freedollars2020.000webhostapp.com Open in urlscan Pro
2a02:4780:dead:ab2a::1  Malicious Activity! Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request websrc.php Show response freedollars2020.000webhostapp.com/signin/	23 KB 9 KB	380ms 168ms	Document text/html	2a02:4780:dead:ab2a::1 AWEX
General Check archive.org Show headers Download Go to Full URL https://freedollars2020.000webhostapp.com/signin/websrc.php?cmd=_login-submit&dispatch=4a1dbf86a324509014a1a41ae452547e88a7274301b71cf58da471d116e4a3006835954b Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:4780:dead:ab2a::1 , United States, ASN204915 (AWEX, US), Reverse DNS Software awex / Resource Hash c4deb5623275816e304df0c7ad8a63c812bc36b2434ee6b47f5f2b5c28fa2034 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers :method GET :authority freedollars2020.000webhostapp.com :scheme https :path /signin/websrc.php?cmd=_login-submit&dispatch=4a1dbf86a324509014a1a41ae452547e88a7274301b71cf58da471d116e4a3006835954b pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 date Wed, 24 Jun 2020 00:56:35 GMT content-type text/html; charset=UTF-8 server awex x-xss-protection 1; mode=block x-content-type-options nosniff x-request-id f33b3bce3242103cce8a05141d3d8863 content-encoding gzip
GET H2	200	app.css www.paypalobjects.com/web/res/dd1/3776a01d8c6d0e1d251f0de8e5e55/css/	41 KB 8 KB	172ms 57ms	Stylesheet text/css	104.111.228.123 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://www.paypalobjects.com/web/res/dd1/3776a01d8c6d0e1d251f0de8e5e55/css/app.css Requested by Host: freedollars2020.000webhostapp.com URL: https://freedollars2020.000webhostapp.com/signin/websrc.php?cmd=_login-submit&dispatch=4a1dbf86a324509014a1a41ae452547e88a7274301b71cf58da471d116e4a3006835954b Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.228.123 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-228-123.deploy.static.akamaitechnologies.com Software Apache / Resource Hash 2f55d1691615c70e7f2bd076b025b17de86275a13f5e47d1aba3bbc80e4f2672 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Referer https://freedollars2020.000webhostapp.com/signin/websrc.php?cmd=_login-submit&dispatch=4a1dbf86a324509014a1a41ae452547e88a7274301b71cf58da471d116e4a3006835954b User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 24 Jun 2020 00:56:35 GMT content-encoding gzip x-content-type-options nosniff last-modified Fri, 01 Jul 2016 03:12:01 GMT server Apache vary Accept-Encoding content-type text/css status 200 cache-control max-age=31536000 strict-transport-security max-age=31536000 accept-ranges bytes content-length 8118 expires Thu, 24 Jun 2021 00:56:35 GMT
GET H2	200	modernizr-2.6.1.js Show response www.paypalobjects.com/web/res/dd1/3776a01d8c6d0e1d251f0de8e5e55/js/lib/	4 KB 2 KB	176ms 62ms	Script application/x-javascript	104.111.228.123 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://www.paypalobjects.com/web/res/dd1/3776a01d8c6d0e1d251f0de8e5e55/js/lib/modernizr-2.6.1.js Requested by Host: freedollars2020.000webhostapp.com URL: https://freedollars2020.000webhostapp.com/signin/websrc.php?cmd=_login-submit&dispatch=4a1dbf86a324509014a1a41ae452547e88a7274301b71cf58da471d116e4a3006835954b Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.228.123 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-228-123.deploy.static.akamaitechnologies.com Software Apache / Resource Hash a6c3bff965978df8093c3a29f7071c21d7439a212af41e7b40ce70d94d6bcc44 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Referer https://freedollars2020.000webhostapp.com/signin/websrc.php?cmd=_login-submit&dispatch=4a1dbf86a324509014a1a41ae452547e88a7274301b71cf58da471d116e4a3006835954b User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 24 Jun 2020 00:56:35 GMT x-pad avoid browser bug x-content-type-options nosniff status 200 content-encoding gzip vary Accept-Encoding content-length 1788 last-modified Fri, 01 Jul 2016 03:12:01 GMT server Apache strict-transport-security max-age=31536000 access-control-allow-methods GET content-type application/x-javascript access-control-allow-origin * cache-control max-age=31536000 accept-ranges bytes access-control-allow-headers x-csrf-token expires Thu, 24 Jun 2021 00:56:35 GMT
