13.66.28.137 Open in urlscan Pro
13.66.28.137  Malicious Activity! Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Cookie set / Show response 13.66.28.137/authflow/email-recovery/	59 KB 19 KB	778ms 764ms	Document text/html	13.66.28.137
General Check archive.org Show headers Download Go to Full URL http://13.66.28.137/authflow/email-recovery/?country.x=us&amp Protocol HTTP/1.1 Server 13.66.28.137 San Antonio, United States, ASN (), Reverse DNS Software nginx/1.4.6 (Ubuntu) / Resource Hash 13f10ed9965f23fd804cd3816114e9eff0cd851a0145dd2ca1bfe57ff1e3ce3b Security Headers Name Value Content-Security-Policy default-src 'self' https://*.paypal.com https://*.paypalobjects.com; script-src 'nonce-BPdGlR8y+G2XfMFZPuF0DEBOZcBWozNK2U1KQZTE2p42y6XT' 'self' 'unsafe-inline' 'unsafe-eval' https://*.paypal.com https://*.paypalobjects.com; img-src 'self' data: https:; object-src 'none'; media-src data: blob: 'self' https://*.paypal.com https://*.paypalobjects.com; font-src 'self' https://*.paypal.com https://*.paypalobjects.com; style-src 'self' 'unsafe-inline' https://*.paypal.com https://*.paypalobjects.com; frame-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; child-src 'self' https://*.paypal.com https://*.paypalobjects.com; connect-src 'self' https://*.paypal.com https://*.paypalobjects.com https://nexus.ensighten.com https://*.google-analytics.com https://*.qualtrics.com; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; block-all-mixed-content;; report-uri https://www.paypal.com/csplog/api/log/csp Strict-Transport-Security max-age=63072000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Host 13.66.28.137 Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Server nginx/1.4.6 (Ubuntu) Date Tue, 23 Feb 2021 12:11:41 GMT Content-Type text/html; charset=utf-8 Content-Length 16810 Connection keep-alive Cache-Control max-age=0, no-cache, no-store, must-revalidate Content-Security-Policy default-src 'self' https://*.paypal.com https://*.paypalobjects.com; script-src 'nonce-BPdGlR8y+G2XfMFZPuF0DEBOZcBWozNK2U1KQZTE2p42y6XT' 'self' 'unsafe-inline' 'unsafe-eval' https://*.paypal.com https://*.paypalobjects.com; img-src 'self' data: https:; object-src 'none'; media-src data: blob: 'self' https://*.paypal.com https://*.paypalobjects.com; font-src 'self' https://*.paypal.com https://*.paypalobjects.com; style-src 'self' 'unsafe-inline' https://*.paypal.com https://*.paypalobjects.com; frame-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; child-src 'self' https://*.paypal.com https://*.paypalobjects.com; connect-src 'self' https://*.paypal.com https://*.paypalobjects.com https://nexus.ensighten.com https://*.google-analytics.com https://*.qualtrics.com; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; block-all-mixed-content;; report-uri https://www.paypal.com/csplog/api/log/csp ETag W/"ebe1-CS5z/d5iEMgw2kR46mAb9QRhhL8" Paypal-Debug-Id 937da7c38b20b X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block DC ccg11-origin-www-1.paypal.com X-EdgeConnect-MidMile-RTT 41 X-EdgeConnect-Origin-MEX-Latency 384 Vary Accept-Encoding Content-Encoding gzip Set-Cookie enforce_policy=ccpa; Max-Age=31536000; Domain=.paypal.com; Path=/; Expires=Wed, 23 Feb 2022 12:11:41 GMT; Secure; SameSite=None LANG=en_US%3BUS; Max-Age=31556; Domain=.paypal.com; Path=/; Expires=Tue, 23 Feb 2021 20:57:37 GMT; HttpOnly; Secure; SameSite=None tsrce=authnodeweb; Max-Age=259199; Domain=.paypal.com; Path=/; Expires=Fri, 26 Feb 2021 12:11:40 GMT; HttpOnly; Secure; SameSite=None x-pp-s=eyJ0IjoiMTYxNDA4MjMwMTcyNyIsImwiOiIwIiwibSI6IjAifQ; Domain=.paypal.com; Path=/; HttpOnly; Secure; SameSite=None nsid=s%3Awj3ANnCKJUnLSJ_3QSl_PCnLl-khKAiX.O1wzuJksTjVPaVf7099q1146MBH5tphez33rWAzwv2Y; Path=/; HttpOnly; Secure; SameSite=None l7_az=dcg02.phx; Path=/; Domain=paypal.com; Expires=Tue, 23 Feb 2021 12:41:41 GMT; HttpOnly; Secure; SameSite=None ts=vreXpYrS%3D1708690301%26vteXpYrS%3D1614084101%26vr%3Dcecd5dd31770a788723793aef91810d4%26vt%3Dcecd5dd31770a788723793aef91810d3%26vtyp%3Dnew; Path=/; Domain=paypal.com; Expires=Fri, 23 Feb 2024 12:11:41 GMT; HttpOnly; Secure; SameSite=None ts_c=vr%3Dcecd5dd31770a788723793aef91810d4%26vt%3Dcecd5dd31770a788723793aef91810d3; Path=/; Domain=paypal.com; Expires=Fri, 23 Feb 2024 12:11:41 GMT; Secure; SameSite=None x-cdn=akamai; path=/; domain=.paypal.com; secure akavpau_ppsd=1614082901~id=c198c2895d15a9d443d11e62839be979; Domain=www.paypal.com; Path=/; HttpOnly; Secure; SameSite=None Strict-Transport-Security max-age=63072000
