![](/screenshots/b979a0dc-6256-4423-8915-9a7e74618420.png)
paypayp.xyz
Open in
urlscan Pro
104.21.56.229
Malicious Activity!
Public Scan
Effective URL: https://paypayp.xyz/ap/account/sign-in.php?redirect=%2Fapp%2Faccount%2Fsign-in
Submission: On June 23 via manual from JP — Scanned from JP
Summary
TLS certificate: Issued by GTS CA 1P5 on June 23rd 2023. Valid for: 3 months.
This is the only time paypayp.xyz was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: PayPay (Financial)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 20 | 104.21.56.229 104.21.56.229 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
19 | 1 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
20 |
paypayp.xyz
1 redirects
paypayp.xyz |
161 KB |
19 | 1 |
Domain | Requested by | |
---|---|---|
20 | paypayp.xyz |
1 redirects
paypayp.xyz
|
19 | 1 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.paypay.ne.jp |
id.my.softbank.jp |
Subject Issuer | Validity | Valid | |
---|---|---|---|
paypayp.xyz GTS CA 1P5 |
2023-06-23 - 2023-09-21 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://paypayp.xyz/ap/account/sign-in.php?redirect=%2Fapp%2Faccount%2Fsign-in
Frame ID: C7D80E79E8288E5E3A694D461AE26B56
Requests: 19 HTTP requests in this frame
Screenshot
![](/screenshots/b979a0dc-6256-4423-8915-9a7e74618420.png)
Page Title
PayPayPage URL History Show full URLs
-
https://paypayp.xyz/
HTTP 302
https://paypayp.xyz/ap/account/sign-in.php?redirect=%2Fapp%2Faccount%2Fsign-in Page URL
Detected technologies
Detected patterns
- \.php(?:$|\?)
![](/vendor/wappa/icons/Vue.js.png)
Detected patterns
- <[^>]+\sdata-v(?:ue)?-
Page Statistics
3 Outgoing links
These are links going to different origins than the main page.
Title: パスワードをお忘れですか?
Search URL Search Domain Scan URL
Title: ソフトバンク・ワイモバイル・LINEMO
Search URL Search Domain Scan URL
Title: 新規登録
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://paypayp.xyz/
HTTP 302
https://paypayp.xyz/ap/account/sign-in.php?redirect=%2Fapp%2Faccount%2Fsign-in Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
19 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
sign-in.php
paypayp.xyz/ap/account/ Redirect Chain
|
5 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main-8bc203a9.60f2038a.css
paypayp.xyz/ap/account/ |
57 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main-9ad0f35b.d8ac3a15.css
paypayp.xyz/ap/account/ |
60 KB 10 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main-cf55716b.16ac6807.css
paypayp.xyz/ap/account/ |
3 KB 955 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main-f67099a4.8ac07764.css
paypayp.xyz/ap/account/ |
10 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main-f71cff67.32270868.css
paypayp.xyz/ap/account/ |
81 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main-5a11b65b.ebe4b5b4.css
paypayp.xyz/ap/account/ |
37 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main-6a2c624d.7721e1ae.css
paypayp.xyz/ap/account/ |
44 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
account-page-account-page-otp-account-page-reset-account-page-sign-p2p-page-payout-page-update-page--82301314.d97b4595.css
paypayp.xyz/ap/account/ |
12 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
account-page-f71cff67.e164ceef.css
paypayp.xyz/ap/account/ |
69 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
account-page-6a2c624d.0187df84.css
paypayp.xyz/ap/account/ |
58 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
account-page-sign-f71cff67.0cac6551.css
paypayp.xyz/ap/account/ |
80 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ec79c78c200be43e39fe72fb3ad7b3586e7e4fb9.png
paypayp.xyz/ap/account/ |
9 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
a302f51f5c2a291a1ea1f0e27043530340793d1f.png
paypayp.xyz/ap/account/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
09393ccdc3133f322fd9b7017cbab7e2d42469f4.png
paypayp.xyz/ap/account/ |
2 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
81d870911f167ce21c09d11405b9a3ebbb241205.png
paypayp.xyz/ap/account/ |
2 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
softbank-icon.108c1d32.svg
paypayp.xyz/ap/account/ |
11 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Graphik-Regular-Web.woff2
paypayp.xyz/ap/account/ |
36 KB 36 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Graphik-Semibold-Web.woff2
paypayp.xyz/ap/account/ |
40 KB 40 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: PayPay (Financial)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| onbeforetoggle object| onscrollend1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
paypayp.xyz/ | Name: PHPSESSID Value: dpcs5f73jkh6ml88mv8ag799e2 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
paypayp.xyz
104.21.56.229
026edf5e5d1b243ee3f7df45916d0a5c09fc2512d72752d2fb80f1b27f3bebde
146ea7521ac25baf116c97a600102d200a56333d3843e3eef6e8f3592cdc65ac
19553d56b21c687f197f35a31d29dcefecf7f89d3bf1d702893bde7b79b0f0a9
36f6bcd0769595e638498a6f11410c0260e71e9d446f43f53b62bbba2dd1b411
65c20565308d0d341d95e5c97f67663a5139647605a5c17aff8f510eb06ea0c5
6d6af4eb02113f2c42e53be9ccaa058aa48ac9edc330578e7e923f7cef8af323
6d9477835a788bf110c7d1cf1ff133197c095cef8f74d136213fc0dfc0fe8e9f
74db4fa2e08fe977d4c25a620ea986622d93c9a2a921bc5f20776d39e8b618dd
75d50395d4535c3614451c9983598cc08dc048255e5c559acd4da981ecccc30b
882c93eadef6b4f05100102b215fee8260dc81ec84c78d7d494db7216c542c0b
89905097d8322e6efca6ada94f67b7f7439e4e8682fb70698910e662b4d40df4
8f71df825e0a32e7d05b012e784082aff562461422c255218c7eed1a0021d680
91350a34e5ffb56cf1c50092968964486c865c545011dbca1b7be629b35364fc
96db9ca236e4eadf68ca5c79f1e1725270a5d1344021133441f6c9a9d9e48a93
98febd7fe6feca783c4b50bbe4e18894aa33a05e05efdcb37ada1b0c673ac0d9
a178ee071a1ee70aa076c27a62dde346456c13851e55b4d15da8893c9f545ca5
c1ade0624514e5280d8c56c73897a5017b0c91ce1a7819cbaf5fbf23d0e2d1b0
cc55e9e310dd822673cea86a45f7d8466b5d6c39cb3f82090b04bad93dd86028
edb335f2ea3f9cf1eedc6b15248f6e0d4d90237e4af093f156bfc28c12e17be2