GET H/1.1	200 OK	fb-all-prod.pp2.min.js Show response c.paypal.com/webstatic/r/fb/	58 KB 18 KB	230ms 95ms	Script application/x-javascript	84.53.164.154 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://c.paypal.com/webstatic/r/fb/fb-all-prod.pp2.min.js Requested by Host: freedollars2020.000webhostapp.com URL: https://freedollars2020.000webhostapp.com/signin/websrc.php?cmd=_login-submit&dispatch=4a1dbf86a324509014a1a41ae452547e88a7274301b71cf58da471d116e4a3006835954b Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 84.53.164.154 , Ascension Island, ASN16625 (AKAMAI-AS, US), Reverse DNS a84-53-164-154.deploy.static.akamaitechnologies.com Software Apache / Resource Hash 0adaf22e6710cbc950db6526ac09b6c8757ed25e4701196e88cf2f87dca596c7 Request headers Referer https://freedollars2020.000webhostapp.com/signin/websrc.php?cmd=_login-submit&dispatch=4a1dbf86a324509014a1a41ae452547e88a7274301b71cf58da471d116e4a3006835954b User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Wed, 24 Jun 2020 00:56:36 GMT X-Pad avoid browser bug Last-Modified Mon, 30 Sep 2019 18:09:31 GMT Server Apache Vary Accept-Encoding Content-Type application/x-javascript Cache-Control max-age=86400 Connection keep-alive Accept-Ranges bytes Content-Encoding gzip Content-Length 18320 Expires Thu, 25 Jun 2020 00:56:36 GMT
GET H2	200	require.js Show response www.paypalobjects.com/web/res/dd1/3776a01d8c6d0e1d251f0de8e5e55/js/lib/	15 KB 6 KB	270ms 155ms	Script application/x-javascript	104.111.228.123 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://www.paypalobjects.com/web/res/dd1/3776a01d8c6d0e1d251f0de8e5e55/js/lib/require.js Requested by Host: freedollars2020.000webhostapp.com URL: https://freedollars2020.000webhostapp.com/signin/websrc.php?cmd=_login-submit&dispatch=4a1dbf86a324509014a1a41ae452547e88a7274301b71cf58da471d116e4a3006835954b Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.228.123 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-228-123.deploy.static.akamaitechnologies.com Software Apache / Resource Hash c007d73792ac2d25882bfbb573e700e721a0adacfab947e6a0b64a61991fecf0 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Referer https://freedollars2020.000webhostapp.com/signin/websrc.php?cmd=_login-submit&dispatch=4a1dbf86a324509014a1a41ae452547e88a7274301b71cf58da471d116e4a3006835954b User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 24 Jun 2020 00:56:35 GMT x-pad avoid browser bug x-content-type-options nosniff status 200 content-encoding gzip vary Accept-Encoding content-length 5999 last-modified Fri, 01 Jul 2016 03:12:01 GMT server Apache strict-transport-security max-age=31536000 access-control-allow-methods GET content-type application/x-javascript access-control-allow-origin * cache-control max-age=31536000 accept-ranges bytes access-control-allow-headers x-csrf-token expires Thu, 24 Jun 2021 00:56:35 GMT
GET H2	200	app.js Show response www.paypalobjects.com/web/res/dd1/3776a01d8c6d0e1d251f0de8e5e55/js/	297 KB 91 KB	218ms 104ms	Script application/x-javascript	104.111.228.123 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://www.paypalobjects.com/web/res/dd1/3776a01d8c6d0e1d251f0de8e5e55/js/app.js Requested by Host: freedollars2020.000webhostapp.com URL: https://freedollars2020.000webhostapp.com/signin/websrc.php?cmd=_login-submit&dispatch=4a1dbf86a324509014a1a41ae452547e88a7274301b71cf58da471d116e4a3006835954b Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.228.123 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-228-123.deploy.static.akamaitechnologies.com Software Apache / Resource Hash ab4017e3f5f315af5f2e8ee8b184180ed2cc8ee6eab6df7fbaa7c7716036a9b8 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Referer