www.paypal.com
Open in
urlscan Pro
151.101.65.21
Public Scan
Effective URL: https://www.paypal.com/connect/?flowEntry=static&client_id=AbF7w67inlFrsBlnFn-7fkHticGEyZttG3gEwyu_HqGfYAtoSkSytPEfVstG...
Submission Tags: phishing malicious Search All
Submission: On August 24 via api from US
Summary
TLS certificate: Issued by DigiCert SHA2 Extended Validation Ser... on March 10th 2020. Valid for: 2 years.
This is the only time www.paypal.com was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 162.241.124.236 162.241.124.236 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
1 2 | 151.101.65.21 151.101.65.21 | 54113 (FASTLY) (FASTLY) | |
9 | 104.111.228.123 104.111.228.123 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
1 | 23.43.117.160 23.43.117.160 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
11 | 3 |
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 162-241-124-236.unifiedlayer.com
signin.paypai.com-webpps-we52r.info |
ASN16625 (AKAMAI-AS, US)
PTR: a104-111-228-123.deploy.static.akamaitechnologies.com
www.paypalobjects.com |
ASN20940 (AKAMAI-ASN1, EU)
PTR: a23-43-117-160.deploy.static.akamaitechnologies.com
t.paypal.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
paypalobjects.com
www.paypalobjects.com |
189 KB |
3 |
paypal.com
1 redirects
www.paypal.com t.paypal.com |
5 KB |
1 |
com-webpps-we52r.info
1 redirects
signin.paypai.com-webpps-we52r.info |
1 KB |
11 | 3 |
Domain | Requested by | |
---|---|---|
9 | www.paypalobjects.com |
www.paypal.com
www.paypalobjects.com |
2 | www.paypal.com | 1 redirects |
1 | t.paypal.com | |
1 | signin.paypai.com-webpps-we52r.info | 1 redirects |
11 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
www.paypal.com DigiCert SHA2 Extended Validation Server CA |
2020-03-10 - 2022-03-15 |
2 years | crt.sh |
t.paypal.com DigiCert SHA2 Extended Validation Server CA |
2020-01-09 - 2022-01-12 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.paypal.com/connect/?flowEntry=static&client_id=AbF7w67inlFrsBlnFn-7fkHticGEyZttG3gEwyu_HqGfYAtoSkSytPEfVstGECcYsqiKz-k29IrfkSvv&scope=openid+profile&redirect_uri=http%3A%2F%2Fsignin.paypai.com-webpps-we52r.info%2Freturn
Frame ID: 1C32537C1E585F856A7D30D2A25554E4
Requests: 11 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://signin.paypai.com-webpps-we52r.info/
HTTP 302
https://www.paypal.com/connect?flowEntry=static&client_id=AbF7w67inlFrsBlnFn-7fkHticGEyZttG3gEwyu_H... HTTP 301
https://www.paypal.com/connect/?flowEntry=static&client_id=AbF7w67inlFrsBlnFn-7fkHticGEyZttG3gEwyu_... Page URL
Detected technologies
Ubuntu (Operating Systems) ExpandDetected patterns
- headers server /Ubuntu/i
Nginx (Web Servers) Expand
Detected patterns
- headers server /nginx(?:\/([\d.]+))?/i
Varnish (Cache Tools) Expand
Detected patterns
- headers via /varnish(?: \(Varnish\/([\d.]+)\))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://signin.paypai.com-webpps-we52r.info/
HTTP 302
https://www.paypal.com/connect?flowEntry=static&client_id=AbF7w67inlFrsBlnFn-7fkHticGEyZttG3gEwyu_HqGfYAtoSkSytPEfVstGECcYsqiKz-k29IrfkSvv&scope=openid+profile&redirect_uri=http%3A%2F%2Fsignin.paypai.com-webpps-we52r.info%2Freturn HTTP 301
https://www.paypal.com/connect/?flowEntry=static&client_id=AbF7w67inlFrsBlnFn-7fkHticGEyZttG3gEwyu_HqGfYAtoSkSytPEfVstGECcYsqiKz-k29IrfkSvv&scope=openid+profile&redirect_uri=http%3A%2F%2Fsignin.paypai.com-webpps-we52r.info%2Freturn Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
www.paypal.com/connect/ Redirect Chain
|
4 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app.ltr.css
www.paypalobjects.com/web/res/bea/59504d21c7760c01030dfa4310fbd/css/ |
56 KB 10 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
consent.js
www.paypalobjects.com/web/res/bea/59504d21c7760c01030dfa4310fbd/js/ |
7 KB 2 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pa.js
www.paypalobjects.com/pa/js/ |
46 KB 18 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
lg-attention-warning.png
www.paypalobjects.com/images/shared/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icon_PP_monogram_2x.png
www.paypalobjects.com/webstatic/i/consumer/onboarding/ |
