app.sndbox.com Open in urlscan Pro
143.204.214.58  Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request 3ee516c4-5cf4-4f30-b68a-41c6d9e7db75%7C746835c594c93272d821743eab1bb379%7Cmalicious%7C986b05b9abc7182a479936cbb819aaafa2f0d81c%7Cc024a89925cb7905c714e9a0f692fc73e7a66ff91c8a14c3d1e3bda9c96ba7c0%7CH... Show response app.sndbox.com/sample/	2 KB 1 KB	1404ms 1375ms	Document text/html	143.204.214.58 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://app.sndbox.com/sample/3ee516c4-5cf4-4f30-b68a-41c6d9e7db75%7C746835c594c93272d821743eab1bb379%7Cmalicious%7C986b05b9abc7182a479936cbb819aaafa2f0d81c%7Cc024a89925cb7905c714e9a0f692fc73e7a66ff91c8a14c3d1e3bda9c96ba7c0%7CHTML%7C0.579990768490768%7Cfinished%7C2019-09-19T16:29:40.511Z%7C Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 143.204.214.58 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS server-143-204-214-58.fra53.r.cloudfront.net Software CloudFront / Resource Hash a6acad3089689613cf40fedfcc680db5c1855798a87b801d21d8ec7f9549df6d Request headers :method GET :authority app.sndbox.com :scheme https :path /sample/3ee516c4-5cf4-4f30-b68a-41c6d9e7db75%7C746835c594c93272d821743eab1bb379%7Cmalicious%7C986b05b9abc7182a479936cbb819aaafa2f0d81c%7Cc024a89925cb7905c714e9a0f692fc73e7a66ff91c8a14c3d1e3bda9c96ba7c0%7CHTML%7C0.579990768490768%7Cfinished%7C2019-09-19T16:29:40.511Z%7C pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-mode navigate sec-fetch-user ?1 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 sec-fetch-site none accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Response headers status 200 content-type text/html server CloudFront date Thu, 19 Sep 2019 16:33:03 GMT content-encoding gzip vary Accept-Encoding x-cache Error from cloudfront via 1.1 3f6fbf009bb5cf969f92ba2e59576614.cloudfront.net (CloudFront) x-amz-cf-pop FRA53-C1 x-amz-cf-id YaGU4skXuShywzG_tje_iDbdNF20G5V3J71R1tkybJKHfqH3O7BDJw==
GET H2	200	api.js Show response www.google.com/recaptcha/	780 B 576 B	17ms 16ms	Script text/javascript	2a00:1450:4001:818::2004 Google LLC
General Check archive.org Show headers Download Go to Full URL https://www.google.com/recaptcha/api.js?onload=vueRecaptchaApiLoaded&render=explicit Requested by Host: app.sndbox.com URL: https://app.sndbox.com/sample/3ee516c4-5cf4-4f30-b68a-41c6d9e7db75%7C746835c594c93272d821743eab1bb379%7Cmalicious%7C986b05b9abc7182a479936cbb819aaafa2f0d81c%7Cc024a89925cb7905c714e9a0f692fc73e7a66ff91c8a14c3d1e3bda9c96ba7c0%7CHTML%7C0.579990768490768%7Cfinished%7C2019-09-19T16:29:40.511Z%7C Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:818::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software GSE / Resource Hash f960228afbe1791e6ddd5cae0dafbdb6c5047ff373b7f13c3cb486656a6e12e7 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Sec-Fetch-Mode no-cors Referer https://app.sndbox.com/sample/3ee516c4-5cf4-4f30-b68a-41c6d9e7db75%7C746835c594c93272d821743eab1bb379%7Cmalicious%7C986b05b9abc7182a479936cbb819aaafa2f0d81c%7Cc024a89925cb7905c714e9a0f692fc73e7a66ff91c8a14c3d1e3bda9c96ba7c0%7CHTML%7C0.579990768490768%7Cfinished%7C2019-09-19T16:29:40.511Z%7C User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 19 Sep 2019 16:33:03 GMT content-encoding gzip x-content-type-options nosniff server GSE x-frame-options SAMEORIGIN content-type text/javascript; charset=UTF-8 status 200 cache-control private, max-age=300 alt-svc quic=":443"; ma=2592000; v="46,43,39" content-length 478 x-xss-protection 1; mode=block expires Thu, 19 Sep 2019 16:33:03 GMT
