paczkgls.com Open in urlscan Pro
2606:4700:3031::681f:5097 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://paczkgls.com/235
Effective URL:
https://paczkgls.com/wTy6QHtFYz25/gNIaN6
Submission: On July 09 via automatic, source openphish (July 9th 2020, 1:45:21 am UTC)

Summary HTTP 21 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 21 HTTP transactions. The main IP is 2606:4700:3031::681f:5097, located in United States and belongs to CLOUDFLARENET, US. The main domain is paczkgls.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on July 8th 2020. Valid for: a year.

This is the only time paczkgls.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: PayU (Financial)

Domain & IP information

	IP Address		AS Autonomous System
2 23	2606:4700:303... 2606:4700:3031::681f:5097		13335 (CLOUDFLAR...) (CLOUDFLARENET)
21	1

23 2606:4700:3031::681f:5097 (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

paczkgls.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
23	paczkgls.com 2 redirects paczkgls.com	642 KB
21	1

	Domain	Requested by
23	paczkgls.com	2 redirects paczkgls.com
21	1

This site contains no links.

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-07-08` - `2021-07-08`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://paczkgls.com/wTy6QHtFYz25/gNIaN6
Frame ID: 8FBB7916F342151E4C8CC43DC17A67C9
Requests: 21 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://paczkgls.com/235 HTTP 301
https://paczkgls.com/235 HTTP 302
https://paczkgls.com/wTy6QHtFYz25/gNIaN6 Page URL

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

21
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

641 kB
Transfer

740 kB
Size

9
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://paczkgls.com/235 HTTP 301
https://paczkgls.com/235 HTTP 302
https://paczkgls.com/wTy6QHtFYz25/gNIaN6 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

