13.66.28.137 Open in urlscan Pro
13.66.28.137  Malicious Activity! Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Cookie set / Show response 13.66.28.137/authflow/email-recovery/	59 KB 19 KB	506ms 500ms	Document text/html	13.66.28.137 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL http://13.66.28.137/authflow/email-recovery/?amp&amp Protocol HTTP/1.1 Server 13.66.28.137 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software nginx/1.4.6 (Ubuntu) / Resource Hash c760ad5e326e1a1a5d74727707490df96cca2c8d3a3f08e4bf04851d41f382f5 Security Headers Name Value Content-Security-Policy default-src 'self' https://*.paypal.com https://*.paypalobjects.com; script-src 'nonce-VEUehFLFN2bUd5taB+021nOsXnPscagZSsxWHWa0pKkdaqtx' 'self' 'unsafe-inline' 'unsafe-eval' https://*.paypal.com https://*.paypalobjects.com; img-src 'self' data: https:; object-src 'none'; media-src data: blob: 'self' https://*.paypal.com https://*.paypalobjects.com; font-src 'self' https://*.paypal.com https://*.paypalobjects.com; style-src 'self' 'unsafe-inline' https://*.paypal.com https://*.paypalobjects.com; frame-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; child-src 'self' https://*.paypal.com https://*.paypalobjects.com; connect-src 'self' https://*.paypal.com https://*.paypalobjects.com https://nexus.ensighten.com https://*.google-analytics.com https://*.qualtrics.com; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; block-all-mixed-content;; report-uri https://www.paypal.com/csplog/api/log/csp Strict-Transport-Security max-age=63072000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Host 13.66.28.137 Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Server nginx/1.4.6 (Ubuntu) Date Wed, 24 Feb 2021 04:09:06 GMT Content-Type text/html; charset=utf-8 Content-Length 16790 Connection keep-alive Cache-Control max-age=0, no-cache, no-store, must-revalidate Content-Security-Policy default-src 'self' https://*.paypal.com https://*.paypalobjects.com; script-src 'nonce-VEUehFLFN2bUd5taB+021nOsXnPscagZSsxWHWa0pKkdaqtx' 'self' 'unsafe-inline' 'unsafe-eval' https://*.paypal.com https://*.paypalobjects.com; img-src 'self' data: https:; object-src 'none'; media-src data: blob: 'self' https://*.paypal.com https://*.paypalobjects.com; font-src 'self' https://*.paypal.com https://*.paypalobjects.com; style-src 'self' 'unsafe-inline' https://*.paypal.com https://*.paypalobjects.com; frame-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; child-src 'self' https://*.paypal.com https://*.paypalobjects.com; connect-src 'self' https://*.paypal.com https://*.paypalobjects.com https://nexus.ensighten.com https://*.google-analytics.com https://*.qualtrics.com; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; block-all-mixed-content;; report-uri https://www.paypal.com/csplog/api/log/csp ETag W/"eba1-7uECrnKyDdA5YJvNjYUinYNjEmc" Paypal-Debug-Id 5e5f8e048788 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block DC ccg11-origin-www-1.paypal.com X-EdgeConnect-MidMile-RTT 42 X-EdgeConnect-Origin-MEX-Latency 168 Vary Accept-Encoding Content-Encoding gzip Set-Cookie enforce_policy=ccpa; Max-Age=31536000; Domain=.paypal.com; Path=/; Expires=Thu, 24 Feb 2022 04:09:06 GMT; Secure; SameSite=None LANG=en_US%3BUS; Max-Age=31556; Domain=.paypal.com; Path=/; Expires=Wed, 24 Feb 2021 12:55:02 GMT; HttpOnly; Secure; SameSite=None tsrce=authnodeweb; Max-Age=259199; Domain=.paypal.com; Path=/; Expires=Sat, 27 Feb 2021 04:09:05 GMT; HttpOnly; Secure; SameSite=None x-pp-s=eyJ0IjoiMTYxNDEzOTc0NjM0MiIsImwiOiIwIiwibSI6IjAifQ; Domain=.paypal.com; Path=/; HttpOnly; Secure; SameSite=None nsid=s%3AxX6TO39EYWEd-tyHdMLFjT4R_VQHXl8c.SNemFE94uEdPuRSGS08hwJwrh452wwzhQTut%2BHblq4U; Path=/; HttpOnly; Secure; SameSite=None l7_az=dcg15.slc; Path=/; Domain=paypal.com; Expires=Wed, 24 Feb 2021 04:39:06 GMT; HttpOnly; Secure; SameSite=None ts=vreXpYrS%3D1708747746%26vteXpYrS%3D1614141546%26vr%3Dd239e79d1770ad046ccdca65fff76e40%26vt%3Dd239e79d1770ad046ccdca65fff76e3f%26vtyp%3Dnew; Path=/; Domain=paypal.com; Expires=Sat, 24 Feb 2024 04:09:06 GMT; HttpOnly; Secure; SameSite=None ts_c=vr%3Dd239e79d1770ad046ccdca65fff76e40%26vt%3Dd239e79d1770ad046ccdca65fff76e3f; Path=/; Domain=paypal.com; Expires=Sat, 24 Feb 2024 04:09:06 GMT; Secure; SameSite=None x-cdn=akamai; path=/; domain=.paypal.com; secure akavpau_ppsd=1614140346~id=bb4ef8ae0b21fc131ab6b6ee52e31f65; Domain=www.paypal.com; Path=/; HttpOnly; Secure; SameSite=None Strict-Transport-Security max-age=63072000