https://freedollars2020.000webhostapp.com/signin/websrc.php?cmd=_login-submit&dispatch=4a1dbf86a324509014a1a41ae452547e88a7274301b71cf58da471d116e4a3006835954b User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 24 Jun 2020 00:56:35 GMT x-pad avoid browser bug x-content-type-options nosniff status 200 content-encoding gzip vary Accept-Encoding content-length 93161 last-modified Fri, 01 Jul 2016 03:12:01 GMT server Apache strict-transport-security max-age=31536000 access-control-allow-methods GET content-type application/x-javascript access-control-allow-origin * cache-control max-age=31536000 accept-ranges bytes access-control-allow-headers x-csrf-token expires Thu, 24 Jun 2021 00:56:35 GMT
GET H2	200	pp_jscode_080706.js Show response www.paypalobjects.com/js/site_catalyst/	60 KB 23 KB	179ms 64ms	Script application/x-javascript	104.111.228.123 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://www.paypalobjects.com/js/site_catalyst/pp_jscode_080706.js Requested by Host: freedollars2020.000webhostapp.com URL: https://freedollars2020.000webhostapp.com/signin/websrc.php?cmd=_login-submit&dispatch=4a1dbf86a324509014a1a41ae452547e88a7274301b71cf58da471d116e4a3006835954b Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.228.123 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-228-123.deploy.static.akamaitechnologies.com Software Apache / Resource Hash 18c9428f5ed837e027c6fcf29afe9d1f63a1e1e5b53ee1dc6373cf1cd1ea22aa Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Referer https://freedollars2020.000webhostapp.com/signin/websrc.php?cmd=_login-submit&dispatch=4a1dbf86a324509014a1a41ae452547e88a7274301b71cf58da471d116e4a3006835954b User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 24 Jun 2020 00:56:35 GMT x-pad avoid browser bug x-content-type-options nosniff status 200 content-encoding gzip vary Accept-Encoding content-length 22880 last-modified Thu, 15 Dec 2016 01:32:43 GMT server Apache strict-transport-security max-age=31536000 access-control-allow-methods GET content-type application/x-javascript access-control-allow-origin * cache-control max-age=3600 accept-ranges bytes access-control-allow-headers x-csrf-token expires Wed, 24 Jun 2020 01:56:35 GMT
GET H2	200	pa.js Show response www.paypalobjects.com/pa/js/	46 KB 17 KB	271ms 158ms	Script application/x-javascript	104.111.228.123 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://www.paypalobjects.com/pa/js/pa.js Requested by Host: freedollars2020.000webhostapp.com URL: https://freedollars2020.000webhostapp.com/signin/websrc.php?cmd=_login-submit&dispatch=4a1dbf86a324509014a1a41ae452547e88a7274301b71cf58da471d116e4a3006835954b Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.228.123 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-228-123.deploy.static.akamaitechnologies.com Software Apache / Resource Hash dfc4edd44398026b0231673cf9e5d60d8d6038fee6e85fae50bc53a8608a9187 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Referer https://freedollars2020.000webhostapp.com/signin/websrc.php?cmd=_login-submit&dispatch=4a1dbf86a324509014a1a41ae452547e88a7274301b71cf58da471d116e4a3006835954b User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 24 Jun 2020 00:56:35 GMT x-pad avoid browser bug x-content-type-options nosniff status 200 content-encoding gzip vary Accept-Encoding content-length 17465 last-modified Tue, 23 Jun 2020 23:51:09 GMT server Apache strict-transport-security max-age=31536000 access-control-allow-methods GET content-type application/x-javascript access-control-allow-origin * cache-control max-age=3600 accept-ranges bytes access-control-allow-headers x-csrf-token expires Wed, 24 Jun 2020 01:56:35 GMT
