URL: https://servicehelpingppl.000webhostapp.com/account-limited/account-limited/
Tags: phishing malicious
Submission: On August 13 via api from US

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 13 HTTP transactions.
The main IP is 2a02:4780:dead:84ff::1, located in United States and belongs to AWEX, US. The main domain is servicehelpingppl.000webhostapp.com.
TLS certificate: Issued by RapidSSL RSA CA 2018 on June 11th 2019. Valid for: 2 years.
This is the first time this domain was scanned on urlscan.io!

Verdict: Malicious (Score: 100/100) Show Details

  • urlscan - Score: 100
    phishing
    Phishing against PayPal (Financial)
  • googlesafebrowsing - Score: 100 (1 resources matched) -
    social_engineering

Domain & IP information

IP Address AS Autonomous System
7 2a02:4780:dea... 204915 (AWEX)
4 23.210.248.226 16625 (AKAMAI-AS)
1 2606:4700:10:... 13335 (CLOUDFLAR...)
13 4
Domain
Subdomains
Transfer
7 000webhostapp.com
196 KB
4 paypalobjects.com
89 KB
1 000webhost.com
2 KB
0 myfontastic.com Failed
file.myfontastic.com Failed
0 B
13 4
Domain Requested by
7 servicehelpingppl.000webhostapp.com servicehelpingppl.000webhostapp.com
4 www.paypalobjects.com servicehelpingppl.000webhostapp.com
1 cdn.000webhost.com servicehelpingppl.000webhostapp.com
0 file.myfontastic.com Failed servicehelpingppl.000webhostapp.com
13 4

This site contains links to these domains. Also see Links.

Domain
Subject / Issuer Validity Valid
*.000webhostapp.com
RapidSSL RSA CA 2018
2019-06-11 -
2021-07-10
2 years
www.paypal.com
DigiCert SHA2 Extended Validation Server CA
2018-08-14 -
2020-08-18
2 years
*.000webhost.com
COMODO RSA Domain Validation Secure Server CA
2018-10-19 -
2020-12-17
2 years

Screenshot


Detected technologies

Web
Overall confidence: 100%
Detected patterns
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i


Stats

0
Requests

0
Ad-blocked

0
Malicious

0 %
HTTPS

0 %
IPv6

0
Domains

0
Subdomains

0
IPs

0
Countries

0 kB
Transfer

0 kB
Size

0
Cookies

13 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
/
/account-limited/account-limited
54 KB
14 KB
Document
General
Full URL
https://servicehelpingppl.000webhostapp.com/account-limited/account-limited/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:84ff::1 , United States, ASN204915 (AWEX, US),
Reverse DNS
Software
awex /
Resource Hash
b89f761a09a0c3ba81a689c197e876b87d96e15e85accdfe612d1ac33bfdf6a6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
servicehelpingppl.000webhostapp.com
:scheme
https
:path
/account-limited/account-limited/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
navigate
sec-fetch-user
?1
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
none
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1

