13.66.28.137 Open in urlscan Pro
13.66.28.137  Malicious Activity! Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Cookie set / Show response 13.66.28.137/authflow/email-recovery/	59 KB 19 KB	485ms 466ms	Document text/html	13.66.28.137 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL http://13.66.28.137/authflow/email-recovery/?amp&amp Protocol HTTP/1.1 Server 13.66.28.137 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software nginx/1.4.6 (Ubuntu) / Resource Hash 461cc7e88a31b42a317cbe9fac3f4b38b7cebc8152faeda16787807f96c1db37 Security Headers Name Value Content-Security-Policy default-src 'self' https://*.paypal.com https://*.paypalobjects.com; script-src 'nonce-0XdKMaBpalUATRSbfvjHIfajwCSjL2/mQNVNLBBK1Ro/1DdL' 'self' 'unsafe-inline' 'unsafe-eval' https://*.paypal.com https://*.paypalobjects.com; img-src 'self' data: https:; object-src 'none'; media-src data: blob: 'self' https://*.paypal.com https://*.paypalobjects.com; font-src 'self' https://*.paypal.com https://*.paypalobjects.com; style-src 'self' 'unsafe-inline' https://*.paypal.com https://*.paypalobjects.com; frame-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; child-src 'self' https://*.paypal.com https://*.paypalobjects.com; connect-src 'self' https://*.paypal.com https://*.paypalobjects.com https://nexus.ensighten.com https://*.google-analytics.com https://*.qualtrics.com; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; block-all-mixed-content;; report-uri https://www.paypal.com/csplog/api/log/csp Strict-Transport-Security max-age=63072000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Host 13.66.28.137 Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Server nginx/1.4.6 (Ubuntu) Date Tue, 23 Feb 2021 17:10:37 GMT Content-Type text/html; charset=utf-8 Content-Length 16795 Connection keep-alive Cache-Control max-age=0, no-cache, no-store, must-revalidate Content-Security-Policy default-src 'self' https://*.paypal.com https://*.paypalobjects.com; script-src 'nonce-0XdKMaBpalUATRSbfvjHIfajwCSjL2/mQNVNLBBK1Ro/1DdL' 'self' 'unsafe-inline' 'unsafe-eval' https://*.paypal.com https://*.paypalobjects.com; img-src 'self' data: https:; object-src 'none'; media-src data: blob: 'self' https://*.paypal.com https://*.paypalobjects.com; font-src 'self' https://*.paypal.com https://*.paypalobjects.com; style-src 'self' 'unsafe-inline' https://*.paypal.com https://*.paypalobjects.com; frame-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; child-src 'self' https://*.paypal.com https://*.paypalobjects.com; connect-src 'self' https://*.paypal.com https://*.paypalobjects.com https://nexus.ensighten.com https://*.google-analytics.com https://*.qualtrics.com; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; block-all-mixed-content;; report-uri https://www.paypal.com/csplog/api/log/csp ETag W/"eba9-AdppvyIq6tXGMYIISGrj/x00vGY" Paypal-Debug-Id 4f697cb594a0f X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block DC phx-origin-www-1.paypal.com Vary Accept-Encoding Content-Encoding gzip Set-Cookie enforce_policy=ccpa; Max-Age=31536000; Domain=.paypal.com; Path=/; Expires=Wed, 23 Feb 2022 17:10:37 GMT; Secure; SameSite=None LANG=en_US%3BUS; Max-Age=31556; Domain=.paypal.com; Path=/; Expires=Wed, 24 Feb 2021 01:56:33 GMT; HttpOnly; Secure; SameSite=None tsrce=authnodeweb; Max-Age=259199; Domain=.paypal.com; Path=/; Expires=Fri, 26 Feb 2021 17:10:36 GMT; HttpOnly; Secure; SameSite=None x-pp-s=eyJ0IjoiMTYxNDEwMDIzNzIyNSIsImwiOiIwIiwibSI6IjAifQ; Domain=.paypal.com; Path=/; HttpOnly; Secure; SameSite=None nsid=s%3AUciQceggrvCfzyMBPtdxbj-FWCVnmycd.B5LRBCEuT0S0nHrhhpfaBc%2BCLjgnMyry8YfcN%2FMrQ60; Path=/; HttpOnly; Secure; SameSite=None l7_az=dcg02.phx; Path=/; Domain=paypal.com; Expires=Tue, 23 Feb 2021 17:40:37 GMT; HttpOnly; Secure; SameSite=None ts=vreXpYrS%3D1708708237%26vteXpYrS%3D1614102037%26vr%3Dcfdf0b3e1770a1d2c896d909f9f9f318%26vt%3Dcfdf0b3e1770a1d2c896d909f9f9f317%26vtyp%3Dnew; Path=/; Domain=paypal.com; Expires=Fri, 23 Feb 2024 17:10:37 GMT; HttpOnly; Secure; SameSite=None ts_c=vr%3Dcfdf0b3e1770a1d2c896d909f9f9f318%26vt%3Dcfdf0b3e1770a1d2c896d909f9f9f317; Path=/; Domain=paypal.com; Expires=Fri, 23 Feb 2024 17:10:37 GMT; Secure; SameSite=None x-cdn=akamai; path=/; domain=.paypal.com; secure akavpau_ppsd=1614100837~id=ba78a42de7853547b4dddceb1abac2ef; Domain=www.paypal.com; Path=/; HttpOnly; Secure; SameSite=None Strict-Transport-Security max-age=63072000
