caaacc633fd449f32b1085c496ae0a66a0c0ff28eb7ac58fbf

Security Headers

Name	Value
Strict-Transport-Security	max-age=900

Request headers

x-mp-key: 40433222e815b743853a4bb6b7a86058
Referer: http://drugs-is-drops-shopzilla.trycloudflare.com/
accept-language: is-IS,is;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Content-Type: application/json

Response headers

date: Wed, 03 Jan 2024 19:15:12 GMT
content-encoding: gzip
via: 1.1 varnish
x-mp-max-age: 86400
strict-transport-security: max-age=900
x-origin-name: 4PrgpUXX9K0sNAH1JImfyI--F_us1_origin
x-cache: MISS
x-served-by: cache-lcy-eglc8600029-LCY
server: Kestrel
x-timer: S1704309312.334833,VS0,VE96
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: *
x-fastly-trace-id: 2009756078
accept-ranges: bytes
x-cache-hits: 0

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 201846346a7e06da7554b4ecd99f14bdbb011257abf42bc61bdaa8a91f122fff

Request headers

accept-language: is-IS,is;q=0.9
Referer: http://drugs-is-drops-shopzilla.trycloudflare.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 404 analytics.js
venmo.com//www.google-analytics.com/ 0
0 226ms
225ms Script
text/plain 52.84.150.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://venmo.com//www.google-analytics.com/analytics.js

Requested by

Host: drugs-is-drops-shopzilla.trycloudflare.com
URL: http://drugs-is-drops-shopzilla.trycloudflare.com/login.html.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.84.150.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx / Express

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: is-IS,is;q=0.9
Referer: http://drugs-is-drops-shopzilla.trycloudflare.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Wed, 03 Jan 2024 19:15:12 GMT
strict-transport-security: max-age=31536000
via: 1.1 3af85c3075e12aff72b9e148b99d6622.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: AMS54-C1
x-powered-by: Express
x-frame-options: SAMEORIGIN
x-cache: Error from cloudfront
cache-control: no-cache
x-envoy-upstream-service-time: 4
content-length: 0
x-amz-cf-id: WopF3f3MGVpVYu9fLjSCE_Gc0axccPsab1m2Cbs2_78Bmkv8o3xbnA==

GET
H/1.1 404
Not Found mparticle.js
jssdkcdn.mparticle.com/js/v2/40433222e815b743853a4bb6b7a86058https://venmo.com/ 0
0 275ms
166ms Script
text/plain 2a04:4e42:200::645
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: http://jssdkcdn.mparticle.com/js/v2/40433222e815b743853a4bb6b7a86058https://venmo.com/mparticle.js
Requested by: Host: drugs-is-drops-shopzilla.trycloudflare.com
URL: http://drugs-is-drops-shopzilla.trycloudflare.com/login.html.php
Protocol: HTTP/1.1
Server: 2a04:4e42:200::645 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Kestrel /
Resource Hash

Request headers

accept-language: is-IS,is;q=0.9
Referer: http://drugs-is-drops-shopzilla.trycloudflare.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

X-Served-By: cache-iad-kiad7000109-IAD, cache-lcy-eglc8600052-LCY
Date: Wed, 03 Jan 2024 19:15:12 GMT
Via: 1.1 varnish, 1.1 varnish
Server: Kestrel
Age: 0
X-Timer: S1704309312.384648,VS0,VE75
X-Origin-Name: fastlyshield--shield_ssl_cache_iad_kiad7000109_IAD
X-Cache: HIT, MISS
Content-Type: text/plain
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 527
X-Cache-Hits: 2, 0

GET
H2 404 tracker.js
venmo.com//d2zah9y47r7bi2.cloudfront.net/releases/current/ 0
0 222ms
221ms Script
text/plain 52.84.150.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://venmo.com//d2zah9y47r7bi2.cloudfront.net/releases/current/tracker.js