GET H2	200	footer-powered-by-000webhost-white2.png cdn.000webhost.com/000webhost/logo/	2 KB 2 KB	55ms 29ms	Image image/webp	2606:4700:10::6814:442e CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.000webhost.com/000webhost/logo/footer-powered-by-000webhost-white2.png Requested by Host: freedollars2020.000webhostapp.com URL: https://freedollars2020.000webhostapp.com/signin/websrc.php?cmd=_login-submit&dispatch=4a1dbf86a324509014a1a41ae452547e88a7274301b71cf58da471d116e4a3006835954b Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::6814:442e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 86f2673ec74a632865109a76b2232f4f5b3587daa219e07a17ef1d9c76a0fda5 Security Headers Name Value Strict-Transport-Security max-age=2592000 X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers Referer https://freedollars2020.000webhostapp.com/signin/websrc.php?cmd=_login-submit&dispatch=4a1dbf86a324509014a1a41ae452547e88a7274301b71cf58da471d116e4a3006835954b User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 24 Jun 2020 00:56:36 GMT x-content-type-options nosniff cf-cache-status HIT age 4097 cf-polished origFmt=png, origSize=2046 status 200 content-disposition inline; filename="footer-powered-by-000webhost-white2.webp" x-hostinger-datacenter srv alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 1696 x-xss-protection 1; mode=block expires Wed, 24 Jun 2020 04:56:36 GMT last-modified Thu, 11 Jun 2020 15:37:16 GMT server cloudflare x-frame-options sameorigin etag "5ee24fac-7fe" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=2592000 content-type image/webp vary Accept cache-control public, max-age=14400 x-hostinger-node nl-srv-cdn2 cf-request-id 03856cb5b80000c2d6a231e200000001 accept-ranges bytes cf-ray 5a827d692f15c2d6-FRA cf-bgj imgq:100,h2pri
GET H2	200	api.min.js Show response a.opmnstr.com/app/js/	200 KB 60 KB	201ms 63ms	Script application/javascript	23.111.11.182 HIGHWINDS2
General Check archive.org Show headers Download Go to Full URL https://a.opmnstr.com/app/js/api.min.js Requested by Host: freedollars2020.000webhostapp.com URL: https://freedollars2020.000webhostapp.com/signin/websrc.php?cmd=_login-submit&dispatch=4a1dbf86a324509014a1a41ae452547e88a7274301b71cf58da471d116e4a3006835954b Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 23.111.11.182 Phoenix, United States, ASN33438 (HIGHWINDS2, US), Reverse DNS Software NetDNA-cache/2.2 / Resource Hash 5575c06232e3d3c7feda2a5a9153935be52a558e42f3709c4c264ca6abffddf5 Request headers Referer https://freedollars2020.000webhostapp.com/signin/websrc.php?cmd=_login-submit&dispatch=4a1dbf86a324509014a1a41ae452547e88a7274301b71cf58da471d116e4a3006835954b User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 24 Jun 2020 00:56:36 GMT content-encoding gzip last-modified Tue, 23 Jun 2020 21:26:06 GMT server NetDNA-cache/2.2 x-amz-request-id 95E3FFB25C6853E5 etag W/"359cc3efa3ad54a667275079c7a2308f" x-cache HIT content-type application/javascript status 200 cache-control max-age=31104000 access-control-allow-origin * x-amz-id-2 6Xrp72hp6/hjEfkCfhttZwHvmIJsb6g5sSbT4sbzj6aIKmilQAlq1R1L7h4YAibEDQE49lQUx2g= expires Sat, 19 Jun 2021 00:56:36 GMT
GET H2	200	paypal-logo-129x32.svg www.paypalobjects.com/images/shared/	5 KB 2 KB	93ms 92ms	Image image/svg+xml	104.111.228.123 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.paypalobjects.com/images/shared/paypal-logo-129x32.svg Requested by Host: freedollars2020.000webhostapp.com URL: https://freedollars2020.000webhostapp.com/signin/websrc.php?cmd=_login-submit&dispatch=4a1dbf86a324509014a1a41ae452547e88a7274301b71cf58da471d116e4a3006835954b Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.228.123 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-228-123.deploy.static.akamaitechnologies.com Software Apache / Resource Hash b3cc50b9e94bbecaaeb1079b64b8ca50616d1732824964c1cc2c5422627a0ec5 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Referer https://www.paypalobjects.com/web/res/dd1/3776a01d8c6d0e1d251f0de8e5e55/css/app.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 24 Jun 2020 00:56:36 GMT content-encoding gzip x-content-type-options nosniff x-check-cacheable YES status 200 vary Accept-Encoding content-length 1929 last-modified Fri, 24 Oct 2014 22:52:57 GMT server Apache x-serial 16973 strict-transport-security max-age=31536000 content-type image/svg+xml access-control-allow-origin * cache-control max-age=3600 accept-ranges bytes expires Wed, 24 Jun 2020 01:56:36 GMT
