id.userpayypppay.jvvvvv.cn Open in urlscan Pro
192.3.101.110  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response id.userpayypppay.jvvvvv.cn/	8 KB 3 KB	4026ms 771ms	Document text/html	192.3.101.110 AS-COLOCROSSING
General Check archive.org Show headers Download Go to Full URL https://id.userpayypppay.jvvvvv.cn/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.3.101.110 , United States, ASN36352 (AS-COLOCROSSING, US), Reverse DNS 192-3-101-110-host.colocrossing.com Software Apache / Resource Hash 50ec1968b792de12f08cc09782cd954c4c468e9907ec2dd39c0412430e5de209 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 accept-language jp-JP,jp;q=0.9 Response headers access-control-allow-credentials true access-control-allow-methods * access-control-allow-origin * cache-control no-store, no-cache, must-revalidate content-encoding gzip content-length 2505 content-type text/html;charset=utf-8 date Mon, 27 Mar 2023 04:03:01 GMT expires Thu, 19 Nov 1981 08:52:00 GMT pragma no-cache server Apache vary Accept-Encoding
GET H2	200	layui.js Show response id.userpayypppay.jvvvvv.cn/admin/im/	284 KB 92 KB	513ms 512ms	Script application/javascript	192.3.101.110 AS-COLOCROSSING
General Check archive.org Show headers Download Go to Full URL https://id.userpayypppay.jvvvvv.cn/admin/im/layui.js Requested by Host: id.userpayypppay.jvvvvv.cn URL: https://id.userpayypppay.jvvvvv.cn/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.3.101.110 , United States, ASN36352 (AS-COLOCROSSING, US), Reverse DNS 192-3-101-110-host.colocrossing.com Software Apache / Resource Hash bbfe1536a99000acceb61f549aa59354cc596efc9f10d3843aab6b273f5adb1e Request headers accept-language jp-JP,jp;q=0.9 Referer https://id.userpayypppay.jvvvvv.cn/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers date Mon, 27 Mar 2023 04:03:01 GMT content-encoding gzip last-modified Tue, 06 Jul 2021 10:01:50 GMT server Apache etag "471da-5c67182b41f80-gzip" vary Accept-Encoding content-type application/javascript accept-ranges bytes
GET H2	200	site-jquery.min.js Show response id.userpayypppay.jvvvvv.cn/admin/im/	91 KB 32 KB	178ms 178ms	Script application/javascript	192.3.101.110 AS-COLOCROSSING
General Check archive.org Show headers Download Go to Full URL https://id.userpayypppay.jvvvvv.cn/admin/im/site-jquery.min.js Requested by Host: id.userpayypppay.jvvvvv.cn URL: https://id.userpayypppay.jvvvvv.cn/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.3.101.110 , United States, ASN36352 (AS-COLOCROSSING, US), Reverse DNS 192-3-101-110-host.colocrossing.com Software Apache / Resource Hash 5994332aadd364a7350ad226ef61c1c75dc97372f739e01682e190be3abaf672 Request headers accept-language jp-JP,jp;q=0.9 Referer https://id.userpayypppay.jvvvvv.cn/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers date Mon, 27 Mar 2023 04:03:01 GMT content-encoding gzip last-modified Mon, 23 Aug 2021 14:34:16 GMT server Apache etag "16b60-5ca3ae9624a00-gzip" vary Accept-Encoding content-type application/javascript accept-ranges bytes content-length 32817
GET H2	200	layer.min.css cdn.bootcdn.net/ajax/libs/layer/3.5.1/theme/default/	13 KB 4 KB	1483ms 80ms	Stylesheet text/css	221.194.141.163 CHINA169-BACKBONE...