21 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request gNIaN6 Show response paczkgls.com/wTy6QHtFYz25/ Redirect Chain http://paczkgls.com/235 https://paczkgls.com/235 https://paczkgls.com/wTy6QHtFYz25/gNIaN6	13 KB 4 KB	96ms 95ms	Document text/html	2606:4700:3031::681f:5097 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://paczkgls.com/wTy6QHtFYz25/gNIaN6 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::681f:5097 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.4.7RC1 Resource Hash `97a63147266a46d9bce57cff882c549d529dc94cca49ce1975ee916b3a09a70a` Request headers :method GET :authority paczkgls.com :scheme https :path /wTy6QHtFYz25/gNIaN6 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US cookie __cfduid=d0c785fca08412bd95049a1bfeb04d8821594259104; PHPSESSID=8v0ero18l2k7p3l67qdjjbvn9p Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 date Thu, 09 Jul 2020 01:45:05 GMT content-type text/html; charset=UTF-8 vary Accept-Encoding x-powered-by PHP/7.4.7RC1 expires Thu, 19 Nov 1981 08:52:00 GMT cache-control no-store, no-cache, must-revalidate pragma no-cache set-cookie a9e508ebb82a50a08e89724dc60a4dd3=591797976; expires=Thu, 09-Jul-2020 02:45:03 GMT; Max-Age=3598 05343bfbc67392122db12ef02b87919a=2904749318; expires=Thu, 09-Jul-2020 02:42:55 GMT; Max-Age=3470 453cc874783062d16f7ef99136ed9cdb=1322040467; expires=Thu, 09-Jul-2020 02:42:14 GMT; Max-Age=3429 fca3ed8de1b933992ebea12bd2a55a12=3640331672; expires=Thu, 09-Jul-2020 02:42:38 GMT; Max-Age=3453 cc3c92161c0172468bd91f11c912b739=3583948435; expires=Thu, 09-Jul-2020 02:40:10 GMT; Max-Age=3305 357175c3d3b90f19f965cc9e9bd84a8a=2501048716; expires=Thu, 09-Jul-2020 02:46:17 GMT; Max-Age=3672 43160ab5ee10550947d1c05ad2f351db=2973430595; expires=Thu, 09-Jul-2020 02:44:36 GMT; Max-Age=3571 cf-cache-status DYNAMIC cf-request-id 03d2d87cf40000c2dbf105c200000001 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" server cloudflare cf-ray 5afe5d0e5e08c2db-FRA content-encoding br Redirect headers status 302 date Thu, 09 Jul 2020 01:45:05 GMT content-type text/html; charset=UTF-8 x-powered-by PHP/7.4.7RC1 expires Thu, 19 Nov 1981 08:52:00 GMT cache-control no-store, no-cache, must-revalidate pragma no-cache location https://paczkgls.com/wTy6QHtFYz25/gNIaN6 cf-cache-status DYNAMIC cf-request-id 03d2d87b970000c2dbf103a200000001 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" server cloudflare cf-ray 5afe5d0c2b99c2db-FRA
GET H2	200	ca282a92da89d122d32eecab9a3322388.css paczkgls.com/wTy6QHtFYz25/css/	38 KB 9 KB	100ms 100ms	Stylesheet text/css	2606:4700:3031::681f:5097 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://paczkgls.com/wTy6QHtFYz25/css/ca282a92da89d122d32eecab9a3322388.css Requested by Host: paczkgls.com URL: https://paczkgls.com/wTy6QHtFYz25/gNIaN6 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::681f:5097 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.4.7RC1 Resource Hash `02683507a6490dea422cfa2cf69cc98d50af5509c97721139e745a686404d5b1` Request headers Referer https://paczkgls.com/wTy6QHtFYz25/gNIaN6 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Thu, 09 Jul 2020 01:45:05 GMT content-encoding br cf-cache-status BYPASS server cloudflare x-powered-by PHP/7.4.7RC1 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css;charset=UTF-8 status 200 cache-control no-store, no-cache, must-revalidate cf-ray 5afe5d0efeaec2db-FRA cf-request-id 03d2d87d5a0000c2dbf1064200000001 expires Thu, 19 Nov 1981 08:52:00 GMT
GET H2	200	jquery.js Show response paczkgls.com/wTy6QHtFYz25/	86 KB 30 KB	17ms 17ms	Script application/javascript	2606:4700:3031::681f:5097 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://paczkgls.com/wTy6QHtFYz25/jquery.js Requested by Host: paczkgls.com URL: https://paczkgls.com/wTy6QHtFYz25/gNIaN6 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::681f:5097 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a` Request headers Referer https://paczkgls.com/wTy6QHtFYz25/gNIaN6 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 09 Jul 2020 01:45:05 GMT content-encoding br cf-cache-status HIT last-modified Fri, 06 Mar 2020 13:17:46 GMT server cloudflare age 3103 etag W/"5e624d7a-15851" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/javascript status 200 cache-control max-age=315360000 cf-ray 5afe5d0efeafc2db-FRA cf-request-id 03d2d87d5b0000c2dbf1065200000001 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	59a5cd165ff0aefe52c5ebc0533ab93e.jpg paczkgls.com/wTy6QHtFYz25/css/	59 KB 59 KB	103ms 102ms	Image image/jpeg	2606:4700:3031::681f:5097 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://paczkgls.com/wTy6QHtFYz25/css/59a5cd165ff0aefe52c5ebc0533ab93e.jpg Requested by Host: paczkgls.com URL: https://paczkgls.com/wTy6QHtFYz25/gNIaN6 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::681f:5097 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.4.7RC1 Resource Hash `2003f74945a92c53545ad684f0fd9f51b4c5eee823262fe2dc4e5ae705cd3d3e` Request headers Referer https://paczkgls.com/wTy6QHtFYz25/css/ca282a92da89d122d32eecab9a3322388.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Thu, 09 Jul 2020 01:45:05 GMT cf-cache-status BYPASS server cloudflare x-powered-by PHP/7.4.7RC1 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/jpeg status 200 cache-control no-store, no-cache, must-revalidate cf-ray 5afe5d0fbf86c2db-FRA cf-request-id 03d2d87dd50000c2dbf106e200000001 expires Thu, 19 Nov 1981 08:52:00 GMT
