paypal-webgift.at.ua Open in urlscan Pro
193.109.247.16  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 5

• https://www.paypalobjects.com/images/shared/fingerprint-paypal.png HTTP 302
• https://ak1s.abmr.net/is/www.paypalobjects.com?U=/images/shared/fingerprint-paypal.png&V=3-9HauFKEy5Fr3lmBaVYP+MhYACHo2iuMnB+qKKLOba5oZRNfTXvsD9ESgYiqURaic&I=CF4B477EE518A66&D=paypalobjects.com&01AD=1&

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request pay-giftcard.paypal.us.html Show response paypal-webgift.at.ua/	130 KB 36 KB	1589ms 1215ms	Document text/html	193.109.247.16 COMPUBYTE-AS
General Check archive.org Show headers Download Go to Full URL https://paypal-webgift.at.ua/pay-giftcard.paypal.us.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 193.109.247.16 Moscow, Russian Federation, ASN204343 (COMPUBYTE-AS, RU), Reverse DNS dev.ucoz.net Software nginx/1.8.0 / Resource Hash ec18f56a3a45acc7e8e6f6d116e1849e4b68bccd91e78b1b58f0cdd921f0c2d6 Request headers Host paypal-webgift.at.ua Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 Accept-Encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Server nginx/1.8.0 Date Mon, 08 Jul 2019 20:58:31 GMT Content-Type text/html; charset=UTF-8 Transfer-Encoding chunked Connection keep-alive Keep-Alive timeout=15 Expires Sun, 28 Jul 2019 20:58:30 GMT Cache-Control max-age=1728000 Content-Encoding gzip
GET H2	200	contextualLogin.css www.paypalobjects.com/web/res/34a/14ef3d2014458e805dab62668a741/css/	77 KB 13 KB	340ms 88ms	Stylesheet text/css	23.210.248.226 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://www.paypalobjects.com/web/res/34a/14ef3d2014458e805dab62668a741/css/contextualLogin.css Requested by Host: paypal-webgift.at.ua URL: https://paypal-webgift.at.ua/pay-giftcard.paypal.us.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 23.210.248.226 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a23-210-248-226.deploy.static.akamaitechnologies.com Software Apache / Resource Hash b37db507136282eeba84b41f4026867c8979322f52fce3d548b2b0bf36ba7986 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Referer https://paypal-webgift.at.ua/pay-giftcard.paypal.us.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 08 Jul 2019 20:58:32 GMT content-encoding gzip x-content-type-options nosniff last-modified Wed, 27 Feb 2019 19:54:40 GMT server Apache vary Accept-Encoding content-type text/css status 200 cache-control max-age=7776000 strict-transport-security max-age=31536000 accept-ranges bytes content-length 13304 expires Sun, 06 Oct 2019 20:58:32 GMT
GET H2	200	icon-PN-check.png www.paypalobjects.com/images/shared/	2 KB 3 KB	336ms 84ms	Image image/png	23.210.248.226 Akamai Technologies
General Check archive.org Show headers Download Go to Show image Full URL https://www.paypalobjects.com/images/shared/icon-PN-check.png Requested by Host: paypal-webgift.at.ua URL: https://paypal-webgift.at.ua/pay-giftcard.paypal.us.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 23.210.248.226 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a23-210-248-226.deploy.static.akamaitechnologies.com Software Apache / Resource Hash 4a77d272b8cf508cc4a7e0da5763faa9958e42a5554fdb5d29fc3be51d685653 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Referer https://paypal-webgift.at.ua/pay-giftcard.paypal.us.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Mon, 08 Jul 2019 20:58:32 GMT x-content-type-options nosniff last-modified Tue, 29 Mar 2016 00:23:34 GMT server Apache strict-transport-security max-age=31536000 p3p CP="NON DSP ADM DEV PSD OUR IND STP PHY PRE NAV UNI" status 200 cache-control max-age=0, no-cache, no-store accept-ranges bytes content-type image/png content-length 2236 expires Mon, 08 Jul 2019 20:58:32 GMT
GET H2	200	glyph_alert_critical_big-2x.png www.paypalobjects.com/images/shared/	6 KB 6 KB	334ms 83ms	Image image/png	23.210.248.226 Akamai Technologies
General Check archive.org Show headers Download Go to Show image Full URL https://www.paypalobjects.com/images/shared/glyph_alert_critical_big-2x.png Requested by Host: paypal-webgift.at.ua URL: https://paypal-webgift.at.ua/pay-giftcard.paypal.us.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 23.210.248.226 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a23-210-248-226.deploy.static.akamaitechnologies.com Software Apache / Resource Hash 13e4806e5c517e074ab1ea26fe0f2b7b87eaa3988006f35ed0bd4c89502d0d79 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Referer https://paypal-webgift.at.ua/pay-giftcard.paypal.us.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Mon, 08 Jul 2019 20:58:32 GMT x-content-type-options nosniff last-modified Fri, 12 Sep 2014 15:08:04 GMT server Apache strict-transport-security max-age=31536000 p3p CP="NON DSP ADM DEV PSD OUR IND STP PHY PRE NAV UNI" status 200 cache-control max-age=0, no-cache, no-store accept-ranges bytes content-type image/png content-length 5828 expires Mon, 08 Jul 2019 20:58:32 GMT
