paypol-login.com Open in urlscan Pro
3.213.62.134  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

37 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response paypol-login.com/	11 KB 5 KB	349ms 107ms	Document text/html	3.213.62.134 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://paypol-login.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.213.62.134 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-213-62-134.compute-1.amazonaws.com Software ThreatSim-Web-Server / Resource Hash 7c3cf277884b9d4d3dde061a9dc6176d5f90c4183b10e5c774a16ddd5113a776 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :method GET :authority paypol-login.com :scheme https :path / pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 09 Feb 2021 04:59:31 GMT content-type text/html; charset=utf-8 vary Accept-Encoding x-frame-options SAMEORIGIN x-xss-protection 1; mode=block x-content-type-options nosniff x-download-options noopen x-permitted-cross-domain-policies none referrer-policy strict-origin-when-cross-origin etag W/"7c3cf277884b9d4d3dde061a9dc6176d" cache-control max-age=0, private, must-revalidate x-request-id 7dea5bb4-b105-48e8-98fc-104d72b457a0 x-runtime 0.003489 x-host-info lw-prd-us-i-031db153ae0897491 ; 71e9969e7ef808879f5bb0b434b111ab4b585fc3 server ThreatSim-Web-Server access-control-allow-origin * content-encoding gzip
GET H2	200	jquery.min.js Show response paypol-login.com/assets/ajax/libs/jquery/1.11.0/	94 KB 33 KB	190ms 190ms	Script application/javascript	3.213.62.134 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://paypol-login.com/assets/ajax/libs/jquery/1.11.0/jquery.min.js Requested by Host: paypol-login.com URL: https://paypol-login.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.213.62.134 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-213-62-134.compute-1.amazonaws.com Software ThreatSim-Web-Server / Resource Hash b294e973896f8f874e90a8eb1a8908ac790980d034c4c4bdf0fc3d37b8abf682 Request headers Referer https://paypol-login.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 09 Feb 2021 04:59:31 GMT content-encoding gzip last-modified Thu, 04 Feb 2021 15:28:21 GMT server ThreatSim-Web-Server vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control max-age=315360000, public expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	logo.png paypol-login.com/assets/	7 KB 6 KB	104ms 103ms	Image image/png	3.213.62.134 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://paypol-login.com/assets/logo.png Requested by Host: paypol-login.com URL: https://paypol-login.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.213.62.134 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-213-62-134.compute-1.amazonaws.com Software ThreatSim-Web-Server / Resource Hash 26c0e365593f0e20033bd24f01e6e3e68af4e2bb7bec1fd79d795c92560162e9 Request headers Referer https://paypol-login.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 09 Feb 2021 04:59:31 GMT content-encoding gzip last-modified Mon, 07 Dec 2020 17:24:03 GMT server ThreatSim-Web-Server vary Accept-Encoding content-type image/png access-control-allow-origin * cache-control max-age=315360000, public expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	google-tracking.js Show response paypol-login.com/assets/	524 B 614 B	102ms 102ms	Script application/javascript	3.213.62.134 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://paypol-login.com/assets/google-tracking.js?g=infopage Requested by Host: paypol-login.com URL: https://paypol-login.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.213.62.134 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-213-62-134.compute-1.amazonaws.com Software ThreatSim-Web-Server / Resource Hash 6cc8a6f9fe63f66ea5d2f7822846e724a5ab2b46ad6821569ebd666d3c6d7ff3 Request headers Referer https://paypol-login.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 09 Feb 2021 04:59:31 GMT content-encoding gzip last-modified Thu, 04 Feb 2021 15:28:18 GMT server ThreatSim-Web-Server vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control max-age=315360000, public content-length 352 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	all.js Show response paypol-login.com/assets/	28 KB 8 KB	104ms 103ms	Script application/javascript	3.213.62.134 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://paypol-login.com/assets/all.js?g=infopage Requested by Host: paypol-login.com URL: https://paypol-login.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.213.62.134 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-213-62-134.compute-1.amazonaws.com Software ThreatSim-Web-Server / Resource Hash baeb83db3989a35784a514e71da3d508a221ea11d95282da7dc53c75d2712670 Request headers Referer https://paypol-login.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 09 Feb 2021 04:59:31 GMT content-encoding gzip last-modified Thu, 04 Feb 2021 15:28:16 GMT server ThreatSim-Web-Server vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control max-age=315360000, public content-length 7428 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	analytics.js Show response www.google-analytics.com/	46 KB 18 KB	6ms 5ms	Script text/javascript	2a00:1450:4001:812::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: paypol-login.com URL: https://paypol-login.com/assets/google-tracking.js?g=infopage Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://paypol-login.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Fri, 23 Oct 2020 03:00:57 GMT server Golfe2 age 5664 date Tue, 09 Feb 2021 03:25:07 GMT vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 18817 expires Tue, 09 Feb 2021 05:25:07 GMT
