paypal.com-webapps.mpp.zlcnu4en4csmtjkrqkwvot-drklg2khajr-mulq-vux7iro-8cs6sdssj334kq.pp-limited.com Open in urlscan Pro
66.96.162.136  Public Scan

URL: http://paypal.com-webapps.mpp.zlcnu4en4csmtjkrqkwvot-drklg2khajr-mulq-vux7iro-8cs6sdssj334kq.pp-limited.com/xrr
Submission Tags: phishing malicious Search All
Submission: On August 12 via api from US

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 20 HTTP transactions. The main IP is 66.96.162.136, located in Burlington, United States and belongs to BIZLAND-SD, US. The main domain is paypal.com-webapps.mpp.zlcnu4en4csmtjkrqkwvot-drklg2khajr-mulq-vux7iro-8cs6sdssj334kq.pp-limited.com.
This is the only time paypal.com-webapps.mpp.zlcnu4en4csmtjkrqkwvot-drklg2khajr-mulq-vux7iro-8cs6sdssj334kq.pp-limited.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 66.96.162.136 29873 (BIZLAND-SD)
15 65.254.244.180 29873 (BIZLAND-SD)
2 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
20 4
Domain Requested by
9 images.domain.com paypal.com-webapps.mpp.zlcnu4en4csmtjkrqkwvot-drklg2khajr-mulq-vux7iro-8cs6sdssj334kq.pp-limited.com
ajax.googleapis.com
6 www1.domain.com paypal.com-webapps.mpp.zlcnu4en4csmtjkrqkwvot-drklg2khajr-mulq-vux7iro-8cs6sdssj334kq.pp-limited.com
2 fonts.gstatic.com paypal.com-webapps.mpp.zlcnu4en4csmtjkrqkwvot-drklg2khajr-mulq-vux7iro-8cs6sdssj334kq.pp-limited.com
1 fonts.googleapis.com paypal.com-webapps.mpp.zlcnu4en4csmtjkrqkwvot-drklg2khajr-mulq-vux7iro-8cs6sdssj334kq.pp-limited.com
1 ajax.googleapis.com paypal.com-webapps.mpp.zlcnu4en4csmtjkrqkwvot-drklg2khajr-mulq-vux7iro-8cs6sdssj334kq.pp-limited.com
1 paypal.com-webapps.mpp.zlcnu4en4csmtjkrqkwvot-drklg2khajr-mulq-vux7iro-8cs6sdssj334kq.pp-limited.com
20 6

This site contains links to these domains. Also see Links.

Domain
www.domain.com
plus.google.com
www.bbb.org
www.icann.org
Subject Issuer Validity Valid
upload.video.google.com
GTS CA 1O1
2020-07-15 -
2020-10-07
3 months crt.sh
*.gstatic.com
GTS CA 1O1
2020-07-15 -
2020-10-07
3 months crt.sh

This page contains 1 frames:

Primary Page: http://paypal.com-webapps.mpp.zlcnu4en4csmtjkrqkwvot-drklg2khajr-mulq-vux7iro-8cs6sdssj334kq.pp-limited.com/xrr
Frame ID: 189AC6ED2CE76DB050CF1E5335198000
Requests: 20 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

20
Requests

20 %
HTTPS

50 %
IPv6

4
Domains

6
Subdomains

4
IPs

2
Countries

144 kB
Transfer

251 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

20 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request xrr
paypal.com-webapps.mpp.zlcnu4en4csmtjkrqkwvot-drklg2khajr-mulq-vux7iro-8cs6sdssj334kq.pp-limited.com/
8 KB
8 KB
Document
General
Full URL
http://paypal.com-webapps.mpp.zlcnu4en4csmtjkrqkwvot-drklg2khajr-mulq-vux7iro-8cs6sdssj334kq.pp-limited.com/xrr
Protocol
HTTP/1.1
Server
66.96.162.136 Burlington, United States, ASN29873 (BIZLAND-SD, US),
Reverse DNS
136.162.96.66.static.eigbox.net
Software
Apache/2 /
Resource Hash
6c5921f6aa36232c4080228ab2c550965c49025628083381224610fb1105cf19