GET H2	200	app.css www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/css/	134 KB 20 KB	135ms 37ms	Stylesheet text/css	2.18.232.75
General Check archive.org Show headers Download Go to Full URL https://www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/css/app.css Requested by Host: 13.66.28.137 URL: http://13.66.28.137/authflow/email-recovery/?amp&amp Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.18.232.75 Frankfurt am Main, Germany, ASN (), Reverse DNS a2-18-232-75.deploy.static.akamaitechnologies.com Software / Resource Hash e00ab4867c277813a14fbbc89e0b52b2a96060287669cdd6262f539614b97fcb Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Referer http://13.66.28.137/authflow/email-recovery/?amp&amp User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 23 Feb 2021 17:10:37 GMT content-encoding gzip x-content-type-options nosniff surrogate-control max-age=31536000 paypal-debug-id 77a340fb4bae dc ccg11-origin-www-1.paypal.com vary Accept-Encoding content-length 19786 last-modified Thu, 11 Feb 2021 00:43:48 GMT etag W/"60247dc4-2188e" strict-transport-security max-age=31536000 access-control-allow-methods GET content-type text/css access-control-allow-origin * cache-control max-age=31536000 expires Wed, 23 Feb 2022 17:10:37 GMT
GET H2	200	app.js Show response www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/js/	3 MB 726 KB	155ms 56ms	Script application/javascript	2.18.232.75
General Check archive.org Show headers Download Go to Full URL https://www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/js/app.js Requested by Host: 13.66.28.137 URL: http://13.66.28.137/authflow/email-recovery/?amp&amp Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.18.232.75 Frankfurt am Main, Germany, ASN (), Reverse DNS a2-18-232-75.deploy.static.akamaitechnologies.com Software / Resource Hash f39646ccd4fbf32d475bed59e8c5a1f18208da3d23783672d095273e4e91a7dc Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Referer http://13.66.28.137/authflow/email-recovery/?amp&amp User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 23 Feb 2021 17:10:37 GMT content-encoding gzip x-content-type-options nosniff surrogate-control max-age=31536000 paypal-debug-id 7365bc2b8fe33 dc ccg11-origin-www-3.paypal.com vary Accept-Encoding content-length 741072 last-modified Thu, 11 Feb 2021 00:43:48 GMT etag W/"60247dc4-28f32c" strict-transport-security max-age=31536000 access-control-allow-methods GET content-type application/javascript access-control-allow-origin * cache-control max-age=31536000 access-control-allow-headers x-csrf-token expires Wed, 23 Feb 2022 17:10:37 GMT
GET H2	200	pa.js Show response www.paypalobjects.com/pa/js/	52 KB 20 KB	155ms 57ms	Script application/javascript	2.18.232.75
General Check archive.org Show headers Download Go to Full URL https://www.paypalobjects.com/pa/js/pa.js Requested by Host: 13.66.28.137 URL: http://13.66.28.137/authflow/email-recovery/?amp&amp Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.18.232.75 Frankfurt am Main, Germany, ASN (), Reverse DNS a2-18-232-75.deploy.static.akamaitechnologies.com Software / Resource Hash 0eb22afbab03bbbd8a47d4fc5361ff7518a77273e99fd0b73e235c93dd6ea7aa Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Referer http://13.66.28.137/authflow/email-recovery/?amp&amp User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 23 Feb 2021 17:10:37 GMT content-encoding gzip x-content-type-options nosniff surrogate-control max-age=31536000 paypal-debug-id 74fa405ca849f dc slc-b-origin-www-2.paypal.com vary Accept-Encoding content-length 20130 last-modified Thu, 18 Feb 2021 06:57:36 GMT etag W/"602e0fe0-cfcb" strict-transport-security max-age=31536000 access-control-allow-methods GET content-type application/javascript access-control-allow-origin * cache-control public, max-age=3600 access-control-allow-headers x-csrf-token expires Tue, 23 Feb 2021 18:10:37 GMT