GET H/1.1	200 OK	i c.paypal.com/v1/r/d/ Frame 2B64	0 0	151ms 64ms	Document text/html	84.53.164.154 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://c.paypal.com/v1/r/d/i?js_src=https://c.paypal.com/webstatic/r/fb/fb-all-prod.pp2.min.js Requested by Host: freedollars2020.000webhostapp.com URL: https://freedollars2020.000webhostapp.com/signin/websrc.php?cmd=_login-submit&dispatch=4a1dbf86a324509014a1a41ae452547e88a7274301b71cf58da471d116e4a3006835954b Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 84.53.164.154 , Ascension Island, ASN16625 (AKAMAI-AS, US), Reverse DNS a84-53-164-154.deploy.static.akamaitechnologies.com Software / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Host c.paypal.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Sec-Fetch-Dest iframe Referer https://freedollars2020.000webhostapp.com/signin/websrc.php?cmd=_login-submit&dispatch=4a1dbf86a324509014a1a41ae452547e88a7274301b71cf58da471d116e4a3006835954b Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://freedollars2020.000webhostapp.com/signin/websrc.php?cmd=_login-submit&dispatch=4a1dbf86a324509014a1a41ae452547e88a7274301b71cf58da471d116e4a3006835954b Response headers CORRELATION-ID e1e289a19381f Content-Security-Policy-Report-Only default-src 'self' https://*.paypal.com https://*.paypalobjects.com; script-src 'self' https://*.paypal.com https://*.paypalobjects.com https://www.facebook.com 'unsafe-eval' 'unsafe-inline' blob:; connect-src 'self' https://*.paypal.com; style-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; font-src 'self' https://*.paypal.com https://*.paypalobjects.com data:; img-src 'self' https: data:; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; object-src 'self' https://*.paypal.com https://*.paypalobjects.com; report-uri https://www.paypal.com/csplog/api/log/csp Content-Type text/html;charset=UTF-8 Paypal-Debug-Id e1e289a19381f X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Vary Accept-Encoding Content-Encoding gzip Content-Length 160 Cache-Control no-cache, no-store, must-revalidate Date Wed, 24 Jun 2020 00:56:36 GMT Connection keep-alive
POST H2	404	verifychallenge Show response freedollars2020.000webhostapp.com/auth/	21 KB 6 KB	105ms 105ms	XHR text/html	2a02:4780:dead:ab2a::1 AWEX
General Check archive.org Show headers Download Go to Full URL https://freedollars2020.000webhostapp.com/auth/verifychallenge Requested by Host: freedollars2020.000webhostapp.com URL: https://freedollars2020.000webhostapp.com/signin/websrc.php?cmd=_login-submit&dispatch=4a1dbf86a324509014a1a41ae452547e88a7274301b71cf58da471d116e4a3006835954b Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:4780:dead:ab2a::1 , United States, ASN204915 (AWEX, US), Reverse DNS Software awex / Resource Hash 475d7712f4a6a3997f41807e56f4c61a9e51b7b4883da9064291df4ea6ebd2ac Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://freedollars2020.000webhostapp.com/signin/websrc.php?cmd=_login-submit&dispatch=4a1dbf86a324509014a1a41ae452547e88a7274301b71cf58da471d116e4a3006835954b User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-type application/x-www-form-urlencoded Response headers date Wed, 24 Jun 2020 00:56:36 GMT content-encoding gzip x-content-type-options nosniff server awex content-type text/html; charset=UTF-8 status 404 x-xss-protection 1; mode=block x-request-id fd919ebf998bd3738d8ab9367361f031