GET H2	200	pa.js Show response www.paypalobjects.com/pa/js/min/	40 KB 15 KB	80ms 78ms	Script application/x-javascript	23.210.248.226 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://www.paypalobjects.com/pa/js/min/pa.js Requested by Host: paypal-webgift.at.ua URL: https://paypal-webgift.at.ua/pay-giftcard.paypal.us.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 23.210.248.226 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a23-210-248-226.deploy.static.akamaitechnologies.com Software Apache / Resource Hash 7228b1b90209f405d8c34daf7e54c568c9b8a21674ea4794451c45f3290ecf6b Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Referer https://paypal-webgift.at.ua/pay-giftcard.paypal.us.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 08 Jul 2019 20:58:32 GMT x-pad avoid browser bug x-content-type-options nosniff status 200 strict-transport-security max-age=31536000 content-encoding gzip content-length 14635 last-modified Sat, 29 Jun 2019 20:33:19 GMT server Apache vary Accept-Encoding access-control-allow-methods GET content-type application/x-javascript access-control-allow-origin * cache-control max-age=3600 accept-ranges bytes access-control-allow-headers x-csrf-token expires Mon, 08 Jul 2019 21:58:32 GMT
GET H2	200	paypal-logo-129x32.svg www.paypalobjects.com/images/shared/	5 KB 5 KB	74ms 74ms	Image image/svg+xml	23.210.248.226 Akamai Technologies
General Check archive.org Show headers Download Go to Show image Full URL https://www.paypalobjects.com/images/shared/paypal-logo-129x32.svg Requested by Host: paypal-webgift.at.ua URL: https://paypal-webgift.at.ua/pay-giftcard.paypal.us.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 23.210.248.226 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a23-210-248-226.deploy.static.akamaitechnologies.com Software Apache / Resource Hash b3cc50b9e94bbecaaeb1079b64b8ca50616d1732824964c1cc2c5422627a0ec5 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Referer https://www.paypalobjects.com/web/res/34a/14ef3d2014458e805dab62668a741/css/contextualLogin.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 08 Jul 2019 20:58:32 GMT x-content-type-options nosniff last-modified Fri, 24 Oct 2014 22:52:57 GMT server Apache access-control-allow-origin * vary Accept-Encoding content-type image/svg+xml status 200 strict-transport-security max-age=31536000 accept-ranges bytes content-length 4945 expires Wed, 07 Aug 2019 20:58:32 GMT
GET		www.paypalobjects.com ak1s.abmr.net/is/ Redirect Chain https://www.paypalobjects.com/images/shared/fingerprint-paypal.png https://ak1s.abmr.net/is/www.paypalobjects.com?U=/images/shared/fingerprint-paypal.png&V=3-9HauFKEy5Fr3lmBaVYP+MhYACHo2iuMnB+qKKLOba5oZRNfTXvsD9ESgYiqURaic&I=CF4B477EE518A66&D=paypalobjects.com&01A...	0 0
GET H2	200	ts t.paypal.com/	42 B 536 B	277ms 276ms	Image image/gif	23.210.248.226 Akamai Technologies
General Check archive.org Show headers Download Go to Show image Full URL https://t.paypal.com/ts?v=1.3.17&t=1562619516285&g=-120&e=im&pgrp=main%3Aunifiedlogin%3A%3A%3Alogin&page=main%3Aunifiedlogin%3A%3A%3Alogin%3A%3A%3A&pgst=1551837036171&calc=eaec22db22e3e&rsta=en_US&pgtf=Nodejs&env=live&s=ci&ccpg=US&csci=1407c4e90c0241babc093ff201f4b192&comp=unifiedloginnodeweb&tsrce=unifiedloginnodeweb&cu=1&gacook=1583490066.1549932700&pxpguid=df9e1f161680a116ba5e9dcaffffc959&transition_name=ss_prepare_pwd&xe=4122%2C2322%2C3798%2C3966%2C2977%2C3197%2C3862%2C4523%2C4523&xt=9831%2C5566%2C9089%2C10251%2C7132%2C7627%2C9226%2C10868%2C10868&ctx_login_ot_content=1&obex=signin&landing_page=login&state_name=begin_pwd&ctx_login_ctxid_fetch=ctxid-not-exist&ctx_login_content_fetch=success&ctx_login_lang_footer=shown&ctx_login_signup_btn=shown%7Cdefault&ctx_login_intent=signin&ctx_login_flow=Signin&ctx_login_state_transition=login_loaded&post_login_redirect=default&ret_url=%2F&sl_status=LINKED&view=%7B%22t10%22%3A374%2C%22t11%22%3A5485%2C%22tcp%22%3A2038%2C%22et%22%3A%224g%22%2C%22nt%22%3A%22navigate%22%7D&pt=Log%20in%20to%20your%20PayPal%20account&cd=24&sw=1600&sh=1200&dw=1600&dh=1200&bw=1600&bh=1200&ce=1&t1=374&t1c=374&t1d=95&t1s=189&t2=1215&t3=95&t4=458&tt=2049&res=%7B%7D Requested by Host: paypal-webgift.at.ua URL: https://paypal-webgift.at.ua/pay-giftcard.paypal.us.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 23.210.248.226 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a23-210-248-226.deploy.static.akamaitechnologies.com Software akka-http/10.1.7 / Resource Hash 6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93 Request headers Referer https://paypal-webgift.at.ua/pay-giftcard.paypal.us.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Mon, 08 Jul 2019 20:58:36 GMT server akka-http/10.1.7 p3p policyref="https://t.paypal.com/w3c/p3p.xml",CP="CAO IND OUR SAM UNI STA COR COM" status 200 cache-control max-age=0, no-cache, no-store content-type image/gif content-length 42 expires Mon, 08 Jul 2019 20:58:36 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