Request headers

Host
paypal.com-webapps.mpp.zlcnu4en4csmtjkrqkwvot-drklg2khajr-mulq-vux7iro-8cs6sdssj334kq.pp-limited.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 12 Aug 2020 18:20:53 GMT
Content-Type
text/html
Content-Length
7699
Connection
keep-alive
Keep-Alive
timeout=30
Server
Apache/2
Last-Modified
Mon, 26 Aug 2019 18:27:14 GMT
Accept-Ranges
bytes bytes
Age
0
generic_csscomponent.css
www1.domain.com/xslt/elements/
67 KB
19 KB
Stylesheet
General
Full URL
http://www1.domain.com/xslt/elements/generic_csscomponent.css
Requested by
Host: paypal.com-webapps.mpp.zlcnu4en4csmtjkrqkwvot-drklg2khajr-mulq-vux7iro-8cs6sdssj334kq.pp-limited.com
URL: http://paypal.com-webapps.mpp.zlcnu4en4csmtjkrqkwvot-drklg2khajr-mulq-vux7iro-8cs6sdssj334kq.pp-limited.com/xrr
Protocol
HTTP/1.1
Server
65.254.244.180 Burlington, United States, ASN29873 (BIZLAND-SD, US),
Reverse DNS
65-254-244-180.yourhostingaccount.com
Software
Apache /
Resource Hash
af5075129675dea47c6496538801e2ed60f80995fd8aee5babc34cc645fc1bd8

Request headers

Referer
http://paypal.com-webapps.mpp.zlcnu4en4csmtjkrqkwvot-drklg2khajr-mulq-vux7iro-8cs6sdssj334kq.pp-limited.com/xrr
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 12 Aug 2020 18:20:54 GMT
Content-Encoding
gzip
Server
Apache
Connection
close
Content-Type
text/css
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/1.7/
93 KB
33 KB
Script
General
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/1.7/jquery.min.js
Requested by
Host: paypal.com-webapps.mpp.zlcnu4en4csmtjkrqkwvot-drklg2khajr-mulq-vux7iro-8cs6sdssj334kq.pp-limited.com
URL: http://paypal.com-webapps.mpp.zlcnu4en4csmtjkrqkwvot-drklg2khajr-mulq-vux7iro-8cs6sdssj334kq.pp-limited.com/xrr
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
47b68dce8cb6805ad5b3ea4d27af92a241f4e29a5c12a274c852e4346a0500b4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
http://paypal.com-webapps.mpp.zlcnu4en4csmtjkrqkwvot-drklg2khajr-mulq-vux7iro-8cs6sdssj334kq.pp-limited.com/xrr
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 08 Aug 2020 06:46:31 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
387262
status
200
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
33845
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 19:15:00 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 08 Aug 2021 06:46:31 GMT
jquery.main.js
www1.domain.com/generalAppC/javascripts/domaincom/
2 KB
1 KB
Script
General
Full URL
http://www1.domain.com/generalAppC/javascripts/domaincom/jquery.main.js
Requested by
Host: paypal.com-webapps.mpp.zlcnu4en4csmtjkrqkwvot-drklg2khajr-mulq-vux7iro-8cs6sdssj334kq.pp-limited.com
URL: http://paypal.com-webapps.mpp.zlcnu4en4csmtjkrqkwvot-drklg2khajr-mulq-vux7iro-8cs6sdssj334kq.pp-limited.com/xrr
Protocol
HTTP/1.1
Server
65.254.244.180 Burlington, United States, ASN29873 (BIZLAND-SD, US),
Reverse DNS
65-254-244-180.yourhostingaccount.com
Software
nginx/1.15.3 /
Resource Hash
1bd930ba2957ce3958daa1f475f3afba49a0b2293f12d68a2f81d622dfec3d61