GET H2	200	checkout.js Show response www.paypalobjects.com/api/	1 MB 232 KB	38ms 20ms	Script application/x-javascript	23.210.248.226 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://www.paypalobjects.com/api/checkout.js Requested by Host: app.sndbox.com URL: https://app.sndbox.com/sample/3ee516c4-5cf4-4f30-b68a-41c6d9e7db75%7C746835c594c93272d821743eab1bb379%7Cmalicious%7C986b05b9abc7182a479936cbb819aaafa2f0d81c%7Cc024a89925cb7905c714e9a0f692fc73e7a66ff91c8a14c3d1e3bda9c96ba7c0%7CHTML%7C0.579990768490768%7Cfinished%7C2019-09-19T16:29:40.511Z%7C Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 23.210.248.226 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a23-210-248-226.deploy.static.akamaitechnologies.com Software Apache / Resource Hash a8761357265fd267da065af29ede36f41a199cdfc55cec43a408488c18ab7d60 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Sec-Fetch-Mode no-cors Referer https://app.sndbox.com/sample/3ee516c4-5cf4-4f30-b68a-41c6d9e7db75%7C746835c594c93272d821743eab1bb379%7Cmalicious%7C986b05b9abc7182a479936cbb819aaafa2f0d81c%7Cc024a89925cb7905c714e9a0f692fc73e7a66ff91c8a14c3d1e3bda9c96ba7c0%7CHTML%7C0.579990768490768%7Cfinished%7C2019-09-19T16:29:40.511Z%7C User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 19 Sep 2019 16:33:03 GMT content-encoding gzip x-content-type-options nosniff status 200 vary Accept-Encoding content-length 236898 last-modified Tue, 17 Sep 2019 00:16:23 GMT server Apache strict-transport-security max-age=31536000 access-control-allow-methods GET content-type application/x-javascript access-control-allow-origin * cache-control max-age=86400 accept-ranges bytes access-control-allow-headers x-csrf-token expires Fri, 20 Sep 2019 16:33:03 GMT
GET H2	200	app.835aec1e4a0ef661ec161eece528b6f6.css app.sndbox.com/static/css/	1 MB 272 KB	12ms 11ms	Stylesheet text/css	143.204.214.58 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://app.sndbox.com/static/css/app.835aec1e4a0ef661ec161eece528b6f6.css Requested by Host: app.sndbox.com URL: https://app.sndbox.com/sample/3ee516c4-5cf4-4f30-b68a-41c6d9e7db75%7C746835c594c93272d821743eab1bb379%7Cmalicious%7C986b05b9abc7182a479936cbb819aaafa2f0d81c%7Cc024a89925cb7905c714e9a0f692fc73e7a66ff91c8a14c3d1e3bda9c96ba7c0%7CHTML%7C0.579990768490768%7Cfinished%7C2019-09-19T16:29:40.511Z%7C Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 143.204.214.58 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS server-143-204-214-58.fra53.r.cloudfront.net Software AmazonS3 / Resource Hash d58b1374ac50b7f27c2e65c5a0bb91c4a19b8f4faf0d18935e74d3f670f64922 Request headers Sec-Fetch-Mode no-cors Referer