GET H2	200	app.css www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/css/	134 KB 20 KB	89ms 19ms	Stylesheet text/css	104.111.228.123 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/css/app.css Requested by Host: 13.66.28.137 URL: http://13.66.28.137/authflow/email-recovery/?amp&amp Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.228.123 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-228-123.deploy.static.akamaitechnologies.com Software / Resource Hash e00ab4867c277813a14fbbc89e0b52b2a96060287669cdd6262f539614b97fcb Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Referer http://13.66.28.137/authflow/email-recovery/?amp&amp User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 24 Feb 2021 04:09:06 GMT content-encoding gzip x-content-type-options nosniff surrogate-control max-age=31536000 paypal-debug-id 77a340fb4bae dc ccg11-origin-www-1.paypal.com vary Accept-Encoding content-length 19786 last-modified Thu, 11 Feb 2021 00:43:48 GMT etag W/"60247dc4-2188e" strict-transport-security max-age=31536000 access-control-allow-methods GET content-type text/css access-control-allow-origin * cache-control max-age=31536000 expires Thu, 24 Feb 2022 04:09:06 GMT
GET H2	200	app.js Show response www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/js/	3 MB 726 KB	99ms 29ms	Script application/javascript	104.111.228.123 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/js/app.js Requested by Host: 13.66.28.137 URL: http://13.66.28.137/authflow/email-recovery/?amp&amp Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.228.123 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-228-123.deploy.static.akamaitechnologies.com Software / Resource Hash f39646ccd4fbf32d475bed59e8c5a1f18208da3d23783672d095273e4e91a7dc Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Referer http://13.66.28.137/authflow/email-recovery/?amp&amp User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 24 Feb 2021 04:09:06 GMT content-encoding gzip x-content-type-options nosniff surrogate-control max-age=31536000 paypal-debug-id 7365bc2b8fe33 dc ccg11-origin-www-3.paypal.com vary Accept-Encoding content-length 741072 last-modified Thu, 11 Feb 2021 00:43:48 GMT etag W/"60247dc4-28f32c" strict-transport-security max-age=31536000 access-control-allow-methods GET content-type application/javascript access-control-allow-origin * cache-control max-age=31536000 access-control-allow-headers x-csrf-token expires Thu, 24 Feb 2022 04:09:06 GMT
GET H2	200	pa.js Show response www.paypalobjects.com/pa/js/	52 KB 20 KB	107ms 36ms	Script application/javascript	104.111.228.123 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://www.paypalobjects.com/pa/js/pa.js Requested by Host: 13.66.28.137 URL: http://13.66.28.137/authflow/email-recovery/?amp&amp Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.228.123 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-228-123.deploy.static.akamaitechnologies.com Software / Resource Hash 0eb22afbab03bbbd8a47d4fc5361ff7518a77273e99fd0b73e235c93dd6ea7aa Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Referer http://13.66.28.137/authflow/email-recovery/?amp&amp User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 24 Feb 2021 04:09:06 GMT content-encoding gzip x-content-type-options nosniff surrogate-control max-age=31536000 paypal-debug-id 74fa405ca849f dc slc-b-origin-www-2.paypal.com vary Accept-Encoding content-length 20130 last-modified Thu, 18 Feb 2021 06:57:36 GMT etag W/"602e0fe0-cfcb" strict-transport-security max-age=31536000 access-control-allow-methods GET content-type application/javascript access-control-allow-origin * cache-control public, max-age=3600 access-control-allow-headers x-csrf-token expires Wed, 24 Feb 2021 05:09:06 GMT