Request headers

Referer
http://paypal.com-webapps.mpp.zlcnu4en4csmtjkrqkwvot-drklg2khajr-mulq-vux7iro-8cs6sdssj334kq.pp-limited.com/xrr
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 12 Aug 2020 18:20:53 GMT
Content-Encoding
gzip
Last-Modified
Tue, 29 Mar 2016 17:17:04 GMT
Server
nginx/1.15.3
ETag
W/"56fab890-6b2"
Content-Type
application/javascript
Cache-Control
max-age=14400
Connection
close
Expires
Wed, 12 Aug 2020 22:20:53 GMT
jquery.url.packed.js
www1.domain.com/generalAppC/javascripts/domaincom/
2 KB
1 KB
Script
General
Full URL
http://www1.domain.com/generalAppC/javascripts/domaincom/jquery.url.packed.js
Requested by
Host: paypal.com-webapps.mpp.zlcnu4en4csmtjkrqkwvot-drklg2khajr-mulq-vux7iro-8cs6sdssj334kq.pp-limited.com
URL: http://paypal.com-webapps.mpp.zlcnu4en4csmtjkrqkwvot-drklg2khajr-mulq-vux7iro-8cs6sdssj334kq.pp-limited.com/xrr
Protocol
HTTP/1.1
Server
65.254.244.180 Burlington, United States, ASN29873 (BIZLAND-SD, US),
Reverse DNS
65-254-244-180.yourhostingaccount.com
Software
nginx/1.15.3 /
Resource Hash
c3d31fe11a45a48154de2eb0ed427ccbc9a60055b2035ba8294aec5905d2ba27

Request headers

Referer
http://paypal.com-webapps.mpp.zlcnu4en4csmtjkrqkwvot-drklg2khajr-mulq-vux7iro-8cs6sdssj334kq.pp-limited.com/xrr
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 12 Aug 2020 18:20:53 GMT
Content-Encoding
gzip
Last-Modified
Fri, 21 Jun 2013 09:56:12 GMT
Server
nginx/1.15.3
ETag
W/"51c4233c-78f"
Content-Type
application/javascript
Cache-Control
max-age=14400
Connection
close
Expires
Wed, 12 Aug 2020 22:20:53 GMT
opensearch.js
www1.domain.com/generalAppC/javascripts/domaincom/
278 B
599 B
Script
General
Full URL
http://www1.domain.com/generalAppC/javascripts/domaincom/opensearch.js
Requested by
Host: paypal.com-webapps.mpp.zlcnu4en4csmtjkrqkwvot-drklg2khajr-mulq-vux7iro-8cs6sdssj334kq.pp-limited.com
URL: http://paypal.com-webapps.mpp.zlcnu4en4csmtjkrqkwvot-drklg2khajr-mulq-vux7iro-8cs6sdssj334kq.pp-limited.com/xrr
Protocol
HTTP/1.1
Server
65.254.244.180 Burlington, United States, ASN29873 (BIZLAND-SD, US),
Reverse DNS
65-254-244-180.yourhostingaccount.com
Software
nginx/1.15.3 /
Resource Hash
0af8b138625a4fd4e758746028b7d1011320bb9bdbc2f8bf8ed692219b11bf6d

Request headers

Referer
http://paypal.com-webapps.mpp.zlcnu4en4csmtjkrqkwvot-drklg2khajr-mulq-vux7iro-8cs6sdssj334kq.pp-limited.com/xrr
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 12 Aug 2020 18:20:53 GMT
Last-Modified
Fri, 21 Jun 2013 09:56:12 GMT
Server
nginx/1.15.3
ETag
"51c4233c-116"
Content-Type
application/javascript
Cache-Control
max-age=14400
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
278
Expires
Wed, 12 Aug 2020 22:20:53 GMT
css
fonts.googleapis.com/
872 B
480 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Droid+Sans:400,700
Requested by
Host: paypal.com-webapps.mpp.zlcnu4en4csmtjkrqkwvot-drklg2khajr-mulq-vux7iro-8cs6sdssj334kq.pp-limited.com
URL: http://paypal.com-webapps.mpp.zlcnu4en4csmtjkrqkwvot-drklg2khajr-mulq-vux7iro-8cs6sdssj334kq.pp-limited.com/xrr
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
fa6f22af71f6176e78755341cb5148500a9bb86515b9cc346dd4b2e5890e1bff
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
http://paypal.com-webapps.mpp.zlcnu4en4csmtjkrqkwvot-drklg2khajr-mulq-vux7iro-8cs6sdssj334kq.pp-limited.com/xrr
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
status
200
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Wed, 12 Aug 2020 18:15:46 GMT
server
ESF
date
Wed, 12 Aug 2020 18:20:53 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Wed, 12 Aug 2020 18:20:53 GMT
rekicker.css
www1.domain.com/generalAppC/bugkicker/
2 KB
943 B
Stylesheet
General
Full URL
http://www1.domain.com/generalAppC/bugkicker/rekicker.css
Requested by
Host: paypal.com-webapps.mpp.zlcnu4en4csmtjkrqkwvot-drklg2khajr-mulq-vux7iro-8cs6sdssj334kq.pp-limited.com
URL: http://paypal.com-webapps.mpp.zlcnu4en4csmtjkrqkwvot-drklg2khajr-mulq-vux7iro-8cs6sdssj334kq.pp-limited.com/xrr
Protocol
HTTP/1.1
Server
65.254.244.180 Burlington, United States, ASN29873 (BIZLAND-SD, US),
Reverse DNS
65-254-244-180.yourhostingaccount.com
Software
Apache /
Resource Hash
06431ba4b525e24579ca2ce9af14f37fa6d680a7e39e6562dae163b97f1ba119