https://app.sndbox.com/sample/3ee516c4-5cf4-4f30-b68a-41c6d9e7db75%7C746835c594c93272d821743eab1bb379%7Cmalicious%7C986b05b9abc7182a479936cbb819aaafa2f0d81c%7Cc024a89925cb7905c714e9a0f692fc73e7a66ff91c8a14c3d1e3bda9c96ba7c0%7CHTML%7C0.579990768490768%7Cfinished%7C2019-09-19T16:29:40.511Z%7C User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 19 Sep 2019 15:44:29 GMT content-encoding gzip last-modified Sat, 07 Sep 2019 13:42:25 GMT server AmazonS3 age 2915 vary Accept-Encoding x-cache Hit from cloudfront content-type text/css status 200 x-amz-cf-pop FRA53-C1 x-amz-cf-id 1pxbBIzFtKmUuxM-qT5wh1R9rR4mYirCtutG3Brur-riy86uw2FtFA== via 1.1 3f6fbf009bb5cf969f92ba2e59576614.cloudfront.net (CloudFront)
GET H2	200	manifest.453ea4fe44294bcc0a6f.js Show response app.sndbox.com/static/js/	1 KB 1 KB	8ms 7ms	Script application/javascript	143.204.214.58 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://app.sndbox.com/static/js/manifest.453ea4fe44294bcc0a6f.js Requested by Host: app.sndbox.com URL: https://app.sndbox.com/sample/3ee516c4-5cf4-4f30-b68a-41c6d9e7db75%7C746835c594c93272d821743eab1bb379%7Cmalicious%7C986b05b9abc7182a479936cbb819aaafa2f0d81c%7Cc024a89925cb7905c714e9a0f692fc73e7a66ff91c8a14c3d1e3bda9c96ba7c0%7CHTML%7C0.579990768490768%7Cfinished%7C2019-09-19T16:29:40.511Z%7C Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 143.204.214.58 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS server-143-204-214-58.fra53.r.cloudfront.net Software AmazonS3 / Resource Hash e7fcdc6067892d819a157d0d1d06a48fa4ca4b827e2d7400ba8f684989508c77 Request headers Sec-Fetch-Mode no-cors Referer https://app.sndbox.com/sample/3ee516c4-5cf4-4f30-b68a-41c6d9e7db75%7C746835c594c93272d821743eab1bb379%7Cmalicious%7C986b05b9abc7182a479936cbb819aaafa2f0d81c%7Cc024a89925cb7905c714e9a0f692fc73e7a66ff91c8a14c3d1e3bda9c96ba7c0%7CHTML%7C0.579990768490768%7Cfinished%7C2019-09-19T16:29:40.511Z%7C User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 19 Sep 2019 16:30:05 GMT content-encoding gzip last-modified Sat, 07 Sep 2019 13:42:53 GMT server AmazonS3 age 178 vary Accept-Encoding x-cache Hit from cloudfront content-type application/javascript status 200 x-amz-cf-pop FRA53-C1 x-amz-cf-id n7o5_crF3RMvWt3vUQkIvEpN4HYqhq7a8CrY8Ta8tl2bRHBwRW3qfw== via 1.1 3f6fbf009bb5cf969f92ba2e59576614.cloudfront.net (CloudFront)
GET H2	200	vendor.ef279d5370482f9c4f38.js Show response app.sndbox.com/static/js/	3 MB 918 KB	21ms 21ms	Script application/javascript	143.204.214.58 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://app.sndbox.com/static/js/vendor.ef279d5370482f9c4f38.js Requested by Host: app.sndbox.com URL: https://app.sndbox.com/sample/3ee516c4-5cf4-4f30-b68a-41c6d9e7db75%7C746835c594c93272d821743eab1bb379%7Cmalicious%7C986b05b9abc7182a479936cbb819aaafa2f0d81c%7Cc024a89925cb7905c714e9a0f692fc73e7a66ff91c8a14c3d1e3bda9c96ba7c0%7CHTML%7C0.579990768490768%7Cfinished%7C2019-09-19T16:29:40.511Z%7C Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 143.204.214.58 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS server-143-204-214-58.fra53.r.cloudfront.net Software AmazonS3 / Resource Hash e8caaca7ea6ddec7b02dc0a3377ba515eb75829fb0020e55f46cc18644f6eb1e Request headers Sec-Fetch-Mode no-cors Referer