urlscan.io logo urlscan.io
SecurityTrails logo

35.188.36.185 Open in urlscan Pro
35.188.36.185  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://35.188.36.185/paypal/www.paypal.com/website/
Submission Tags: phishing malicious Search All
Submission: On June 06 via api from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 3 countries across 2 domains to perform 21 HTTP transactions. The main IP is 35.188.36.185, located in United States and belongs to GOOGLE, US. The main domain is 35.188.36.185.
This is the only time 35.188.36.185 was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: PayPal (Financial)

Domain & IP information

IP Address AS Autonomous System
1 8 35.188.36.185 15169 (GOOGLE)
9 151.101.114.133 54113 (FASTLY)
2 88.221.142.62 16625 (AKAMAI-AS)
2 88.221.143.181 16625 (AKAMAI-AS)
1 2 64.4.245.84 17012 (PAYPAL)
21 5
8    35.188.36.185 (United States)

ASN15169 (GOOGLE, US)
PTR: 185.36.188.35.bc.googleusercontent.com
35.188.36.185
9    151.101.114.133 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)
www.paypalobjects.com
2    88.221.142.62 (Ascension Island)

ASN16625 (AKAMAI-AS, US)
t.paypal.com
2    88.221.143.181 (Ascension Island)

ASN16625 (AKAMAI-AS, US)
c.paypal.com
2    64.4.245.84 (United States)

ASN17012 (PAYPAL, US)
b.stats.paypal.com
dub.stats.paypal.com
Domain Requested by
9 www.paypalobjects.com 35.188.36.185
2 c.paypal.com www.paypalobjects.com
c.paypal.com
2 t.paypal.com 35.188.36.185
1 dub.stats.paypal.com
1 b.stats.paypal.com 1 redirects
21 5

This site contains no links.

Subject Issuer Validity Valid
www.paypalobjects.com
DigiCert SHA2 Extended Validation Server CA		 2019-12-09 -
2021-12-13		 2 years crt.sh
t.paypal.com
DigiCert SHA2 Extended Validation Server CA		 2020-01-09 -
2022-01-12		 2 years crt.sh
c.paypal.com
DigiCert SHA2 Extended Validation Server CA		 2020-01-09 -
2022-01-13		 2 years crt.sh
b.stats.paypal.com
DigiCert SHA2 High Assurance Server CA		 2020-03-13 -
2022-06-03		 2 years crt.sh

This page contains 3 frames:

Primary Page: http://35.188.36.185/paypal/www.paypal.com/website/
Frame ID: 256FCE5EBB7CBE19C381F7C427CA877F
Requests: 19 HTTP requests in this frame

Frame: https://c.paypal.com/v1/r/d/i?js_src=https://c.paypal.com/da/r/fb.js
Frame ID: 30B249EB15510B77DA3BE7C838AE75E9
Requests: 1 HTTP requests in this frame

Frame: https://dub.stats.paypal.com/v1/counter2.cgi?r=cD1hNGI2NzRhZThmN2M0YTYzOGNiOGRiNDQxZGIyYTJkNyZpPTEwNC4xOTcuMjA3LjEwNyZ0PTE1ODQ0NzMxMDQuNDAyJmE9MjEmcz1VTklGSUVEX0xPR0lOsVHyImCPX7txBxjbsMIAV2hcAyg
Frame ID: D101C2DC310062DB65983350D7638CC4
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://35.188.36.185/paypal/www.paypal.com/website HTTP 301
    http://35.188.36.185/paypal/www.paypal.com/website/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /lighttpd(?:\/([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • script /([\d.]+)?\/modernizr(?:.([\d.]+))?.*\.js/i

Page Statistics

21
Requests

67 %
HTTPS

0 %
IPv6

2
Domains

5
Subdomains

5
IPs

3
Countries

118 kB
Transfer

394 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://35.188.36.185/paypal/www.paypal.com/website HTTP 301
    http://35.188.36.185/paypal/www.paypal.com/website/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 16
  • https://b.stats.paypal.com/v1/counter.cgi?r=cD1hNGI2NzRhZThmN2M0YTYzOGNiOGRiNDQxZGIyYTJkNyZpPTEwNC4xOTcuMjA3LjEwNyZ0PTE1ODQ0NzMxMDQuNDAyJmE9MjEmcz1VTklGSUVEX0xPR0lOsVHyImCPX7txBxjbsMIAV2hcAyg HTTP 302
  • https://dub.stats.paypal.com/v1/counter2.cgi?r=cD1hNGI2NzRhZThmN2M0YTYzOGNiOGRiNDQxZGIyYTJkNyZpPTEwNC4xOTcuMjA3LjEwNyZ0PTE1ODQ0NzMxMDQuNDAyJmE9MjEmcz1VTklGSUVEX0xPR0lOsVHyImCPX7txBxjbsMIAV2hcAyg

