urlscan.io logo urlscan.io
SecurityTrails logo

paypal.saffsolution.com Open in urlscan Pro
45.13.255.56  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://paypal.saffsolution.com/signin/?r4e9nXEg0o2BdpmK1UuNsDxcwtRC6VfFhvMyL7GAiY
Submission: On August 26 via api from JP — Scanned from SG
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 7 HTTP transactions. The main IP is 45.13.255.56, located in Singapore and belongs to AS-HOSTINGER, CY. The main domain is paypal.saffsolution.com.
TLS certificate: Issued by R3 on August 23rd 2023. Valid for: 3 months.
This is the only time paypal.saffsolution.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: PayPal (Financial)

Domain & IP information

IP Address AS Autonomous System
2 45.13.255.56 47583 (AS-HOSTINGER)
5 151.101.2.133 54113 (FASTLY)
7 2
Apex Domain
Subdomains		 Transfer
5 paypalobjects.com
www.paypalobjects.com — Cisco Umbrella Rank: 2518
48 KB
2 saffsolution.com
paypal.saffsolution.com
30 KB
7 2
Domain Requested by
5 www.paypalobjects.com paypal.saffsolution.com
2 paypal.saffsolution.com paypal.saffsolution.com
7 2

This site contains no links.

Subject Issuer Validity Valid
*.saffsolution.com
R3		 2023-08-23 -
2023-11-21		 3 months crt.sh
www.paypalobjects.com
DigiCert SHA2 Extended Validation Server CA		 2022-10-13 -
2023-11-13		 a year crt.sh

This page contains 1 frames:

Primary Page: https://paypal.saffsolution.com/signin/?r4e9nXEg0o2BdpmK1UuNsDxcwtRC6VfFhvMyL7GAiY
Frame ID: 9D2CD7D7E939B5880CAE7F7885B04553
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Log in to your PayPal account

Detected technologies

Overall confidence: 100%
Detected patterns
  • paypalobjects\.com

Page Statistics

7
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

79 kB
Transfer

234 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
paypal.saffsolution.com/signin/ 		43 KB
9 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://paypal.saffsolution.com/signin/?r4e9nXEg0o2BdpmK1UuNsDxcwtRC6VfFhvMyL7GAiY
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.13.255.56 , Singapore, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
srv74.niagahoster.com
Software
LiteSpeed / Niagahoster
Resource Hash
134c52fab43c724d7168f488477d3bef5528e872c92f322b3df53e87b80bdeaf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
accept-language
zh-SG,zh;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
cache-control
no-store, no-cache, must-revalidate
content-encoding
br
content-length
9239
content-type
text/html; charset=UTF-8
date
Sat, 26 Aug 2023 00:33:21 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
pragma
no-cache
server
LiteSpeed
strict-transport-security
max-age=31536000; includeSubDomains; preload
vary
Accept-Encoding,User-Agent
x-content-type-options
nosniff
x-powered-by
Niagahoster
x-xss-protection
1; mode=block
contextualLoginElementalUIv2.css
paypal.saffsolution.com/assets/ 		144 KB
21 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://paypal.saffsolution.com/assets/contextualLoginElementalUIv2.css
Requested by
Host: paypal.saffsolution.com
URL: https://paypal.saffsolution.com/signin/?r4e9nXEg0o2BdpmK1UuNsDxcwtRC6VfFhvMyL7GAiY
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.13.255.56 , Singapore, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
srv74.niagahoster.com
Software
LiteSpeed / Niagahoster
Resource Hash
0d35c23a6813d07463bdda22d4c0ddc4c96e56ad8d68312c97249acf672724a4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://paypal.saffsolution.com/signin/?r4e9nXEg0o2BdpmK1UuNsDxcwtRC6VfFhvMyL7GAiY
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Sat, 26 Aug 2023 00:33:21 GMT
content-encoding
br
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains; preload
last-modified
Wed, 23 Aug 2023 21:25:38 GMT
server
LiteSpeed
x-powered-by
Niagahoster
vary
Accept-Encoding,User-Agent
content-type
text/css
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
21331
x-xss-protection
1; mode=block
expires
Sat, 02 Sep 2023 00:33:21 GMT
icon-PN-check.png
www.paypalobjects.com/images/shared/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.paypalobjects.com/images/shared/icon-PN-check.png
Requested by
Host: paypal.saffsolution.com
URL: https://paypal.saffsolution.com/signin/?r4e9nXEg0o2BdpmK1UuNsDxcwtRC6VfFhvMyL7GAiY
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
d2847bea03b68a100caf41aca4d972b58368b4ee956ab13dde15963d905d7c24
Security Headers
Name Value
Strict-Transport-Security max-age=31557600
X-Content-Type-Options nosniff