https://app.sndbox.com/sample/3ee516c4-5cf4-4f30-b68a-41c6d9e7db75%7C746835c594c93272d821743eab1bb379%7Cmalicious%7C986b05b9abc7182a479936cbb819aaafa2f0d81c%7Cc024a89925cb7905c714e9a0f692fc73e7a66ff91c8a14c3d1e3bda9c96ba7c0%7CHTML%7C0.579990768490768%7Cfinished%7C2019-09-19T16:29:40.511Z%7C User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 19 Sep 2019 16:30:05 GMT content-encoding gzip last-modified Sat, 07 Sep 2019 13:42:53 GMT server AmazonS3 age 178 vary Accept-Encoding x-cache Hit from cloudfront content-type application/javascript status 200 x-amz-cf-pop FRA53-C1 x-amz-cf-id S98tdfPf0ZWaETxtwW2mku9WAi82sIBxCQBt3oeul1L84utN3VRFgw== via 1.1 3f6fbf009bb5cf969f92ba2e59576614.cloudfront.net (CloudFront)
GET H2	200	app.6790abc33e5233ee5dc6.js Show response app.sndbox.com/static/js/	484 KB 98 KB	11ms 11ms	Script application/javascript	143.204.214.58 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://app.sndbox.com/static/js/app.6790abc33e5233ee5dc6.js Requested by Host: app.sndbox.com URL: https://app.sndbox.com/sample/3ee516c4-5cf4-4f30-b68a-41c6d9e7db75%7C746835c594c93272d821743eab1bb379%7Cmalicious%7C986b05b9abc7182a479936cbb819aaafa2f0d81c%7Cc024a89925cb7905c714e9a0f692fc73e7a66ff91c8a14c3d1e3bda9c96ba7c0%7CHTML%7C0.579990768490768%7Cfinished%7C2019-09-19T16:29:40.511Z%7C Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 143.204.214.58 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS server-143-204-214-58.fra53.r.cloudfront.net Software AmazonS3 / Resource Hash 7dfd16de07d6cc0c4230e74493d517f521403968ebca8c8d5851b52223e7d077 Request headers Sec-Fetch-Mode no-cors Referer https://app.sndbox.com/sample/3ee516c4-5cf4-4f30-b68a-41c6d9e7db75%7C746835c594c93272d821743eab1bb379%7Cmalicious%7C986b05b9abc7182a479936cbb819aaafa2f0d81c%7Cc024a89925cb7905c714e9a0f692fc73e7a66ff91c8a14c3d1e3bda9c96ba7c0%7CHTML%7C0.579990768490768%7Cfinished%7C2019-09-19T16:29:40.511Z%7C User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 19 Sep 2019 16:30:05 GMT content-encoding gzip last-modified Sat, 07 Sep 2019 13:42:53 GMT server AmazonS3 age 178 vary Accept-Encoding x-cache Hit from cloudfront content-type application/javascript status 200 x-amz-cf-pop FRA53-C1 x-amz-cf-id 4mw0Z37PXWPJbk4AtZQY1oT3bFyQBdhRDPcRi8KatLcsfHbtqERodw== via 1.1 3f6fbf009bb5cf969f92ba2e59576614.cloudfront.net (CloudFront)
GET H2	200	recaptcha__en.js Show response www.gstatic.com/recaptcha/api2/v1566858990656/	264 KB 92 KB	6ms 6ms	Script text/javascript	2a00:1450:4001:817::2003 Google LLC
General Check archive.org Show headers Download Go to Full URL https://www.gstatic.com/recaptcha/api2/v1566858990656/recaptcha__en.js Requested by Host: www.google.com URL: https://www.google.com/recaptcha/api.js?onload=vueRecaptchaApiLoaded&render=explicit Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:817::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software sffe / Resource Hash bd3cad6b7ba79270dee54a5ba1482ac6b522b147dc8f9d04791050711ada7865 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Sec-Fetch-Mode no-cors Referer