GET H2	200	app.css www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/css/	134 KB 20 KB	100ms 25ms	Stylesheet text/css	104.111.228.123 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/css/app.css Requested by Host: 13.66.28.137 URL: http://13.66.28.137/authflow/email-recovery/?country.x=us&amp Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.228.123 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-228-123.deploy.static.akamaitechnologies.com Software / Resource Hash e00ab4867c277813a14fbbc89e0b52b2a96060287669cdd6262f539614b97fcb Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Referer http://13.66.28.137/authflow/email-recovery/?country.x=us&amp User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 23 Feb 2021 12:11:42 GMT content-encoding gzip x-content-type-options nosniff surrogate-control max-age=31536000 paypal-debug-id 77a340fb4bae dc ccg11-origin-www-1.paypal.com vary Accept-Encoding content-length 19786 last-modified Thu, 11 Feb 2021 00:43:48 GMT etag W/"60247dc4-2188e" strict-transport-security max-age=31536000 access-control-allow-methods GET content-type text/css access-control-allow-origin * cache-control max-age=31536000 expires Wed, 23 Feb 2022 12:11:42 GMT
GET H2	200	app.js Show response www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/js/	3 MB 726 KB	114ms 39ms	Script application/javascript	104.111.228.123 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/js/app.js Requested by Host: 13.66.28.137 URL: http://13.66.28.137/authflow/email-recovery/?country.x=us&amp Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.228.123 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-228-123.deploy.static.akamaitechnologies.com Software / Resource Hash f39646ccd4fbf32d475bed59e8c5a1f18208da3d23783672d095273e4e91a7dc Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Referer http://13.66.28.137/authflow/email-recovery/?country.x=us&amp User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 23 Feb 2021 12:11:42 GMT content-encoding gzip x-content-type-options nosniff surrogate-control max-age=31536000 paypal-debug-id 7365bc2b8fe33 dc ccg11-origin-www-3.paypal.com vary Accept-Encoding content-length 741072 last-modified Thu, 11 Feb 2021 00:43:48 GMT etag W/"60247dc4-28f32c" strict-transport-security max-age=31536000 access-control-allow-methods GET content-type application/javascript access-control-allow-origin * cache-control max-age=31536000 access-control-allow-headers x-csrf-token expires Wed, 23 Feb 2022 12:11:42 GMT
GET H2	200	pa.js Show response www.paypalobjects.com/pa/js/	52 KB 20 KB	114ms 40ms	Script application/javascript	104.111.228.123 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://www.paypalobjects.com/pa/js/pa.js Requested by Host: 13.66.28.137 URL: http://13.66.28.137/authflow/email-recovery/?country.x=us&amp Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.228.123 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-228-123.deploy.static.akamaitechnologies.com Software / Resource Hash 0eb22afbab03bbbd8a47d4fc5361ff7518a77273e99fd0b73e235c93dd6ea7aa Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Referer http://13.66.28.137/authflow/email-recovery/?country.x=us&amp User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 23 Feb 2021 12:11:42 GMT content-encoding gzip x-content-type-options nosniff surrogate-control max-age=31536000 paypal-debug-id 74fa405ca849f dc slc-b-origin-www-2.paypal.com vary Accept-Encoding content-length 20130 last-modified Thu, 18 Feb 2021 06:57:36 GMT etag W/"602e0fe0-cfcb" strict-transport-security max-age=31536000 access-control-allow-methods GET content-type application/javascript access-control-allow-origin * cache-control public, max-age=3600 access-control-allow-headers x-csrf-token expires Tue, 23 Feb 2021 13:11:42 GMT