GET H2	200	bs.js Show response www.paypalobjects.com/tagmgmt/	19 B 374 B	171ms 73ms	Script application/javascript	2.18.232.75
General Check archive.org Show headers Download Go to Full URL https://www.paypalobjects.com/tagmgmt/bs.js Requested by Host: 13.66.28.137 URL: http://13.66.28.137/authflow/email-recovery/?amp&amp Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.18.232.75 Frankfurt am Main, Germany, ASN (), Reverse DNS a2-18-232-75.deploy.static.akamaitechnologies.com Software / Resource Hash be5c4f71eea822cbdcaefcf92963ab573e903f75a60b8bc0793e4eec935a1187 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Referer http://13.66.28.137/authflow/email-recovery/?amp&amp User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 23 Feb 2021 17:10:37 GMT x-content-type-options nosniff surrogate-control max-age=31536000 paypal-debug-id beed56fe117b4 dc ccg11-origin-www-3.paypal.com vary Accept-Encoding content-length 19 last-modified Thu, 01 Oct 2020 22:15:27 GMT etag "5f7654ff-13" strict-transport-security max-age=31536000 access-control-allow-methods GET content-type application/javascript access-control-allow-origin * cache-control max-age=3600 accept-ranges bytes access-control-allow-headers x-csrf-token expires Tue, 23 Feb 2021 18:10:37 GMT
GET H2	200	messaging-opener-mts.js Show response www.paypalobjects.com/messaging/auth/v1/	3 KB 1 KB	175ms 77ms	Script application/javascript	2.18.232.75
General Check archive.org Show headers Download Go to Full URL https://www.paypalobjects.com/messaging/auth/v1/messaging-opener-mts.js Requested by Host: 13.66.28.137 URL: http://13.66.28.137/authflow/email-recovery/?amp&amp Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.18.232.75 Frankfurt am Main, Germany, ASN (), Reverse DNS a2-18-232-75.deploy.static.akamaitechnologies.com Software / Resource Hash bcdf050ce6625609e7a3e64f52f1650e7a79abc12a9c7e712fe2b9cfd808e977 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Referer http://13.66.28.137/authflow/email-recovery/?amp&amp User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 23 Feb 2021 17:10:37 GMT content-encoding gzip x-content-type-options nosniff surrogate-control max-age=31536000 paypal-debug-id b67d6edeb53a5 dc slc-b-origin-www-3.paypal.com vary Accept-Encoding content-length 1081 last-modified Thu, 01 Oct 2020 22:15:16 GMT etag W/"5f7654f4-b7b" strict-transport-security max-age=31536000 access-control-allow-methods GET content-type application/javascript access-control-allow-origin * cache-control max-age=3600 expires Tue, 23 Feb 2021 18:10:37 GMT
GET H/1.1	200 OK	recaptchav3.js Show response 13.66.28.137/auth/createchallenge/1ec2dede153ae3fe/	11 KB 12 KB	174ms 174ms	Script text/javascript	13.66.28.137 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL http://13.66.28.137/auth/createchallenge/1ec2dede153ae3fe/recaptchav3.js Requested by Host: 13.66.28.137 URL: http://13.66.28.137/authflow/email-recovery/?amp&amp Protocol HTTP/1.1 Server 13.66.28.137 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software nginx/1.4.6 (Ubuntu) / Resource Hash 1f9fbee4b224290bef89c6355c7142213d09f9a50ca5c3ecfc242e8068115fe1 Security Headers Name Value Content-Security-Policy default-src 'self' https://*.paypal.com https://*.paypalobjects.com; script-src 'nonce-O3kwcAR9tMTMjrM48G35zkWhyHRiBoKw9mrtJO/oBCk+RIN2' 'self' https://*.paypal.com https://*.paypalobjects.com https://www.recaptcha.net https://www.gstatic.com 'unsafe-inline'; img-src https://*.paypalobjects.com https://*.paypal.com https://ak1s.abmr.net https://ak1.abmr.net https://ak1s.mathtag.com https://akamai.mathtag.com; object-src 'none'; media-src 'self' https://*.paypal.com https://*.paypalobjects.com; font-src 'self' https://*.paypal.com https://*.paypalobjects.com; frame-src 'self' https://*.paypal.com https://*.paypalobjects.com