https://app.sndbox.com/sample/3ee516c4-5cf4-4f30-b68a-41c6d9e7db75%7C746835c594c93272d821743eab1bb379%7Cmalicious%7C986b05b9abc7182a479936cbb819aaafa2f0d81c%7Cc024a89925cb7905c714e9a0f692fc73e7a66ff91c8a14c3d1e3bda9c96ba7c0%7CHTML%7C0.579990768490768%7Cfinished%7C2019-09-19T16:29:40.511Z%7C User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 30 Aug 2019 07:38:02 GMT content-encoding gzip x-content-type-options nosniff last-modified Mon, 26 Aug 2019 23:45:00 GMT server sffe age 1760101 vary Accept-Encoding content-type text/javascript status 200 cache-control public, max-age=31536000 accept-ranges bytes alt-svc quic=":443"; ma=2592000; v="46,43,39" content-length 94196 x-xss-protection 0 expires Sat, 29 Aug 2020 07:38:02 GMT
GET H2	200	pptm.js Show response www.paypal.com/tagmanager/	12 KB 6 KB	16ms 14ms	Script application/x-javascript	23.210.248.226 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://www.paypal.com/tagmanager/pptm.js?id=app.sndbox.com&source=checkoutjs&t=xo&v=4.0.286 Requested by Host: www.paypalobjects.com URL: https://www.paypalobjects.com/api/checkout.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 23.210.248.226 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a23-210-248-226.deploy.static.akamaitechnologies.com Software Apache / Resource Hash d69182fae9ab3261fb315c27f4c678da0bff12d11a315c0cdf95c2f896e5f06c Security Headers Name Value Content-Security-Policy default-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; script-src 'nonce-ydoPD+If2XgP88fQBqbr4Iv7/gkPNblUDvHEzZaoHyQ9IDUO' 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline' 'unsafe-eval'; img-src * data:; object-src 'none'; font-src 'self' https://*.paypalobjects.com https://*.paypal.com; connect-src 'self' https://*.paypal.com https://*.paypalobjects.com https://nexus.ensighten.com https://*.google-analytics.com 'unsafe-inline'; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; block-all-mixed-content; report-uri https://www.paypal.com/csplog/api/log/csp Strict-Transport-Security max-age=63072000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Sec-Fetch-Mode no-cors Referer https://app.sndbox.com/sample/3ee516c4-5cf4-4f30-b68a-41c6d9e7db75%7C746835c594c93272d821743eab1bb379%7Cmalicious%7C986b05b9abc7182a479936cbb819aaafa2f0d81c%7Cc024a89925cb7905c714e9a0f692fc73e7a66ff91c8a14c3d1e3bda9c96ba7c0%7CHTML%7C0.579990768490768%7Cfinished%7C2019-09-19T16:29:40.511Z%7C User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers x-edgeconnect-origin-mex-latency 306, 306 content-security-policy default-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; script-src 'nonce-ydoPD+If2XgP88fQBqbr4Iv7/gkPNblUDvHEzZaoHyQ9IDUO' 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline' 'unsafe-eval'; img-src * data:; object-src 'none'; font-src 'self' https://*.paypalobjects.com https://*.paypal.com; connect-src 'self' https://*.paypal.com https://*.paypalobjects.com https://nexus.ensighten.com https://*.google-analytics.com 'unsafe-inline'; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; block-all-mixed-content; report-uri https://www.paypal.com/csplog/api/log/csp content-encoding gzip x-content-type-options nosniff x-edgeconnect-midmile-rtt 