update-account-credit-service.server-activation.limit.e4cb.com Open in urlscan Pro
131.153.37.2 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://update-account-credit-service.server-activation.limit.e4cb.com/
Effective URL:
http://update-account-credit-service.server-activation.limit.e4cb.com/c04a693c73ccc67f1e01c63107e15015/secureaccount.php?country.x=PL&locale.x=pl_PL&customer.x=ID-PA$...
Submission Tags: phishing malicious Search All
Submission: On September 11 via api (September 11th 2020, 4:00:08 pm UTC) from US

Summary HTTP 10 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 10 HTTP transactions. The main IP is 131.153.37.2, located in Phoenix, United States and belongs to SSASN2, US. The main domain is update-account-credit-service.server-activation.limit.e4cb.com.

This is the only time update-account-credit-service.server-activation.limit.e4cb.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: PayPal (Financial)

Domain & IP information

	IP Address	AS Autonomous System
3 8	131.153.37.2 131.153.37.2	20454 (SSASN2) (SSASN2)
5	104.111.228.123 104.111.228.123	16625 (AKAMAI-AS) (AKAMAI-AS)
10	2

8 131.153.37.2 (Phoenix, United States) 3 redirects

ASN20454 (SSASN2, US)
PTR: svr156.edns1.com

update-account-credit-service.server-activation.limit.e4cb.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 104.111.228.123 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-228-123.deploy.static.akamaitechnologies.com

www.paypalobjects.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	e4cb.com 3 redirects update-account-credit-service.server-activation.limit.e4cb.com	197 KB
5	paypalobjects.com www.paypalobjects.com	145 KB
10	2

	Domain	Requested by
8	update-account-credit-service.server-activation.limit.e4cb.com	3 redirects update-account-credit-service.server-activation.limit.e4cb.com
5	www.paypalobjects.com	update-account-credit-service.server-activation.limit.e4cb.com
10	2

This site contains no links.

Subject Issuer	Validity	Valid
www.paypal.com DigiCert SHA2 Extended Validation Server CA	`2020-01-09` - `2022-01-12`	2 years	crt.sh

This page contains 1 frames:

Primary Page: http://update-account-credit-service.server-activation.limit.e4cb.com/c04a693c73ccc67f1e01c63107e15015/secureaccount.php?country.x=PL&locale.x=pl_PL&customer.x=ID-PA$1$BO7ysSvl$Gs/iSDNLrzGH7ET8IgeNg0&safety=429U60kZ6f1R79dc9HBNOaQeaK5YSuhmz34AWbG6V1Dvw7q78pdbMLxo3T6Fda2ddaf8cgCn899ae2JiyaX5lb1EPstjrI
Frame ID: 038B99C0F039F6FF95F65A6DED21CC8F
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://update-account-credit-service.server-activation.limit.e4cb.com/ HTTP 302
http://update-account-credit-service.server-activation.limit.e4cb.com/to.php HTTP 302
http://update-account-credit-service.server-activation.limit.e4cb.com/c04a693c73ccc67f1e01c63107e15015 HTTP 301
http://update-account-credit-service.server-activation.limit.e4cb.com/c04a693c73ccc67f1e01c63107e15015/ Page URL
http://update-account-credit-service.server-activation.limit.e4cb.com/c04a693c73ccc67f1e01c63107e15015/secureaccount.php?country.x=PL&locale.x=pl_... Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

10
Requests

50 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

341 kB
Transfer

339 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://update-account-credit-service.server-activation.limit.e4cb.com/ HTTP 302
http://update-account-credit-service.server-activation.limit.e4cb.com/to.php HTTP 302
http://update-account-credit-service.server-activation.limit.e4cb.com/c04a693c73ccc67f1e01c63107e15015 HTTP 301
http://update-account-credit-service.server-activation.limit.e4cb.com/c04a693c73ccc67f1e01c63107e15015/ Page URL
http://update-account-credit-service.server-activation.limit.e4cb.com/c04a693c73ccc67f1e01c63107e15015/secureaccount.php?country.x=PL&locale.x=pl_PL&customer.x=ID-PA$1$BO7ysSvl$Gs/iSDNLrzGH7ET8IgeNg0&safety=429U60kZ6f1R79dc9HBNOaQeaK5YSuhmz34AWbG6V1Dvw7q78pdbMLxo3T6Fda2ddaf8cgCn899ae2JiyaX5lb1EPstjrI Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://update-account-credit-service.server-activation.limit.e4cb.com/ HTTP 302
http://update-account-credit-service.server-activation.limit.e4cb.com/to.php HTTP 302
http://update-account-credit-service.server-activation.limit.e4cb.com/c04a693c73ccc67f1e01c63107e15015 HTTP 301
http://update-account-credit-service.server-activation.limit.e4cb.com/c04a693c73ccc67f1e01c63107e15015/

