secure.paypal.com-ws.com Open in urlscan Pro
166.62.28.129  Malicious Activity! Public Scan

Submitted URL: http://secure.paypal.com-ws.com/
Effective URL: http://secure.paypal.com-ws.com/34f50268067bf2cc8cc839e8da0bad19/login.php?cmd=_account-details&session=6283f3eed0eba209ed5f0fbf...
Submission Tags: phishing malicious Search All
Submission: On February 19 via api from US

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 13 HTTP transactions. The main IP is 166.62.28.129, located in Scottsdale, United States and belongs to AS-26496-GO-DADDY-COM-LLC, US. The main domain is secure.paypal.com-ws.com.
This is the only time secure.paypal.com-ws.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: PayPal (Financial)

Domain & IP information

IP Address AS Autonomous System
3 15 166.62.28.129 26496 (AS-26496-...)
13 2
Apex Domain
Subdomains
Transfer
15 com-ws.com
secure.paypal.com-ws.com
62 KB
0 se3curity.com Failed
binlist.se3curity.com Failed
13 2
Domain Requested by
15 secure.paypal.com-ws.com 3 redirects secure.paypal.com-ws.com
0 binlist.se3curity.com Failed secure.paypal.com-ws.com
13 2

This site contains no links.

Subject Issuer Validity Valid

This page contains 1 frames:

Primary Page: http://secure.paypal.com-ws.com/34f50268067bf2cc8cc839e8da0bad19/login.php?cmd=_account-details&session=6283f3eed0eba209ed5f0fbfe72090dc&dispatch=afce9474e519bc0ecbd1ee35088a5adf0fdd9b34
Frame ID: 56B090B82D3B090F6B198AE5371416B2
Requests: 13 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. http://secure.paypal.com-ws.com/ HTTP 302
    http://secure.paypal.com-ws.com/34f50268067bf2cc8cc839e8da0bad19 HTTP 301
    http://secure.paypal.com-ws.com/34f50268067bf2cc8cc839e8da0bad19/ HTTP 302
    http://secure.paypal.com-ws.com/34f50268067bf2cc8cc839e8da0bad19/login.php?cmd=_account-details&session=6283... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Overall confidence: 100%
Detected patterns
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

13
Requests

0 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

61 kB
Transfer

184 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://secure.paypal.com-ws.com/ HTTP 302
    http://secure.paypal.com-ws.com/34f50268067bf2cc8cc839e8da0bad19 HTTP 301
    http://secure.paypal.com-ws.com/34f50268067bf2cc8cc839e8da0bad19/ HTTP 302
    http://secure.paypal.com-ws.com/34f50268067bf2cc8cc839e8da0bad19/login.php?cmd=_account-details&session=6283f3eed0eba209ed5f0fbfe72090dc&dispatch=afce9474e519bc0ecbd1ee35088a5adf0fdd9b34 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request login.php
secure.paypal.com-ws.com/34f50268067bf2cc8cc839e8da0bad19/
Redirect Chain
  • http://secure.paypal.com-ws.com/
  • http://secure.paypal.com-ws.com/34f50268067bf2cc8cc839e8da0bad19
  • http://secure.paypal.com-ws.com/34f50268067bf2cc8cc839e8da0bad19/
  • http://secure.paypal.com-ws.com/34f50268067bf2cc8cc839e8da0bad19/login.php?cmd=_account-details&session=6283f3eed0eba209ed5f0fbfe72090dc&dispatch=afce9474e519bc0ecbd1ee35088a5adf0fdd9b34
3 KB
1 KB
Document
General
Full URL
http://secure.paypal.com-ws.com/34f50268067bf2cc8cc839e8da0bad19/login.php?cmd=_account-details&session=6283f3eed0eba209ed5f0fbfe72090dc&dispatch=afce9474e519bc0ecbd1ee35088a5adf0fdd9b34
Protocol
HTTP/1.1
Server
166.62.28.129 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-166-62-28-129.ip.secureserver.net
Software
Apache / PHP/7.3.13
Resource Hash
e3cc198586d26153fbcd0374cebb96bdf3f1d6196f7b11af921c297aa085e573

Request headers

Host
secure.paypal.com-ws.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 19 Feb 2020 23:22:48 GMT
Server
Apache
X-Powered-By
PHP/7.3.13
Vary
Accept-Encoding,User-Agent
Content-Encoding
gzip
Content-Length
1002
Keep-Alive
timeout=5
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8

