proxylogin.us-east-1.cpair.dev.braintree.tools

Summary

This website contacted 3 IPs in 2 countries across 4 domains to perform 4 HTTP transactions. The main IP is 18.210.34.115, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is proxylogin.us-east-1.cpair.dev.braintree.tools.
TLS certificate: Issued by DigiCert SHA2 High Assurance Server CA on October 12th 2023. Valid for: a year.

This is the only time proxylogin.us-east-1.cpair.dev.braintree.tools was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 2	18.210.34.115 18.210.34.115	14618 (AMAZON-AES) (AMAZON-AES)
2 2	107.162.159.88 107.162.159.88	55002 (DEFENSE-NET) (DEFENSE-NET)
1	2a04:4e42:400... 2a04:4e42:400::485	54113 (FASTLY) (FASTLY)
2	104.17.25.14 104.17.25.14	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	3

2 18.210.34.115 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-210-34-115.compute-1.amazonaws.com

29bunisimply-comintegrity-toolh-mssql.lufc.us-east-1.cpair.dev.braintree.tools	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
proxylogin.us-east-1.cpair.dev.braintree.tools	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 107.162.159.88 (United States) 2 redirects

ASN55002 (DEFENSE-NET, US)

sso.paypalcorp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:400::485 (United States)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.17.25.14 (None, )

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 237	11 KB
2	paypalcorp.com 2 redirects sso.paypalcorp.com — Cisco Umbrella Rank: 919832	2 KB
2	braintree.tools 1 redirects 29bunisimply-comintegrity-toolh-mssql.lufc.us-east-1.cpair.dev.braintree.tools proxylogin.us-east-1.cpair.dev.braintree.tools	3 KB
1	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 332	29 KB
4	4

	Domain	Requested by
2	cdnjs.cloudflare.com	proxylogin.us-east-1.cpair.dev.braintree.tools cdnjs.cloudflare.com
2	sso.paypalcorp.com	2 redirects
1	cdn.jsdelivr.net	proxylogin.us-east-1.cpair.dev.braintree.tools
1	proxylogin.us-east-1.cpair.dev.braintree.tools
1	29bunisimply-comintegrity-toolh-mssql.lufc.us-east-1.cpair.dev.braintree.tools	1 redirects
4	5

This site contains links to these domains. Also see Links.

Domain
github.com

Subject Issuer	Validity	Valid
*.cpair.dev.braintree.tools DigiCert SHA2 High Assurance Server CA	`2023-10-12` - `2024-10-30`	a year	crt.sh
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2023 Q3	`2023-09-27` - `2024-10-28`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-07-03` - `2024-07-02`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://proxylogin.us-east-1.cpair.dev.braintree.tools/oauth2/callback?error_description=Authentication+failed.&state=2aiiuNdMIS5wdNWZcdD_4TJAIn1oML6Z_q1_xRAw7vU%3A%2F&error=access_denied
Frame ID: 9DC20AEC9F922898D9BA2D25678A6DAA
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

403 Forbidden

Page URL History Show full URLs

http://29bunisimply-comintegrity-toolh-mssql.lufc.us-east-1.cpair.dev.braintree.tools/ HTTP 307
https://29bunisimply-comintegrity-toolh-mssql.lufc.us-east-1.cpair.dev.braintree.tools/ HTTP 302
https://sso.paypalcorp.com/as/authorization.oauth2?approval_prompt=force&client_id=9db6a9bf-10ce-42c0-a... HTTP 302
https://sso.paypalcorp.com:444/as/XEjQm9L5MJ/resume/as/authorization.ping HTTP 302
https://proxylogin.us-east-1.cpair.dev.braintree.tools/oauth2/callback?error_description=Authentication+failed.&state=2aiiuNdMIS5wd... Page URL

Detected technologies

Bulma (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]+?href="[^"]+bulma(?:\.min)?\.css