Request headers

Referer
http://paypal.com-webapps.mpp.zlcnu4en4csmtjkrqkwvot-drklg2khajr-mulq-vux7iro-8cs6sdssj334kq.pp-limited.com/xrr
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 12 Aug 2020 18:20:54 GMT
Content-Encoding
gzip
Server
Apache
Connection
close
Content-Type
text/css
945ecf10693ad5cae76c2d8f13e34e66.1
www1.domain.com/generalAppC/scriptcat/
1 B
844 B
Script
General
Full URL
http://www1.domain.com/generalAppC/scriptcat/945ecf10693ad5cae76c2d8f13e34e66.1
Requested by
Host: paypal.com-webapps.mpp.zlcnu4en4csmtjkrqkwvot-drklg2khajr-mulq-vux7iro-8cs6sdssj334kq.pp-limited.com
URL: http://paypal.com-webapps.mpp.zlcnu4en4csmtjkrqkwvot-drklg2khajr-mulq-vux7iro-8cs6sdssj334kq.pp-limited.com/xrr
Protocol
HTTP/1.1
Server
65.254.244.180 Burlington, United States, ASN29873 (BIZLAND-SD, US),
Reverse DNS
65-254-244-180.yourhostingaccount.com
Software
Apache /
Resource Hash
01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' http://*.impress.ly http://*.dragndropbuilder.com https://*.weeblycloud.com https://*.sitelock.com https://*.mojomarketplace.com http://*.ipage.com http://*.yourhostingaccount.com https://*.ecwid.com
X-Frame-Options SAMEORIGIN ALLOW-FROM http://*.impress.ly http://*.dragndropbuilder.com https://*.weeblycloud.com https://*.sitelock.com https://*.mojomarketplace.com http://*.ipage.com http://*.yourhostingaccount.com https://*.ecwid.com

Request headers

Referer
http://paypal.com-webapps.mpp.zlcnu4en4csmtjkrqkwvot-drklg2khajr-mulq-vux7iro-8cs6sdssj334kq.pp-limited.com/xrr
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 12 Aug 2020 18:20:54 GMT
Content-Encoding
gzip
Server
Apache
X-Frame-Options
SAMEORIGIN ALLOW-FROM http://*.impress.ly http://*.dragndropbuilder.com https://*.weeblycloud.com https://*.sitelock.com https://*.mojomarketplace.com http://*.ipage.com http://*.yourhostingaccount.com https://*.ecwid.com
Content-Type
text/html; charset=UTF-8
Cache-Control
max-age=3600, public
Content-Security-Policy
frame-ancestors 'self' http://*.impress.ly http://*.dragndropbuilder.com https://*.weeblycloud.com https://*.sitelock.com https://*.mojomarketplace.com http://*.ipage.com http://*.yourhostingaccount.com https://*.ecwid.com
Connection
close
Expires
Wed, 12 Aug 2020 19:20:54 GMT
logo-new.png
images.domain.com/templates/domaincom/
22 KB
22 KB
Image
General
Full URL
http://images.domain.com/templates/domaincom/logo-new.png
Requested by
Host: paypal.com-webapps.mpp.zlcnu4en4csmtjkrqkwvot-drklg2khajr-mulq-vux7iro-8cs6sdssj334kq.pp-limited.com
URL: http://paypal.com-webapps.mpp.zlcnu4en4csmtjkrqkwvot-drklg2khajr-mulq-vux7iro-8cs6sdssj334kq.pp-limited.com/xrr
Protocol
HTTP/1.1
Server
65.254.244.180 Burlington, United States, ASN29873 (BIZLAND-SD, US),
Reverse DNS
65-254-244-180.yourhostingaccount.com
Software
Apache /
Resource Hash
3b9d1b1cc7149020dd70ce4eb3a48dae963c4ef70c19e41386073019aee9ba4b

