13.66.28.137 Open in urlscan Pro
13.66.28.137 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://13.66.28.137/authflow/password-recovery/
Submission Tags: phishing malicious Search All
Submission: On February 22 via api (February 22nd 2021, 11:11:54 pm UTC) from US

Summary HTTP 25 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 7 IPs in 2 countries across 2 domains to perform 25 HTTP transactions. The main IP is 13.66.28.137, located in San Antonio, United States and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is 13.66.28.137.

This is the only time 13.66.28.137 was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: PayPal (Financial)

Domain & IP information

	IP Address	AS Autonomous System
3	13.66.28.137 13.66.28.137	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
11	184.25.114.184 184.25.114.184	16625 (AKAMAI-AS) (AKAMAI-AS)
5	23.79.145.158 23.79.145.158	16625 (AKAMAI-AS) (AKAMAI-AS)
1 2	64.4.245.84 64.4.245.84	17012 (PAYPAL) (PAYPAL)
3	151.101.1.35 151.101.1.35	54113 (FASTLY) (FASTLY)
1	2a04:4e42:200... 2a04:4e42:200::291	54113 (FASTLY) (FASTLY)
25	7

3 13.66.28.137 (San Antonio, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

13.66.28.137	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 184.25.114.184 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a184-25-114-184.deploy.static.akamaitechnologies.com

www.paypalobjects.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 23.79.145.158 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-79-145-158.deploy.static.akamaitechnologies.com

c.paypal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 64.4.245.84 (United States) 1 redirects

ASN17012 (PAYPAL, US)

b.stats.paypal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
dub.stats.paypal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 151.101.1.35 (United States)

ASN54113 (FASTLY, US)

t.paypal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:200::291 (United States)

ASN54113 (FASTLY, US)

c6.paypal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	paypal.com 1 redirects c.paypal.com b.stats.paypal.com dub.stats.paypal.com t.paypal.com c6.paypal.com	48 KB
11	paypalobjects.com www.paypalobjects.com	1 MB
25	2

	Domain	Requested by
11	www.paypalobjects.com	13.66.28.137 www.paypalobjects.com
5	c.paypal.com	13.66.28.137 c.paypal.com
3	t.paypal.com	13.66.28.137
1	c6.paypal.com	13.66.28.137
1	dub.stats.paypal.com	13.66.28.137
1	b.stats.paypal.com	1 redirects
25	6

This site contains links to these domains. Also see Links.

Domain
www.paypal.com

Subject Issuer	Validity	Valid
www.paypal.com DigiCert SHA2 Extended Validation Server CA	`2021-01-13` - `2022-01-11`	a year	crt.sh
c.paypal.com DigiCert SHA2 Extended Validation Server CA	`2020-01-09` - `2022-01-13`	2 years	crt.sh
b.stats.paypal.com DigiCert SHA2 High Assurance Server CA	`2020-03-13` - `2022-06-03`	2 years	crt.sh
t.paypal.com DigiCert SHA2 Extended Validation Server CA	`2020-11-17` - `2021-11-21`	a year	crt.sh

This page contains 3 frames:

Primary Page: http://13.66.28.137/authflow/password-recovery/
Frame ID: 63D5547A31A33BC03C4F731B085DF925
Requests: 18 HTTP requests in this frame

Frame: https://c.paypal.com/v1/r/d/i?js_src=https://c.paypal.com/da/r/fb.js
Frame ID: 819AAB5E31819E634FF2157FF0BB5855
Requests: 5 HTTP requests in this frame

Frame: https://dub.stats.paypal.com/v2/counter2.cgi?p=4c67ad72d336458796aa09d7af712112&s=ANW
Frame ID: 53384BCC612399E755867C828749CE2A
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Ubuntu (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Ubuntu/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

25
Requests

84 %
HTTPS

17 %
IPv6

2
Domains

6
Subdomains

7
IPs

2
Countries

1119 kB
Transfer

3532 kB
Size

4
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://www.paypal.com/
Title: Return to PayPal login

Search URL Search Domain Scan URL

URL: https://www.paypal.com/myaccount/profile/flow/cookies/?locale=en_US
Title: Learn more and manage your cookies

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 13

https://b.stats.paypal.com/v2/counter.cgi?p=4c67ad72d336458796aa09d7af712112&s=ANW HTTP 302
https://dub.stats.paypal.com/v2/counter2.cgi?p=4c67ad72d336458796aa09d7af712112&s=ANW

25 HTTP transactions
-1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request Cookie set / Show response
13.66.28.137/authflow/password-recovery/ 59 KB
20 KB 614ms
596ms Document
text/html 13.66.28.137
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