GET H2	200	bs.js Show response www.paypalobjects.com/tagmgmt/	19 B 374 B	130ms 56ms	Script application/javascript	104.111.228.123 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://www.paypalobjects.com/tagmgmt/bs.js Requested by Host: 13.66.28.137 URL: http://13.66.28.137/authflow/email-recovery/?country.x=us&amp Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.228.123 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-228-123.deploy.static.akamaitechnologies.com Software / Resource Hash be5c4f71eea822cbdcaefcf92963ab573e903f75a60b8bc0793e4eec935a1187 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Referer http://13.66.28.137/authflow/email-recovery/?country.x=us&amp User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 23 Feb 2021 12:11:42 GMT x-content-type-options nosniff surrogate-control max-age=31536000 paypal-debug-id beed56fe117b4 dc ccg11-origin-www-3.paypal.com vary Accept-Encoding content-length 19 last-modified Thu, 01 Oct 2020 22:15:27 GMT etag "5f7654ff-13" strict-transport-security max-age=31536000 access-control-allow-methods GET content-type application/javascript access-control-allow-origin * cache-control max-age=3600 accept-ranges bytes access-control-allow-headers x-csrf-token expires Tue, 23 Feb 2021 13:11:42 GMT
GET H2	200	messaging-opener-mts.js Show response www.paypalobjects.com/messaging/auth/v1/	3 KB 1 KB	130ms 56ms	Script application/javascript	104.111.228.123 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://www.paypalobjects.com/messaging/auth/v1/messaging-opener-mts.js Requested by Host: 13.66.28.137 URL: http://13.66.28.137/authflow/email-recovery/?country.x=us&amp Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.228.123 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-228-123.deploy.static.akamaitechnologies.com Software / Resource Hash bcdf050ce6625609e7a3e64f52f1650e7a79abc12a9c7e712fe2b9cfd808e977 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Referer http://13.66.28.137/authflow/email-recovery/?country.x=us&amp User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 23 Feb 2021 12:11:42 GMT content-encoding gzip x-content-type-options nosniff surrogate-control max-age=31536000 paypal-debug-id b67d6edeb53a5 dc slc-b-origin-www-3.paypal.com vary Accept-Encoding content-length 1081 last-modified Thu, 01 Oct 2020 22:15:16 GMT etag W/"5f7654f4-b7b" strict-transport-security max-age=31536000 access-control-allow-methods GET content-type application/javascript access-control-allow-origin * cache-control max-age=3600 expires Tue, 23 Feb 2021 13:11:42 GMT
GET H/1.1	200 OK	recaptchav3.js Show response 13.66.28.137/auth/createchallenge/7d313d57ff21bcad/	11 KB 12 KB	160ms 160ms	Script text/javascript	13.66.28.137
General Check archive.org Show headers Download Go to Full URL http://13.66.28.137/auth/createchallenge/7d313d57ff21bcad/recaptchav3.js Requested by Host: 13.66.28.137 URL: http://13.66.28.137/authflow/email-recovery/?country.x=us&amp Protocol HTTP/1.1 Server 13.66.28.137 San Antonio, United States, ASN (), Reverse DNS Software nginx/1.4.6 (Ubuntu) / Resource Hash b8a64feb2ac3ff5520a3c16afc2e56e8d1189e272a21c5e45c79122b93281e67 Security Headers Name Value Content-Security-Policy default-src 'self' https://*.paypal.com https://*.paypalobjects.com; script-src 'nonce-IK2h4RXImfJGvGzrWLZigx5oewBLh23kMdy5KQbwQshxjpQ+' 'self' https://*.paypal.com https://*.paypalobjects.com https://www.recaptcha.net https://www.gstatic.com 'unsafe-inline'; img-src https://*.paypalobjects.com https://*.paypal.com https://ak1s.abmr.net https://ak1.abmr.net https://ak1s.mathtag.com https://akamai.mathtag.com; object-src 'none'; media-src 'self' https://*.paypal.com https://*.paypalobjects.com; font-src 'self' https://*.paypal.com