POST H3-Q050	200	collect Show response www.google-analytics.com/j/	4 B 391 B	46ms 13ms	XHR text/plain	2a00:1450:4001:812::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j87&a=773990192&t=pageview&_s=1&dl=https%3A%2F%2Fpaypol-login.com%2F&ul=en-us&de=UTF-8&dt=Proofpoint%20Security%20Awareness%20Training&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAAC~&jid=1545618849&gjid=967393431&cid=360600365.1612846772&tid=UA-83403-17&_gid=749032077.1612846772&_r=1&_slc=1&z=1281818929 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://paypol-login.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Tue, 09 Feb 2021 04:59:31 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://paypol-login.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 4 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	200	collect Show response stats.g.doubleclick.net/j/	4 B 447 B	41ms 14ms	XHR text/plain	2a00:1450:400c:c00::9a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j87&tid=UA-83403-17&cid=360600365.1612846772&jid=1545618849&gjid=967393431&_gid=749032077.1612846772&_u=IEBAAEAAAAAAAC~&z=1912943662 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c00::9a Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://paypol-login.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type text/plain Response headers pragma no-cache strict-transport-security max-age=10886400; includeSubDomains; preload x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 date Tue, 09 Feb 2021 04:59:31 GMT content-type text/plain access-control-allow-origin https://paypol-login.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 4 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	collect www.google-analytics.com/	35 B 122 B	6ms 6ms	Image image/gif	2a00:1450:4001:812::200e GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google-analytics.com/collect?v=1&_v=j87&a=773990192&t=pageview&_s=2&dl=https%3A%2F%2Fpaypol-login.com%2F&ul=en-us&de=UTF-8&dt=Proofpoint%20Security%20Awareness%20Training&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aEBAAEABAAAAAC~&jid=&gjid=&cid=360600365.1612846772&uid=infopage&tid=UA-83403-17&_gid=749032077.1612846772&z=523246977 Requested by Host: paypol-login.com URL: https://paypol-login.com/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://paypol-login.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 08 Feb 2021 10:55:55 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 age 65016 content-type image/gif access-control-allow-origin * cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 35 expires Mon, 01 Jan 1990 00:00:00 GMT
POST H2	200	browser_post Show response paypol-login.com/secure/	0 476 B	108ms 108ms	XHR image/gif	3.213.62.134 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://paypol-login.com/secure/browser_post Requested by Host: paypol-login.com URL: https://paypol-login.com/assets/ajax/libs/jquery/1.11.0/jquery.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.213.62.134 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-213-62-134.compute-1.amazonaws.com Software ThreatSim-Web-Server / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept */* Referer https://paypol-login.com/ X-Requested-With XMLHttpRequest User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers date Tue, 09 Feb 2021 04:59:31 GMT content-encoding gzip x-content-type-options nosniff x-permitted-cross-domain-policies none x-xss-protection 1; mode=block x-request-id 4ddefcca-eba3-46bf-85ed-81f4a8b68587 x-runtime 0.004507 referrer-policy strict-origin-when-cross-origin server ThreatSim-Web-Server x-host-info lw-prd-us-i-0662d0d1cddd6f126, ; 71e9969e7ef808879f5bb0b434b111ab4b585fc3 x-frame-options SAMEORIGIN x-download-options noopen vary Accept-Encoding content-type image/gif; charset=utf-8 access-control-allow-origin * cache-control no-cache
GET H2	200	trace paypol-login.com/	0 396 B	114ms 106ms	Image text/html	3.213.62.134 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://paypol-login.com/trace?id=infopage&msg=BrowserDetect%20-%20localStorage%20%3D%20true&correlation_id=undefined Requested by Host: paypol-login.com URL: https://paypol-login.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.213.62.134 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-213-62-134.compute-1.amazonaws.com Software ThreatSim-Web-Server / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://paypol-login.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-runtime 0.003416 date Tue, 09 Feb 2021 04:59:31 GMT referrer-policy strict-origin-when-cross-origin x-permitted-cross-domain-policies none x-host-info lw-prd-us-i-0ee618627bdedf03f, ; 71e9969e7ef808879f5bb0b434b111ab4b585fc3 x-download-options noopen x-frame-options SAMEORIGIN content-type text/html access-control-allow-origin * x-xss-protection 1; mode=block cache-control no-cache x-request-id ccbd655b-51b3-4fc4-a86c-1d52c2906270 content-length 0 x-content-type-options nosniff server ThreatSim-Web-Server