ak1s.abmr.net

URL

https://ak1s.abmr.net/is/www.paypalobjects.com?U=/images/shared/fingerprint-paypal.png&V=3-9HauFKEy5Fr3lmBaVYP+MhYACHo2iuMnB+qKKLOba5oZRNfTXvsD9ESgYiqURaic&I=CF4B477EE518A66&D=paypalobjects.com&01AD=1&

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial)

19 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask object| html5 object| Modernizr function| isEligibleIntegration object| antiClickjack object| PAYPAL function| $ function| _classCallCheck function| _typeof function| _createClass number| HTTPOK string| HTTPGET string| HTTPPOST number| DEFAULT_XHR_TIMEOUT object| fpti string| fptiserverurl object| _ifpti

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ak1s.abmr.net
paypal-webgift.at.ua
t.paypal.com
www.paypalobjects.com
ak1s.abmr.net
193.109.247.16
23.210.248.226
13e4806e5c517e074ab1ea26fe0f2b7b87eaa3988006f35ed0bd4c89502d0d79
4a77d272b8cf508cc4a7e0da5763faa9958e42a5554fdb5d29fc3be51d685653
6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93
7228b1b90209f405d8c34daf7e54c568c9b8a21674ea4794451c45f3290ecf6b
b37db507136282eeba84b41f4026867c8979322f52fce3d548b2b0bf36ba7986
b3cc50b9e94bbecaaeb1079b64b8ca50616d1732824964c1cc2c5422627a0ec5
ec18f56a3a45acc7e8e6f6d116e1849e4b68bccd91e78b1b58f0cdd921f0c2d6