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

<link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
//cdn\.jsdelivr\.net/

Page Statistics

4
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

5
Subdomains

3
IPs

2
Countries

42 kB
Transfer

329 kB
Size

8
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://github.com/oauth2-proxy/oauth2-proxy#oauth2_proxy
Title: OAuth2 Proxy

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://29bunisimply-comintegrity-toolh-mssql.lufc.us-east-1.cpair.dev.braintree.tools/ HTTP 307
https://29bunisimply-comintegrity-toolh-mssql.lufc.us-east-1.cpair.dev.braintree.tools/ HTTP 302
https://sso.paypalcorp.com/as/authorization.oauth2?approval_prompt=force&client_id=9db6a9bf-10ce-42c0-ab35-24217ca280d1&redirect_uri=https%3A%2F%2Fproxylogin.us-east-1.cpair.dev.braintree.tools%2Foauth2%2Fcallback&response_type=code&scope=openid+profile+paypal2fa+btoauth2prxy+email&state=2aiiuNdMIS5wdNWZcdD_4TJAIn1oML6Z_q1_xRAw7vU%3A%2F HTTP 302
https://sso.paypalcorp.com:444/as/XEjQm9L5MJ/resume/as/authorization.ping HTTP 302
https://proxylogin.us-east-1.cpair.dev.braintree.tools/oauth2/callback?error_description=Authentication+failed.&state=2aiiuNdMIS5wdNWZcdD_4TJAIn1oML6Z_q1_xRAw7vU%3A%2F&error=access_denied Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

403
Forbidden

Primary Request callback Show response
proxylogin.us-east-1.cpair.dev.braintree.tools/oauth2/
Redirect Chain

http://29bunisimply-comintegrity-toolh-mssql.lufc.us-east-1.cpair.dev.braintree.tools/
https://29bunisimply-comintegrity-toolh-mssql.lufc.us-east-1.cpair.dev.braintree.tools/
https://sso.paypalcorp.com/as/authorization.oauth2?approval_prompt=force&client_id=9db6a9bf-10ce-42c0-ab35-24217ca280d1&redirect_uri=https%3A%2F%2Fproxylogin.us-east-1.cpair.dev.braintree.tools%2Fo...
https://sso.paypalcorp.com:444/as/XEjQm9L5MJ/resume/as/authorization.ping
https://proxylogin.us-east-1.cpair.dev.braintree.tools/oauth2/callback?error_description=Authentication+failed.&state=2aiiuNdMIS5wdNWZcdD_4TJAIn1oML6Z_q1_xRAw7vU%3A%2F&error=access_denied

3 KB
2 KB

137ms
41ms

Document
text/html

18.210.34.115
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://proxylogin.us-east-1.cpair.dev.braintree.tools/oauth2/callback?error_description=Authentication+failed.&state=2aiiuNdMIS5wdNWZcdD_4TJAIn1oML6Z_q1_xRAw7vU%3A%2F&error=access_denied
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 18.210.34.115 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-210-34-115.compute-1.amazonaws.com
Software: nginx/1.18.0 /
Resource Hash: b884576e49e81e5954e7fe215bf5e4ed3e80513501ab1ede172b4b5b69f0bb3a

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: no-cache, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=utf-8
Date: Sat, 06 Apr 2024 01:21:09 GMT
Expires: Thu, 01 Jan 1970 00:00:00 UTC
Server: nginx/1.18.0
Transfer-Encoding: chunked

Redirect headers

cache-control: no-cache, no-store
content-length: 0
content-type: text/html;charset=utf-8
date: Sat, 06 Apr 2024 01:21:09 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://proxylogin.us-east-1.cpair.dev.braintree.tools/oauth2/callback?error_description=Authentication+failed.&state=2aiiuNdMIS5wdNWZcdD_4TJAIn1oML6Z_q1_xRAw7vU%3A%2F&error=access_denied#.
pragma: no-cache
referrer-policy: origin
strict-transport-security: max-age=31536000
x-robots-tag: noindex