https://*.paypalobjects.com; frame-src 'self' https://*.paypal.com https://*.paypalobjects.com https://www.google.com https://www.recaptcha.net https://*.qualtrics.com; style-src 'self' 'unsafe-inline' https://*.paypal.com https://*.paypalobjects.com; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; block-all-mixed-content;; report-uri https://www.paypal.com/csplog/api/log/csp; connect-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; Strict-Transport-Security max-age=63072000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer http://13.66.28.137/authflow/email-recovery/?country.x=us&amp User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers X-EdgeConnect-Origin-MEX-Latency 173 Content-Security-Policy default-src 'self' https://*.paypal.com https://*.paypalobjects.com; script-src 'nonce-IK2h4RXImfJGvGzrWLZigx5oewBLh23kMdy5KQbwQshxjpQ+' 'self' https://*.paypal.com https://*.paypalobjects.com https://www.recaptcha.net https://www.gstatic.com 'unsafe-inline'; img-src https://*.paypalobjects.com https://*.paypal.com https://ak1s.abmr.net https://ak1.abmr.net https://ak1s.mathtag.com https://akamai.mathtag.com; object-src 'none'; media-src 'self' https://*.paypal.com https://*.paypalobjects.com; font-src 'self' https://*.paypal.com https://*.paypalobjects.com; frame-src 'self' https://*.paypal.com https://*.paypalobjects.com https://www.google.com https://www.recaptcha.net https://*.qualtrics.com; style-src 'self' 'unsafe-inline' https://*.paypal.com https://*.paypalobjects.com; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; block-all-mixed-content;; report-uri https://www.paypal.com/csplog/api/log/csp; connect-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; X-Content-Type-Options nosniff Server nginx/1.4.6 (Ubuntu) X-EdgeConnect-MidMile-RTT 39 ETag W/"2add-gLTr+eatlS0z9WwDp/0tkQluCuI" Strict-Transport-Security max-age=63072000 Content-Type text/javascript; charset=utf-8 Paypal-Debug-Id d0402fed2775d Cache-Control max-age=0, no-cache, no-store, must-revalidate Date Tue, 23 Feb 2021 12:11:42 GMT Connection keep-alive DC ccg11-origin-www-1.paypal.com Content-Length 10973 X-Xss-Protection 1; mode=block
GET H2	200	monogram@2x.png www.paypalobjects.com/images/shared/	1 KB 2 KB	55ms 54ms	Image image/png	104.111.228.123 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.paypalobjects.com/images/shared/monogram@2x.png Requested by Host: www.paypalobjects.com URL: https://www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/css/app.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.228.123 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-228-123.deploy.static.akamaitechnologies.com Software Akamai Image Manager / Resource Hash bbe3177aa5d225f117aea0e2eeb27f11d853a33d6d162733c5be8b1de8d36dc5 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Referer https://www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/css/app.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 23 Feb 2021 12:11:42 GMT x-content-type-options nosniff last-modified Wed, 06 Jan 2021 02:00:50 GMT server Akamai Image Manager etag "tu4IksQhsaBV1ddsYvtwjxUD2qmVV7SZmLo7q4XSXU0" strict-transport-security max-age=31536000 content-type image/png cache-control private, max-age=740939 content-length 1507 expires Thu, 04 Mar 2021 02:00:41 GMT
GET H2	200	PayPalSansSmall-Regular.woff www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/	46 KB 47 KB	75ms 24ms	Font font/woff	104.111.228.123 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/PayPalSansSmall-Regular.woff Requested by Host: www.paypalobjects.com URL: https://www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/css/app.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.228.123 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-228-123.deploy.static.akamaitechnologies.com Software / Resource Hash ae79dcc3eb016922caa1d095cfd936446bc65a46bb3364b242dfc556f7e3c6a8 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Origin http://13.66.28.137 Referer https://www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/css/app.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 23 Feb 2021 12:11:42 GMT x-content-type-options nosniff last-modified Wed, 30 Sep 2015 05:09:04 GMT cache-control max-age=3600 etag "560b6e70-b8eb" vary Accept-Encoding content-type font/woff access-control-allow-origin * paypal-debug-id ff23e7beab590 strict-transport-security max-age=31536000 accept-ranges bytes dc phx-origin-www-2.paypal.com content-length 47339 expires Tue, 23 Feb 2021 13:11:42 GMT