GET H2	200	trace paypol-login.com/	0 396 B	114ms 107ms	Image text/html	3.213.62.134 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://paypol-login.com/trace?id=infopage&msg=BrowserDetect%20-%20sessionStorage%20%3D%20true&correlation_id=undefined Requested by Host: paypol-login.com URL: https://paypol-login.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.213.62.134 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-213-62-134.compute-1.amazonaws.com Software ThreatSim-Web-Server / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://paypol-login.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-runtime 0.003632 date Tue, 09 Feb 2021 04:59:31 GMT referrer-policy strict-origin-when-cross-origin x-permitted-cross-domain-policies none x-host-info lw-prd-us-i-0683d5892e420be4f, ; 71e9969e7ef808879f5bb0b434b111ab4b585fc3 x-download-options noopen x-frame-options SAMEORIGIN content-type text/html access-control-allow-origin * x-xss-protection 1; mode=block cache-control no-cache x-request-id f1a8a7f3-5811-46d1-9a79-1708c4b9f45e content-length 0 x-content-type-options nosniff server ThreatSim-Web-Server
GET H2	200	trace paypol-login.com/	0 396 B	114ms 107ms	Image text/html	3.213.62.134 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://paypol-login.com/trace?id=infopage&msg=BrowserDetect%20-%20hasCookies%20%3D%20true&correlation_id=undefined Requested by Host: paypol-login.com URL: https://paypol-login.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.213.62.134 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-213-62-134.compute-1.amazonaws.com Software ThreatSim-Web-Server / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://paypol-login.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-runtime 0.003615 date Tue, 09 Feb 2021 04:59:31 GMT referrer-policy strict-origin-when-cross-origin x-permitted-cross-domain-policies none x-host-info lw-prd-us-i-031db153ae0897491, ; 71e9969e7ef808879f5bb0b434b111ab4b585fc3 x-download-options noopen x-frame-options SAMEORIGIN content-type text/html access-control-allow-origin * x-xss-protection 1; mode=block cache-control no-cache x-request-id 137aa85b-1293-4fc8-9048-6dae5513bb78 content-length 0 x-content-type-options nosniff server ThreatSim-Web-Server
GET H2	200	trace paypol-login.com/	0 395 B	113ms 106ms	Image text/html	3.213.62.134 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://paypol-login.com/trace?id=infopage&msg=BrowserDetect%20-%20browser%20%3D%20Chrome&correlation_id=undefined Requested by Host: paypol-login.com URL: https://paypol-login.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.213.62.134 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-213-62-134.compute-1.amazonaws.com Software ThreatSim-Web-Server / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://paypol-login.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-runtime 0.003160 date Tue, 09 Feb 2021 04:59:31 GMT referrer-policy strict-origin-when-cross-origin x-permitted-cross-domain-policies none x-host-info lw-prd-us-i-0662d0d1cddd6f126, ; 71e9969e7ef808879f5bb0b434b111ab4b585fc3 x-download-options noopen x-frame-options SAMEORIGIN content-type text/html access-control-allow-origin * x-xss-protection 1; mode=block cache-control no-cache x-request-id e0cf9832-ddaf-4e06-a6cf-4227201ccda3 content-length 0 x-content-type-options nosniff server ThreatSim-Web-Server
GET H2	200	trace paypol-login.com/	0 396 B	115ms 108ms	Image text/html	3.213.62.134 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://paypol-login.com/trace?id=infopage&msg=BrowserDetect%20-%20browser_version%20%3D%2083&correlation_id=undefined Requested by Host: paypol-login.com URL: https://paypol-login.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.213.62.134 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-213-62-134.compute-1.amazonaws.com Software ThreatSim-Web-Server / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://paypol-login.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-runtime 0.003918 date Tue, 09 Feb 2021 04:59:31 GMT referrer-policy strict-origin-when-cross-origin x-permitted-cross-domain-policies none x-host-info lw-prd-us-i-0ee618627bdedf03f, ; 71e9969e7ef808879f5bb0b434b111ab4b585fc3 x-download-options noopen x-frame-options SAMEORIGIN content-type text/html access-control-allow-origin * x-xss-protection 1; mode=block cache-control no-cache x-request-id c73cfc68-2ded-4011-831d-6ab648fecf09 content-length 0 x-content-type-options nosniff server ThreatSim-Web-Server