GET H2	200	9884eab69520d5cc24e630aaf8d4301c.png paczkgls.com/wTy6QHtFYz25/css/	5 KB 5 KB	102ms 101ms	Image image/png	2606:4700:3031::681f:5097 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://paczkgls.com/wTy6QHtFYz25/css/9884eab69520d5cc24e630aaf8d4301c.png Requested by Host: paczkgls.com URL: https://paczkgls.com/wTy6QHtFYz25/gNIaN6 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::681f:5097 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.4.7RC1 Resource Hash `97c82cbe5756806a085a5656032cfcf19518f9c5d0f80f5612d15b83897a296c` Request headers Referer https://paczkgls.com/wTy6QHtFYz25/css/ca282a92da89d122d32eecab9a3322388.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Thu, 09 Jul 2020 01:45:05 GMT cf-cache-status BYPASS server cloudflare x-powered-by PHP/7.4.7RC1 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/png status 200 cache-control no-store, no-cache, must-revalidate accept-ranges bytes cf-ray 5afe5d0fbf87c2db-FRA content-length 5442 cf-request-id 03d2d87dd50000c2dbf106f200000001 expires Thu, 19 Nov 1981 08:52:00 GMT
GET H2	200	164361640cb235ffdd99be23669ae01e.png paczkgls.com/wTy6QHtFYz25/css/	135 KB 135 KB	99ms 99ms	Image image/png	2606:4700:3031::681f:5097 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://paczkgls.com/wTy6QHtFYz25/css/164361640cb235ffdd99be23669ae01e.png Requested by Host: paczkgls.com URL: https://paczkgls.com/wTy6QHtFYz25/gNIaN6 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::681f:5097 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.4.7RC1 Resource Hash `7a3cc037a3543d9f2995b2ae5d7b270471d816ea9c091024d62f7a312b7a59fb` Request headers Referer https://paczkgls.com/wTy6QHtFYz25/css/ca282a92da89d122d32eecab9a3322388.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Thu, 09 Jul 2020 01:45:05 GMT cf-cache-status BYPASS server cloudflare x-powered-by PHP/7.4.7RC1 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/png status 200 cache-control no-store, no-cache, must-revalidate cf-ray 5afe5d0fbf88c2db-FRA cf-request-id 03d2d87dd50000c2dbf1070200000001 expires Thu, 19 Nov 1981 08:52:00 GMT
GET H2	200	d8ed08df707c5d0f6b2c2117e8632323.png paczkgls.com/wTy6QHtFYz25/css/	1 KB 2 KB	100ms 99ms	Image image/png	2606:4700:3031::681f:5097 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://paczkgls.com/wTy6QHtFYz25/css/d8ed08df707c5d0f6b2c2117e8632323.png Requested by Host: paczkgls.com URL: https://paczkgls.com/wTy6QHtFYz25/gNIaN6 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::681f:5097 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.4.7RC1 Resource Hash `5cbfe3a894d5bd28df28fbfb55a1d0bc2d8873b1c46bb0f259c2b22204cad002` Request headers Referer https://paczkgls.com/wTy6QHtFYz25/css/ca282a92da89d122d32eecab9a3322388.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Thu, 09 Jul 2020 01:45:05 GMT cf-cache-status BYPASS server cloudflare x-powered-by PHP/7.4.7RC1 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/png status 200 cache-control no-store, no-cache, must-revalidate accept-ranges bytes cf-ray 5afe5d0fbf89c2db-FRA content-length 1393 cf-request-id 03d2d87dd50000c2dbf1071200000001 expires Thu, 19 Nov 1981 08:52:00 GMT
GET H2	200	opensans-regular-webfont.woff paczkgls.com/wTy6QHtFYz25/css/fonts/	87 KB 88 KB	15ms 14ms	Font application/font-woff	2606:4700:3031::681f:5097 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://paczkgls.com/wTy6QHtFYz25/css/fonts/opensans-regular-webfont.woff Requested by Host: paczkgls.com URL: https://paczkgls.com/wTy6QHtFYz25/gNIaN6 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::681f:5097 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `9650a5ba277274205e90974e7fb4183289ca51653c33fc291ad064bf8dd998e1` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://paczkgls.com/wTy6QHtFYz25/css/ca282a92da89d122d32eecab9a3322388.css Origin https://paczkgls.com Response headers date Thu, 09 Jul 2020 01:45:05 GMT content-encoding br cf-cache-status HIT last-modified Sun, 21 Oct 2018 18:37:28 GMT server cloudflare age 3103 etag W/"15de8-578c16db2aa00" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/font-woff status 200 cache-control max-age=14400 cf-ray 5afe5d0fbf8ac2db-FRA cf-request-id 03d2d87dd50000c2dbf1072200000001
GET H2	200	opensans-light-webfont.woff paczkgls.com/wTy6QHtFYz25/css/fonts/	84 KB 84 KB	18ms 17ms	Font application/font-woff	2606:4700:3031::681f:5097 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://paczkgls.com/wTy6QHtFYz25/css/fonts/opensans-light-webfont.woff Requested by Host: paczkgls.com URL: https://paczkgls.com/wTy6QHtFYz25/gNIaN6 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::681f:5097 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `0fe491e2047389b9deb7a06fd36de7fec03af2791ec29461be02571cbebdb4ab` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://paczkgls.com/wTy6QHtFYz25/css/ca282a92da89d122d32eecab9a3322388.css Origin https://paczkgls.com Response headers date Thu, 09 Jul 2020 01:45:05 GMT content-encoding br cf-cache-status HIT last-modified Sun, 21 Oct 2018 18:36:32 GMT server cloudflare age 3103 etag W/"15000-578c16a5c2c00" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/font-woff status 200 cache-control max-age=14400 cf-ray 5afe5d0fcf8cc2db-FRA cf-request-id 03d2d87dd80000c2dbf1073200000001
GET H2	200	opensans-semibold-webfont.woff paczkgls.com/wTy6QHtFYz25/css/fonts/	89 KB 89 KB	17ms 16ms	Font application/font-woff	2606:4700:3031::681f:5097 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://paczkgls.com/wTy6QHtFYz25/css/fonts/opensans-semibold-webfont.woff Requested by Host: paczkgls.com URL: https://paczkgls.com/wTy6QHtFYz25/gNIaN6 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::681f:5097 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `431817115e31ff8604ab76a86ce6ed55d02cd5ea7332bd0ed3d15d9b5bf9aaae` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://paczkgls.com/wTy6QHtFYz25/css/ca282a92da89d122d32eecab9a3322388.css Origin https://paczkgls.com Response headers date Thu, 09 Jul 2020 01:45:05 GMT content-encoding br cf-cache-status HIT last-modified Sun, 21 Oct 2018 18:38:38 GMT server cloudflare age 3103 etag W/"16420-578c171dec780" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/font-woff status 200 cache-control max-age=14400 cf-ray 5afe5d0fcf8dc2db-FRA cf-request-id 03d2d87dd80000c2dbf1074200000001
