Report - pay-pay-ne-jp.replit.app/login.php/

Report Overview

Submitted URL
pay-pay-ne-jp.replit.app/login.php/
IP
34.117.33.233
ASN
#396982 GOOGLE-CLOUD-PLATFORM
Submitted
2024-04-18 19:12:13
Access
public
Website Title
PayPay
Final URL
pay-pay-ne-jp.replit.app/login.php/
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
26

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
www.paypay.ne.jp	unknown	2018-06-14	2018-10-02	2024-04-15	459 B	23 kB	108.157.214.96
pay-pay-ne-jp.replit.app	unknown	2021-04-16	2024-03-11	2024-04-17	5.8 kB	703 kB	34.117.33.233

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2024-04-13	medium	pay-pay-ne-jp.replit.app/login.php/	PayPay

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-04-18	medium	pay-pay-ne-jp.replit.app	Sinkholed
2024-04-18	medium	pay-pay-ne-jp.replit.app	Sinkholed
2024-04-18	medium	pay-pay-ne-jp.replit.app	Sinkholed
2024-04-18	medium	pay-pay-ne-jp.replit.app	Sinkholed
2024-04-18	medium	pay-pay-ne-jp.replit.app	Sinkholed
2024-04-18	medium	pay-pay-ne-jp.replit.app	Sinkholed
2024-04-18	medium	pay-pay-ne-jp.replit.app	Sinkholed
2024-04-18	medium	pay-pay-ne-jp.replit.app	Sinkholed
2024-04-18	medium	pay-pay-ne-jp.replit.app	Sinkholed
2024-04-18	medium	pay-pay-ne-jp.replit.app	Sinkholed
2024-04-18	medium	pay-pay-ne-jp.replit.app	Sinkholed
2024-04-18	medium	pay-pay-ne-jp.replit.app	Sinkholed

ThreatFox

No alerts detected

JavaScript (2)

	URL	Size	First Seen	Last Seen
	pay-pay-ne-jp.replit.app/login.php/	870 B	2023-03-09	2024-04-24
Pretty URL pay-pay-ne-jp.replit.app/login.php/ IP 34.117.33.233 ASN #396982 GOOGLE-CLOUD-PLATFORM Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-09 02:04:59 Last Seen2024-04-24 19:13:23 Times Seen273 Hash 750f145798a8c6c773fbb65c0de5be4c a4a8a2cd32f19de73e1f3508ab0742f6e77bab44 b627af6a787c7a60f2a554a71237c834d1d9a20de48b091a80b73333a6e265f3 Loading...

	pay-pay-ne-jp.replit.app/login.php/	633 B	2023-03-26	2024-04-24
Pretty URL pay-pay-ne-jp.replit.app/login.php/ IP 34.117.33.233 ASN #396982 GOOGLE-CLOUD-PLATFORM Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-26 03:49:28 Last Seen2024-04-24 19:13:23 Times Seen105 Hash c72bd127c1a3140bf517b1399e9a016a 420f435b4a526f0acbd87f53e990c1f2327a3ce1 b59844ab91fa2e661adb2f91981aa64f1e8420ecd48c7ea4f23b75c97b34898c Loading...

HTTP Transactions (13)

URL IP Response Size

pay-pay-ne-jp.replit.app/login.php/PayPay_files/account-page~f71cff67.96e81cc5.css

34.117.33.233

200 OK

48 kB

URL GET HTTP/3
pay-pay-ne-jp.replit.app/login.php/PayPay_files/account-page~f71cff67.96e81cc5.css
IP
34.117.33.233:443
ASN
#396982 GOOGLE-CLOUD-PLATFORM

Requested by
https://pay-pay-ne-jp.replit.app/login.php/
Certificate
IssuerGoogle Trust Services LLC
Subjectreplit.app
FingerprintB7:63:C6:71:CB:87:E2:38:C1:27:BB:21:03:4F:59:4E:4C:9C:7C:BB
ValidityThu, 18 Apr 2024 08:30:37 GMT - Wed, 17 Jul 2024 09:26:32 GMT

File type
data
Size
48 kB (48006 bytes)
Hash
e0263b01f79e6afb5f6a130ec673ae65
c006b8ad49dd7027bc14a894c23465813757bd19
49614d49953717b0fec88d2693527482c6787d19a7651c913eac4cbf33b73393