GET H2	200	animation-oval.png www.paypalobjects.com/images/shared/	2 KB 3 KB	44ms 43ms	Image image/webp	104.111.228.123 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.paypalobjects.com/images/shared/animation-oval.png Requested by Host: www.paypalobjects.com URL: https://www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/css/app.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.228.123 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-228-123.deploy.static.akamaitechnologies.com Software Akamai Image Manager / Resource Hash da775dd10f868447dea4c3522fb3b55bd4a5df650d3f2233a76d31bb711f6c2a Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Referer https://www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/css/app.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 23 Feb 2021 12:11:42 GMT x-content-type-options nosniff last-modified Tue, 02 Feb 2021 02:00:03 GMT server Akamai Image Manager etag "dhhY3utDsCxd+2sX5XmaH0WADbsU4TzWhkD7AThom/c" strict-transport-security max-age=31536000 content-type image/webp cache-control private, no-transform, max-age=43200 content-length 2448 expires Wed, 24 Feb 2021 00:11:42 GMT
GET H2	200	PayPalSansBig-Light.woff www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/	48 KB 48 KB	88ms 49ms	Font application/x-font-woff	104.111.228.123 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/PayPalSansBig-Light.woff Requested by Host: www.paypalobjects.com URL: https://www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/css/app.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.228.123 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-228-123.deploy.static.akamaitechnologies.com Software Apache / Resource Hash c599c554590d1a336ffcb9627f6caaac34b6228f60e15f5f25454bff38facb7e Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Origin http://13.66.28.137 Referer https://www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/css/app.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 23 Feb 2021 12:11:42 GMT x-pad avoid browser bug x-content-type-options nosniff last-modified Wed, 30 Sep 2015 05:09:04 GMT server Apache vary Accept-Encoding content-type application/x-font-woff access-control-allow-origin * cache-control max-age=3600 strict-transport-security max-age=31536000 accept-ranges bytes content-length 49115 expires Tue, 23 Feb 2021 13:11:42 GMT
GET H2	200	PayPalSansSmall-Light.woff www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/	46 KB 46 KB	89ms 50ms	Font font/woff	104.111.228.123 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/PayPalSansSmall-Light.woff Requested by Host: www.paypalobjects.com URL: https://www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/css/app.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.228.123 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-228-123.deploy.static.akamaitechnologies.com Software / Resource Hash 843e67ad522a908162007f4b7601819a5bbfef00e38ac7aec778766da8b7b2ab Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Origin http://13.66.28.137 Referer https://www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/css/app.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 23 Feb 2021 12:11:42 GMT x-content-type-options nosniff last-modified Wed, 30 Sep 2015 05:09:04 GMT cache-control public, max-age=3600 etag "560b6e70-b66f" surrogate-control max-age=31536000 vary Accept-Encoding content-type font/woff access-control-allow-origin * paypal-debug-id 5c262e7fb56e0 strict-transport-security max-age=31536000 accept-ranges bytes dc slc-b-origin-www-1.paypal.com content-length 46703 expires Tue, 23 Feb 2021 13:11:42 GMT
