paypal.ngservers.com Open in urlscan Pro
195.154.237.40 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://paypal.ngservers.com/
Submission Tags: @phishunt_io
Submission: On January 31 via api (January 31st 2021, 11:24:11 pm UTC) from ES

Summary HTTP 9 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 9 HTTP transactions. The main IP is 195.154.237.40, located in Paris, France and belongs to Online SAS, FR. The main domain is paypal.ngservers.com.
TLS certificate: Issued by R3 on January 31st 2021. Valid for: 3 months.

This is the only time paypal.ngservers.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address		AS Autonomous System
9	195.154.237.40 195.154.237.40		12876 (Online SAS) (Online SAS)
9	1

9 195.154.237.40 (Paris, France)

ASN12876 (Online SAS, FR)
PTR: web.ngservers.com

paypal.ngservers.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	ngservers.com paypal.ngservers.com	39 KB
9	1

	Domain	Requested by
9	paypal.ngservers.com	paypal.ngservers.com
9	1

This site contains links to these domains. Also see Links.

Domain
wordpress.org
fr.wordpress.org

Subject Issuer	Validity	Valid
paypal.ngservers.com R3	`2021-01-31` - `2021-05-01`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://paypal.ngservers.com/
Frame ID: BBF5CC1C3E87B4CDB4E4D8D163ECEB79
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i
meta generator /^WordPress ?([\d.]+)?/i
headers link /rel="https:\/\/api\.w\.org\/"/i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i
meta generator /^WordPress ?([\d.]+)?/i
headers link /rel="https:\/\/api\.w\.org\/"/i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i
meta generator /^WordPress ?([\d.]+)?/i
headers link /rel="https:\/\/api\.w\.org\/"/i

Debian (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Debian/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

9
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

39 kB
Transfer

203 kB
Size

0
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://wordpress.org/
Title: Un commentateur WordPress

Search URL Search Domain Scan URL

URL: https://fr.wordpress.org/
Title: WordPress

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
paypal.ngservers.com/ 8 KB
3 KB 256ms
116ms Document
text/html 195.154.237.40
Online SAS

General

Check archive.org

Show headers Download Go to

Full URL: https://paypal.ngservers.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 195.154.237.40 Paris, France, ASN12876 (Online SAS, FR),
Reverse DNS: web.ngservers.com
Software: Apache/2.4.38 (Debian) /
Resource Hash: 7915aca7fe799a38fefd86bdcaffb97e75a54247a464df7e104711582615b574

Request headers

Host: paypal.ngservers.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sun, 31 Jan 2021 23:23:46 GMT
Server: Apache/2.4.38 (Debian)
Upgrade: h2,h2c
Connection: Upgrade, Keep-Alive
Link: <https://paypal.ngservers.com/index.php?rest_route=/>; rel="https://api.w.org/"
X-Mod-Pagespeed: 1.13.35.2-0
Cache-Control: max-age=0, no-cache, s-maxage=10
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 3123
Keep-Alive: timeout=5, max=100
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK style.min.css
paypal.ngservers.com/wp-includes/css/dist/block-library/ 50 KB
8 KB 45ms
44ms Stylesheet
text/css 195.154.237.40
Online SAS

General

Check archive.org

Show headers Download Go to

Full URL

https://paypal.ngservers.com/wp-includes/css/dist/block-library/style.min.css?ver=5.6

Requested by

Host: paypal.ngservers.com
URL: https://paypal.ngservers.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

195.154.237.40 Paris, France, ASN12876 (Online SAS, FR),

Reverse DNS

web.ngservers.com

Software

Apache/2.4.38 (Debian) /

Resource Hash

9ab596e78d079633dd88bd1b3b6777f40cb508493961c371c9b4d2544e18fc59

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://paypal.ngservers.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sun, 31 Jan 2021 23:23:46 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Original-Content-Length: 51433
Server: Apache/2.4.38 (Debian)
Etag: W/"PSA-aj-Bdfqc367R9"
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=2584145
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 7756
Expires: Tue, 02 Mar 2021 21:12:52 GMT

GET
H/1.1 200
OK theme.min.css
paypal.ngservers.com/wp-includes/css/dist/block-library/ 2 KB
1 KB 93ms
44ms Stylesheet
text/css 195.154.237.40
Online SAS

General

Check archive.org

Show headers Download Go to

Full URL: https://paypal.ngservers.com/wp-includes/css/dist/block-library/theme.min.css?ver=5.6
Requested by: Host: paypal.ngservers.com
URL: https://paypal.ngservers.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 195.154.237.40 Paris, France, ASN12876 (Online SAS, FR),
Reverse DNS: web.ngservers.com
Software: Apache/2.4.38 (Debian) /
Resource Hash: 83596846d160e44c98d8674d1f4b35be40646ec5ea30d9df136012028d354aa6

