update-account-credit-service.server-activation.limit.e4cb.com Open in urlscan Pro
131.153.37.2 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://update-account-credit-service.server-activation.limit.e4cb.com/
Effective URL:
https://update-account-credit-service.server-activation.limit.e4cb.com/3f353bf5e983c0b92eec5dce1baec6f2/secureaccount.php?country.x=SE&locale.x=sv_SE&customer.x=ID-PA$...
Submission Tags: phishing malicious Search All
Submission: On September 10 via api (September 10th 2020, 4:34:08 pm UTC) from US

Summary HTTP 10 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 10 HTTP transactions. The main IP is 131.153.37.2, located in Phoenix, United States and belongs to SSASN2, US. The main domain is update-account-credit-service.server-activation.limit.e4cb.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on September 1st 2020. Valid for: 3 months.

This is the only time update-account-credit-service.server-activation.limit.e4cb.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: PayPal (Financial)

Domain & IP information

	IP Address	AS Autonomous System
3 8	131.153.37.2 131.153.37.2	20454 (SSASN2) (SSASN2)
5	104.111.228.123 104.111.228.123	16625 (AKAMAI-AS) (AKAMAI-AS)
10	2

8 131.153.37.2 (Phoenix, United States) 3 redirects

ASN20454 (SSASN2, US)
PTR: svr156.edns1.com

update-account-credit-service.server-activation.limit.e4cb.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 104.111.228.123 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-228-123.deploy.static.akamaitechnologies.com

www.paypalobjects.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	e4cb.com 3 redirects update-account-credit-service.server-activation.limit.e4cb.com	197 KB
5	paypalobjects.com www.paypalobjects.com	145 KB
10	2

	Domain	Requested by
8	update-account-credit-service.server-activation.limit.e4cb.com	3 redirects update-account-credit-service.server-activation.limit.e4cb.com
5	www.paypalobjects.com	update-account-credit-service.server-activation.limit.e4cb.com
10	2

This site contains no links.

Subject Issuer	Validity	Valid
update-account-credit-service.server-activation.limit.e4cb.com cPanel, Inc. Certification Authority	`2020-09-01` - `2020-11-30`	3 months	crt.sh
www.paypal.com DigiCert SHA2 Extended Validation Server CA	`2020-01-09` - `2022-01-12`	2 years	crt.sh

This page contains 1 frames:

Primary Page: https://update-account-credit-service.server-activation.limit.e4cb.com/3f353bf5e983c0b92eec5dce1baec6f2/secureaccount.php?country.x=SE&locale.x=sv_SE&customer.x=ID-PA$1$Omdr37m3$cg3x1gFgfMmLZFVL18kWo/&safety=xJ7fMfn2tq863b7Ie4OPyF49gUwK4lc059LBj83rm0SNuZdsE4f66e5i16fX2C6k5pa2aR7DGavoWTbzdAHdYV5Q9abchf
Frame ID: D8CFAFE661DB3D89C532D62167C74F89
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

(SE) Securing your account

Page URL History Show full URLs

https://update-account-credit-service.server-activation.limit.e4cb.com/ HTTP 302
https://update-account-credit-service.server-activation.limit.e4cb.com/to.php HTTP 302
https://update-account-credit-service.server-activation.limit.e4cb.com/3f353bf5e983c0b92eec5dce1baec6f2 HTTP 301
https://update-account-credit-service.server-activation.limit.e4cb.com/3f353bf5e983c0b92eec5dce1baec6f2/ Page URL
https://update-account-credit-service.server-activation.limit.e4cb.com/3f353bf5e983c0b92eec5dce1baec6f2/secureaccount.php?country.x=SE&locale.x=sv_... Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