Response headers

status
200
date
Tue, 13 Aug 2019 21:59:23 GMT
content-type
text/html; charset=UTF-8
server
awex
x-xss-protection
1; mode=block
x-content-type-options
nosniff
x-request-id
366dca31d5832dc87a255c94185bf942
content-encoding
gzip
ajax.js
/account-limited/account-limited/js
85 KB
34 KB
Script
General
Full URL
https://servicehelpingppl.000webhostapp.com/account-limited/account-limited/js/ajax.js
Requested by
Host: servicehelpingppl.000webhostapp.com
URL: https://servicehelpingppl.000webhostapp.com/account-limited/account-limited/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:84ff::1 , United States, ASN204915 (AWEX, US),
Reverse DNS
Software
awex /
Resource Hash
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://servicehelpingppl.000webhostapp.com/account-limited/account-limited/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 13 Aug 2019 21:59:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Sun, 14 Oct 2018 22:12:11 GMT
server
awex
content-type
application/javascript
status
200
x-xss-protection
1; mode=block
x-request-id
8be0d416adb01286ea29ca75418ab539
jquery.js
/account-limited/account-limited/js
85 KB
34 KB
Script
General
Full URL
https://servicehelpingppl.000webhostapp.com/account-limited/account-limited/js/jquery.js
Requested by
Host: servicehelpingppl.000webhostapp.com
URL: https://servicehelpingppl.000webhostapp.com/account-limited/account-limited/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:84ff::1 , United States, ASN204915 (AWEX, US),
Reverse DNS
Software
awex /
Resource Hash
1cf30e59d21d4ae560af7143f5913efcc8222bcaa4fcc7508eb802b5faa9e94e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://servicehelpingppl.000webhostapp.com/account-limited/account-limited/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 13 Aug 2019 21:59:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Sun, 14 Oct 2018 22:12:11 GMT
server
awex
content-type
application/javascript
status
200
x-xss-protection
1; mode=block
x-request-id
e535ce2d975eda9c5f835e859eba0774
jquery.min.js
/account-limited/account-limited/js
85 KB
34 KB
Script
General
Full URL
https://servicehelpingppl.000webhostapp.com/account-limited/account-limited/js/jquery.min.js
Requested by
Host: servicehelpingppl.000webhostapp.com
URL: https://servicehelpingppl.000webhostapp.com/account-limited/account-limited/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:84ff::1 , United States, ASN204915 (AWEX, US),
Reverse DNS
Software
awex /
Resource Hash
1cf30e59d21d4ae560af7143f5913efcc8222bcaa4fcc7508eb802b5faa9e94e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://servicehelpingppl.000webhostapp.com/account-limited/account-limited/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 13 Aug 2019 21:59:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Sun, 14 Oct 2018 22:12:11 GMT
server
awex
content-type
application/javascript
status
200
x-xss-protection
1; mode=block
x-request-id
d788d3e85e2eea7337001fb75ef1088a
js-plus.js
/account-limited/account-limited/js
19 KB
4 KB
Script
General
Full URL
https://servicehelpingppl.000webhostapp.com/account-limited/account-limited/js/js-plus.js
Requested by
Host: servicehelpingppl.000webhostapp.com
URL: https://servicehelpingppl.000webhostapp.com/account-limited/account-limited/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:84ff::1 , United States, ASN204915 (AWEX, US),
Reverse DNS
Software
awex /
Resource Hash
8ecc6879c087a5d2a5acb64ddf8a9d1c790d37fc848f3befc28f527a23995050
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://servicehelpingppl.000webhostapp.com/account-limited/account-limited/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 13 Aug 2019 21:59:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Sun, 14 Oct 2018 22:12:11 GMT
server
awex
content-type
application/javascript
status
200
x-xss-protection
1; mode=block
x-request-id
bed893c6fbd96a36b8240c9d53fda096
styles.css
/account-limited/account-limited/css
6 KB
2 KB
Stylesheet
General
Full URL
https://servicehelpingppl.000webhostapp.com/account-limited/account-limited/css/styles.css
Requested by
Host: servicehelpingppl.000webhostapp.com
URL: https://servicehelpingppl.000webhostapp.com/account-limited/account-limited/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:84ff::1 , United States, ASN204915 (AWEX, US),
Reverse DNS
Software
awex /
Resource Hash
5011d5b32b22761a13ebc98b5da6ddf388ce658f70f1a0a10131c02cefbbbea1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://servicehelpingppl.000webhostapp.com/account-limited/account-limited/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 13 Aug 2019 21:59:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Sun, 14 Oct 2018 22:12:11 GMT
server
awex
content-type
text/css
status
200
x-xss-protection
1; mode=block
x-request-id
d59f1762613a0fc393cb1c812dfa05c9
icons.css
file.myfontastic.com/hSMyDca9BDwBA8GgvxRZRP
0
0

