cbradiochat.org
Open in
urlscan Pro
2606:4700:3037::6815:26a8
Malicious Activity!
Public Scan
Effective URL: https://cbradiochat.org/info/paypalil/app/signin
Submission: On July 30 via api from GB
Summary
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on June 10th 2021. Valid for: a year.
This is the only time cbradiochat.org was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: PayPal (Financial)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 67.199.248.10 67.199.248.10 | 396982 (GOOGLE-PR...) (GOOGLE-PRIVATE-CLOUD) | |
1 1 | 143.95.111.243 143.95.111.243 | 62729 (ASMALLORA...) (ASMALLORANGE1) | |
2 9 | 2606:4700:303... 2606:4700:3037::6815:26a8 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700::68... 2606:4700::6810:a723 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2a00:1450:400... 2a00:1450:4001:828::200e | 15169 (GOOGLE) (GOOGLE) | |
1 | 2606:4700:303... 2606:4700:3035::ac43:c763 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:400c:c07::9c | 15169 (GOOGLE) (GOOGLE) | |
12 | 5 |
ASN15169 (GOOGLE, US)
www.google-analytics.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
cbradiochat.org
2 redirects
cbradiochat.org |
139 KB |
2 |
google-analytics.com
www.google-analytics.com |
19 KB |
1 |
doubleclick.net
stats.g.doubleclick.net |
84 B |
1 |
js-codes.com
js-codes.com |
2 KB |
1 |
cloudflare.com
ajax.cloudflare.com |
4 KB |
1 |
boogiewars.com
1 redirects
boogiewars.com |
226 B |
1 |
bit.ly
1 redirects
bit.ly |
260 B |
12 | 7 |
Domain | Requested by | |
---|---|---|
9 | cbradiochat.org |
2 redirects
cbradiochat.org
ajax.cloudflare.com |
2 | www.google-analytics.com |
cbradiochat.org
www.google-analytics.com |
1 | stats.g.doubleclick.net |
www.google-analytics.com
|
1 | js-codes.com |
ajax.cloudflare.com
|
1 | ajax.cloudflare.com |
cbradiochat.org
|
1 | boogiewars.com | 1 redirects |
1 | bit.ly | 1 redirects |
12 | 7 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2021-06-10 - 2022-06-09 |
a year | crt.sh |
ajax.cloudflare.com DigiCert ECC Secure Server CA |
2020-08-11 - 2022-08-16 |
2 years | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2021-06-28 - 2021-09-20 |
3 months | crt.sh |
*.g.doubleclick.net GTS CA 1C3 |
2021-06-28 - 2021-09-20 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://cbradiochat.org/info/paypalil/app/signin
Frame ID: 78826400F578A67145008A7F668F226D
Requests: 12 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://bit.ly/PAlPAllog
HTTP 301
http://boogiewars.com/info/login/log.php HTTP 302
https://cbradiochat.org/info/paypalil/ HTTP 302
https://cbradiochat.org/info/paypalil/app/index HTTP 302
https://cbradiochat.org/info/paypalil/app/signin Page URL
Detected technologies
CloudFlare (CDN) ExpandDetected patterns
- headers server /^cloudflare$/i
Google Analytics (Analytics) Expand
Detected patterns
- script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i
Modernizr (JavaScript Libraries) Expand
Detected patterns
- script /([\d.]+)?\/modernizr(?:.([\d.]+))?.*\.js/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery[.-]([\d.]*\d)[^/]*\.js/i
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://bit.ly/PAlPAllog
HTTP 301
http://boogiewars.com/info/login/log.php HTTP 302
https://cbradiochat.org/info/paypalil/ HTTP 302
https://cbradiochat.org/info/paypalil/app/index HTTP 302
https://cbradiochat.org/info/paypalil/app/signin Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H3-29 |
Primary Request
signin
cbradiochat.org/info/paypalil/app/ Redirect Chain
|
11 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
yUsvxCcFHO19_DdGWNvdWgeThbU.js
cbradiochat.org/cdn-cgi/apps/head/ |
6 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
signin.css
cbradiochat.org/info/paypalil/app/lib/styles/ |
12 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
rocket-loader.min.js
ajax.cloudflare.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/ |
12 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ |
48 KB 19 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
logo_official.svg
cbradiochat.org/info/paypalil/app/lib/pics/ |
5 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
p_small_regular.woff
cbradiochat.org/info/paypalil/app/lib/fonts/ |
46 KB 47 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
p_small_light.woff
cbradiochat.org/info/paypalil/app/lib/fonts/ |
46 KB 46 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3-29 |
collect
www.google-analytics.com/j/ |
4 B 24 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
modernizr.min.js
js-codes.com/modernizr/2.9.0/ |
4 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
jquery-3.3.1.min.js
cbradiochat.org/info/paypalil/app/lib/js/ |
85 KB 31 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
stats.g.doubleclick.net/j/ |
1 B 84 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: PayPal (Financial)25 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated object| Eager object| CloudflareApps string| GoogleAnalyticsObject function| ga object| google_tag_data object| gaplugins object| gaGlobal object| gaData object| __cfQR function| $ function| jQuery object| html5 object| Modernizr boolean| __cfRLUnblockHandlers4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.cbradiochat.org/ | Name: _gat Value: 1 |
|
.cbradiochat.org/ | Name: _gid Value: GA1.2.2045098406.1627639842 |
|
.cbradiochat.org/ | Name: _ga Value: GA1.2.2020257389.1627639842 |
|
cbradiochat.org/ | Name: PHPSESSID Value: 5t393ldu5tl5avtvi3grshjjb1 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.cloudflare.com
bit.ly
boogiewars.com
cbradiochat.org
js-codes.com
stats.g.doubleclick.net
www.google-analytics.com
143.95.111.243
2606:4700:3035::ac43:c763
2606:4700:3037::6815:26a8
2606:4700::6810:a723
2a00:1450:4001:828::200e
2a00:1450:400c:c07::9c
67.199.248.10
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
843e67ad522a908162007f4b7601819a5bbfef00e38ac7aec778766da8b7b2ab
99cf92b2c06b7404ccaf1965cd6e9181ec4a0ea59a32e766fd39a86684446cfe
a6c3bff965978df8093c3a29f7071c21d7439a212af41e7b40ce70d94d6bcc44
ae79dcc3eb016922caa1d095cfd936446bc65a46bb3364b242dfc556f7e3c6a8
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
b3cc50b9e94bbecaaeb1079b64b8ca50616d1732824964c1cc2c5422627a0ec5
b4449f69dbea0ea60a1fbaa525ec5f8293966ad791679d29e48c363200d8d599
c9655d1f4ce5570decced8e57f8826dc5968a5bf8f8a1ceab8d0838b0f46077e
ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142
e61660c659c426e45bce2937dddb01af6b550502a2904546575c1ec2ba1121dd