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /login.php/PayPay_files/account-page~f71cff67.96e81cc5.css HTTP/1.1
Host: pay-pay-ne-jp.replit.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pay-pay-ne-jp.replit.app/login.php/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
content-type: text/html; charset=UTF-8
date: Thu, 18 Apr 2024 19:11:48 GMT
server: Google Frontend
strict-transport-security: max-age=63072000; includeSubDomains
x-powered-by: PHP/8.2.0RC7
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

pay-pay-ne-jp.replit.app/login.php/PayPay_files/main~748942c6.dc692474.css

34.117.33.233

200 OK

33 kB

URL GET HTTP/3
pay-pay-ne-jp.replit.app/login.php/PayPay_files/main~748942c6.dc692474.css
IP
34.117.33.233:443
ASN
#396982 GOOGLE-CLOUD-PLATFORM

Requested by
https://pay-pay-ne-jp.replit.app/login.php/
Certificate
IssuerGoogle Trust Services LLC
Subjectreplit.app
FingerprintB7:63:C6:71:CB:87:E2:38:C1:27:BB:21:03:4F:59:4E:4C:9C:7C:BB
ValidityThu, 18 Apr 2024 08:30:37 GMT - Wed, 17 Jul 2024 09:26:32 GMT

File type
data
Size
33 kB (32787 bytes)
Hash
ae42ec66c9817f4ec8e9865f17d4784c
18f9306e439bad326ae6783b2fbfd4abad4b8f0d
08f794c951855a79dce178362b4e1ea440d35c8023c55424fe1e001d05e1e2df

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /login.php/PayPay_files/main~748942c6.dc692474.css HTTP/1.1
Host: pay-pay-ne-jp.replit.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pay-pay-ne-jp.replit.app/login.php/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
content-type: text/html; charset=UTF-8
date: Thu, 18 Apr 2024 19:11:48 GMT
server: Google Frontend
strict-transport-security: max-age=63072000; includeSubDomains
x-powered-by: PHP/8.2.0RC7
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

pay-pay-ne-jp.replit.app/portal/api/v1/custom-metrics/appLoadTimeout10S

34.117.33.233

200 OK

388 kB

URL GET HTTP/3
pay-pay-ne-jp.replit.app/portal/api/v1/custom-metrics/appLoadTimeout10S
IP
34.117.33.233:443
ASN
#396982 GOOGLE-CLOUD-PLATFORM

Requested by
https://pay-pay-ne-jp.replit.app/login.php/
Certificate
IssuerGoogle Trust Services LLC
Subjectreplit.app
FingerprintB7:63:C6:71:CB:87:E2:38:C1:27:BB:21:03:4F:59:4E:4C:9C:7C:BB
ValidityThu, 18 Apr 2024 08:30:37 GMT - Wed, 17 Jul 2024 09:26:32 GMT

File type
HTML document, Unicode text, UTF-8 text, with very long lines (57756)
Size
388 kB (387800 bytes)
Hash
6f7b89589ab8dd276ef01334794e1aa9
fcae573e735266f300402ea715c9734d7ee36463
f8b409ab776503b563dd187a32a8bc62ee4279d429ecd2fb76285acfe598a946

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /portal/api/v1/custom-metrics/appLoadTimeout10S HTTP/1.1
Host: pay-pay-ne-jp.replit.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://pay-pay-ne-jp.replit.app/login.php/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
content-type: text/html; charset=UTF-8
date: Thu, 18 Apr 2024 19:11:58 GMT
server: Google Frontend
strict-transport-security: max-age=63072000; includeSubDomains
x-powered-by: PHP/8.2.0RC7
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

pay-pay-ne-jp.replit.app/login.php/PayPay_files/chunk-vendors~fdc6512a.61c8e8bc.css

34.117.33.233

200 OK

26 kB

URL GET HTTP/3
pay-pay-ne-jp.replit.app/login.php/PayPay_files/chunk-vendors~fdc6512a.61c8e8bc.css
IP
34.117.33.233:443
ASN
#396982 GOOGLE-CLOUD-PLATFORM

Requested by
https://pay-pay-ne-jp.replit.app/login.php/
Certificate
IssuerGoogle Trust Services LLC
Subjectreplit.app
FingerprintB7:63:C6:71:CB:87:E2:38:C1:27:BB:21:03:4F:59:4E:4C:9C:7C:BB
ValidityThu, 18 Apr 2024 08:30:37 GMT - Wed, 17 Jul 2024 09:26:32 GMT