GET H2	200	PFBeauSansPro-Bold.woff paczkgls.com/wTy6QHtFYz25/css/fonts/	142 KB 135 KB	18ms 17ms	Font application/font-woff	2606:4700:3031::681f:5097 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://paczkgls.com/wTy6QHtFYz25/css/fonts/PFBeauSansPro-Bold.woff Requested by Host: paczkgls.com URL: https://paczkgls.com/wTy6QHtFYz25/gNIaN6 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::681f:5097 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `c8b380cdc92601f7195d0cd34c777bcdee7dcd285e110534a8cf48bfa7d8b2e8` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://paczkgls.com/wTy6QHtFYz25/css/ca282a92da89d122d32eecab9a3322388.css Origin https://paczkgls.com Response headers date Thu, 09 Jul 2020 01:45:05 GMT content-encoding br cf-cache-status HIT last-modified Sun, 21 Oct 2018 18:35:56 GMT server cloudflare age 3103 etag W/"2374c-578c16836db00" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/font-woff status 200 cache-control max-age=14400 cf-ray 5afe5d0fcf8ec2db-FRA cf-request-id 03d2d87dd80000c2dbf1075200000001
POST H2	200	online.php Show response paczkgls.com/wTy6QHtFYz25/	0 132 B	93ms 93ms	XHR text/html	2606:4700:3031::681f:5097 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://paczkgls.com/wTy6QHtFYz25/online.php Requested by Host: paczkgls.com URL: https://paczkgls.com/wTy6QHtFYz25/jquery.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::681f:5097 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.4.7RC1 Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Accept / Referer https://paczkgls.com/wTy6QHtFYz25/gNIaN6 X-Requested-With XMLHttpRequest User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers pragma no-cache date Thu, 09 Jul 2020 01:45:07 GMT content-encoding br cf-cache-status DYNAMIC server cloudflare x-powered-by PHP/7.4.7RC1 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" content-type text/html; charset=UTF-8 status 200 cache-control no-store, no-cache, must-revalidate cf-ray 5afe5d1cbd56c2db-FRA cf-request-id 03d2d885ee0000c2dbf10d8200000001 expires Thu, 19 Nov 1981 08:52:00 GMT
POST H2	200	online.php Show response paczkgls.com/wTy6QHtFYz25/	0 105 B	64ms 63ms	XHR text/html	2606:4700:3031::681f:5097 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://paczkgls.com/wTy6QHtFYz25/online.php Requested by Host: paczkgls.com URL: https://paczkgls.com/wTy6QHtFYz25/jquery.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::681f:5097 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.4.7RC1 Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Accept / Referer https://paczkgls.com/wTy6QHtFYz25/gNIaN6 X-Requested-With XMLHttpRequest User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers pragma no-cache date Thu, 09 Jul 2020 01:45:08 GMT content-encoding br cf-cache-status DYNAMIC server cloudflare x-powered-by PHP/7.4.7RC1 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" content-type text/html; charset=UTF-8 status 200 cache-control no-store, no-cache, must-revalidate cf-ray 5afe5d22ec8fc2db-FRA cf-request-id 03d2d889d40000c2dbf1105200000001 expires Thu, 19 Nov 1981 08:52:00 GMT
POST H2	200	online.php Show response paczkgls.com/wTy6QHtFYz25/	0 108 B	95ms 94ms	XHR text/html	2606:4700:3031::681f:5097 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://paczkgls.com/wTy6QHtFYz25/online.php Requested by Host: paczkgls.com URL: https://paczkgls.com/wTy6QHtFYz25/jquery.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::681f:5097 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.4.7RC1 Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Accept / Referer https://paczkgls.com/wTy6QHtFYz25/gNIaN6 X-Requested-With XMLHttpRequest User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers pragma no-cache date Thu, 09 Jul 2020 01:45:09 GMT content-encoding br cf-cache-status DYNAMIC server cloudflare x-powered-by PHP/7.4.7RC1 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" content-type text/html; charset=UTF-8 status 200 cache-control no-store, no-cache, must-revalidate cf-ray 5afe5d292b37c2db-FRA cf-request-id 03d2d88dbd0000c2dbf112d200000001 expires Thu, 19 Nov 1981 08:52:00 GMT
POST H2	200	online.php Show response paczkgls.com/wTy6QHtFYz25/	0 248 B	58ms 58ms	XHR text/html	2606:4700:3031::681f:5097 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://paczkgls.com/wTy6QHtFYz25/online.php Requested by Host: paczkgls.com URL: https://paczkgls.com/wTy6QHtFYz25/jquery.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::681f:5097 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.4.7RC1 Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Accept / Referer https://paczkgls.com/wTy6QHtFYz25/gNIaN6 X-Requested-With XMLHttpRequest User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers pragma no-cache date Thu, 09 Jul 2020 01:45:10 GMT content-encoding br cf-cache-status DYNAMIC server cloudflare x-powered-by PHP/7.4.7RC1 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" content-type text/html; charset=UTF-8 status 200 cache-control no-store, no-cache, must-revalidate cf-ray 5afe5d2f69c4c2db-FRA cf-request-id 03d2d891a30000c2dbf1158200000001 expires Thu, 19 Nov 1981 08:52:00 GMT