Redirect headers

Date
Wed, 19 Feb 2020 23:22:48 GMT
Server
Apache
X-Powered-By
PHP/7.3.13
location
login.php?cmd=_account-details&session=6283f3eed0eba209ed5f0fbfe72090dc&dispatch=afce9474e519bc0ecbd1ee35088a5adf0fdd9b34
Vary
User-Agent
Content-Length
0
Keep-Alive
timeout=5
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
font-sans.css
secure.paypal.com-ws.com/34f50268067bf2cc8cc839e8da0bad19/file/
1 KB
586 B
Stylesheet
General
Full URL
http://secure.paypal.com-ws.com/34f50268067bf2cc8cc839e8da0bad19/file/font-sans.css
Requested by
Host: secure.paypal.com-ws.com
URL: http://secure.paypal.com-ws.com/34f50268067bf2cc8cc839e8da0bad19/login.php?cmd=_account-details&session=6283f3eed0eba209ed5f0fbfe72090dc&dispatch=afce9474e519bc0ecbd1ee35088a5adf0fdd9b34
Protocol
HTTP/1.1
Server
166.62.28.129 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-166-62-28-129.ip.secureserver.net
Software
Apache /
Resource Hash
6225da29bcb513ec7861eb54e621707ddb6edbd2eba6c3b2f855a4481125977a

Request headers

Referer
http://secure.paypal.com-ws.com/34f50268067bf2cc8cc839e8da0bad19/login.php?cmd=_account-details&session=6283f3eed0eba209ed5f0fbfe72090dc&dispatch=afce9474e519bc0ecbd1ee35088a5adf0fdd9b34
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 19 Feb 2020 23:22:48 GMT
Content-Encoding
gzip
Last-Modified
Wed, 19 Feb 2020 23:22:47 GMT
Server
Apache
ETag
W/"7406ffc-4f4-59ef610fd82fb-gzip"
Vary
Accept-Encoding,User-Agent
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5
Content-Length
254
template.css
secure.paypal.com-ws.com/34f50268067bf2cc8cc839e8da0bad19/file/
8 KB
3 KB
Stylesheet
General
Full URL
http://secure.paypal.com-ws.com/34f50268067bf2cc8cc839e8da0bad19/file/template.css
Requested by
Host: secure.paypal.com-ws.com
URL: http://secure.paypal.com-ws.com/34f50268067bf2cc8cc839e8da0bad19/login.php?cmd=_account-details&session=6283f3eed0eba209ed5f0fbfe72090dc&dispatch=afce9474e519bc0ecbd1ee35088a5adf0fdd9b34
Protocol
HTTP/1.1
Server
166.62.28.129 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-166-62-28-129.ip.secureserver.net
Software
Apache /
Resource Hash
418a85116b236ea4569a647212068da8c1cb50ea4e53f0f0a750b40684c8cd08

Request headers

Referer
http://secure.paypal.com-ws.com/34f50268067bf2cc8cc839e8da0bad19/login.php?cmd=_account-details&session=6283f3eed0eba209ed5f0fbfe72090dc&dispatch=afce9474e519bc0ecbd1ee35088a5adf0fdd9b34
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 19 Feb 2020 23:22:48 GMT
Content-Encoding
gzip
Last-Modified
Wed, 19 Feb 2020 23:22:47 GMT
Server
Apache
ETag
"7406ff7-1e55-59ef610fcbfab-gzip"
Vary
Accept-Encoding,User-Agent
Upgrade
h2,h2c
Connection
Upgrade, Keep-Alive
Accept-Ranges
bytes
Content-Type
text/css
Keep-Alive
timeout=5
Content-Length
2251
css.css
secure.paypal.com-ws.com/34f50268067bf2cc8cc839e8da0bad19/file/
21 KB
5 KB
Stylesheet
General
Full URL
http://secure.paypal.com-ws.com/34f50268067bf2cc8cc839e8da0bad19/file/css.css
Requested by
Host: secure.paypal.com-ws.com
URL: http://secure.paypal.com-ws.com/34f50268067bf2cc8cc839e8da0bad19/login.php?cmd=_account-details&session=6283f3eed0eba209ed5f0fbfe72090dc&dispatch=afce9474e519bc0ecbd1ee35088a5adf0fdd9b34
Protocol
HTTP/1.1
Server
166.62.28.129 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-166-62-28-129.ip.secureserver.net
Software
Apache /
Resource Hash
1b37f34884926c6ed60337ec9e80263544312a9b1875b41be7ce21143996066e