21 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
35.188.36.185/paypal/www.paypal.com/website/
Redirect Chain
  • http://35.188.36.185/paypal/www.paypal.com/website
  • http://35.188.36.185/paypal/www.paypal.com/website/
20 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://35.188.36.185/paypal/www.paypal.com/website/
Protocol
HTTP/1.1
Server
35.188.36.185 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
185.36.188.35.bc.googleusercontent.com
Software
lighttpd/1.4.45 /
Resource Hash
9e65fb406474b13ab64babcb88f31a2736b05706c45a8c2785cdf95c5f7ab676

Request headers

Host
35.188.36.185
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Vary
Accept-Encoding
Content-Encoding
gzip
Last-Modified
Wed, 18 Mar 2020 09:56:45 GMT
ETag
"2593236663"
Content-Type
text/html
Accept-Ranges
bytes
Content-Length
6108
Date
Sat, 06 Jun 2020 20:18:54 GMT
Server
lighttpd/1.4.45

Redirect headers

Location
http://35.188.36.185/paypal/www.paypal.com/website/
Content-Length
0
Date
Sat, 06 Jun 2020 20:18:53 GMT
Server
lighttpd/1.4.45
xhr-ads.min.js
www.paypalobjects.com/web/res/40f/264f98d5d1f113e33bd9c3be2bba5/js/ 		21 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.paypalobjects.com/web/res/40f/264f98d5d1f113e33bd9c3be2bba5/js/xhr-ads.min.js
Requested by
Host: 35.188.36.185
URL: http://35.188.36.185/paypal/www.paypal.com/website/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.133 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache /
Resource Hash
08d604303801d3eb8b48337e4b1ac48550e5a1f9524b9863b557ff0b6992d5b9
Security Headers
Name Value
Strict-Transport-Security max-age=31557600
X-Content-Type-Options nosniff

Request headers

Referer
http://35.188.36.185/paypal/www.paypal.com/website/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 06 Jun 2020 20:18:54 GMT
x-pad
avoid browser bug
x-content-type-options
nosniff
age
6741918
x-cache
HIT, HIT
status
200
surrorage-key
/web/res/40f/264f98d5d1f113e33bd9c3be2bba5/js/xhr-ads.min.js /web/res/40f/264f98d5d1f113e33bd9c3be2bba5/js/xhr-ads.min.js /web/res/40f/264f98d5d1f113e33bd9c3be2bba5/js/xhr-ads.min.js /web/res/40f/264f98d5d1f113e33bd9c3be2bba5/js/xhr-ads.min.js /web/res/40f/264f98d5d1f113e33bd9c3be2bba5/js /web/res/40f/264f98d5d1f113e33bd9c3be2bba5 /web/res/40f /web/res /web
content-encoding
gzip
vary
Accept-Encoding
content-length
6343
via
1.1 varnish, 1.1 varnish
x-served-by
cache-lax8638-LAX, cache-hhn4046-HHN
last-modified
Thu, 07 Nov 2019 17:10:49 GMT
server
Apache
x-timer
S1591474734.418185,VS0,VE0
strict-transport-security
max-age=31557600
access-control-allow-methods
GET
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
max-age=3600
accept-ranges
bytes
access-control-allow-headers
x-csrf-token
x-cache-hits
1, 55
contextualLogin.css
www.paypalobjects.com/web/res/f80/dbd0ca34a132d12e446cc9e727039/css/ 		94 KB
16 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.paypalobjects.com/web/res/f80/dbd0ca34a132d12e446cc9e727039/css/contextualLogin.css
Requested by
Host: 35.188.36.185
URL: http://35.188.36.185/paypal/www.paypal.com/website/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.133 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache /
Resource Hash
c4f2d1829889bce495b90cae2efbf390eded04bb76fdb600f2084501204c27b9
Security Headers
Name Value
Strict-Transport-Security max-age=31557600
X-Content-Type-Options nosniff