GET H2	200	bs.js Show response www.paypalobjects.com/tagmgmt/	19 B 374 B	110ms 40ms	Script application/javascript	104.111.228.123 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://www.paypalobjects.com/tagmgmt/bs.js Requested by Host: 13.66.28.137 URL: http://13.66.28.137/authflow/email-recovery/?amp&amp Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.228.123 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-228-123.deploy.static.akamaitechnologies.com Software / Resource Hash be5c4f71eea822cbdcaefcf92963ab573e903f75a60b8bc0793e4eec935a1187 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Referer http://13.66.28.137/authflow/email-recovery/?amp&amp User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 24 Feb 2021 04:09:06 GMT x-content-type-options nosniff surrogate-control max-age=31536000 paypal-debug-id beed56fe117b4 dc ccg11-origin-www-3.paypal.com vary Accept-Encoding content-length 19 last-modified Thu, 01 Oct 2020 22:15:27 GMT etag "5f7654ff-13" strict-transport-security max-age=31536000 access-control-allow-methods GET content-type application/javascript access-control-allow-origin * cache-control max-age=3600 accept-ranges bytes access-control-allow-headers x-csrf-token expires Wed, 24 Feb 2021 05:09:06 GMT
GET H2	200	messaging-opener-mts.js Show response www.paypalobjects.com/messaging/auth/v1/	3 KB 1 KB	112ms 42ms	Script application/javascript	104.111.228.123 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://www.paypalobjects.com/messaging/auth/v1/messaging-opener-mts.js Requested by Host: 13.66.28.137 URL: http://13.66.28.137/authflow/email-recovery/?amp&amp Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.228.123 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-228-123.deploy.static.akamaitechnologies.com Software / Resource Hash bcdf050ce6625609e7a3e64f52f1650e7a79abc12a9c7e712fe2b9cfd808e977 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Referer http://13.66.28.137/authflow/email-recovery/?amp&amp User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 24 Feb 2021 04:09:06 GMT content-encoding gzip x-content-type-options nosniff surrogate-control max-age=31536000 paypal-debug-id b67d6edeb53a5 dc slc-b-origin-www-3.paypal.com vary Accept-Encoding content-length 1081 last-modified Thu, 01 Oct 2020 22:15:16 GMT etag W/"5f7654f4-b7b" strict-transport-security max-age=31536000 access-control-allow-methods GET content-type application/javascript access-control-allow-origin * cache-control max-age=3600 expires Wed, 24 Feb 2021 05:09:06 GMT
GET H2	200	monogram@2x.png www.paypalobjects.com/images/shared/	1 KB 2 KB	30ms 29ms	Image image/png	104.111.228.123 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.paypalobjects.com/images/shared/monogram@2x.png Requested by Host: www.paypalobjects.com URL: https://www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/css/app.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.228.123 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-228-123.deploy.static.akamaitechnologies.com Software Akamai Image Manager / Resource Hash bbe3177aa5d225f117aea0e2eeb27f11d853a33d6d162733c5be8b1de8d36dc5 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Referer https://www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/css/app.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 24 Feb 2021 04:09:06 GMT x-content-type-options nosniff last-modified Wed, 06 Jan 2021 02:00:50 GMT server Akamai Image Manager etag "tu4IksQhsaBV1ddsYvtwjxUD2qmVV7SZmLo7q4XSXU0" strict-transport-security max-age=31536000 content-type image/png cache-control private, max-age=683495 content-length 1507 expires Thu, 04 Mar 2021 02:00:41 GMT