GET
H2 200 bulma.min.css
cdn.jsdelivr.net/npm/bulma@0.9.1/css/ 199 KB
29 KB 96ms
30ms Stylesheet
text/css 2a04:4e42:400::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bulma@0.9.1/css/bulma.min.css

Requested by

Host: proxylogin.us-east-1.cpair.dev.braintree.tools
URL: https://proxylogin.us-east-1.cpair.dev.braintree.tools/oauth2/callback?error_description=Authentication+failed.&state=2aiiuNdMIS5wdNWZcdD_4TJAIn1oML6Z_q1_xRAw7vU%3A%2F&error=access_denied

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:400::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

/

Resource Hash

58b28659220961ead137cb5b346b5759562750ce703094d70fc786e0db467033

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://proxylogin.us-east-1.cpair.dev.braintree.tools/
accept-language: en-US,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Sat, 06 Apr 2024 01:21:09 GMT
x-content-type-options: nosniff
content-encoding: br
age: 1451881
x-jsd-version: 0.9.1
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 29360
x-served-by: cache-fra-eddf8230058-FRA, cache-nyc-kteb1890058-NYC
x-jsd-version-type: version
etag: W/"31cfe-cxAuaoAAu03IvCnGZXCIyxkHKC0"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *

GET
H3 200 all.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.2/css/ 58 KB
11 KB 93ms
63ms Stylesheet
text/css 104.17.25.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.2/css/all.min.css

Requested by

Host: proxylogin.us-east-1.cpair.dev.braintree.tools
URL: https://proxylogin.us-east-1.cpair.dev.braintree.tools/oauth2/callback?error_description=Authentication+failed.&state=2aiiuNdMIS5wdNWZcdD_4TJAIn1oML6Z_q1_xRAw7vU%3A%2F&error=access_denied

Protocol

H3

Security

QUIC, , AES_128_GCM

Server

104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d1fb8d8337cd22568295b0ed998c85c58f0b4cd083af0b0db21cb0af80002f2d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://proxylogin.us-east-1.cpair.dev.braintree.tools/
accept-language: en-US,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 06 Apr 2024 01:21:09 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 98434
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 10472
last-modified: Wed, 13 Jan 2021 22:29:05 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5fff7431-e7d0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dNOEWoU9nBMydmJ7pkO7%2FHRUiFMD%2BVDMKh8pbCfn7ZMQM8vFMiI7gqNLSTysQZNVU38Beme8Ijf%2B7%2BSkM4CJtLzE1lxUGSq5hC%2FKqE4HsBo4tyiW30YZ2NH1OGVD1Nog73ceKx2a"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 86fdf5a2ffd5a234-YYZ
expires: Thu, 27 Mar 2025 01:21:09 GMT

GET
H3 200 fa-solid-900.woff2
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.2/webfonts/ 69 KB
0 141ms
36ms Font
application/octet-stream 104.17.25.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.2/webfonts/fa-solid-900.woff2

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.2/css/all.min.css

Protocol

H3

Security

QUIC, , AES_128_GCM

Server

104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.2/css/all.min.css
Origin: https://proxylogin.us-east-1.cpair.dev.braintree.tools
accept-language: en-US,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 06 Apr 2024 01:21:09 GMT
strict-transport-security: max-age=15780000
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 120841
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 80252
last-modified: Wed, 13 Jan 2021 22:29:06 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5fff7432-1397c"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=k7i%2BRhbLEfTMLsml8cnxOUdsbTiNuzHiXuWmreKBSsBQk4HdjTzPpioU39YoZ83SqYsiwMbNIs9MhAy%2Fwi7gQtnx3LSS%2FOKp29CVpUpAGv50UBgZorPfLxcc41gzF04jB1dixxoF"}],"group":"cf-nel","max_age":604800}
content-type: application/octet-stream; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 86fdf5a43e7638e4-YYZ
expires: Thu, 27 Mar 2025 01:21:09 GMT