GET H2	200	f6brbmuxflyqoriatchv Show response api.omappapi.com/v2/embed/71036/	52 KB 7 KB	295ms 162ms	XHR application/json	143.204.247.69 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://api.omappapi.com/v2/embed/71036/f6brbmuxflyqoriatchv Requested by Host: a.opmnstr.com URL: https://a.opmnstr.com/app/js/api.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 143.204.247.69 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-247-69.cph50.r.cloudfront.net Software Pagely Gateway/1.5.1 / Resource Hash 72f3b7d5bbc574a7670507c38d69507984961a34c2a78235e4cadfd38adb0230 Request headers Referer https://freedollars2020.000webhostapp.com/signin/websrc.php?cmd=_login-submit&dispatch=4a1dbf86a324509014a1a41ae452547e88a7274301b71cf58da471d116e4a3006835954b User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 24 Jun 2020 00:56:36 GMT content-encoding gzip x-cache-config 0 0 x-amz-cf-pop CPH50-C1 x-cache-status HIT x-cache Miss from cloudfront status 200 access-control-allow-headers X-CSRF-Token x-optinmonster-campaign f6brbmuxflyqoriatchv x-user-agent standard last-modified Wed, 17 Jun 2020 15:26:43 GMT server Pagely Gateway/1.5.1 etag W/"be87dcaccc31a2dbac6626bca53ea873" vary Accept-Encoding, User-Agent content-type application/json via 1.1 55541d3f726d85610ca3ec4fc80705f1.cloudfront.net (CloudFront) access-control-expose-headers X-OptinMonster-Campaign cache-control public, max-age=30, stale-while-revalidate=1800 access-control-allow-origin * x-amz-cf-id ZwNrrbjeDbyAyYGL5OJ_EBeTqgbOnaKbAAvF_5gSiEBYaLGR_YM9uA== expires Wed, 24 Jun 2020 00:31:53 GMT
GET H2	200	webfont.js Show response ajax.googleapis.com/ajax/libs/webfont/1.5.18/	16 KB 7 KB	24ms 6ms	Script text/javascript	2a00:1450:4001:817::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/webfont/1.5.18/webfont.js Requested by Host: a.opmnstr.com URL: https://a.opmnstr.com/app/js/api.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:817::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ce261eb163fcaee6953cedc35059732a133766ab824dc512bbdf9424d48601e4 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://freedollars2020.000webhostapp.com/signin/websrc.php?cmd=_login-submit&dispatch=4a1dbf86a324509014a1a41ae452547e88a7274301b71cf58da471d116e4a3006835954b User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 11 Jun 2020 16:22:46 GMT content-encoding gzip x-content-type-options nosniff age 1067630 status 200 alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 6490 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe vary Accept-Encoding content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Fri, 11 Jun 2021 16:22:46 GMT
GET H/1.1	200 OK	ts t.paypal.com/	42 B 748 B	592ms 451ms	Image image/gif	23.37.43.154 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://t.paypal.com/ts?v=1.4.14&t=1592960196598&g=-120&pgrp=main%3Aunifiedloginnodeweb%3A%3A%3Alogin-captcha&page=main%3Aunifiedloginnodeweb%3A%3A%3Alogin-captcha%3A%3A%3A&tmpl=unifiedloginnodeweb%2Fpublic%2Ftemplates%2Flogin.dust&pgst=1467592127381&lgin=%3A%3A&vers=unifiedloginnodeweb&calc=b7274a1059ef6&rsta=en_US&pgtf=Nodejs&s=ci&csci=4f4ae34601ef4e57b72d4bf29990f9a5&comp=unifiedloginnodeweb&tsrce=mppnodeweb&e=im&imsrc=setup&view=%7B%22t10%22%3A212%2C%22t11%22%3A943%2C%22tcp%22%3A648%2C%22et%22%3A%224g%22%2C%22nt%22%3A%22navigate%22%2C%22bt%22%3A50%7D&pt=Log%20in%20to%20your%20PayPal%20account&cd=24&sw=1600&sh=1200&dw=1600&dh=1200&bw=1600&bh=1200&ce=1&t1=212&t1c=212&t1d=1&t1s=108&t2=168&t3=38&t4d=495&t4=509&t4e=14&tt=891&rdc=0&res=%7B%7D&3p_vid=5d9eb4d11f76bed8&3p_fpti=3b9de8e874489d3 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 23.37.43.154 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-37-43-154.deploy.static.akamaitechnologies.com Software akka-http/10.1.11 / Resource Hash 6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93 Request headers Referer https://freedollars2020.000webhostapp.com/signin/websrc.php?cmd=_login-submit&dispatch=4a1dbf86a324509014a1a41ae452547e88a7274301b71cf58da471d116e4a3006835954b User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Pragma no-cache Date Wed, 24 Jun 2020 00:56:37 GMT Server akka-http/10.1.11 P3P policyref="https://t.paypal.com/w3c/p3p.xml",CP="CAO IND OUR SAM UNI STA COR COM" Cache-Control max-age=0, no-cache, no-store Connection keep-alive Content-Type image/gif Content-Length 42 Expires Wed, 24 Jun 2020 00:56:37 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial)