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://paypal.saffsolution.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Sat, 26 Aug 2023 00:33:21 GMT
via
1.1 varnish, 1.1 varnish
x-content-type-options
nosniff
strict-transport-security
max-age=31557600
x-cache
HIT, HIT
fastly-io-info
ifsz=2236 idim=121x133 ifmt=png ofsz=1238 odim=121x133 ofmt=png
paypal-debug-id
2f1988aaad88e
fastly-stats
io=1
dc
ccg11-origin-www-1.paypal.com
content-length
1238
x-served-by
cache-sjc10049-SJC, cache-fra-etou8220113-FRA
traceparent
00-00000000000000000002f1988aaad88e-3a26b9f93980853b-01
x-timer
S1693010002.797702,VS0,VE0
etag
"AZ9t6rGehi9y9p2ujcSqSNvZMxyQoMNWEtWl7+WNPx4"
content-type
image/png
cache-control
s-maxage=31536000, public,max-age=3600
accept-ranges
bytes
timing-allow-origin
https://www.paypal.com,https://www.sandbox.paypal.com
x-cache-hits
11602, 3060
glyph_alert_critical_big-2x.png
www.paypalobjects.com/images/shared/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.paypalobjects.com/images/shared/glyph_alert_critical_big-2x.png
Requested by
Host: paypal.saffsolution.com
URL: https://paypal.saffsolution.com/signin/?r4e9nXEg0o2BdpmK1UuNsDxcwtRC6VfFhvMyL7GAiY
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
4b16c98214d45bedb1513b7fd53a02ce204f6a2091a920c3122fb213168c3139
Security Headers
Name Value
Strict-Transport-Security max-age=31557600
X-Content-Type-Options nosniff

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://paypal.saffsolution.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Sat, 26 Aug 2023 00:33:21 GMT
via
1.1 varnish, 1.1 varnish
x-content-type-options
nosniff
strict-transport-security
max-age=31557600
x-cache
HIT, HIT
fastly-io-info
ifsz=5828 idim=224x200 ifmt=png ofsz=1709 odim=224x200 ofmt=png
paypal-debug-id
e0287765cd4e8
fastly-stats
io=1
dc
ccg11-origin-www-1.paypal.com
content-length
1709
x-served-by
cache-sjc1000122-SJC, cache-fra-etou8220113-FRA
traceparent
00-0000000000000000000e0287765cd4e8-8467b18d29b0d51c-01
x-timer
S1693010002.797703,VS0,VE0
etag
"54TnxcBfLRSyR73KAV5h/BoItPuzb0nSBaEwWisdsl4"
content-type
image/png
cache-control
s-maxage=31536000, public,max-age=3600
accept-ranges
bytes
timing-allow-origin
https://www.paypal.com,https://www.sandbox.paypal.com
x-cache-hits
4677, 3067
paypal-mark-color.svg
www.paypalobjects.com/paypal-ui/logos/svg/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.paypalobjects.com/paypal-ui/logos/svg/paypal-mark-color.svg
Requested by
Host: paypal.saffsolution.com
URL: https://paypal.saffsolution.com/assets/contextualLoginElementalUIv2.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
f9035e34f5734e89ddb03b601b1c0fd58323a93f176c5c7e220d7aa7a2062ed5
Security Headers
Name Value
Strict-Transport-Security max-age=31557600
X-Content-Type-Options nosniff