Request headers

Referer
http://35.188.36.185/paypal/www.paypal.com/website/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 06 Jun 2020 20:18:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2738362
x-cache
HIT, HIT
status
200
vary
Accept-Encoding
content-length
16116
x-served-by
cache-dfw18635-DFW, cache-hhn4046-HHN
last-modified
Fri, 13 Mar 2020 05:57:33 GMT
server
Apache
x-timer
S1591474734.418206,VS0,VE1
strict-transport-security
max-age=31557600
content-type
text/css
via
1.1 varnish, 1.1 varnish
cache-control
max-age=3600
accept-ranges
bytes
x-cache-hits
1, 1
modernizr-2.6.1.js
www.paypalobjects.com/web/res/f80/dbd0ca34a132d12e446cc9e727039/js/lib/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.paypalobjects.com/web/res/f80/dbd0ca34a132d12e446cc9e727039/js/lib/modernizr-2.6.1.js
Requested by
Host: 35.188.36.185
URL: http://35.188.36.185/paypal/www.paypal.com/website/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.133 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache /
Resource Hash
a6c3bff965978df8093c3a29f7071c21d7439a212af41e7b40ce70d94d6bcc44
Security Headers
Name Value
Strict-Transport-Security max-age=31557600
X-Content-Type-Options nosniff

Request headers

Referer
http://35.188.36.185/paypal/www.paypal.com/website/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 06 Jun 2020 20:18:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
785427
x-cache
HIT, HIT
status
200
vary
Accept-Encoding
content-length
1788
via
1.1 varnish, 1.1 varnish
x-served-by
cache-dfw18677-DFW, cache-hhn4046-HHN
last-modified
Fri, 13 Mar 2020 05:57:34 GMT
server
Apache
x-timer
S1591474734.418174,VS0,VE1
strict-transport-security
max-age=31557600
access-control-allow-methods
GET
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
max-age=3600
accept-ranges
bytes
access-control-allow-headers
x-csrf-token
x-cache-hits
1, 1
icon-PN-check.png
www.paypalobjects.com/images/shared/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.paypalobjects.com/images/shared/icon-PN-check.png
Requested by
Host: 35.188.36.185
URL: http://35.188.36.185/paypal/www.paypal.com/website/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.133 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache /
Resource Hash
4a77d272b8cf508cc4a7e0da5763faa9958e42a5554fdb5d29fc3be51d685653
Security Headers
Name Value
Strict-Transport-Security max-age=31557600
X-Content-Type-Options nosniff

Request headers

Referer
http://35.188.36.185/paypal/www.paypal.com/website/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 06 Jun 2020 20:18:54 GMT
via
1.1 varnish, 1.1 varnish
x-content-type-options
nosniff
age
6741920
x-cache
HIT, HIT
status
200
surrorage-key
/images/shared/icon-PN-check.png /images/shared/icon-PN-check.png /images/shared/icon-PN-check.png /images/shared/icon-PN-check.png /images/shared/icon-PN-check.png /images/shared/icon-PN-check.png /images/shared/icon-PN-check.png /images/shared /images
content-length
2236
x-served-by
cache-sjc10050-SJC, cache-hhn4046-HHN
last-modified
Tue, 29 Mar 2016 00:23:32 GMT
server
Apache
x-timer
S1591474734.461204,VS0,VE0
strict-transport-security
max-age=31557600
content-type
image/png
cache-control
max-age=3600
accept-ranges
bytes
x-cache-hits
1, 130244
glyph_alert_critical_big-2x.png
www.paypalobjects.com/images/shared/ 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.paypalobjects.com/images/shared/glyph_alert_critical_big-2x.png
Requested by
Host: 35.188.36.185
URL: http://35.188.36.185/paypal/www.paypal.com/website/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.133 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache /
Resource Hash
13e4806e5c517e074ab1ea26fe0f2b7b87eaa3988006f35ed0bd4c89502d0d79
Security Headers
Name Value
Strict-Transport-Security max-age=31557600
X-Content-Type-Options nosniff

