![](/screenshots/dbcffb60-9da6-485b-9d46-70fead36c99a.png)
paypay-netsecurity.com
Open in
urlscan Pro
202.73.15.46
Malicious Activity!
Public Scan
Effective URL: https://paypay-netsecurity.com/login
Submission: On May 06 via manual — Scanned from JP
Summary
TLS certificate: Issued by R3 on May 6th 2022. Valid for: 3 months.
This is the only time paypay-netsecurity.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: PayPay (Financial)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 10 | 202.73.15.46 202.73.15.46 | 55720 (GIGABIT-M...) (GIGABIT-MY Gigabit Hosting Sdn Bhd) | |
2 | 13.225.159.13 13.225.159.13 | 16509 (AMAZON-02) (AMAZON-02) | |
11 | 2 |
ASN55720 (GIGABIT-MY Gigabit Hosting Sdn Bhd, MY)
paypay-netsecurity.com |
ASN16509 (AMAZON-02, US)
PTR: server-13-225-159-13.nrt12.r.cloudfront.net
static.paypay.ne.jp |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
paypay-netsecurity.com
1 redirects
paypay-netsecurity.com |
69 KB |
2 |
paypay.ne.jp
static.paypay.ne.jp |
78 KB |
11 | 2 |
Domain | Requested by | |
---|---|---|
10 | paypay-netsecurity.com |
1 redirects
paypay-netsecurity.com
|
2 | static.paypay.ne.jp |
paypay-netsecurity.com
|
11 | 2 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.paypay.ne.jp |
Subject Issuer | Validity | Valid | |
---|---|---|---|
paypay-netsecurity.com R3 |
2022-05-06 - 2022-08-04 |
3 months | crt.sh |
*.paypay.ne.jp Amazon |
2021-06-12 - 2022-07-11 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://paypay-netsecurity.com/login
Frame ID: 139B3516741CF455EF70EFFFEF8B8986
Requests: 11 HTTP requests in this frame
Screenshot
![](/screenshots/dbcffb60-9da6-485b-9d46-70fead36c99a.png)
Page Title
PayPayPage URL History Show full URLs
-
https://paypay-netsecurity.com/
HTTP 302
https://paypay-netsecurity.com/login Page URL
Detected technologies
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
2 Outgoing links
These are links going to different origins than the main page.
Title: パスワードを忘れた場合
Search URL Search Domain Scan URL
Title: 新規登録
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://paypay-netsecurity.com/
HTTP 302
https://paypay-netsecurity.com/login Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
login
paypay-netsecurity.com/ Redirect Chain
|
5 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
common.css
paypay-netsecurity.com/static/css/ |
15 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.5.1.min.js
paypay-netsecurity.com/static/js/ |
87 KB 34 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
login.js
paypay-netsecurity.com/static/js/ |
8 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
loading.gif
paypay-netsecurity.com/static/picture/ |
404 B 609 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
paypay_logo.png
paypay-netsecurity.com/static/picture/ |
9 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
paypay_icon-eye-close.png
paypay-netsecurity.com/static/picture/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
yahoo.png
paypay-netsecurity.com/static/picture/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
softbank-icon.svg
paypay-netsecurity.com/static/picture/ |
11 KB 11 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Graphik-Regular-Web.woff2
static.paypay.ne.jp/font/ |
36 KB 37 KB |
Font
binary/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Graphik-Semibold-Web.woff2
static.paypay.ne.jp/font/ |
40 KB 41 KB |
Font
binary/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: PayPay (Financial)8 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontextlost object| oncontextrestored function| structuredClone function| getScreenDetails object| onorientationchange number| orientation function| $ function| jQuery0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31536000 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
paypay-netsecurity.com
static.paypay.ne.jp
13.225.159.13
202.73.15.46
026edf5e5d1b243ee3f7df45916d0a5c09fc2512d72752d2fb80f1b27f3bebde
217d1b91669dd4a21ce0cff140d526b43a3ac1ea5caa5578d5372fde00dadf1d
2945b93cdcb7635a043a5af8a9e79c794d8e382271843664179679e6c560fecb
6d23e4d28f9256db85774448eec00526f5d1fd57faf08f082aaeebe4aef3543b
6d9477835a788bf110c7d1cf1ff133197c095cef8f74d136213fc0dfc0fe8e9f
7d8b1e300a7323d85af331f60d4a6d9b5916e5cff2ba92cac397f10208abf4b6
84da2f59c67c7fa08de5ab4fe30c401e8b162bde73b7097dcedc50a7d9a80e0b
882c93eadef6b4f05100102b215fee8260dc81ec84c78d7d494db7216c542c0b
91350a34e5ffb56cf1c50092968964486c865c545011dbca1b7be629b35364fc
96db9ca236e4eadf68ca5c79f1e1725270a5d1344021133441f6c9a9d9e48a93
9a2723c21fb1b7dff0e2aa5dc6be24a9670220a17ae21f70fdbc602d1f8acd38