10
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

341 kB
Transfer

339 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://update-account-credit-service.server-activation.limit.e4cb.com/ HTTP 302
https://update-account-credit-service.server-activation.limit.e4cb.com/to.php HTTP 302
https://update-account-credit-service.server-activation.limit.e4cb.com/3f353bf5e983c0b92eec5dce1baec6f2 HTTP 301
https://update-account-credit-service.server-activation.limit.e4cb.com/3f353bf5e983c0b92eec5dce1baec6f2/ Page URL
https://update-account-credit-service.server-activation.limit.e4cb.com/3f353bf5e983c0b92eec5dce1baec6f2/secureaccount.php?country.x=SE&locale.x=sv_SE&customer.x=ID-PA$1$Omdr37m3$cg3x1gFgfMmLZFVL18kWo/&safety=xJ7fMfn2tq863b7Ie4OPyF49gUwK4lc059LBj83rm0SNuZdsE4f66e5i16fX2C6k5pa2aR7DGavoWTbzdAHdYV5Q9abchf Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://update-account-credit-service.server-activation.limit.e4cb.com/ HTTP 302
https://update-account-credit-service.server-activation.limit.e4cb.com/to.php HTTP 302
https://update-account-credit-service.server-activation.limit.e4cb.com/3f353bf5e983c0b92eec5dce1baec6f2 HTTP 301
https://update-account-credit-service.server-activation.limit.e4cb.com/3f353bf5e983c0b92eec5dce1baec6f2/

10 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Cookie set /
update-account-credit-service.server-activation.limit.e4cb.com/3f353bf5e983c0b92eec5dce1baec6f2/
Redirect Chain

https://update-account-credit-service.server-activation.limit.e4cb.com/
https://update-account-credit-service.server-activation.limit.e4cb.com/to.php
https://update-account-credit-service.server-activation.limit.e4cb.com/3f353bf5e983c0b92eec5dce1baec6f2
https://update-account-credit-service.server-activation.limit.e4cb.com/3f353bf5e983c0b92eec5dce1baec6f2/

285 B
667 B

844ms
463ms

Document
text/html

131.153.37.2
SSASN2

General

Check archive.org

Show headers Download Go to

Full URL: https://update-account-credit-service.server-activation.limit.e4cb.com/3f353bf5e983c0b92eec5dce1baec6f2/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 131.153.37.2 Phoenix, United States, ASN20454 (SSASN2, US),
Reverse DNS: svr156.edns1.com
Software: Apache / PHP/7.2.33
Resource Hash

Request headers

Host: update-account-credit-service.server-activation.limit.e4cb.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 10 Sep 2020 16:33:49 GMT
Server: Apache
X-Powered-By: PHP/7.2.33
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Set-Cookie: PHPSESSID=42c73354b844f618f31a6a787f3867fe; path=/
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

Redirect headers

Date: Thu, 10 Sep 2020 16:33:48 GMT
Server: Apache
Location: https://update-account-credit-service.server-activation.limit.e4cb.com/3f353bf5e983c0b92eec5dce1baec6f2/
Content-Length: 312
Connection: close
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 200
OK Primary Request secureaccount.php Show response
update-account-credit-service.server-activation.limit.e4cb.com/3f353bf5e983c0b92eec5dce1baec6f2/ 2 KB
2 KB 766ms
385ms Document
text/html 131.153.37.2
SSASN2

General

Check archive.org

Show headers Download Go to

Full URL: https://update-account-credit-service.server-activation.limit.e4cb.com/3f353bf5e983c0b92eec5dce1baec6f2/secureaccount.php?country.x=SE&locale.x=sv_SE&customer.x=ID-PA$1$Omdr37m3$cg3x1gFgfMmLZFVL18kWo/&safety=xJ7fMfn2tq863b7Ie4OPyF49gUwK4lc059LBj83rm0SNuZdsE4f66e5i16fX2C6k5pa2aR7DGavoWTbzdAHdYV5Q9abchf
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 131.153.37.2 Phoenix, United States, ASN20454 (SSASN2, US),
Reverse DNS: svr156.edns1.com
Software: Apache / PHP/7.2.33
Resource Hash: 81073a753c1c03a576b8535d249e306ffa2212bac0e495d1e8e1e8b4aef6c34b

Request headers

Host: update-account-credit-service.server-activation.limit.e4cb.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: document
Referer: https://update-account-credit-service.server-activation.limit.e4cb.com/3f353bf5e983c0b92eec5dce1baec6f2/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: PHPSESSID=42c73354b844f618f31a6a787f3867fe
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://update-account-credit-service.server-activation.limit.e4cb.com/3f353bf5e983c0b92eec5dce1baec6f2/

Response headers

Date: Thu, 10 Sep 2020 16:33:50 GMT
Server: Apache
X-Powered-By: PHP/7.2.33
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK jquery.min.js Show response
update-account-credit-service.server-activation.limit.e4cb.com/3f353bf5e983c0b92eec5dce1baec6f2/open/js/ 85 KB
85 KB 753ms
368ms Script
application/javascript 131.153.37.2
SSASN2