https://www.google.com https://www.recaptcha.net https://*.qualtrics.com; style-src 'self' 'unsafe-inline' https://*.paypal.com https://*.paypalobjects.com; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; block-all-mixed-content;; report-uri https://www.paypal.com/csplog/api/log/csp; connect-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; Strict-Transport-Security max-age=63072000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer http://13.66.28.137/authflow/email-recovery/?amp&amp User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Security-Policy default-src 'self' https://*.paypal.com https://*.paypalobjects.com; script-src 'nonce-O3kwcAR9tMTMjrM48G35zkWhyHRiBoKw9mrtJO/oBCk+RIN2' 'self' https://*.paypal.com https://*.paypalobjects.com https://www.recaptcha.net https://www.gstatic.com 'unsafe-inline'; img-src https://*.paypalobjects.com https://*.paypal.com https://ak1s.abmr.net https://ak1.abmr.net https://ak1s.mathtag.com https://akamai.mathtag.com; object-src 'none'; media-src 'self' https://*.paypal.com https://*.paypalobjects.com; font-src 'self' https://*.paypal.com https://*.paypalobjects.com; frame-src 'self' https://*.paypal.com https://*.paypalobjects.com https://www.google.com https://www.recaptcha.net https://*.qualtrics.com; style-src 'self' 'unsafe-inline' https://*.paypal.com https://*.paypalobjects.com; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; block-all-mixed-content;; report-uri https://www.paypal.com/csplog/api/log/csp; connect-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; X-Content-Type-Options nosniff Server nginx/1.4.6 (Ubuntu) ETag W/"2af4-nOsGDzzZ5n/trda5Lv+wehPP1v4" Strict-Transport-Security max-age=63072000 Content-Type text/javascript; charset=utf-8 Paypal-Debug-Id a1e5e7b3e103c Cache-Control max-age=0, no-cache, no-store, must-revalidate Date Tue, 23 Feb 2021 17:10:37 GMT Connection keep-alive DC phx-origin-www-1.paypal.com Content-Length 10996 X-Xss-Protection 1; mode=block
GET H2	200	monogram@2x.png www.paypalobjects.com/images/shared/	1 KB 2 KB	78ms 77ms	Image image/png	2.18.232.75
General Check archive.org Show headers Download Go to Show image Full URL https://www.paypalobjects.com/images/shared/monogram@2x.png Requested by Host: www.paypalobjects.com URL: https://www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/css/app.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.18.232.75 Frankfurt am Main, Germany, ASN (), Reverse DNS a2-18-232-75.deploy.static.akamaitechnologies.com Software Akamai Image Manager / Resource Hash bbe3177aa5d225f117aea0e2eeb27f11d853a33d6d162733c5be8b1de8d36dc5 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Referer https://www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/css/app.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 23 Feb 2021 17:10:37 GMT x-content-type-options nosniff last-modified Wed, 06 Jan 2021 02:00:50 GMT server Akamai Image Manager etag "tu4IksQhsaBV1ddsYvtwjxUD2qmVV7SZmLo7q4XSXU0" strict-transport-security max-age=31536000 content-type image/png cache-control private, max-age=722954 content-length 1507 expires Thu, 04 Mar 2021 01:59:51 GMT
GET H2	200	PayPalSansSmall-Regular.woff www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/	46 KB 47 KB	106ms 35ms	Font font/woff	2.18.232.75
General Check archive.org Show headers Download Go to Full URL https://www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/PayPalSansSmall-Regular.woff Requested by Host: www.paypalobjects.com URL: https://www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/css/app.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.18.232.75 Frankfurt am Main, Germany, ASN (), Reverse DNS a2-18-232-75.deploy.static.akamaitechnologies.com Software / Resource Hash ae79dcc3eb016922caa1d095cfd936446bc65a46bb3364b242dfc556f7e3c6a8 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Origin http://13.66.28.137 Referer https://www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/css/app.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 23 Feb 2021 17:10:37 GMT x-content-type-options nosniff last-modified Wed, 30 Sep 2015 05:09:04 GMT cache-control public, max-age=3600 etag "560b6e70-b8eb" surrogate-control max-age=31536000 vary Accept-Encoding content-type font/woff access-control-allow-origin * paypal-debug-id 4a7de1e0fffbd strict-transport-security max-age=31536000 accept-ranges bytes dc slc-b-origin-www-1.paypal.com content-length 47339 expires Tue, 23 Feb 2021 18:10:37 GMT