GET H2	200	PayPalSansSmall-Regular.woff www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/	46 KB 47 KB	59ms 19ms	Font font/woff	104.111.228.123 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/PayPalSansSmall-Regular.woff Requested by Host: www.paypalobjects.com URL: https://www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/css/app.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.228.123 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-228-123.deploy.static.akamaitechnologies.com Software / Resource Hash ae79dcc3eb016922caa1d095cfd936446bc65a46bb3364b242dfc556f7e3c6a8 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Origin http://13.66.28.137 Referer https://www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/css/app.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 24 Feb 2021 04:09:06 GMT x-content-type-options nosniff last-modified Wed, 30 Sep 2015 05:09:04 GMT cache-control max-age=3600 etag "560b6e70-b8eb" vary Accept-Encoding content-type font/woff access-control-allow-origin * paypal-debug-id ff23e7beab590 strict-transport-security max-age=31536000 accept-ranges bytes dc phx-origin-www-2.paypal.com content-length 47339 expires Wed, 24 Feb 2021 05:09:06 GMT
GET H2	200	animation-oval.png www.paypalobjects.com/images/shared/	2 KB 3 KB	26ms 25ms	Image image/webp	104.111.228.123 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.paypalobjects.com/images/shared/animation-oval.png Requested by Host: www.paypalobjects.com URL: https://www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/css/app.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.228.123 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-228-123.deploy.static.akamaitechnologies.com Software Akamai Image Manager / Resource Hash da775dd10f868447dea4c3522fb3b55bd4a5df650d3f2233a76d31bb711f6c2a Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Referer https://www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/css/app.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 24 Feb 2021 04:09:06 GMT x-content-type-options nosniff last-modified Tue, 02 Feb 2021 02:00:03 GMT server Akamai Image Manager etag "dhhY3utDsCxd+2sX5XmaH0WADbsU4TzWhkD7AThom/c" strict-transport-security max-age=31536000 content-type image/webp cache-control private, no-transform, max-age=43200 content-length 2448 expires Wed, 24 Feb 2021 16:09:06 GMT
GET H2	200	PayPalSansBig-Light.woff www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/	48 KB 48 KB	71ms 36ms	Font application/x-font-woff	104.111.228.123 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/PayPalSansBig-Light.woff Requested by Host: www.paypalobjects.com URL: https://www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/css/app.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.228.123 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-228-123.deploy.static.akamaitechnologies.com Software Apache / Resource Hash c599c554590d1a336ffcb9627f6caaac34b6228f60e15f5f25454bff38facb7e Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Origin http://13.66.28.137 Referer https://www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/css/app.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 24 Feb 2021 04:09:06 GMT x-pad avoid browser bug x-content-type-options nosniff last-modified Wed, 30 Sep 2015 05:09:04 GMT server Apache vary Accept-Encoding content-type application/x-font-woff access-control-allow-origin * cache-control max-age=3600 strict-transport-security max-age=31536000 accept-ranges bytes content-length 49115 expires Wed, 24 Feb 2021 05:09:06 GMT