Request headers

Referer
http://www1.domain.com/xslt/elements/generic_csscomponent.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 12 Aug 2020 18:20:54 GMT
Last-Modified
Wed, 30 Mar 2016 23:18:08 GMT
Server
Apache
ETag
"5785-52f4c5bdc8f9d"
Vary
Host
Content-Type
image/png
Cache-Control
max-age=604800, public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
22405
email.png
images.domain.com/templates/domaincom/
2 KB
2 KB
Image
General
Full URL
http://images.domain.com/templates/domaincom/email.png
Requested by
Host: paypal.com-webapps.mpp.zlcnu4en4csmtjkrqkwvot-drklg2khajr-mulq-vux7iro-8cs6sdssj334kq.pp-limited.com
URL: http://paypal.com-webapps.mpp.zlcnu4en4csmtjkrqkwvot-drklg2khajr-mulq-vux7iro-8cs6sdssj334kq.pp-limited.com/xrr
Protocol
HTTP/1.1
Server
65.254.244.180 Burlington, United States, ASN29873 (BIZLAND-SD, US),
Reverse DNS
65-254-244-180.yourhostingaccount.com
Software
Apache /
Resource Hash
25cd74dc73beed19870b7e6ca9dddd97e71687394d4187f2262e48c6fb70a5fb

Request headers

Referer
http://www1.domain.com/xslt/elements/generic_csscomponent.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 12 Aug 2020 18:20:54 GMT
Last-Modified
Tue, 03 Jan 2012 18:27:54 GMT
Server
Apache
ETag
"791-4b5a3db8b3b2a"
Vary
Host
Content-Type
image/png
Cache-Control
max-age=604800, public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1937
exit.png
images.domain.com/templates/domaincom/
2 KB
2 KB
Image
General
Full URL
http://images.domain.com/templates/domaincom/exit.png
Requested by
Host: paypal.com-webapps.mpp.zlcnu4en4csmtjkrqkwvot-drklg2khajr-mulq-vux7iro-8cs6sdssj334kq.pp-limited.com
URL: http://paypal.com-webapps.mpp.zlcnu4en4csmtjkrqkwvot-drklg2khajr-mulq-vux7iro-8cs6sdssj334kq.pp-limited.com/xrr
Protocol
HTTP/1.1
Server
65.254.244.180 Burlington, United States, ASN29873 (BIZLAND-SD, US),
Reverse DNS
65-254-244-180.yourhostingaccount.com
Software
Apache /
Resource Hash
ac54fff8f8f63f0051b787ab52d921213517ac578c3487ea23ec1d6429ce5797