http://13.66.28.137/authflow/password-recovery/

Protocol

HTTP/1.1

Server

13.66.28.137 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

nginx/1.4.6 (Ubuntu) /

Resource Hash

9e889ce073067608502d57f157952a14ce64b3e5ea177d621a0c713a665d55e1

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://.paypal.com https://.paypalobjects.com; script-src 'nonce-IQrmSszvvm6cPxTd9Ee7t2EMiYYPKjqbkqePaNSa8QvT0Y5z' 'self' 'unsafe-inline' 'unsafe-eval' https://.paypal.com https://.paypalobjects.com; img-src 'self' data: https:; object-src 'none'; media-src data: blob: 'self' https://.paypal.com https://.paypalobjects.com; font-src 'self' https://.paypal.com https://.paypalobjects.com; style-src 'self' 'unsafe-inline' https://.paypal.com https://.paypalobjects.com; frame-src 'self' https://.paypal.com https://.paypalobjects.com https://.qualtrics.com; child-src 'self' https://.paypal.com https://.paypalobjects.com; connect-src 'self' https://.paypal.com https://.paypalobjects.com https://nexus.ensighten.com https://.google-analytics.com https://.qualtrics.com; form-action 'self' https://.paypal.com; base-uri 'self' https://*.paypal.com; block-all-mixed-content;; report-uri https://www.paypal.com/csplog/api/log/csp
Strict-Transport-Security	max-age=63072000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Host: 13.66.28.137
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Server: nginx/1.4.6 (Ubuntu)
Date: Mon, 22 Feb 2021 23:11:37 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 16983
Connection: keep-alive
Cache-Control: max-age=0, no-cache, no-store, must-revalidate
Content-Security-Policy: default-src 'self' https://*.paypal.com https://*.paypalobjects.com; script-src 'nonce-IQrmSszvvm6cPxTd9Ee7t2EMiYYPKjqbkqePaNSa8QvT0Y5z' 'self' 'unsafe-inline' 'unsafe-eval' https://*.paypal.com https://*.paypalobjects.com; img-src 'self' data: https:; object-src 'none'; media-src data: blob: 'self' https://*.paypal.com https://*.paypalobjects.com; font-src 'self' https://*.paypal.com https://*.paypalobjects.com; style-src 'self' 'unsafe-inline' https://*.paypal.com https://*.paypalobjects.com; frame-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; child-src 'self' https://*.paypal.com https://*.paypalobjects.com; connect-src 'self' https://*.paypal.com https://*.paypalobjects.com https://nexus.ensighten.com https://*.google-analytics.com https://*.qualtrics.com; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; block-all-mixed-content;; report-uri https://www.paypal.com/csplog/api/log/csp
ETag: W/"eada-d4P1VF9N0A34Fw/xpn3mukHazAw"
Paypal-Debug-Id: ea71751afac32
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-Xss-Protection: 1; mode=block
DC: ccg11-origin-www-1.paypal.com
X-EdgeConnect-MidMile-RTT: 40
X-EdgeConnect-Origin-MEX-Latency: 215
Vary: Accept-Encoding
Content-Encoding: gzip
Set-Cookie: enforce_policy=ccpa; Max-Age=31536000; Domain=.paypal.com; Path=/; Expires=Tue, 22 Feb 2022 23:11:37 GMT; Secure; SameSite=None LANG=en_US%3BUS; Max-Age=31556; Domain=.paypal.com; Path=/; Expires=Tue, 23 Feb 2021 07:57:33 GMT; HttpOnly; Secure; SameSite=None tsrce=authnodeweb; Max-Age=259199; Domain=.paypal.com; Path=/; Expires=Thu, 25 Feb 2021 23:11:36 GMT; HttpOnly; Secure; SameSite=None fn_dt=4c67ad72d336458796aa09d7af712112; Domain=.paypal.com; Path=/; HttpOnly; Secure; SameSite=None x-pp-s=eyJ0IjoiMTYxNDAzNTQ5NzU4OSIsImwiOiIwIiwibSI6IjAifQ; Domain=.paypal.com; Path=/; HttpOnly; Secure; SameSite=None nsid=s%3AkMMCWRJ9F-UwaoQfHkSN-EtcVVTf73B4.IhEYD43043Gm4lyN5gkTfcS7bmwuYwwr6JfBFp3DJno; Path=/; HttpOnly; Secure; SameSite=None l7_az=dcg02.phx; Path=/; Domain=paypal.com; Expires=Mon, 22 Feb 2021 23:41:37 GMT; HttpOnly; Secure; SameSite=None ts=vreXpYrS%3D1708643497%26vteXpYrS%3D1614037297%26vr%3Dcc0331c41770ad005c69255efbe044b4%26vt%3Dcc0331c41770ad005c69255efbe044b3%26vtyp%3Dnew; Path=/; Domain=paypal.com; Expires=Thu, 22 Feb 2024 23:11:37 GMT; HttpOnly; Secure; SameSite=None ts_c=vr%3Dcc0331c41770ad005c69255efbe044b4%26vt%3Dcc0331c41770ad005c69255efbe044b3; Path=/; Domain=paypal.com; Expires=Thu, 22 Feb 2024 23:11:37 GMT; Secure; SameSite=None x-cdn=akamai; path=/; domain=.paypal.com; secure akavpau_ppsd=1614036097~id=3d471d0d2fbb19e3e0c8dda14a5c02d8; Domain=www.paypal.com; Path=/; HttpOnly; Secure; SameSite=None
Strict-Transport-Security: max-age=63072000

GET
H2 200 app.css
www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/css/ 134 KB
20 KB 114ms
27ms Stylesheet
text/css 184.25.114.184
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/css/app.css

Requested by

Host: 13.66.28.137
URL: http://13.66.28.137/authflow/password-recovery/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.25.114.184 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a184-25-114-184.deploy.static.akamaitechnologies.com

Software

Resource Hash

e00ab4867c277813a14fbbc89e0b52b2a96060287669cdd6262f539614b97fcb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: http://13.66.28.137/authflow/password-recovery/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 22 Feb 2021 23:11:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
surrogate-control: max-age=31536000
paypal-debug-id: 77a340fb4bae
dc: ccg11-origin-www-1.paypal.com
vary: Accept-Encoding
content-length: 19786
last-modified: Thu, 11 Feb 2021 00:43:48 GMT
etag: W/"60247dc4-2188e"
strict-transport-security: max-age=31536000
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
expires: Tue, 22 Feb 2022 23:11:37 GMT

GET
H2 200 app.js Show response
www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/js/ 3 MB
726 KB 133ms
46ms Script
application/javascript 184.25.114.184
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/js/app.js

Requested by

Host: 13.66.28.137
URL: http://13.66.28.137/authflow/password-recovery/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.25.114.184 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a184-25-114-184.deploy.static.akamaitechnologies.com

Software

Resource Hash

f39646ccd4fbf32d475bed59e8c5a1f18208da3d23783672d095273e4e91a7dc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: http://13.66.28.137/authflow/password-recovery/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 22 Feb 2021 23:11:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
surrogate-control: max-age=31536000
paypal-debug-id: 7365bc2b8fe33
dc: ccg11-origin-www-3.paypal.com
vary: Accept-Encoding
content-length: 741072
last-modified: Thu, 11 Feb 2021 00:43:48 GMT
etag: W/"60247dc4-28f32c"
strict-transport-security: max-age=31536000
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-headers: x-csrf-token
expires: Tue, 22 Feb 2022 23:11:37 GMT