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://paypal.saffsolution.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Sat, 26 Aug 2023 00:33:21 GMT
via
1.1 varnish, 1.1 varnish
x-content-type-options
nosniff
strict-transport-security
max-age=31557600
x-cache
HIT, HIT
paypal-debug-id
2a05f83d28e8b
dc
ccg11-origin-www-1.paypal.com
content-length
1078
x-served-by
cache-sjc10044-SJC, cache-fra-etou8220113-FRA
last-modified
Wed, 15 Jun 2022 22:33:20 GMT
traceparent
00-00000000000000000002a05f83d28e8b-04274758ebe2a514-01
x-timer
S1693010002.797562,VS0,VE0
etag
"62aa5e30-436"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
s-maxage=31536000, public,max-age=3600
accept-ranges
bytes
timing-allow-origin
https://www.paypal.com,https://www.sandbox.paypal.com
x-cache-hits
6444, 2940
PayPalSansBig-Regular.woff2
www.paypalobjects.com/paypal-ui/fonts/ 		25 KB
25 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.paypalobjects.com/paypal-ui/fonts/PayPalSansBig-Regular.woff2
Requested by
Host: paypal.saffsolution.com
URL: https://paypal.saffsolution.com/assets/contextualLoginElementalUIv2.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
1f70ff447ed799a34f4c3ae37ef1f49ed4af71123ba2c2aefe354565354284be
Security Headers
Name Value
Strict-Transport-Security max-age=31557600
X-Content-Type-Options nosniff

Request headers

Referer
https://paypal.saffsolution.com/
Origin
https://paypal.saffsolution.com
accept-language
zh-SG,zh;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Sat, 26 Aug 2023 00:33:21 GMT
via
1.1 varnish, 1.1 varnish
x-content-type-options
nosniff
strict-transport-security
max-age=31557600
x-cache
HIT, HIT
paypal-debug-id
92223fcebd019
dc
ccg11-origin-www-1.paypal.com
content-length
25368
x-served-by
cache-sjc10069-SJC, cache-fra-etou8220056-FRA
last-modified
Sat, 13 Feb 2021 00:27:06 GMT
traceparent
00-000000000000000000092223fcebd019-80ccb4a4d8dcab77-01
x-timer
S1693010002.824124,VS0,VE0
etag
"60271cda-6318"
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
s-maxage=31536000, public,max-age=3600
accept-ranges
bytes
timing-allow-origin
https://www.paypal.com,https://www.sandbox.paypal.com
x-cache-hits
28037, 4053
PayPalSansBig-Medium.woff2
www.paypalobjects.com/paypal-ui/fonts/ 		18 KB
18 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.paypalobjects.com/paypal-ui/fonts/PayPalSansBig-Medium.woff2
Requested by
Host: paypal.saffsolution.com
URL: https://paypal.saffsolution.com/assets/contextualLoginElementalUIv2.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
2ae6779c6c3579643ab6deb5cfb822e843bf637d006a4ec25d9857ec7fb6d8c1
Security Headers
Name Value
Strict-Transport-Security max-age=31557600
X-Content-Type-Options nosniff

Request headers

Referer
https://paypal.saffsolution.com/
Origin
https://paypal.saffsolution.com
accept-language
zh-SG,zh;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Sat, 26 Aug 2023 00:33:21 GMT
via
1.1 varnish, 1.1 varnish
x-content-type-options
nosniff
strict-transport-security
max-age=31557600
x-cache
HIT, HIT
paypal-debug-id
2bf271596580
dc
ccg11-origin-www-1.paypal.com
content-length
18508
x-served-by
cache-sjc10026-SJC, cache-fra-etou8220056-FRA
last-modified
Sat, 13 Feb 2021 00:27:06 GMT
x-timer
S1693010002.824171,VS0,VE0
etag
"60271cda-484c"
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
s-maxage=31536000, public,max-age=3600
accept-ranges
bytes
timing-allow-origin
https://www.paypal.com,https://www.sandbox.paypal.com
x-cache-hits
1, 3573

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture

1 Cookies

Domain/Path Name / Value
paypal.saffsolution.com/ Name: PHPSESSID
Value: b91b096eac2cd1bccdf55dcd209cd5e2

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block