sf16-muse-va.ibytedtos.com
Open in
urlscan Pro
2a02:26f0:eb::5f64:b522
Malicious Activity!
Public Scan
Submission Tags: phishing malicious Search All
Submission: On September 22 via api from US
Summary
This is the only time sf16-muse-va.ibytedtos.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: PayPal (Financial)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
11 | 2a02:26f0:eb:... 2a02:26f0:eb::5f64:b522 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
17 | 151.101.14.133 151.101.14.133 | 54113 (FASTLY) (FASTLY) | |
3 | 151.101.1.35 151.101.1.35 | 54113 (FASTLY) (FASTLY) | |
1 2 | 64.4.245.84 64.4.245.84 | 17012 (PAYPAL) (PAYPAL) | |
3 | 151.101.193.35 151.101.193.35 | 54113 (FASTLY) (FASTLY) | |
35 | 5 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
17 |
paypalobjects.com
www.paypalobjects.com |
720 KB |
11 |
ibytedtos.com
sf16-muse-va.ibytedtos.com |
18 KB |
8 |
paypal.com
1 redirects
c.paypal.com b.stats.paypal.com dub.stats.paypal.com t.paypal.com |
22 KB |
35 | 3 |
Domain | Requested by | |
---|---|---|
17 | www.paypalobjects.com |
sf16-muse-va.ibytedtos.com
www.paypalobjects.com |
11 | sf16-muse-va.ibytedtos.com |
sf16-muse-va.ibytedtos.com
www.paypalobjects.com |
3 | t.paypal.com |
sf16-muse-va.ibytedtos.com
|
3 | c.paypal.com |
sf16-muse-va.ibytedtos.com
c.paypal.com |
1 | dub.stats.paypal.com |
sf16-muse-va.ibytedtos.com
|
1 | b.stats.paypal.com | 1 redirects |
35 | 6 |
This site contains links to these domains. Also see Links.
Domain |
---|
outsidret.com |
www.paypal.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
www.paypalobjects.com DigiCert SHA2 Extended Validation Server CA |
2019-12-09 - 2021-12-13 |
2 years | crt.sh |
c.paypal.com DigiCert SHA2 Extended Validation Server CA |
2020-06-24 - 2022-06-29 |
2 years | crt.sh |
b.stats.paypal.com DigiCert SHA2 High Assurance Server CA |
2020-03-13 - 2022-06-03 |
2 years | crt.sh |
t.paypal.com DigiCert SHA2 High Assurance Server CA |
2020-07-15 - 2022-07-20 |
2 years | crt.sh |
This page contains 4 frames:
Primary Page:
http://sf16-muse-va.ibytedtos.com/obj/ad-audit-eyes-va/2333e9a34a9f2f94c2bc50d2cfb526d4.html
Frame ID: BC593323EB1145186ACE6139CF8319A2
Requests: 32 HTTP requests in this frame
Frame:
https://www.paypalobjects.com/web/res/d50/e19b4176001c3d632673ce9007d27/recaptcha/grcenterprise_v3.html
Frame ID: 4FACA19833A8CFE430316A0F318B5593
Requests: 1 HTTP requests in this frame
Frame:
https://c.paypal.com/v1/r/d/i?js_src=https://c.paypal.com/da/r/fb.js
Frame ID: A30E80A464128544D7D481678DC5F217
Requests: 1 HTTP requests in this frame
Frame:
https://dub.stats.paypal.com/v1/counter2.cgi?r=cD05MlkzMDE5NDdGOTE1MDgzQyZpPTI0LjE2Ny45OS4yMjYmdD0xNTk5MjQxODI0LjExJmE9MjEmcz1VTklGSUVEX0xPR0lO-6tMa-d84CnSA1ylhRgappO0PJc
Frame ID: 6EA774873056AB3A336D0DF2669B8B60
Requests: 1 HTTP requests in this frame
2 Outgoing links
These are links going to different origins than the main page.