Request headers

Referer
http://secure.paypal.com-ws.com/34f50268067bf2cc8cc839e8da0bad19/login.php?cmd=_account-details&session=6283f3eed0eba209ed5f0fbfe72090dc&dispatch=afce9474e519bc0ecbd1ee35088a5adf0fdd9b34
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 19 Feb 2020 23:22:48 GMT
Content-Encoding
gzip
Last-Modified
Wed, 19 Feb 2020 23:22:47 GMT
Server
Apache
ETag
"7406ff9-53f1-59ef610fce2d3-gzip"
Vary
Accept-Encoding,User-Agent
Upgrade
h2,h2c
Connection
Upgrade, Keep-Alive
Accept-Ranges
bytes
Content-Type
text/css
Keep-Alive
timeout=5
Content-Length
4557
jquery.min.js
secure.paypal.com-ws.com/34f50268067bf2cc8cc839e8da0bad19/file/
84 KB
30 KB
Script
General
Full URL
http://secure.paypal.com-ws.com/34f50268067bf2cc8cc839e8da0bad19/file/jquery.min.js
Requested by
Host: secure.paypal.com-ws.com
URL: http://secure.paypal.com-ws.com/34f50268067bf2cc8cc839e8da0bad19/login.php?cmd=_account-details&session=6283f3eed0eba209ed5f0fbfe72090dc&dispatch=afce9474e519bc0ecbd1ee35088a5adf0fdd9b34
Protocol
HTTP/1.1
Server
166.62.28.129 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-166-62-28-129.ip.secureserver.net
Software
Apache /
Resource Hash
d6f859d58e6e6b7bbbc7758a97b408b1cb54787d7ae86eff349172ce4da205a8

Request headers

Referer
http://secure.paypal.com-ws.com/34f50268067bf2cc8cc839e8da0bad19/login.php?cmd=_account-details&session=6283f3eed0eba209ed5f0fbfe72090dc&dispatch=afce9474e519bc0ecbd1ee35088a5adf0fdd9b34
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 19 Feb 2020 23:22:48 GMT
Content-Encoding
gzip
Last-Modified
Wed, 19 Feb 2020 23:22:47 GMT
Server
Apache
ETag
"7406ffb-14f60-59ef610fd2d0b-gzip"
Vary
Accept-Encoding,User-Agent
Upgrade
h2,h2c
Connection
Upgrade, Keep-Alive
Accept-Ranges
bytes
Content-Type
application/javascript
Keep-Alive
timeout=5
Content-Length
30047
jstz.min.js
secure.paypal.com-ws.com/34f50268067bf2cc8cc839e8da0bad19/file/
26 KB
5 KB
Script
General
Full URL
http://secure.paypal.com-ws.com/34f50268067bf2cc8cc839e8da0bad19/file/jstz.min.js
Requested by
Host: secure.paypal.com-ws.com
URL: http://secure.paypal.com-ws.com/34f50268067bf2cc8cc839e8da0bad19/login.php?cmd=_account-details&session=6283f3eed0eba209ed5f0fbfe72090dc&dispatch=afce9474e519bc0ecbd1ee35088a5adf0fdd9b34
Protocol
HTTP/1.1
Server
166.62.28.129 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-166-62-28-129.ip.secureserver.net
Software
Apache /
Resource Hash
739f819b70df6ddf832a38bca8b55abd9ccbc2de0ab444d2e9a23abadef1b92d