10 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Cookie set /
update-account-credit-service.server-activation.limit.e4cb.com/c04a693c73ccc67f1e01c63107e15015/
Redirect Chain

http://update-account-credit-service.server-activation.limit.e4cb.com/
http://update-account-credit-service.server-activation.limit.e4cb.com/to.php
http://update-account-credit-service.server-activation.limit.e4cb.com/c04a693c73ccc67f1e01c63107e15015
http://update-account-credit-service.server-activation.limit.e4cb.com/c04a693c73ccc67f1e01c63107e15015/

285 B
667 B

706ms
681ms

Document
text/html

131.153.37.2
SSASN2

General

Check archive.org

Show headers Download Go to

Full URL: http://update-account-credit-service.server-activation.limit.e4cb.com/c04a693c73ccc67f1e01c63107e15015/
Protocol: HTTP/1.1
Server: 131.153.37.2 Phoenix, United States, ASN20454 (SSASN2, US),
Reverse DNS: svr156.edns1.com
Software: Apache / PHP/7.2.33
Resource Hash

Request headers

Host: update-account-credit-service.server-activation.limit.e4cb.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 11 Sep 2020 15:59:50 GMT
Server: Apache
X-Powered-By: PHP/7.2.33
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Set-Cookie: PHPSESSID=324513f22d58d01a9b65247779c4d467; path=/
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

Redirect headers

Date: Fri, 11 Sep 2020 15:59:50 GMT
Server: Apache
Location: http://update-account-credit-service.server-activation.limit.e4cb.com/c04a693c73ccc67f1e01c63107e15015/
Content-Length: 311
Connection: close
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 200
OK Primary Request secureaccount.php Show response
update-account-credit-service.server-activation.limit.e4cb.com/c04a693c73ccc67f1e01c63107e15015/ 2 KB
2 KB 619ms
593ms Document
text/html 131.153.37.2
SSASN2

General

Check archive.org

Show headers Download Go to

Full URL: http://update-account-credit-service.server-activation.limit.e4cb.com/c04a693c73ccc67f1e01c63107e15015/secureaccount.php?country.x=PL&locale.x=pl_PL&customer.x=ID-PA$1$BO7ysSvl$Gs/iSDNLrzGH7ET8IgeNg0&safety=429U60kZ6f1R79dc9HBNOaQeaK5YSuhmz34AWbG6V1Dvw7q78pdbMLxo3T6Fda2ddaf8cgCn899ae2JiyaX5lb1EPstjrI
Protocol: HTTP/1.1
Server: 131.153.37.2 Phoenix, United States, ASN20454 (SSASN2, US),
Reverse DNS: svr156.edns1.com
Software: Apache / PHP/7.2.33
Resource Hash: a007f54d6d5e2628eec4360219df69fc77700f34b0602d479e80cb18601ddaa1

Request headers

Host: update-account-credit-service.server-activation.limit.e4cb.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://update-account-credit-service.server-activation.limit.e4cb.com/c04a693c73ccc67f1e01c63107e15015/
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Cookie: PHPSESSID=324513f22d58d01a9b65247779c4d467
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: http://update-account-credit-service.server-activation.limit.e4cb.com/c04a693c73ccc67f1e01c63107e15015/

Response headers

Date: Fri, 11 Sep 2020 15:59:51 GMT
Server: Apache
X-Powered-By: PHP/7.2.33
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK jquery.min.js Show response
update-account-credit-service.server-activation.limit.e4cb.com/c04a693c73ccc67f1e01c63107e15015/open/js/ 85 KB
85 KB 573ms
548ms Script
application/javascript 131.153.37.2
SSASN2