General Check archive.org Show headers Download Go to Full URL https://cdn.bootcdn.net/ajax/libs/layer/3.5.1/theme/default/layer.min.css Requested by Host: id.userpayypppay.jvvvvv.cn URL: https://id.userpayypppay.jvvvvv.cn/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 221.194.141.163 , China, ASN4837 (CHINA169-BACKBONE CHINA UNICOM China169 Backbone, CN), Reverse DNS Software openresty / Resource Hash f99199228144a11b7adda7dad83f11c366ecb6f530ba8a352fb155bc0e58fc0e Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers accept-language jp-JP,jp;q=0.9 Referer https://id.userpayypppay.jvvvvv.cn/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers nginx-hit 1 date Mon, 27 Mar 2023 04:03:03 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status MISS nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=15780000 via CHN-HElangfang-AREACUCC2-CACHE60[4],CHN-HElangfang-AREACUCC2-CACHE11[0,TCP_HIT,0],CHN-TJ-GLOBAL1-CACHE23[8],CHN-TJ-GLOBAL1-CACHE118[0,TCP_HIT,6] age 25387168 x-ccdn-cachettl 31536000 cross-origin-resource-policy cross-origin nginx-vary Accept-Encoding alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 2655 last-modified Fri, 11 Jun 2021 14:31:54 GMT server openresty cf-cdnjs-via cfworker/kv etag "60c373da-a5f" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=48xpaZOmBqYDa%2BYmD8uAG7J4y9708fRESewOa4rF3Sx0OQuZ0eSkqF9PL2RlSyd6lGGx1n3fnGLy4y7PHARsQcxYflRJHhKcHMHb0e8FBWU22pcpz3ddrEQ4xhjUoWasid2nNLvC"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=utf-8 access-control-allow-origin * cache-control public, max-age=30672000 x-ccdn-expires 6148861 accept-ranges bytes timing-allow-origin * cf-ray 716f9b8aef137e9f-LAX x-hcs-proxy-type 1 expires Sat, 27 May 2023 07:59:15 GMT
GET H2	200	img_logo.png image.paypay.ne.jp/page/common/images/	3 KB 4 KB	199ms 11ms	Image image/png	54.230.130.122 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://image.paypay.ne.jp/page/common/images/img_logo.png Requested by Host: id.userpayypppay.jvvvvv.cn URL: https://id.userpayypppay.jvvvvv.cn/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 54.230.130.122 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-54-230-130-122.kix56.r.cloudfront.net Software AmazonS3 / Resource Hash 5ae82ced18f26ecb4117409ff2d4bdda73abde9f5a0e20ac42a8fa1ac9b34585 Security Headers Name Value Content-Security-Policy default-src 'self' *.paypay.ne.jp; frame-ancestors 'none' *.paypay.ne.jp Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 1; mode=block Request headers accept-language jp-JP,jp;q=0.9 Referer https://id.userpayypppay.jvvvvv.cn/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers x-amz-version-id null strict-transport-security max-age=31536000 x-content-type-options nosniff content-security-policy default-src 'self' *.paypay.ne.jp; frame-ancestors 'none' *.paypay.ne.jp via 1.1 e06dfcdb8abf82709b7aa659a8d098ce.cloudfront.net (CloudFront) date Mon, 27 Mar 2023 04:02:54 GMT x-amz-cf-pop KIX56-C1 age 13 x-cache Hit from cloudfront x-amz-replication-status COMPLETED content-length 3152 x-xss-protection 1; mode=block last-modified Fri, 28 Sep 2018 05:29:53 GMT server AmazonS3 etag "8c1b8640bc954bdd4481f6ad1e582636" expect-ct max-age=86400, enforce x-frame-options DENY content-type image/png accept-ranges bytes x-amz-cf-id WOhYMqf8meus6lZGGpe5Pb0REv3H9gKt2FkIsvShXNHqlZV-1xcRWQ==
GET H2	200	wh.jpg id.userpayypppay.jvvvvv.cn/img/	19 KB 19 KB	169ms 169ms	Image image/jpeg	192.3.101.110 AS-COLOCROSSING