General

Check archive.org

Show headers Download Go to

Full URL: https://update-account-credit-service.server-activation.limit.e4cb.com/3f353bf5e983c0b92eec5dce1baec6f2/open/js/jquery.min.js
Requested by: Host: update-account-credit-service.server-activation.limit.e4cb.com
URL: https://update-account-credit-service.server-activation.limit.e4cb.com/3f353bf5e983c0b92eec5dce1baec6f2/secureaccount.php?country.x=SE&locale.x=sv_SE&customer.x=ID-PA$1$Omdr37m3$cg3x1gFgfMmLZFVL18kWo/&safety=xJ7fMfn2tq863b7Ie4OPyF49gUwK4lc059LBj83rm0SNuZdsE4f66e5i16fX2C6k5pa2aR7DGavoWTbzdAHdYV5Q9abchf
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 131.153.37.2 Phoenix, United States, ASN20454 (SSASN2, US),
Reverse DNS: svr156.edns1.com
Software: Apache /
Resource Hash: d30b6114fb9496ae46b2a8cdf59379c8ffdb957534bd1dd73e626c7c61c7e67d

Request headers

Referer: https://update-account-credit-service.server-activation.limit.e4cb.com/3f353bf5e983c0b92eec5dce1baec6f2/secureaccount.php?country.x=SE&locale.x=sv_SE&customer.x=ID-PA$1$Omdr37m3$cg3x1gFgfMmLZFVL18kWo/&safety=xJ7fMfn2tq863b7Ie4OPyF49gUwK4lc059LBj83rm0SNuZdsE4f66e5i16fX2C6k5pa2aR7DGavoWTbzdAHdYV5Q9abchf
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 10 Sep 2020 16:33:50 GMT
Last-Modified: Thu, 10 Sep 2020 16:33:45 GMT
Server: Apache
Connection: close
Accept-Ranges: bytes
Content-Length: 86927
Content-Type: application/javascript

GET
H/1.1 200
OK xappx.css
update-account-credit-service.server-activation.limit.e4cb.com/3f353bf5e983c0b92eec5dce1baec6f2/open/css/ 108 KB
108 KB 758ms
374ms Stylesheet
text/css 131.153.37.2
SSASN2

General

Check archive.org

Show headers Download Go to

Full URL: https://update-account-credit-service.server-activation.limit.e4cb.com/3f353bf5e983c0b92eec5dce1baec6f2/open/css/xappx.css
Requested by: Host: update-account-credit-service.server-activation.limit.e4cb.com
URL: https://update-account-credit-service.server-activation.limit.e4cb.com/3f353bf5e983c0b92eec5dce1baec6f2/secureaccount.php?country.x=SE&locale.x=sv_SE&customer.x=ID-PA$1$Omdr37m3$cg3x1gFgfMmLZFVL18kWo/&safety=xJ7fMfn2tq863b7Ie4OPyF49gUwK4lc059LBj83rm0SNuZdsE4f66e5i16fX2C6k5pa2aR7DGavoWTbzdAHdYV5Q9abchf
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 131.153.37.2 Phoenix, United States, ASN20454 (SSASN2, US),
Reverse DNS: svr156.edns1.com
Software: Apache /
Resource Hash: 544dfa59462862db7bafc2d2e4b3925ac3eacb11e52834916df02bd1cda19b1d

Request headers

Referer: https://update-account-credit-service.server-activation.limit.e4cb.com/3f353bf5e983c0b92eec5dce1baec6f2/secureaccount.php?country.x=SE&locale.x=sv_SE&customer.x=ID-PA$1$Omdr37m3$cg3x1gFgfMmLZFVL18kWo/&safety=xJ7fMfn2tq863b7Ie4OPyF49gUwK4lc059LBj83rm0SNuZdsE4f66e5i16fX2C6k5pa2aR7DGavoWTbzdAHdYV5Q9abchf
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 10 Sep 2020 16:33:50 GMT
Last-Modified: Thu, 10 Sep 2020 16:33:46 GMT
Server: Apache
Connection: close
Accept-Ranges: bytes
Content-Length: 110339
Content-Type: text/css

GET
H/1.1 200
OK xsecx.js Show response
update-account-credit-service.server-activation.limit.e4cb.com/3f353bf5e983c0b92eec5dce1baec6f2/open/js/ 268 B
486 B 756ms
369ms Script
application/javascript 131.153.37.2
SSASN2