0, 2 x-recruiting If you are reading this, maybe you should be working at PayPal instead! Check out https://www.paypal.com/us/webapps/mpp/paypal-jobs status 200 http_x_pp_az_locator ccg23.lvs paypal-debug-id 6310fa6bd1b08, 6310fa6bd1b08 dc phx-origin-www-1.paypal.com vary Accept-Encoding content-length 4467 x-xss-protection 1; mode=block pragma no-cache server Apache x-frame-options SAMEORIGIN date Thu, 19 Sep 2019 16:33:03 GMT strict-transport-security max-age=63072000 content-type application/x-javascript; charset=utf-8 cache-control max-age=900, max-age=0, no-cache, no-store, must-revalidate etag W/"3123-fZLdNFp9zZJYYcw8ylpc4twnNa0"
GET H2	200	css fonts.googleapis.com/	9 KB 813 B	22ms 22ms	Stylesheet text/css	2a00:1450:4001:81f::200a Google LLC
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Open+Sans:300,400,600|Raleway:400,700 Requested by Host: app.sndbox.com URL: https://app.sndbox.com/sample/3ee516c4-5cf4-4f30-b68a-41c6d9e7db75%7C746835c594c93272d821743eab1bb379%7Cmalicious%7C986b05b9abc7182a479936cbb819aaafa2f0d81c%7Cc024a89925cb7905c714e9a0f692fc73e7a66ff91c8a14c3d1e3bda9c96ba7c0%7CHTML%7C0.579990768490768%7Cfinished%7C2019-09-19T16:29:40.511Z%7C Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software ESF / Resource Hash aca78ba20c4e994e98e32026f4c393f4b702c66dc0dfa6ccc91c0eabe638c1c0 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Sec-Fetch-Mode no-cors Referer https://app.sndbox.com/sample/3ee516c4-5cf4-4f30-b68a-41c6d9e7db75%7C746835c594c93272d821743eab1bb379%7Cmalicious%7C986b05b9abc7182a479936cbb819aaafa2f0d81c%7Cc024a89925cb7905c714e9a0f692fc73e7a66ff91c8a14c3d1e3bda9c96ba7c0%7CHTML%7C0.579990768490768%7Cfinished%7C2019-09-19T16:29:40.511Z%7C User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding br last-modified Thu, 19 Sep 2019 16:33:03 GMT server ESF link <https://fonts.gstatic.com>; rel=preconnect; crossorigin status 200 date Thu, 19 Sep 2019 16:33:03 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43,39" x-xss-protection 0 expires Thu, 19 Sep 2019 16:33:03 GMT
GET H2	200	icon fonts.googleapis.com/	574 B 419 B	21ms 21ms	Stylesheet text/css	2a00:1450:4001:81f::200a Google LLC
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/icon?family=Material+Icons Requested by Host: app.sndbox.com URL: https://app.sndbox.com/sample/3ee516c4-5cf4-4f30-b68a-41c6d9e7db75%7C746835c594c93272d821743eab1bb379%7Cmalicious%7C986b05b9abc7182a479936cbb819aaafa2f0d81c%7Cc024a89925cb7905c714e9a0f692fc73e7a66ff91c8a14c3d1e3bda9c96ba7c0%7CHTML%7C0.579990768490768%7Cfinished%7C2019-09-19T16:29:40.511Z%7C Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software ESF / Resource Hash 09e13bc501877a8383c2661e6fc80187efadbd82ac4d3b0d1ec8a41d8630756c Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Sec-Fetch-Mode no-cors Referer https://app.sndbox.com/sample/3ee516c4-5cf4-4f30-b68a-41c6d9e7db75%7C746835c594c93272d821743eab1bb379%7Cmalicious%7C986b05b9abc7182a479936cbb819aaafa2f0d81c%7Cc024a89925cb7905c714e9a0f692fc73e7a66ff91c8a14c3d1e3bda9c96ba7c0%7CHTML%7C0.579990768490768%7Cfinished%7C2019-09-19T16:29:40.511Z%7C User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding br last-modified Thu, 19 Sep 2019 16:33:03 GMT server ESF link <https://fonts.gstatic.com>; rel=preconnect; crossorigin status 200 date Thu, 19 Sep 2019 16:33:03 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43,39" x-xss-protection 0 expires Thu, 19 Sep 2019 16:33:03 GMT
