![](/screenshots/8ca5b619-019e-4844-8d74-0c7391a00b26.png)
www-bgandg-com.filesusr.com
Open in
urlscan Pro
34.102.176.152
Malicious Activity!
Public Scan
Submission: On October 16 via api from QA
Summary
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on May 28th 2020. Valid for: 6 months.
This is the only time www-bgandg-com.filesusr.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: PayPal (Financial)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 | 34.102.176.152 34.102.176.152 | 15169 (GOOGLE) (GOOGLE) | |
18 | 104.108.64.37 104.108.64.37 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
1 | 2a02:26f0:6c0... 2a02:26f0:6c00:2a3::11a6 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
1 | 151.101.1.21 151.101.1.21 | 54113 (FASTLY) (FASTLY) | |
1 | 2a02:26f0:6c0... 2a02:26f0:6c00:19a::11a6 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
1 | 104.108.34.200 104.108.34.200 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
25 | 7 |
ASN15169 (GOOGLE, US)
PTR: 152.176.102.34.bc.googleusercontent.com
www-bgandg-com.filesusr.com |
ASN16625 (AKAMAI-AS, US)
PTR: a104-108-64-37.deploy.static.akamaitechnologies.com
www.paypalobjects.com |
ASN16625 (AKAMAI-AS, US)
PTR: a104-108-34-200.deploy.static.akamaitechnologies.com
t.paypal.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
18 |
paypalobjects.com
www.paypalobjects.com |
330 KB |
3 |
filesusr.com
www-bgandg-com.filesusr.com |
43 KB |
2 |
paypal.com
www.paypal.com t.paypal.com |
6 KB |
2 |
go-mpulse.net
s.go-mpulse.net c.go-mpulse.net |
50 KB |
25 | 4 |
Domain | Requested by | |
---|---|---|
18 | www.paypalobjects.com |
www-bgandg-com.filesusr.com
www.paypalobjects.com |
3 | www-bgandg-com.filesusr.com |
www.paypalobjects.com
|
1 | t.paypal.com | |
1 | c.go-mpulse.net |
s.go-mpulse.net
|
1 | www.paypal.com |
www-bgandg-com.filesusr.com
|
1 | s.go-mpulse.net |
www-bgandg-com.filesusr.com
|
25 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.filesusr.com Sectigo RSA Domain Validation Secure Server CA |
2020-05-28 - 2020-11-24 |
6 months | crt.sh |
www.paypal.com DigiCert SHA2 Extended Validation Server CA |
2020-01-09 - 2022-01-12 |
2 years | crt.sh |
akstat.io DigiCert Secure Site ECC CA-1 |
2020-05-06 - 2021-08-05 |
a year | crt.sh |
t.paypal.com DigiCert SHA2 Extended Validation Server CA |
2020-01-09 - 2022-01-12 |
2 years | crt.sh |
This page contains 2 frames:
Primary Page:
https://www-bgandg-com.filesusr.com/html/a5f201_b3cdc8130adaa1e0b2cee67a24dbf3d6.html
Frame ID: 32FB27C75CC8BA884A5749DF71BCA16F
Requests: 24 HTTP requests in this frame
Frame:
https://s.go-mpulse.net/boomerang/74759-CGVD8-BDC9U-HFEBK-L8YVN
Frame ID: 60F380CD477CF1BF558959A6F132116A
Requests: 2 HTTP requests in this frame
Screenshot
![](/screenshots/8ca5b619-019e-4844-8d74-0c7391a00b26.png)
Detected technologies
![](/vendor/wappa/icons/Lua.png)
Detected patterns
- headers server /openresty(?:\/([\d.]+))?/i
Detected patterns
- headers server /openresty(?:\/([\d.]+))?/i
![](/vendor/wappa/icons/OpenResty.png)
Detected patterns
- headers server /openresty(?:\/([\d.]+))?/i
Detected patterns
- headers via /^1\.1 google$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
25 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
a5f201_b3cdc8130adaa1e0b2cee67a24dbf3d6.html
www-bgandg-com.filesusr.com/html/ |
42 KB 43 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.css
www.paypalobjects.com/web/res/8b5/2bad2975659615d746e7ca740ef45/js/client/ |
24 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
helpcenter-8ball-spark.min.js
www.paypalobjects.com/helpcenter/ |
7 KB 3 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
notifications.min.js
www.paypalobjects.com/ui-web/notifications/1.29.0/ |
11 KB 3 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
header-footer.min.css
www.paypalobjects.com/ui-web/header-footer/1.32.0/ |
43 KB 9 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bs-chunk.js
www.paypalobjects.com/tagmgmt/ |
19 B 292 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
74759-CGVD8-BDC9U-HFEBK-L8YVN
s.go-mpulse.net/boomerang/ Frame 60F3 |
202 KB 49 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
polyfill.js
www.paypal.com/paypalme/v1/ |
9 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pa.js
www.paypalobjects.com/pa/js/min/ |
46 KB 18 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.bundle.js
www.paypalobjects.com/web/res/8b5/2bad2975659615d746e7ca740ef45/js/client/ |
429 KB 117 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
config.json
c.go-mpulse.net/api/ Frame 60F3 |