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

8 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.braintree.tools/	1970-01-20 19:49:31	Name: _oauth2_proxy_csrf Value: OEwRvdkN8c9EZi6OmJUrKBpKYGlJCq9-apfZaU2bpZf7JbzVCLu1ONGI3ARJ6o3suXteu9b0jw30pE2vTB_LCWuMX9jz56e85s1QZBIPgcdcw4-Uy0ujpvw=\|1712366467\|uhWOJXpsk6VEuTnnzI71GHOGmnAA65ks8_F_MlBLH5A=
.us-east-1.cpair.dev.braintree.tools/	1969-12-31 23:59:59	Name: cpairtarget Value: 29bunisimply-comintegrity-toolh-mssql.lufc.us-east-1.cpair.dev.braintree.tools
.us-east-1.cpair.dev.braintree.tools/	1969-12-31 23:59:59	Name: cpairport Value: 443
sso.paypalcorp.com/	1970-01-20 19:49:31	Name: PF Value: TzdyKi5n67sIPC5SqHXKcJ
sso.paypalcorp.com/	1970-01-21 04:25:24	Name: pfbrowserid Value: 7dUw4R4Ngnan7qNIU3dR
sso.paypalcorp.com/	1970-01-20 19:39:27	Name: pp-ssoprod-stickyw Value: rd3o00000000000000000000ffff0ab9f635o443
sso.paypalcorp.com/	1969-12-31 23:59:59	Name: TS01b10454 Value: 0110f765d95095ee7a241979571f98376876cd2686de72d7a0a3b048ff9d342b0ae3aef6638719d0277dd06c1f1e98d91bf06fa0c5
sso.paypalcorp.com/	1969-12-31 23:59:59	Name: TSb39869d6027 Value: 08ed0955e2ab200064ce8c55266b7ebb462c6e95cae70126be59a5f42866837f37fee5e4f044733808a0f5f492113000fe6f16d2eed0ef93188e1f3d1755041b4428e637952508e6df8f6242e82f973a6603567dab8ad9106e4db6d12ba249ff

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://proxylogin.us-east-1.cpair.dev.braintree.tools/oauth2/callback?error_description=Authentication+failed.&state=2aiiuNdMIS5wdNWZcdD_4TJAIn1oML6Z_q1_xRAw7vU%3A%2F&error=access_denied#. Message: Failed to load resource: the server responded with a status of 403 (Forbidden)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

29bunisimply-comintegrity-toolh-mssql.lufc.us-east-1.cpair.dev.braintree.tools
cdn.jsdelivr.net
cdnjs.cloudflare.com
proxylogin.us-east-1.cpair.dev.braintree.tools
sso.paypalcorp.com
104.17.25.14
107.162.159.88
18.210.34.115
2a04:4e42:400::485
58b28659220961ead137cb5b346b5759562750ce703094d70fc786e0db467033
b884576e49e81e5954e7fe215bf5e4ed3e80513501ab1ede172b4b5b69f0bb3a
d1fb8d8337cd22568295b0ed998c85c58f0b4cd083af0b0db21cb0af80002f2d

proxylogin.us-east-1.cpair.dev.braintree.tools Open in urlscan Pro 18.210.34.115 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

4 Requests

100 %HTTPS

25 %IPv6

4 Domains

5 Subdomains

3 IPs

2 Countries

42 kBTransfer

329 kBSize

8 Cookies

1 Outgoing links

Page URL History

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

8 Cookies

1 Console Messages

Indicators

proxylogin.us-east-1.cpair.dev.braintree.tools Open in urlscan Pro
18.210.34.115 Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

5
Subdomains

3
IPs

2
Countries

42 kB
Transfer

329 kB
Size

8
Cookies

4 HTTP transactions
0 data transactions