{"report_id":"5e0e4b74-6296-470d-824e-7ad83de53b10","version":0,"status":"done","tags":["paypal","phishing","financial"],"date":"2026-07-29T13:11:51Z","url":{"schema":"http","addr":"zerointerestpromo.com","fqdn":"zerointerestpromo.com","domain":"zerointerestpromo.com","tld":"com"},"ip":{"addr":"95.111.240.229","port":0,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"final":{"url":{"schema":"https","addr":"zerointerestpromo.com/","fqdn":"zerointerestpromo.com","domain":"zerointerestpromo.com","tld":"com"},"title":"Log in to your PayPal account","dom":{"size":75807,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (829)","md5":"91607c0b60cd54894c1924eea3fdedd6","sha1":"ded87a964865a82837da35e167043ff22a154db6","sha256":"301778ca62cd9d65508bbf9c3cd3c95edc864d49c92cec44ad89b1b4a1071d45","sha512":"1f32e00340c7054efae8dc9ae57b311b32bf5e91d002e8036a0a9ff51d6ecee1b4869735a6fab8f9439fb1ddecd69ac54195089b852717a2fb08a9fd0e4f33f0","ssdeep":"768:NRfFH7Wu/IzIt3S9FFFQ6FvSipUjKYSS/KdcQIObVwlFZk6V4Sd5gxjzr:NRfl7x/IUwLa69MjKYTK62b5zjH","tlshash":"6073947777ab04717967c4ad77a64b4a2524f003b805d5183edc32d09fcee86e862abc","dom_hash":"domhash5e677fa9310e22e7aa4c2bff9bdc9b8b","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"zerointerestpromo.com","fqdn":"zerointerestpromo.com","domain":"zerointerestpromo.com","tld":"com"},"ip":{"addr":"95.111.240.229","port":0,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-02T13:11:51Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":0}},"detection":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - PayPal","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with PayPal phishing","tags":["paypal","phishing","financial"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - PayPal","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with PayPal phishing","tags":["paypal","phishing","financial"],"meta":null}]},"summary":[{"fqdn":"www.paypalobjects.com","ip":{"addr":"151.101.3.1","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"domain_registered":"2005-05-12","domain_rank":19317,"first_seen":"2012-05-30T06:40:21Z","last_seen":"2026-07-23T16:48:23.499957Z","alert_count":0,"request_count":3,"received_data":37194,"sent_data":1676,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]}]},{"fqdn":"zerointerestpromo.com","ip":{"addr":"95.111.240.229","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"domain_registered":"2026-07-28","domain_rank":0,"first_seen":"2026-07-29T13:06:28.634304Z","last_seen":"2026-07-29T13:06:28.634304Z","alert_count":2,"request_count":2,"received_data":76589,"sent_data":985,"comment":"","tags":null,"fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}]},{"fqdn":"flagcdn.com","ip":{"addr":"172.67.180.104","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2020-04-05","domain_rank":30920,"first_seen":"2020-04-05T08:17:33Z","last_seen":"2026-07-24T06:33:06.436724Z","alert_count":0,"request_count":1,"received_data":1442,"sent_data":543,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - PayPal","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with PayPal phishing","tags":["paypal","phishing","financial"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"zerointerestpromo.com/","fqdn":"zerointerestpromo.com","domain":"zerointerestpromo.com","tld":"com"},"ip":{"addr":"95.111.240.229","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":true,"md5":"4de5a7d8782947436000f53875429222","sha1":"76a17d78d36f2bca50e0c0e29e70d470d015ee43","sha256":"74b00a50fbfbcfd0cec84315796e818e7063cefce4dc93ea0259a0db3663a50e","sha512":"4c8b84417002db3b398e582aff5895e5fb664d1ee26f58daf70bb99e1d9d89a768a0bb1b4129b78dce96316a94fcd5f3ed41cc9531f49ec1104cbddecbd6f211","ssdeep":"384:nwKn7f86dqx8vBcZJhG/tIg0ANb5wCpCSwlFZaUkJagh6VE:wKdcQIObVwlFZk6VE","tlshash":"44b2edb7b3ae14b07977e16e7747468a2425b0033841a8083e9c72c06fded5ed562ebc","size":25334,"data