Request headers

Referer
http://www1.domain.com/xslt/elements/generic_csscomponent.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 12 Aug 2020 18:20:54 GMT
Last-Modified
Mon, 30 Apr 2012 17:20:11 GMT
Server
Apache
ETag
"68b-4bee8aaa4391c"
Vary
Host
Content-Type
image/png
Cache-Control
max-age=604800, public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1675
domcom_live_chat.png
images.domain.com/templates/domaincom/
1 KB
1 KB
Image
General
Full URL
http://images.domain.com/templates/domaincom/domcom_live_chat.png
Requested by
Host: paypal.com-webapps.mpp.zlcnu4en4csmtjkrqkwvot-drklg2khajr-mulq-vux7iro-8cs6sdssj334kq.pp-limited.com
URL: http://paypal.com-webapps.mpp.zlcnu4en4csmtjkrqkwvot-drklg2khajr-mulq-vux7iro-8cs6sdssj334kq.pp-limited.com/xrr
Protocol
HTTP/1.1
Server
65.254.244.180 Burlington, United States, ASN29873 (BIZLAND-SD, US),
Reverse DNS
65-254-244-180.yourhostingaccount.com
Software
Apache /
Resource Hash
ac781b2767db88fb6120e6ebb942cb74d8190de93af3ee58de858463b8e7e233

Request headers

Referer
http://www1.domain.com/xslt/elements/generic_csscomponent.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 12 Aug 2020 18:20:54 GMT
Last-Modified
Wed, 14 May 2014 23:13:16 GMT
Server
Apache
ETag
"45e-4f964534cad82"
Vary
Host
Content-Type
image/png
Cache-Control
max-age=604800, public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1118
phone.png
images.domain.com/templates/domaincom/
1 KB
1 KB
Image
General
Full URL
http://images.domain.com/templates/domaincom/phone.png
Requested by
Host: paypal.com-webapps.mpp.zlcnu4en4csmtjkrqkwvot-drklg2khajr-mulq-vux7iro-8cs6sdssj334kq.pp-limited.com
URL: http://paypal.com-webapps.mpp.zlcnu4en4csmtjkrqkwvot-drklg2khajr-mulq-vux7iro-8cs6sdssj334kq.pp-limited.com/xrr
Protocol
HTTP/1.1
Server
65.254.244.180 Burlington, United States, ASN29873 (BIZLAND-SD, US),
Reverse DNS
65-254-244-180.yourhostingaccount.com
Software
Apache /
Resource Hash
fc276a0d2051f5eaedf2f0f767a90bebb9925b872b131106c7d59d6c85a2b197

Request headers

Referer
http://www1.domain.com/xslt/elements/generic_csscomponent.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 12 Aug 2020 18:20:54 GMT
Last-Modified
Tue, 06 Mar 2012 16:22:13 GMT
Server
Apache
ETag
"4ad-4ba95720b030a"
Vary
Host
Content-Type
image/png
Cache-Control
max-age=604800, public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1197
follow-4.png
images.domain.com/templates/domaincom/import/
3 KB
3 KB
Image
General
Full URL
http://images.domain.com/templates/domaincom/import/follow-4.png
Requested by
Host: paypal.com-webapps.mpp.zlcnu4en4csmtjkrqkwvot-drklg2khajr-mulq-vux7iro-8cs6sdssj334kq.pp-limited.com
URL: http://paypal.com-webapps.mpp.zlcnu4en4csmtjkrqkwvot-drklg2khajr-mulq-vux7iro-8cs6sdssj334kq.pp-limited.com/xrr
Protocol
HTTP/1.1
Server
65.254.244.180 Burlington, United States, ASN29873 (BIZLAND-SD, US),
Reverse DNS
65-254-244-180.yourhostingaccount.com
Software
Apache /
Resource Hash
7931d78d725c9acb1a40bf005e77ae3c01d30f2ff8e50ae7b6f59531ca5dec2e

Request headers

Referer
http://www1.domain.com/xslt/elements/generic_csscomponent.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 12 Aug 2020 18:20:54 GMT
Last-Modified
Wed, 10 Apr 2013 22:53:10 GMT
Server
Apache
ETag
"a9e-4da0988b7e1e8"
Vary
Host
Content-Type
image/png
Cache-Control
max-age=604800, public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
2718
follow-gp.png
images.domain.com/templates/domaincom/import/
1 KB
2 KB
Image
General
Full URL
http://images.domain.com/templates/domaincom/import/follow-gp.png
Requested by
Host: paypal.com-webapps.mpp.zlcnu4en4csmtjkrqkwvot-drklg2khajr-mulq-vux7iro-8cs6sdssj334kq.pp-limited.com
URL: http://paypal.com-webapps.mpp.zlcnu4en4csmtjkrqkwvot-drklg2khajr-mulq-vux7iro-8cs6sdssj334kq.pp-limited.com/xrr
Protocol
HTTP/1.1
Server
65.254.244.180 Burlington, United States, ASN29873 (BIZLAND-SD, US),
Reverse DNS
65-254-244-180.yourhostingaccount.com
Software
Apache /
Resource Hash
c8c829bbf9cd24c61d5463d26af9f80c1d2def493605801a02d30ea56f24db70