Request headers

Referer
http://35.188.36.185/paypal/www.paypal.com/website/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 06 Jun 2020 20:18:54 GMT
via
1.1 varnish, 1.1 varnish
x-content-type-options
nosniff
age
6741916
x-cache
MISS, HIT
status
200
surrorage-key
/images/shared/glyph_alert_critical_big-2x.png /images/shared/glyph_alert_critical_big-2x.png /images/shared/glyph_alert_critical_big-2x.png /images/shared/glyph_alert_critical_big-2x.png /images/shared/glyph_alert_critical_big-2x.png /images/shared/glyph_alert_critical_big-2x.png /images/shared/glyph_alert_critical_big-2x.png /images/shared /images
content-length
5828
x-served-by
cache-lax8625-LAX, cache-hhn4046-HHN
last-modified
Fri, 12 Sep 2014 15:08:04 GMT
server
Apache
x-timer
S1591474734.461113,VS0,VE0
strict-transport-security
max-age=31557600
content-type
image/png
cache-control
max-age=3600
accept-ranges
bytes
x-cache-hits
0, 130545
fn-sync-telemetry-min.js
www.paypalobjects.com/web/res/f80/dbd0ca34a132d12e446cc9e727039/js/lib/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.paypalobjects.com/web/res/f80/dbd0ca34a132d12e446cc9e727039/js/lib/fn-sync-telemetry-min.js
Requested by
Host: 35.188.36.185
URL: http://35.188.36.185/paypal/www.paypal.com/website/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.133 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache /
Resource Hash
b93b49d381df9272021c76ee3c1b20fc41852f8da892536348b6fd9d4c94b7b2
Security Headers
Name Value
Strict-Transport-Security max-age=31557600
X-Content-Type-Options nosniff

Request headers

Referer
http://35.188.36.185/paypal/www.paypal.com/website/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 06 Jun 2020 20:18:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1323995
x-cache
HIT, HIT
status
200
vary
Accept-Encoding
content-length
2074
via
1.1 varnish, 1.1 varnish
x-served-by
cache-dfw18622-DFW, cache-hhn4046-HHN
last-modified
Fri, 13 Mar 2020 05:57:34 GMT
server
Apache
x-timer
S1591474734.444781,VS0,VE1
strict-transport-security
max-age=31557600
access-control-allow-methods
GET
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
max-age=3600
accept-ranges
bytes
access-control-allow-headers
x-csrf-token
x-cache-hits
1, 1
signin-split.js
www.paypalobjects.com/web/res/f80/dbd0ca34a132d12e446cc9e727039/js/ 		126 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.paypalobjects.com/web/res/f80/dbd0ca34a132d12e446cc9e727039/js/signin-split.js
Requested by
Host: 35.188.36.185
URL: http://35.188.36.185/paypal/www.paypal.com/website/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.133 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache /
Resource Hash
fb6986d7cc76d8a84f22f0356e686b26744c12137979bbdd78c4802dafd706ad
Security Headers
Name Value
Strict-Transport-Security max-age=31557600
X-Content-Type-Options nosniff

Request headers

Referer
http://35.188.36.185/paypal/www.paypal.com/website/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 06 Jun 2020 20:18:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1986923
x-cache
HIT, HIT
status
200
vary
Accept-Encoding
content-length
31668
via
1.1 varnish, 1.1 varnish
x-served-by
cache-lax8651-LAX, cache-hhn4046-HHN
last-modified
Fri, 13 Mar 2020 05:57:34 GMT
server
Apache
x-timer
S1591474734.461257,VS0,VE1
strict-transport-security
max-age=31557600
access-control-allow-methods
GET
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
max-age=3600
accept-ranges
bytes
access-control-allow-headers
x-csrf-token
x-cache-hits
1, 1
pa.js
www.paypalobjects.com/pa/js/min/ 		43 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.paypalobjects.com/pa/js/min/pa.js
Requested by
Host: 35.188.36.185
URL: http://35.188.36.185/paypal/www.paypal.com/website/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.133 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache /
Resource Hash
acc9e4f58d29427c3b160c810260ce6ca0e64c93a17eabda67f1fcfa27174c67
Security Headers
Name Value
Strict-Transport-Security max-age=31557600
X-Content-Type-Options nosniff