General

Check archive.org

Show headers Download Go to

Full URL: https://update-account-credit-service.server-activation.limit.e4cb.com/3f353bf5e983c0b92eec5dce1baec6f2/open/js/xsecx.js
Requested by: Host: update-account-credit-service.server-activation.limit.e4cb.com
URL: https://update-account-credit-service.server-activation.limit.e4cb.com/3f353bf5e983c0b92eec5dce1baec6f2/secureaccount.php?country.x=SE&locale.x=sv_SE&customer.x=ID-PA$1$Omdr37m3$cg3x1gFgfMmLZFVL18kWo/&safety=xJ7fMfn2tq863b7Ie4OPyF49gUwK4lc059LBj83rm0SNuZdsE4f66e5i16fX2C6k5pa2aR7DGavoWTbzdAHdYV5Q9abchf
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 131.153.37.2 Phoenix, United States, ASN20454 (SSASN2, US),
Reverse DNS: svr156.edns1.com
Software: Apache /
Resource Hash: 12bec3e411f30e9f988a001dc06817aef7a8d2513fb2e78c989d75a4946714de

Request headers

Referer: https://update-account-credit-service.server-activation.limit.e4cb.com/3f353bf5e983c0b92eec5dce1baec6f2/secureaccount.php?country.x=SE&locale.x=sv_SE&customer.x=ID-PA$1$Omdr37m3$cg3x1gFgfMmLZFVL18kWo/&safety=xJ7fMfn2tq863b7Ie4OPyF49gUwK4lc059LBj83rm0SNuZdsE4f66e5i16fX2C6k5pa2aR7DGavoWTbzdAHdYV5Q9abchf
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 10 Sep 2020 16:33:50 GMT
Last-Modified: Thu, 10 Sep 2020 16:33:45 GMT
Server: Apache
Connection: close
Accept-Ranges: bytes
Content-Length: 268
Content-Type: application/javascript

GET
H2 200 monogram@2x.png
www.paypalobjects.com/images/shared/ 1 KB
2 KB 215ms
81ms Image
image/png 104.111.228.123
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.paypalobjects.com/images/shared/monogram@2x.png

Requested by

Host: update-account-credit-service.server-activation.limit.e4cb.com
URL: https://update-account-credit-service.server-activation.limit.e4cb.com/3f353bf5e983c0b92eec5dce1baec6f2/open/css/xappx.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.111.228.123 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-228-123.deploy.static.akamaitechnologies.com

Software

Akamai Image Manager /

Resource Hash

bbe3177aa5d225f117aea0e2eeb27f11d853a33d6d162733c5be8b1de8d36dc5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://update-account-credit-service.server-activation.limit.e4cb.com/3f353bf5e983c0b92eec5dce1baec6f2/open/css/xappx.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 10 Sep 2020 16:33:52 GMT
x-content-type-options: nosniff
last-modified: Fri, 08 May 2020 01:20:32 GMT
server: Akamai Image Manager
strict-transport-security: max-age=31536000
content-type: image/png
status: 200
cache-control: private, max-age=1070308
content-length: 1507
expires: Wed, 23 Sep 2020 01:52:20 GMT

GET
H2 200 animation-oval.png
www.paypalobjects.com/images/shared/ 2 KB
3 KB 215ms
82ms Image
image/webp 104.111.228.123
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.paypalobjects.com/images/shared/animation-oval.png

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.111.228.123 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-228-123.deploy.static.akamaitechnologies.com

Software

Akamai Image Manager /

Resource Hash

da775dd10f868447dea4c3522fb3b55bd4a5df650d3f2233a76d31bb711f6c2a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://update-account-credit-service.server-activation.limit.e4cb.com/3f353bf5e983c0b92eec5dce1baec6f2/open/css/xappx.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 10 Sep 2020 16:33:52 GMT
x-content-type-options: nosniff
last-modified: Fri, 08 May 2020 01:20:32 GMT
server: Akamai Image Manager
strict-transport-security: max-age=31536000
content-type: image/webp
status: 200
cache-control: private, no-transform, max-age=43200
content-length: 2448
expires: Fri, 11 Sep 2020 04:33:52 GMT

GET
H2 200 PayPalSansBig-Light.woff
www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/ 48 KB
48 KB 216ms
83ms Font
application/x-font-woff 104.111.228.123
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/PayPalSansBig-Light.woff

