13.66.28.137
Open in
urlscan Pro
13.66.28.137
Malicious Activity!
Public Scan
Submission Tags: phishing malicious Search All
Submission: On February 22 via api from US
Summary
This is the only time 13.66.28.137 was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: PayPal (Financial)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 | 13.66.28.137 13.66.28.137 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
11 | 184.25.114.184 184.25.114.184 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
5 | 23.79.145.158 23.79.145.158 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
1 2 | 64.4.245.84 64.4.245.84 | 17012 (PAYPAL) (PAYPAL) | |
3 | 151.101.1.35 151.101.1.35 | 54113 (FASTLY) (FASTLY) | |
1 | 2a04:4e42:200... 2a04:4e42:200::291 | 54113 (FASTLY) (FASTLY) | |
24 | 6 |
ASN16625 (AKAMAI-AS, US)
PTR: a184-25-114-184.deploy.static.akamaitechnologies.com
www.paypalobjects.com |
ASN16625 (AKAMAI-AS, US)
PTR: a23-79-145-158.deploy.static.akamaitechnologies.com
c.paypal.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
paypal.com
1 redirects
c.paypal.com b.stats.paypal.com dub.stats.paypal.com t.paypal.com c6.paypal.com |
48 KB |
11 |
paypalobjects.com
www.paypalobjects.com |
1 MB |
24 | 2 |
Domain | Requested by | |
---|---|---|
11 | www.paypalobjects.com |
13.66.28.137
www.paypalobjects.com |
5 | c.paypal.com |
13.66.28.137
c.paypal.com |
3 | t.paypal.com |
13.66.28.137
|
1 | c6.paypal.com |
13.66.28.137
|
1 | dub.stats.paypal.com |
13.66.28.137
|
1 | b.stats.paypal.com | 1 redirects |
24 | 6 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.paypal.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
www.paypal.com DigiCert SHA2 Extended Validation Server CA |
2021-01-13 - 2022-01-11 |
a year | crt.sh |
c.paypal.com DigiCert SHA2 Extended Validation Server CA |
2020-01-09 - 2022-01-13 |
2 years | crt.sh |
b.stats.paypal.com DigiCert SHA2 High Assurance Server CA |
2020-03-13 - 2022-06-03 |
2 years | crt.sh |
t.paypal.com DigiCert SHA2 Extended Validation Server CA |
2020-11-17 - 2021-11-21 |
a year | crt.sh |
This page contains 3 frames:
Primary Page:
http://13.66.28.137/authflow/password-recovery/
Frame ID: 63D5547A31A33BC03C4F731B085DF925
Requests: 18 HTTP requests in this frame
Frame:
https://c.paypal.com/v1/r/d/i?js_src=https://c.paypal.com/da/r/fb.js
Frame ID: 819AAB5E31819E634FF2157FF0BB5855
Requests: 5 HTTP requests in this frame
Frame:
https://dub.stats.paypal.com/v2/counter2.cgi?p=4c67ad72d336458796aa09d7af712112&s=ANW
Frame ID: 53384BCC612399E755867C828749CE2A
Requests: 1 HTTP requests in this frame
2 Outgoing links
These are links going to different origins than the main page.
Title: Return to PayPal login
Search URL Search Domain Scan URL
Title: Learn more and manage your cookies
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 13- https://b.stats.paypal.com/v2/counter.cgi?p=4c67ad72d336458796aa09d7af712112&s=ANW HTTP 302
- https://dub.stats.paypal.com/v2/counter2.cgi?p=4c67ad72d336458796aa09d7af712112&s=ANW
24 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
Cookie set
/
13.66.28.137/authflow/password-recovery/ |
59 KB 20 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app.css
www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/css/ |
134 KB 20 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app.js
www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/js/ |
3 MB 726 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pa.js
www.paypalobjects.com/pa/js/ |
52 KB 20 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bs.js
www.paypalobjects.com/tagmgmt/ |
19 B 374 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
messaging-opener-mts.js
www.paypalobjects.com/messaging/auth/v1/ |
3 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
fb.js
c.paypal.com/da/r/ |
61 KB 21 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
recaptchav3.js
13.66.28.137/auth/createchallenge/357d727e1f5648fe/ |
11 KB 13 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
monogram@2x.png
www.paypalobjects.com/images/shared/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
PayPalSansSmall-Regular.woff
www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/ |
46 KB 47 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
animation-oval.png
www.paypalobjects.com/images/shared/ |
2 KB 3 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
PayPalSansBig-Light.woff
www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/ |
48 KB 48 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
PayPalSansSmall-Light.woff
www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/ |
46 KB 46 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
i
c.paypal.com/v1/r/d/ Frame 819A |
160 B 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
counter2.cgi
dub.stats.paypal.com/v2/ Frame 5338 Redirect Chain