Request headers

Referer
http://35.188.36.185/paypal/www.paypal.com/website/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 06 Jun 2020 20:18:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
59121
x-cache
HIT, HIT
status
200
vary
Accept-Encoding
content-length
16636
via
1.1 varnish, 1.1 varnish
x-served-by
cache-lax8633-LAX, cache-hhn4046-HHN
last-modified
Sat, 06 Jun 2020 01:08:24 GMT
server
Apache
x-timer
S1591474734.461226,VS0,VE0
strict-transport-security
max-age=31557600
access-control-allow-methods
GET
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
max-age=3600
accept-ranges
bytes
access-control-allow-headers
x-csrf-token
x-cache-hits
722, 63340
recaptchav3.js
35.188.36.185/paypal/www.paypal.com/website/assets/ 		10 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://35.188.36.185/paypal/www.paypal.com/website/assets/recaptchav3.js?_sessionID=vneZwUncVlYOWF5BoHYoHhm0yuYGoqeK
Requested by
Host: 35.188.36.185
URL: http://35.188.36.185/paypal/www.paypal.com/website/
Protocol
HTTP/1.1
Server
35.188.36.185 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
185.36.188.35.bc.googleusercontent.com
Software
lighttpd/1.4.45 /
Resource Hash
53c3f11678669ecdde0dde13a9153f66267139dc7424a99670feea07722798c7

Request headers

Referer
http://35.188.36.185/paypal/www.paypal.com/website/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Sat, 06 Jun 2020 20:18:54 GMT
Content-Encoding
gzip
Last-Modified
Wed, 18 Mar 2020 09:56:45 GMT
Server
lighttpd/1.4.45
ETag
"2532435591"
Vary
Accept-Encoding
Content-Type
application/javascript
Accept-Ranges
bytes
Content-Length
3554
paypal-logo-129x32.svg
www.paypalobjects.com/images/shared/ 		5 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.paypalobjects.com/images/shared/paypal-logo-129x32.svg
Requested by
Host: 35.188.36.185
URL: http://35.188.36.185/paypal/www.paypal.com/website/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.133 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache /
Resource Hash
b3cc50b9e94bbecaaeb1079b64b8ca50616d1732824964c1cc2c5422627a0ec5
Security Headers
Name Value
Strict-Transport-Security max-age=31557600
X-Content-Type-Options nosniff

Request headers

Referer
https://www.paypalobjects.com/web/res/f80/dbd0ca34a132d12e446cc9e727039/css/contextualLogin.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 06 Jun 2020 20:18:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
6741916
x-cache
HIT, HIT, HIT
status
200
surrorage-key
/images/shared/paypal-logo-129x32.svg /images/shared/paypal-logo-129x32.svg /images/shared/paypal-logo-129x32.svg /images/shared/paypal-logo-129x32.svg /images/shared/paypal-logo-129x32.svg /images/shared/paypal-logo-129x32.svg /images/shared/paypal-logo-129x32.svg /images/shared /images
vary
Accept-Encoding
content-length
1929
via
1.1 varnish, 1.1 varnish, 1.1 varnish
x-served-by
cache-sjc10024-SJC, cache-dfw18665-DFW, cache-hhn4046-HHN
last-modified
Fri, 24 Oct 2014 22:52:57 GMT
server
Apache
x-timer
S1591474734.465477,VS0,VE0
strict-transport-security
max-age=31557600
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
max-age=3600
accept-ranges
bytes
x-cache-hits
1, 287968, 121927
ts
t.paypal.com/ 		42 B
780 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://t.paypal.com/ts?v=1.4.12&t=1591474734568&g=-120&e=err&page=main%3Aunifiedlogin%3Asplitlogin%3A%3Aemail%3A%3A%3A&pgrp=main%3Aunifiedlogin%3Asplitlogin%3A%3Aemail&comp=unifiedloginnodeweb&erpg=data%20is%20not%20defined&error_type=WINDOW_ONERROR&error_description=ReferenceError%3A%20data%20is%20not%20defined%0A%20%20%20%20at%20_%2Frecaptchav3.js%3F_sessionID%3DvneZwUncVlYOWF5BoHYoHhm0yuYGoqeK%3A1%3A6947%0A%20%20%20%20at%20_0x11b0ba%20(_%2Frecaptchav3.js%3F_sessionID%3DvneZwUncVlYOWF5BoHYoHhm0yuYGoqeK%3A1%3A3160)%0A%20%20%20%20at%20_0x2e489c%20(_%2Frecaptchav3.js%3F_sessionID%3DvneZwUncVlYOWF5BoHYoHhm0yuYGoqeK%3A1%3A6981)%0A%20%20%20%20at%20_%2Frecaptchav3.js%3F_sessionID%3DvneZwUncVlYOWF5BoHYoHhm0yuYGoqeK%3A1%3A9736%0A%20%20%20%20at%20_%2Frecaptchav3.js%3F_sessionID%3DvneZwUncVlYOWF5BoHYoHhm0yuYGoqeK%3A1%3A10512&error_source=http%3A%2F%2F35.188.36.185%2Fpaypal%2Fwww.paypal.com%2Fwebsite%2Fassets%2Frecaptchav3.js%3F_sessionID%3DvneZwUncVlYOWF5BoHYoHhm0yuYGoqeK%201%3A6947&3p_vid=357b8d425c207836&3p_fpti=787222742f9d64f
Requested by
Host: 35.188.36.185
URL: http://35.188.36.185/paypal/www.paypal.com/website/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
88.221.142.62 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
Software
akka-http/10.1.11 /
Resource Hash
6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93