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.111.228.123 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-228-123.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

c599c554590d1a336ffcb9627f6caaac34b6228f60e15f5f25454bff38facb7e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Origin: https://update-account-credit-service.server-activation.limit.e4cb.com
Referer: https://update-account-credit-service.server-activation.limit.e4cb.com/3f353bf5e983c0b92eec5dce1baec6f2/open/css/xappx.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 10 Sep 2020 16:33:52 GMT
x-pad: avoid browser bug
x-content-type-options: nosniff
last-modified: Wed, 30 Sep 2015 05:09:04 GMT
server: Apache
status: 200
vary: Accept-Encoding
content-type: application/x-font-woff
access-control-allow-origin: *
cache-control: max-age=3600
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 49115
expires: Thu, 10 Sep 2020 17:33:52 GMT

GET
H2 200 PayPalSansSmall-Light.woff
www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/ 46 KB
46 KB 289ms
157ms Font
application/x-font-woff 104.111.228.123
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/PayPalSansSmall-Light.woff

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.111.228.123 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-228-123.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

843e67ad522a908162007f4b7601819a5bbfef00e38ac7aec778766da8b7b2ab

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Origin: https://update-account-credit-service.server-activation.limit.e4cb.com
Referer: https://update-account-credit-service.server-activation.limit.e4cb.com/3f353bf5e983c0b92eec5dce1baec6f2/open/css/xappx.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 10 Sep 2020 16:33:52 GMT
x-pad: avoid browser bug
x-content-type-options: nosniff
last-modified: Wed, 30 Sep 2015 05:09:04 GMT
server: Apache
status: 200
vary: Accept-Encoding
content-type: application/x-font-woff
access-control-allow-origin: *
cache-control: max-age=3600
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 46703
expires: Thu, 10 Sep 2020 17:33:52 GMT

GET
H2 200 PayPalSansSmall-Regular.woff
www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/ 46 KB
47 KB 316ms
185ms Font
application/x-font-woff 104.111.228.123
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/PayPalSansSmall-Regular.woff

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.111.228.123 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-228-123.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

ae79dcc3eb016922caa1d095cfd936446bc65a46bb3364b242dfc556f7e3c6a8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Origin: https://update-account-credit-service.server-activation.limit.e4cb.com
Referer: https://update-account-credit-service.server-activation.limit.e4cb.com/3f353bf5e983c0b92eec5dce1baec6f2/open/css/xappx.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 10 Sep 2020 16:33:52 GMT
x-pad: avoid browser bug
x-content-type-options: nosniff
last-modified: Wed, 30 Sep 2015 05:09:04 GMT
server: Apache
status: 200
vary: Accept-Encoding
content-type: application/x-font-woff
access-control-allow-origin: *
cache-control: max-age=3600
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 47339
expires: Thu, 10 Sep 2020 17:33:52 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| trustedTypes function| $ function| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

update-account-credit-service.server-activation.limit.e4cb.com
www.paypalobjects.com
104.111.228.123
131.153.37.2
12bec3e411f30e9f988a001dc06817aef7a8d2513fb2e78c989d75a4946714de
544dfa59462862db7bafc2d2e4b3925ac3eacb11e52834916df02bd1cda19b1d
81073a753c1c03a576b8535d249e306ffa2212bac0e495d1e8e1e8b4aef6c34b
843e67ad522a908162007f4b7601819a5bbfef00e38ac7aec778766da8b7b2ab
ae79dcc3eb016922caa1d095cfd936446bc65a46bb3364b242dfc556f7e3c6a8
bbe3177aa5d225f117aea0e2eeb27f11d853a33d6d162733c5be8b1de8d36dc5
c599c554590d1a336ffcb9627f6caaac34b6228f60e15f5f25454bff38facb7e
d30b6114fb9496ae46b2a8cdf59379c8ffdb957534bd1dd73e626c7c61c7e67d
da775dd10f868447dea4c3522fb3b55bd4a5df650d3f2233a76d31bb711f6c2a

update-account-credit-service.server-activation.limit.e4cb.com Open in urlscan Pro 131.153.37.2 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

10 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

341 kBTransfer

339 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

0 Cookies

Indicators

update-account-credit-service.server-activation.limit.e4cb.com Open in urlscan Pro
131.153.37.2 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

341 kB
Transfer

339 kB
Size

0
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!