urdugb.com Open in urlscan Pro
23.94.187.130 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://urdugb.com/modules/Direction/88b70c33c0ab2b4a6a9a48bc692618d7/en_US/i/scr/1FDC481GF-T1Y34VC6X-C61XW2GFD/9ac...
Submission: On August 19 via api (August 19th 2019, 9:03:13 pm UTC) from US

Summary HTTP 12 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 3 domains to perform 12 HTTP transactions. The main IP is 23.94.187.130, located in Buffalo, United States and belongs to AS-COLOCROSSING - ColoCrossing, US. The main domain is urdugb.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on July 13th 2019. Valid for: 3 months.

This is the only time urdugb.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: PayPal (Financial)

Domain & IP information

	IP Address	AS Autonomous System
8	23.94.187.130 23.94.187.130	36352 (AS-COLOCR...) (AS-COLOCROSSING - ColoCrossing)
1 2	66.117.29.228 66.117.29.228	15224 (OMNITURE) (OMNITURE - Adobe Systems Inc.)
12	3

8 23.94.187.130 (Buffalo, United States)

ASN36352 (AS-COLOCROSSING - ColoCrossing, US)
PTR: jupiter.globalhostingservers.com

urdugb.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 66.117.29.228 (United States) 1 redirects

ASN15224 (OMNITURE - Adobe Systems Inc., US)

paypal.112.2o7.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	urdugb.com urdugb.com	42 KB
2	2o7.net 1 redirects paypal.112.2o7.net	2 KB
0	paypalobjects.com Failed www.paypalobjects.com Failed
12	3

	Domain	Requested by
8	urdugb.com	urdugb.com
2	paypal.112.2o7.net	1 redirects urdugb.com
0	www.paypalobjects.com Failed	urdugb.com
12	3

This site contains links to these domains. Also see Links.

Domain
www.paypal.com

Subject Issuer	Validity	Valid
urdugb.com cPanel, Inc. Certification Authority	`2019-07-13` - `2019-10-11`	3 months	crt.sh
*.112.2o7.net DigiCert SHA2 High Assurance Server CA	`2019-04-23` - `2021-04-27`	2 years	crt.sh

This page contains 1 frames:

Primary Page: https://urdugb.com/modules/Direction/88b70c33c0ab2b4a6a9a48bc692618d7/en_US/i/scr/1FDC481GF-T1Y34VC6X-C61XW2GFD/9ac3d7a48d7bde6ad9e57d59218c6ae1/Connexion.php
Frame ID: 9BFCDECEB4BAB776176425695D8E1597
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

LiteSpeed (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /^LiteSpeed$/i

Page Statistics

12
Requests

75 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

43 kB
Transfer

154 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.paypal.com/fr/cgi-bin/webscr?cmd=_home