Request headers

Referer
http://35.188.36.185/paypal/www.paypal.com/website/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Sat, 06 Jun 2020 20:18:55 GMT
Server
akka-http/10.1.11
P3P
policyref="https://t.paypal.com/w3c/p3p.xml",CP="CAO IND OUR SAM UNI STA COR COM"
HTTP_X_PP_AZ_LOCATOR
slcb.slc
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
42
Expires
Sat, 06 Jun 2020 20:18:55 GMT
fb.js
c.paypal.com/da/r/ 		55 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c.paypal.com/da/r/fb.js
Requested by
Host: www.paypalobjects.com
URL: https://www.paypalobjects.com/web/res/f80/dbd0ca34a132d12e446cc9e727039/js/signin-split.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
88.221.143.181 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
Software
Apache /
Resource Hash
3d9694d4605fd934422db49544a5f583e630f0af9ac297573a04f7a825266972

Request headers

Referer
http://35.188.36.185/paypal/www.paypal.com/website/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Sat, 06 Jun 2020 20:18:55 GMT
X-Pad
avoid browser bug
Vary
Accept-Encoding
Connection
keep-alive
Content-Encoding
gzip
Content-Length
18905
Last-Modified
Thu, 19 Mar 2020 20:20:51 GMT
Server
Apache
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=86400
Access-Control-Allow-Credentials
false
Accept-Ranges
bytes
Expires
Sun, 07 Jun 2020 20:18:55 GMT
challenge.js
35.188.36.185/auth/createchallenge/554dee7a43f11420/ 		345 B
479 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://35.188.36.185/auth/createchallenge/554dee7a43f11420/challenge.js
Requested by
Host: www.paypalobjects.com
URL: https://www.paypalobjects.com/web/res/40f/264f98d5d1f113e33bd9c3be2bba5/js/xhr-ads.min.js
Protocol
HTTP/1.1
Server
35.188.36.185 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
185.36.188.35.bc.googleusercontent.com
Software
lighttpd/1.4.45 /
Resource Hash
beab79184bf1fca1f52ff3761f8a533827106fef3749c6c9c9a3e7eec619a226

Request headers

Accept
application/json
Referer
http://35.188.36.185/paypal/www.paypal.com/website/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Sat, 06 Jun 2020 20:18:55 GMT
Server
lighttpd/1.4.45
Content-Length
345
Content-Type
text/html
client-log
35.188.36.185/signin/ 		345 B
479 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://35.188.36.185/signin/client-log
Requested by
Host: www.paypalobjects.com
URL: https://www.paypalobjects.com/web/res/40f/264f98d5d1f113e33bd9c3be2bba5/js/xhr-ads.min.js
Protocol
HTTP/1.1
Server
35.188.36.185 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
185.36.188.35.bc.googleusercontent.com
Software
lighttpd/1.4.45 /
Resource Hash
beab79184bf1fca1f52ff3761f8a533827106fef3749c6c9c9a3e7eec619a226

Request headers

Accept
application/json
Referer
http://35.188.36.185/paypal/www.paypal.com/website/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

Date
Sat, 06 Jun 2020 20:18:55 GMT
Server
lighttpd/1.4.45
Content-Length
345
Content-Type
text/html
load-resource
35.188.36.185/signin/ 		345 B
479 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://35.188.36.185/signin/load-resource
Requested by
Host: www.paypalobjects.com
URL: https://www.paypalobjects.com/web/res/40f/264f98d5d1f113e33bd9c3be2bba5/js/xhr-ads.min.js
Protocol
HTTP/1.1
Server
35.188.36.185 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
185.36.188.35.bc.googleusercontent.com
Software
lighttpd/1.4.45 /
Resource Hash
beab79184bf1fca1f52ff3761f8a533827106fef3749c6c9c9a3e7eec619a226