GET H2	200	trace paypol-login.com/	0 396 B	116ms 109ms	Image text/html	3.213.62.134 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://paypol-login.com/trace?id=infopage&msg=BrowserDetect%20-%20os%20%3D%20Linux&correlation_id=undefined Requested by Host: paypol-login.com URL: https://paypol-login.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.213.62.134 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-213-62-134.compute-1.amazonaws.com Software ThreatSim-Web-Server / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://paypol-login.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-runtime 0.003895 date Tue, 09 Feb 2021 04:59:31 GMT referrer-policy strict-origin-when-cross-origin x-permitted-cross-domain-policies none x-host-info lw-prd-us-i-0683d5892e420be4f, ; 71e9969e7ef808879f5bb0b434b111ab4b585fc3 x-download-options noopen x-frame-options SAMEORIGIN content-type text/html access-control-allow-origin * x-xss-protection 1; mode=block cache-control no-cache x-request-id f376b9d9-144a-4004-b179-f87e165b41d8 content-length 0 x-content-type-options nosniff server ThreatSim-Web-Server
GET H2	200	trace paypol-login.com/	0 396 B	122ms 115ms	Image text/html	3.213.62.134 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://paypol-login.com/trace?id=infopage&msg=BrowserDetect%20-%20os_version%20%3D%2010.14.5&correlation_id=undefined Requested by Host: paypol-login.com URL: https://paypol-login.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.213.62.134 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-213-62-134.compute-1.amazonaws.com Software ThreatSim-Web-Server / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://paypol-login.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-runtime 0.008737 date Tue, 09 Feb 2021 04:59:31 GMT referrer-policy strict-origin-when-cross-origin x-permitted-cross-domain-policies none x-host-info lw-prd-us-i-031db153ae0897491, ; 71e9969e7ef808879f5bb0b434b111ab4b585fc3 x-download-options noopen x-frame-options SAMEORIGIN content-type text/html access-control-allow-origin * x-xss-protection 1; mode=block cache-control no-cache x-request-id f1db7401-1eec-4752-8544-b48701e46635 content-length 0 x-content-type-options nosniff server ThreatSim-Web-Server
GET H2	200	trace paypol-login.com/	0 396 B	116ms 109ms	Image text/html	3.213.62.134 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://paypol-login.com/trace?id=infopage&msg=BrowserDetect%20-%20language%20%3D%20en-US&correlation_id=undefined Requested by Host: paypol-login.com URL: https://paypol-login.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.213.62.134 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-213-62-134.compute-1.amazonaws.com Software ThreatSim-Web-Server / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://paypol-login.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-runtime 0.003657 date Tue, 09 Feb 2021 04:59:31 GMT referrer-policy strict-origin-when-cross-origin x-permitted-cross-domain-policies none x-host-info lw-prd-us-i-0662d0d1cddd6f126, ; 71e9969e7ef808879f5bb0b434b111ab4b585fc3 x-download-options noopen x-frame-options SAMEORIGIN content-type text/html access-control-allow-origin * x-xss-protection 1; mode=block cache-control no-cache x-request-id 654b3175-ca57-4375-8020-5ae1335192c5 content-length 0 x-content-type-options nosniff server ThreatSim-Web-Server
GET H2	200	trace paypol-login.com/	0 396 B	120ms 113ms	Image text/html	3.213.62.134 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://paypol-login.com/trace?id=infopage&msg=BrowserDetect%20-%20colorDepth%20%3D%2024&correlation_id=undefined Requested by Host: paypol-login.com URL: https://paypol-login.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.213.62.134 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-213-62-134.compute-1.amazonaws.com Software ThreatSim-Web-Server / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://paypol-login.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-runtime 0.006093 date Tue, 09 Feb 2021 04:59:31 GMT referrer-policy strict-origin-when-cross-origin x-permitted-cross-domain-policies none x-host-info lw-prd-us-i-0ee618627bdedf03f, ; 71e9969e7ef808879f5bb0b434b111ab4b585fc3 x-download-options noopen x-frame-options SAMEORIGIN content-type text/html access-control-allow-origin * x-xss-protection 1; mode=block cache-control no-cache x-request-id 3121553f-bfec-436f-9edc-63b881de0baa content-length 0 x-content-type-options nosniff server ThreatSim-Web-Server
GET H2	200	trace paypol-login.com/	0 396 B	124ms 118ms	Image text/html	3.213.62.134 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://paypol-login.com/trace?id=infopage&msg=BrowserDetect%20-%20width%20%3D%201600&correlation_id=undefined Requested by Host: paypol-login.com URL: https://paypol-login.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.213.62.134 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-213-62-134.compute-1.amazonaws.com Software ThreatSim-Web-Server / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://paypol-login.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-runtime 0.005909 date Tue, 09 Feb 2021 04:59:31 GMT referrer-policy strict-origin-when-cross-origin x-permitted-cross-domain-policies none x-host-info lw-prd-us-i-0683d5892e420be4f, ; 71e9969e7ef808879f5bb0b434b111ab4b585fc3 x-download-options noopen x-frame-options SAMEORIGIN content-type text/html access-control-allow-origin * x-xss-protection 1; mode=block cache-control no-cache x-request-id 1d4b4a77-9b2f-493e-98ae-e668166238c0 content-length 0 x-content-type-options nosniff server ThreatSim-Web-Server