GET H2	200	animation-oval.png www.paypalobjects.com/images/shared/	2 KB 3 KB	70ms 70ms	Image image/webp	2.18.232.75
General Check archive.org Show headers Download Go to Show image Full URL https://www.paypalobjects.com/images/shared/animation-oval.png Requested by Host: www.paypalobjects.com URL: https://www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/css/app.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.18.232.75 Frankfurt am Main, Germany, ASN (), Reverse DNS a2-18-232-75.deploy.static.akamaitechnologies.com Software Akamai Image Manager / Resource Hash da775dd10f868447dea4c3522fb3b55bd4a5df650d3f2233a76d31bb711f6c2a Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Referer https://www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/css/app.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 23 Feb 2021 17:10:37 GMT x-content-type-options nosniff last-modified Tue, 02 Feb 2021 02:00:03 GMT server Akamai Image Manager etag "dhhY3utDsCxd+2sX5XmaH0WADbsU4TzWhkD7AThom/c" strict-transport-security max-age=31536000 content-type image/webp cache-control private, no-transform, max-age=43200 content-length 2448 expires Wed, 24 Feb 2021 05:10:37 GMT
GET H2	200	PayPalSansBig-Light.woff www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/	48 KB 48 KB	134ms 70ms	Font application/x-font-woff	2.18.232.75
General Check archive.org Show headers Download Go to Full URL https://www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/PayPalSansBig-Light.woff Requested by Host: www.paypalobjects.com URL: https://www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/css/app.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.18.232.75 Frankfurt am Main, Germany, ASN (), Reverse DNS a2-18-232-75.deploy.static.akamaitechnologies.com Software Apache / Resource Hash c599c554590d1a336ffcb9627f6caaac34b6228f60e15f5f25454bff38facb7e Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Origin http://13.66.28.137 Referer https://www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/css/app.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 23 Feb 2021 17:10:37 GMT x-pad avoid browser bug x-content-type-options nosniff last-modified Wed, 30 Sep 2015 05:09:04 GMT server Apache vary Accept-Encoding content-type application/x-font-woff access-control-allow-origin * cache-control max-age=3600 strict-transport-security max-age=31536000 accept-ranges bytes content-length 49115 expires Tue, 23 Feb 2021 18:10:37 GMT
GET H2	200	PayPalSansSmall-Light.woff www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/	46 KB 46 KB	134ms 70ms	Font font/woff	2.18.232.75
General Check archive.org Show headers Download Go to Full URL https://www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/PayPalSansSmall-Light.woff Requested by Host: www.paypalobjects.com URL: https://www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/css/app.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.18.232.75 Frankfurt am Main, Germany, ASN (), Reverse DNS a2-18-232-75.deploy.static.akamaitechnologies.com Software / Resource Hash 843e67ad522a908162007f4b7601819a5bbfef00e38ac7aec778766da8b7b2ab Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Origin http://13.66.28.137 Referer https://www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/css/app.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 23 Feb 2021 17:10:37 GMT x-content-type-options nosniff last-modified Wed, 30 Sep 2015 05:09:04 GMT cache-control public, max-age=3600 etag "560b6e70-b66f" surrogate-control max-age=31536000 vary Accept-Encoding content-type font/woff access-control-allow-origin * paypal-debug-id 5c262e7fb56e0 strict-transport-security max-age=31536000 accept-ranges bytes dc slc-b-origin-www-1.paypal.com content-length 46703 expires Tue, 23 Feb 2021 18:10:37 GMT