Request headers

Referer: https://paypal.ngservers.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sun, 31 Jan 2021 23:23:46 GMT
Content-Encoding: gzip
Last-Modified: Sun, 31 Jan 2021 19:31:21 GMT
Server: Apache/2.4.38 (Debian)
ETag: "8f9-5ba37483e8472-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=2592000, s-maxage=10
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 741
Expires: Tue, 02 Mar 2021 23:23:46 GMT

GET
H/1.1 200
OK style.css
paypal.ngservers.com/wp-content/themes/twentytwentyone/ 124 KB
17 KB 131ms
44ms Stylesheet
text/css 195.154.237.40
Online SAS

General

Check archive.org

Show headers Download Go to

Full URL

https://paypal.ngservers.com/wp-content/themes/twentytwentyone/style.css?ver=1.0

Requested by

Host: paypal.ngservers.com
URL: https://paypal.ngservers.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

195.154.237.40 Paris, France, ASN12876 (Online SAS, FR),

Reverse DNS

web.ngservers.com

Software

Apache/2.4.38 (Debian) /

Resource Hash

2c22d63090a1b5834a3ea46f04d24fd6c94df45aebb7f4a5a40e6acca88c4219

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://paypal.ngservers.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sun, 31 Jan 2021 23:23:46 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Original-Content-Length: 151714
Server: Apache/2.4.38 (Debian)
Etag: W/"PSA-aj-Gzymq9BULq"
Vary: Accept-Encoding
Upgrade: h2,h2c
Cache-Control: max-age=2584145
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Content-Type: text/css
Keep-Alive: timeout=5, max=100
Content-Length: 17337
Expires: Tue, 02 Mar 2021 21:12:52 GMT

GET
H/1.1 200
OK polyfills.js Show response
paypal.ngservers.com/wp-content/themes/twentytwentyone/assets/js/ 558 B
745 B 133ms
44ms Script
application/javascript 195.154.237.40
Online SAS

General

Check archive.org

Show headers Download Go to

Full URL

https://paypal.ngservers.com/wp-content/themes/twentytwentyone/assets/js/polyfills.js?ver=1.0

Requested by

Host: paypal.ngservers.com
URL: https://paypal.ngservers.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

195.154.237.40 Paris, France, ASN12876 (Online SAS, FR),

Reverse DNS

web.ngservers.com

Software

Apache/2.4.38 (Debian) /

Resource Hash

9a84929c5068c80dc42c03ba2041bbe47d96d0dc8361bbfdfd938b93bd2c9d15

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://paypal.ngservers.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sun, 31 Jan 2021 23:23:46 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Original-Content-Length: 1057
Server: Apache/2.4.38 (Debian)
Etag: W/"PSA-aj-1Kl2gzn-FU"
Vary: Accept-Encoding
Upgrade: h2,h2c
Cache-Control: max-age=2584145
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Content-Type: application/javascript
Keep-Alive: timeout=5, max=100
Content-Length: 280
Expires: Tue, 02 Mar 2021 21:12:52 GMT

GET
H/1.1 200
OK responsive-embeds.js Show response
paypal.ngservers.com/wp-content/themes/twentytwentyone/assets/js/ 513 B
717 B 138ms
44ms Script
application/javascript 195.154.237.40
Online SAS

General

Check archive.org

Show headers Download Go to

Full URL

https://paypal.ngservers.com/wp-content/themes/twentytwentyone/assets/js/responsive-embeds.js?ver=1.0

Requested by

Host: paypal.ngservers.com
URL: https://paypal.ngservers.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

195.154.237.40 Paris, France, ASN12876 (Online SAS, FR),

Reverse DNS

web.ngservers.com

Software

Apache/2.4.38 (Debian) /

Resource Hash

928a6add4f20c7100f2286ec2fceda328412634a4ee3620d8215cc72de69f210

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://paypal.ngservers.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sun, 31 Jan 2021 23:23:46 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Original-Content-Length: 1111
Server: Apache/2.4.38 (Debian)
Etag: W/"PSA-aj-rBbT20uzwA"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=2584145
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 279
Expires: Tue, 02 Mar 2021 21:12:52 GMT

GET
H/1.1 200
OK wp-embed.min.js Show response
paypal.ngservers.com/wp-includes/js/ 1 KB
1 KB 139ms
45ms Script
application/javascript 195.154.237.40
Online SAS

General

Check archive.org

Show headers Download Go to

Full URL

https://paypal.ngservers.com/wp-includes/js/wp-embed.min.js?ver=5.6

Requested by

Host: paypal.ngservers.com
URL: https://paypal.ngservers.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