":"","first_seen":"2026-07-29T13:06:32.093043Z","last_seen":"2026-07-29T13:11:56.183065Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"zerointerestpromo.com/","fqdn":"zerointerestpromo.com","domain":"zerointerestpromo.com","tld":"com"},"ip":{"addr":"95.111.240.229","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":true,"md5":"ed6212b6e70969b6892cd4efdf27d7c6","sha1":"e4a479c6220ce4861b1d94b1e668194c97c9ff15","sha256":"9bc39181b26ba26e2dab1c13c077b00d136d7d18e345f7aeb3b7c47ec317fe97","sha512":"8e776d40bd915ccb9cac27ac5f7012a0ace443930580ddec9b3041df89da5c278d88e45fbc057239b7db70d06c9b8da984e195bbb9e72844bbde0f6c9e2fc4c4","ssdeep":"192:TpmKafE8aEapKg8Tx5pjgcKf7ko7kBgM+9cKwmlkylk7zDF6h:FjoE8TapKg8TxncJ7ko7kBgTqRmlkyl/","tlshash":"c022bc7b36a70870baebd5af73a653c5742970173c0194093d2e73948fede82a0229f5","size":10728,"data":"","first_seen":"2026-07-29T13:06:32.095245Z","last_seen":"2026-07-29T13:11:56.184024Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"zerointerestpromo.com/","fqdn":"zerointerestpromo.com","domain":"zerointerestpromo.com","tld":"com"},"ip":{"addr":"95.111.240.229","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-29T13:11:24.253Z","timestamp":1785330684253,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.zerointerestpromo.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Jul 2026 19:47:18 GMT","end":"Mon, 26 Oct 2026 19:47:17 GMT"},"fingerprint":{"sha1":"90:F4:2E:CA:A4:A8:3B:CF:44:89:F1:EF:C9:2C:62:53:09:F5:75:EE","sha256":"3A:83:93:CE:84:5E:2D:1A:1D:1A:AD:F0:19:13:2F:EB:68:60:67:ED:BF:EF:58:A8:59:2A:18:39:3E:41:72:18"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: zerointerestpromo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 29 Jul 2026 13:11:24 GMT\r\nServer: Apache\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate\r\nPragma: no-cache\r\nSet-Cookie: PHPSESSID=5cdbe94753f104c7eefea13d9cd7a712; path=/\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nTransfer-Encoding: chunked\r\nContent-Type: text/html; charset=UTF-8\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":75989,"size_decoded":76359,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (823), with CRLF line terminators","md5":"6378c0c2c123704f8fbc3df8f54273b7","sha1":"2b8a4912f9cf534f82f9426750022ed76c7ef45c","sha256":"1d5f5341932f894faf1087cd41a0bac5ca25518317b34a85343d420e1597d26e","sha512":"e24251f97a4c47c4dba810c49b5963604dbf08beabe08bc8c7ef49c3e8feb859855b1810504d79e88e4cb63cd162243007204ff50a1b07ca1d775eba450ef688","ssdeep":"768:FYxvZQ8X448JSqZvSuFmFuA0+Satn4B2SZ82B2xahk6Qg6VLSfzb8Ad:FG14JS8XIQAt/4B2V2oYkTAd","tlshash":"0173617672844071b977c26dbb624b49f925b013ba0241193aec72c15ffee46d923ebc","first_seen":"2026-07-29T13:11:53.081454Z","last_seen":"2026-07-29T13:11:53.081454Z","times_seen":1,"resource_available":false,"data":null}},"time_used":703,"timings":{"blocked":-1,"dns":46,"connect":22,"send":0,"wait":556,"receive":49,"ssl":29},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - PayPal","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with PayPal phishing","tags":["paypal","phishing","financial"],"meta":null}]}},{"url":{"schema":"https","addr":"flagcdn.com/16x12/us.png","fqdn":"flagcdn.com","domain":"flagcdn.com","tld":"com"},"ip":{"addr":"172.67.180.104","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://zerointerestpromo.com/","date":"2026-07-29T13:11:25.278Z","timestamp":1785330685278,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"flagcdn.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Jul 2026 01:47:23 GMT","end":"Tue, 27 Oct 2026 02:42:40 GMT"},"fingerprint":{"sha1":"DB:70:D4:5F:B8:7E:38:F4:35:F1:23:C7:66:98:1A:51:08:78:F6:40","sha256":"47:2A:A2:91:C2:CC:37:AC:9C:8E:B5:A6:FD:21:5C:06:B6:3E:13:2D:D0:DF:E8:55:90:D7:80:3D:D5:34:02:A8"}}},"request":{"raw":"GET /16x12/us.png HTTP/1.1\r\nHost: flagcdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zerointerestpromo.