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 10

https://paypal.112.2o7.net/b/ss/paypalglobal/1/H.19.3/s3737016373898?AQB=1&ndh=1&t=19/7/2019%2023%3A2%3A36%201%20-120&ce=UTF-8&ns=paypal&pageName=p/gen/cnf/email-password%3A%3A_ece&g=https%3A//urdugb.com/modules/direction/88b70c33c0ab2b4a6a9a48bc692618d7/en_us/i/scr/1fdc481gf-t1y34vc6x-c61xw2gfd/9ac3d7a48d7bde6ad9e57d59218c6ae1/connexion.php&cc=USD&ch=p/gen/cnf/email-password&c1=p/gen/cnf/email-password&c7=unknown&c8=unknown&c9=unknown&c10=fr&c17=pp-mot%20de%20passe%20-%20paypal-pp&c19=p/gen/cnf/email-password%3A%3A_ece&c30=value%20not%20set&c31=value%20not%20set&c34=paypalcredit%3Aservicing%3Aco%3Anotransactions&c36=https%3A//urdugb.com/modules/direction/88b70c33c0ab2b4a6a9a48bc692618d7/en_us/i/scr/1fdc481gf-t1y34vc6&c47=p/gen/cnf/email-password%3A%3A_ece&c50=fr_fr&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1 HTTP 302
https://paypal.112.2o7.net/b/ss/paypalglobal/1/H.19.3/s3737016373898?AQB=1&pccr=true&vidn=2EAD87378530876E-4000030640002F78&&ndh=1&t=19/7/2019%2023%3A2%3A36%201%20-120&ce=UTF-8&ns=paypal&pageName=p/gen/cnf/email-password%3A%3A_ece&g=https%3A//urdugb.com/modules/direction/88b70c33c0ab2b4a6a9a48bc692618d7/en_us/i/scr/1fdc481gf-t1y34vc6x-c61xw2gfd/9ac3d7a48d7bde6ad9e57d59218c6ae1/connexion.php&cc=USD&ch=p/gen/cnf/email-password&c1=p/gen/cnf/email-password&c7=unknown&c8=unknown&c9=unknown&c10=fr&c17=pp-mot%20de%20passe%20-%20paypal-pp&c19=p/gen/cnf/email-password%3A%3A_ece&c30=value%20not%20set&c31=value%20not%20set&c34=paypalcredit%3Aservicing%3Aco%3Anotransactions&c36=https%3A//urdugb.com/modules/direction/88b70c33c0ab2b4a6a9a48bc692618d7/en_us/i/scr/1fdc481gf-t1y34vc6&c47=p/gen/cnf/email-password%3A%3A_ece&c50=fr_fr&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1

12 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request Connexion.php Show response
urdugb.com/modules/Direction/88b70c33c0ab2b4a6a9a48bc692618d7/en_US/i/scr/1FDC481GF-T1Y34VC6X-C61XW2GFD/9ac3d7a48d7bde6ad9e57d59218c6ae1/ 9 KB
3 KB 542ms
214ms Document
text/html 23.94.187.130
ColoCrossing

General

Check archive.org

Show headers Download Go to

Full URL: https://urdugb.com/modules/Direction/88b70c33c0ab2b4a6a9a48bc692618d7/en_US/i/scr/1FDC481GF-T1Y34VC6X-C61XW2GFD/9ac3d7a48d7bde6ad9e57d59218c6ae1/Connexion.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.94.187.130 Buffalo, United States, ASN36352 (AS-COLOCROSSING - ColoCrossing, US),
Reverse DNS: jupiter.globalhostingservers.com
Software: LiteSpeed /
Resource Hash: ce4b0a4502fc96a42e924e9ef518d3c181355d4558f84ab75435c63b88cff89c

Request headers

:method: GET
:authority: urdugb.com
:scheme: https
:path: /modules/Direction/88b70c33c0ab2b4a6a9a48bc692618d7/en_US/i/scr/1FDC481GF-T1Y34VC6X-C61XW2GFD/9ac3d7a48d7bde6ad9e57d59218c6ae1/Connexion.php
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode: navigate
sec-fetch-user: ?1
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: none
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1

Response headers

status: 200
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
content-length: 3321
content-encoding: gzip
date: Mon, 19 Aug 2019 21:02:35 GMT
accept-ranges: bytes
server: LiteSpeed
alt-svc: quic=":443"; ma=2592000; v="35,37,38,39"

GET
H2 200 global.css
urdugb.com/modules/Direction/88b70c33c0ab2b4a6a9a48bc692618d7/en_US/i/scr/1FDC481GF-T1Y34VC6X-C61XW2GFD/9ac3d7a48d7bde6ad9e57d59218c6ae1/files/ 60 KB
8 KB 105ms
102ms Stylesheet
text/css 23.94.187.130
ColoCrossing

General

Check archive.org

Show headers Download Go to

Full URL: https://urdugb.com/modules/Direction/88b70c33c0ab2b4a6a9a48bc692618d7/en_US/i/scr/1FDC481GF-T1Y34VC6X-C61XW2GFD/9ac3d7a48d7bde6ad9e57d59218c6ae1/files/global.css
Requested by: Host: urdugb.com
URL: https://urdugb.com/modules/Direction/88b70c33c0ab2b4a6a9a48bc692618d7/en_US/i/scr/1FDC481GF-T1Y34VC6X-C61XW2GFD/9ac3d7a48d7bde6ad9e57d59218c6ae1/Connexion.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.94.187.130 Buffalo, United States, ASN36352 (AS-COLOCROSSING - ColoCrossing, US),
Reverse DNS: jupiter.globalhostingservers.com
Software: LiteSpeed /
Resource Hash: ccf27823816dd9c1674beca235d07d1c65a2dd95ac3e7ec1dbdde0256454bd0f