POST H2	200	logger Show response www.paypal.com/xoplatform/logger/api/	0 1 KB	244ms 243ms	XHR text/html	23.210.248.226 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://www.paypal.com/xoplatform/logger/api/logger Requested by Host: www.paypalobjects.com URL: https://www.paypalobjects.com/api/checkout.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 23.210.248.226 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a23-210-248-226.deploy.static.akamaitechnologies.com Software Apache / Express Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=63072000 X-Content-Type-Options nosniff Request headers x-app-name checkoutjs Referer https://app.sndbox.com/sample/3ee516c4-5cf4-4f30-b68a-41c6d9e7db75%7C746835c594c93272d821743eab1bb379%7Cmalicious%7C986b05b9abc7182a479936cbb819aaafa2f0d81c%7Cc024a89925cb7905c714e9a0f692fc73e7a66ff91c8a14c3d1e3bda9c96ba7c0%7CHTML%7C0.579990768490768%7Cfinished%7C2019-09-19T16:29:40.511Z%7C X-Requested-With XMLHttpRequest User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Mode cors Content-type application/json Response headers x-edgeconnect-origin-mex-latency 92 date Thu, 19 Sep 2019 16:33:04 GMT content-encoding gzip x-content-type-options nosniff x-edgeconnect-midmile-rtt 140 x-powered-by Express x-recruiting If you are reading this, maybe you should be working at PayPal instead! Check out https://www.paypal.com/us/webapps/mpp/paypal-jobs status 200 http_x_pp_az_locator ccg23.lvs paypal-debug-id 39d0a00f230d7, 39d0a00f230d7 dc phx-origin-www-1.paypal.com vary Accept-Encoding content-length 26 pragma no-cache server Apache strict-transport-security max-age=63072000 content-type text/html access-control-allow-origin https://app.sndbox.com cache-control no-cache, max-age=0, no-cache, no-store, must-revalidate
GET H2	200	ts t.paypal.com/	42 B 559 B	239ms 235ms	Image image/gif	23.210.248.226 Akamai Technologies
General Check archive.org Show headers Download Go to Show image Full URL https://t.paypal.com/ts?pgrp=muse%3Ageneric%3Aanalytics%3A%3Amerchant&page=muse%3Ageneric%3Aanalytics%3A%3Amerchant%3A%3A%3A&tsrce=tagmanagernodeweb&comp=tagmanagernodeweb&sub_component=analytics&s=ci&fltp=analytics-generic&pt=SNDBOX&dh=1200&dw=1600&bh=1200&bw=1600&cd=24&sh=1200&sw=1600&v=NA&rosetta_language=en-US&e=im&t=1568910783810&g=-120&completeurl=https%3A%2F%2Fapp.sndbox.com%2Fsample%2F3ee516c4-5cf4-4f30-b68a-41c6d9e7db75%257C746835c594c93272d821743eab1bb379%257Cmalicious%257C986b05b9abc7182a479936cbb819aaafa2f0d81c%257Cc024a89925cb7905c714e9a0f692fc73e7a66ff91c8a14c3d1e3bda9c96ba7c0%257CHTML%257C0.579990768490768%257Cfinished%257C2019-09-19T16%3A29%3A40.511Z%257C&sinfo=%7B%22partners%22%3A%7B%22ecwid%22%3A%7B%7D%2C%22bigCommerce%22%3A%7B%7D%2C%22shopify%22%3A%7B%7D%2C%22wix%22%3A%7B%7D%2C%22bigCartel%22%3A%7B%7D%7D%7D Requested by Host: app.sndbox.com