GET H2	200	PayPalSansSmall-Light.woff www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/	46 KB 46 KB	70ms 36ms	Font font/woff	104.111.228.123 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/PayPalSansSmall-Light.woff Requested by Host: www.paypalobjects.com URL: https://www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/css/app.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.228.123 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-228-123.deploy.static.akamaitechnologies.com Software / Resource Hash 843e67ad522a908162007f4b7601819a5bbfef00e38ac7aec778766da8b7b2ab Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Origin http://13.66.28.137 Referer https://www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/css/app.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 24 Feb 2021 04:09:06 GMT x-content-type-options nosniff last-modified Wed, 30 Sep 2015 05:09:04 GMT cache-control public, max-age=3600 etag "560b6e70-b66f" surrogate-control max-age=31536000 vary Accept-Encoding content-type font/woff access-control-allow-origin * paypal-debug-id 5c262e7fb56e0 strict-transport-security max-age=31536000 accept-ranges bytes dc slc-b-origin-www-1.paypal.com content-length 46703 expires Wed, 24 Feb 2021 05:09:06 GMT
GET H/1.1	200 OK	recaptchav3.js Show response 13.66.28.137/auth/createchallenge/2f48f582a44e0683/	11 KB 13 KB	153ms 152ms	Script text/javascript	13.66.28.137 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL http://13.66.28.137/auth/createchallenge/2f48f582a44e0683/recaptchav3.js Requested by Host: 13.66.28.137 URL: http://13.66.28.137/authflow/email-recovery/?amp&amp Protocol HTTP/1.1 Server 13.66.28.137 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software nginx/1.4.6 (Ubuntu) / Resource Hash 5beb6d7a155b1ec49de89912940feab94441362fe002b9ac01524c537356b775 Security Headers Name Value Content-Security-Policy default-src 'self' https://*.paypal.com https://*.paypalobjects.com; script-src 'nonce-TcLDw47BBH7DbHVswkKkcYR5ZGrq2eKwSGdVs6bPuag2Me8C' 'self' https://*.paypal.com https://*.paypalobjects.com https://www.recaptcha.net https://www.gstatic.com 'unsafe-inline'; img-src https://*.paypalobjects.com https://*.paypal.com https://ak1s.abmr.net https://ak1.abmr.net https://ak1s.mathtag.com https://akamai.mathtag.com; object-src 'none'; media-src 'self' https://*.paypal.com https://*.paypalobjects.com; font-src 'self' https://*.paypal.com https://*.paypalobjects.com; frame-src 'self' https://*.paypal.com https://*.paypalobjects.com https://www.google.com https://www.recaptcha.net https://*.qualtrics.com; style-src 'self' 'unsafe-inline' https://*.paypal.com https://*.paypalobjects.com; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; block-all-mixed-content;; report-uri https://www.paypal.com/csplog/api/log/csp; connect-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; Strict-Transport-Security max-age=63072000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer http://13.66.28.137/authflow/email-recovery/?amp&amp User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers X-EdgeConnect-Origin-MEX-Latency 251 Content-Security-Policy default-src 'self' https://*.paypal.com https://*.paypalobjects.com; script-src 'nonce-TcLDw47BBH7DbHVswkKkcYR5ZGrq2eKwSGdVs6bPuag2Me8C' 'self' https://*.paypal.com https://*.paypalobjects.com https://www.recaptcha.net https://www.gstatic.com 'unsafe-inline'; img-src https://*.paypalobjects.com https://*.paypal.com https://ak1s.abmr.net https://ak1.abmr.net https://ak1s.mathtag.com https://akamai.mathtag.com; object-src 'none'; media-src 'self' https://*.paypal.com https://*.paypalobjects.com; font-src 'self' https://*.paypal.com https://*.paypalobjects.com; frame-src 'self' https://*.paypal.com https://*.paypalobjects.com https://www.google.com https://www.recaptcha.net https://*.qualtrics.com; style-src 'self' 'unsafe-inline' https://*.paypal.com https://*.paypalobjects.com; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; block-all-mixed-content;; report-uri https://www.paypal.com/csplog/api/log/csp; connect-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; X-Content-Type-Options nosniff Server nginx/1.4.6 (Ubuntu) X-EdgeConnect-MidMile-RTT 44 ETag W/"2b5d-4OtsMFSQ4nEv7NNaKArQswyehzo" Strict-Transport-Security max-age=63072000 Content-Type text/javascript; charset=utf-8 Paypal-Debug-Id 93b82d1ec4d2a Cache-Control max-age=0, no-cache, no-store, must-revalidate Date Wed, 24 Feb 2021 04:09:06 GMT Connection keep-alive DC ccg11-origin-www-1.paypal.com Content-Length 11101 X-Xss-Protection 1; mode=block