89 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate object| html5 object| Modernizr object| antiClickjack function| require function| requirejs function| define function| extend function| $ function| jQuery object| dust function| _ object| Backbone string| sc_code_ver string| s_account object| s function| s_doPlugins string| s_code string| s_objectID function| s_gi function| s_giqf string| s_an function| s_sp function| s_jn function| s_rep function| s_d function| s_fe function| s_fa function| s_ft object| s_c_il number| s_c_in number| s_giq function| scOnload object| PAYPAL object| jQuery18008844453205896277 object| fpti string| fptiserverurl object| _ifpti function| clientCalLog function| cdebbdcdce function| getCookie undefined| wordpressAdminBody object| notification object| hostingerLogo undefined| mainContent object| wpSidebar object| wpTopBarRight undefined| googleFont undefined| css undefined| style undefined| sheet undefined| button undefined| link undefined| mainContentHolder undefined| h1Tag undefined| h2Tag undefined| paragraph undefined| list undefined| org_html undefined| new_html undefined| saleImage function| AjaxRequest string| PP_SERVICE_URL string| BASE_SWF_URL string| BEACON_BASE_URL string| PP_IFRAME_JS_URL string| PP_NEW_SERVICE_URL string| PP_VERSION object| Configuration object| PFB_4732Config object| PFB_4732 object| dataCollector object| fp undefined| runFb function| initTsFb object| jstz function| SwfStore function| SlvtStore function| setImmediate function| clearImmediate function| OptinMonsterApp boolean| om_loaded object| f6brbmuxflyqoriatchv string| j object| s_i_paypal object| _omapp object| omf6brbmuxflyqoriatchv object| WebFont

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.000webhostapp.com/	1970-01-20 04:00:32	Name: s_pers Value: %20s_fid%3D6A602956B6134467-1969CE1509FC6BA9%7C1656032196310%3B%20gpv_c43%3Dmain%253Aunifiedloginnodeweb%253A%253A%253Alogin-captcha%7C1592961996312%3B%20tr_p1%3Dmain%253Aunifiedloginnodeweb%253A%253A%253Alogin-captcha%7C1592961996314%3B%20gpv_events%3Dno%2520value%7C1592961996315%3B
			freedollars2020.000webhostapp.com/	1970-01-19 10:29:20	Name: _omappvs Value: 1592960196280
			.000webhostapp.com/	1969-12-31 23:59:59	Name: s_sess Value: %20s_ppv%3D100%3B%20s_cc%3Dtrue%3B%20v31%3Dmain%253Aunifiedloginnodeweb%253A%253A%253Alogin-captcha%3B%20s_sq%3D%3B
			freedollars2020.000webhostapp.com/	1970-01-23 10:27:53	Name: _omappvp Value: HeVpQeCfk5fTTLxg7zpwwgZiMqfjZeTewQBINHQnMaytThFi6Ravo9n4tue5bnqWWRqPNDSrGcxLqYsTcjTllyPpUXFjKbtE

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.opmnstr.com
ajax.googleapis.com
api.omappapi.com
c.paypal.com
cdn.000webhost.com
freedollars2020.000webhostapp.com
t.paypal.com
www.paypalobjects.com
104.111.228.123
143.204.247.69
23.111.11.182
23.37.43.154
2606:4700:10::6814:442e
2a00:1450:4001:817::200a
2a02:4780:dead:ab2a::1
84.53.164.154
0adaf22e6710cbc950db6526ac09b6c8757ed25e4701196e88cf2f87dca596c7
18c9428f5ed837e027c6fcf29afe9d1f63a1e1e5b53ee1dc6373cf1cd1ea22aa
2f55d1691615c70e7f2bd076b025b17de86275a13f5e47d1aba3bbc80e4f2672
475d7712f4a6a3997f41807e56f4c61a9e51b7b4883da9064291df4ea6ebd2ac
5575c06232e3d3c7feda2a5a9153935be52a558e42f3709c4c264ca6abffddf5
6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93
72f3b7d5bbc574a7670507c38d69507984961a34c2a78235e4cadfd38adb0230
86f2673ec74a632865109a76b2232f4f5b3587daa219e07a17ef1d9c76a0fda5
a6c3bff965978df8093c3a29f7071c21d7439a212af41e7b40ce70d94d6bcc44
ab4017e3f5f315af5f2e8ee8b184180ed2cc8ee6eab6df7fbaa7c7716036a9b8
b3cc50b9e94bbecaaeb1079b64b8ca50616d1732824964c1cc2c5422627a0ec5
c007d73792ac2d25882bfbb573e700e721a0adacfab947e6a0b64a61991fecf0
c4deb5623275816e304df0c7ad8a63c812bc36b2434ee6b47f5f2b5c28fa2034
ce261eb163fcaee6953cedc35059732a133766ab824dc512bbdf9424d48601e4
dfc4edd44398026b0231673cf9e5d60d8d6038fee6e85fae50bc53a8608a9187