472a4262-a2a1-4785-b3aa-4816cba070ed.htmlcomponentservice.com
Open in
urlscan Pro
2a00:1450:4001:812::2013
Malicious Activity!
Public Scan
Submission Tags: phishing malicious Search All
Submission: On February 26 via api from US
Summary
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on February 5th 2021. Valid for: 6 months.
This is the only time 472a4262-a2a1-4785-b3aa-4816cba070ed.htmlcomponentservice.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: PayPal (Financial)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 | 2a00:1450:400... 2a00:1450:4001:812::2013 | 15169 (GOOGLE) (GOOGLE) | |
14 | 104.111.228.123 104.111.228.123 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
1 | 2a00:1450:400... 2a00:1450:4001:809::2003 | 15169 (GOOGLE) (GOOGLE) | |
7 | 2a00:1450:400... 2a00:1450:4001:810::2003 | 15169 (GOOGLE) (GOOGLE) | |
4 | 2a00:1450:400... 2a00:1450:4001:810::2004 | 15169 (GOOGLE) (GOOGLE) | |
2 | 151.101.1.35 151.101.1.35 | 54113 (FASTLY) (FASTLY) | |
31 | 7 |
ASN15169 (GOOGLE, US)
472a4262-a2a1-4785-b3aa-4816cba070ed.htmlcomponentservice.com |
ASN16625 (AKAMAI-AS, US)
PTR: a104-111-228-123.deploy.static.akamaitechnologies.com
www.paypalobjects.com |
ASN15169 (GOOGLE, US)
www.gstatic.com | |
fonts.gstatic.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
14 |
paypalobjects.com
www.paypalobjects.com |
104 KB |
7 |
gstatic.com
www.gstatic.com fonts.gstatic.com |
451 KB |
4 |
google.com
www.google.com |
19 KB |
3 |
htmlcomponentservice.com
472a4262-a2a1-4785-b3aa-4816cba070ed.htmlcomponentservice.com |
3 KB |
2 |
paypal.com
t.paypal.com |
1 KB |
1 |
recaptcha.net
www.recaptcha.net |
998 B |
31 | 6 |
Domain | Requested by | |
---|---|---|
14 | www.paypalobjects.com |
472a4262-a2a1-4785-b3aa-4816cba070ed.htmlcomponentservice.com
www.paypalobjects.com |
6 | www.gstatic.com |
www.recaptcha.net
www.google.com www.gstatic.com |
4 | www.google.com |
www.gstatic.com
www.google.com |
3 | 472a4262-a2a1-4785-b3aa-4816cba070ed.htmlcomponentservice.com |
www.paypalobjects.com
|
2 | t.paypal.com | |
1 | fonts.gstatic.com |
www.google.com
|
1 | www.recaptcha.net |
www.paypalobjects.com
|
31 | 7 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.htmlcomponentservice.com Sectigo RSA Domain Validation Secure Server CA |
2021-02-05 - 2021-08-04 |
6 months | crt.sh |
www.paypal.com DigiCert SHA2 Extended Validation Server CA |
2021-01-13 - 2022-01-11 |
a year | crt.sh |
misc.google.com GTS CA 1O1 |
2021-01-26 - 2021-04-20 |
3 months | crt.sh |
*.gstatic.com GTS CA 1O1 |
2021-01-26 - 2021-04-20 |
3 months | crt.sh |
www.google.com GTS CA 1O1 |
2021-01-26 - 2021-04-20 |
3 months | crt.sh |
*.google.com GTS CA 1O1 |
2021-01-26 - 2021-04-20 |
3 months | crt.sh |
t.paypal.com DigiCert SHA2 Extended Validation Server CA |
2020-11-17 - 2021-11-21 |
a year | crt.sh |
This page contains 4 frames:
Primary Page:
https://472a4262-a2a1-4785-b3aa-4816cba070ed.htmlcomponentservice.com/get_draft?id=472a42_5d66332d057c0e5e467a67a63595b775.html
Frame ID: F27C5C3E8333F2F538B400D3740B6BBD
Requests: 18 HTTP requests in this frame
Frame:
https://www.paypalobjects.com/authchallenge/recaptcha_v2.html?siteKey=6LepHQgUAAAAAFOcWWRUhSOX_LNu0USnf7Vg6SyA&locale.x=en_US&country.x=US&checkConnectionTimeout=5000
Frame ID: 6898158668D5EC0A6461B0CB3BE4ECC8
Requests: 3 HTTP requests in this frame
Frame:
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LepHQgUAAAAAFOcWWRUhSOX_LNu0USnf7Vg6SyA&co=aHR0cHM6Ly93d3cucGF5cGFsb2JqZWN0cy5jb206NDQz&hl=en&v=jxFQ7RQ9s9HTGKeWcoa6UQdD&theme=light&size=normal&cb=i886psfgmwiu
Frame ID: D19E09D6B3F9907B5A643DE78AB71374
Requests: 9 HTTP requests in this frame
Frame:
https://www.google.com/recaptcha/api2/bframe?hl=en&v=jxFQ7RQ9s9HTGKeWcoa6UQdD&k=6LepHQgUAAAAAFOcWWRUhSOX_LNu0USnf7Vg6SyA&cb=spr34m14m0uz
Frame ID: 14DD7ED7F761D6C7436DA79DBA4982F7
Requests: 3 HTTP requests in this frame
Screenshot
Detected technologies
Google App Engine (Web Servers) ExpandDetected patterns
- headers server /Google Frontend/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
31 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
get_draft
472a4262-a2a1-4785-b3aa-4816cba070ed.htmlcomponentservice.com/ |
6 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pa.js
www.paypalobjects.com/pa/js/ |
52 KB 20 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app.css
www.paypalobjects.com/web/res/a1e/e1e5222a8483f8c63e425963d904b/css/ |
33 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
modernizr-2.6.1.js
www.paypalobjects.com/web/res/a1e/e1e5222a8483f8c63e425963d904b/js/lib/ |
4 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
authchallenge.js
www.paypalobjects.com/web/res/a1e/e1e5222a8483f8c63e425963d904b/js/ |
12 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
require.js
www.paypalobjects.com/web/res/a1e/e1e5222a8483f8c63e425963d904b/js/lib/ |
15 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
recaptcha_v2.html
www.paypalobjects.com/authchallenge/ Frame 6898 |
4 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
config.js
www.paypalobjects.com/web/res/a1e/e1e5222a8483f8c63e425963d904b/js/ |
1 KB 932 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app.js
www.paypalobjects.com/web/res/a1e/e1e5222a8483f8c63e425963d904b/js/ |
154 KB 52 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
logclientdata
472a4262-a2a1-4785-b3aa-4816cba070ed.htmlcomponentservice.com/auth/ |
154 B 224 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
momgram@2x.png
www.paypalobjects.com/images/shared/ |
1 KB 2 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
api.js
www.recaptcha.net/recaptcha/ Frame 6898 |
912 B 998 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
recaptcha__en.js
www.gstatic.com/recaptcha/releases/jxFQ7RQ9s9HTGKeWcoa6UQdD/ Frame 6898 |
331 KB 129 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dust-core.js
www.paypalobjects.com/web/res/a1e/e1e5222a8483f8c63e425963d904b/js/lib/ |
11 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
anchor
www.google.com/recaptcha/api2/ Frame D19E |
20 KB 11 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
logclientdata
472a4262-a2a1-4785-b3aa-4816cba070ed.htmlcomponentservice.com/auth/ |
154 B 212 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
styles__ltr.css
www.gstatic.com/recaptcha/releases/jxFQ7RQ9s9HTGKeWcoa6UQdD/ Frame D19E |
50 KB 25 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
recaptcha__en.js
www.gstatic.com/recaptcha/releases/jxFQ7RQ9s9HTGKeWcoa6UQdD/ Frame D19E |
331 KB 129 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame D19E |
14 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame D19E |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
logo_48.png
www.gstatic.com/recaptcha/api2/ Frame D19E |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
fonts.gstatic.com/s/roboto/v18/ Frame D19E |
10 KB 11 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
OO1-U3lU0dAcjgy9Mul1Jwiij773bxCQH26zOKTm-Ow.js
www.google.com/js/bg/ Frame D19E |
14 KB 6 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
webworker.js
www.google.com/recaptcha/api2/ Frame D19E |
102 B 279 B |
Other
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
bframe
www.google.com/recaptcha/api2/ Frame 14DD |
7 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
authcaptcha.js