GET
H2 200 pa.js Show response
www.paypalobjects.com/pa/js/ 52 KB
20 KB 148ms
61ms Script
application/javascript 184.25.114.184
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/pa/js/pa.js

Requested by

Host: 13.66.28.137
URL: http://13.66.28.137/authflow/password-recovery/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.25.114.184 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a184-25-114-184.deploy.static.akamaitechnologies.com

Software

Resource Hash

0eb22afbab03bbbd8a47d4fc5361ff7518a77273e99fd0b73e235c93dd6ea7aa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: http://13.66.28.137/authflow/password-recovery/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 22 Feb 2021 23:11:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
surrogate-control: max-age=31536000
paypal-debug-id: 74fa405ca849f
dc: slc-b-origin-www-2.paypal.com
vary: Accept-Encoding
content-length: 20130
last-modified: Thu, 18 Feb 2021 06:57:36 GMT
etag: W/"602e0fe0-cfcb"
strict-transport-security: max-age=31536000
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=3600
access-control-allow-headers: x-csrf-token
expires: Tue, 23 Feb 2021 00:11:37 GMT

GET
H2 200 bs.js Show response
www.paypalobjects.com/tagmgmt/ 19 B
374 B 150ms
64ms Script
application/javascript 184.25.114.184
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/tagmgmt/bs.js

Requested by

Host: 13.66.28.137
URL: http://13.66.28.137/authflow/password-recovery/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.25.114.184 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a184-25-114-184.deploy.static.akamaitechnologies.com

Software

Resource Hash

be5c4f71eea822cbdcaefcf92963ab573e903f75a60b8bc0793e4eec935a1187

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: http://13.66.28.137/authflow/password-recovery/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 22 Feb 2021 23:11:37 GMT
x-content-type-options: nosniff
surrogate-control: max-age=31536000
paypal-debug-id: beed56fe117b4
dc: ccg11-origin-www-3.paypal.com
vary: Accept-Encoding
content-length: 19
last-modified: Thu, 01 Oct 2020 22:15:27 GMT
etag: "5f7654ff-13"
strict-transport-security: max-age=31536000
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
accept-ranges: bytes
access-control-allow-headers: x-csrf-token
expires: Tue, 23 Feb 2021 00:11:37 GMT

GET
H2 200 messaging-opener-mts.js Show response
www.paypalobjects.com/messaging/auth/v1/ 3 KB
1 KB 155ms
70ms Script
application/javascript 184.25.114.184
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/messaging/auth/v1/messaging-opener-mts.js

Requested by

Host: 13.66.28.137
URL: http://13.66.28.137/authflow/password-recovery/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.25.114.184 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a184-25-114-184.deploy.static.akamaitechnologies.com

Software

Resource Hash

bcdf050ce6625609e7a3e64f52f1650e7a79abc12a9c7e712fe2b9cfd808e977

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: http://13.66.28.137/authflow/password-recovery/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 22 Feb 2021 23:11:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
surrogate-control: max-age=31536000
paypal-debug-id: b67d6edeb53a5
dc: slc-b-origin-www-3.paypal.com
vary: Accept-Encoding
content-length: 1081
last-modified: Thu, 01 Oct 2020 22:15:16 GMT
etag: W/"5f7654f4-b7b"
strict-transport-security: max-age=31536000
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
expires: Tue, 23 Feb 2021 00:11:37 GMT

GET
H/1.1 200
OK fb.js Show response
c.paypal.com/da/r/ 61 KB
21 KB 171ms
51ms Script
application/x-javascript 23.79.145.158
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://c.paypal.com/da/r/fb.js
Requested by: Host: 13.66.28.137
URL: http://13.66.28.137/authflow/password-recovery/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.79.145.158 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-79-145-158.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: a57d9156941c9e6a2f3b46623b169a11638bc604a2f9b45aa8a656ea02f09209

Request headers

Referer: http://13.66.28.137/authflow/password-recovery/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 22 Feb 2021 23:11:37 GMT
X-Pad: avoid browser bug
Vary: Accept-Encoding
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 21347
Last-Modified: Tue, 26 Jan 2021 03:41:11 GMT
Server: Apache
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=86400
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Expires: Tue, 23 Feb 2021 23:11:37 GMT

GET
H/1.1 200
OK recaptchav3.js Show response
13.66.28.137/auth/createchallenge/357d727e1f5648fe/ 11 KB
13 KB 170ms
169ms Script
text/javascript 13.66.28.137
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