GET H2	200	ts t.paypal.com/	42 B 404 B	301ms 187ms	Image image/gif	151.101.129.35 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://t.paypal.com/ts?v=1.4.30&t=1614100237906&g=-60&pgrp=main%3Aauthflow%3Aemailrecovery%3A%3Alist&page=main%3Aauthflow%3Aemailrecovery%3A%3Alist%3Anode%3A%3A&pgst=1614100237124&calc=4f697cb594a0f&nsid=UciQceggrvCfzyMBPtdxbj-FWCVnmycd&rsta=en_US&pgtf=Nodejs&env=live&s=ci&ccpg=US&csci=22bc3f8a746441ab942ce2e6bfa26399&comp=authnodeweb&tsrce=authnodeweb&cu=0&ef_policy=ccpa&xe=101021%2C101851%2C101935%2C101936%2C101960%2C102692&xt=102961%2C107586%2C107594%2C107602%2C113422%2C110228&gccd=US&inline_experience=N&tmpl=authnodeweb%2Fpublic%2Ftemplates%2Fpages%2FemailRecovery%2FForgotEmail.js&e=im&pt=PayPal&cd=24&sw=1600&sh=1200&dw=1600&dh=1200&bw=1600&bh=1200&ce=1 Requested by Host: 13.66.28.137 URL: http://13.66.28.137/authflow/email-recovery/?amp&amp Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.129.35 , United States, ASN54113 (FASTLY, US), Reverse DNS Software akka-http/10.1.11 / Resource Hash 6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93 Request headers Referer http://13.66.28.137/authflow/email-recovery/?amp&amp User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Tue, 23 Feb 2021 17:10:38 GMT via 1.1 varnish server akka-http/10.1.11 x-timer S1614100238.041782,VS0,VE160 x-cache MISS p3p policyref="https://t.paypal.com/w3c/p3p.xml",CP="CAO IND OUR SAM UNI STA COR COM" expires Tue, 23 Feb 2021 17:10:38 GMT cache-control no-cache, no-store, max-age=0, no-transform x-cache-hits 0 accept-ranges bytes content-type image/gif content-length 42 x-served-by cache-hhn4052-HHN
GET H/1.1	200 OK	chat-meta Show response 13.66.28.137/smartchat/open/	9 KB 12 KB	303ms 302ms	XHR application/json	13.66.28.137 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL http://13.66.28.137/smartchat/open/chat-meta?app=authflow Requested by Host: www.paypalobjects.com URL: https://www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/js/app.js Protocol HTTP/1.1 Server 13.66.28.137 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software nginx/1.4.6 (Ubuntu) / Resource Hash 99a49fbf3a18d19f688dd8a72f64b9f543d85e2d905b6ce9c1f8f21c7bde4314 Security Headers Name Value Content-Security-Policy default-src 'self' https://*.paypal.com https://*.paypalobjects.com; script-src 'nonce-vMERw5t/sJbpswG+w0gZ6zt4qMz4bRAtXIBj8LB9Pp8+mVcM' 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline' ; style-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline' ; img-src 'self' https: data:; object-src 'none'; connect-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline' https://*.kampyle.com https://*.qualtrics.com; font-src 'self' https://*.paypal.com https://*.paypalobjects.com data:; base-uri 'self' https://*.paypal.com; form-action 'self' https://*.paypal.com; frame-ancestors 'self' https://help.venmo.com; block-all-mixed-content;; report-uri https://www.paypal.com/csplog/api/log/csp; frame-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; Strict-Transport-Security max-age=63072000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer http://13.66.28.137/authflow/email-recovery/?amp&amp User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 X-Requested-With XMLHttpRequest Response headers X-EdgeConnect-Origin-MEX-Latency 76 Content-Security-Policy default-src 'self' https://*.paypal.com https://*.paypalobjects.com; script-src 'nonce-vMERw5t/sJbpswG+w0gZ6zt4qMz4bRAtXIBj8LB9Pp8+mVcM' 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline' ; style-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline' ; img-src 'self' https: data:; object-src 'none'; connect-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline' https://*.kampyle.com https://*.qualtrics.com; font-src 'self' https://*.paypal.com https://*.paypalobjects.com data:; base-uri 'self' https://*.paypal.com; form-action 