www.paypalobjects.com/web/res/a1e/e1e5222a8483f8c63e425963d904b/js/view/ |
2 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
styles__ltr.css
www.gstatic.com/recaptcha/releases/jxFQ7RQ9s9HTGKeWcoa6UQdD/ Frame 14DD |
50 KB 25 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
recaptcha__en.js
www.gstatic.com/recaptcha/releases/jxFQ7RQ9s9HTGKeWcoa6UQdD/ Frame 14DD |
331 KB 129 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pageView.js
www.paypalobjects.com/web/res/a1e/e1e5222a8483f8c63e425963d904b/js/view/ |
962 B 907 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
validation.js
www.paypalobjects.com/web/res/a1e/e1e5222a8483f8c63e425963d904b/js/widgets/ |
693 B 746 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
errorDisplay.js
www.paypalobjects.com/web/res/a1e/e1e5222a8483f8c63e425963d904b/js/widgets/ |
2 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ts
t.paypal.com/ |
42 B 681 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ts
t.paypal.com/ |
42 B 455 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: PayPal (Financial)30 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated object| PAYPAL object| fpti string| fptiserverurl object| _ifpti object| html5 object| Modernizr function| requirejs function| require function| define boolean| autosubmit undefined| recaptchaCallback object| ADS_FPTI function| validateChallengeInput function| extend function| $ function| jQuery object| dust function| _ object| Backbone object| jQuery1124090043058401926520 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
472a4262-a2a1-4785-b3aa-4816cba070ed.htmlcomponentservice.com
fonts.gstatic.com
t.paypal.com
www.google.com
www.gstatic.com
www.paypalobjects.com
www.recaptcha.net
104.111.228.123
151.101.1.35
2a00:1450:4001:809::2003
2a00:1450:4001:810::2003
2a00:1450:4001:810::2004
2a00:1450:4001:812::2013
0964d141519db34adc6aa127a33dbc6761cda1e56b584ea402082d99c44afb9e
0d5ae53ece52d6fdd659eab44c62831a3edeaf170a2f900ec2a405cba5f976c6
0eb22afbab03bbbd8a47d4fc5361ff7518a77273e99fd0b73e235c93dd6ea7aa
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
1da11ee0eedb645c9089183d58178cfb96708f321a76be3eadf2f978a0ca4bbb
38ed7e537954d1d01c8e0cbd32e9752708a28fbef76f10901f6eb338a4e6f8ec
3ab59d6a93eea708acd7de12f0f1a969ee43aec05af9c8233cf8bd8b7ebbb9ac
3c1fcf42997c157f61c40fdd081558f64ecc58956eb45ca5e7c2768286fe26ff
4352380f92ce7f9a4a4a23306b992bed10055dbfffe90987cc72083e583fc280
43ef4025567f7a15859b5252b6ccc1efe2ff8c7331b1aefbea7ce88eb5084d27
46c97699759b3239f2306f7d09df96131fb1044315b07cfdd62b66c2e4c0125b
6b08ea3a348838bc942ad470a757575975bd09459b63c1872c6e1129a6ca1939
6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93
7549618e528fd1eccd42defb37f7b18d7330813a4c7214f5b9660f7a6c23032b
8cf5ce27d21490c24eedf91e0ac2bc4a748ba8f4eb20cb7c1fc9442d2d580008
a0828c4ed91da6cb035a3ef8e2c45c95c7d2ffef2d28813b2cda9b6433bd212c
a6c3bff965978df8093c3a29f7071c21d7439a212af41e7b40ce70d94d6bcc44
ab1e16c1b3f793e0aec723c7a7add9e179781105d1646ced630af7007ca52720
afc53c2cec2356343be099b69e3328b10d3938dc041f0db6e44059e94fc3d753
b5a8625ac074103a36ddef69e1a8ee3a4dcb10df29abe8be9511469bc0d7d479
b9c1fbd8f6b13011e0c3e0e9ca294884f09dc3ec0c305b41f567bf9b088aebbe
c007d73792ac2d25882bfbb573e700e721a0adacfab947e6a0b64a61991fecf0
cfe6220499b6747acae20d3034ebf5dcb8d37718262994964b85fa6964a6cf45
d1a7d216019da8388df7eae074e71b0acfc005ad84409a5ff6c7e0f36ef9eb96
df91f886fb930b4756ca24d3d46371d38294e4c1ba5d84bbb98ce07af25e057e
f054fae6fb3433f5e1f7d3f964156276a85b82298d8b5bdc12aac342124f88be
f63be82448bb5f46eadfbda31e771fe3710f5cbdcaaab02c7a020c2a2bf3d5b9
f977d4284f71bb9418da0e2ced1408b073cd2484cba7fc04a90ff3ee72eab60c