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 29 Jul 2026 13:11:25 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Tue, 01 Jul 2025 15:39:56 GMT\r\netag: \"6864014c-260\"\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2678400, s-maxage=2678400\r\naccept-ranges: bytes\r\npriority: u=5,i\r\nage: 1846605\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2F9uqmCDsqXFsv0Xk6ZdJt%2BEIrGEMUVhB5QPBturZgtp6FqFMu49iNSr1j%2BoC5oE7mLvBlZkD%2BVjDUJZrinIyL5GWM7PdcG3sGskXJxCgEoJ4TnLq%2FhyA73vbWrhAFQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncf-ray: a22c5e8f1c4556ae-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 608\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":608,"size_decoded":1442,"mime_type":"image/png","magic":"PNG image data, 16 x 12, 8-bit colormap, non-interlaced","md5":"d4514b1f803ef955baea2512df50c271","sha1":"12306e04a0168abba816cc48e1290204a676e969","sha256":"fcaef9a9329c59eb2b99d20bdfad3d445d47af4e564ef85b694b9df424477993","sha512":"c2268cc3366e7566ac7529d9d1ee1bbdae9aa9f1759b2101e963a9c6f31f2a2c1f5b4719e9c61062cf6c0cc3294cdf585e4c36b6d548e1b9ca91e6384956e5db","ssdeep":"","tlshash":"8df002b16cd92d2f8bb11a565a2d66b29f165471c3671054010169973d8278b76a01ac","first_seen":"2025-07-18T20:05:22.079762Z","last_seen":"2026-07-29T14:38:13.627785Z","times_seen":147,"resource_available":false,"data":null}},"time_used":29,"timings":{"blocked":-1,"dns":3,"connect":15,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.paypalobjects.com/paypal-ui/fonts/PayPalOpen-Regular.woff2","fqdn":"www.paypalobjects.com","domain":"paypalobjects.com","tld":"com"},"ip":{"addr":"151.101.3.1","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://zerointerestpromo.com/","date":"2026-07-29T13:11:25.288Z","timestamp":1785330685288,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.paypalobjects.com","organization":""},"issuer":{"commonName":"DigiCert EV RSA CA G2","organization":"DigiCert Inc"},"validity":{"start":"Mon, 23 Mar 2026 00:00:00 GMT","end":"Wed, 07 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C5:00:18:97:B9:56:2D:A2:02:A9:4D:5F:A6:BD:CF:EE:71:7F:9C:70","sha256":"64:BB:91:23:34:C5:83:1C:FA:85:2C:6D:1A:14:E6:E1:AB:9D:84:06:AE:2E:45:D4:68:B7:F4:BD:6B:F2:50:A2"}}},"request":{"raw":"GET /paypal-ui/fonts/PayPalOpen-Regular.woff2 HTTP/1.1\r\nHost: www.paypalobjects.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://zerointerestpromo.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zerointerestpromo.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-length: 27457\r\ncache-control: s-maxage=31536000, public,max-age=31536000\r\ntiming-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com\r\naccess-control-allow-methods: GET\r\nlast-modified: Thu, 02 Jun 2022 17:26:24 GMT\r\npaypal-debug-id: b42895292a6be\r\ndc: ccg11-origin-www-1.paypal.com\r\ntraceparent: 00-0000000000000000000b42895292a6be-cc377a6dfdd50433-01\r\netag: \"6298f2c0-6b41\"\r\nvia: 1.1 varnish, 1.1 varnish\r\naccept-ranges: bytes\r\ndate: Wed, 29 Jul 2026 13:11:25 GMT\r\nx-served-by: cache-sjc1000144-SJC, cache-sjc10020-SJC, cache-bma-essb1270049-BMA\r\nx-cache: MISS, HIT, HIT\r\nx-cache-hits: 0, 555, 4\r\nx-timer: S1785330685.328063,VS0,VE0\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\naccess-control-allow-origin: *\r\ncontent-type: application/font-woff2\r\nstrict-transport-security: max-age=31557600\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]}],"data":{"size":27457,"size_decoded":28318,"mime_type":"application/font-woff2","magic":"Web Open Font Format (Version 2), TrueType, length 27457, version 