Request headers

Accept
application/json
Referer
http://35.188.36.185/paypal/www.paypal.com/website/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

Date
Sat, 06 Jun 2020 20:18:55 GMT
Server
lighttpd/1.4.45
Content-Length
345
Content-Type
text/html
i
c.paypal.com/v1/r/d/ Frame 30B2 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://c.paypal.com/v1/r/d/i?js_src=https://c.paypal.com/da/r/fb.js
Requested by
Host: c.paypal.com
URL: https://c.paypal.com/da/r/fb.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
88.221.143.181 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Host
c.paypal.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
http://35.188.36.185/paypal/www.paypal.com/website/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
ts=vreXpYrS%3D1686082734%26vteXpYrS%3D1591476534%26vr%3D787222742f9d64f%26vt%3D357b8d425c207836; ts_c=vr%3D787222742f9d64f%26vt%3D357b8d425c207836
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
http://35.188.36.185/paypal/www.paypal.com/website/

Response headers

CORRELATION-ID
32de3e7a109a
Cache-Control
max-age=0, no-cache, no-store, must-revalidate
Content-Length
160
Content-Security-Policy-Report-Only
default-src 'self' https://*.paypal.com https://*.paypalobjects.com; script-src 'self' https://*.paypal.com https://*.paypalobjects.com https://www.facebook.com 'unsafe-eval' 'unsafe-inline' blob:; connect-src 'self' https://*.paypal.com; style-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; font-src 'self' https://*.paypal.com https://*.paypalobjects.com data:; img-src 'self' https: data:; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; object-src 'self' https://*.paypal.com https://*.paypalobjects.com; report-uri https://www.paypal.com/csplog/api/log/csp
Content-Type
text/html;charset=UTF-8
Paypal-Debug-Id
32de3e7a109a
X-Content-Type-Options
nosniff
X-Xss-Protection
1; mode=block
Date
Sat, 06 Jun 2020 20:18:55 GMT
Connection
keep-alive
counter2.cgi
dub.stats.paypal.com/v1/ Frame D101
Redirect Chain
  • https://b.stats.paypal.com/v1/counter.cgi?r=cD1hNGI2NzRhZThmN2M0YTYzOGNiOGRiNDQxZGIyYTJkNyZpPTEwNC4xOTcuMjA3LjEwNyZ0PTE1ODQ0NzMxMDQuNDAyJmE9MjEmcz1VTklGSUVEX0xPR0lOsVHyImCPX7txBxjbsMIAV2hcAyg
  • https://dub.stats.paypal.com/v1/counter2.cgi?r=cD1hNGI2NzRhZThmN2M0YTYzOGNiOGRiNDQxZGIyYTJkNyZpPTEwNC4xOTcuMjA3LjEwNyZ0PTE1ODQ0NzMxMDQuNDAyJmE9MjEmcz1VTklGSUVEX0xPR0lOsVHyImCPX7txBxjbsMIAV2hcAyg
42 B
299 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dub.stats.paypal.com/v1/counter2.cgi?r=cD1hNGI2NzRhZThmN2M0YTYzOGNiOGRiNDQxZGIyYTJkNyZpPTEwNC4xOTcuMjA3LjEwNyZ0PTE1ODQ0NzMxMDQuNDAyJmE9MjEmcz1VTklGSUVEX0xPR0lOsVHyImCPX7txBxjbsMIAV2hcAyg
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
64.4.245.84 , United States, ASN17012 (PAYPAL, US),
Reverse DNS
Software
PayPal-B.Stats/1.0 /
Resource Hash
47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292

Request headers

Referer
http://35.188.36.185/paypal/www.paypal.com/website/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Sat, 06 Jun 2020 20:18:55 GMT
Server
PayPal-B.Stats/1.0
Connection
close
Content-Length
42
Content-Type
image/jpeg

Redirect headers

Location
https://dub.stats.paypal.com/v1/counter2.cgi?r=cD1hNGI2NzRhZThmN2M0YTYzOGNiOGRiNDQxZGIyYTJkNyZpPTEwNC4xOTcuMjA3LjEwNyZ0PTE1ODQ0NzMxMDQuNDAyJmE9MjEmcz1VTklGSUVEX0xPR0lOsVHyImCPX7txBxjbsMIAV2hcAyg
Date
Sat, 06 Jun 2020 20:18:55 GMT
Server
PayPal-B.Stats/1.0
Connection
close
Content-Length
0
Content-Type
application/octet-stream
load-resource
35.188.36.185/signin/ 		345 B
479 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://35.188.36.185/signin/load-resource
Requested by
Host: www.paypalobjects.com
URL: https://www.paypalobjects.com/web/res/40f/264f98d5d1f113e33bd9c3be2bba5/js/xhr-ads.min.js
Protocol
HTTP/1.1
Server
35.188.36.185 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
185.36.188.35.bc.googleusercontent.com
Software
lighttpd/1.4.45 /
Resource Hash
beab79184bf1fca1f52ff3761f8a533827106fef3749c6c9c9a3e7eec619a226