Requested by

Host: drugs-is-drops-shopzilla.trycloudflare.com
URL: http://drugs-is-drops-shopzilla.trycloudflare.com/login.html.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.84.150.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx / Express

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: is-IS,is;q=0.9
Referer: http://drugs-is-drops-shopzilla.trycloudflare.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Wed, 03 Jan 2024 19:15:12 GMT
strict-transport-security: max-age=31536000
via: 1.1 3af85c3075e12aff72b9e148b99d6622.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: AMS54-C1
x-powered-by: Express
x-frame-options: SAMEORIGIN
x-cache: Error from cloudfront
cache-control: no-cache
x-envoy-upstream-service-time: 3
content-length: 0
x-amz-cf-id: Zccc9QwsBzRwDWFK9sbSBtCzFI0g5mZlflO9eoxQ8mByNa9t4-_geA==

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: venmo.com
URL: https://venmo.com/build/js/auth.da057eaa579ace1ee189.min.js

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Venmo (Financial)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

9 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	error	URL: http://drugs-is-drops-shopzilla.trycloudflare.com/login.html.php Message: Access to script at 'https://venmo.com/build/js/auth.da057eaa579ace1ee189.min.js' from origin 'http://drugs-is-drops-shopzilla.trycloudflare.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://venmo.com/build/js/auth.da057eaa579ace1ee189.min.js Message: Failed to load resource: net::ERR_FAILED
network	error	URL: https://venmo.com//www.google-analytics.com/analytics.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://venmo.com//cdn.plaid.com/link/v2/stable/link-initialize.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://venmo.com//d2zah9y47r7bi2.cloudfront.net/releases/current/tracker.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://venmo.com//connect.facebook.net/en_US/sdk.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://venmo.com//d2zah9y47r7bi2.cloudfront.net/releases/current/tracker.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://venmo.com//www.google-analytics.com/analytics.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: http://jssdkcdn.mparticle.com/js/v2/40433222e815b743853a4bb6b7a86058https://venmo.com/mparticle.js Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.plaid.com
connect.facebook.net
drugs-is-drops-shopzilla.trycloudflare.com
identity.mparticle.com
jssdkcdn.mparticle.com
jssdkcdns.mparticle.com
venmo.com
venmo.com
104.17.123.55
2a03:2880:f083:9:face:b00c:0:3
2a04:4e42:200::645
52.84.150.58
65.9.95.74
14a7270311e1c00220cb6f4a7358328c11339b7b30a3ddaadcc3626d05a6b058
201846346a7e06da7554b4ecd99f14bdbb011257abf42bc61bdaa8a91f122fff
478df65ca44a25b3537b630f1da8d8bd98460bf7f89f06fa978b3daddf28508d
507e7ffabad6024ea1fdc909c6be4c7530ba6a3b53a9f7d147875d9d9d9ef5ee
622cd21a484947d7e042e5e581b569a88745c099ec42122427ef7be1aff44f0e
626eafc2049eb51816280b88e68e2afeffad5ea3f9d6a94da94fc5ca076bd9a7
8ff6224eeda8bcb444154f744bbb1d73cd1ef40250a1bb1759eb68281fb613f6
cd2342ffafbb59caaacc633fd449f32b1085c496ae0a66a0c0ff28eb7ac58fbf
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

drugs-is-drops-shopzilla.trycloudflare.com Open in urlscan Pro 104.17.123.55 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

18 Requests

61 %HTTPS

40 %IPv6

5 Domains

7 Subdomains

6 IPs

3 Countries

267 kBTransfer

729 kBSize

0 Cookies

22 Outgoing links

Page URL History

Redirected requests

18 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

8 JavaScript Global Variables

0 Cookies

9 Console Messages

Indicators

drugs-is-drops-shopzilla.trycloudflare.com Open in urlscan Pro
104.17.123.55 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

18
Requests

61 %
HTTPS

40 %
IPv6

5
Domains

7
Subdomains

6
IPs

3
Countries

267 kB
Transfer

729 kB
Size

0
Cookies

18 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!