bbad6693.15ab0ot.pages.dev Open in urlscan Pro
2606:4700:310c::ac42:2f03 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/ua/upcoming-policies-full,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium
Effective URL:
https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/ua/upcoming-policies-full,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium
Submission: On October 26 via api (October 26th 2024, 2:07:29 am UTC) from US — Scanned from US

Summary HTTP 65 Redirects Links 13 Behaviour Indicators

Summary

This website contacted 12 IPs in 1 countries across 10 domains to perform 65 HTTP transactions. The main IP is 2606:4700:310c::ac42:2f03, located in United States and belongs to CLOUDFLARENET, US. The main domain is bbad6693.15ab0ot.pages.dev.
TLS certificate: Issued by WE1 on October 12th 2024. Valid for: 3 months.

This is the only time bbad6693.15ab0ot.pages.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: PayPal (Financial) Generic Cloudflare (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 6	2606:4700:310... 2606:4700:310c::ac42:2f03	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2607:f8b0:400... 2607:f8b0:400d:c07::63	15169 (GOOGLE) (GOOGLE)
29	192.229.210.155 192.229.210.155	15133 (EDGECAST) (EDGECAST)
1	2607:f8b0:400... 2607:f8b0:400d:c09::9a	15169 (GOOGLE) (GOOGLE)
2	2a04:4e42:400... 2a04:4e42:400::291	54113 (FASTLY) (FASTLY)
1	2600:9000:a71... 2600:9000:a717:2fb3:95f4:1d0e:8cc4:1c6a	16509 (AMAZON-02) (AMAZON-02)
1 2	35.235.122.5 35.235.122.5	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2	151.101.195.1 151.101.195.1	54113 (FASTLY) (FASTLY)
1	2a03:2880:f10... 2a03:2880:f103:181:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	2607:f8b0:400... 2607:f8b0:400d:c07::8b	15169 (GOOGLE) (GOOGLE)
4 4	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
65	12

6 2606:4700:310c::ac42:2f03 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

bbad6693.15ab0ot.pages.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:400d:c07::63 (Morganton, United States)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

29 192.229.210.155 (United States)

ASN15133 (EDGECAST, US)

www.paypalobjects.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.paypal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:400d:c09::9a (Morganton, United States)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a04:4e42:400::291 (United States)

ASN54113 (FASTLY, US)

c6.paypal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:a717:2fb3:95f4:1d0e:8cc4:1c6a (United States)

ASN16509 (AMAZON-02, US)

api.bigdatacloud.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.235.122.5 (Los Angeles, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 5.122.235.35.bc.googleusercontent.com

b.stats.paypal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
lvs.stats.paypal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.195.1 (San Francisco, United States)

ASN54113 (FASTLY, US)

t.paypal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f103:181:face:b00c:0:25de (Ashburn, United States)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:400d:c07::8b (Morganton, United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2620:1ec:21::14 (United States) 4 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
25	paypalobjects.com www.paypalobjects.com — Cisco Umbrella Rank: 2817	497 KB
10	paypal.com 1 redirects c.paypal.com — Cisco Umbrella Rank: 8333 lvs.stats.paypal.com — Cisco Umbrella Rank: 11470 Failed c6.paypal.com — Cisco Umbrella Rank: 9992 b.stats.paypal.com — Cisco Umbrella Rank: 6677 t.paypal.com — Cisco Umbrella Rank: 3852	25 KB
6	pages.dev 1 redirects bbad6693.15ab0ot.pages.dev	28 KB
5	linkedin.com 4 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 321 www.linkedin.com — Cisco Umbrella Rank: 646 px4.ads.linkedin.com — Cisco Umbrella Rank: 6828	3 KB
4	google.com www.google.com — Cisco Umbrella Rank: 3	23 KB
1	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 34	603 B
1	facebook.com www.facebook.com — Cisco Umbrella Rank: 113	274 B
1	bigdatacloud.net api.bigdatacloud.net — Cisco Umbrella Rank: 33730	201 B
1	doubleclick.net googleads.g.doubleclick.net — Cisco Umbrella Rank: 42	2 KB
0	Failed function sub() { [native code] }. Failed
65	10

	Domain	Requested by
25	www.paypalobjects.com	bbad6693.15ab0ot.pages.dev www.paypalobjects.com
6	bbad6693.15ab0ot.pages.dev	1 redirects bbad6693.15ab0ot.pages.dev
4	c.paypal.com	bbad6693.15ab0ot.pages.dev c.paypal.com
4	www.google.com	bbad6693.15ab0ot.pages.dev
3	px.ads.linkedin.com	3 redirects
2	t.paypal.com
2	c6.paypal.com	bbad6693.15ab0ot.pages.dev
1	px4.ads.linkedin.com
1	www.linkedin.com	1 redirects
1	www.google-analytics.com
1	www.facebook.com
1	b.stats.paypal.com	1 redirects
1	api.bigdatacloud.net	www.paypalobjects.com
1	lvs.stats.paypal.com	bbad6693.15ab0ot.pages.dev
1	googleads.g.doubleclick.net	bbad6693.15ab0ot.pages.dev
0	192.55.233.1 Failed	www.paypalobjects.com
0	https Failed	www.paypalobjects.com
65	17

This site contains links to these domains. Also see Links.