Request headers

Accept
application/json
Referer
http://35.188.36.185/paypal/www.paypal.com/website/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

Date
Sat, 06 Jun 2020 20:18:55 GMT
Server
lighttpd/1.4.45
Content-Length
345
Content-Type
text/html
load-resource
35.188.36.185/signin/ 		345 B
479 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://35.188.36.185/signin/load-resource
Requested by
Host: www.paypalobjects.com
URL: https://www.paypalobjects.com/web/res/40f/264f98d5d1f113e33bd9c3be2bba5/js/xhr-ads.min.js
Protocol
HTTP/1.1
Server
35.188.36.185 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
185.36.188.35.bc.googleusercontent.com
Software
lighttpd/1.4.45 /
Resource Hash
beab79184bf1fca1f52ff3761f8a533827106fef3749c6c9c9a3e7eec619a226

Request headers

Accept
application/json
Referer
http://35.188.36.185/paypal/www.paypal.com/website/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

Date
Sat, 06 Jun 2020 20:18:55 GMT
Server
lighttpd/1.4.45
Content-Length
345
Content-Type
text/html
ts
t.paypal.com/ 		42 B
748 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://t.paypal.com/ts?v=1.4.12&t=1591474735439&g=-120&pgrp=main%3Aunifiedlogin%3Asplitlogin%3A%3Aemail&page=main%3Aunifiedlogin%3Asplitlogin%3A%3Aemail%3A%3A%3A&qual=input_email&pgst=1584473104368&calc=72a451995ba97&nsid=vneZwUncVlYOWF5BoHYoHhm0yuYGoqeK&rsta=en_US&pgtf=Nodejs&env=live&s=ci&ccpg=US&csci=a4b674ae8f7c4a638cb8db441db2a2d7&comp=unifiedloginnodeweb&tsrce=unifiedloginnodeweb&cu=0&transition_name=ss_prepare_email&ctx_login_ot_content=1&obex=signin&landing_page=login&state_name=begin_email&ctx_login_ctxid_fetch=ctxid-not-exist&ctx_login_content_fetch=success&ctx_login_lang_footer=shown&ctx_login_signup_btn=shown%7Cdefault&ctx_login_intent=signin&ctx_login_flow=Signin&ctx_login_state_transition=login_loaded&post_login_redirect=returnUri&ret_url=%2F&e=im&imsrc=setup&view=%7B%22t10%22%3A226%2C%22t11%22%3A1191%2C%22tcp%22%3A483%2C%22et%22%3A%224g%22%2C%22nt%22%3A%22navigate%22%2C%22bt%22%3A50%7D&pt=Log%20in%20to%20your%20paypal%20account&cd=24&sw=1600&sh=1200&dw=1600&dh=1200&bw=1600&bh=1200&ce=1&t1=1&t1c=0&t1d=0&t1s=0&t2=112&t3=1&t4d=787&t4=799&t4e=3&tt=1140&rdc=1&res=%7B%7D&rtt=581&3p_vid=357b8d425c207836&3p_fpti=787222742f9d64f
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
88.221.142.62 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
Software
akka-http/10.1.11 /
Resource Hash
6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93

Request headers

Referer
http://35.188.36.185/paypal/www.paypal.com/website/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Sat, 06 Jun 2020 20:18:55 GMT
Server
akka-http/10.1.11
P3P
policyref="https://t.paypal.com/w3c/p3p.xml",CP="CAO IND OUR SAM UNI STA COR COM"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
42
Expires
Sat, 06 Jun 2020 20:18:55 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial)

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate boolean| paypalADSInterceptorInjected object| html5 object| Modernizr function| isEligibleIntegration object| antiClickjack object| PAYPAL function| $ object| fpti string| fptiserverurl object| _ifpti object| _0x4923 function| _0x5a96

0 Cookies