680 B 910 B |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
PayPalSansBig-Light.woff
www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/ |
48 KB 48 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
PayPalSansSmall-Light.woff
www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/ |
46 KB 46 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
PayPalSansSmall-Regular.woff
www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/ |
46 KB 47 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
miconfig.js
www.paypalobjects.com/pa/mi/ |
85 KB 15 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ts
t.paypal.com/ |
42 B 827 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
39 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| trustedTypes function| addEvent function| showSpinner function| showTransitionPage function| displaceFooter function| showError function| isNotEmpty function| isValidOtp function| validation function| hideError function| verifyOtp function| toggleInfo function| openModal function| hideModal function| closeModalOnESC function| waitToRedirect object| form object| transition undefined| transitioning object| returnUrl undefined| redirectUri object| externalRedirect object| otpForm object| rememberedForm object| infoIcon object| transistionPage object| cancelLink object| groupModalWindow object| closeModalWindow object| escModalWindow undefined| otpCode object| redirectInContext object| categories object| PAYPAL object| fpti string| fptiserverurl object| _ifpti object| miconfig object| laDataLayer9 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
www.paypal.com/ | Name: nsid Value: s%3A6gezzt_U_JFzewJREkyVSm6Pm-kwnHk0.dPza0lGwbZnOI%2Fe%2FAZQwP9ba9HUr0MmVU5GuqVRxU0Q |
|
.paypal.com/ | Name: X-PP-SILOVER Value: name%3DLIVE3.WEB.1%26silo_version%3D880%26app%3Dconnectnodeweb%26TIME%3D1598228215%26HTTP_X_PP_AZ_LOCATOR%3Ddcg14.slc |
|
.paypal.com/ | Name: tsrce Value: connectnodeweb |
|
.paypal.com/ | Name: enforce_policy Value: ccpa |
|
.paypal.com/ | Name: ts_c Value: vr%3D1dd3368e1740a4a1f621ce6eff611336%26vt%3D1dd3368e1740a4a1f621ce6eff611335 |
|
.paypal.com/ | Name: LANG Value: en_US%3BUS |
|
.paypal.com/ | Name: x-cdn Value: fastly:HHN |
|
.paypal.com/ | Name: x-pp-s Value: eyJ0IjoiMTU5ODIyODIxNTc1MiIsImwiOiIwIiwibSI6IjAifQ |
|
.paypal.com/ | Name: ts Value: vreXpYrS%3D1692836215%26vteXpYrS%3D1598230015%26vr%3D1dd3368e1740a4a1f621ce6eff611336%26vt%3D1dd3368e1740a4a1f621ce6eff611335%26vtyp%3Dnew |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | default-src 'self' https://*.paypal.com https://*.paypalobjects.com; frame-src 'self' https://*.paypal.com https://*.paypalobjects.com; script-src 'nonce-JwFofMQUjjoZOkmGtUW+8hgaTAQqPYblMkxgCX3l/7a7/yJr' 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; img-src 'self' https:; object-src 'none'; font-src 'self' https://*.paypal.com https://*.paypalobjects.com; style-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline' 'unsafe-eval'; connect-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; form-action 'self' https://*.paypal.com https://*.trustwave.com; base-uri 'self' https://*.paypal.com; block-all-mixed-content; report-uri https://www.paypal.com/csplog/api/log/csp |
Strict-Transport-Security | max-age=63072000; includeSubDomains; preload |
X-Content-Type-Options | nosniff |
X-Frame-Options | SAMEORIGIN |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
signin.paypai.com-webpps-we52r.info
t.paypal.com
www.paypal.com
www.paypalobjects.com
104.111.228.123
151.101.65.21
162.241.124.236
23.43.117.160
044492e686063d387c7005e099d411a92f0708cfd4587602e1db063e3c9462aa
061a8e6c5b4c9b398b7f32f658eefccb43134a0963d360f95c1f287ea34776fd
375c8b986fc0742fc6d65ee7bef80ad400349a1e947214fc590b17bdbaf01cf4
4b1af72169831dcf6fb00f0e04a4e59addab8ee10c78aa9e56d0a7a2727029c6
6860b16e25dfe4e72ffb72631dde079391e88f5144bddedab9cb36cdb5ad574c
6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93
99e4f81bf4317873cc4d03e38a7385b1a455528732b2da5c69ff2500ae930814
c0d269c260ecad99c274f4312800f1aa9603c1fc65cdc5e43e4fa448a82668b3