GET H/1.1	200 OK	ts t.paypal.com/	42 B 846 B	260ms 178ms	Image image/gif	104.108.34.200 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://t.paypal.com/ts?v=1.4.30&t=1614139746839&g=-60&pgrp=main%3Aauthflow%3Aemailrecovery%3A%3Alist&page=main%3Aauthflow%3Aemailrecovery%3A%3Alist%3Anode%3A%3A&pgst=1614139746214&calc=5e5f8e048788&nsid=xX6TO39EYWEd-tyHdMLFjT4R_VQHXl8c&rsta=en_US&pgtf=Nodejs&env=live&s=ci&ccpg=US&csci=4a888ed049f64d009158ea237d252a6b&comp=authnodeweb&tsrce=authnodeweb&cu=0&ef_policy=ccpa&xe=101021%2C101851%2C101935%2C101936%2C101960%2C102692&xt=102961%2C107586%2C107594%2C107602%2C113422%2C110228&gccd=US&inline_experience=N&tmpl=authnodeweb%2Fpublic%2Ftemplates%2Fpages%2FemailRecovery%2FForgotEmail.js&e=im&pt=PayPal&cd=24&sw=1600&sh=1200&dw=1600&dh=1200&bw=1600&bh=1200&ce=1 Requested by Host: 13.66.28.137 URL: http://13.66.28.137/authflow/email-recovery/?amp&amp Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.108.34.200 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-108-34-200.deploy.static.akamaitechnologies.com Software akka-http/10.1.11 / Resource Hash 6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93 Request headers Referer http://13.66.28.137/authflow/email-recovery/?amp&amp User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Pragma no-cache Date Wed, 24 Feb 2021 04:09:07 GMT Server akka-http/10.1.11 P3P policyref="https://t.paypal.com/w3c/p3p.xml",CP="CAO IND OUR SAM UNI STA COR COM" HTTP_X_PP_AZ_LOCATOR slca.slc Cache-Control max-age=0, no-cache, no-store Connection keep-alive Content-Type image/gif Content-Length 42 Expires Wed, 24 Feb 2021 04:09:07 GMT
GET H/1.1	200 OK	chat-meta Show response 13.66.28.137/smartchat/open/	9 KB 12 KB	279ms 278ms	XHR application/json	13.66.28.137 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL http://13.66.28.137/smartchat/open/chat-meta?app=authflow Requested by Host: www.paypalobjects.com URL: https://www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/js/app.js Protocol HTTP/1.1 Server 13.66.28.137 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software nginx/1.4.6 (Ubuntu) / Resource Hash 4716a67439895f0ddd632234a599c0f1f181917a7c133662586dc2158726d788 Security Headers Name Value Content-Security-Policy default-src 'self' https://*.paypal.com https://*.paypalobjects.com; script-src 'nonce-17iNblbI0gBo35MwKBshpb3eKbo1gzYsmyp4Ofq3UfICMPEH' 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline' ; style-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline' ; img-src 'self' https: data:; object-src 'none'; connect-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline' https://*.kampyle.com https://*.qualtrics.com; font-src 'self' https://*.paypal.com https://*.paypalobjects.com data:; base-uri 'self' https://*.paypal.com; form-action 'self' https://*.paypal.com; frame-ancestors 'self' https://help.venmo.com; block-all-mixed-content;; report-uri https://www.paypal.com/csplog/api/log/csp; frame-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; Strict-Transport-Security max-age=63072000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer http://13.66.28.137/authflow/email-recovery/?amp&amp User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 X-Requested-With XMLHttpRequest Response headers X-EdgeConnect-Origin-MEX-Latency 74 Content-Security-Policy default-src 'self' https://*.paypal.com https://*.paypalobjects.com; script-src 'nonce-17iNblbI0gBo35MwKBshpb3eKbo1gzYsmyp4Ofq3UfICMPEH' 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline' ; style-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline' ; img-src 'self' https: data:; object-src 'none'; connect-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline' https://*.kampyle.com https://*.qualtrics.com; font-src 'self' https://*.paypal.com https://*.paypalobjects.com data:; base-uri 'self' https://*.paypal.com; form-action 'self' https://*.paypal.com; frame-ancestors 