http://13.66.28.137/auth/createchallenge/357d727e1f5648fe/recaptchav3.js

Requested by

Host: 13.66.28.137
URL: http://13.66.28.137/authflow/password-recovery/

Protocol

HTTP/1.1

Server

13.66.28.137 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

nginx/1.4.6 (Ubuntu) /

Resource Hash

4ac1848d518483d2f031da28c09fde8e2313b42d3628273247e4a9008eb56b47

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://.paypal.com https://.paypalobjects.com; script-src 'nonce-HJVRAMDbA87HgPoe6u6j7B6nLKK19cxdc9bWqMaVntuEBDSo' 'self' https://.paypal.com https://.paypalobjects.com https://www.recaptcha.net https://www.gstatic.com 'unsafe-inline'; img-src https://.paypalobjects.com https://.paypal.com https://ak1s.abmr.net https://ak1.abmr.net https://ak1s.mathtag.com https://akamai.mathtag.com; object-src 'none'; media-src 'self' https://.paypal.com https://.paypalobjects.com; font-src 'self' https://.paypal.com https://.paypalobjects.com; frame-src 'self' https://.paypal.com https://.paypalobjects.com https://www.google.com https://www.recaptcha.net https://.qualtrics.com; style-src 'self' 'unsafe-inline' https://.paypal.com https://.paypalobjects.com; form-action 'self' https://.paypal.com; base-uri 'self' https://.paypal.com; block-all-mixed-content;; report-uri https://www.paypal.com/csplog/api/log/csp; connect-src 'self' https://.paypal.com https://.paypalobjects.com https://.qualtrics.com;
Strict-Transport-Security	max-age=63072000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://13.66.28.137/authflow/password-recovery/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-EdgeConnect-Origin-MEX-Latency: 200
Content-Security-Policy: default-src 'self' https://*.paypal.com https://*.paypalobjects.com; script-src 'nonce-HJVRAMDbA87HgPoe6u6j7B6nLKK19cxdc9bWqMaVntuEBDSo' 'self' https://*.paypal.com https://*.paypalobjects.com https://www.recaptcha.net https://www.gstatic.com 'unsafe-inline'; img-src https://*.paypalobjects.com https://*.paypal.com https://ak1s.abmr.net https://ak1.abmr.net https://ak1s.mathtag.com https://akamai.mathtag.com; object-src 'none'; media-src 'self' https://*.paypal.com https://*.paypalobjects.com; font-src 'self' https://*.paypal.com https://*.paypalobjects.com; frame-src 'self' https://*.paypal.com https://*.paypalobjects.com https://www.google.com https://www.recaptcha.net https://*.qualtrics.com; style-src 'self' 'unsafe-inline' https://*.paypal.com https://*.paypalobjects.com; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; block-all-mixed-content;; report-uri https://www.paypal.com/csplog/api/log/csp; connect-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com;
X-Content-Type-Options: nosniff
Server: nginx/1.4.6 (Ubuntu)
X-EdgeConnect-MidMile-RTT: 38
ETag: W/"2b3b-X1sw96Smn96/nl50RjPk/WN/fqU"
Strict-Transport-Security: max-age=63072000
Content-Type: text/javascript; charset=utf-8
Paypal-Debug-Id: 5b16561edcd65
Cache-Control: max-age=0, no-cache, no-store, must-revalidate
Date: Mon, 22 Feb 2021 23:11:37 GMT
Connection: keep-alive
DC: ccg11-origin-www-1.paypal.com
Content-Length: 11067
X-Xss-Protection: 1; mode=block

GET
H2 200 monogram@2x.png
www.paypalobjects.com/images/shared/ 1 KB
2 KB 71ms
70ms Image
image/png 184.25.114.184
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.paypalobjects.com/images/shared/monogram@2x.png

Requested by

Host: www.paypalobjects.com
URL: https://www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/css/app.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.25.114.184 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a184-25-114-184.deploy.static.akamaitechnologies.com

Software

Akamai Image Manager /

Resource Hash

bbe3177aa5d225f117aea0e2eeb27f11d853a33d6d162733c5be8b1de8d36dc5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/css/app.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 22 Feb 2021 23:11:37 GMT
x-content-type-options: nosniff
last-modified: Wed, 06 Jan 2021 02:00:50 GMT
server: Akamai Image Manager
etag: "tu4IksQhsaBV1ddsYvtwjxUD2qmVV7SZmLo7q4XSXU0"
strict-transport-security: max-age=31536000
content-type: image/png
cache-control: private, no-transform, max-age=43200
content-length: 1507
expires: Tue, 23 Feb 2021 11:11:37 GMT

GET
H2 200 PayPalSansSmall-Regular.woff
www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/ 46 KB
47 KB 83ms
27ms Font
font/woff 184.25.114.184
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/PayPalSansSmall-Regular.woff

Requested by

Host: www.paypalobjects.com
URL: https://www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/css/app.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.25.114.184 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a184-25-114-184.deploy.static.akamaitechnologies.com

Software

Resource Hash

ae79dcc3eb016922caa1d095cfd936446bc65a46bb3364b242dfc556f7e3c6a8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Origin: http://13.66.28.137
Referer: https://www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/css/app.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 22 Feb 2021 23:11:37 GMT
x-content-type-options: nosniff
last-modified: Wed, 30 Sep 2015 05:09:04 GMT
cache-control: max-age=3600
etag: "560b6e70-b8eb"
vary: Accept-Encoding
content-type: font/woff
access-control-allow-origin: *
paypal-debug-id: ff23e7beab590
strict-transport-security: max-age=31536000
accept-ranges: bytes
dc: phx-origin-www-2.paypal.com
content-length: 47339
expires: Tue, 23 Feb 2021 00:11:37 GMT

GET
H2 200 animation-oval.png
www.paypalobjects.com/images/shared/ 2 KB
3 KB 62ms
61ms Image
image/webp 184.25.114.184
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.paypalobjects.com/images/shared/animation-oval.png

Requested by

Host: www.paypalobjects.com
URL: https://www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/css/app.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.25.114.184 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a184-25-114-184.deploy.static.akamaitechnologies.com

Software

Akamai Image Manager /

Resource Hash

da775dd10f868447dea4c3522fb3b55bd4a5df650d3f2233a76d31bb711f6c2a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/css/app.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 22 Feb 2021 23:11:37 GMT
x-content-type-options: nosniff
x-check-cacheable: YES
x-serial: 556
etag: "dhhY3utDsCxd+2sX5XmaH0WADbsU4TzWhkD7AThom/c"
strict-transport-security: max-age=31536000
content-type: image/webp
cache-control: private, no-transform, max-age=43200
last-modified: Tue, 02 Feb 2021 02:00:03 GMT
content-length: 2448
server: Akamai Image Manager
expires: Tue, 23 Feb 2021 11:11:37 GMT

GET
H2 200 PayPalSansBig-Light.woff
www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/ 48 KB
48 KB 106ms
56ms Font
application/x-font-woff 184.25.114.184
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/PayPalSansBig-Light.woff

Requested by

Host: www.paypalobjects.com
URL: https://www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/css/app.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.25.114.184 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a184-25-114-184.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

c599c554590d1a336ffcb9627f6caaac34b6228f60e15f5f25454bff38facb7e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Origin: http://13.66.28.137
Referer: https://www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/css/app.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 22 Feb 2021 23:11:37 GMT
x-pad: avoid browser bug
x-content-type-options: nosniff
last-modified: Wed, 30 Sep 2015 05:09:04 GMT
server: Apache
vary: Accept-Encoding
content-type: application/x-font-woff
access-control-allow-origin: *
cache-control: max-age=3600
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 49115
expires: Tue, 23 Feb 2021 00:11:37 GMT