|
42 B 299 B |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ts
t.paypal.com/ |
42 B 673 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
chat-meta
13.66.28.137/smartchat/open/ |
9 KB 12 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ts
t.paypal.com/ |
42 B 403 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ts
t.paypal.com/ |
42 B 411 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
fb.js
c.paypal.com/da/r/ Frame 819A |
61 KB 21 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
p1
c.paypal.com/v1/r/d/b/ Frame 819A |
125 B 941 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
p2
c.paypal.com/v1/r/d/b/ Frame 819A |
125 B 695 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
p3
c6.paypal.com/v1/r/d/b/ Frame 819A |
0 255 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
messaging-bot.js
www.paypalobjects.com/messaging/auth/v2/ |
377 KB 116 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: PayPal (Financial)31 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| trustedTypes boolean| crossOriginIsolated function| bindGdprEvents object| core object| __core-js_shared__ object| global object| System function| asap function| Observable function| setImmediate function| clearImmediate object| regeneratorRuntime boolean| _babelPolyfill object| IntlPolyfill object| PDFJS object| PAYPAL object| fpti string| fptiserverurl object| dataLayer object| _ifpti function| openChatUtils function| hideGdprBanner function| showGdprBanner object| _0x5259 function| _0xa8d8 object| mtsChat4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.paypal.com/ | Name: KHcl0EuY7AKSMgfvHl7J5E7hPtK Value: hDHs54BIfuK8GqcV7Zh-_QhokQb055M9aKPTQh2IFlWI_RbnNY7_V46eOSI7HXqBO5i7HNm31FGxVX9L |
|
.paypal.com/ | Name: ts_c Value: vr%3Dcc0335b11770a30003512932ffffffff%26vt%3Dcc0335b11770a30003512932fffffffe |
|
.c.paypal.com/ | Name: sc_f Value: GPTNRXc4qlBD7spc-4sLJeitY0fUEK4Q1HUIvrrvAUsSTlflcAu-XFJekVTdjO3UyvpeXU7hxrgwqdXLmszEkgdeyKntblIxvULvRm |
|
.paypal.com/ | Name: ts Value: vreXpYrS%3D1708643498%26vteXpYrS%3D1614037298%26vr%3Dcc0335b11770a30003512932ffffffff%26vt%3Dcc0335b11770a30003512932fffffffe |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | default-src 'self' https://*.paypal.com https://*.paypalobjects.com; script-src 'nonce-IQrmSszvvm6cPxTd9Ee7t2EMiYYPKjqbkqePaNSa8QvT0Y5z' 'self' 'unsafe-inline' 'unsafe-eval' https://*.paypal.com https://*.paypalobjects.com; img-src 'self' data: https:; object-src 'none'; media-src data: blob: 'self' https://*.paypal.com https://*.paypalobjects.com; font-src 'self' https://*.paypal.com https://*.paypalobjects.com; style-src 'self' 'unsafe-inline' https://*.paypal.com https://*.paypalobjects.com; frame-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; child-src 'self' https://*.paypal.com https://*.paypalobjects.com; connect-src 'self' https://*.paypal.com https://*.paypalobjects.com https://nexus.ensighten.com https://*.google-analytics.com https://*.qualtrics.com; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; block-all-mixed-content;; report-uri https://www.paypal.com/csplog/api/log/csp |
Strict-Transport-Security | max-age=63072000 |
X-Content-Type-Options | nosniff |
X-Frame-Options | SAMEORIGIN |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
b.stats.paypal.com
c.paypal.com
c6.paypal.com
dub.stats.paypal.com
t.paypal.com
www.paypalobjects.com
13.66.28.137
151.101.1.35
184.25.114.184
23.79.145.158
2a04:4e42:200::291
64.4.245.84
0eb22afbab03bbbd8a47d4fc5361ff7518a77273e99fd0b73e235c93dd6ea7aa
42f2dee59f50b3060dd0e17d23d2959b6c73b782e53be70bca5f9e6a13fc85da
47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292
4ac1848d518483d2f031da28c09fde8e2313b42d3628273247e4a9008eb56b47
5e42372ce9ffa76f03053700dd0b3c7e13de4edabd571666ab2bcd9d16d3929b
6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93
843e67ad522a908162007f4b7601819a5bbfef00e38ac7aec778766da8b7b2ab
9321bc63a75b3ac6d384b411665b6e77a8b326a4b176ca2049872d3b5d4974f5
9e889ce073067608502d57f157952a14ce64b3e5ea177d621a0c713a665d55e1
a57d9156941c9e6a2f3b46623b169a11638bc604a2f9b45aa8a656ea02f09209
ae79dcc3eb016922caa1d095cfd936446bc65a46bb3364b242dfc556f7e3c6a8
b01f45a4d98c8537aaa95ba16a8a6200e32cb08339a0a88cba683e8f90b51881
bbe3177aa5d225f117aea0e2eeb27f11d853a33d6d162733c5be8b1de8d36dc5
bcdf050ce6625609e7a3e64f52f1650e7a79abc12a9c7e712fe2b9cfd808e977
be5c4f71eea822cbdcaefcf92963ab573e903f75a60b8bc0793e4eec935a1187
c599c554590d1a336ffcb9627f6caaac34b6228f60e15f5f25454bff38facb7e
c8496f3da06fa0fb0d96498cd2d0ee12d2a2ea428c8d83c7e354e2b942790cff
da775dd10f868447dea4c3522fb3b55bd4a5df650d3f2233a76d31bb711f6c2a
e00ab4867c277813a14fbbc89e0b52b2a96060287669cdd6262f539614b97fcb
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f39646ccd4fbf32d475bed59e8c5a1f18208da3d23783672d095273e4e91a7dc