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://urdugb.com/modules/Direction/88b70c33c0ab2b4a6a9a48bc692618d7/en_US/i/scr/1FDC481GF-T1Y34VC6X-C61XW2GFD/9ac3d7a48d7bde6ad9e57d59218c6ae1/Connexion.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 21:02:36 GMT
content-encoding: br
last-modified: Mon, 19 Aug 2019 16:29:31 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="35,37,38,39"
content-length: 8126
expires: Mon, 26 Aug 2019 21:02:36 GMT

GET
H2 200 country.css
urdugb.com/modules/Direction/88b70c33c0ab2b4a6a9a48bc692618d7/en_US/i/scr/1FDC481GF-T1Y34VC6X-C61XW2GFD/9ac3d7a48d7bde6ad9e57d59218c6ae1/files/ 30 B
70 B 105ms
102ms Stylesheet
text/css 23.94.187.130
ColoCrossing

General

Check archive.org

Show headers Download Go to

Full URL: https://urdugb.com/modules/Direction/88b70c33c0ab2b4a6a9a48bc692618d7/en_US/i/scr/1FDC481GF-T1Y34VC6X-C61XW2GFD/9ac3d7a48d7bde6ad9e57d59218c6ae1/files/country.css
Requested by: Host: urdugb.com
URL: https://urdugb.com/modules/Direction/88b70c33c0ab2b4a6a9a48bc692618d7/en_US/i/scr/1FDC481GF-T1Y34VC6X-C61XW2GFD/9ac3d7a48d7bde6ad9e57d59218c6ae1/Connexion.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.94.187.130 Buffalo, United States, ASN36352 (AS-COLOCROSSING - ColoCrossing, US),
Reverse DNS: jupiter.globalhostingservers.com
Software: LiteSpeed /
Resource Hash: c36bef44937289a54acc239aac93f322ac2f1bf4e880e050d4ad80473a16ca4b

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://urdugb.com/modules/Direction/88b70c33c0ab2b4a6a9a48bc692618d7/en_US/i/scr/1FDC481GF-T1Y34VC6X-C61XW2GFD/9ac3d7a48d7bde6ad9e57d59218c6ae1/Connexion.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 21:02:36 GMT
last-modified: Mon, 19 Aug 2019 16:29:31 GMT
server: LiteSpeed
content-type: text/css
status: 200
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="35,37,38,39"
content-length: 30
expires: Mon, 26 Aug 2019 21:02:36 GMT

GET
H2 200 global.js Show response
urdugb.com/modules/Direction/88b70c33c0ab2b4a6a9a48bc692618d7/en_US/i/scr/1FDC481GF-T1Y34VC6X-C61XW2GFD/9ac3d7a48d7bde6ad9e57d59218c6ae1/files/ 47 KB
13 KB 105ms
103ms Script
application/javascript 23.94.187.130
ColoCrossing

General

Check archive.org

Show headers Download Go to

Full URL: https://urdugb.com/modules/Direction/88b70c33c0ab2b4a6a9a48bc692618d7/en_US/i/scr/1FDC481GF-T1Y34VC6X-C61XW2GFD/9ac3d7a48d7bde6ad9e57d59218c6ae1/files/global.js
Requested by: Host: urdugb.com
URL: https://urdugb.com/modules/Direction/88b70c33c0ab2b4a6a9a48bc692618d7/en_US/i/scr/1FDC481GF-T1Y34VC6X-C61XW2GFD/9ac3d7a48d7bde6ad9e57d59218c6ae1/Connexion.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.94.187.130 Buffalo, United States, ASN36352 (AS-COLOCROSSING - ColoCrossing, US),
Reverse DNS: jupiter.globalhostingservers.com
Software: LiteSpeed /
Resource Hash: 7d59f3b63ab445337909c76e9f89b039886bc873f48547760898fe8fd17b4571