GET H/1.1	200 OK	ts t.paypal.com/	42 B 846 B	265ms 182ms	Image image/gif	23.37.43.154 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://t.paypal.com/ts?v=1.4.30&t=1614082302440&g=-60&pgrp=main%3Aauthflow%3Aemailrecovery%3A%3Alist&page=main%3Aauthflow%3Aemailrecovery%3A%3Alist%3Anode%3A%3A&pgst=1614082301409&calc=937da7c38b20b&nsid=wj3ANnCKJUnLSJ_3QSl_PCnLl-khKAiX&rsta=en_US&pgtf=Nodejs&env=live&s=ci&ccpg=US&csci=41d2a2cfef68406eb4b4ea08a9b7cd1a&comp=authnodeweb&tsrce=authnodeweb&cu=0&ef_policy=ccpa&xe=100210%2C101021%2C101851%2C101935%2C101936%2C101960%2C102692&xt=102528%2C102961%2C107586%2C107594%2C107602%2C113422%2C110228&gccd=US&inline_experience=N&tmpl=authnodeweb%2Fpublic%2Ftemplates%2Fpages%2FemailRecovery%2FForgotEmail.js&e=im&pt=PayPal&cd=24&sw=1600&sh=1200&dw=1600&dh=1200&bw=1600&bh=1200&ce=1 Requested by Host: 13.66.28.137 URL: http://13.66.28.137/authflow/email-recovery/?country.x=us&amp Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 23.37.43.154 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-37-43-154.deploy.static.akamaitechnologies.com Software akka-http/10.1.11 / Resource Hash 6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93 Request headers Referer http://13.66.28.137/authflow/email-recovery/?country.x=us&amp User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Pragma no-cache Date Tue, 23 Feb 2021 12:11:42 GMT Server akka-http/10.1.11 P3P policyref="https://t.paypal.com/w3c/p3p.xml",CP="CAO IND OUR SAM UNI STA COR COM" HTTP_X_PP_AZ_LOCATOR slcb.slc Cache-Control max-age=0, no-cache, no-store Connection keep-alive Content-Type image/gif Content-Length 42 Expires Tue, 23 Feb 2021 12:11:42 GMT
GET H/1.1	200 OK	chat-meta Show response 13.66.28.137/smartchat/open/	9 KB 12 KB	240ms 240ms	XHR application/json	13.66.28.137
General Check archive.org Show headers Download Go to Full URL http://13.66.28.137/smartchat/open/chat-meta?app=authflow Requested by Host: www.paypalobjects.com URL: https://www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/js/app.js Protocol HTTP/1.1 Server 13.66.28.137 San Antonio, United States, ASN (), Reverse DNS Software nginx/1.4.6 (Ubuntu) / Resource Hash 9cda269ce040d86f56952536c066f2bcbc2162f930b5a1aa2dd943fb622e6be8 Security Headers Name Value Content-Security-Policy default-src 'self' https://*.paypal.com https://*.paypalobjects.com; script-src 'nonce-qrLmFv65dgIdj6jKkZ+y91ablHrQwSXqgSS7eKUei9klTTtV' 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline' ; style-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline' ; img-src 'self' https: data:; object-src 'none'; connect-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline' https://*.kampyle.com https://*.qualtrics.com; font-src 'self' https://*.paypal.com https://*.paypalobjects.com data:; base-uri 'self' https://*.paypal.com; form-action 'self' https://*.paypal.com; frame-ancestors 'self' https://help.venmo.com; block-all-mixed-content;; report-uri https://www.paypal.com/csplog/api/log/csp; frame-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; Strict-Transport-Security max-age=63072000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer http://13.66.28.137/authflow/email-recovery/?country.x=us&amp User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 X-Requested-With XMLHttpRequest Response headers Content-Security-Policy default-src 'self' https://*.paypal.com https://*.paypalobjects.com; script-src 'nonce-qrLmFv65dgIdj6jKkZ+y91ablHrQwSXqgSS7eKUei9klTTtV' 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline' ; style-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline' ; img-src 'self' https: data:; object-src 'none'; connect-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline' https://*.kampyle.com https://*.qualtrics.com; font-src 'self' https://*.paypal.com https://*.paypalobjects.com data:; base-uri 'self' https://*.paypal.com; form-action 