Title: Cancel and return to Shenzhen Lijuan Trading Co., Ltd
Search URL Search Domain Scan URL
Title: Learn more and manage your cookies
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 18- https://b.stats.paypal.com/v1/counter.cgi?r=cD05MlkzMDE5NDdGOTE1MDgzQyZpPTI0LjE2Ny45OS4yMjYmdD0xNTk5MjQxODI0LjExJmE9MjEmcz1VTklGSUVEX0xPR0lO-6tMa-d84CnSA1ylhRgappO0PJc HTTP 302
- https://dub.stats.paypal.com/v1/counter2.cgi?r=cD05MlkzMDE5NDdGOTE1MDgzQyZpPTI0LjE2Ny45OS4yMjYmdD0xNTk5MjQxODI0LjExJmE9MjEmcz1VTklGSUVEX0xPR0lO-6tMa-d84CnSA1ylhRgappO0PJc
35 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
2333e9a34a9f2f94c2bc50d2cfb526d4.html
sf16-muse-va.ibytedtos.com/obj/ad-audit-eyes-va/ |
34 KB 11 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.paypalobjects.com/pa/mi/3p/gtag/ |
44 KB 18 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gtag.js
www.paypalobjects.com/pa/mi/3p/gtag/ |
79 KB 31 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
miconfig.js
www.paypalobjects.com/pa/mi/ |
93 KB 16 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ngrlCaptcha.min.js
www.paypalobjects.com/webcaptcha/ |
21 KB 6 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
contextualLogin.css
www.paypalobjects.com/web/res/9f8/63537dfb66a2aba807d60707592aa/css/ |
98 KB 16 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
modernizr-2.6.1.js
www.paypalobjects.com/web/res/9f8/63537dfb66a2aba807d60707592aa/js/lib/ |
4 KB 2 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icon-PN-check.png
www.paypalobjects.com/images/shared/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
glyph_alert_critical_big-2x.png
www.paypalobjects.com/images/shared/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fn-sync-telemetry-min.js
www.paypalobjects.com/web/res/9f8/63537dfb66a2aba807d60707592aa/js/lib/ |
5 KB 2 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
checkout-split.js
www.paypalobjects.com/web/res/9f8/63537dfb66a2aba807d60707592aa/js/ |
158 KB 38 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pa.js
www.paypalobjects.com/pa/js/min/ |
46 KB 18 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
recaptchav3.js
sf16-muse-va.ibytedtos.com/auth/createchallenge/dc38381260d582fb/ |
0 0 |
Script
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
patleaf.js
www.paypalobjects.com/pa/3pjs/tl/5.6.1/ |
122 KB 42 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
patlcfg.js
www.paypalobjects.com/pa/3pjs/tl/5.6.1/ |
9 KB 3 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fb.js
c.paypal.com/da/r/ |
59 KB 20 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
paypal-logo-129x32.svg
www.paypalobjects.com/images/shared/ |
5 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
grcenterprise_v3.html
www.paypalobjects.com/web/res/d50/e19b4176001c3d632673ce9007d27/recaptcha/ Frame 4FAC |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
i
c.paypal.com/v1/r/d/ Frame A30E |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
counter2.cgi
dub.stats.paypal.com/v1/ Frame 6EA7 Redirect Chain
|
42 B 299 B |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ts
t.paypal.com/ |
42 B 633 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
tealeaftarget
sf16-muse-va.ibytedtos.com/platform/ |
18 B 784 B |
Fetch
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
w
c.paypal.com/v1/r/d/b/ |
0 302 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
challenge.js
sf16-muse-va.ibytedtos.com/auth/createchallenge/0775f377a6c5d5ef/ |
81 B 1 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.js
www.paypalobjects.com/web/res/c44/a8c34cc96a48b850dc38839b147c6/js/ |
2 MB 396 KB |
XHR
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
framework.js
www.paypalobjects.com/js/xo/hermes/1.9.0/ |
353 KB 120 KB |
XHR
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
