![](/screenshots/e29541ac-c431-4ad2-9d42-5c751a437b04.png)
paypal-update.landinglion.com
Open in
urlscan Pro
52.11.70.207
Public Scan
Submission Tags: phishing malicious Search All
Submission: On September 08 via api from US
Summary
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on May 6th 2019. Valid for: 2 years.
This is the only time paypal-update.landinglion.com was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
5 | 52.11.70.207 52.11.70.207 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
1 | 2a00:1450:400... 2a00:1450:4001:80b::200a | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 | 2600:9000:205... 2600:9000:2057:c200:3:78c:9c0:93a1 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
2 | 2a00:1450:400... 2a00:1450:4001:825::2003 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
9 | 4 |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-11-70-207.us-west-2.compute.amazonaws.com
paypal-update.landinglion.com | |
gfonts.landinglion.net |
ASN15169 (GOOGLE - Google LLC, US)
fonts.googleapis.com |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
cdn.landinglion.net |
ASN15169 (GOOGLE - Google LLC, US)
fonts.gstatic.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
landinglion.com
paypal-update.landinglion.com |
188 KB |
2 |
gstatic.com
fonts.gstatic.com |
18 KB |
2 |
landinglion.net
gfonts.landinglion.net cdn.landinglion.net |
3 KB |
1 |
googleapis.com
fonts.googleapis.com |
1 KB |
9 | 4 |
Domain | Requested by | |
---|---|---|
4 | paypal-update.landinglion.com |
paypal-update.landinglion.com
|
2 | fonts.gstatic.com |
paypal-update.landinglion.com
|
1 | cdn.landinglion.net |
paypal-update.landinglion.com
|
1 | gfonts.landinglion.net |
paypal-update.landinglion.com
|
1 | fonts.googleapis.com |
paypal-update.landinglion.com
|
9 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.landinglion.com Sectigo RSA Domain Validation Secure Server CA |
2019-05-06 - 2021-05-07 |
2 years | crt.sh |
*.googleapis.com GTS CA 1O1 |
2019-08-23 - 2019-11-21 |
3 months | crt.sh |
gfonts.landinglion.net Let's Encrypt Authority X3 |
2019-09-01 - 2019-11-30 |
3 months | crt.sh |
cdn.landinglion.net Amazon |
2019-08-16 - 2020-09-16 |
a year | crt.sh |
*.google.com GTS CA 1O1 |
2019-08-23 - 2019-11-21 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://paypal-update.landinglion.com/login-paypal/
Frame ID: E3E43AACF49B98E8EE6A59B6530B09B0
Requests: 9 HTTP requests in this frame
Screenshot
![](/screenshots/e29541ac-c431-4ad2-9d42-5c751a437b04.png)
Detected technologies
![](/vendor/wappa/icons/Ubuntu.png)
Detected patterns
- headers server /Ubuntu/i
Detected patterns
- headers server /nginx(?:\/([\d.]+))?/i
![](/vendor/wappa/icons/Google Font API.png)
Detected patterns
- html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
9 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
paypal-update.landinglion.com/login-paypal/ |
29 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
build-0.1.css
paypal-update.landinglion.com/shared/css/ |
30 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
12 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
gfonts.landinglion.net/ |
2 KB 824 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
5e7772f7-5763-484f-a798-8ec420e8f9a0.svg
cdn.landinglion.net/files/0000026424/ |
5 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
build-0.1.js
paypal-update.landinglion.com/shared/js/ |
503 KB 174 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v17/ |
9 KB 9 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v17/ |
9 KB 9 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
discrete-events
paypal-update.landinglion.com/analytics/v0/bach/ |
305 B 403 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
66 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| LL_INFO object| LZString object| _gsScope function| $ function| jQuery function| _ object| angular object| IPv6 object| punycode object| SecondLevelDomains function| URI function| URITemplate object| _gsQueue object| GreenSockGlobals object| com function| _gsDefine function| Ease function| Power4 function| Strong function| Quint function| Power3 function| Quart function| Power2 function| Cubic function| Power1 function| Quad function| Power0 function| Linear function| TweenLite function| TweenPlugin function| TweenMax function| TimelineLite function| TimelineMax function| BezierPlugin function| CSSPlugin function| BackOut function| BackIn function| BackInOut object| Back function| SlowMo function| SteppedEase function| ExpoScaleEase function| RoughEase function| BounceOut function| BounceIn function| BounceInOut object| Bounce function| CircOut function| CircIn function| CircInOut object| Circ function| ElasticOut function| ElasticIn function| ElasticInOut object| Elastic function| ExpoOut function| ExpoIn function| ExpoInOut object| Expo function| SineOut function| SineIn function| SineInOut object| Sine object| EaseLookup function| MorphSVGPlugin function| DrawSVGPlugin6 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.landinglion.com/ | Name: VariantId Value: 1028398 |
|
.landinglion.com/ | Name: VisitorId Value: 8c948468-aa01-4b83-9e56-3ad47757f476 |
|
.landinglion.com/ | Name: CampaignId Value: 1011345 |
|
.landinglion.com/ | Name: variantWeightIndex Value: 0.636324615048396 |
|
.landinglion.com/ | Name: SessionId Value: 20d99600-6153-4f40-b402-7151623d2143 |
|
.landinglion.com/ | Name: PageId Value: 1027101 |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.landinglion.net
fonts.googleapis.com
fonts.gstatic.com
gfonts.landinglion.net
paypal-update.landinglion.com
2600:9000:2057:c200:3:78c:9c0:93a1
2a00:1450:4001:80b::200a
2a00:1450:4001:825::2003
52.11.70.207
2b71828b146a6fff579e8f35e600dae040221239d02405b90f57cd7707d32958
413a998656d511817103ff1fbb92ef6ec3b98b2117f328caccee9776444128cd
470999c1b90b6fe935cdb52901bf1082c970407f27e8a4059b756d36b1bd58b0
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
b3cc50b9e94bbecaaeb1079b64b8ca50616d1732824964c1cc2c5422627a0ec5
b8e23a845bc6b7fd417d29182e0e38d353e64b5e12e06bb1de2b5ce063db1dcc
d7623cf43b0c90eba3705563811e2f06217ea3951dbffcf6b5eb6ec79b6837b0
eaa7eec66f2087911cd0a46a06be6719bc98700649ee9a302d9c2e64ce5a7182
fa2f5c45ed868727f0e72e7615dc4d1b1d76266bf4126cfe616f5c0774d4d494