1.0","md5":"49d49974386dc725656bc1a2bf32ed44","sha1":"26139d3425422f233dfccb09fca2edb36f01e390","sha256":"9ae7b95f034d76b21aaf8fcc0cdd39f4ba7ba59dd9751348a32c7e5cfdfdb6df","sha512":"440a101dc681e69275ab9c2bfa2e436b9d3500debfcf5c84f47b9796f6879e1021b4a6e797ea3c4b45052f68cb066c1bcc75b4a6ac204a40848cb4eb6731f94a","ssdeep":"768:rs41ijgVewvJ0P+BvnbXzmX07uu/pmawwzQ8Mv:rsaijVwP1bXzmX077zQzv","tlshash":"9dc2e0f975cfa310c31d315cbce08a7a010579a8ece47799c368999f195bc8ad1db13a","first_seen":"2023-04-11T21:56:01Z","last_seen":"2026-07-29T13:11:56.175683Z","times_seen":1393,"resource_available":false,"data":null}},"time_used":45,"timings":{"blocked":-1,"dns":15,"connect":19,"send":0,"wait":9,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"zerointerestpromo.com/n.php","fqdn":"zerointerestpromo.com","domain":"zerointerestpromo.com","tld":"com"},"ip":{"addr":"95.111.240.229","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://zerointerestpromo.com/","date":"2026-07-29T13:11:25.293Z","timestamp":1785330685293,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.zerointerestpromo.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Jul 2026 19:47:18 GMT","end":"Mon, 26 Oct 2026 19:47:17 GMT"},"fingerprint":{"sha1":"90:F4:2E:CA:A4:A8:3B:CF:44:89:F1:EF:C9:2C:62:53:09:F5:75:EE","sha256":"3A:83:93:CE:84:5E:2D:1A:1D:1A:AD:F0:19:13:2F:EB:68:60:67:ED:BF:EF:58:A8:59:2A:18:39:3E:41:72:18"}}},"request":{"raw":"GET /n.php HTTP/1.1\r\nHost: zerointerestpromo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://zerointerestpromo.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=5cdbe94753f104c7eefea13d9cd7a712\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 29 Jul 2026 13:11:25 GMT\r\nServer: Apache\r\nKeep-Alive: timeout=5, max=99\r\nConnection: Keep-Alive\r\nTransfer-Encoding: chunked\r\nContent-Type: application/json\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":43,"size_decoded":230,"mime_type":"application/json","magic":"JSON text data","md5":"4abc48e34b46bd94990d8684db6f9783","sha1":"3b770cbfabb3b3d5a96e5176f9c02d54d65401a2","sha256":"d6af6665a25651fb381f5cf0c5b9b76cd5683076608b0b1905001e5b85658fae","sha512":"cfec05734cff019aee5f1f80eb7782ba090e52fa9e47acfcb9e83a8ba86dfe9737d3500b10c4856ecdd9bfae21adce8aa5da2dabe445a9c2ac59c71f8f912188","ssdeep":"","tlshash":"9c900246da012c381355190137503621604014819a90756f1408805957164641442588","first_seen":"2026-07-29T13:06:32.089968Z","last_seen":"2026-07-29T13:11:56.173992Z","times_seen":3,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - PayPal","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with PayPal phishing","tags":["paypal","phishing","financial"],"meta":null}]}},{"url":{"schema":"https","addr":"www.paypalobjects.com/webstatic/icon/pp64.png","fqdn":"www.paypalobjects.com","domain":"paypalobjects.com","tld":"com"},"ip":{"addr":"151.101.3.1","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://zerointerestpromo.com/","date":"2026-07-29T13:11:25.362Z","timestamp":1785330685362,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.paypalobjects.com","organization":""},"issuer":{"commonName":"DigiCert EV RSA CA G2","organization":"DigiCert Inc"},"validity":{"start":"Mon, 23 Mar 2026 00:00:00 GMT","end":"Wed, 07 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C5:00:18:97:B9:56:2D:A2:02:A9:4D:5F:A6:BD:CF:EE:71:7F:9C:70","sha256":"64:BB:91:23:34:C5:83:1C:FA:85:2C:6D:1A:14:E6:E1:AB:9D:84:06:AE:2E:45:D4:68:B7:F4:BD:6B:F2:50:A2"}}},"request":{"raw":"GET /webstatic/icon/pp64.png HTTP/1.1\r\nHost: www.paypalobjects.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zerointerestpromo.