client-log
sf16-muse-va.ibytedtos.com/signin/ |
18 B 780 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cookie-banner
sf16-muse-va.ibytedtos.com/signin/ |
51 B 1 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
load-resource
sf16-muse-va.ibytedtos.com/signin/ |
18 B 784 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
client-log
sf16-muse-va.ibytedtos.com/signin/ |
18 B 780 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ts
t.paypal.com/ |
42 B 166 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
sms
sf16-muse-va.ibytedtos.com/signin/challenge/ |
18 B 782 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ts
t.paypal.com/ |
42 B 165 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
load-resource
sf16-muse-va.ibytedtos.com/signin/ |
18 B 781 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
load-resource
sf16-muse-va.ibytedtos.com/signin/ |
18 B 782 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: PayPal (Financial)22 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| trustedTypes object| google_tag_data function| ga object| gaplugins object| google_tag_manager object| gDataLayer object| miconfig boolean| paypalADSInterceptorInjected object| html5 object| Modernizr function| isEligibleIntegration object| antiClickjack object| PAYPAL function| $ object| fpti string| fptiserverurl object| _ifpti object| pako object| TLT function| bindGdprEvents function| hideGdprBanner function| showGdprBanner4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.paypal.com/ | Name: KHcl0EuY7AKSMgfvHl7J5E7hPtK Value: U5Jpn2T1BEKCbsKWh-SRLSEH8LyqNA6g0ARPXgzaJhptnvBB-JFT-pjuKcU3mkRBjtN6od_fc2Nxn5Px |
|
.paypal.com/ | Name: ts_c Value: vr%3D56d584c3e00ca1a%26vt%3D61c96cae5c757bf |
|
.c.paypal.com/ | Name: sc_f Value: GpHntDHH6Hv5Zt6KA-O3xabkRDmV0O67AVTsL3XG37q-jyXwSOB5EWuqxpiBgzqAyUq7hmgp7j0oK6UD3vQWT8MX05o1Nhnmj3Je2W |
|
.paypal.com/ | Name: ts Value: vreXpYrS%3D1695357257%26vteXpYrS%3D1600751057%26vr%3D56d584c3e00ca1a%26vt%3D61c96cae5c757bf |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
b.stats.paypal.com
c.paypal.com
dub.stats.paypal.com
sf16-muse-va.ibytedtos.com
t.paypal.com
www.paypalobjects.com
151.101.1.35
151.101.14.133
151.101.193.35
2a02:26f0:eb::5f64:b522
64.4.245.84
13e4806e5c517e074ab1ea26fe0f2b7b87eaa3988006f35ed0bd4c89502d0d79
1cc7ef2701531a12b771f0af67533e7be37f4d6c056c14259bfc07a6e7d64110
219fe3382fabdbb0444747aa0073d75f3815cc9aba97bed4fe3ceca97afc38e8
3bcab8de1b7cd34e3529a57eab31170d93eed1efa23cd5fbfa86a8c6e3bb55e6
4571d2505eb051a672a61d6e1fb9a0229f790499035ce10796227cef2a28dca5
47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292
4a77d272b8cf508cc4a7e0da5763faa9958e42a5554fdb5d29fc3be51d685653
5396af5006928832517239a2145e9de4bfde558161bd68be9a4b57ea5f37acf5
61ce0ee4efd0b82c90eb9c78bc3c93cf9e6703ce670237bedd1f88a6af82e004
62bb5685d837089cd6aedb6f5fe5375c83ce5facc879632628e1e63e51399580
655790946659ad22d9cf3a6a53adaaeebde362fe3cd46701069299d87ae804ef
6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93
743269eba97930520fffacfbab90f4468674fd06d329e45e6557d298fd16f2ed
7fce85dd76dc54868df949eed9c40be211e4b2881090fa065e8e81c0d631b458
8b202d5bd55968ce4bfc21c063166eaebe62104275ce7ec362d78b64b2581c95
99eb12f2ab3c4866a353e098ffa3cb7a967e617c49b98480394ec5d8ea92b094
a6c3bff965978df8093c3a29f7071c21d7439a212af41e7b40ce70d94d6bcc44
b3cc50b9e94bbecaaeb1079b64b8ca50616d1732824964c1cc2c5422627a0ec5
bc75ccc27fd9a3128e1ad1b5a710d3d09fa3e3f13e649ac892cecb46d0b71a46
d7360f2684a0399a30edd737e96f60e3dd9e7622c892a8421740efcc689bd7a3
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ec719cca38cc9933de2dab9b5fb255684dd287bb10bdc3e637634f16a9448e46
f28b302dec35e6df6dd6ef6ae3706d18103fc02f61bf4a0d618ea8870d974617
f982a9dad50b916735a08b8e6f40efa7f97163106b18da079b144764c86a44a1