GET
H2 200 PayPalSansSmall-Light.woff
www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/ 46 KB
46 KB 114ms
65ms Font
application/x-font-woff 184.25.114.184
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/PayPalSansSmall-Light.woff

Requested by

Host: www.paypalobjects.com
URL: https://www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/css/app.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.25.114.184 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a184-25-114-184.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

843e67ad522a908162007f4b7601819a5bbfef00e38ac7aec778766da8b7b2ab

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Origin: http://13.66.28.137
Referer: https://www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/css/app.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 22 Feb 2021 23:11:37 GMT
x-pad: avoid browser bug
x-content-type-options: nosniff
last-modified: Wed, 30 Sep 2015 05:09:04 GMT
server: Apache
vary: Accept-Encoding
content-type: application/x-font-woff
access-control-allow-origin: *
cache-control: max-age=3600
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 46703
expires: Tue, 23 Feb 2021 00:11:37 GMT

GET
H/1.1 200
OK i Show response
c.paypal.com/v1/r/d/ Frame 819A 160 B
1 KB 222ms
222ms Document
text/html 23.79.145.158
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://c.paypal.com/v1/r/d/i?js_src=https://c.paypal.com/da/r/fb.js

Requested by

Host: c.paypal.com
URL: https://c.paypal.com/da/r/fb.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.79.145.158 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-79-145-158.deploy.static.akamaitechnologies.com

Software

Resource Hash

9321bc63a75b3ac6d384b411665b6e77a8b326a4b176ca2049872d3b5d4974f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Host: c.paypal.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: http://13.66.28.137/authflow/password-recovery/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: http://13.66.28.137/authflow/password-recovery/

Response headers

CORRELATION-ID: 1fb4ffb7bc145
Cache-Control: max-age=0, no-cache, no-store, must-revalidate
Content-Length: 160
Content-Security-Policy-Report-Only: default-src 'self' https://*.paypal.com https://*.paypalobjects.com; script-src 'self' https://*.paypal.com https://*.paypalobjects.com https://www.facebook.com 'unsafe-eval' 'unsafe-inline' blob:; connect-src 'self' https://*.paypal.com; style-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; font-src 'self' https://*.paypal.com https://*.paypalobjects.com data:; img-src 'self' https: data:; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; object-src 'self' https://*.paypal.com https://*.paypalobjects.com; report-uri https://www.paypal.com/csplog/api/log/csp
Content-Type: text/html;charset=UTF-8
Paypal-Debug-Id: 1fb4ffb7bc145
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
Date: Mon, 22 Feb 2021 23:11:38 GMT
Connection: keep-alive

GET
H/1.1

200
OK

counter2.cgi
dub.stats.paypal.com/v2/ Frame 5338
Redirect Chain

https://b.stats.paypal.com/v2/counter.cgi?p=4c67ad72d336458796aa09d7af712112&s=ANW
https://dub.stats.paypal.com/v2/counter2.cgi?p=4c67ad72d336458796aa09d7af712112&s=ANW

42 B
299 B

142ms
47ms

Image
image/jpeg

64.4.245.84
PAYPAL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dub.stats.paypal.com/v2/counter2.cgi?p=4c67ad72d336458796aa09d7af712112&s=ANW
Requested by: Host: 13.66.28.137
URL: http://13.66.28.137/authflow/password-recovery/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 64.4.245.84 , United States, ASN17012 (PAYPAL, US),
Reverse DNS
Software: PayPal-B.Stats/1.0 /
Resource Hash: 47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292

Request headers

Referer: http://13.66.28.137/authflow/password-recovery/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 22 Feb 2021 23:11:38 GMT
Server: PayPal-B.Stats/1.0
Connection: close
Content-Length: 42
Content-Type: image/jpeg

Redirect headers

Location: https://dub.stats.paypal.com/v2/counter2.cgi?p=4c67ad72d336458796aa09d7af712112&s=ANW
Date: Mon, 22 Feb 2021 23:11:38 GMT
Server: PayPal-B.Stats/1.0
Connection: close
Content-Length: 0
Content-Type: application/octet-stream

GET
H2 200 ts
t.paypal.com/ 42 B
673 B 230ms
178ms Image
image/gif 151.101.1.35
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://t.paypal.com/ts?v=1.4.30&t=1614035498251&g=-60&pgrp=main%3Aauthflow%3Apassword_recovery%3A%3Aforgot_password&page=main%3Aauthflow%3Apassword_recovery%3A%3Aforgot_password%3Anode%3A%3A&pgst=1614035497467&calc=ea71751afac32&nsid=kMMCWRJ9F-UwaoQfHkSN-EtcVVTf73B4&rsta=en_US&pgtf=Nodejs&env=live&s=ci&ccpg=US&csci=7044e4afbedd46718719a36e2b84b941&comp=authnodeweb&tsrce=authnodeweb&cu=0&ef_policy=ccpa&xe=101021%2C101851%2C101935%2C101936%2C101960%2C102692&xt=102961%2C107586%2C107594%2C107602%2C113422%2C110228&gccd=US&inline_experience=N&sub_comp=password_recovery&tmpl=authnodeweb%2Fpublic%2Ftemplates%2Fpages%2FpasswordRecovery%2FForgotPassword.js&e=im&pt=PayPal&cd=24&sw=1600&sh=1200&dw=1600&dh=1200&bw=1600&bh=1200&ce=1
Requested by: Host: 13.66.28.137
URL: http://13.66.28.137/authflow/password-recovery/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.1.35 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: akka-http/10.1.11 /
Resource Hash: 6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93

Request headers

Referer: http://13.66.28.137/authflow/password-recovery/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 22 Feb 2021 23:11:38 GMT
via: 1.1 varnish
server: akka-http/10.1.11
x-timer: S1614035498.326334,VS0,VE148
x-cache: MISS
p3p: policyref="https://t.paypal.com/w3c/p3p.xml",CP="CAO IND OUR SAM UNI STA COR COM"
http_x_pp_az_locator: slcb.slc
expires: Mon, 22 Feb 2021 23:11:38 GMT
cache-control: no-cache, no-store, max-age=0, no-transform
x-cache-hits: 0
accept-ranges: bytes
content-type: image/gif
content-length: 42
x-served-by: cache-hhn4028-HHN

