![](/screenshots/8e782904-0c32-41b3-bacd-7494f1ba19a8.png)
52.70.129.120
Open in
urlscan Pro
52.70.129.120
Malicious Activity!
Public Scan
Effective URL: http://52.70.129.120/js/.wp.php/rf/myaccount/21d7d/home?cmd=_account-details&session=fe92be646665b4c2dd635d0ac6f6253a...
Submission: On March 30 via automatic, source openphish
Summary
This is the only time 52.70.129.120 was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: PayPal (Financial)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 15 | 52.70.129.120 52.70.129.120 | 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com) | |
3 | 2.18.233.20 2.18.233.20 | 16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies) | |
1 | 104.108.64.175 104.108.64.175 | 16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies) | |
17 | 3 |
ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-52-70-129-120.compute-1.amazonaws.com
52.70.129.120 |
ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
www.paypalobjects.com |
ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-108-64-175.deploy.static.akamaitechnologies.com
t.paypal.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
3 |
paypalobjects.com
www.paypalobjects.com |
109 KB |
1 |
paypal.com
t.paypal.com |
728 B |
17 | 2 |
Domain | Requested by | |
---|---|---|
3 | www.paypalobjects.com |
52.70.129.120
|
1 | t.paypal.com | |
17 | 2 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.paypal.com |
Subject Issuer | Validity | Valid |
---|
This page contains 1 frames:
Primary Page:
http://52.70.129.120/js/.wp.php/rf/myaccount/21d7d/home?cmd=_account-details&session=fe92be646665b4c2dd635d0ac6f6253a&dispatch=6573b8526352bb3d252123616502fce810010c5d
Frame ID: 5000FA4DAB5C3FBF903FCCA92BE58BCB
Requests: 17 HTTP requests in this frame
Screenshot
![](/screenshots/8e782904-0c32-41b3-bacd-7494f1ba19a8.png)
Page URL History Show full URLs
-
http://52.70.129.120/js/.wp.php/rf/myaccount/21d7d
HTTP 301
http://52.70.129.120/js/.wp.php/rf/myaccount/21d7d/ HTTP 302
http://52.70.129.120/js/.wp.php/rf/myaccount/21d7d/home?cmd=_account-details&session=fe92be646665... Page URL
Detected technologies
Detected patterns
- headers server /\(Amazon\)/i
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
Detected patterns
- env /^PAYPAL$/i
![](/vendor/wappa/icons/RequireJS.png)
Detected patterns
- script /require.*\.js/i
- env /^requirejs$/i
![](/vendor/wappa/icons/SiteCatalyst.png)
Detected patterns
- env /^s_(?:account|objectID|code|INST)$/i
Detected patterns
- env /^jQuery$/i
Page Statistics
2 Outgoing links
These are links going to different origins than the main page.
Title: Log out
Search URL Search Domain Scan URL
Title: Legal
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://52.70.129.120/js/.wp.php/rf/myaccount/21d7d
HTTP 301
http://52.70.129.120/js/.wp.php/rf/myaccount/21d7d/ HTTP 302
http://52.70.129.120/js/.wp.php/rf/myaccount/21d7d/home?cmd=_account-details&session=fe92be646665b4c2dd635d0ac6f6253a&dispatch=6573b8526352bb3d252123616502fce810010c5d Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
17 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
home
52.70.129.120/js/.wp.php/rf/myaccount/21d7d/ Redirect Chain
|
10 KB 10 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
app.css
52.70.129.120/js/.wp.php/rf/Suspicious_files/ |
172 KB 172 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
app.js
52.70.129.120/js/.wp.php/rf/Suspicious_files/ |
382 KB 382 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
config.js
52.70.129.120/js/.wp.php/rf/Suspicious_files/ |
600 B 860 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
activity.js
52.70.129.120/js/.wp.php/rf/Suspicious_files/ |
1 B 257 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
translateelement.css
52.70.129.120/js/.wp.php/rf/Suspicious_files/ |
17 KB 18 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo_paypal_106x29.png
52.70.129.120/js/.wp.php/rf/Suspicious_files/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
peek-shield-logo.png
52.70.129.120/js/.wp.php/rf/Suspicious_files/ |
4 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
require-spinner.js
52.70.129.120/js/.wp.php/rf/Suspicious_files/ |
6 KB 6 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
require.js
52.70.129.120/js/.wp.php/rf/Suspicious_files/ |
15 KB 15 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
pp_jscode_080706.js
52.70.129.120/js/.wp.php/rf/Suspicious_files/ |
60 KB 61 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
pa.js
52.70.129.120/js/.wp.php/rf/Suspicious_files/ |
66 KB 67 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
translate_24dp.png
52.70.129.120/js/.wp.php/rf/Suspicious_files/ |
825 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
app.js
www.paypalobjects.com/web/res/7a7/dd87ef7a2afbb69dece5be488ad19/js/ |
382 KB 108 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
config.js
www.paypalobjects.com/web/res/7a7/dd87ef7a2afbb69dece5be488ad19/js/ |
600 B 813 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
activity.js
www.paypalobjects.com/web/res/7a7/dd87ef7a2afbb69dece5be488ad19/js/view/s12n/ato/ |
1 B 213 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ts
t.paypal.com/ |
42 B 728 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: PayPal (Financial)32 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| RequireSpinners function| Spinner function| requirejs function| require function| define function| $ function| jQuery object| dust object| jQuery111006232959013000032 object| jQuery111008895311543039175 string| sc_code_ver string| s_account object| s function| s_doPlugins string| s_code undefined| s_objectID function| s_gi function| s_giqf string| s_an function| s_sp function| s_jn function| s_rep function| s_d function| s_fe function| s_fa function| s_ft object| s_c_il number| s_c_in number| s_giq object| PAYPAL object| fpti string| fptiserverurl1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
52.70.129.120/ | Name: s_sess Value: %20s_ppv%3D100%3B |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
t.paypal.com
www.paypalobjects.com
104.108.64.175
2.18.233.20
52.70.129.120
05b3965cbe7889bbba309939196020bc0d3d935a5d185d82f7df429f389f9696
0a8c7553b10d35e2a00d78f83fe564c11d92deca635cda10580766b51ac47fd9
1bb2279aed6bc1438d2b17a5ffcbac9d37864582aedeeec8d301eab162b2c213
417c9a56495a1a8c7022f358df0f3c265f6d5e7eb2a3452a5f52cb5b7983bf4c
41b805ea7ac014e23556e98bb374702a08344268f92489a02f0880849394a1e4
66b7c0f3cc9387c53f657204395c181772a68c0029ae4251c355e398f9711c3b
6c24e9fc3844d713e81e8182d435b1ec16df0b291e559742c5842f995b2e0498
6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93
89b95375e63b25663cc6e1c7304acc78439a961f9be4d3b7810fe50d57eb3f76
98ecaad59fce14516bd1c79d6361e1f798a6cf3d077b68b5807adc153c5fb389
9bbf1ce51d9751054757ff383e410a379a4b1ee26527334f4add83fbfba1d36c
9c0821da2aee265221ce1c392604dd4b0901e2f671b87c6c7d141e8f698d4ca7
ab39e6288837a25d62b740906db369081f38978b23570148c28ed41f509d4fe2
c007d73792ac2d25882bfbb573e700e721a0adacfab947e6a0b64a61991fecf0