Request headers

Referer
http://secure.paypal.com-ws.com/34f50268067bf2cc8cc839e8da0bad19/login.php?cmd=_account-details&session=6283f3eed0eba209ed5f0fbfe72090dc&dispatch=afce9474e519bc0ecbd1ee35088a5adf0fdd9b34
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 19 Feb 2020 23:22:48 GMT
Content-Encoding
gzip
Last-Modified
Wed, 19 Feb 2020 23:22:47 GMT
Server
Apache
ETag
"7406ffd-68a4-59ef610fd8eb3-gzip"
Vary
Accept-Encoding,User-Agent
Upgrade
h2,h2c
Connection
Upgrade, Keep-Alive
Accept-Ranges
bytes
Content-Type
application/javascript
Keep-Alive
timeout=5
Content-Length
4709
jquery.mobile.custom.min.js
secure.paypal.com-ws.com/34f50268067bf2cc8cc839e8da0bad19/file/
35 KB
13 KB
Script
General
Full URL
http://secure.paypal.com-ws.com/34f50268067bf2cc8cc839e8da0bad19/file/jquery.mobile.custom.min.js
Requested by
Host: secure.paypal.com-ws.com
URL: http://secure.paypal.com-ws.com/34f50268067bf2cc8cc839e8da0bad19/login.php?cmd=_account-details&session=6283f3eed0eba209ed5f0fbfe72090dc&dispatch=afce9474e519bc0ecbd1ee35088a5adf0fdd9b34
Protocol
HTTP/1.1
Server
166.62.28.129 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-166-62-28-129.ip.secureserver.net
Software
Apache /
Resource Hash
264fe373615bcf15c32ae6df08a6a2bc8a0844b5928af69f9f2967da07e78200

Request headers

Referer
http://secure.paypal.com-ws.com/34f50268067bf2cc8cc839e8da0bad19/login.php?cmd=_account-details&session=6283f3eed0eba209ed5f0fbfe72090dc&dispatch=afce9474e519bc0ecbd1ee35088a5adf0fdd9b34
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 19 Feb 2020 23:22:48 GMT
Content-Encoding
gzip
Last-Modified
Wed, 19 Feb 2020 23:22:47 GMT
Server
Apache
ETag
"7406ffa-8d2c-59ef610fcfa43-gzip"
Vary
Accept-Encoding,User-Agent
Upgrade
h2,h2c
Connection
Upgrade, Keep-Alive
Accept-Ranges
bytes
Content-Type
application/javascript
Keep-Alive
timeout=5
Content-Length
12587
jquery.browser.min.js
secure.paypal.com-ws.com/34f50268067bf2cc8cc839e8da0bad19/file/
3 KB
1 KB
Script
General
Full URL
http://secure.paypal.com-ws.com/34f50268067bf2cc8cc839e8da0bad19/file/jquery.browser.min.js
Requested by
Host: secure.paypal.com-ws.com
URL: http://secure.paypal.com-ws.com/34f50268067bf2cc8cc839e8da0bad19/login.php?cmd=_account-details&session=6283f3eed0eba209ed5f0fbfe72090dc&dispatch=afce9474e519bc0ecbd1ee35088a5adf0fdd9b34
Protocol
HTTP/1.1
Server
166.62.28.129 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-166-62-28-129.ip.secureserver.net
Software
Apache /
Resource Hash
d9829082e496712e896683c4c5055b927751a13b4678cc37ce0c8448e808b83a

Request headers

Referer
http://secure.paypal.com-ws.com/34f50268067bf2cc8cc839e8da0bad19/login.php?cmd=_account-details&session=6283f3eed0eba209ed5f0fbfe72090dc&dispatch=afce9474e519bc0ecbd1ee35088a5adf0fdd9b34
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 19 Feb 2020 23:22:48 GMT
Content-Encoding
gzip
Last-Modified
Wed, 19 Feb 2020 23:22:47 GMT
Server
Apache
ETag
"7406ff8-c72-59ef610fcd333-gzip"
Vary
Accept-Encoding,User-Agent
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5
Content-Length
949
script.js
secure.paypal.com-ws.com/34f50268067bf2cc8cc839e8da0bad19/file/
0
0
Script
General
Full URL
http://secure.paypal.com-ws.com/34f50268067bf2cc8cc839e8da0bad19/file/script.js
Requested by
Host: secure.paypal.com-ws.com
URL: http://secure.paypal.com-ws.com/34f50268067bf2cc8cc839e8da0bad19/login.php?cmd=_account-details&session=6283f3eed0eba209ed5f0fbfe72090dc&dispatch=afce9474e519bc0ecbd1ee35088a5adf0fdd9b34
Protocol
HTTP/1.1
Server
166.62.28.129 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-166-62-28-129.ip.secureserver.net
Software
Apache /
Resource Hash