GET H2	200	trace paypol-login.com/	0 396 B	117ms 111ms	Image text/html	3.213.62.134 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://paypol-login.com/trace?id=infopage&msg=BrowserDetect%20-%20height%20%3D%201200&correlation_id=undefined Requested by Host: paypol-login.com URL: https://paypol-login.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.213.62.134 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-213-62-134.compute-1.amazonaws.com Software ThreatSim-Web-Server / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://paypol-login.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-runtime 0.002931 date Tue, 09 Feb 2021 04:59:31 GMT referrer-policy strict-origin-when-cross-origin x-permitted-cross-domain-policies none x-host-info lw-prd-us-i-031db153ae0897491, ; 71e9969e7ef808879f5bb0b434b111ab4b585fc3 x-download-options noopen x-frame-options SAMEORIGIN content-type text/html access-control-allow-origin * x-xss-protection 1; mode=block cache-control no-cache x-request-id c4b55177-577e-46b5-bc57-410c200da49e content-length 0 x-content-type-options nosniff server ThreatSim-Web-Server
GET H2	200	log paypol-login.com/	0 476 B	123ms 117ms	Image image/gif	3.213.62.134 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://paypol-login.com/log?id=infopage&sev=1&msg=PluginDetect%20is%20not%20defined&correlation_id=undefined Requested by Host: paypol-login.com URL: https://paypol-login.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.213.62.134 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-213-62-134.compute-1.amazonaws.com Software ThreatSim-Web-Server / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://paypol-login.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 09 Feb 2021 04:59:31 GMT content-encoding gzip x-content-type-options nosniff x-permitted-cross-domain-policies none x-xss-protection 1; mode=block x-request-id 0a1b903a-ae7b-4323-b491-50baaf5c8dc4 x-runtime 0.006735 referrer-policy strict-origin-when-cross-origin server ThreatSim-Web-Server x-host-info lw-prd-us-i-0662d0d1cddd6f126, ; 71e9969e7ef808879f5bb0b434b111ab4b585fc3 x-frame-options SAMEORIGIN x-download-options noopen vary Accept-Encoding content-type image/gif; charset=utf-8 access-control-allow-origin * cache-control no-cache
GET H2	200	trace paypol-login.com/	0 396 B	118ms 112ms	Image text/html	3.213.62.134 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://paypol-login.com/trace?id=infopage&msg=Skipping%20java%20detection&correlation_id=undefined Requested by Host: paypol-login.com URL: https://paypol-login.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.213.62.134 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-213-62-134.compute-1.amazonaws.com Software ThreatSim-Web-Server / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://paypol-login.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-runtime 0.002779 date Tue, 09 Feb 2021 04:59:31 GMT referrer-policy strict-origin-when-cross-origin x-permitted-cross-domain-policies none x-host-info lw-prd-us-i-0ee618627bdedf03f, ; 71e9969e7ef808879f5bb0b434b111ab4b585fc3 x-download-options noopen x-frame-options SAMEORIGIN content-type text/html access-control-allow-origin * x-xss-protection 1; mode=block cache-control no-cache x-request-id a4d96562-3704-4dd4-8a2a-961de0c96c7f content-length 0 x-content-type-options nosniff server ThreatSim-Web-Server
GET H2	200	trace paypol-login.com/	0 396 B	122ms 116ms	Image text/html	3.213.62.134 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://paypol-login.com/trace?id=infopage&msg=Loading%20flash%20version&correlation_id=undefined Requested by Host: paypol-login.com URL: https://paypol-login.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.213.62.134 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-213-62-134.compute-1.amazonaws.com Software ThreatSim-Web-Server / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://paypol-login.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-runtime 0.008037 date Tue, 09 Feb 2021 04:59:31 GMT referrer-policy strict-origin-when-cross-origin x-permitted-cross-domain-policies none x-host-info lw-prd-us-i-0683d5892e420be4f, ; 71e9969e7ef808879f5bb0b434b111ab4b585fc3 x-download-options noopen x-frame-options SAMEORIGIN content-type text/html access-control-allow-origin * x-xss-protection 1; mode=block cache-control no-cache x-request-id 463beaca-081d-410e-b754-67045b29a69e content-length 0 x-content-type-options nosniff server ThreatSim-Web-Server