General Check archive.org Show headers Download Go to Show image Full URL https://id.userpayypppay.jvvvvv.cn/img/wh.jpg Requested by Host: id.userpayypppay.jvvvvv.cn URL: https://id.userpayypppay.jvvvvv.cn/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.3.101.110 , United States, ASN36352 (AS-COLOCROSSING, US), Reverse DNS 192-3-101-110-host.colocrossing.com Software Apache / Resource Hash 3e32f8bf479bb3f575b39f4b527168e383b9250ad71e58c0d05986ac91f33781 Request headers accept-language jp-JP,jp;q=0.9 Referer https://id.userpayypppay.jvvvvv.cn/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers date Mon, 27 Mar 2023 04:03:02 GMT last-modified Sat, 21 Aug 2021 12:36:28 GMT server Apache accept-ranges bytes etag "4ac9-5ca11086a6b00" content-length 19145 content-type image/jpeg
GET H2	200	yahoo.png id.userpayypppay.jvvvvv.cn/img/	3 KB 3 KB	170ms 169ms	Image image/png	192.3.101.110 AS-COLOCROSSING
General Check archive.org Show headers Download Go to Show image Full URL https://id.userpayypppay.jvvvvv.cn/img/yahoo.png Requested by Host: id.userpayypppay.jvvvvv.cn URL: https://id.userpayypppay.jvvvvv.cn/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.3.101.110 , United States, ASN36352 (AS-COLOCROSSING, US), Reverse DNS 192-3-101-110-host.colocrossing.com Software Apache / Resource Hash d199dc9e85fcb241d1a30afee87b452ff65ac1909e8d1fd50505e1ebcb63ee36 Request headers accept-language jp-JP,jp;q=0.9 Referer https://id.userpayypppay.jvvvvv.cn/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers date Mon, 27 Mar 2023 04:03:02 GMT last-modified Sun, 22 Aug 2021 07:14:40 GMT server Apache accept-ranges bytes etag "c9a-5ca20a7691800" content-length 3226 content-type image/png
GET H2	200	ft.jpg id.userpayypppay.jvvvvv.cn/img/	1 KB 1 KB	169ms 169ms	Image image/jpeg	192.3.101.110 AS-COLOCROSSING
General Check archive.org Show headers Download Go to Show image Full URL https://id.userpayypppay.jvvvvv.cn/img/ft.jpg Requested by Host: id.userpayypppay.jvvvvv.cn URL: https://id.userpayypppay.jvvvvv.cn/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.3.101.110 , United States, ASN36352 (AS-COLOCROSSING, US), Reverse DNS 192-3-101-110-host.colocrossing.com Software Apache / Resource Hash 0c1d3200cef32f9183ddbe639d498c10d46f8d21f6f9b202a23ef9453624f7f6 Request headers accept-language jp-JP,jp;q=0.9 Referer https://id.userpayypppay.jvvvvv.cn/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers date Mon, 27 Mar 2023 04:03:02 GMT last-modified Sun, 22 Aug 2021 07:08:58 GMT server Apache accept-ranges bytes etag "49d-5ca2093069680" content-length 1181 content-type image/jpeg
GET H2	404	laydate.css id.userpayypppay.jvvvvv.cn/admin/im/css/modules/laydate/default/	0 0	171ms 170ms	Stylesheet text/html	192.3.101.110 AS-COLOCROSSING
General Check archive.org Show headers Download Go to Full URL https://id.userpayypppay.jvvvvv.cn/admin/im/css/modules/laydate/default/laydate.css?v=5.3.1 Requested by Host: id.userpayypppay.jvvvvv.cn URL: https://id.userpayypppay.jvvvvv.cn/admin/im/layui.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.3.101.110 , United States, ASN36352 (AS-COLOCROSSING, US), Reverse DNS 192-3-101-110-host.colocrossing.com Software Apache / Resource Hash Request headers accept-language jp-JP,jp;q=0.9 Referer https://id.userpayypppay.jvvvvv.cn/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers date Mon, 27 Mar 2023 04:03:02 GMT server Apache content-length 273 content-type text/html; charset=iso-8859-1
GET H2	404	layer.css id.userpayypppay.jvvvvv.cn/admin/im/css/modules/layer/default/	0 0	168ms 167ms	Stylesheet text/html	192.3.101.110 AS-COLOCROSSING
General Check archive.org Show headers Download Go to Full URL https://id.userpayypppay.jvvvvv.cn/admin/im/css/modules/layer/default/layer.css?v=3.5.1 Requested by Host: id.userpayypppay.jvvvvv.cn URL: https://id.userpayypppay.jvvvvv.cn/admin/im/layui.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.3.101.110 , United States, ASN36352 (AS-COLOCROSSING, US), Reverse DNS 192-3-101-110-host.colocrossing.com Software Apache / Resource Hash Request headers accept-language jp-JP,jp;q=0.9 Referer https://id.userpayypppay.jvvvvv.cn/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers date Mon, 27 Mar 2023 04:03:02 GMT server Apache content-length 273 content-type text/html; charset=iso-8859-1