General

Check archive.org

Show headers Download Go to

Full URL: http://update-account-credit-service.server-activation.limit.e4cb.com/c04a693c73ccc67f1e01c63107e15015/open/js/jquery.min.js
Requested by: Host: update-account-credit-service.server-activation.limit.e4cb.com
URL: http://update-account-credit-service.server-activation.limit.e4cb.com/c04a693c73ccc67f1e01c63107e15015/secureaccount.php?country.x=PL&locale.x=pl_PL&customer.x=ID-PA$1$BO7ysSvl$Gs/iSDNLrzGH7ET8IgeNg0&safety=429U60kZ6f1R79dc9HBNOaQeaK5YSuhmz34AWbG6V1Dvw7q78pdbMLxo3T6Fda2ddaf8cgCn899ae2JiyaX5lb1EPstjrI
Protocol: HTTP/1.1
Server: 131.153.37.2 Phoenix, United States, ASN20454 (SSASN2, US),
Reverse DNS: svr156.edns1.com
Software: Apache /
Resource Hash: d30b6114fb9496ae46b2a8cdf59379c8ffdb957534bd1dd73e626c7c61c7e67d

Request headers

Referer: http://update-account-credit-service.server-activation.limit.e4cb.com/c04a693c73ccc67f1e01c63107e15015/secureaccount.php?country.x=PL&locale.x=pl_PL&customer.x=ID-PA$1$BO7ysSvl$Gs/iSDNLrzGH7ET8IgeNg0&safety=429U60kZ6f1R79dc9HBNOaQeaK5YSuhmz34AWbG6V1Dvw7q78pdbMLxo3T6Fda2ddaf8cgCn899ae2JiyaX5lb1EPstjrI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 11 Sep 2020 15:59:52 GMT
Last-Modified: Fri, 11 Sep 2020 15:59:48 GMT
Server: Apache
Connection: close
Accept-Ranges: bytes
Content-Length: 86927
Content-Type: application/javascript

GET
H/1.1 200
OK xappx.css
update-account-credit-service.server-activation.limit.e4cb.com/c04a693c73ccc67f1e01c63107e15015/open/css/ 108 KB
108 KB 591ms
566ms Stylesheet
text/css 131.153.37.2
SSASN2

General

Check archive.org

Show headers Download Go to

Full URL: http://update-account-credit-service.server-activation.limit.e4cb.com/c04a693c73ccc67f1e01c63107e15015/open/css/xappx.css
Requested by: Host: update-account-credit-service.server-activation.limit.e4cb.com
URL: http://update-account-credit-service.server-activation.limit.e4cb.com/c04a693c73ccc67f1e01c63107e15015/secureaccount.php?country.x=PL&locale.x=pl_PL&customer.x=ID-PA$1$BO7ysSvl$Gs/iSDNLrzGH7ET8IgeNg0&safety=429U60kZ6f1R79dc9HBNOaQeaK5YSuhmz34AWbG6V1Dvw7q78pdbMLxo3T6Fda2ddaf8cgCn899ae2JiyaX5lb1EPstjrI
Protocol: HTTP/1.1
Server: 131.153.37.2 Phoenix, United States, ASN20454 (SSASN2, US),
Reverse DNS: svr156.edns1.com
Software: Apache /
Resource Hash: 544dfa59462862db7bafc2d2e4b3925ac3eacb11e52834916df02bd1cda19b1d

Request headers

Referer: http://update-account-credit-service.server-activation.limit.e4cb.com/c04a693c73ccc67f1e01c63107e15015/secureaccount.php?country.x=PL&locale.x=pl_PL&customer.x=ID-PA$1$BO7ysSvl$Gs/iSDNLrzGH7ET8IgeNg0&safety=429U60kZ6f1R79dc9HBNOaQeaK5YSuhmz34AWbG6V1Dvw7q78pdbMLxo3T6Fda2ddaf8cgCn899ae2JiyaX5lb1EPstjrI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 11 Sep 2020 15:59:52 GMT
Last-Modified: Fri, 11 Sep 2020 15:59:48 GMT
Server: Apache
Connection: close
Accept-Ranges: bytes
Content-Length: 110339
Content-Type: text/css

GET
H/1.1 200
OK xsecx.js Show response
update-account-credit-service.server-activation.limit.e4cb.com/c04a693c73ccc67f1e01c63107e15015/open/js/ 268 B
486 B 593ms
567ms Script
application/javascript 131.153.37.2
SSASN2