GET H2	200	log paypol-login.com/	0 477 B	121ms 116ms	Image image/gif	3.213.62.134 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://paypol-login.com/log?id=infopage&sev=1&msg=Cannot%20read%20property%20%27getVersion%27%20of%20undefined&correlation_id=undefined Requested by Host: paypol-login.com URL: https://paypol-login.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.213.62.134 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-213-62-134.compute-1.amazonaws.com Software ThreatSim-Web-Server / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://paypol-login.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 09 Feb 2021 04:59:31 GMT content-encoding gzip x-content-type-options nosniff x-permitted-cross-domain-policies none x-xss-protection 1; mode=block x-request-id 95367759-25f5-408d-b0f3-488019aab438 x-runtime 0.003219 referrer-policy strict-origin-when-cross-origin server ThreatSim-Web-Server x-host-info lw-prd-us-i-031db153ae0897491, ; 71e9969e7ef808879f5bb0b434b111ab4b585fc3 x-frame-options SAMEORIGIN x-download-options noopen vary Accept-Encoding content-type image/gif; charset=utf-8 access-control-allow-origin * cache-control no-cache
GET H2	200	trace paypol-login.com/	0 396 B	121ms 116ms	Image text/html	3.213.62.134 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://paypol-login.com/trace?id=infopage&msg=Loading%20pdf%20version&correlation_id=undefined Requested by Host: paypol-login.com URL: https://paypol-login.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.213.62.134 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-213-62-134.compute-1.amazonaws.com Software ThreatSim-Web-Server / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://paypol-login.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-runtime 0.004523 date Tue, 09 Feb 2021 04:59:31 GMT referrer-policy strict-origin-when-cross-origin x-permitted-cross-domain-policies none x-host-info lw-prd-us-i-0662d0d1cddd6f126, ; 71e9969e7ef808879f5bb0b434b111ab4b585fc3 x-download-options noopen x-frame-options SAMEORIGIN content-type text/html access-control-allow-origin * x-xss-protection 1; mode=block cache-control no-cache x-request-id 78ca9cb9-b3fe-4284-b96e-8fd7085ffba1 content-length 0 x-content-type-options nosniff server ThreatSim-Web-Server
GET H2	200	trace paypol-login.com/	0 396 B	122ms 117ms	Image text/html	3.213.62.134 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://paypol-login.com/trace?id=infopage&msg=Loading%20quicktime%20version&correlation_id=undefined Requested by Host: paypol-login.com URL: https://paypol-login.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.213.62.134 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-213-62-134.compute-1.amazonaws.com Software ThreatSim-Web-Server / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://paypol-login.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-runtime 0.003901 date Tue, 09 Feb 2021 04:59:31 GMT referrer-policy strict-origin-when-cross-origin x-permitted-cross-domain-policies none x-host-info lw-prd-us-i-0ee618627bdedf03f, ; 71e9969e7ef808879f5bb0b434b111ab4b585fc3 x-download-options noopen x-frame-options SAMEORIGIN content-type text/html access-control-allow-origin * x-xss-protection 1; mode=block cache-control no-cache x-request-id 339727e5-61c2-4127-a185-8ac22f5847a2 content-length 0 x-content-type-options nosniff server ThreatSim-Web-Server
GET H2	200	trace paypol-login.com/	0 395 B	119ms 115ms	Image text/html	3.213.62.134 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://paypol-login.com/trace?id=infopage&msg=Loading%20RealPlayer%20version&correlation_id=undefined Requested by Host: paypol-login.com URL: https://paypol-login.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.213.62.134 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-213-62-134.compute-1.amazonaws.com Software ThreatSim-Web-Server / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://paypol-login.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-runtime 0.004371 date Tue, 09 Feb 2021 04:59:31 GMT referrer-policy strict-origin-when-cross-origin x-permitted-cross-domain-policies none x-host-info lw-prd-us-i-0683d5892e420be4f, ; 71e9969e7ef808879f5bb0b434b111ab4b585fc3 x-download-options noopen x-frame-options SAMEORIGIN content-type text/html access-control-allow-origin * x-xss-protection 1; mode=block cache-control no-cache x-request-id 2973101c-e840-437d-a1ab-16da0d571260 content-length 0 x-content-type-options nosniff server ThreatSim-Web-Server
GET H2	200	trace paypol-login.com/	0 396 B	118ms 114ms	Image text/html	3.213.62.134 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://paypol-login.com/trace?id=infopage&msg=Loading%20Silverlight%20version&correlation_id=undefined Requested by Host: paypol-login.com URL: https://paypol-login.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.213.62.134 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-213-62-134.compute-1.amazonaws.com Software ThreatSim-Web-Server / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://paypol-login.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-runtime 0.004237 date Tue, 09 Feb 2021 04:59:31 GMT referrer-policy strict-origin-when-cross-origin x-permitted-cross-domain-policies none x-host-info lw-prd-us-i-031db153ae0897491, ; 71e9969e7ef808879f5bb0b434b111ab4b585fc3 x-download-options noopen x-frame-options SAMEORIGIN content-type text/html access-control-allow-origin * x-xss-protection 1; mode=block cache-control no-cache x-request-id f0a1852c-858a-4fa9-9b68-0154c1badaf5 content-length 0 x-content-type-options nosniff server ThreatSim-Web-Server
