13.66.28.137
Open in
urlscan Pro
13.66.28.137
Malicious Activity!
Public Scan
Submission Tags: phishing malicious Search All
Submission: On February 23 via api from US
Summary
This is the only time 13.66.28.137 was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: PayPal (Financial)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 | 13.66.28.137 13.66.28.137 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
11 | 151.101.114.133 151.101.114.133 | 54113 (FASTLY) (FASTLY) | |
3 | 151.101.129.35 151.101.129.35 | 54113 (FASTLY) (FASTLY) | |
17 | 3 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
paypalobjects.com
www.paypalobjects.com |
1 MB |
3 |
paypal.com
t.paypal.com |
1 KB |
17 | 2 |
Domain | Requested by | |
---|---|---|
11 | www.paypalobjects.com |
13.66.28.137
www.paypalobjects.com |
3 | t.paypal.com |
13.66.28.137
|
17 | 2 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.paypal.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
www.paypalobjects.com DigiCert SHA2 Extended Validation Server CA |
2019-12-09 - 2021-12-13 |
2 years | crt.sh |
t.paypal.com DigiCert SHA2 Extended Validation Server CA |
2020-11-17 - 2021-11-21 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
http://13.66.28.137/authflow/email-recovery/?amp&
Frame ID: EB80E98DF0C0676F97EBC4213889624F
Requests: 17 HTTP requests in this frame
1 Outgoing links
These are links going to different origins than the main page.
Title: Learn more and manage your cookies
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
17 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
Cookie set
/
13.66.28.137/authflow/email-recovery/ |
59 KB 19 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app.css
www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/css/ |
134 KB 20 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app.js
www.paypalobjects.com/web/res/3c3/2f56e5c6aa290714af699fb32f4d1/js/ |
3 MB 724 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pa.js
www.paypalobjects.com/pa/js/ |
52 KB 20 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bs.js
www.paypalobjects.com/tagmgmt/ |
19 B 453 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
messaging-opener-mts.js
www.paypalobjects.com/messaging/auth/v1/ |
3 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
monogram@2x.png
www.paypalobjects.com/images/shared/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
PayPalSansSmall-Regular.woff
www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/ |
46 KB 47 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
animation-oval.png
www.paypalobjects.com/images/shared/ |
4 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
PayPalSansBig-Light.woff
www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/ |
48 KB 48 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
PayPalSansSmall-Light.woff
www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/ |
46 KB 46 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
recaptchav3.js
13.66.28.137/auth/createchallenge/0a2db071cec4faa7/ |
11 KB 14 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ts
t.paypal.com/ |
42 B 672 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
chat-meta
13.66.28.137/smartchat/open/ |
9 KB 12 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ts
t.paypal.com/ |
42 B 401 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ts
t.paypal.com/ |
42 B 433 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
messaging-bot.js
www.paypalobjects.com/messaging/auth/v2/ |
377 KB 115 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: PayPal (Financial)29 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| trustedTypes boolean| crossOriginIsolated function| bindGdprEvents object| core object| __core-js_shared__ object| global object| System function| asap function| Observable function| setImmediate function| clearImmediate object| regeneratorRuntime boolean| _babelPolyfill object| IntlPolyfill object| PDFJS object| PAYPAL object| fpti string| fptiserverurl object| dataLayer object| _ifpti function| openChatUtils function| hideGdprBanner function| showGdprBanner object| _0x52d8 function| _0x508a object| mtsChat0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | default-src 'self' https://*.paypal.com https://*.paypalobjects.com; script-src 'nonce-2ckscR7vJIgTfdgOZ3vialPmFjaZr8dRskmHDL8TG3uVU1RV' 'self' 'unsafe-inline' 'unsafe-eval' https://*.paypal.com https://*.paypalobjects.com; img-src 'self' data: https:; object-src 'none'; media-src data: blob: 'self' https://*.paypal.com https://*.paypalobjects.com; font-src 'self' https://*.paypal.com https://*.paypalobjects.com; style-src 'self' 'unsafe-inline' https://*.paypal.com https://*.paypalobjects.com; frame-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; child-src 'self' https://*.paypal.com https://*.paypalobjects.com; connect-src 'self' https://*.paypal.com https://*.paypalobjects.com https://nexus.ensighten.com https://*.google-analytics.com https://*.qualtrics.com; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; block-all-mixed-content;; report-uri https://www.paypal.com/csplog/api/log/csp |
Strict-Transport-Security | max-age=63072000 |
X-Content-Type-Options | nosniff |
X-Frame-Options | SAMEORIGIN |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
t.paypal.com
www.paypalobjects.com
13.66.28.137
151.101.114.133
151.101.129.35
0eb22afbab03bbbd8a47d4fc5361ff7518a77273e99fd0b73e235c93dd6ea7aa
356151ade870650801e3e5ad8119a7429b24e96166ddc661728d48b285ae2f8b
6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93
79afa489dcdf2111b856a015aaedc28ab325fbb40711a978e501d412702e35da
7f12758c71613e391a01ed8f7aa2f2f8c4a25e3dad3ba871e8a46adde277ebe8
843e67ad522a908162007f4b7601819a5bbfef00e38ac7aec778766da8b7b2ab
ae79dcc3eb016922caa1d095cfd936446bc65a46bb3364b242dfc556f7e3c6a8
b01f45a4d98c8537aaa95ba16a8a6200e32cb08339a0a88cba683e8f90b51881
bcdf050ce6625609e7a3e64f52f1650e7a79abc12a9c7e712fe2b9cfd808e977
be5c4f71eea822cbdcaefcf92963ab573e903f75a60b8bc0793e4eec935a1187
c599c554590d1a336ffcb9627f6caaac34b6228f60e15f5f25454bff38facb7e
ccf46c17adf7ba0c321faa40e10da59b5d107aa54cd3240dceddb26cd31f4855
e00ab4867c277813a14fbbc89e0b52b2a96060287669cdd6262f539614b97fcb
f07d1c4d37a3fed2d9c34a881665a613a26804cccf2a5b5c21bc00d7bde6c64e
f39646ccd4fbf32d475bed59e8c5a1f18208da3d23783672d095273e4e91a7dc