Request headers

Referer
http://www1.domain.com/xslt/elements/generic_csscomponent.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 12 Aug 2020 18:20:54 GMT
Last-Modified
Wed, 10 Apr 2013 22:53:12 GMT
Server
Apache
ETag
"5e4-4da0988d5d574"
Vary
Host
Content-Type
image/png
Cache-Control
max-age=604800, public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1508
SlGVmQWMvZQIdix7AFxXkHNSbRYXags.woff2
fonts.gstatic.com/s/droidsans/v12/
11 KB
11 KB
Font
General
Full URL
https://fonts.gstatic.com/s/droidsans/v12/SlGVmQWMvZQIdix7AFxXkHNSbRYXags.woff2
Requested by
Host: paypal.com-webapps.mpp.zlcnu4en4csmtjkrqkwvot-drklg2khajr-mulq-vux7iro-8cs6sdssj334kq.pp-limited.com
URL: http://paypal.com-webapps.mpp.zlcnu4en4csmtjkrqkwvot-drklg2khajr-mulq-vux7iro-8cs6sdssj334kq.pp-limited.com/xrr
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c8cb742dbb60decab090cf738bfef2d8a780141573e9a2a3854bf3f78919faed
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Droid+Sans:400,700
Origin
http://paypal.com-webapps.mpp.zlcnu4en4csmtjkrqkwvot-drklg2khajr-mulq-vux7iro-8cs6sdssj334kq.pp-limited.com

Response headers

date
Tue, 11 Aug 2020 05:58:12 GMT
x-content-type-options
nosniff
last-modified
Thu, 20 Feb 2020 02:00:07 GMT
server
sffe
age
130962
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
11236
x-xss-protection
0
expires
Wed, 11 Aug 2021 05:58:12 GMT
SlGWmQWMvZQIdix7AFxXmMh3eDs1ZyHKpWg.woff2
fonts.gstatic.com/s/droidsans/v12/
11 KB
11 KB
Font
General
Full URL
https://fonts.gstatic.com/s/droidsans/v12/SlGWmQWMvZQIdix7AFxXmMh3eDs1ZyHKpWg.woff2
Requested by
Host: paypal.com-webapps.mpp.zlcnu4en4csmtjkrqkwvot-drklg2khajr-mulq-vux7iro-8cs6sdssj334kq.pp-limited.com
URL: http://paypal.com-webapps.mpp.zlcnu4en4csmtjkrqkwvot-drklg2khajr-mulq-vux7iro-8cs6sdssj334kq.pp-limited.com/xrr
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
bd33ffebb82d0e70371aedd27d79a993c98b29fb0d5e3d8c99c376cc9d57414d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Droid+Sans:400,700
Origin
http://paypal.com-webapps.mpp.zlcnu4en4csmtjkrqkwvot-drklg2khajr-mulq-vux7iro-8cs6sdssj334kq.pp-limited.com

Response headers

date
Fri, 07 Aug 2020 08:09:11 GMT
x-content-type-options
nosniff
last-modified
Thu, 20 Feb 2020 02:52:18 GMT
server
sffe
age
468703
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
11396
x-xss-protection
0
expires
Sat, 07 Aug 2021 08:09:11 GMT
domain-com-logos.png
images.domain.com/templates/domaincom/import/
16 KB
16 KB
Image
General
Full URL
http://images.domain.com/templates/domaincom/import/domain-com-logos.png
Requested by
Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/1.7/jquery.min.js
Protocol
HTTP/1.1
Server
65.254.244.180 Burlington, United States, ASN29873 (BIZLAND-SD, US),
Reverse DNS
65-254-244-180.yourhostingaccount.com
Software
Apache /
Resource Hash
d4ab945faae32f7f037ba70686747cee21882c8296c12f55bc804a090cb8876d