Request headers

Referer
http://secure.paypal.com-ws.com/34f50268067bf2cc8cc839e8da0bad19/login.php?cmd=_account-details&session=6283f3eed0eba209ed5f0fbfe72090dc&dispatch=afce9474e519bc0ecbd1ee35088a5adf0fdd9b34
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 19 Feb 2020 23:22:49 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5
Content-Length
315
Content-Type
text/html; charset=iso-8859-1
logo.png
secure.paypal.com-ws.com/34f50268067bf2cc8cc839e8da0bad19/img/
3 KB
3 KB
Image
General
Full URL
http://secure.paypal.com-ws.com/34f50268067bf2cc8cc839e8da0bad19/img/logo.png
Requested by
Host: secure.paypal.com-ws.com
URL: http://secure.paypal.com-ws.com/34f50268067bf2cc8cc839e8da0bad19/login.php?cmd=_account-details&session=6283f3eed0eba209ed5f0fbfe72090dc&dispatch=afce9474e519bc0ecbd1ee35088a5adf0fdd9b34
Protocol
HTTP/1.1
Server
166.62.28.129 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-166-62-28-129.ip.secureserver.net
Software
Apache /
Resource Hash
82928cdbc4d65102f84bbeed6331cbb00d48a29639663ba48e8690f84092a3a5

Request headers

Referer
http://secure.paypal.com-ws.com/34f50268067bf2cc8cc839e8da0bad19/login.php?cmd=_account-details&session=6283f3eed0eba209ed5f0fbfe72090dc&dispatch=afce9474e519bc0ecbd1ee35088a5adf0fdd9b34
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 19 Feb 2020 23:22:49 GMT
Last-Modified
Wed, 19 Feb 2020 23:22:47 GMT
Server
Apache
ETag
"7407007-b7b-59ef610fe176b"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5
Content-Length
2939
title.png
binlist.se3curity.com/images/
0
0

PayPalSansBig-Regular.woff2
secure.paypal.com-ws.com/34f50268067bf2cc8cc839e8da0bad19/font/
0
0
Font
General
Full URL
http://secure.paypal.com-ws.com/34f50268067bf2cc8cc839e8da0bad19/font/PayPalSansBig-Regular.woff2
Requested by
Host: secure.paypal.com-ws.com
URL: http://secure.paypal.com-ws.com/34f50268067bf2cc8cc839e8da0bad19/login.php?cmd=_account-details&session=6283f3eed0eba209ed5f0fbfe72090dc&dispatch=afce9474e519bc0ecbd1ee35088a5adf0fdd9b34
Protocol
HTTP/1.1
Server
166.62.28.129 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-166-62-28-129.ip.secureserver.net
Software
Apache /
Resource Hash

Request headers

Origin
http://secure.paypal.com-ws.com
Referer
http://secure.paypal.com-ws.com/34f50268067bf2cc8cc839e8da0bad19/file/font-sans.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 19 Feb 2020 23:22:49 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5
Content-Length
315
Content-Type
text/html; charset=iso-8859-1
PayPalSansBig-Regular.woff
secure.paypal.com-ws.com/34f50268067bf2cc8cc839e8da0bad19/font/
0
0
Font
General
Full URL
http://secure.paypal.com-ws.com/34f50268067bf2cc8cc839e8da0bad19/font/PayPalSansBig-Regular.woff
Requested by
Host: secure.paypal.com-ws.com
URL: http://secure.paypal.com-ws.com/34f50268067bf2cc8cc839e8da0bad19/login.php?cmd=_account-details&session=6283f3eed0eba209ed5f0fbfe72090dc&dispatch=afce9474e519bc0ecbd1ee35088a5adf0fdd9b34
Protocol
HTTP/1.1
Server
166.62.28.129 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-166-62-28-129.ip.secureserver.net
Software
Apache /
Resource Hash

Request headers

Origin
http://secure.paypal.com-ws.com
Referer
http://secure.paypal.com-ws.com/34f50268067bf2cc8cc839e8da0bad19/file/font-sans.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 19 Feb 2020 23:22:49 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5
Content-Length
315
Content-Type
text/html; charset=iso-8859-1

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
binlist.se3curity.com
URL
http://binlist.se3curity.com/images/title.png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate object| jstz object| jQBrowser

0 Cookies