'self' https://*.paypal.com; frame-ancestors 'self' https://help.venmo.com; block-all-mixed-content;; report-uri https://www.paypal.com/csplog/api/log/csp; frame-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; X-Content-Type-Options nosniff Server nginx/1.4.6 (Ubuntu) ETag W/"2483-UG+0tYDr3GvRMZv9TyF1png+ixU" Strict-Transport-Security max-age=63072000 Content-Type application/json; charset=utf-8 Paypal-Debug-Id e12bb995b8e0f Cache-Control max-age=0, no-cache, no-store, must-revalidate Date Tue, 23 Feb 2021 12:11:42 GMT Connection keep-alive DC ccg11-origin-www-1.paypal.com Content-Length 9347 X-Xss-Protection 1; mode=block
GET H/1.1	200 OK	ts t.paypal.com/	42 B 846 B	230ms 183ms	Image image/gif	23.37.43.154 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://t.paypal.com/ts?v=1.4.30&t=1614082302519&g=-60&e=err&page=main%3Aauthflow%3Aemailrecovery%3A%3Alist%3Anode%3A%3A&pgrp=main%3Aauthflow%3Aemailrecovery%3A%3Alist&comp=authnodeweb&erpg=data%20is%20not%20defined&error_type=WINDOW_ONERROR&error_description=ReferenceError%3A%20data%20is%20not%20defined%0A%20%20%20%20at%20_%2Frecaptchav3.js%3A1%3A6940%0A%20%20%20%20at%20_0x497b6f%20(_%2Frecaptchav3.js%3A1%3A3142)%0A%20%20%20%20at%20_0x3355a3%20(_%2Frecaptchav3.js%3A1%3A6974)%0A%20%20%20%20at%20_%2Frecaptchav3.js%3A1%3A10246%0A%20%20%20%20at%20_%2Frecaptchav3.js%3A1%3A10970&error_source=http%3A%2F%2F13.66.28.137%2Fauth%2Fcreatechallenge%2F7d313d57ff21bcad%2Frecaptchav3.js%201%3A6940 Requested by Host: 13.66.28.137 URL: http://13.66.28.137/authflow/email-recovery/?country.x=us&amp Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 23.37.43.154 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-37-43-154.deploy.static.akamaitechnologies.com Software akka-http/10.1.11 / Resource Hash 6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93 Request headers Referer http://13.66.28.137/authflow/email-recovery/?country.x=us&amp User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Pragma no-cache Date Tue, 23 Feb 2021 12:11:42 GMT Server akka-http/10.1.11 P3P policyref="https://t.paypal.com/w3c/p3p.xml",CP="CAO IND OUR SAM UNI STA COR COM" HTTP_X_PP_AZ_LOCATOR slcb.slc Cache-Control max-age=0, no-cache, no-store Connection keep-alive Content-Type image/gif Content-Length 42 Expires Tue, 23 Feb 2021 12:11:42 GMT
GET H/1.1	200 OK	ts t.paypal.com/	42 B 846 B	249ms 203ms	Image image/gif	23.37.43.154 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://t.paypal.com/ts?v=1.4.30&t=1614082302520&g=-60&pgrp=main%3Aprivacy%3Apolicy&page=main%3Aprivacy%3Apolicy%3Accpa&pgst=1614082301409&calc=937da7c38b20b&nsid=wj3ANnCKJUnLSJ_3QSl_PCnLl-khKAiX&rsta=en_US&pgtf=Nodejs&env=live&s=ci&ccpg=US&csci=41d2a2cfef68406eb4b4ea08a9b7cd1a&comp=authnodeweb&tsrce=authnodeweb&cu=0&ef_policy=ccpa&xe=100210%2C101021%2C101851%2C101935%2C101936%2C101960%2C102692&xt=102528%2C102961%2C107586%2C107594%2C107602%2C113422%2C110228&gccd=US&inline_experience=N&tmpl=authnodeweb%2Fpublic%2Ftemplates%2Fpages%2FemailRecovery%2FForgotEmail.js&displayPage=main%3Aauthflow%3Aemailrecovery%3A%3Alist&ppage=privacy_banner&bannerType=cookiebanner&flag=ccpa&bannerVersion=v3a&bannerSource=ConsentNodeServ&e=ac Requested by Host: 13.66.28.137 URL: http://13.66.28.137/authflow/email-recovery/?country.x=us&amp Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 23.37.43.154 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-37-43-154.deploy.static.akamaitechnologies.com Software akka-http/10.1.11 / Resource Hash 6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93 Request headers Referer http://13.66.28.137/authflow/email-recovery/?country.x=us&amp User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Pragma no-cache Date Tue, 23 Feb 2021 12:11:42 GMT Server akka-http/10.1.11 P3P policyref="https://t.paypal.com/w3c/p3p.xml",CP="CAO IND OUR SAM UNI STA COR COM" HTTP_X_PP_AZ_LOCATOR slcb.slc Cache-Control max-age=0, no-cache, no-store Connection keep-alive Content-Type image/gif Content-Length 42 Expires Tue, 23 Feb 2021 12:11:42 GMT