68 B 388 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
refund-prefetch
www-bgandg-com.filesusr.com/smarthelp/ |
9 B 109 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
chat-meta
www-bgandg-com.filesusr.com/smartchat/ |
9 B 166 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vendors~ppme-grab~ppme-shared.bundle.js
www.paypalobjects.com/web/res/8b5/2bad2975659615d746e7ca740ef45/js/client/ |
22 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vendors~ppme-shared.bundle.js
www.paypalobjects.com/web/res/8b5/2bad2975659615d746e7ca740ef45/js/client/ |
30 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ppme-shared.css
www.paypalobjects.com/web/res/8b5/2bad2975659615d746e7ca740ef45/js/client/ |
171 B 442 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ppme-shared.bundle.js
www.paypalobjects.com/web/res/8b5/2bad2975659615d746e7ca740ef45/js/client/ |
12 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
389 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vendors~ppme-grab~ppme-settings~ppme-slug.bundle.js
www.paypalobjects.com/web/res/8b5/2bad2975659615d746e7ca740ef45/js/client/ |
94 KB 25 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ppme-grab~ppme-settings~ppme-slug.bundle.js
www.paypalobjects.com/web/res/8b5/2bad2975659615d746e7ca740ef45/js/client/ |
44 KB 10 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ppme-slug.bundle.js
www.paypalobjects.com/web/res/8b5/2bad2975659615d746e7ca740ef45/js/client/ |
21 KB 4 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
PayPalVXIcons-Regular.woff2
www.paypalobjects.com/ui-web/vx-icons/2-0-2/ |
9 KB 9 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
PayPalSansSmall-Regular.woff2
www.paypalobjects.com/ui-web/paypal-sans-small/1-0-0/ |
36 KB 37 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
PayPalSansSmall-Medium.woff2
www.paypalobjects.com/ui-web/paypal-sans-small/1-0-0/ |
38 KB 38 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
PayPalSansSmall-Light.woff2
www.paypalobjects.com/ui-web/paypal-sans-small/1-0-0/ |
36 KB 36 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ts
t.paypal.com/ |
42 B 865 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: PayPal (Financial)26 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes object| dataLayer string| tagManagerUrl string| tagManagerObject function| tagManager object| BOOMR number| BOOMR_lstart string| webpackPublicPath object| BOOMR_mq boolean| isLessthanIE10 function| helpCenterSpark object| mountElement function| mountData function| helpcenterapi object| PAYPAL object| fpti string| fptiserverurl object| webpackJsonp object| regeneratorRuntime object| VX object| _ifpti number| BOOMR_onload0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
c.go-mpulse.net
s.go-mpulse.net
t.paypal.com
www-bgandg-com.filesusr.com
www.paypal.com
www.paypalobjects.com
104.108.34.200
104.108.64.37
151.101.1.21
2a02:26f0:6c00:19a::11a6
2a02:26f0:6c00:2a3::11a6
34.102.176.152
0c82c716810f696094ec9fa8ee97b69ad7eb68d1f8cb763b8265088f5bbc136c
22a9516ec33636a224aa1c0ae0d194274918ba3b3066951701052b3e2ee9ef07
2a6519865647a832e1fb13c743ab157702982a06ac7435b3f9958022626f1115
2bd489558b2373c5faeecbdf17bfd8a619cf5db1cad8d648dcbd40d98d3d980d
3217a6955b600825965f424d1cf73bc156ade880bcb4e16760cfe1771e2da89e
3692dc84dcb15a9fdca4bbd2cfcd040bbabec41536efeab83484bc9535857700
38b524869bd1aa91e37e3bb3cf40a298bc74f0e1405e925170a25aae1305e6ab
4bcf08c42243488b21b169575446b702af7b1cbc88cea79e7e33d23cb4d19ece
55108b5e4bf0203c3d03995699e9113add8ef4c27edc5266bbddb05d354ba6fb
5eded7f7520e13fb62d3705624335483351d80ee8d7f0880c71ebd84a738b1a4
6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93
743269eba97930520fffacfbab90f4468674fd06d329e45e6557d298fd16f2ed
78342a0905a72ce44da083dcb5d23b8ea0c16992ba2a82eece97e033d76ba3d3
86617a30c8cf11ba15314cbad73f8020618047ae593e586ab564802b473d1f1a
9bd33862231cbc6ce6aa38ba260846b2898008e523701e32293545fa022219b7
9fb974b84a129972abbd1e2e5cfdf685cab5f6f22d881adf3845bc73b43eb4ad
aa5f838e3a8483eedc050cb4f9d711081107393bf3b0b2ea0073c22c3611e38a
b337b4723a05881b0fdbc54695b0558d288b13ab9d98ff45d091e51d78fd6ed0
be5c4f71eea822cbdcaefcf92963ab573e903f75a60b8bc0793e4eec935a1187
c0f7fae8dcba07c887e9f3051d0dd38b75a1e6beae0e4454f4e7a895e341b962
c8ccab35aa22d42a8e7bb4784fa75ac7498f92bccc19c324206b52b58165c66a
c91d3a13cd6ef06ab8a5fb32fb20db0b7b3a034668647d2a5e5c5bbafd85ec1b
de04dd8789d114505a4dfa421bc4b1a418bfc4321cb7550f65f2cca3a8c179eb
e085866d187704eb7574395c3bf4ae78dfdc8f189816d2081b9495fd4a12787f
fbc9938e7f80cc983bbdfe777b736364fec34f493d20a81f84b5c67b6bc0c24e