GET
H/1.1 200
OK chat-meta Show response
13.66.28.137/smartchat/open/ 9 KB
12 KB 351ms
351ms XHR
application/json 13.66.28.137
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

http://13.66.28.137/smartchat/open/chat-meta?app=authflow

Requested by

Host: www.paypalobjects.com
URL: https://www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/js/app.js

Protocol

HTTP/1.1

Server

13.66.28.137 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

nginx/1.4.6 (Ubuntu) /

Resource Hash

42f2dee59f50b3060dd0e17d23d2959b6c73b782e53be70bca5f9e6a13fc85da

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://.paypal.com https://.paypalobjects.com; script-src 'nonce-Sf7JWpedMVliC0jDf+Hiwa4CiIvfjxl6vY3g/PcKD68pgdNR' 'self' https://.paypal.com https://.paypalobjects.com 'unsafe-inline' ; style-src 'self' https://.paypal.com https://.paypalobjects.com 'unsafe-inline' ; img-src 'self' https: data:; object-src 'none'; connect-src 'self' https://.paypal.com https://.paypalobjects.com 'unsafe-inline' https://.kampyle.com https://.qualtrics.com; font-src 'self' https://.paypal.com https://.paypalobjects.com data:; base-uri 'self' https://.paypal.com; form-action 'self' https://.paypal.com; frame-ancestors 'self' https://help.venmo.com; block-all-mixed-content;; report-uri https://www.paypal.com/csplog/api/log/csp; frame-src 'self' https://.paypal.com https://.paypalobjects.com https://*.qualtrics.com;
Strict-Transport-Security	max-age=63072000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://13.66.28.137/authflow/password-recovery/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
X-Requested-With: XMLHttpRequest

Response headers

X-EdgeConnect-Origin-MEX-Latency: 116
Content-Security-Policy: default-src 'self' https://*.paypal.com https://*.paypalobjects.com; script-src 'nonce-Sf7JWpedMVliC0jDf+Hiwa4CiIvfjxl6vY3g/PcKD68pgdNR' 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline' ; style-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline' ; img-src 'self' https: data:; object-src 'none'; connect-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline' https://*.kampyle.com https://*.qualtrics.com; font-src 'self' https://*.paypal.com https://*.paypalobjects.com data:; base-uri 'self' https://*.paypal.com; form-action 'self' https://*.paypal.com; frame-ancestors 'self' https://help.venmo.com; block-all-mixed-content;; report-uri https://www.paypal.com/csplog/api/log/csp; frame-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com;
X-Content-Type-Options: nosniff
Server: nginx/1.4.6 (Ubuntu)
X-EdgeConnect-MidMile-RTT: 45
ETag: W/"248b-1hdztFAU/2Rfnh68NuS/gJYSQ0s"
Strict-Transport-Security: max-age=63072000
Content-Type: application/json; charset=utf-8
Paypal-Debug-Id: 6efcd7a93a7d9
Cache-Control: max-age=0, no-cache, no-store, must-revalidate
Date: Mon, 22 Feb 2021 23:11:38 GMT
Connection: keep-alive
DC: ccg11-origin-www-1.paypal.com
Content-Length: 9355
X-Xss-Protection: 1; mode=block

GET
H2 200 ts
t.paypal.com/ 42 B
403 B 177ms
177ms Image
image/gif 151.101.1.35
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://t.paypal.com/ts?v=1.4.30&t=1614035498316&g=-60&pgrp=main%3Aprivacy%3Apolicy&page=main%3Aprivacy%3Apolicy%3Accpa&pgst=1614035497467&calc=ea71751afac32&nsid=kMMCWRJ9F-UwaoQfHkSN-EtcVVTf73B4&rsta=en_US&pgtf=Nodejs&env=live&s=ci&ccpg=US&csci=7044e4afbedd46718719a36e2b84b941&comp=authnodeweb&tsrce=authnodeweb&cu=0&ef_policy=ccpa&xe=101021%2C101851%2C101935%2C101936%2C101960%2C102692&xt=102961%2C107586%2C107594%2C107602%2C113422%2C110228&gccd=US&inline_experience=N&sub_comp=password_recovery&tmpl=authnodeweb%2Fpublic%2Ftemplates%2Fpages%2FpasswordRecovery%2FForgotPassword.js&displayPage=main%3Aauthflow%3Apassword_recovery%3A%3Aforgot_password&ppage=privacy_banner&bannerType=cookiebanner&flag=ccpa&bannerVersion=v3a&bannerSource=ConsentNodeServ&e=ac
Requested by: Host: 13.66.28.137
URL: http://13.66.28.137/authflow/password-recovery/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.1.35 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: akka-http/10.1.11 /
Resource Hash: 6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93

Request headers

Referer: http://13.66.28.137/authflow/password-recovery/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 22 Feb 2021 23:11:38 GMT
via: 1.1 varnish
server: akka-http/10.1.11
x-timer: S1614035498.332415,VS0,VE149
x-cache: MISS
p3p: policyref="https://t.paypal.com/w3c/p3p.xml",CP="CAO IND OUR SAM UNI STA COR COM"
http_x_pp_az_locator: slcb.slc
expires: Mon, 22 Feb 2021 23:11:38 GMT
cache-control: no-cache, no-store, max-age=0, no-transform
x-cache-hits: 0
accept-ranges: bytes
content-type: image/gif
content-length: 42
x-served-by: cache-hhn4028-HHN