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-length: 1745\r\naccess-control-allow-headers: x-csrf-token\r\ncache-control: s-maxage=31536000, public,max-age=3600\r\ncontent-type: image/png\r\ndc: ccg11-origin-www-1.paypal.com\r\netag: \"BBNvPbdpaauRT+iiW9NBzqhT2loQNLSTf5XNX6l5j+0\"\r\nfastly-io-info: ifsz=4518 idim=64x64 ifmt=png ofsz=1745 odim=64x64 ofmt=png\r\nfastly-io-served-by: vpop-haf2300707\r\nfastly-stats: io=1\r\npaypal-debug-id: f8432227ed173\r\ntiming-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com\r\nvia: 1.1 varnish, 1.1 varnish\r\naccept-ranges: bytes\r\ndate: Wed, 29 Jul 2026 13:11:25 GMT\r\nx-served-by: cache-sjc1000085-SJC, cache-sjc10060-SJC, cache-bma-essb1270047-BMA\r\nx-cache: MISS, HIT, HIT\r\nx-cache-hits: 0, 609, 7\r\nx-timer: S1785330685.383414,VS0,VE0\r\nx-content-type-options: nosniff\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET\r\nstrict-transport-security: max-age=31557600\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]}],"data":{"size":1745,"size_decoded":2641,"mime_type":"image/png","magic":"PNG image data, 64 x 64, 8-bit/color RGB, non-interlaced","md5":"de1ba89339f0a1addf3aaa930cd3e461","sha1":"d29ffd216b865aa95798758aaccbed3a654139c3","sha256":"af0887bb94e12e0bfc49f20335693e68b43c993885d6f1cf95d3830ce88565c0","sha512":"f8312fbcec0f22a952d1d2f8d22f092c993bb5126cb5545f11300b8322574828554510de05be9226a2ea174066f89bc84bea0a89ba42290a3004d2281742fe49","ssdeep":"","tlshash":"80310830b0f9301003518879956fab4f95772e9243535711aad9eb40316c17dde997e2","first_seen":"2023-05-08T19:27:30Z","last_seen":"2026-07-29T13:11:53.097381Z","times_seen":385,"resource_available":false,"data":null}},"time_used":25,"timings":{"blocked":-1,"dns":0,"connect":15,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.paypalobjects.com/en_US/i/icon/pp_favicon_x.ico","fqdn":"www.paypalobjects.com","domain":"paypalobjects.com","tld":"com"},"ip":{"addr":"151.101.3.1","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://zerointerestpromo.com/","date":"2026-07-29T13:11:25.364Z","timestamp":1785330685364,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.paypalobjects.com","organization":""},"issuer":{"commonName":"DigiCert EV RSA CA G2","organization":"DigiCert Inc"},"validity":{"start":"Mon, 23 Mar 2026 00:00:00 GMT","end":"Wed, 07 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C5:00:18:97:B9:56:2D:A2:02:A9:4D:5F:A6:BD:CF:EE:71:7F:9C:70","sha256":"64:BB:91:23:34:C5:83:1C:FA:85:2C:6D:1A:14:E6:E1:AB:9D:84:06:AE:2E:45:D4:68:B7:F4:BD:6B:F2:50:A2"}}},"request":{"raw":"GET /en_US/i/icon/pp_favicon_x.ico HTTP/1.1\r\nHost: www.paypalobjects.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zerointerestpromo.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-length: 1309\r\ncontent-type: image/x-icon\r\ncache-control: s-maxage=31536000, public,max-age=3600\r\nlast-modified: Fri, 16 Aug 2019 04:57:33 GMT\r\ncontent-encoding: br\r\netag: W/\"5d5637bd-1536\"\r\npaypal-debug-id: e7f14f0b2abe6\r\ntiming-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com\r\ntraceparent: 00-0000000000000000000e7f14f0b2abe6-55c4b5394932a0a0-01\r\ndc: ccg11-origin-www-1.paypal.com\r\nvia: 1.1 varnish, 1.1 varnish\r\naccept-ranges: bytes\r\ndate: Wed, 29 Jul 2026 13:11:25 GMT\r\nx-served-by: cache-sjc10033-SJC, cache-sjc10033-SJC, cache-bma-essb1270047-BMA\r\nx-cache: MISS, HIT, HIT\r\nx-cache-hits: 0, 7591, 1046\r\nx-timer: S1785330685.383402,VS0,VE0\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31557600\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5430,"size_decoded":2114,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 2 icons, 32x32, 32 bits/pixel, 16x16, 32 bits/pixel","md5":"e1528b5176081f0ed963ec8397bc8fd3","sha1":"ff60afd001e924511e9b6f12c57b6bf26821fc1e","sha256":"1690c4e20869c3763b7fc111e2f94035b0a7ee830311dd680ac91421daad3667","sha512":"acf71864e2844907752901eeeaf5c5648d9f6acf3b73a2fb91e580bee67a04ffe83bc2c984a9464732123bc43a3594007691653271ba94f95f7e1179f4146212","ssdeep":"48:++/pSKnJ/3cCXndBlr9aPZ0M0V+2hDTGlpFRlcPgCOfU:+ASKJPcCXjgZ03Gre9","tlshash":"18b1dc641694e0d8d690567ed3bcd9fbc415de02e9a50bcf078dfdba77340a0a0c6887","first_seen":"2023-04-06T18:53:38Z","last_seen":"2026-07-29T15:03:33.257249Z","times_seen":1574,"resource_available":false,"data":null}},"time_used":24,"timings":{"blocked":14,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}