File type

Size
26 kB (25624 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /login.php/PayPay_files/chunk-vendors~fdc6512a.61c8e8bc.css HTTP/1.1
Host: pay-pay-ne-jp.replit.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pay-pay-ne-jp.replit.app/login.php/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
content-type: text/html; charset=UTF-8
date: Thu, 18 Apr 2024 19:11:48 GMT
server: Google Frontend
strict-transport-security: max-age=63072000; includeSubDomains
x-powered-by: PHP/8.2.0RC7
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

pay-pay-ne-jp.replit.app/login.php/PayPay_files/main~6a2c624d.fcb27ef1.css

34.117.33.233

200 OK

26 kB

URL GET HTTP/3
pay-pay-ne-jp.replit.app/login.php/PayPay_files/main~6a2c624d.fcb27ef1.css
IP
34.117.33.233:443
ASN
#396982 GOOGLE-CLOUD-PLATFORM

Requested by
https://pay-pay-ne-jp.replit.app/login.php/
Certificate
IssuerGoogle Trust Services LLC
Subjectreplit.app
FingerprintB7:63:C6:71:CB:87:E2:38:C1:27:BB:21:03:4F:59:4E:4C:9C:7C:BB
ValidityThu, 18 Apr 2024 08:30:37 GMT - Wed, 17 Jul 2024 09:26:32 GMT

File type

Size
26 kB (25624 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /login.php/PayPay_files/main~6a2c624d.fcb27ef1.css HTTP/1.1
Host: pay-pay-ne-jp.replit.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pay-pay-ne-jp.replit.app/login.php/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
content-type: text/html; charset=UTF-8
date: Thu, 18 Apr 2024 19:11:48 GMT
server: Google Frontend
strict-transport-security: max-age=63072000; includeSubDomains
x-powered-by: PHP/8.2.0RC7
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

pay-pay-ne-jp.replit.app/login.php/PayPay_files/main~5a11b65b.305b4c7b.css

34.117.33.233

200 OK

26 kB

URL GET HTTP/3
pay-pay-ne-jp.replit.app/login.php/PayPay_files/main~5a11b65b.305b4c7b.css
IP
34.117.33.233:443
ASN
#396982 GOOGLE-CLOUD-PLATFORM

Requested by
https://pay-pay-ne-jp.replit.app/login.php/
Certificate
IssuerGoogle Trust Services LLC
Subjectreplit.app
FingerprintB7:63:C6:71:CB:87:E2:38:C1:27:BB:21:03:4F:59:4E:4C:9C:7C:BB
ValidityThu, 18 Apr 2024 08:30:37 GMT - Wed, 17 Jul 2024 09:26:32 GMT

File type

Size
26 kB (25624 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /login.php/PayPay_files/main~5a11b65b.305b4c7b.css HTTP/1.1
Host: pay-pay-ne-jp.replit.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pay-pay-ne-jp.replit.app/login.php/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
content-type: text/html; charset=UTF-8
date: Thu, 18 Apr 2024 19:11:48 GMT
server: Google Frontend
strict-transport-security: max-age=63072000; includeSubDomains
x-powered-by: PHP/8.2.0RC7
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

pay-pay-ne-jp.replit.app/login.php/PayPay_files/p2p-page~21833f8f.1cb4356a.css

34.117.33.233

200 OK

26 kB

URL GET HTTP/3
pay-pay-ne-jp.replit.app/login.php/PayPay_files/p2p-page~21833f8f.1cb4356a.css
IP
34.117.33.233:443
ASN
#396982 GOOGLE-CLOUD-PLATFORM

Requested by
https://pay-pay-ne-jp.replit.app/login.php/
Certificate
IssuerGoogle Trust Services LLC
Subjectreplit.app
FingerprintB7:63:C6:71:CB:87:E2:38:C1:27:BB:21:03:4F:59:4E:4C:9C:7C:BB
ValidityThu, 18 Apr 2024 08:30:37 GMT - Wed, 17 Jul 2024 09:26:32 GMT

File type

Size
26 kB (25624 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /login.php/PayPay_files/p2p-page~21833f8f.1cb4356a.css HTTP/1.1
Host: pay-pay-ne-jp.replit.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pay-pay-ne-jp.replit.app/login.php/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
content-type: text/html; charset=UTF-8
date: Thu, 18 Apr 2024 19:11:48 GMT
server: Google Frontend
strict-transport-security: max-age=63072000; includeSubDomains
x-powered-by: PHP/8.2.0RC7
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

www.paypay.ne.jp/cdn/apps/prod/web/4-10-0/favicon.ico

108.157.214.96

200 OK

22 kB

URL GET HTTP/2
www.paypay.ne.jp/cdn/apps/prod/web/4-10-0/favicon.ico
IP
108.157.214.96:443
ASN
#16509 AMAZON-02