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://urdugb.com/modules/Direction/88b70c33c0ab2b4a6a9a48bc692618d7/en_US/i/scr/1FDC481GF-T1Y34VC6X-C61XW2GFD/9ac3d7a48d7bde6ad9e57d59218c6ae1/Connexion.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 21:02:36 GMT
content-encoding: br
last-modified: Mon, 19 Aug 2019 16:29:31 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="35,37,38,39"
content-length: 13037
expires: Mon, 26 Aug 2019 21:02:36 GMT

GET
H2 200 paypal_logo.gif
urdugb.com/modules/Direction/88b70c33c0ab2b4a6a9a48bc692618d7/en_US/i/scr/1FDC481GF-T1Y34VC6X-C61XW2GFD/9ac3d7a48d7bde6ad9e57d59218c6ae1/files/ 1 KB
1 KB 106ms
103ms Image
image/gif 23.94.187.130
ColoCrossing

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://urdugb.com/modules/Direction/88b70c33c0ab2b4a6a9a48bc692618d7/en_US/i/scr/1FDC481GF-T1Y34VC6X-C61XW2GFD/9ac3d7a48d7bde6ad9e57d59218c6ae1/files/paypal_logo.gif
Requested by: Host: urdugb.com
URL: https://urdugb.com/modules/Direction/88b70c33c0ab2b4a6a9a48bc692618d7/en_US/i/scr/1FDC481GF-T1Y34VC6X-C61XW2GFD/9ac3d7a48d7bde6ad9e57d59218c6ae1/Connexion.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.94.187.130 Buffalo, United States, ASN36352 (AS-COLOCROSSING - ColoCrossing, US),
Reverse DNS: jupiter.globalhostingservers.com
Software: LiteSpeed /
Resource Hash: 87a2207c48e5927d03764ac10a3ebf6425f801e8a71856b36305431d3b41fe71

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://urdugb.com/modules/Direction/88b70c33c0ab2b4a6a9a48bc692618d7/en_US/i/scr/1FDC481GF-T1Y34VC6X-C61XW2GFD/9ac3d7a48d7bde6ad9e57d59218c6ae1/Connexion.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 21:02:36 GMT
last-modified: Mon, 19 Aug 2019 16:29:31 GMT
server: LiteSpeed
content-type: image/gif
status: 200
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="35,37,38,39"
content-length: 1071
expires: Mon, 26 Aug 2019 21:02:36 GMT

GET
H2 200 pp_naturalsearch.js Show response
urdugb.com/modules/Direction/88b70c33c0ab2b4a6a9a48bc692618d7/en_US/i/scr/1FDC481GF-T1Y34VC6X-C61XW2GFD/9ac3d7a48d7bde6ad9e57d59218c6ae1/files/ 6 KB
2 KB 105ms
103ms Script
application/javascript 23.94.187.130
ColoCrossing

General

Check archive.org

Show headers Download Go to

Full URL: https://urdugb.com/modules/Direction/88b70c33c0ab2b4a6a9a48bc692618d7/en_US/i/scr/1FDC481GF-T1Y34VC6X-C61XW2GFD/9ac3d7a48d7bde6ad9e57d59218c6ae1/files/pp_naturalsearch.js
Requested by: Host: urdugb.com
URL: https://urdugb.com/modules/Direction/88b70c33c0ab2b4a6a9a48bc692618d7/en_US/i/scr/1FDC481GF-T1Y34VC6X-C61XW2GFD/9ac3d7a48d7bde6ad9e57d59218c6ae1/Connexion.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.94.187.130 Buffalo, United States, ASN36352 (AS-COLOCROSSING - ColoCrossing, US),
Reverse DNS: jupiter.globalhostingservers.com
Software: LiteSpeed /
Resource Hash: 568397a8b27bd4417cf61d1491d43ddf5090cad4369d2a48a7379a94a1b9bfa9