GET H2	404	code.css id.userpayypppay.jvvvvv.cn/admin/im/css/modules/	0 0	170ms 167ms	Stylesheet text/html	192.3.101.110 AS-COLOCROSSING
General Check archive.org Show headers Download Go to Full URL https://id.userpayypppay.jvvvvv.cn/admin/im/css/modules/code.css?v=2 Requested by Host: id.userpayypppay.jvvvvv.cn URL: https://id.userpayypppay.jvvvvv.cn/admin/im/layui.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.3.101.110 , United States, ASN36352 (AS-COLOCROSSING, US), Reverse DNS 192-3-101-110-host.colocrossing.com Software Apache / Resource Hash Request headers accept-language jp-JP,jp;q=0.9 Referer https://id.userpayypppay.jvvvvv.cn/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers date Mon, 27 Mar 2023 04:03:02 GMT server Apache content-length 273 content-type text/html; charset=iso-8859-1
GET H2	200	api.php Show response id.userpayypppay.jvvvvv.cn/	13 B 107 B	172ms 172ms	XHR text/html	192.3.101.110 AS-COLOCROSSING
General Check archive.org Show headers Download Go to Full URL https://id.userpayypppay.jvvvvv.cn/api.php?act=ip_save&_r=0.09335574383073997 Requested by Host: id.userpayypppay.jvvvvv.cn URL: https://id.userpayypppay.jvvvvv.cn/admin/im/site-jquery.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.3.101.110 , United States, ASN36352 (AS-COLOCROSSING, US), Reverse DNS 192-3-101-110-host.colocrossing.com Software Apache / Resource Hash aa3d21398252adb9f16b5208884b4da22eec9f2019a0139b114a61f178396794 Request headers Accept */* Referer https://id.userpayypppay.jvvvvv.cn/ X-Requested-With XMLHttpRequest accept-language jp-JP,jp;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers pragma no-cache date Mon, 27 Mar 2023 04:03:03 GMT content-encoding gzip server Apache vary Accept-Encoding content-type text/html; charset=UTF-8 cache-control no-store, no-cache, must-revalidate content-length 33 expires Thu, 19 Nov 1981 08:52:00 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPay (Financial)

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| layui function| lay number| errors object| layer object| jQuery112405669640191692755 function| $ function| jQuery object| mask object| timer object| hb_timer function| heart_beat function| ip_save function| is_agree function| verify

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			id.userpayypppay.jvvvvv.cn/	1969-12-31 23:59:59	Name: PHPSESSID Value: s1b675pvttjijp0itks9vopil6

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://id.userpayypppay.jvvvvv.cn/admin/im/css/modules/laydate/default/laydate.css?v=5.3.1 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://id.userpayypppay.jvvvvv.cn/admin/im/css/modules/layer/default/layer.css?v=3.5.1 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://id.userpayypppay.jvvvvv.cn/admin/im/css/modules/code.css?v=2 Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.bootcdn.net
id.userpayypppay.jvvvvv.cn
image.paypay.ne.jp
192.3.101.110
221.194.141.163
54.230.130.122
0c1d3200cef32f9183ddbe639d498c10d46f8d21f6f9b202a23ef9453624f7f6
3e32f8bf479bb3f575b39f4b527168e383b9250ad71e58c0d05986ac91f33781
50ec1968b792de12f08cc09782cd954c4c468e9907ec2dd39c0412430e5de209
5994332aadd364a7350ad226ef61c1c75dc97372f739e01682e190be3abaf672
5ae82ced18f26ecb4117409ff2d4bdda73abde9f5a0e20ac42a8fa1ac9b34585
aa3d21398252adb9f16b5208884b4da22eec9f2019a0139b114a61f178396794
bbfe1536a99000acceb61f549aa59354cc596efc9f10d3843aab6b273f5adb1e
d199dc9e85fcb241d1a30afee87b452ff65ac1909e8d1fd50505e1ebcb63ee36
f99199228144a11b7adda7dad83f11c366ecb6f530ba8a352fb155bc0e58fc0e