'self' https://*.paypal.com; frame-ancestors 'self' https://help.venmo.com; block-all-mixed-content;; report-uri https://www.paypal.com/csplog/api/log/csp; frame-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; X-Content-Type-Options nosniff Server nginx/1.4.6 (Ubuntu) X-EdgeConnect-MidMile-RTT 43 ETag W/"2483-HtIhTB7H6K/a1FmVnykswHHIWMM" Strict-Transport-Security max-age=63072000 Content-Type application/json; charset=utf-8 Paypal-Debug-Id 331ac6f77f5eb Cache-Control max-age=0, no-cache, no-store, must-revalidate Date Tue, 23 Feb 2021 17:10:38 GMT Connection keep-alive DC ccg11-origin-www-1.paypal.com Content-Length 9347 X-Xss-Protection 1; mode=block
GET H2	200	ts t.paypal.com/	42 B 401 B	248ms 187ms	Image image/gif	151.101.129.35 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://t.paypal.com/ts?v=1.4.30&t=1614100237966&g=-60&pgrp=main%3Aprivacy%3Apolicy&page=main%3Aprivacy%3Apolicy%3Accpa&pgst=1614100237124&calc=4f697cb594a0f&nsid=UciQceggrvCfzyMBPtdxbj-FWCVnmycd&rsta=en_US&pgtf=Nodejs&env=live&s=ci&ccpg=US&csci=22bc3f8a746441ab942ce2e6bfa26399&comp=authnodeweb&tsrce=authnodeweb&cu=0&ef_policy=ccpa&xe=101021%2C101851%2C101935%2C101936%2C101960%2C102692&xt=102961%2C107586%2C107594%2C107602%2C113422%2C110228&gccd=US&inline_experience=N&tmpl=authnodeweb%2Fpublic%2Ftemplates%2Fpages%2FemailRecovery%2FForgotEmail.js&displayPage=main%3Aauthflow%3Aemailrecovery%3A%3Alist&ppage=privacy_banner&bannerType=cookiebanner&flag=ccpa&bannerVersion=v3a&bannerSource=ConsentNodeServ&e=ac Requested by Host: 13.66.28.137 URL: http://13.66.28.137/authflow/email-recovery/?amp&amp Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.129.35 , United States, ASN54113 (FASTLY, US), Reverse DNS Software akka-http/10.1.11 / Resource Hash 6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93 Request headers Referer http://13.66.28.137/authflow/email-recovery/?amp&amp User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Tue, 23 Feb 2021 17:10:38 GMT via 1.1 varnish server akka-http/10.1.11 x-timer S1614100238.041936,VS0,VE160 x-cache MISS p3p policyref="https://t.paypal.com/w3c/p3p.xml",CP="CAO IND OUR SAM UNI STA COR COM" expires Tue, 23 Feb 2021 17:10:38 GMT cache-control no-cache, no-store, max-age=0, no-transform x-cache-hits 0 accept-ranges bytes content-type image/gif content-length 42 x-served-by cache-hhn4052-HHN
GET H2	200	ts t.paypal.com/	42 B 673 B	226ms 174ms	Image image/gif	151.101.129.35 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://t.paypal.com/ts?v=1.4.30&t=1614100237975&g=-60&e=err&page=main%3Aauthflow%3Aemailrecovery%3A%3Alist%3Anode%3A%3A&pgrp=main%3Aauthflow%3Aemailrecovery%3A%3Alist&comp=authnodeweb&erpg=data%20is%20not%20defined&error_type=WINDOW_ONERROR&error_description=ReferenceError%3A%20data%20is%20not%20defined%0A%20%20%20%20at%20_%2Frecaptchav3.js%3A1%3A7078%0A%20%20%20%20at%20_0x278523%20(_%2Frecaptchav3.js%3A1%3A3295)%0A%20%20%20%20at%20_0xf95321%20(_%2Frecaptchav3.js%3A1%3A7112)%0A%20%20%20%20at%20_%2Frecaptchav3.js%3A1%3A10251%0A%20%20%20%20at%20_%2Frecaptchav3.js%3A1%3A10993&error_source=http%3A%2F%2F13.66.28.137%2Fauth%2Fcreatechallenge%2F1ec2dede153ae3fe%2Frecaptchav3.js%201%3A7078 Requested by Host: 13.66.28.137 URL: http://13.66.28.137/authflow/email-recovery/?amp&amp Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.129.35 , United States, ASN54113 (FASTLY, US), Reverse DNS Software akka-http/10.1.11 / Resource Hash 6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93 Request headers Referer http://13.66.28.137/authflow/email-recovery/?amp&amp User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Tue, 23 Feb 2021 17:10:38 GMT via 1.1 varnish server akka-http/10.1.11 x-timer S1614100238.042078,VS0,VE145 x-cache MISS p3p policyref="https://t.paypal.com/w3c/p3p.xml",CP="CAO IND OUR SAM UNI STA COR COM" http_x_pp_az_locator slcb.slc expires Tue, 23 Feb 2021 17:10:38 GMT cache-control no-cache, no-store, max-age=0, no-transform x-cache-hits 0 accept-ranges bytes content-type image/gif content-length 42 x-served-by cache-hhn4052-HHN