POST H2	200	online.php Show response paczkgls.com/wTy6QHtFYz25/	0 105 B	94ms 93ms	XHR text/html	2606:4700:3031::681f:5097 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://paczkgls.com/wTy6QHtFYz25/online.php Requested by Host: paczkgls.com URL: https://paczkgls.com/wTy6QHtFYz25/jquery.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::681f:5097 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.4.7RC1 Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Accept / Referer https://paczkgls.com/wTy6QHtFYz25/gNIaN6 X-Requested-With XMLHttpRequest User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers pragma no-cache date Thu, 09 Jul 2020 01:45:11 GMT content-encoding br cf-cache-status DYNAMIC server cloudflare x-powered-by PHP/7.4.7RC1 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" content-type text/html; charset=UTF-8 status 200 cache-control no-store, no-cache, must-revalidate cf-ray 5afe5d35a8bfc2db-FRA cf-request-id 03d2d8958b0000c2dbf117a200000001 expires Thu, 19 Nov 1981 08:52:00 GMT
POST H2	200	online.php Show response paczkgls.com/wTy6QHtFYz25/	0 105 B	62ms 62ms	XHR text/html	2606:4700:3031::681f:5097 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://paczkgls.com/wTy6QHtFYz25/online.php Requested by Host: paczkgls.com URL: https://paczkgls.com/wTy6QHtFYz25/jquery.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::681f:5097 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.4.7RC1 Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Accept / Referer https://paczkgls.com/wTy6QHtFYz25/gNIaN6 X-Requested-With XMLHttpRequest User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers pragma no-cache date Thu, 09 Jul 2020 01:45:12 GMT content-encoding br cf-cache-status DYNAMIC server cloudflare x-powered-by PHP/7.4.7RC1 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" content-type text/html; charset=UTF-8 status 200 cache-control no-store, no-cache, must-revalidate cf-ray 5afe5d3bef96c2db-FRA cf-request-id 03d2d899730000c2dbf119c200000001 expires Thu, 19 Nov 1981 08:52:00 GMT
POST H2	200	online.php Show response paczkgls.com/wTy6QHtFYz25/	0 248 B	54ms 54ms	XHR text/html	2606:4700:3031::681f:5097 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://paczkgls.com/wTy6QHtFYz25/online.php Requested by Host: paczkgls.com URL: https://paczkgls.com/wTy6QHtFYz25/jquery.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::681f:5097 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.4.7RC1 Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Accept / Referer https://paczkgls.com/wTy6QHtFYz25/gNIaN6 X-Requested-With XMLHttpRequest User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers pragma no-cache date Thu, 09 Jul 2020 01:45:13 GMT content-encoding br cf-cache-status DYNAMIC server cloudflare x-powered-by PHP/7.4.7RC1 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" content-type text/html; charset=UTF-8 status 200 cache-control no-store, no-cache, must-revalidate cf-ray 5afe5d422ec1c2db-FRA cf-request-id 03d2d89d5b0000c2dbf11bf200000001 expires Thu, 19 Nov 1981 08:52:00 GMT
POST H2	200	online.php Show response paczkgls.com/wTy6QHtFYz25/	0 105 B	97ms 97ms	XHR text/html	2606:4700:3031::681f:5097 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://paczkgls.com/wTy6QHtFYz25/online.php Requested by Host: paczkgls.com URL: https://paczkgls.com/wTy6QHtFYz25/jquery.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::681f:5097 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.4.7RC1 Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Accept / Referer https://paczkgls.com/wTy6QHtFYz25/gNIaN6 X-Requested-With XMLHttpRequest User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers pragma no-cache date Thu, 09 Jul 2020 01:45:14 GMT content-encoding br cf-cache-status DYNAMIC server cloudflare x-powered-by PHP/7.4.7RC1 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" content-type text/html; charset=UTF-8 status 200 cache-control no-store, no-cache, must-revalidate cf-ray 5afe5d486cefc2db-FRA cf-request-id 03d2d8a1430000c2dbf11f2200000001 expires Thu, 19 Nov 1981 08:52:00 GMT
POST H2	200	online.php Show response paczkgls.com/wTy6QHtFYz25/	0 105 B	54ms 53ms	XHR text/html	2606:4700:3031::681f:5097 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://paczkgls.com/wTy6QHtFYz25/online.php Requested by Host: paczkgls.com URL: https://paczkgls.com/wTy6QHtFYz25/jquery.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::681f:5097 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.4.7RC1 Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Accept / Referer https://paczkgls.com/wTy6QHtFYz25/gNIaN6 X-Requested-With XMLHttpRequest User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers pragma no-cache date Thu, 09 Jul 2020 01:45:15 GMT content-encoding br cf-cache-status DYNAMIC server cloudflare x-powered-by PHP/7.4.7RC1 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" content-type text/html; charset=UTF-8 status 200 cache-control no-store, no-cache, must-revalidate cf-ray 5afe5d4eab15c2db-FRA cf-request-id 03d2d8a52b0000c2dbf1219200000001 expires Thu, 19 Nov 1981 08:52:00 GMT
POST H2	200	online.php Show response paczkgls.com/wTy6QHtFYz25/	0 105 B	63ms 62ms	XHR text/html	2606:4700:3031::681f:5097 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://paczkgls.com/wTy6QHtFYz25/online.php Requested by Host: paczkgls.com URL: https://paczkgls.com/wTy6QHtFYz25/jquery.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::681f:5097 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.4.7RC1 Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Accept / Referer https://paczkgls.com/wTy6QHtFYz25/gNIaN6 X-Requested-With XMLHttpRequest User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers pragma no-cache date Thu, 09 Jul 2020 01:45:16 GMT content-encoding br cf-cache-status DYNAMIC server cloudflare x-powered-by PHP/7.4.7RC1 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" content-type text/html; charset=UTF-8 status 200 cache-control no-store, no-cache, must-revalidate cf-ray 5afe5d54e93dc2db-FRA cf-request-id 03d2d8a9130000c2dbf1241200000001 expires Thu, 19 Nov 1981 08:52:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayU (Financial)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery object| e5c36ba1