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://urdugb.com/modules/Direction/88b70c33c0ab2b4a6a9a48bc692618d7/en_US/i/scr/1FDC481GF-T1Y34VC6X-C61XW2GFD/9ac3d7a48d7bde6ad9e57d59218c6ae1/Connexion.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 21:02:36 GMT
content-encoding: br
last-modified: Mon, 19 Aug 2019 16:29:31 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="35,37,38,39"
content-length: 1904
expires: Mon, 26 Aug 2019 21:02:36 GMT

GET
H2 200 pp_jscode_080706.js Show response
urdugb.com/modules/Direction/88b70c33c0ab2b4a6a9a48bc692618d7/en_US/i/scr/1FDC481GF-T1Y34VC6X-C61XW2GFD/9ac3d7a48d7bde6ad9e57d59218c6ae1/files/ 29 KB
14 KB 103ms
103ms Script
application/javascript 23.94.187.130
ColoCrossing

General

Check archive.org

Show headers Download Go to

Full URL: https://urdugb.com/modules/Direction/88b70c33c0ab2b4a6a9a48bc692618d7/en_US/i/scr/1FDC481GF-T1Y34VC6X-C61XW2GFD/9ac3d7a48d7bde6ad9e57d59218c6ae1/files/pp_jscode_080706.js
Requested by: Host: urdugb.com
URL: https://urdugb.com/modules/Direction/88b70c33c0ab2b4a6a9a48bc692618d7/en_US/i/scr/1FDC481GF-T1Y34VC6X-C61XW2GFD/9ac3d7a48d7bde6ad9e57d59218c6ae1/Connexion.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.94.187.130 Buffalo, United States, ASN36352 (AS-COLOCROSSING - ColoCrossing, US),
Reverse DNS: jupiter.globalhostingservers.com
Software: LiteSpeed /
Resource Hash: ba7276139b4cd045b416105b0bb857b837c4eb7991a584251ddcb1f643af78c0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://urdugb.com/modules/Direction/88b70c33c0ab2b4a6a9a48bc692618d7/en_US/i/scr/1FDC481GF-T1Y34VC6X-C61XW2GFD/9ac3d7a48d7bde6ad9e57d59218c6ae1/Connexion.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 21:02:36 GMT
content-encoding: br
last-modified: Mon, 19 Aug 2019 16:29:31 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="35,37,38,39"
content-length: 14549
expires: Mon, 26 Aug 2019 21:02:36 GMT

GET
H2 200 print.css
urdugb.com/modules/Direction/88b70c33c0ab2b4a6a9a48bc692618d7/en_US/i/scr/1FDC481GF-T1Y34VC6X-C61XW2GFD/9ac3d7a48d7bde6ad9e57d59218c6ae1/files/ 4 KB
751 B 104ms
103ms Stylesheet
text/css 23.94.187.130
ColoCrossing

General

Check archive.org

Show headers Download Go to

Full URL: https://urdugb.com/modules/Direction/88b70c33c0ab2b4a6a9a48bc692618d7/en_US/i/scr/1FDC481GF-T1Y34VC6X-C61XW2GFD/9ac3d7a48d7bde6ad9e57d59218c6ae1/files/print.css
Requested by: Host: urdugb.com
URL: https://urdugb.com/modules/Direction/88b70c33c0ab2b4a6a9a48bc692618d7/en_US/i/scr/1FDC481GF-T1Y34VC6X-C61XW2GFD/9ac3d7a48d7bde6ad9e57d59218c6ae1/Connexion.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.94.187.130 Buffalo, United States, ASN36352 (AS-COLOCROSSING - ColoCrossing, US),
Reverse DNS: jupiter.globalhostingservers.com
Software: LiteSpeed /
Resource Hash: 7c18b4d749ec7d193df7be7f9054af4f09418dd2a140e06fe8a9b4902d8a109b

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://urdugb.com/modules/Direction/88b70c33c0ab2b4a6a9a48bc692618d7/en_US/i/scr/1FDC481GF-T1Y34VC6X-C61XW2GFD/9ac3d7a48d7bde6ad9e57d59218c6ae1/Connexion.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 21:02:36 GMT
content-encoding: br
last-modified: Mon, 19 Aug 2019 16:29:31 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="35,37,38,39"
content-length: 708
expires: Mon, 26 Aug 2019 21:02:36 GMT