Requested by
https://pay-pay-ne-jp.replit.app/login.php/
Certificate
IssuerGlobalSign nv-sa
Subject*.paypay.ne.jp
FingerprintC9:77:78:E2:27:EE:69:07:4A:14:2B:68:72:84:15:28:C1:0F:53:EE
ValidityThu, 12 Oct 2023 08:26:20 GMT - Tue, 12 Nov 2024 08:26:19 GMT

File type
MS Windows icon resource - 3 icons, 64x64, 32 bits/pixel, 32x32, 32 bits/pixel
Size
22 kB (22382 bytes)
Hash
576287a38d00e198b1e8b4881932be10
8401d5110333717c59e4165d34dce913eb117697
3850a133bfe3ac48100036a9452f60bfc74538bd94ced9aa53db40b5654749e5

HTTP Headers

GET /cdn/apps/prod/web/4-10-0/favicon.ico HTTP/1.1
Host: www.paypay.ne.jp
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pay-pay-ne-jp.replit.app/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: image/vnd.microsoft.icon
content-length: 22382
date: Thu, 18 Apr 2024 06:28:55 GMT
x-amz-replication-status: COMPLETED
last-modified: Wed, 23 Aug 2023 13:05:41 GMT
etag: "576287a38d00e198b1e8b4881932be10"
x-amz-server-side-encryption: AES256
x-amz-version-id: IqQZOLU8z_ETdaKouRqrg.3LPRwvP5q8
accept-ranges: bytes
server: AmazonS3
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
expect-ct: max-age=86400, enforce
content-security-policy: default-src 'self' *.paypay.ne.jp; frame-ancestors 'none' *.paypay.ne.jp; connect-src https://*.tiles.mapbox.com https://api.mapbox.com https://events.mapbox.com
x-frame-options: DENY
x-cache: Hit from cloudfront
via: 1.1 9fde400234236c10982fe8b8a3ca9eb2.cloudfront.net (CloudFront)
x-amz-cf-pop: ARN56-P1
x-amz-cf-id: fWlGhKGI_i5MGD3_IMGlqJgNBDGggmjo0yzaH64k-Bu7j70bUckrfA==
age: 45774
X-Firefox-Spdy: h2

pay-pay-ne-jp.replit.app/login.php/

34.117.33.233

200 OK

26 kB

URL User Request GET HTTP/2
pay-pay-ne-jp.replit.app/login.php/
IP
34.117.33.233:443
ASN
#396982 GOOGLE-CLOUD-PLATFORM

Certificate
IssuerGoogle Trust Services LLC
Subjectreplit.app
FingerprintB7:63:C6:71:CB:87:E2:38:C1:27:BB:21:03:4F:59:4E:4C:9C:7C:BB
ValidityThu, 18 Apr 2024 08:30:37 GMT - Wed, 17 Jul 2024 09:26:32 GMT

File type

Size
26 kB (25624 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	PayPay
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /login.php/ HTTP/1.1
Host: pay-pay-ne-jp.replit.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: text/html; charset=UTF-8
date: Thu, 18 Apr 2024 19:11:48 GMT
server: Google Frontend
strict-transport-security: max-age=63072000; includeSubDomains
x-powered-by: PHP/8.2.0RC7
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

pay-pay-ne-jp.replit.app/login.php/PayPay_files/npm.element-ui~793f9119.6d7c9c7e.css

34.117.33.233

200 OK

26 kB

URL GET HTTP/3
pay-pay-ne-jp.replit.app/login.php/PayPay_files/npm.element-ui~793f9119.6d7c9c7e.css
IP
34.117.33.233:443
ASN
#396982 GOOGLE-CLOUD-PLATFORM

Requested by
https://pay-pay-ne-jp.replit.app/login.php/
Certificate
IssuerGoogle Trust Services LLC
Subjectreplit.app
FingerprintB7:63:C6:71:CB:87:E2:38:C1:27:BB:21:03:4F:59:4E:4C:9C:7C:BB
ValidityThu, 18 Apr 2024 08:30:37 GMT - Wed, 17 Jul 2024 09:26:32 GMT