GET H2	200	messaging-bot.js Show response www.paypalobjects.com/messaging/auth/v2/	377 KB 116 KB	39ms 29ms	Script application/javascript	104.111.228.123 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://www.paypalobjects.com/messaging/auth/v2/messaging-bot.js Requested by Host: www.paypalobjects.com URL: https://www.paypalobjects.com/messaging/auth/v1/messaging-opener-mts.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.228.123 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-228-123.deploy.static.akamaitechnologies.com Software / Resource Hash b01f45a4d98c8537aaa95ba16a8a6200e32cb08339a0a88cba683e8f90b51881 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Referer http://13.66.28.137/authflow/email-recovery/?country.x=us&amp User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 23 Feb 2021 12:11:42 GMT content-encoding gzip x-content-type-options nosniff surrogate-control max-age=31536000 paypal-debug-id 48eac8fe54fdd dc ccg11-origin-www-1.paypal.com vary Accept-Encoding content-length 117697 last-modified Wed, 04 Nov 2020 17:04:45 GMT etag W/"5fa2df2d-5e241" strict-transport-security max-age=31536000 access-control-allow-methods GET content-type application/javascript access-control-allow-origin * cache-control max-age=3600 expires Tue, 23 Feb 2021 13:11:42 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial)

29 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| trustedTypes boolean| crossOriginIsolated function| bindGdprEvents object| core object| __core-js_shared__ object| global object| System function| asap function| Observable function| setImmediate function| clearImmediate object| regeneratorRuntime boolean| _babelPolyfill object| IntlPolyfill object| PDFJS object| PAYPAL object| fpti string| fptiserverurl object| dataLayer object| _ifpti function| openChatUtils object| _0x5755 function| _0x1835 function| hideGdprBanner function| showGdprBanner object| mtsChat

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	default-src 'self' https://*.paypal.com https://*.paypalobjects.com; script-src 'nonce-BPdGlR8y+G2XfMFZPuF0DEBOZcBWozNK2U1KQZTE2p42y6XT' 'self' 'unsafe-inline' 'unsafe-eval' https://*.paypal.com https://*.paypalobjects.com; img-src 'self' data: https:; object-src 'none'; media-src data: blob: 'self' https://*.paypal.com https://*.paypalobjects.com; font-src 'self' https://*.paypal.com https://*.paypalobjects.com; style-src 'self' 'unsafe-inline' https://*.paypal.com https://*.paypalobjects.com; frame-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; child-src 'self' https://*.paypal.com https://*.paypalobjects.com; connect-src 'self' https://*.paypal.com https://*.paypalobjects.com https://nexus.ensighten.com https://*.google-analytics.com https://*.qualtrics.com; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; block-all-mixed-content;; report-uri https://www.paypal.com/csplog/api/log/csp
Strict-Transport-Security	max-age=63072000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

t.paypal.com
www.paypalobjects.com
104.111.228.123
13.66.28.137
23.37.43.154
0eb22afbab03bbbd8a47d4fc5361ff7518a77273e99fd0b73e235c93dd6ea7aa
13f10ed9965f23fd804cd3816114e9eff0cd851a0145dd2ca1bfe57ff1e3ce3b
6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93
843e67ad522a908162007f4b7601819a5bbfef00e38ac7aec778766da8b7b2ab
9cda269ce040d86f56952536c066f2bcbc2162f930b5a1aa2dd943fb622e6be8
ae79dcc3eb016922caa1d095cfd936446bc65a46bb3364b242dfc556f7e3c6a8
b01f45a4d98c8537aaa95ba16a8a6200e32cb08339a0a88cba683e8f90b51881
b8a64feb2ac3ff5520a3c16afc2e56e8d1189e272a21c5e45c79122b93281e67
bbe3177aa5d225f117aea0e2eeb27f11d853a33d6d162733c5be8b1de8d36dc5
bcdf050ce6625609e7a3e64f52f1650e7a79abc12a9c7e712fe2b9cfd808e977
be5c4f71eea822cbdcaefcf92963ab573e903f75a60b8bc0793e4eec935a1187
c599c554590d1a336ffcb9627f6caaac34b6228f60e15f5f25454bff38facb7e
da775dd10f868447dea4c3522fb3b55bd4a5df650d3f2233a76d31bb711f6c2a
e00ab4867c277813a14fbbc89e0b52b2a96060287669cdd6262f539614b97fcb
f39646ccd4fbf32d475bed59e8c5a1f18208da3d23783672d095273e4e91a7dc