GET hdr_search_bg.gif
www.paypalobjects.com/WEBSCR-620-20100330-1/en_US/i/pui/core/ 0
0

GET btn_bg_sprite.gif
www.paypalobjects.com/WEBSCR-620-20100330-1/en_US/i/pui/core/ 0
0

GET nav_sprite.gif
www.paypalobjects.com/WEBSCR-620-20100330-1/en_US/i/pui/core/ 0
0

GET
H/1.1

200
OK

s3737016373898
paypal.112.2o7.net/b/ss/paypalglobal/1/H.19.3/
Redirect Chain

https://paypal.112.2o7.net/b/ss/paypalglobal/1/H.19.3/s3737016373898?AQB=1&ndh=1&t=19/7/2019%2023%3A2%3A36%201%20-120&ce=UTF-8&ns=paypal&pageName=p/gen/cnf/email-password%3A%3A_ece&g=https%3A//urdu...
https://paypal.112.2o7.net/b/ss/paypalglobal/1/H.19.3/s3737016373898?AQB=1&pccr=true&vidn=2EAD87378530876E-4000030640002F78&&ndh=1&t=19/7/2019%2023%3A2%3A36%201%20-120&ce=UTF-8&ns=paypal&pageName=p...

43 B
743 B

16ms
15ms

Image
image/gif

66.117.29.228
Adobe Systems Inc.

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://paypal.112.2o7.net/b/ss/paypalglobal/1/H.19.3/s3737016373898?AQB=1&pccr=true&vidn=2EAD87378530876E-4000030640002F78&&ndh=1&t=19/7/2019%2023%3A2%3A36%201%20-120&ce=UTF-8&ns=paypal&pageName=p/gen/cnf/email-password%3A%3A_ece&g=https%3A//urdugb.com/modules/direction/88b70c33c0ab2b4a6a9a48bc692618d7/en_us/i/scr/1fdc481gf-t1y34vc6x-c61xw2gfd/9ac3d7a48d7bde6ad9e57d59218c6ae1/connexion.php&cc=USD&ch=p/gen/cnf/email-password&c1=p/gen/cnf/email-password&c7=unknown&c8=unknown&c9=unknown&c10=fr&c17=pp-mot%20de%20passe%20-%20paypal-pp&c19=p/gen/cnf/email-password%3A%3A_ece&c30=value%20not%20set&c31=value%20not%20set&c34=paypalcredit%3Aservicing%3Aco%3Anotransactions&c36=https%3A//urdugb.com/modules/direction/88b70c33c0ab2b4a6a9a48bc692618d7/en_us/i/scr/1fdc481gf-t1y34vc6&c47=p/gen/cnf/email-password%3A%3A_ece&c50=fr_fr&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1

Requested by

Host: urdugb.com
URL: https://urdugb.com/modules/Direction/88b70c33c0ab2b4a6a9a48bc692618d7/en_US/i/scr/1FDC481GF-T1Y34VC6X-C61XW2GFD/9ac3d7a48d7bde6ad9e57d59218c6ae1/Connexion.php

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

66.117.29.228 , United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),

Reverse DNS

Software

Omniture DC/2.0.0 /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://urdugb.com/modules/Direction/88b70c33c0ab2b4a6a9a48bc692618d7/en_US/i/scr/1FDC481GF-T1Y34VC6X-C61XW2GFD/9ac3d7a48d7bde6ad9e57d59218c6ae1/Connexion.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 19 Aug 2019 21:02:39 GMT
X-Content-Type-Options: nosniff
X-C: ms-6.8.1
P3P: CP="This is not a P3P policy"
Connection: keep-alive
Content-Length: 43
X-XSS-Protection: 1; mode=block
Pragma: no-cache
Last-Modified: Tue, 20 Aug 2019 21:02:39 GMT
Server: Omniture DC/2.0.0
xserver: www50
ETag: "3363493169243127808-4745530695231745920"
Vary: *
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, max-age=0, no-transform, private
Expires: Sun, 18 Aug 2019 21:02:39 GMT