Request headers

Referer
http://www1.domain.com/xslt/elements/generic_csscomponent.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 12 Aug 2020 18:20:54 GMT
Last-Modified
Thu, 26 Jan 2012 18:10:35 GMT
Server
Apache
ETag
"40b9-4b7724bf5bd60"
Vary
Host
Content-Type
image/png
Cache-Control
max-age=604800, public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
16569
domain-com-icann-logo.png
images.domain.com/templates/domaincom/import/
6 KB
7 KB
Image
General
Full URL
http://images.domain.com/templates/domaincom/import/domain-com-icann-logo.png
Requested by
Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/1.7/jquery.min.js
Protocol
HTTP/1.1
Server
65.254.244.180 Burlington, United States, ASN29873 (BIZLAND-SD, US),
Reverse DNS
65-254-244-180.yourhostingaccount.com
Software
Apache /
Resource Hash
ddaaedfb181ccd7d62247274552e1750fc169f485835df1efb9698d4fa791ef9

Request headers

Referer
http://www1.domain.com/xslt/elements/generic_csscomponent.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 12 Aug 2020 18:20:54 GMT
Last-Modified
Thu, 26 Jan 2012 18:10:33 GMT
Server
Apache
ETag
"194e-4b7724bd6fec4"
Vary
Host
Content-Type
image/png
Cache-Control
max-age=604800, public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
6478

Verdicts & Comments Add Verdict or Comment

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery number| google_conversion_id string| google_conversion_language string| google_conversion_format string| google_conversion_color string| google_conversion_label number| google_conversion_value function| installOpenSearch

0 Cookies

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
fonts.googleapis.com
fonts.gstatic.com
images.domain.com
paypal.com-webapps.mpp.zlcnu4en4csmtjkrqkwvot-drklg2khajr-mulq-vux7iro-8cs6sdssj334kq.pp-limited.com
www1.domain.com
2a00:1450:4001:800::200a
2a00:1450:4001:81d::2003
65.254.244.180
66.96.162.136
01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
06431ba4b525e24579ca2ce9af14f37fa6d680a7e39e6562dae163b97f1ba119
0af8b138625a4fd4e758746028b7d1011320bb9bdbc2f8bf8ed692219b11bf6d
1bd930ba2957ce3958daa1f475f3afba49a0b2293f12d68a2f81d622dfec3d61
25cd74dc73beed19870b7e6ca9dddd97e71687394d4187f2262e48c6fb70a5fb
3b9d1b1cc7149020dd70ce4eb3a48dae963c4ef70c19e41386073019aee9ba4b
47b68dce8cb6805ad5b3ea4d27af92a241f4e29a5c12a274c852e4346a0500b4
6c5921f6aa36232c4080228ab2c550965c49025628083381224610fb1105cf19
7931d78d725c9acb1a40bf005e77ae3c01d30f2ff8e50ae7b6f59531ca5dec2e
ac54fff8f8f63f0051b787ab52d921213517ac578c3487ea23ec1d6429ce5797
ac781b2767db88fb6120e6ebb942cb74d8190de93af3ee58de858463b8e7e233
af5075129675dea47c6496538801e2ed60f80995fd8aee5babc34cc645fc1bd8
bd33ffebb82d0e70371aedd27d79a993c98b29fb0d5e3d8c99c376cc9d57414d
c3d31fe11a45a48154de2eb0ed427ccbc9a60055b2035ba8294aec5905d2ba27
c8c829bbf9cd24c61d5463d26af9f80c1d2def493605801a02d30ea56f24db70
c8cb742dbb60decab090cf738bfef2d8a780141573e9a2a3854bf3f78919faed
d4ab945faae32f7f037ba70686747cee21882c8296c12f55bc804a090cb8876d
ddaaedfb181ccd7d62247274552e1750fc169f485835df1efb9698d4fa791ef9
fa6f22af71f6176e78755341cb5148500a9bb86515b9cc346dd4b2e5890e1bff
fc276a0d2051f5eaedf2f0f767a90bebb9925b872b131106c7d59d6c85a2b197