File type

Size
26 kB (25624 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /login.php/PayPay_files/npm.element-ui~793f9119.6d7c9c7e.css HTTP/1.1
Host: pay-pay-ne-jp.replit.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pay-pay-ne-jp.replit.app/login.php/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
content-type: text/html; charset=UTF-8
date: Thu, 18 Apr 2024 19:11:48 GMT
server: Google Frontend
strict-transport-security: max-age=63072000; includeSubDomains
x-powered-by: PHP/8.2.0RC7
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

pay-pay-ne-jp.replit.app/login.php/PayPay_files/chunk-vendors~253ae210.0fb89b1a.css

34.117.33.233

200 OK

26 kB

URL GET HTTP/3
pay-pay-ne-jp.replit.app/login.php/PayPay_files/chunk-vendors~253ae210.0fb89b1a.css
IP
34.117.33.233:443
ASN
#396982 GOOGLE-CLOUD-PLATFORM

Requested by
https://pay-pay-ne-jp.replit.app/login.php/
Certificate
IssuerGoogle Trust Services LLC
Subjectreplit.app
FingerprintB7:63:C6:71:CB:87:E2:38:C1:27:BB:21:03:4F:59:4E:4C:9C:7C:BB
ValidityThu, 18 Apr 2024 08:30:37 GMT - Wed, 17 Jul 2024 09:26:32 GMT

File type

Size
26 kB (25624 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /login.php/PayPay_files/chunk-vendors~253ae210.0fb89b1a.css HTTP/1.1
Host: pay-pay-ne-jp.replit.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pay-pay-ne-jp.replit.app/login.php/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
content-type: text/html; charset=UTF-8
date: Thu, 18 Apr 2024 19:11:48 GMT
server: Google Frontend
strict-transport-security: max-age=63072000; includeSubDomains
x-powered-by: PHP/8.2.0RC7
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

pay-pay-ne-jp.replit.app/login.php/PayPay_files/js

34.117.33.233

200 OK

26 kB

URL GET HTTP/3
pay-pay-ne-jp.replit.app/login.php/PayPay_files/js
IP
34.117.33.233:443
ASN
#396982 GOOGLE-CLOUD-PLATFORM

Requested by
https://pay-pay-ne-jp.replit.app/login.php/
Certificate
IssuerGoogle Trust Services LLC
Subjectreplit.app
FingerprintB7:63:C6:71:CB:87:E2:38:C1:27:BB:21:03:4F:59:4E:4C:9C:7C:BB
ValidityThu, 18 Apr 2024 08:30:37 GMT - Wed, 17 Jul 2024 09:26:32 GMT

File type

Size
26 kB (25624 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /login.php/PayPay_files/js HTTP/1.1
Host: pay-pay-ne-jp.replit.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pay-pay-ne-jp.replit.app/login.php/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
content-type: text/html; charset=UTF-8
date: Thu, 18 Apr 2024 19:11:48 GMT
server: Google Frontend
strict-transport-security: max-age=63072000; includeSubDomains
x-powered-by: PHP/8.2.0RC7
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

pay-pay-ne-jp.replit.app/login.php/PayPay_files/account-page-sign~f71cff67.217fec94.css

34.117.33.233

200 OK

26 kB

URL GET HTTP/3
pay-pay-ne-jp.replit.app/login.php/PayPay_files/account-page-sign~f71cff67.217fec94.css
IP
34.117.33.233:443
ASN
#396982 GOOGLE-CLOUD-PLATFORM

Requested by
https://pay-pay-ne-jp.replit.app/login.php/
Certificate
IssuerGoogle Trust Services LLC
Subjectreplit.app
FingerprintB7:63:C6:71:CB:87:E2:38:C1:27:BB:21:03:4F:59:4E:4C:9C:7C:BB
ValidityThu, 18 Apr 2024 08:30:37 GMT - Wed, 17 Jul 2024 09:26:32 GMT

File type

Size
26 kB (25624 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /login.php/PayPay_files/account-page-sign~f71cff67.217fec94.css HTTP/1.1
Host: pay-pay-ne-jp.replit.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pay-pay-ne-jp.replit.app/login.php/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
content-type: text/html; charset=UTF-8
date: Thu, 18 Apr 2024 19:11:48 GMT
server: Google Frontend
strict-transport-security: max-age=63072000; includeSubDomains
x-powered-by: PHP/8.2.0RC7
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (2)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (13)

URL GET HTTP/3

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/3

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/3

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/3

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections