pze.old.mybluehost.me Open in urlscan Pro
66.235.200.147 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://parelhas.rn.gov.br/unsubscribe.php?id=316341433163414331634143
Effective URL:
https://pze.old.mybluehost.me/.well-known/pki-validation/app/signin
Submission: On May 11 via manual (May 11th 2024, 2:47:03 pm UTC) from US — Scanned from DE

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 3 domains to perform 9 HTTP transactions. The main IP is 66.235.200.147, located in United States and belongs to CLOUDFLARENET, US. The main domain is pze.old.mybluehost.me.
TLS certificate: Issued by GTS CA 1P5 on April 21st 2024. Valid for: 3 months.

This is the only time pze.old.mybluehost.me was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: PayPal (Financial)

Domain & IP information

	IP Address	AS Autonomous System
1 1	50.116.87.223 50.116.87.223	19871 (NETWORK-S...) (NETWORK-SOLUTIONS-HOSTING)
3 11	66.235.200.147 66.235.200.147	13335 (CLOUDFLAR...) (CLOUDFLARENET)
9	2

1 50.116.87.223 (United States) 1 redirects

ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: 50-116-87-223.unifiedlayer.com

parelhas.rn.gov.br	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 66.235.200.147 (United States) 3 redirects

ASN13335 (CLOUDFLARENET, US)
PTR: host77.ipowerweb.com

pze.old.mybluehost.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	mybluehost.me 3 redirects pze.old.mybluehost.me	146 KB
1	parelhas.rn.gov.br 1 redirects parelhas.rn.gov.br	115 B
0	js-codes.com Failed js-codes.com Failed
9	3

	Domain	Requested by
11	pze.old.mybluehost.me	3 redirects pze.old.mybluehost.me
1	parelhas.rn.gov.br	1 redirects
0	js-codes.com Failed	pze.old.mybluehost.me
9	3

This site contains no links.

Subject Issuer	Validity	Valid
pze.old.mybluehost.me GTS CA 1P5	`2024-04-21` - `2024-07-20`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://pze.old.mybluehost.me/.well-known/pki-validation/app/signin
Frame ID: 30735EFF774DA5C68DCD24709B943551
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Loggen Sie sich bei PayPal ein

Page URL History Show full URLs

https://parelhas.rn.gov.br/unsubscribe.php?id=316341433163414331634143 HTTP 302
https://pze.old.mybluehost.me/.well-known/pki-validation HTTP 301
https://pze.old.mybluehost.me/.well-known/pki-validation/ HTTP 302
https://pze.old.mybluehost.me/.well-known/pki-validation/app/index HTTP 302
https://pze.old.mybluehost.me/.well-known/pki-validation/app/signin Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

9
Requests

89 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

1
Countries

145 kB
Transfer

222 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://parelhas.rn.gov.br/unsubscribe.php?id=316341433163414331634143 HTTP 302
https://pze.old.mybluehost.me/.well-known/pki-validation HTTP 301
https://pze.old.mybluehost.me/.well-known/pki-validation/ HTTP 302
https://pze.old.mybluehost.me/.well-known/pki-validation/app/index HTTP 302
https://pze.old.mybluehost.me/.well-known/pki-validation/app/signin Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request signin Show response
pze.old.mybluehost.me/.well-known/pki-validation/app/
Redirect Chain

https://parelhas.rn.gov.br/unsubscribe.php?id=316341433163414331634143
https://pze.old.mybluehost.me/.well-known/pki-validation
https://pze.old.mybluehost.me/.well-known/pki-validation/
https://pze.old.mybluehost.me/.well-known/pki-validation/app/index
https://pze.old.mybluehost.me/.well-known/pki-validation/app/signin

19 KB
7 KB

253ms
252ms

Document
text/html

66.235.200.147
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://pze.old.mybluehost.me/.well-known/pki-validation/app/signin

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

66.235.200.147 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

host77.ipowerweb.com

Software

cloudflare /

Resource Hash

4584d105387dc72d2e4a10a5324c713020da845cdb8b11a6429ca534d246282f

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

cache-control: no-store, no-cache, must-revalidate
cf-cache-status: MISS
cf-ray: 8822f62abc9e03ec-FRA
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Sat, 11 May 2024 14:46:59 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
host: www.fbi.gov
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
last-modified: Sat, 11 May 2024 14:46:59 GMT
origin: https://www.fbi.gov
pragma: no-cache
referer: https://www.fbi.gov
remote_addr: 104.16.77.187
server: cloudflare
vary: Accept-Encoding
x-content-type: nosniff
x-endurance-cache-level: 2
x-forwarded-host: www.fbi.gov
x-forwarded-proto: https
x-nginx-cache: WordPress
x-xss-protection: 1; mode=block
x_forwarded_for: 104.16.77.187

Redirect headers

cache-control: no-store, no-cache, must-revalidate
cf-cache-status: MISS
cf-ray: 8822f620b86a03ec-FRA
content-type: text/html; charset=UTF-8
date: Sat, 11 May 2024 14:46:58 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
host: www.fbi.gov
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
location: signin
origin: https://www.fbi.gov
pragma: no-cache
referer: https://www.fbi.gov
remote_addr: 104.16.77.187
server: cloudflare
vary: Accept-Encoding
x-content-type: nosniff
x-endurance-cache-level: 2
x-forwarded-host: www.fbi.gov
x-forwarded-proto: https
x-nginx-cache: WordPress
x-xss-protection: 1; mode=block
x_forwarded_for: 104.16.77.187

GET
H2 200 signin.css
pze.old.mybluehost.me/.well-known/pki-validation/app/lib/styles/ 15 KB
4 KB 24ms
24ms Stylesheet
text/css 66.235.200.147
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://pze.old.mybluehost.me/.well-known/pki-validation/app/lib/styles/signin.css

Requested by

Host: pze.old.mybluehost.me
URL: https://pze.old.mybluehost.me/.well-known/pki-validation/app/signin

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

66.235.200.147 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

host77.ipowerweb.com

Software

cloudflare /

Resource Hash

44334e15099fb14b56b78e0fa275cf5a74469c83dee771388b0df6fd1777d6f7

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://pze.old.mybluehost.me/.well-known/pki-validation/app/signin
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 14:46:59 GMT
content-encoding: gzip
origin: https://www.fbi.gov
cf-cache-status: HIT
age: 1114216
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
x-forwarded-proto: https
content-length: 3822
x-xss-protection: 1; mode=block
x-content-type: nosniff
x-nginx-cache: WordPress
last-modified: Mon, 01 Apr 2019 13:09:50 GMT
x-forwarded-host: www.fbi.gov
x_forwarded_for: 104.16.77.187
host: www.fbi.gov
server: cloudflare
remote_addr: 104.16.77.187
vary: Accept-Encoding
x-endurance-cache-level: 2
content-type: text/css
cache-control: max-age=2592000
referer: https://www.fbi.gov
accept-ranges: bytes
cf-ray: 8822f62c5e7603ec-FRA
expires: Tue, 28 May 2024 17:16:43 GMT

GET
H2 200 jquery-3.3.1.min.js Show response
pze.old.mybluehost.me/.well-known/pki-validation/app/lib/js/ 85 KB
37 KB 23ms
22ms Script
application/javascript 66.235.200.147
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://pze.old.mybluehost.me/.well-known/pki-validation/app/lib/js/jquery-3.3.1.min.js

Requested by

Host: pze.old.mybluehost.me
URL: https://pze.old.mybluehost.me/.well-known/pki-validation/app/signin

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

66.235.200.147 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

host77.ipowerweb.com

Software

cloudflare /

Resource Hash

160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://pze.old.mybluehost.me/.well-known/pki-validation/app/signin
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 14:46:59 GMT
content-encoding: gzip
origin: https://www.fbi.gov
cf-cache-status: HIT
age: 14577
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
x-forwarded-proto: https
x-xss-protection: 1; mode=block
x-content-type: nosniff
x-nginx-cache: WordPress
last-modified: Mon, 01 Apr 2019 13:09:50 GMT
x-forwarded-host: www.fbi.gov
x_forwarded_for: 104.16.77.187
host: www.fbi.gov
server: cloudflare
remote_addr: 104.16.77.187
vary: Accept-Encoding
x-endurance-cache-level: 2
content-type: application/javascript
cache-control: max-age=21600
referer: https://www.fbi.gov
cf-ray: 8822f62c5e7703ec-FRA
expires: Sat, 11 May 2024 16:44:02 GMT

GET modernizr.min.js
js-codes.com/modernizr/2.9.0/ 0
0

GET
H2 200 email-decode.min.js Show response
pze.old.mybluehost.me/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
849 B 10ms
10ms Script
application/javascript 66.235.200.147
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://pze.old.mybluehost.me/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Requested by

Host: pze.old.mybluehost.me
URL: https://pze.old.mybluehost.me/.well-known/pki-validation/app/signin

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

66.235.200.147 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

host77.ipowerweb.com

Software

cloudflare /

Resource Hash

2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://pze.old.mybluehost.me/.well-known/pki-validation/app/signin
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 14:46:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 08 May 2024 09:31:53 GMT
server: cloudflare
etag: W/"663b4689-4d7"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/javascript
cache-control: max-age=172800, public
cf-ray: 8822f62c5e7903ec-FRA
expires: Mon, 13 May 2024 14:46:59 GMT

GET
H2 200 logo_official.svg
pze.old.mybluehost.me/.well-known/pki-validation/app/lib/pics/ 5 KB
2 KB 218ms
218ms Image
image/svg+xml 66.235.200.147
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pze.old.mybluehost.me/.well-known/pki-validation/app/lib/pics/logo_official.svg

Requested by

Host: pze.old.mybluehost.me
URL: https://pze.old.mybluehost.me/.well-known/pki-validation/app/lib/styles/signin.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

66.235.200.147 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

host77.ipowerweb.com

Software

cloudflare /

Resource Hash

b3cc50b9e94bbecaaeb1079b64b8ca50616d1732824964c1cc2c5422627a0ec5

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://pze.old.mybluehost.me/.well-known/pki-validation/app/lib/styles/signin.css
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 14:46:59 GMT
content-encoding: gzip
origin: https://www.fbi.gov
cf-cache-status: REVALIDATED
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
x-forwarded-proto: https
x-xss-protection: 1; mode=block
x-content-type: nosniff
x-nginx-cache: WordPress
last-modified: Mon, 01 Apr 2019 13:09:50 GMT
x-forwarded-host: www.fbi.gov
x_forwarded_for: 104.16.77.187
host: www.fbi.gov
server: cloudflare
remote_addr: 104.16.77.187
vary: Accept-Encoding
x-endurance-cache-level: 2
content-type: image/svg+xml
cache-control: max-age=21600
referer: https://www.fbi.gov
cf-ray: 8822f62db81d03ec-FRA
expires: Sat, 11 May 2024 20:46:59 GMT

GET
H2 200 p_small_regular.woff
pze.old.mybluehost.me/.well-known/pki-validation/app/lib/fonts/ 46 KB
46 KB 282ms
281ms Font
font/woff 66.235.200.147
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://pze.old.mybluehost.me/.well-known/pki-validation/app/lib/fonts/p_small_regular.woff

Requested by

Host: pze.old.mybluehost.me
URL: https://pze.old.mybluehost.me/.well-known/pki-validation/app/lib/styles/signin.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

66.235.200.147 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

host77.ipowerweb.com

Software

cloudflare /

Resource Hash

ae79dcc3eb016922caa1d095cfd936446bc65a46bb3364b242dfc556f7e3c6a8

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://pze.old.mybluehost.me/.well-known/pki-validation/app/lib/styles/signin.css
Origin: https://pze.old.mybluehost.me
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 14:46:59 GMT
origin: https://www.fbi.gov
cf-cache-status: REVALIDATED
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
x-forwarded-proto: https
content-length: 47339
x-xss-protection: 1; mode=block
x-content-type: nosniff
x-nginx-cache: WordPress
last-modified: Mon, 01 Apr 2019 13:09:48 GMT
x-forwarded-host: www.fbi.gov
x_forwarded_for: 104.16.77.187
host: www.fbi.gov
server: cloudflare
remote_addr: 104.16.77.187
vary: Accept-Encoding
x-endurance-cache-level: 2
content-type: font/woff
cache-control: max-age=21600
referer: https://www.fbi.gov
accept-ranges: bytes
cf-ray: 8822f62dc82703ec-FRA
expires: Sat, 11 May 2024 20:46:59 GMT

GET
H2 200 p_small_light.woff
pze.old.mybluehost.me/.well-known/pki-validation/app/lib/fonts/ 46 KB
46 KB 514ms
513ms Font
font/woff 66.235.200.147
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://pze.old.mybluehost.me/.well-known/pki-validation/app/lib/fonts/p_small_light.woff

Requested by

Host: pze.old.mybluehost.me
URL: https://pze.old.mybluehost.me/.well-known/pki-validation/app/lib/styles/signin.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