Redirect headers

Date: Mon, 19 Aug 2019 21:02:39 GMT
X-Content-Type-Options: nosniff
X-C: ms-6.8.1
P3P: CP="This is not a P3P policy"
Connection: keep-alive
Content-Length: 0
X-XSS-Protection: 1; mode=block
Pragma: no-cache
Last-Modified: Tue, 20 Aug 2019 21:02:39 GMT
Server: Omniture DC/2.0.0
xserver: www50
Location: https://paypal.112.2o7.net/b/ss/paypalglobal/1/H.19.3/s3737016373898?AQB=1&pccr=true&vidn=2EAD87378530876E-4000030640002F78&&ndh=1&t=19/7/2019%2023%3A2%3A36%201%20-120&ce=UTF-8&ns=paypal&pageName=p/gen/cnf/email-password%3A%3A_ece&g=https%3A//urdugb.com/modules/direction/88b70c33c0ab2b4a6a9a48bc692618d7/en_us/i/scr/1fdc481gf-t1y34vc6x-c61xw2gfd/9ac3d7a48d7bde6ad9e57d59218c6ae1/connexion.php&cc=USD&ch=p/gen/cnf/email-password&c1=p/gen/cnf/email-password&c7=unknown&c8=unknown&c9=unknown&c10=fr&c17=pp-mot%20de%20passe%20-%20paypal-pp&c19=p/gen/cnf/email-password%3A%3A_ece&c30=value%20not%20set&c31=value%20not%20set&c34=paypalcredit%3Aservicing%3Aco%3Anotransactions&c36=https%3A//urdugb.com/modules/direction/88b70c33c0ab2b4a6a9a48bc692618d7/en_us/i/scr/1fdc481gf-t1y34vc6&c47=p/gen/cnf/email-password%3A%3A_ece&c50=fr_fr&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1
Content-Type: text/plain
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, max-age=0, no-transform, private
Expires: Sun, 18 Aug 2019 21:02:39 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.paypalobjects.com
URL: https://www.paypalobjects.com/WEBSCR-620-20100330-1/en_US/i/pui/core/hdr_search_bg.gif

Domain: www.paypalobjects.com
URL: https://www.paypalobjects.com/WEBSCR-620-20100330-1/en_US/i/pui/core/btn_bg_sprite.gif

Domain: www.paypalobjects.com
URL: https://www.paypalobjects.com/WEBSCR-620-20100330-1/en_US/i/pui/core/nav_sprite.gif

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial)

29 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

paypal.112.2o7.net
urdugb.com
www.paypalobjects.com
www.paypalobjects.com
23.94.187.130
66.117.29.228
568397a8b27bd4417cf61d1491d43ddf5090cad4369d2a48a7379a94a1b9bfa9
7c18b4d749ec7d193df7be7f9054af4f09418dd2a140e06fe8a9b4902d8a109b
7d59f3b63ab445337909c76e9f89b039886bc873f48547760898fe8fd17b4571
87a2207c48e5927d03764ac10a3ebf6425f801e8a71856b36305431d3b41fe71
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
ba7276139b4cd045b416105b0bb857b837c4eb7991a584251ddcb1f643af78c0
c36bef44937289a54acc239aac93f322ac2f1bf4e880e050d4ad80473a16ca4b
ccf27823816dd9c1674beca235d07d1c65a2dd95ac3e7ec1dbdde0256454bd0f
ce4b0a4502fc96a42e924e9ef518d3c181355d4558f84ab75435c63b88cff89c

urdugb.com Open in urlscan Pro 23.94.187.130 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

12 Requests

75 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

3 IPs

1 Countries

43 kBTransfer

154 kBSize

0 Cookies

1 Outgoing links

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

29 JavaScript Global Variables

0 Cookies

Indicators

urdugb.com Open in urlscan Pro
23.94.187.130 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

75 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

43 kB
Transfer

154 kB
Size

0
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!