38934482f6b05e6f8ab261cebe773fbeeb0e24.css
www.paypalobjects.com/eboxapps/css/c9
97 KB
17 KB
Stylesheet
General
Full URL
https://www.paypalobjects.com/eboxapps/css/c9/38934482f6b05e6f8ab261cebe773fbeeb0e24.css
Requested by
Host: servicehelpingppl.000webhostapp.com
URL: https://servicehelpingppl.000webhostapp.com/account-limited/account-limited/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.210.248.226 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-248-226.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
c16c66b596ca78dda8e722cbaea156b19b3fc84fbe5f56887114cf2f568cf7c7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://servicehelpingppl.000webhostapp.com/account-limited/account-limited/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 13 Aug 2019 21:59:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 08 Aug 2019 15:07:07 GMT
server
Apache
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
max-age=7776000
strict-transport-security
max-age=31536000
accept-ranges
bytes
content-length
17149
expires
Mon, 11 Nov 2019 21:59:23 GMT
8ce700307d4d0bebd91ab07558493707737ee4.js
www.paypalobjects.com/eboxapps/js/67
120 KB
38 KB
Script
General
Full URL
https://www.paypalobjects.com/eboxapps/js/67/8ce700307d4d0bebd91ab07558493707737ee4.js
Requested by
Host: servicehelpingppl.000webhostapp.com
URL: https://servicehelpingppl.000webhostapp.com/account-limited/account-limited/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.210.248.226 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-248-226.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
7b8ed9e1d57a27ebffc842a2afdc370ace2c67c6930535d68dd77c512a17e9a7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://servicehelpingppl.000webhostapp.com/account-limited/account-limited/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 13 Aug 2019 21:59:23 GMT
x-pad
avoid browser bug
x-content-type-options
nosniff
last-modified
Mon, 30 Jul 2018 17:45:46 GMT
server
Apache
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=7776000
strict-transport-security
max-age=31536000
accept-ranges
bytes
content-encoding
gzip
content-length
38763
expires
Mon, 11 Nov 2019 21:59:23 GMT
bs-chunk.js
www.paypalobjects.com/tagmgmt
67 KB
19 KB
Script
General
Full URL
https://www.paypalobjects.com/tagmgmt/bs-chunk.js
Requested by
Host: servicehelpingppl.000webhostapp.com
URL: https://servicehelpingppl.000webhostapp.com/account-limited/account-limited/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.210.248.226 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-248-226.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
6bb932ce3fc9effb5c981daa3682d85f156b3e00f2485adfde1773c164bf8f50
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://servicehelpingppl.000webhostapp.com/account-limited/account-limited/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 13 Aug 2019 21:59:23 GMT
x-pad
avoid browser bug
x-content-type-options
nosniff
status
200
content-encoding
gzip
vary
Accept-Encoding
content-length
19304
last-modified
Thu, 18 Apr 2019 18:33:54 GMT
server
Apache
strict-transport-security
max-age=31536000
access-control-allow-methods
GET
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
max-age=7776000
accept-ranges
bytes
access-control-allow-headers
x-csrf-token
expires
Mon, 11 Nov 2019 21:59:23 GMT
pa.js
www.paypalobjects.com/pa/js/min
41 KB
15 KB
Script
General
Full URL
https://www.paypalobjects.com/pa/js/min/pa.js
Requested by
Host: servicehelpingppl.000webhostapp.com
URL: https://servicehelpingppl.000webhostapp.com/account-limited/account-limited/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.210.248.226 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-248-226.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
fb09c511a746af8737671bd1bd11245f3607a988293c567d2403f1bbadc75e90
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://servicehelpingppl.000webhostapp.com/account-limited/account-limited/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 13 Aug 2019 21:59:23 GMT
x-pad
avoid browser bug
x-content-type-options
nosniff
status
200
content-encoding
gzip
vary
Accept-Encoding
content-length
14743
last-modified
Tue, 06 Aug 2019 04:43:25 GMT
server
Apache
strict-transport-security
max-age=31536000
access-control-allow-methods
GET
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
max-age=3600
accept-ranges
bytes
access-control-allow-headers
x-csrf-token
expires
Tue, 13 Aug 2019 22:59:23 GMT
footer-powered-by-000webhost-white2.png
cdn.000webhost.com/000webhost/logo
2 KB
2 KB
Image
General
Full URL
https://cdn.000webhost.com/000webhost/logo/footer-powered-by-000webhost-white2.png
Requested by
Host: servicehelpingppl.000webhostapp.com
URL: https://servicehelpingppl.000webhostapp.com/account-limited/account-limited/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:432e , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
86f2673ec74a632865109a76b2232f4f5b3587daa219e07a17ef1d9c76a0fda5

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://servicehelpingppl.000webhostapp.com/account-limited/account-limited/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 13 Aug 2019 21:59:23 GMT
cf-cache-status
HIT
age
3205
cf-polished
origFmt=png, origSize=2046
status
200
content-disposition
inline; filename="footer-powered-by-000webhost-white2.webp"
x-hostinger-datacenter
srv
content-length
1696
last-modified
Tue, 13 Aug 2019 10:06:22 GMT
server
cloudflare
etag
"5d528b9e-7fe"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
expires
Wed, 14 Aug 2019 01:59:23 GMT
cache-control
public, max-age=14400
x-hostinger-node
nl-srv-cdn2
accept-ranges
bytes
cf-ray
505df4b69b79dfdb-FRA
cf-bgj
imgq:100
logo.png
/account-limited/account-limited/css
73 KB
74 KB
Image
General
Full URL
https://servicehelpingppl.000webhostapp.com/account-limited/account-limited/css/logo.png
Requested by
Host: servicehelpingppl.000webhostapp.com
URL: https://servicehelpingppl.000webhostapp.com/account-limited/account-limited/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:84ff::1 , United States, ASN204915 (AWEX, US),
Reverse DNS
Software
awex /
Resource Hash
015c1b9d9d8a362f4f6c1e542f0b8d9e9f662bef7bc819ee948cdece297164a4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://servicehelpingppl.000webhostapp.com/account-limited/account-limited/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 13 Aug 2019 21:59:24 GMT
x-content-type-options
nosniff
last-modified
Sun, 14 Oct 2018 22:12:11 GMT
server
awex
content-type
image/png
status
200
accept-ranges
bytes
content-length
75114
x-xss-protection
1; mode=block
x-request-id
5597a6e25fcd7c51bb55e4daa27abf12

Redirect requests

There were HTTP redirects (301, 302) for the following requests:

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
file.myfontastic.com
URL
https://file.myfontastic.com/hSMyDca9BDwBA8GgvxRZRP/icons.css

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan - Score: 100

Categories:
phishing

Tags:
phishing

Phishing against: PayPal (Financial)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask function| $ function| jQuery

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block