paperwhale.cloud
Lure Page pivotFound via IP pivot from botlagos.shop
Indicator paperwhale.cloud Type domain Category Lure Page Confidence medium VT Score 5/94 Source urlscan First Seen 2026-09-23 00:00:12 UTC Last Seen 2026-09-23 00:00:12 UTC urlscan View scan result ↗
Raw JSON
{
"verdicts": {
"score": 0,
"malicious": false,
"urlscan": {
"malicious": false
},
"engines": {
"score": 84,
"malicious": true,
"hasVerdicts": true,
"tags": [
"urlscan-ml",
"urlscan-ml-60c5e22"
]
},
"community": {
"score": 0,
"malicious": false,
"hasVerdicts": false
}
},
"submitter": {
"country": "it"
},
"frames": {
"length": 1
},
"usertags": [],
"canonical": {
"task": {
"url": "paperwhale.cloud/k/secure_downloads/FaronicsDeployAgent_Manual.exe"
},
"page": {
"url": "paperwhale.cloud/k/secure_downloads/FaronicsDeployAgent_Manual.exe"
}
},
"labels": [
"domain.apexdomain"
],
"task": {
"visibility": "public",
"method": "api",
"domain": "paperwhale.cloud",
"apexDomain": "paperwhale.cloud",
"time": "2026-07-27T13:29:06.045Z",
"uuid": "019fa3c3-4210-701c-a1e0-045617b8eac3",
"url": "http://paperwhale.cloud/k/secure_downloads/FaronicsDeployAgent_Manual.exe",
"tags": [
"@ecarlesi",
"possiblethreat"
]
},
"stats": {
"uniqIPs": 1,
"uniqCountries": 1,
"dataLength": 0,
"encodedDataLength": 0,
"requests": 1
},
"meta": [],
"scanner": {
"country": "de"
},
"files": [
{
"filename": "FaronicsDeployAgent_Manual.exe",
"filesize": 80083040,
"state": "canceled",
"url": "https://paperwhale.cloud/k/secure_downloads/FaronicsDeployAgent_Manual.exe"
}
],
"links": {
"length": 0
},
"page": {
"country": "US",
"server": "Apache",
"redirected": "https-only",
"ip": "50.6.202.214",
"apexDomainAgeDays": 52,
"mimeType": "application/x-msdownload",
"url": "https://paperwhale.cloud/k/secure_downloads/FaronicsDeployAgent_Manual.exe",
"tlsValidDays": 89,
"tlsAgeDays": 8,
"ptr": "dream.2344234.xyz",
"domainAgeDays": 52,
"tlsValidFrom": "2026-07-18T18:37:45.000Z",
"domain": "paperwhale.cloud",
"apexDomain": "paperwhale.cloud",
"asnname": "ORACLE-BMC-31898 - Oracle Corporation, US",
"asn": "AS31898",
"tlsIssuer": "YR2",
"status": "200"
},
"websockets": {
"totalBytesSent": 0,
"totalBytesReceived": 0,
"length": 0
},
"_id": "019fa3c3-4210-701c-a1e0-045617b8eac3",
"_score": null,
"sort": [
1785158946045,
"019fa3c3-4210-701c-a1e0-045617b8eac3"
],
"result": "https://urlscan.io/api/v1/result/019fa3c3-4210-701c-a1e0-045617b8eac3/",
"screenshot": "https://urlscan.io/screenshots/019fa3c3-4210-701c-a1e0-045617b8eac3.png"
}