General

Check archive.org

Show headers Download Go to

Full URL: http://update-account-credit-service.server-activation.limit.e4cb.com/c04a693c73ccc67f1e01c63107e15015/open/js/xsecx.js
Requested by: Host: update-account-credit-service.server-activation.limit.e4cb.com
URL: http://update-account-credit-service.server-activation.limit.e4cb.com/c04a693c73ccc67f1e01c63107e15015/secureaccount.php?country.x=PL&locale.x=pl_PL&customer.x=ID-PA$1$BO7ysSvl$Gs/iSDNLrzGH7ET8IgeNg0&safety=429U60kZ6f1R79dc9HBNOaQeaK5YSuhmz34AWbG6V1Dvw7q78pdbMLxo3T6Fda2ddaf8cgCn899ae2JiyaX5lb1EPstjrI
Protocol: HTTP/1.1
Server: 131.153.37.2 Phoenix, United States, ASN20454 (SSASN2, US),
Reverse DNS: svr156.edns1.com
Software: Apache /
Resource Hash: 12bec3e411f30e9f988a001dc06817aef7a8d2513fb2e78c989d75a4946714de

Request headers

Referer: http://update-account-credit-service.server-activation.limit.e4cb.com/c04a693c73ccc67f1e01c63107e15015/secureaccount.php?country.x=PL&locale.x=pl_PL&customer.x=ID-PA$1$BO7ysSvl$Gs/iSDNLrzGH7ET8IgeNg0&safety=429U60kZ6f1R79dc9HBNOaQeaK5YSuhmz34AWbG6V1Dvw7q78pdbMLxo3T6Fda2ddaf8cgCn899ae2JiyaX5lb1EPstjrI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 11 Sep 2020 15:59:52 GMT
Last-Modified: Fri, 11 Sep 2020 15:59:47 GMT
Server: Apache
Connection: close
Accept-Ranges: bytes
Content-Length: 268
Content-Type: application/javascript

GET
H2 200 monogram@2x.png
www.paypalobjects.com/images/shared/ 1 KB
2 KB 60ms
59ms Image
image/png 104.111.228.123
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.paypalobjects.com/images/shared/monogram@2x.png

Requested by

Host: update-account-credit-service.server-activation.limit.e4cb.com
URL: http://update-account-credit-service.server-activation.limit.e4cb.com/c04a693c73ccc67f1e01c63107e15015/open/css/xappx.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.111.228.123 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-228-123.deploy.static.akamaitechnologies.com

Software

Akamai Image Manager /

Resource Hash

bbe3177aa5d225f117aea0e2eeb27f11d853a33d6d162733c5be8b1de8d36dc5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: http://update-account-credit-service.server-activation.limit.e4cb.com/c04a693c73ccc67f1e01c63107e15015/open/css/xappx.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 11 Sep 2020 15:59:53 GMT
x-content-type-options: nosniff
last-modified: Fri, 08 May 2020 01:20:32 GMT
server: Akamai Image Manager
strict-transport-security: max-age=31536000
content-type: image/png
status: 200
cache-control: private, max-age=985947
content-length: 1507
expires: Wed, 23 Sep 2020 01:52:20 GMT

GET
H2 200 animation-oval.png
www.paypalobjects.com/images/shared/ 2 KB
3 KB 66ms
65ms Image
image/webp 104.111.228.123
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.paypalobjects.com/images/shared/animation-oval.png

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.111.228.123 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-228-123.deploy.static.akamaitechnologies.com

Software

Akamai Image Manager /

Resource Hash

da775dd10f868447dea4c3522fb3b55bd4a5df650d3f2233a76d31bb711f6c2a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: http://update-account-credit-service.server-activation.limit.e4cb.com/c04a693c73ccc67f1e01c63107e15015/open/css/xappx.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 11 Sep 2020 15:59:53 GMT
x-content-type-options: nosniff
last-modified: Fri, 08 May 2020 01:20:32 GMT
server: Akamai Image Manager
strict-transport-security: max-age=31536000
content-type: image/webp
status: 200
cache-control: private, no-transform, max-age=43200
content-length: 2448
expires: Sat, 12 Sep 2020 03:59:53 GMT

GET
H2 200 PayPalSansBig-Light.woff
www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/ 48 KB
48 KB 52ms
51ms Font
application/x-font-woff 104.111.228.123
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/PayPalSansBig-Light.woff

