paypal-agent.net Open in urlscan Pro
92.223.30.30  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request wp-includes Show response paypal-agent.net/	727 B 995 B	1286ms 162ms	Document text/html	92.223.30.30 GHOST
General Check archive.org Show headers Download Go to Full URL http://paypal-agent.net/wp-includes Protocol HTTP/1.1 Server 92.223.30.30 Frankfurt am Main, Germany, ASN202422 (GHOST, LU), Reverse DNS cooldog2261.example.com Software nginx / Resource Hash fce29e1fe6bf89c80ee27d17e1bd33bc2050ab5897bff235e3176e6f53d00661 Request headers Host paypal-agent.net Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers Server nginx Date Sun, 24 Oct 2021 13:10:48 GMT Content-Type text/html; charset=utf-8 Content-Length 727 Connection keep-alive Last-Modified Wed, 20 Oct 2021 10:57:15 GMT Cache-Control max-age=0 no-cache X-Cache MISS
GET H/1.1	200 OK	app.6775eed8164f72ee06dec1c5e84f73d2.css paypal-agent.net/static/css/	902 KB 164 KB	164ms 163ms	Stylesheet text/css	92.223.30.30 GHOST
General Check archive.org Show headers Download Go to Full URL http://paypal-agent.net/static/css/app.6775eed8164f72ee06dec1c5e84f73d2.css Requested by Host: paypal-agent.net URL: http://paypal-agent.net/wp-includes Protocol HTTP/1.1 Server 92.223.30.30 Frankfurt am Main, Germany, ASN202422 (GHOST, LU), Reverse DNS cooldog2261.example.com Software nginx / Resource Hash 77322b6d7dedc0088db9f75ad21b8cc867d8c76d774b2444a3e366abfb88a4a4 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Pragma no-cache Accept-Encoding gzip, deflate Host paypal-agent.net Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept text/css,*/*;q=0.1 Referer http://paypal-agent.net/wp-includes Connection keep-alive Cache-Control no-cache Accept-Language de-DE,de;q=0.9 Referer http://paypal-agent.net/wp-includes User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Sun, 24 Oct 2021 13:10:48 GMT Content-Encoding gzip Vary Accept-Encoding Last-Modified Wed, 20 Oct 2021 10:57:15 GMT Server nginx Strict-Transport-Security max-age=31536000 Content-Type text/css; charset=utf-8 Cache-Control max-age=43200 Transfer-Encoding chunked Connection keep-alive Expires Mon, 25 Oct 2021 01:10:48 GMT
GET H/1.1	200 OK	manifest.3ad1d5771e9b13dbdad2.js Show response paypal-agent.net/static/js/	800 B 1 KB	178ms 177ms	Script application/javascript	92.223.30.30 GHOST
General Check archive.org Show headers Download Go to Full URL http://paypal-agent.net/static/js/manifest.3ad1d5771e9b13dbdad2.js Requested by Host: paypal-agent.net URL: http://paypal-agent.net/wp-includes Protocol HTTP/1.1 Server 92.223.30.30 Frankfurt am Main, Germany, ASN202422 (GHOST, LU), Reverse DNS cooldog2261.example.com Software nginx / Resource Hash fcdf3becb34727e89ae7395ac70df92e4537639ae903784e201f479dd70f3ef0 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Pragma no-cache Accept-Encoding gzip, deflate Host paypal-agent.net Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept */* Referer http://paypal-agent.net/wp-includes Connection keep-alive Cache-Control no-cache Accept-Language de-DE,de;q=0.9 Referer http://paypal-agent.net/wp-includes User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Sun, 24 Oct 2021 13:10:48 GMT Last-Modified Wed, 20 Oct 2021 10:57:15 GMT Server nginx Strict-Transport-Security max-age=31536000 Content-Type application/javascript; charset=utf-8 Cache-Control max-age=43200 Connection keep-alive Content-Length 800 Expires Mon, 25 Oct 2021 01:10:48 GMT
GET H/1.1	200 OK	vendor.1a0506386d0eeafc9405.js Show response paypal-agent.net/static/js/	4 MB 899 KB	322ms 169ms	Script application/javascript	92.223.30.30 GHOST
General Check archive.org Show headers Download Go to Full URL http://paypal-agent.net/static/js/vendor.1a0506386d0eeafc9405.js Requested by Host: paypal-agent.net URL: http://paypal-agent.net/wp-includes Protocol HTTP/1.1 Server 92.223.30.30 Frankfurt am Main, Germany, ASN202422 (GHOST, LU), Reverse DNS cooldog2261.example.com Software nginx / Resource Hash 1471c0b82002e8eed175417e03444fa385c323d1784171e6d1a6dc6901c32228 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Pragma no-cache Accept-Encoding gzip, deflate Host paypal-agent.net Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept */* Referer http://paypal-agent.net/wp-includes Connection keep-alive Cache-Control no-cache Accept-Language de-DE,de;q=0.9 Referer http://paypal-agent.net/wp-includes User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Sun, 24 Oct 2021 13:10:48 GMT Content-Encoding gzip Vary Accept-Encoding Last-Modified Wed, 20 Oct 2021 10:57:15 GMT Server nginx Strict-Transport-Security max-age=31536000 Content-Type application/javascript; charset=utf-8 Cache-Control max-age=43200 Transfer-Encoding chunked Connection keep-alive Expires Mon, 25 Oct 2021 01:10:48 GMT
GET H/1.1	200 OK	app.617bbf151160a5b1e144.js Show response paypal-agent.net/static/js/	96 KB 37 KB	325ms 173ms	Script application/javascript	92.223.30.30 GHOST