9 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.paczkgls.com/	1970-01-19 11:34:11	Name: __cfduid Value: d0c785fca08412bd95049a1bfeb04d8821594259104
paczkgls.com/wTy6QHtFYz25	1970-01-19 10:51:02	Name: 43160ab5ee10550947d1c05ad2f351db Value: 2973430595
paczkgls.com/wTy6QHtFYz25	1970-01-19 10:51:02	Name: cc3c92161c0172468bd91f11c912b739 Value: 3583948435
paczkgls.com/wTy6QHtFYz25	1970-01-19 10:51:02	Name: fca3ed8de1b933992ebea12bd2a55a12 Value: 3640331672
paczkgls.com/wTy6QHtFYz25	1970-01-19 10:51:02	Name: 453cc874783062d16f7ef99136ed9cdb Value: 1322040467
paczkgls.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 8v0ero18l2k7p3l67qdjjbvn9p
paczkgls.com/wTy6QHtFYz25	1970-01-19 10:51:02	Name: 05343bfbc67392122db12ef02b87919a Value: 2904749318
paczkgls.com/wTy6QHtFYz25	1970-01-19 10:51:02	Name: 357175c3d3b90f19f965cc9e9bd84a8a Value: 2501048716
paczkgls.com/wTy6QHtFYz25	1970-01-19 10:51:02	Name: a9e508ebb82a50a08e89724dc60a4dd3 Value: 591797976