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.111.228.123 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-228-123.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

c599c554590d1a336ffcb9627f6caaac34b6228f60e15f5f25454bff38facb7e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Origin: http://update-account-credit-service.server-activation.limit.e4cb.com
Referer: http://update-account-credit-service.server-activation.limit.e4cb.com/c04a693c73ccc67f1e01c63107e15015/open/css/xappx.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 11 Sep 2020 15:59:53 GMT
x-pad: avoid browser bug
x-content-type-options: nosniff
last-modified: Wed, 30 Sep 2015 05:09:04 GMT
server: Apache
status: 200
vary: Accept-Encoding
content-type: application/x-font-woff
access-control-allow-origin: *
cache-control: max-age=3600
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 49115
expires: Fri, 11 Sep 2020 16:59:53 GMT

GET
H2 200 PayPalSansSmall-Light.woff
www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/ 46 KB
46 KB 66ms
65ms Font
application/x-font-woff 104.111.228.123
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/PayPalSansSmall-Light.woff

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.111.228.123 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-228-123.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

843e67ad522a908162007f4b7601819a5bbfef00e38ac7aec778766da8b7b2ab

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Origin: http://update-account-credit-service.server-activation.limit.e4cb.com
Referer: http://update-account-credit-service.server-activation.limit.e4cb.com/c04a693c73ccc67f1e01c63107e15015/open/css/xappx.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 11 Sep 2020 15:59:53 GMT
x-pad: avoid browser bug
x-content-type-options: nosniff
last-modified: Wed, 30 Sep 2015 05:09:04 GMT
server: Apache
status: 200
vary: Accept-Encoding
content-type: application/x-font-woff
access-control-allow-origin: *
cache-control: max-age=3600
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 46703
expires: Fri, 11 Sep 2020 16:59:53 GMT

GET
H2 200 PayPalSansSmall-Regular.woff
www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/ 46 KB
47 KB 82ms
81ms Font
application/x-font-woff 104.111.228.123
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/PayPalSansSmall-Regular.woff

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.111.228.123 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-228-123.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

ae79dcc3eb016922caa1d095cfd936446bc65a46bb3364b242dfc556f7e3c6a8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Origin: http://update-account-credit-service.server-activation.limit.e4cb.com
Referer: http://update-account-credit-service.server-activation.limit.e4cb.com/c04a693c73ccc67f1e01c63107e15015/open/css/xappx.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 11 Sep 2020 15:59:53 GMT
x-pad: avoid browser bug
x-content-type-options: nosniff
last-modified: Wed, 30 Sep 2015 05:09:04 GMT
server: Apache
status: 200
vary: Accept-Encoding
content-type: application/x-font-woff
access-control-allow-origin: *
cache-control: max-age=3600
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 47339
expires: Fri, 11 Sep 2020 16:59:53 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| trustedTypes function| $ function| jQuery

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			update-account-credit-service.server-activation.limit.e4cb.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 324513f22d58d01a9b65247779c4d467

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

update-account-credit-service.server-activation.limit.e4cb.com
www.paypalobjects.com
104.111.228.123
131.153.37.2
12bec3e411f30e9f988a001dc06817aef7a8d2513fb2e78c989d75a4946714de
544dfa59462862db7bafc2d2e4b3925ac3eacb11e52834916df02bd1cda19b1d
843e67ad522a908162007f4b7601819a5bbfef00e38ac7aec778766da8b7b2ab
a007f54d6d5e2628eec4360219df69fc77700f34b0602d479e80cb18601ddaa1
ae79dcc3eb016922caa1d095cfd936446bc65a46bb3364b242dfc556f7e3c6a8
bbe3177aa5d225f117aea0e2eeb27f11d853a33d6d162733c5be8b1de8d36dc5
c599c554590d1a336ffcb9627f6caaac34b6228f60e15f5f25454bff38facb7e
d30b6114fb9496ae46b2a8cdf59379c8ffdb957534bd1dd73e626c7c61c7e67d
da775dd10f868447dea4c3522fb3b55bd4a5df650d3f2233a76d31bb711f6c2a

update-account-credit-service.server-activation.limit.e4cb.com Open in urlscan Pro 131.153.37.2 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

10 Requests

50 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

341 kBTransfer

339 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

1 Cookies

Indicators

update-account-credit-service.server-activation.limit.e4cb.com Open in urlscan Pro
131.153.37.2 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

50 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

341 kB
Transfer

339 kB
Size

1
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!