General Check archive.org Show headers Download Go to Full URL http://paypal-agent.net/static/js/app.617bbf151160a5b1e144.js Requested by Host: paypal-agent.net URL: http://paypal-agent.net/wp-includes Protocol HTTP/1.1 Server 92.223.30.30 Frankfurt am Main, Germany, ASN202422 (GHOST, LU), Reverse DNS cooldog2261.example.com Software nginx / Resource Hash 3ebc007b9f6052ff95287c1c4c691e890a72a989b9c97d3cfd6466425c8e4bd9 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Pragma no-cache Accept-Encoding gzip, deflate Host paypal-agent.net Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept */* Referer http://paypal-agent.net/wp-includes Connection keep-alive Cache-Control no-cache Accept-Language de-DE,de;q=0.9 Referer http://paypal-agent.net/wp-includes User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Sun, 24 Oct 2021 13:10:48 GMT Content-Encoding gzip Vary Accept-Encoding Last-Modified Wed, 20 Oct 2021 10:57:15 GMT Server nginx Strict-Transport-Security max-age=31536000 Content-Type application/javascript; charset=utf-8 Cache-Control max-age=43200 Transfer-Encoding chunked Connection keep-alive Expires Mon, 25 Oct 2021 01:10:48 GMT
GET H2	200	cityjson Show response pv.sohu.com/	85 B 245 B	2196ms 265ms	Script text/json	13.69.222.243 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://pv.sohu.com/cityjson?ie=utf-8 Requested by Host: paypal-agent.net URL: http://paypal-agent.net/wp-includes Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.69.222.243 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software nginx/1.0.15 / Resource Hash 4888c0d2c521a2dde98e8066ccf3458a8dd9f62ec862137482e8485d4c10c20b Request headers Accept-Language de-DE,de;q=0.9 Referer http://paypal-agent.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sun, 24 Oct 2021 13:10:50 GMT fss-proxy Powered by 5903434.9966676.7083656, Powered by 4544565.5003327.7961660 server nginx/1.0.15 content-length 85 content-type text/json; charset=utf-8
GET H/1.1	200 OK	getiplang Show response paypal-agent.net/auth/	85 B 287 B	486ms 486ms	XHR application/json	92.223.30.30 GHOST
General Check archive.org Show headers Download Go to Full URL http://paypal-agent.net/auth/getiplang Requested by Host: paypal-agent.net URL: http://paypal-agent.net/static/js/vendor.1a0506386d0eeafc9405.js Protocol HTTP/1.1 Server 92.223.30.30 Frankfurt am Main, Germany, ASN202422 (GHOST, LU), Reverse DNS cooldog2261.example.com Software nginx / Resource Hash 7b27416ef702ee38d8608cf59520b73320902b0ff656967754d73723d50b2255 Request headers Pragma no-cache Accept-Encoding gzip, deflate Host paypal-agent.net Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept application/json, text/plain, */* Referer http://paypal-agent.net/ Connection keep-alive Cache-Control no-cache Accept application/json, text/plain, */* Referer http://paypal-agent.net/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Sun, 24 Oct 2021 13:10:50 GMT Cache-Control no-cache Server nginx Connection keep-alive Content-Length 85 X-Cache MISS Content-Type application/json; charset=utf-8
GET H/1.1	200 OK	paypal-logo-129x32.svg paypal-agent.net/static/assets/img/	5 KB 5 KB	162ms 162ms	Image image/svg+xml	92.223.30.30 GHOST
General Check archive.org Show headers Download Go to Show image Full URL http://paypal-agent.net/static/assets/img/paypal-logo-129x32.svg Requested by Host: paypal-agent.net URL: http://paypal-agent.net/static/css/app.6775eed8164f72ee06dec1c5e84f73d2.css Protocol HTTP/1.1 Server 92.223.30.30 Frankfurt am Main, Germany, ASN202422 (GHOST, LU), Reverse DNS cooldog2261.example.com Software nginx / Resource Hash b3cc50b9e94bbecaaeb1079b64b8ca50616d1732824964c1cc2c5422627a0ec5 Request headers Pragma no-cache Accept-Encoding gzip, deflate Host paypal-agent.net Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Referer http://paypal-agent.net/static/css/app.6775eed8164f72ee06dec1c5e84f73d2.css Connection keep-alive Cache-Control no-cache Accept-Language de-DE,de;q=0.9 Referer http://paypal-agent.net/static/css/app.6775eed8164f72ee06dec1c5e84f73d2.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Sun, 24 Oct 2021 13:10:50 GMT Last-Modified Wed, 20 Oct 2021 10:57:15 GMT Server nginx X-Cache MISS Content-Type image/svg+xml Cache-Control max-age=0 no-cache Connection keep-alive Content-Length 4945

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect boolean| originAgentCluster function| webpackJsonp function| setImmediate function| clearImmediate object| __core-js_shared__ object| returnCitySN

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

paypal-agent.net
pv.sohu.com
13.69.222.243
92.223.30.30
1471c0b82002e8eed175417e03444fa385c323d1784171e6d1a6dc6901c32228
3ebc007b9f6052ff95287c1c4c691e890a72a989b9c97d3cfd6466425c8e4bd9
4888c0d2c521a2dde98e8066ccf3458a8dd9f62ec862137482e8485d4c10c20b
77322b6d7dedc0088db9f75ad21b8cc867d8c76d774b2444a3e366abfb88a4a4
7b27416ef702ee38d8608cf59520b73320902b0ff656967754d73723d50b2255
b3cc50b9e94bbecaaeb1079b64b8ca50616d1732824964c1cc2c5422627a0ec5
fcdf3becb34727e89ae7395ac70df92e4537639ae903784e201f479dd70f3ef0
fce29e1fe6bf89c80ee27d17e1bd33bc2050ab5897bff235e3176e6f53d00661