66.235.200.147 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

host77.ipowerweb.com

Software

cloudflare /

Resource Hash

843e67ad522a908162007f4b7601819a5bbfef00e38ac7aec778766da8b7b2ab

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://pze.old.mybluehost.me/.well-known/pki-validation/app/lib/styles/signin.css
Origin: https://pze.old.mybluehost.me
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 14:46:59 GMT
origin: https://www.fbi.gov
cf-cache-status: REVALIDATED
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
x-forwarded-proto: https
content-length: 46703
x-xss-protection: 1; mode=block
x-content-type: nosniff
x-nginx-cache: WordPress
last-modified: Mon, 01 Apr 2019 13:09:48 GMT
x-forwarded-host: www.fbi.gov
x_forwarded_for: 104.16.77.187
host: www.fbi.gov
server: cloudflare
remote_addr: 104.16.77.187
vary: Accept-Encoding
x-endurance-cache-level: 2
content-type: font/woff
cache-control: max-age=21600
referer: https://www.fbi.gov
accept-ranges: bytes
cf-ray: 8822f62dc82903ec-FRA
expires: Sat, 11 May 2024 20:46:59 GMT

GET
H2 200 favi.ico
pze.old.mybluehost.me/.well-known/pki-validation/app/lib/pics/ 5 KB
2 KB 30ms
30ms Other
image/x-icon 66.235.200.147
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://pze.old.mybluehost.me/.well-known/pki-validation/app/lib/pics/favi.ico

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

66.235.200.147 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

host77.ipowerweb.com

Software

cloudflare /

Resource Hash

1690c4e20869c3763b7fc111e2f94035b0a7ee830311dd680ac91421daad3667

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://pze.old.mybluehost.me/.well-known/pki-validation/app/signin
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 11 May 2024 14:47:00 GMT
content-encoding: gzip
origin: https://www.fbi.gov
cf-cache-status: HIT
age: 1114215
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
x-forwarded-proto: https
x-xss-protection: 1; mode=block
x-content-type: nosniff
x-nginx-cache: WordPress
last-modified: Mon, 01 Apr 2019 13:09:50 GMT
x-forwarded-host: www.fbi.gov
x_forwarded_for: 104.16.77.187
host: www.fbi.gov
server: cloudflare
remote_addr: 104.16.77.187
vary: Accept-Encoding
x-endurance-cache-level: 2
content-type: image/x-icon
cache-control: max-age=31536000
referer: https://www.fbi.gov
cf-ray: 8822f630fbaf03ec-FRA
expires: Mon, 28 Apr 2025 17:16:45 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: js-codes.com
URL: https://js-codes.com/modernizr/2.9.0/modernizr.min.js

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.pze.old.mybluehost.me/	1969-12-31 23:59:59	Name: _cfuvid Value: hTb.N14YvB_UhniZDmCm2w4egrvkBPfy8OgYm.XDgX0-1715438816645-0.0.1.1-604800000
			pze.old.mybluehost.me/	1969-12-31 23:59:59	Name: PHPSESSID Value: e6cfc1b0cd642047cca5829ae6f92ce3

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://pze.old.mybluehost.me/.well-known/pki-validation/app/signin Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

js-codes.com
parelhas.rn.gov.br
pze.old.mybluehost.me
js-codes.com
50.116.87.223
66.235.200.147
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
1690c4e20869c3763b7fc111e2f94035b0a7ee830311dd680ac91421daad3667
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
44334e15099fb14b56b78e0fa275cf5a74469c83dee771388b0df6fd1777d6f7
4584d105387dc72d2e4a10a5324c713020da845cdb8b11a6429ca534d246282f
843e67ad522a908162007f4b7601819a5bbfef00e38ac7aec778766da8b7b2ab
ae79dcc3eb016922caa1d095cfd936446bc65a46bb3364b242dfc556f7e3c6a8
b3cc50b9e94bbecaaeb1079b64b8ca50616d1732824964c1cc2c5422627a0ec5

pze.old.mybluehost.me Open in urlscan Pro 66.235.200.147 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

9 Requests

89 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

2 IPs

1 Countries

145 kBTransfer

222 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

2 Cookies

1 Console Messages

Security Headers

Indicators

pze.old.mybluehost.me Open in urlscan Pro
66.235.200.147 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

89 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

1
Countries

145 kB
Transfer

222 kB
Size

2
Cookies

9 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!