GET
H2 200 ts
t.paypal.com/ 42 B
411 B 171ms
171ms Image
image/gif 151.101.1.35
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://t.paypal.com/ts?v=1.4.30&t=1614035498324&g=-60&e=err&page=main%3Aauthflow%3Apassword_recovery%3A%3Aforgot_password%3Anode%3A%3A&pgrp=main%3Aauthflow%3Apassword_recovery%3A%3Aforgot_password&comp=authnodeweb&erpg=data%20is%20not%20defined&error_type=WINDOW_ONERROR&error_description=ReferenceError%3A%20data%20is%20not%20defined%0A%20%20%20%20at%20_%2Frecaptchav3.js%3A1%3A7141%0A%20%20%20%20at%20_0x19a2cd%20(_%2Frecaptchav3.js%3A1%3A3354)%0A%20%20%20%20at%20_0xb1610b%20(_%2Frecaptchav3.js%3A1%3A7175)%0A%20%20%20%20at%20_%2Frecaptchav3.js%3A1%3A10315%0A%20%20%20%20at%20_%2Frecaptchav3.js%3A1%3A11064&error_source=http%3A%2F%2F13.66.28.137%2Fauth%2Fcreatechallenge%2F357d727e1f5648fe%2Frecaptchav3.js%201%3A7141
Requested by: Host: 13.66.28.137
URL: http://13.66.28.137/authflow/password-recovery/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.1.35 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: akka-http/10.1.11 /
Resource Hash: 6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93

Request headers

Referer: http://13.66.28.137/authflow/password-recovery/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 22 Feb 2021 23:11:38 GMT
via: 1.1 varnish
server: akka-http/10.1.11
x-timer: S1614035498.340108,VS0,VE147
x-cache: MISS
p3p: policyref="https://t.paypal.com/w3c/p3p.xml",CP="CAO IND OUR SAM UNI STA COR COM"
http_x_pp_az_locator: slca.slc
expires: Mon, 22 Feb 2021 23:11:38 GMT
cache-control: no-cache, no-store, max-age=0, no-transform
x-cache-hits: 0
accept-ranges: bytes
content-type: image/gif
content-length: 42
x-served-by: cache-hhn4028-HHN

GET
H/1.1 200
OK fb.js Show response
c.paypal.com/da/r/ Frame 819A 61 KB
21 KB 34ms
33ms Script
application/x-javascript 23.79.145.158
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://c.paypal.com/da/r/fb.js
Requested by: Host: c.paypal.com
URL: https://c.paypal.com/v1/r/d/i?js_src=https://c.paypal.com/da/r/fb.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.79.145.158 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-79-145-158.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: a57d9156941c9e6a2f3b46623b169a11638bc604a2f9b45aa8a656ea02f09209

Request headers

Referer: https://c.paypal.com/v1/r/d/i?js_src=https://c.paypal.com/da/r/fb.js
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 22 Feb 2021 23:11:38 GMT
X-Pad: avoid browser bug
Vary: Accept-Encoding
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 21347
Last-Modified: Tue, 26 Jan 2021 03:41:11 GMT
Server: Apache
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=86400
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Expires: Tue, 23 Feb 2021 23:11:38 GMT

POST
H/1.1 200
OK p1 Show response
c.paypal.com/v1/r/d/b/ Frame 819A 125 B
941 B 246ms
246ms XHR
application/json 23.79.145.158
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://c.paypal.com/v1/r/d/b/p1
Requested by: Host: c.paypal.com
URL: https://c.paypal.com/da/r/fb.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.79.145.158 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-79-145-158.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: c8496f3da06fa0fb0d96498cd2d0ee12d2a2ea428c8d83c7e354e2b942790cff

Request headers

Referer: https://c.paypal.com/v1/r/d/i?js_src=https://c.paypal.com/da/r/fb.js
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/json

Response headers

Date: Mon, 22 Feb 2021 23:11:38 GMT
CORRELATION-ID: 4500dc7e544cf
P3p: policyref="/w3c/p3p.xml", CP="NON DSP COR ADM OUR IND COM"
Paypal-Debug-Id: 4500dc7e544cf
Cache-Control: max-age=0, no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Type: application/json
Content-Length: 125

POST
H/1.1 200
OK p2 Show response
c.paypal.com/v1/r/d/b/ Frame 819A 125 B
695 B 324ms
267ms XHR
application/json 23.79.145.158
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://c.paypal.com/v1/r/d/b/p2
Requested by: Host: c.paypal.com
URL: https://c.paypal.com/da/r/fb.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.79.145.158 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-79-145-158.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 5e42372ce9ffa76f03053700dd0b3c7e13de4edabd571666ab2bcd9d16d3929b

Request headers

Referer: https://c.paypal.com/v1/r/d/i?js_src=https://c.paypal.com/da/r/fb.js
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/json

Response headers

Date: Mon, 22 Feb 2021 23:11:38 GMT
CORRELATION-ID: 65d8fb20509fa
P3p: policyref="/w3c/p3p.xml", CP="NON DSP COR ADM OUR IND COM"
Paypal-Debug-Id: 65d8fb20509fa
Cache-Control: max-age=0, no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Type: application/json
Content-Length: 125

GET
H2 200 p3
c6.paypal.com/v1/r/d/b/ Frame 819A 0
255 B 245ms
210ms Image
text/plain 2a04:4e42:200::291
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c6.paypal.com/v1/r/d/b/p3?f=4c67ad72d336458796aa09d7af712112&s=ANW
Requested by: Host: 13.66.28.137
URL: http://13.66.28.137/authflow/password-recovery/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::291 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://c.paypal.com/v1/r/d/i?js_src=https://c.paypal.com/da/r/fb.js
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 22 Feb 2021 23:11:38 GMT
via: 1.1 varnish, 1.1 varnish
correlation-id: ef6f7aee13b8e
x-timer: S1614035499.545291,VS0,VE198
x-served-by: cache-hhn11524-HHN, cache-fra19165-FRA
x-cache: MISS, MISS
paypal-debug-id: ef6f7aee13b8e
cache-control: max-age=0, no-cache, no-store, must-revalidate
accept-ranges: bytes
content-length: 0
x-cache-hits: 0, 0

GET
H2 200 messaging-bot.js Show response
www.paypalobjects.com/messaging/auth/v2/ 377 KB
116 KB 27ms
27ms Script
application/javascript 184.25.114.184
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/messaging/auth/v2/messaging-bot.js

Requested by

Host: www.paypalobjects.com
URL: https://www.paypalobjects.com/messaging/auth/v1/messaging-opener-mts.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.25.114.184 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a184-25-114-184.deploy.static.akamaitechnologies.com

