php-gray-insect-marin706063.codeanyapp.com Open in urlscan Pro
138.68.196.6  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://paypay-login.web.app/ Page URL
2. https://php-gray-insect-marin706063.codeanyapp.com/PHP-PAY/ Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	/ Show response paypay-login.web.app/	161 B 479 B	296ms 214ms	Document text/html	2620:0:890::100 FASTLY
General Check archive.org Show headers Download Go to Full URL https://paypay-login.web.app/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2620:0:890::100 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 2fbe176c86e4ef6961a465e99849b621fe35633379791524feda99ebc522ac73 Security Headers Name Value Strict-Transport-Security max-age=31556926; includeSubDomains; preload Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 accept-language en-CA,en;q=0.9 Response headers accept-ranges bytes alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 cache-control max-age=3600 content-encoding br content-length 113 content-type text/html; charset=utf-8 date Thu, 13 Oct 2022 07:21:50 GMT etag "eddea71006aeabf7448f82e2dff224bcb7ab561e8ad56ba38b2c9ebb2d76be3e-br" last-modified Wed, 12 Oct 2022 10:34:06 GMT strict-transport-security max-age=31556926; includeSubDomains; preload vary x-fh-requested-host, accept-encoding x-cache MISS x-cache-hits 0 x-served-by cache-yul12833-YUL x-timer S1665645710.062138,VS0,VE200
GET H2	200	Primary Request / Show response php-gray-insect-marin706063.codeanyapp.com/PHP-PAY/	7 KB 2 KB	1824ms 1636ms	Document text/html	138.68.196.6 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://php-gray-insect-marin706063.codeanyapp.com/PHP-PAY/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 138.68.196.6 San Francisco, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software openresty / Resource Hash 714924aa5849b3dce832baeb19822541ce813501b9ede08a1a70171a278c2a40 Request headers Referer https://paypay-login.web.app/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 accept-language en-CA,en;q=0.9 Response headers content-encoding gzip content-length 2312 content-type text/html; charset=UTF-8 date Thu, 13 Oct 2022 07:08:12 GMT server openresty vary Accept-Encoding
GET H2	200	style.css php-gray-insect-marin706063.codeanyapp.com/PHP-PAY/files/	570 KB 51 KB	240ms 239ms	Stylesheet text/css	138.68.196.6 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://php-gray-insect-marin706063.codeanyapp.com/PHP-PAY/files/style.css Requested by Host: php-gray-insect-marin706063.codeanyapp.com URL: https://php-gray-insect-marin706063.codeanyapp.com/PHP-PAY/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 138.68.196.6 San Francisco, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software openresty / Resource Hash 271483ff115f1d8d00a4e5af29492f9472eb8d61b7b9fe9540b3fef2da439c46 Request headers accept-language en-CA,en;q=0.9 Referer https://php-gray-insect-marin706063.codeanyapp.com/PHP-PAY/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers date Thu, 13 Oct 2022 07:08:12 GMT content-encoding gzip last-modified Wed, 12 Oct 2022 10:32:26 GMT server openresty etag "8e75e-5ead3e8add435-gzip" vary Accept-Encoding content-type text/css accept-ranges bytes content-length 52167
GET H2	200	mysb-common.css php-gray-insect-marin706063.codeanyapp.com/PHP-PAY/files/	26 KB 4 KB	222ms 221ms	Stylesheet text/css	138.68.196.6 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://php-gray-insect-marin706063.codeanyapp.com/PHP-PAY/files/mysb-common.css Requested by Host: php-gray-insect-marin706063.codeanyapp.com URL: https://php-gray-insect-marin706063.codeanyapp.com/PHP-PAY/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 138.68.196.6 San Francisco, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software openresty / Resource Hash 34490be0d137fbf3c8eab428f80eee22f2db270269fa77cda79a45f62ec078db Request headers accept-language en-CA,en;q=0.9 Referer https://php-gray-insect-marin706063.codeanyapp.com/PHP-PAY/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers date Thu, 13 Oct 2022 07:08:12 GMT content-encoding gzip last-modified Wed, 12 Oct 2022 10:32:26 GMT server openresty etag "6622-5ead3e8adc495-gzip" vary Accept-Encoding content-type text/css accept-ranges bytes content-length 3524