GET H2	200	trace paypol-login.com/	0 396 B	118ms 114ms	Image text/html	3.213.62.134 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://paypol-login.com/trace?id=infopage&msg=Loading%20WindowsMediaPlayer%20version&correlation_id=undefined Requested by Host: paypol-login.com URL: https://paypol-login.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.213.62.134 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-213-62-134.compute-1.amazonaws.com Software ThreatSim-Web-Server / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://paypol-login.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-runtime 0.004838 date Tue, 09 Feb 2021 04:59:31 GMT referrer-policy strict-origin-when-cross-origin x-permitted-cross-domain-policies none x-host-info lw-prd-us-i-0662d0d1cddd6f126, ; 71e9969e7ef808879f5bb0b434b111ab4b585fc3 x-download-options noopen x-frame-options SAMEORIGIN content-type text/html access-control-allow-origin * x-xss-protection 1; mode=block cache-control no-cache x-request-id 2fbd1799-42d7-4c2e-a58d-68d7e32ee619 content-length 0 x-content-type-options nosniff server ThreatSim-Web-Server
GET H2	200	trace paypol-login.com/	0 396 B	122ms 118ms	Image text/html	3.213.62.134 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://paypol-login.com/trace?id=infopage&msg=redirect_url%20is%20undefined&correlation_id=undefined Requested by Host: paypol-login.com URL: https://paypol-login.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.213.62.134 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-213-62-134.compute-1.amazonaws.com Software ThreatSim-Web-Server / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://paypol-login.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-runtime 0.003415 date Tue, 09 Feb 2021 04:59:31 GMT referrer-policy strict-origin-when-cross-origin x-permitted-cross-domain-policies none x-host-info lw-prd-us-i-0ee618627bdedf03f, ; 71e9969e7ef808879f5bb0b434b111ab4b585fc3 x-download-options noopen x-frame-options SAMEORIGIN content-type text/html access-control-allow-origin * x-xss-protection 1; mode=block cache-control no-cache x-request-id 08af7e4a-8117-4139-ac8a-75a316de64d1 content-length 0 x-content-type-options nosniff server ThreatSim-Web-Server
GET H2	200	ga-audiences www.google.com/ads/	42 B 107 B	17ms 16ms	Image image/gif	2a00:1450:4001:827::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j87&tid=UA-83403-17&cid=360600365.1612846772&jid=1545618849&_u=IEBAAEAAAAAAAC~&z=46764947 Requested by Host: paypol-login.com URL: https://paypol-login.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://paypol-login.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Tue, 09 Feb 2021 04:59:31 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ga-audiences www.google.de/ads/	42 B 107 B	28ms 27ms	Image image/gif	2a00:1450:4001:80f::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j87&tid=UA-83403-17&cid=360600365.1612846772&jid=1545618849&_u=IEBAAEAAAAAAAC~&z=46764947 Requested by Host: paypol-login.com URL: https://paypol-login.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://paypol-login.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Tue, 09 Feb 2021 04:59:31 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	trace paypol-login.com/	0 396 B	106ms 106ms	Image text/html	3.213.62.134 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://paypol-login.com/trace?id=infopage&msg=browser_post_successful&correlation_id=undefined Requested by Host: paypol-login.com URL: https://paypol-login.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.213.62.134 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-213-62-134.compute-1.amazonaws.com Software ThreatSim-Web-Server / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://paypol-login.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-runtime 0.002755 date Tue, 09 Feb 2021 04:59:32 GMT referrer-policy strict-origin-when-cross-origin x-permitted-cross-domain-policies none x-host-info lw-prd-us-i-0683d5892e420be4f, ; 71e9969e7ef808879f5bb0b434b111ab4b585fc3 x-download-options noopen x-frame-options SAMEORIGIN content-type text/html access-control-allow-origin * x-xss-protection 1; mode=block cache-control no-cache x-request-id ad8b00d7-87a6-4942-99f0-f54afbe3975f content-length 0 x-content-type-options nosniff server ThreatSim-Web-Server
GET H2	200	nr-1198.min.js Show response js-agent.newrelic.com/	27 KB 11 KB	68ms 21ms	Script application/javascript	151.101.114.110 FASTLY
General Check archive.org Show headers Download Go to Full URL https://js-agent.newrelic.com/nr-1198.min.js Requested by Host: paypol-login.com URL: https://paypol-login.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.114.110 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 39893061747f88b837a34d0395d05fca83e7cd5bbf2d582d181a73c5c9a174c6 Request headers Referer https://paypol-login.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 09 Feb 2021 04:59:32 GMT content-encoding gzip x-amz-request-id 6G7N8SBZFWDP9P9M x-cache HIT content-length 10682 x-amz-id-2 0UGCO4Mhlfex45xXj/8DAFadaQ6I71xHRyRaRgwDh98IVodQV5SoRghdxpscDq1FfJKXoBas7qw= x-served-by cache-hhn4066-HHN last-modified Fri, 29 Jan 2021 19:19:08 GMT server AmazonS3 x-timer S1612846772.122198,VS0,VE0 etag "59c98195ba35e0b45cbe2e5beebd1ac8" vary Accept-Encoding content-type application/javascript via 1.1 varnish cache-control public, max-age=7200, stale-if-error=604800 accept-ranges bytes x-cache-hits 14307