GET H2	200	messaging-bot.js Show response www.paypalobjects.com/messaging/auth/v2/	377 KB 116 KB	53ms 53ms	Script application/javascript	2.18.232.75
General Check archive.org Show headers Download Go to Full URL https://www.paypalobjects.com/messaging/auth/v2/messaging-bot.js Requested by Host: www.paypalobjects.com URL: https://www.paypalobjects.com/messaging/auth/v1/messaging-opener-mts.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.18.232.75 Frankfurt am Main, Germany, ASN (), Reverse DNS a2-18-232-75.deploy.static.akamaitechnologies.com Software / Resource Hash b01f45a4d98c8537aaa95ba16a8a6200e32cb08339a0a88cba683e8f90b51881 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Referer http://13.66.28.137/authflow/email-recovery/?amp&amp User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 23 Feb 2021 17:10:38 GMT content-encoding gzip x-content-type-options nosniff surrogate-control max-age=31536000 paypal-debug-id 48eac8fe54fdd dc ccg11-origin-www-1.paypal.com vary Accept-Encoding content-length 117697 last-modified Wed, 04 Nov 2020 17:04:45 GMT etag W/"5fa2df2d-5e241" strict-transport-security max-age=31536000 access-control-allow-methods GET content-type application/javascript access-control-allow-origin * cache-control max-age=3600 expires Tue, 23 Feb 2021 18:10:38 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial)

29 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| trustedTypes boolean| crossOriginIsolated function| bindGdprEvents object| core object| __core-js_shared__ object| global object| System function| asap function| Observable function| setImmediate function| clearImmediate object| regeneratorRuntime boolean| _babelPolyfill object| IntlPolyfill object| PDFJS object| PAYPAL object| fpti string| fptiserverurl object| dataLayer object| _ifpti function| openChatUtils function| hideGdprBanner function| showGdprBanner object| _0x58ae function| _0xbf78 object| mtsChat

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	default-src 'self' https://*.paypal.com https://*.paypalobjects.com; script-src 'nonce-0XdKMaBpalUATRSbfvjHIfajwCSjL2/mQNVNLBBK1Ro/1DdL' 'self' 'unsafe-inline' 'unsafe-eval' https://*.paypal.com https://*.paypalobjects.com; img-src 'self' data: https:; object-src 'none'; media-src data: blob: 'self' https://*.paypal.com https://*.paypalobjects.com; font-src 'self' https://*.paypal.com https://*.paypalobjects.com; style-src 'self' 'unsafe-inline' https://*.paypal.com https://*.paypalobjects.com; frame-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; child-src 'self' https://*.paypal.com https://*.paypalobjects.com; connect-src 'self' https://*.paypal.com https://*.paypalobjects.com https://nexus.ensighten.com https://*.google-analytics.com https://*.qualtrics.com; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; block-all-mixed-content;; report-uri https://www.paypal.com/csplog/api/log/csp
Strict-Transport-Security	max-age=63072000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

t.paypal.com
www.paypalobjects.com
13.66.28.137
151.101.129.35
2.18.232.75
0eb22afbab03bbbd8a47d4fc5361ff7518a77273e99fd0b73e235c93dd6ea7aa
1f9fbee4b224290bef89c6355c7142213d09f9a50ca5c3ecfc242e8068115fe1
461cc7e88a31b42a317cbe9fac3f4b38b7cebc8152faeda16787807f96c1db37
6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93
843e67ad522a908162007f4b7601819a5bbfef00e38ac7aec778766da8b7b2ab
99a49fbf3a18d19f688dd8a72f64b9f543d85e2d905b6ce9c1f8f21c7bde4314
ae79dcc3eb016922caa1d095cfd936446bc65a46bb3364b242dfc556f7e3c6a8
b01f45a4d98c8537aaa95ba16a8a6200e32cb08339a0a88cba683e8f90b51881
bbe3177aa5d225f117aea0e2eeb27f11d853a33d6d162733c5be8b1de8d36dc5
bcdf050ce6625609e7a3e64f52f1650e7a79abc12a9c7e712fe2b9cfd808e977
be5c4f71eea822cbdcaefcf92963ab573e903f75a60b8bc0793e4eec935a1187
c599c554590d1a336ffcb9627f6caaac34b6228f60e15f5f25454bff38facb7e
da775dd10f868447dea4c3522fb3b55bd4a5df650d3f2233a76d31bb711f6c2a
e00ab4867c277813a14fbbc89e0b52b2a96060287669cdd6262f539614b97fcb
f39646ccd4fbf32d475bed59e8c5a1f18208da3d23783672d095273e4e91a7dc