GET H2	200	mysb-temporary.css php-gray-insect-marin706063.codeanyapp.com/PHP-PAY/files/	16 KB 3 KB	217ms 215ms	Stylesheet text/css	138.68.196.6 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://php-gray-insect-marin706063.codeanyapp.com/PHP-PAY/files/mysb-temporary.css Requested by Host: php-gray-insect-marin706063.codeanyapp.com URL: https://php-gray-insect-marin706063.codeanyapp.com/PHP-PAY/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 138.68.196.6 San Francisco, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software openresty / Resource Hash f1e19bd154073314cc4ce16028127cd06ffb48cae2a66c65dd1cf47c6355f450 Request headers accept-language en-CA,en;q=0.9 Referer https://php-gray-insect-marin706063.codeanyapp.com/PHP-PAY/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers date Thu, 13 Oct 2022 07:08:12 GMT content-encoding gzip last-modified Wed, 12 Oct 2022 10:32:26 GMT server openresty etag "418e-5ead3e8adc495-gzip" vary Accept-Encoding content-type text/css accept-ranges bytes content-length 2973
GET H2	200	notice_pcidss_y_tls.css php-gray-insect-marin706063.codeanyapp.com/PHP-PAY/files/	942 B 576 B	217ms 216ms	Stylesheet text/css	138.68.196.6 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://php-gray-insect-marin706063.codeanyapp.com/PHP-PAY/files/notice_pcidss_y_tls.css Requested by Host: php-gray-insect-marin706063.codeanyapp.com URL: https://php-gray-insect-marin706063.codeanyapp.com/PHP-PAY/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 138.68.196.6 San Francisco, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software openresty / Resource Hash d0c2052c335ebd4fe737d074f3a670b9a2e4c453e09de002ac565c19a1b2cc23 Request headers accept-language en-CA,en;q=0.9 Referer https://php-gray-insect-marin706063.codeanyapp.com/PHP-PAY/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers date Thu, 13 Oct 2022 07:08:12 GMT content-encoding gzip last-modified Wed, 12 Oct 2022 10:32:26 GMT server openresty etag "3ae-5ead3e8adc495-gzip" vary Accept-Encoding content-type text/css accept-ranges bytes content-length 392
GET H2	200	translateelement.css php-gray-insect-marin706063.codeanyapp.com/PHP-PAY/files/	18 KB 4 KB	233ms 232ms	Stylesheet text/css	138.68.196.6 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://php-gray-insect-marin706063.codeanyapp.com/PHP-PAY/files/translateelement.css Requested by Host: php-gray-insect-marin706063.codeanyapp.com URL: https://php-gray-insect-marin706063.codeanyapp.com/PHP-PAY/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 138.68.196.6 San Francisco, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software openresty / Resource Hash d39ee51a9c2d61184a78111c731cce4b32488c99bcc9b1f8c236705d06145166 Request headers accept-language en-CA,en;q=0.9 Referer https://php-gray-insect-marin706063.codeanyapp.com/PHP-PAY/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers date Thu, 13 Oct 2022 07:08:12 GMT content-encoding gzip last-modified Wed, 12 Oct 2022 10:32:26 GMT server openresty etag "4924-5ead3e8add435-gzip" vary Accept-Encoding content-type text/css accept-ranges bytes content-length 3655
GET H/1.1	200 OK	main_logo.png login.paypay-bank.co.jp/commontpl/images/	5 KB 5 KB	722ms 524ms	Image image/png	23.1.205.93 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://login.paypay-bank.co.jp/commontpl/images/main_logo.png Requested by Host: php-gray-insect-marin706063.codeanyapp.com URL: https://php-gray-insect-marin706063.codeanyapp.com/PHP-PAY/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 23.1.205.93 Edison, United States, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-1-205-93.deploy.static.akamaitechnologies.com Software / Resource Hash 49cc5f6a48d5342d35aaa1439f849074f9da36d24ac4c36f5096059bd9d12560 Request headers accept-language en-CA,en;q=0.9 Referer https://php-gray-insect-marin706063.codeanyapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers Date Thu, 13 Oct 2022 07:21:52 GMT Last-Modified Sun, 04 Apr 2021 12:41:33 GMT Connection keep-alive Accept-Ranges bytes ETag "dc5d8-12ec-e6a73940" Content-Length 4844 Content-Type image/png