'self' https://help.venmo.com; block-all-mixed-content;; report-uri https://www.paypal.com/csplog/api/log/csp; frame-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; X-Content-Type-Options nosniff Server nginx/1.4.6 (Ubuntu) X-EdgeConnect-MidMile-RTT 41 ETag W/"2487-XzHOGbIFHsBeULBvm/LzWe/wUOI" Strict-Transport-Security max-age=63072000 Content-Type application/json; charset=utf-8 Paypal-Debug-Id b541a55a8d191 Cache-Control max-age=0, no-cache, no-store, must-revalidate Date Wed, 24 Feb 2021 04:09:07 GMT Connection keep-alive DC ccg11-origin-www-1.paypal.com Content-Length 9351 X-Xss-Protection 1; mode=block
GET H/1.1	200 OK	ts t.paypal.com/	42 B 846 B	250ms 181ms	Image image/gif	104.108.34.200 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://t.paypal.com/ts?v=1.4.30&t=1614139746856&g=-60&pgrp=main%3Aprivacy%3Apolicy&page=main%3Aprivacy%3Apolicy%3Accpa&pgst=1614139746214&calc=5e5f8e048788&nsid=xX6TO39EYWEd-tyHdMLFjT4R_VQHXl8c&rsta=en_US&pgtf=Nodejs&env=live&s=ci&ccpg=US&csci=4a888ed049f64d009158ea237d252a6b&comp=authnodeweb&tsrce=authnodeweb&cu=0&ef_policy=ccpa&xe=101021%2C101851%2C101935%2C101936%2C101960%2C102692&xt=102961%2C107586%2C107594%2C107602%2C113422%2C110228&gccd=US&inline_experience=N&tmpl=authnodeweb%2Fpublic%2Ftemplates%2Fpages%2FemailRecovery%2FForgotEmail.js&displayPage=main%3Aauthflow%3Aemailrecovery%3A%3Alist&ppage=privacy_banner&bannerType=cookiebanner&flag=ccpa&bannerVersion=v3a&bannerSource=ConsentNodeServ&e=ac Requested by Host: 13.66.28.137 URL: http://13.66.28.137/authflow/email-recovery/?amp&amp Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.108.34.200 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-108-34-200.deploy.static.akamaitechnologies.com Software akka-http/10.1.11 / Resource Hash 6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93 Request headers Referer http://13.66.28.137/authflow/email-recovery/?amp&amp User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Pragma no-cache Date Wed, 24 Feb 2021 04:09:07 GMT Server akka-http/10.1.11 P3P policyref="https://t.paypal.com/w3c/p3p.xml",CP="CAO IND OUR SAM UNI STA COR COM" HTTP_X_PP_AZ_LOCATOR slca.slc Cache-Control max-age=0, no-cache, no-store Connection keep-alive Content-Type image/gif Content-Length 42 Expires Wed, 24 Feb 2021 04:09:07 GMT
GET H/1.1	200 OK	ts t.paypal.com/	42 B 846 B	242ms 178ms	Image image/gif	104.108.34.200 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://t.paypal.com/ts?v=1.4.30&t=1614139746859&g=-60&e=err&page=main%3Aauthflow%3Aemailrecovery%3A%3Alist%3Anode%3A%3A&pgrp=main%3Aauthflow%3Aemailrecovery%3A%3Alist&comp=authnodeweb&erpg=data%20is%20not%20defined&error_type=WINDOW_ONERROR&error_description=ReferenceError%3A%20data%20is%20not%20defined%0A%20%20%20%20at%20_%2Frecaptchav3.js%3A1%3A7096%0A%20%20%20%20at%20_0x224910%20(_%2Frecaptchav3.js%3A1%3A3291)%0A%20%20%20%20at%20_0x42ac8f%20(_%2Frecaptchav3.js%3A1%3A7130)%0A%20%20%20%20at%20_%2Frecaptchav3.js%3A1%3A10330%0A%20%20%20%20at%20_%2Frecaptchav3.js%3A1%3A11098&error_source=http%3A%2F%2F13.66.28.137%2Fauth%2Fcreatechallenge%2F2f48f582a44e0683%2Frecaptchav3.js%201%3A7096 Requested by Host: 13.66.28.137 URL: http://13.66.28.137/authflow/email-recovery/?amp&amp Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.108.34.200 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-108-34-200.deploy.static.akamaitechnologies.com Software akka-http/10.1.11 / Resource Hash 6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93 Request headers Referer http://13.66.28.137/authflow/email-recovery/?amp&amp User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Pragma no-cache Date Wed, 24 Feb 2021 04:09:07 GMT Server akka-http/10.1.11 P3P policyref="https://t.paypal.com/w3c/p3p.xml",CP="CAO IND OUR SAM UNI STA COR COM" HTTP_X_PP_AZ_LOCATOR slca.slc Cache-Control max-age=0, no-cache, no-store Connection keep-alive Content-Type image/gif Content-Length 42 Expires Wed, 24 Feb 2021 04:09:07 GMT