URL: https://app.sndbox.com/sample/3ee516c4-5cf4-4f30-b68a-41c6d9e7db75%7C746835c594c93272d821743eab1bb379%7Cmalicious%7C986b05b9abc7182a479936cbb819aaafa2f0d81c%7Cc024a89925cb7905c714e9a0f692fc73e7a66ff91c8a14c3d1e3bda9c96ba7c0%7CHTML%7C0.579990768490768%7Cfinished%7C2019-09-19T16:29:40.511Z%7C Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 23.210.248.226 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a23-210-248-226.deploy.static.akamaitechnologies.com Software akka-http/10.1.7 / Resource Hash 6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93 Request headers Sec-Fetch-Mode no-cors Referer https://app.sndbox.com/sample/3ee516c4-5cf4-4f30-b68a-41c6d9e7db75%7C746835c594c93272d821743eab1bb379%7Cmalicious%7C986b05b9abc7182a479936cbb819aaafa2f0d81c%7Cc024a89925cb7905c714e9a0f692fc73e7a66ff91c8a14c3d1e3bda9c96ba7c0%7CHTML%7C0.579990768490768%7Cfinished%7C2019-09-19T16:29:40.511Z%7C User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Thu, 19 Sep 2019 16:33:04 GMT server akka-http/10.1.7 p3p policyref="https://t.paypal.com/w3c/p3p.xml",CP="CAO IND OUR SAM UNI STA COR COM" status 200 http_x_pp_az_locator slcb.slc cache-control max-age=0, no-cache, no-store content-type image/gif content-length 42 expires Thu, 19 Sep 2019 16:33:04 GMT

23 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate object| ___grecaptcha_cfg object| grecaptcha boolean| __google_recaptcha_client object| recaptcha object| __postRobot__ object| __zoid__ function| onLegacyPaymentAuthorize function| watchForLegacyFallback function| onLegacyFallback string| LOG_LEVEL function| __pptmLoadedWithNoContent object| __paypal_storage__ object| paypal object| PAYPAL object| ppxo function| webpackJsonp object| paypalDDL object| __core-js_shared__ function| setImmediate function| clearImmediate function| _

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://www.gstatic.com/recaptcha/api2/v1566858990656/recaptcha__en.js(Line 512) Message: reCAPTCHA couldn't find user-provided function: vueRecaptchaApiLoaded

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

app.sndbox.com
fonts.googleapis.com
t.paypal.com
www.google.com
www.gstatic.com
www.paypal.com
www.paypalobjects.com
143.204.214.58
23.210.248.226
2a00:1450:4001:817::2003
2a00:1450:4001:818::2004
2a00:1450:4001:81f::200a
09e13bc501877a8383c2661e6fc80187efadbd82ac4d3b0d1ec8a41d8630756c
6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93
7dfd16de07d6cc0c4230e74493d517f521403968ebca8c8d5851b52223e7d077
a6acad3089689613cf40fedfcc680db5c1855798a87b801d21d8ec7f9549df6d
a8761357265fd267da065af29ede36f41a199cdfc55cec43a408488c18ab7d60
aca78ba20c4e994e98e32026f4c393f4b702c66dc0dfa6ccc91c0eabe638c1c0
bd3cad6b7ba79270dee54a5ba1482ac6b522b147dc8f9d04791050711ada7865
d58b1374ac50b7f27c2e65c5a0bb91c4a19b8f4faf0d18935e74d3f670f64922
d69182fae9ab3261fb315c27f4c678da0bff12d11a315c0cdf95c2f896e5f06c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e7fcdc6067892d819a157d0d1d06a48fa4ca4b827e2d7400ba8f684989508c77
e8caaca7ea6ddec7b02dc0a3377ba515eb75829fb0020e55f46cc18644f6eb1e
f960228afbe1791e6ddd5cae0dafbdb6c5047ff373b7f13c3cb486656a6e12e7