GET H2	200	site-logo.png php-gray-insect-marin706063.codeanyapp.com/PHP-PAY/files/	3 KB 3 KB	279ms 278ms	Image image/png	138.68.196.6 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://php-gray-insect-marin706063.codeanyapp.com/PHP-PAY/files/site-logo.png Requested by Host: php-gray-insect-marin706063.codeanyapp.com URL: https://php-gray-insect-marin706063.codeanyapp.com/PHP-PAY/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 138.68.196.6 San Francisco, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software openresty / Resource Hash df3d1608e4ab20082b5556e209ea790f16cfaabe519e1f26d4f23986191c967c Request headers accept-language en-CA,en;q=0.9 Referer https://php-gray-insect-marin706063.codeanyapp.com/PHP-PAY/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers date Thu, 13 Oct 2022 07:08:12 GMT last-modified Wed, 12 Oct 2022 10:32:26 GMT server openresty accept-ranges bytes etag "a85-5ead3e8adc495" content-length 2693 content-type image/png
GET H2	200	switch_blind.png php-gray-insect-marin706063.codeanyapp.com/PHP-PAY/files/	261 B 407 B	279ms 279ms	Image image/png	138.68.196.6 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://php-gray-insect-marin706063.codeanyapp.com/PHP-PAY/files/switch_blind.png Requested by Host: php-gray-insect-marin706063.codeanyapp.com URL: https://php-gray-insect-marin706063.codeanyapp.com/PHP-PAY/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 138.68.196.6 San Francisco, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software openresty / Resource Hash 84c682ba3502718b4d5022a461d4d2ed1c162ab2d28d6aad64f8ff807309c9d4 Request headers accept-language en-CA,en;q=0.9 Referer https://php-gray-insect-marin706063.codeanyapp.com/PHP-PAY/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers date Thu, 13 Oct 2022 07:08:12 GMT last-modified Wed, 12 Oct 2022 10:32:26 GMT server openresty accept-ranges bytes etag "105-5ead3e8add435" content-length 261 content-type image/png
GET H2	404	bg_switch_blind.png php-gray-insect-marin706063.codeanyapp.com/img/shared/	337 B 337 B	213ms 213ms	Image text/html	138.68.196.6 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://php-gray-insect-marin706063.codeanyapp.com/img/shared/bg_switch_blind.png Requested by Host: php-gray-insect-marin706063.codeanyapp.com URL: https://php-gray-insect-marin706063.codeanyapp.com/PHP-PAY/files/mysb-temporary.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 138.68.196.6 San Francisco, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software openresty / Resource Hash 8b2ea6434e186cff4c26964c423d67a4ebaf14ff9865dd5fe82ffa798ea446b0 Request headers accept-language en-CA,en;q=0.9 Referer https://php-gray-insect-marin706063.codeanyapp.com/PHP-PAY/files/mysb-temporary.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers date Thu, 13 Oct 2022 07:08:12 GMT server openresty content-length 337 content-type text/html; charset=iso-8859-1

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPay (Financial)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://php-gray-insect-marin706063.codeanyapp.com/img/shared/bg_switch_blind.png Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

login.paypay-bank.co.jp
paypay-login.web.app
php-gray-insect-marin706063.codeanyapp.com
138.68.196.6
23.1.205.93
2620:0:890::100
271483ff115f1d8d00a4e5af29492f9472eb8d61b7b9fe9540b3fef2da439c46
2fbe176c86e4ef6961a465e99849b621fe35633379791524feda99ebc522ac73
34490be0d137fbf3c8eab428f80eee22f2db270269fa77cda79a45f62ec078db
49cc5f6a48d5342d35aaa1439f849074f9da36d24ac4c36f5096059bd9d12560
714924aa5849b3dce832baeb19822541ce813501b9ede08a1a70171a278c2a40
84c682ba3502718b4d5022a461d4d2ed1c162ab2d28d6aad64f8ff807309c9d4
8b2ea6434e186cff4c26964c423d67a4ebaf14ff9865dd5fe82ffa798ea446b0
d0c2052c335ebd4fe737d074f3a670b9a2e4c453e09de002ac565c19a1b2cc23
d39ee51a9c2d61184a78111c731cce4b32488c99bcc9b1f8c236705d06145166
df3d1608e4ab20082b5556e209ea790f16cfaabe519e1f26d4f23986191c967c
f1e19bd154073314cc4ce16028127cd06ffb48cae2a66c65dd1cf47c6355f450