Software

Resource Hash

b01f45a4d98c8537aaa95ba16a8a6200e32cb08339a0a88cba683e8f90b51881

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: http://13.66.28.137/authflow/password-recovery/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 22 Feb 2021 23:11:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
surrogate-control: max-age=31536000
paypal-debug-id: 48eac8fe54fdd
dc: ccg11-origin-www-1.paypal.com
vary: Accept-Encoding
content-length: 117697
last-modified: Wed, 04 Nov 2020 17:04:45 GMT
etag: W/"5fa2df2d-5e241"
strict-transport-security: max-age=31536000
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
expires: Tue, 23 Feb 2021 00:11:38 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial)

31 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.paypal.com/	1970-01-26 23:32:35	Name: KHcl0EuY7AKSMgfvHl7J5E7hPtK Value: hDHs54BIfuK8GqcV7Zh-_QhokQb055M9aKPTQh2IFlWI_RbnNY7_V46eOSI7HXqBO5i7HNm31FGxVX9L
.paypal.com/	1970-01-20 18:37:23	Name: ts_c Value: vr%3Dcc0335b11770a30003512932ffffffff%26vt%3Dcc0335b11770a30003512932fffffffe
.c.paypal.com/	1970-01-21 12:08:35	Name: sc_f Value: GPTNRXc4qlBD7spc-4sLJeitY0fUEK4Q1HUIvrrvAUsSTlflcAu-XFJekVTdjO3UyvpeXU7hxrgwqdXLmszEkgdeyKntblIxvULvRm
.paypal.com/	1970-01-20 18:37:23	Name: ts Value: vreXpYrS%3D1708643498%26vteXpYrS%3D1614037298%26vr%3Dcc0335b11770a30003512932ffffffff%26vt%3Dcc0335b11770a30003512932fffffffe

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	default-src 'self' https://.paypal.com https://.paypalobjects.com; script-src 'nonce-IQrmSszvvm6cPxTd9Ee7t2EMiYYPKjqbkqePaNSa8QvT0Y5z' 'self' 'unsafe-inline' 'unsafe-eval' https://.paypal.com https://.paypalobjects.com; img-src 'self' data: https:; object-src 'none'; media-src data: blob: 'self' https://.paypal.com https://.paypalobjects.com; font-src 'self' https://.paypal.com https://.paypalobjects.com; style-src 'self' 'unsafe-inline' https://.paypal.com https://.paypalobjects.com; frame-src 'self' https://.paypal.com https://.paypalobjects.com https://.qualtrics.com; child-src 'self' https://.paypal.com https://.paypalobjects.com; connect-src 'self' https://.paypal.com https://.paypalobjects.com https://nexus.ensighten.com https://.google-analytics.com https://.qualtrics.com; form-action 'self' https://.paypal.com; base-uri 'self' https://*.paypal.com; block-all-mixed-content;; report-uri https://www.paypal.com/csplog/api/log/csp
Strict-Transport-Security	max-age=63072000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

b.stats.paypal.com
c.paypal.com
c6.paypal.com
dub.stats.paypal.com
t.paypal.com
www.paypalobjects.com
13.66.28.137
151.101.1.35
184.25.114.184
23.79.145.158
2a04:4e42:200::291
64.4.245.84
0eb22afbab03bbbd8a47d4fc5361ff7518a77273e99fd0b73e235c93dd6ea7aa
42f2dee59f50b3060dd0e17d23d2959b6c73b782e53be70bca5f9e6a13fc85da
47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292
4ac1848d518483d2f031da28c09fde8e2313b42d3628273247e4a9008eb56b47
5e42372ce9ffa76f03053700dd0b3c7e13de4edabd571666ab2bcd9d16d3929b
6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93
843e67ad522a908162007f4b7601819a5bbfef00e38ac7aec778766da8b7b2ab
9321bc63a75b3ac6d384b411665b6e77a8b326a4b176ca2049872d3b5d4974f5
9e889ce073067608502d57f157952a14ce64b3e5ea177d621a0c713a665d55e1
a57d9156941c9e6a2f3b46623b169a11638bc604a2f9b45aa8a656ea02f09209
ae79dcc3eb016922caa1d095cfd936446bc65a46bb3364b242dfc556f7e3c6a8
b01f45a4d98c8537aaa95ba16a8a6200e32cb08339a0a88cba683e8f90b51881
bbe3177aa5d225f117aea0e2eeb27f11d853a33d6d162733c5be8b1de8d36dc5
bcdf050ce6625609e7a3e64f52f1650e7a79abc12a9c7e712fe2b9cfd808e977
be5c4f71eea822cbdcaefcf92963ab573e903f75a60b8bc0793e4eec935a1187
c599c554590d1a336ffcb9627f6caaac34b6228f60e15f5f25454bff38facb7e
c8496f3da06fa0fb0d96498cd2d0ee12d2a2ea428c8d83c7e354e2b942790cff
da775dd10f868447dea4c3522fb3b55bd4a5df650d3f2233a76d31bb711f6c2a
e00ab4867c277813a14fbbc89e0b52b2a96060287669cdd6262f539614b97fcb
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f39646ccd4fbf32d475bed59e8c5a1f18208da3d23783672d095273e4e91a7dc

13.66.28.137 Open in urlscan Pro 13.66.28.137 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

25 Requests

84 %HTTPS

17 %IPv6

2 Domains

6 Subdomains

7 IPs

2 Countries

1119 kBTransfer

3532 kBSize

4 Cookies

2 Outgoing links

Redirected requests

25 HTTP transactions Everything HTML Script AJAX CSS Image Expand all -1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

31 JavaScript Global Variables

4 Cookies

Security Headers

Indicators

13.66.28.137 Open in urlscan Pro
13.66.28.137 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

25
Requests

84 %
HTTPS

17 %
IPv6

2
Domains

6
Subdomains

7
IPs

2
Countries

1119 kB
Transfer

3532 kB
Size

4
Cookies

25 HTTP transactions
-1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!