195.154.237.40 Paris, France, ASN12876 (Online SAS, FR),

Reverse DNS

web.ngservers.com

Software

Apache/2.4.38 (Debian) /

Resource Hash

0284cbccebf1682452d62d06efa3665c874d642d4e03f5f5f9bb0f555da9251b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://paypal.ngservers.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sun, 31 Jan 2021 23:23:46 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Original-Content-Length: 1434
Server: Apache/2.4.38 (Debian)
Etag: W/"PSA-aj-BBM9N8_Q8I"
Vary: Accept-Encoding
Upgrade: h2,h2c
Cache-Control: max-age=2584145
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Content-Type: application/javascript
Keep-Alive: timeout=5, max=100
Content-Length: 740
Expires: Tue, 02 Mar 2021 21:12:52 GMT

GET
H/1.1 200
OK wp-emoji-release.min.js Show response
paypal.ngservers.com/wp-includes/js/ 14 KB
5 KB 94ms
46ms Script
application/javascript 195.154.237.40
Online SAS

General

Check archive.org

Show headers Download Go to

Full URL

https://paypal.ngservers.com/wp-includes/js/wp-emoji-release.min.js?ver=5.6

Requested by

Host: paypal.ngservers.com
URL: https://paypal.ngservers.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

195.154.237.40 Paris, France, ASN12876 (Online SAS, FR),

Reverse DNS

web.ngservers.com

Software

Apache/2.4.38 (Debian) /

Resource Hash

5ae65bdc21a1526f3a0a2ff517c0df99fc0d9fdabf01951df1b9819bc6af0fd4

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://paypal.ngservers.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sun, 31 Jan 2021 23:23:46 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Original-Content-Length: 14246
Server: Apache/2.4.38 (Debian)
Etag: W/"PSA-aj-EYbhaA_RTY"
Vary: Accept-Encoding
Upgrade: h2,h2c
Cache-Control: max-age=2584145
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Content-Type: application/javascript
Keep-Alive: timeout=5, max=100
Content-Length: 4563
Expires: Tue, 02 Mar 2021 21:12:52 GMT

GET
H/1.1 200
OK print.css
paypal.ngservers.com/wp-content/themes/twentytwentyone/assets/css/ 2 KB
1 KB 49ms
44ms Stylesheet
text/css 195.154.237.40
Online SAS

General

Check archive.org

Show headers Download Go to

Full URL

https://paypal.ngservers.com/wp-content/themes/twentytwentyone/assets/css/print.css?ver=1.0

Requested by

Host: paypal.ngservers.com
URL: https://paypal.ngservers.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

195.154.237.40 Paris, France, ASN12876 (Online SAS, FR),

Reverse DNS

web.ngservers.com

Software

Apache/2.4.38 (Debian) /

Resource Hash

37cf1af51d4baf7d28b9d5435933353178a44a6948e87bf9abfae2d19c763b08

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://paypal.ngservers.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sun, 31 Jan 2021 23:23:46 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Original-Content-Length: 2897
Server: Apache/2.4.38 (Debian)
Etag: W/"PSA-aj-qVAzrlg_OG"
Vary: Accept-Encoding
Upgrade: h2,h2c
Cache-Control: max-age=2584145
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Content-Type: text/css
Keep-Alive: timeout=5, max=100
Content-Length: 822
Expires: Tue, 02 Mar 2021 21:12:52 GMT

Verdicts & Comments Add Verdict or Comment

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

paypal.ngservers.com
195.154.237.40
0284cbccebf1682452d62d06efa3665c874d642d4e03f5f5f9bb0f555da9251b
2c22d63090a1b5834a3ea46f04d24fd6c94df45aebb7f4a5a40e6acca88c4219
37cf1af51d4baf7d28b9d5435933353178a44a6948e87bf9abfae2d19c763b08
5ae65bdc21a1526f3a0a2ff517c0df99fc0d9fdabf01951df1b9819bc6af0fd4
7915aca7fe799a38fefd86bdcaffb97e75a54247a464df7e104711582615b574
83596846d160e44c98d8674d1f4b35be40646ec5ea30d9df136012028d354aa6
928a6add4f20c7100f2286ec2fceda328412634a4ee3620d8215cc72de69f210
9a84929c5068c80dc42c03ba2041bbe47d96d0dc8361bbfdfd938b93bd2c9d15
9ab596e78d079633dd88bd1b3b6777f40cb508493961c371c9b4d2544e18fc59

paypal.ngservers.com Open in urlscan Pro 195.154.237.40 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

9 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

39 kBTransfer

203 kBSize

0 Cookies

2 Outgoing links

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

13 JavaScript Global Variables

0 Cookies

Indicators

paypal.ngservers.com Open in urlscan Pro
195.154.237.40 Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

39 kB
Transfer

203 kB
Size

0
Cookies

9 HTTP transactions
0 data transactions