GET H/1.1	200 OK	4b7a74eb40 Show response bam-cell.nr-data.net/1/	57 B 646 B	223ms 154ms	Script text/javascript	162.247.243.147 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://bam-cell.nr-data.net/1/4b7a74eb40?a=980065240&v=1198.fe6ec20&to=dVtXQkUKCFpTQxtVBVhQUFhQSg1YUlRM&rst=966&ck=1&ref=https://paypol-login.com/&ap=4&be=358&fe=891&dc=662&perf=%7B%22timing%22:%7B%22of%22:1612846771175,%22n%22:0,%22f%22:1,%22dn%22:2,%22dne%22:38,%22c%22:38,%22s%22:53,%22ce%22:243,%22rq%22:243,%22rp%22:351,%22rpe%22:352,%22dl%22:353,%22di%22:662,%22ds%22:662,%22de%22:678,%22dc%22:891,%22l%22:891,%22le%22:892%7D,%22navigation%22:%7B%7D%7D&fp=579&fcp=579&jsonp=NREUM.setToken Requested by Host: js-agent.newrelic.com URL: https://js-agent.newrelic.com/nr-1198.min.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 162.247.243.147 San Francisco, United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d10c94b6cdb747904baee9070f003bb45849da46f8100b1320f286c21cbcaaa1 Request headers Referer https://paypol-login.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 09 Feb 2021 04:59:32 GMT Content-Encoding gzip CF-Cache-Status DYNAMIC Server cloudflare Expect-CT max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Vary Accept-Encoding Content-Type text/javascript;charset=ISO-8859-1 Transfer-Encoding chunked Connection keep-alive CF-Ray 61eb05866da5edbf-CDG cf-request-id 0826c1c8010000edbff6193000000001 Expires Thu, 01 Jan 1970 00:00:00 GMT
POST H/1.1	200 OK	4b7a74eb40 Show response bam-cell.nr-data.net/events/1/	24 B 492 B	142ms 142ms	XHR image/gif	162.247.243.147 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://bam-cell.nr-data.net/events/1/4b7a74eb40?a=980065240&v=1198.fe6ec20&to=dVtXQkUKCFpTQxtVBVhQUFhQSg1YUlRM&rst=10966&ck=1&ref=https://paypol-login.com/ Requested by Host: js-agent.newrelic.com URL: https://js-agent.newrelic.com/nr-1198.min.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 162.247.243.147 San Francisco, United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300 Request headers Referer https://paypol-login.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 content-type text/plain Response headers Date Tue, 09 Feb 2021 04:59:42 GMT CF-Cache-Status DYNAMIC Server cloudflare Expect-CT max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Vary Accept-Encoding Content-Type image/gif Access-Control-Allow-Origin https://paypol-login.com Access-Control-Allow-Credentials true Connection keep-alive CF-Ray 61eb05c47f3aedbf-CDG Content-Length 24 cf-request-id 0826c1eeca0000edbf4d2cd000000001

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Phishing Simulation (Internet)

46 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated object| NREUM object| newrelic function| __nr_require boolean| do_not_detect_java string| tracking_id function| $ function| jQuery string| GoogleAnalyticsObject function| ga object| google_tag_data object| gaplugins object| gaGlobal object| gaData object| BrowserDetect object| $_GET undefined| regex undefined| items undefined| last string| base_post_url function| log_error function| log_to_console function| log_message boolean| fingerprinted function| strip function| secureSubmitWithGuid function| secureSubmit function| findUsername function| checkPassword function| secureLogAndRedirect function| sendFingerprint function| imageSender function| sendIndividually function| loadAllInfo object| local_addresses function| redirector function| rewriteLinks function| isFormValid

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.paypol-login.com/	1970-01-19 16:02:13	Name: _gid Value: GA1.2.749032077.1612846772
			.paypol-login.com/	1970-01-19 16:00:46	Name: _gat Value: 1
			.paypol-login.com/	1970-01-20 09:31:58	Name: _ga Value: GA1.2.360600365.1612846772

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bam-cell.nr-data.net
js-agent.newrelic.com
paypol-login.com
stats.g.doubleclick.net
www.google-analytics.com
www.google.com
www.google.de
151.101.114.110
162.247.243.147
2a00:1450:4001:80f::2003
2a00:1450:4001:812::200e
2a00:1450:4001:827::2004
2a00:1450:400c:c00::9a
3.213.62.134
0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300
26c0e365593f0e20033bd24f01e6e3e68af4e2bb7bec1fd79d795c92560162e9
39893061747f88b837a34d0395d05fca83e7cd5bbf2d582d181a73c5c9a174c6
6cc8a6f9fe63f66ea5d2f7822846e724a5ab2b46ad6821569ebd666d3c6d7ff3
7c3cf277884b9d4d3dde061a9dc6176d5f90c4183b10e5c774a16ddd5113a776
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
b294e973896f8f874e90a8eb1a8908ac790980d034c4c4bdf0fc3d37b8abf682
baeb83db3989a35784a514e71da3d508a221ea11d95282da7dc53c75d2712670
d10c94b6cdb747904baee9070f003bb45849da46f8100b1320f286c21cbcaaa1
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629