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

paczkgls.com
2606:4700:3031::681f:5097
02683507a6490dea422cfa2cf69cc98d50af5509c97721139e745a686404d5b1
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
0fe491e2047389b9deb7a06fd36de7fec03af2791ec29461be02571cbebdb4ab
2003f74945a92c53545ad684f0fd9f51b4c5eee823262fe2dc4e5ae705cd3d3e
431817115e31ff8604ab76a86ce6ed55d02cd5ea7332bd0ed3d15d9b5bf9aaae
5cbfe3a894d5bd28df28fbfb55a1d0bc2d8873b1c46bb0f259c2b22204cad002
7a3cc037a3543d9f2995b2ae5d7b270471d816ea9c091024d62f7a312b7a59fb
9650a5ba277274205e90974e7fb4183289ca51653c33fc291ad064bf8dd998e1
97a63147266a46d9bce57cff882c549d529dc94cca49ce1975ee916b3a09a70a
97c82cbe5756806a085a5656032cfcf19518f9c5d0f80f5612d15b83897a296c
c8b380cdc92601f7195d0cd34c777bcdee7dcd285e110534a8cf48bfa7d8b2e8
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

paczkgls.com Open in urlscan Pro 2606:4700:3031::681f:5097 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

21 Requests

100 %HTTPS

100 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

641 kBTransfer

740 kBSize

9 Cookies

0 Outgoing links

Page URL History

Redirected requests

21 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

9 Cookies

Indicators

paczkgls.com Open in urlscan Pro
2606:4700:3031::681f:5097 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

21
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

641 kB
Transfer

740 kB
Size

9
Cookies

21 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!