GET H2	200	messaging-bot.js Show response www.paypalobjects.com/messaging/auth/v2/	377 KB 116 KB	19ms 19ms	Script application/javascript	104.111.228.123 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://www.paypalobjects.com/messaging/auth/v2/messaging-bot.js Requested by Host: www.paypalobjects.com URL: https://www.paypalobjects.com/messaging/auth/v1/messaging-opener-mts.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.228.123 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-228-123.deploy.static.akamaitechnologies.com Software / Resource Hash b01f45a4d98c8537aaa95ba16a8a6200e32cb08339a0a88cba683e8f90b51881 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Referer http://13.66.28.137/authflow/email-recovery/?amp&amp User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 24 Feb 2021 04:09:07 GMT content-encoding gzip x-content-type-options nosniff surrogate-control max-age=31536000 paypal-debug-id 48eac8fe54fdd dc ccg11-origin-www-1.paypal.com vary Accept-Encoding content-length 117697 last-modified Wed, 04 Nov 2020 17:04:45 GMT etag W/"5fa2df2d-5e241" strict-transport-security max-age=31536000 access-control-allow-methods GET content-type application/javascript access-control-allow-origin * cache-control max-age=3600 expires Wed, 24 Feb 2021 05:09:07 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial)

29 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| trustedTypes boolean| crossOriginIsolated function| bindGdprEvents object| core object| __core-js_shared__ object| global object| System function| asap function| Observable function| setImmediate function| clearImmediate object| regeneratorRuntime boolean| _babelPolyfill object| IntlPolyfill object| PDFJS object| PAYPAL object| fpti string| fptiserverurl object| dataLayer object| _ifpti function| openChatUtils function| hideGdprBanner function| showGdprBanner object| _0x29bc function| _0x1c61 object| mtsChat

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	default-src 'self' https://*.paypal.com https://*.paypalobjects.com; script-src 'nonce-VEUehFLFN2bUd5taB+021nOsXnPscagZSsxWHWa0pKkdaqtx' 'self' 'unsafe-inline' 'unsafe-eval' https://*.paypal.com https://*.paypalobjects.com; img-src 'self' data: https:; object-src 'none'; media-src data: blob: 'self' https://*.paypal.com https://*.paypalobjects.com; font-src 'self' https://*.paypal.com https://*.paypalobjects.com; style-src 'self' 'unsafe-inline' https://*.paypal.com https://*.paypalobjects.com; frame-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; child-src 'self' https://*.paypal.com https://*.paypalobjects.com; connect-src 'self' https://*.paypal.com https://*.paypalobjects.com https://nexus.ensighten.com https://*.google-analytics.com https://*.qualtrics.com; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; block-all-mixed-content;; report-uri https://www.paypal.com/csplog/api/log/csp
Strict-Transport-Security	max-age=63072000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

t.paypal.com
www.paypalobjects.com
104.108.34.200
104.111.228.123
13.66.28.137
0eb22afbab03bbbd8a47d4fc5361ff7518a77273e99fd0b73e235c93dd6ea7aa
4716a67439895f0ddd632234a599c0f1f181917a7c133662586dc2158726d788
5beb6d7a155b1ec49de89912940feab94441362fe002b9ac01524c537356b775
6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93
843e67ad522a908162007f4b7601819a5bbfef00e38ac7aec778766da8b7b2ab
ae79dcc3eb016922caa1d095cfd936446bc65a46bb3364b242dfc556f7e3c6a8
b01f45a4d98c8537aaa95ba16a8a6200e32cb08339a0a88cba683e8f90b51881
bbe3177aa5d225f117aea0e2eeb27f11d853a33d6d162733c5be8b1de8d36dc5
bcdf050ce6625609e7a3e64f52f1650e7a79abc12a9c7e712fe2b9cfd808e977
be5c4f71eea822cbdcaefcf92963ab573e903f75a60b8bc0793e4eec935a1187
c599c554590d1a336ffcb9627f6caaac34b6228f60e15f5f25454bff38facb7e
c760ad5e326e1a1a5d74727707490df96cca2c8d3a3f08e4bf04851d41f382f5
da775dd10f868447dea4c3522fb3b55bd4a5df650d3f2233a76d31bb711f6c2a
e00ab4867c277813a14fbbc89e0b52b2a96060287669cdd6262f539614b97fcb
f39646ccd4fbf32d475bed59e8c5a1f18208da3d23783672d095273e4e91a7dc