Domain
https

Subject Issuer	Validity	Valid
15ab0ot.pages.dev WE1	`2024-10-12` - `2025-01-10`	3 months	crt.sh
*.google.com WR2	`2024-10-07` - `2024-12-30`	3 months	crt.sh
www.paypal.com DigiCert SHA2 Extended Validation Server CA	`2024-06-13` - `2025-06-12`	a year	crt.sh
*.g.doubleclick.net WR2	`2024-10-07` - `2024-12-30`	3 months	crt.sh
*.bigdatacloud.net Amazon RSA 2048 M03	`2024-04-02` - `2025-05-01`	a year	crt.sh
t.paypal.com DigiCert SHA2 Extended Validation Server CA	`2024-06-21` - `2025-06-20`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2024-08-04` - `2024-11-02`	3 months	crt.sh
*.google-analytics.com WR2	`2024-10-07` - `2024-12-30`	3 months	crt.sh

This page contains 8 frames:

Primary Page: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/ua/upcoming-policies-full,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium
Frame ID: 1A1E85E61EFA7F89581EF680DFB9CD32
Requests: 50 HTTP requests in this frame

Frame: https://www.paypalobjects.com/webcaptcha/grcenterprise_v3_static.html
Frame ID: D3CA4C86B3B8A6D4D65CC506632F4FF4
Requests: 1 HTTP requests in this frame

Frame: https://www.paypalobjects.com/webcaptcha/grcenterprise_v3_static.html
Frame ID: EF61613D05FF54721F97546AE72450E4
Requests: 1 HTTP requests in this frame

Frame: https://c.paypal.com/v1/r/d/i?js_src=https://c.paypal.com/da/r/fb.js
Frame ID: EE4957C21945191EB74910910C331FC8
Requests: 1 HTTP requests in this frame

Frame: https://lvs.stats.paypal.com/v1/counter2.cgi?r=cD1mOWRhZGU2MDE1YWI0OTVmODBiYWY1ZjM1NDUzMTQ4YiZpPTMxLjEzLjE4OS40JnQ9MTY5NTk3ODE1Ny40NzYmYT0yMSZzPVVOSUZJRURfTE9HSU42dqrCAJneY3SWrSmdZkDPIT8EYA
Frame ID: F694BC4A15D2B1CF4A8DF44A791DAE58
Requests: 1 HTTP requests in this frame

Frame: https://c.paypal.com/v1/r/d/i?js_src=https://c.paypal.com/da/r/fb.js
Frame ID: D7085217C1160E1554BA98062DF39254
Requests: 1 HTTP requests in this frame

Frame: https://c.paypal.com/v1/r/d/i?js_src=https://c.paypal.com/da/r/fb.js
Frame ID: 8077B007DE7ABEE3F926F6D12C1E6E36
Requests: 1 HTTP requests in this frame

Frame: https://lvs.stats.paypal.com/v1/counter2.cgi?r=cD1mOWRhZGU2MDE1YWI0OTVmODBiYWY1ZjM1NDUzMTQ4YiZpPTMxLjEzLjE4OS40JnQ9MTY5NTk3ODE1Ny40NzYmYT0yMSZzPVVOSUZJRURfTE9HSU42dqrCAJneY3SWrSmdZkDPIT8EYA
Frame ID: EAEB071416F04E24618986C336607AF9
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Log in to your PayPal account

Page URL History Show full URLs

http://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/ua/upcoming-policies-full,n/a,https:/openphish.com/feed.txt,1... HTTP 307
https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/ua/upcoming-policies-full,n/a,https:/openphish.com/feed.txt,1... Page URL
https://bbad6693.15ab0ot.pages.dev/cdn-cgi/phish-bypass?atok=vrIusCjKKkEr7eJH52o42a2M6X33S6z6h93UiAXHjkU-172990... HTTP 301
https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/ua/upcoming-policies-full,n/a,https:/openphish.com/feed.txt,1... Page URL

Detected technologies

PayPal (Payment Processors) Expand

Overall confidence: 100%
Detected patterns

paypalobjects\.com

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Modernizr (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

([\d.]+)?/modernizr(?:\.([\d.]+))?.*\.js

Page Statistics

65
Requests

71 %
HTTPS

67 %
IPv6

10
Domains

17
Subdomains

12
IPs

1
Countries

575 kB
Transfer

2089 kB
Size

16
Cookies

13 Outgoing links

These are links going to different origins than the main page.

URL: https://https//www.paypal.com/signin
Title: Change

Search URL Search Domain Scan URL

URL: https://https/signin?country.x=US&locale.x=en_US&langTgl=en
Title: English

Search URL Search Domain Scan URL

URL: https://https/signin?country.x=US&locale.x=fr_XC&langTgl=fr
Title: Français

Search URL Search Domain Scan URL

URL: https://https/signin?country.x=US&locale.x=es_XC&langTgl=es
Title: Español

Search URL Search Domain Scan URL

URL: https://https/signin?country.x=US&locale.x=zh_XC&langTgl=zh
Title: 中文

Search URL Search Domain Scan URL

URL: https://https/authflow/password-recovery/?country.x=US&locale.x=en_US&redirectUri=%252Fsignin
Title: Forgot password?

Search URL Search Domain Scan URL

URL: https://https//www.paypal.com/signin
Title: Use password instead

Search URL Search Domain Scan URL

URL: https://https/%7BcoBrand%7D/cgi-bin/helpscr?cmd=_help
Title: We can help

Search URL Search Domain Scan URL

URL: https://https/us/smarthelp/contact-us
Title: Contact Us

Search URL Search Domain Scan URL

URL: https://https/us/webapps/mpp/ua/privacy-full
Title: Privacy

Search URL Search Domain Scan URL

URL: https://https/us/webapps/mpp/ua/legalhub-full
Title: Legal

Search URL Search Domain Scan URL

URL: https://https/us/webapps/mpp/ua/upcoming-policies-full
Title: Policy Updates

Search URL Search Domain Scan URL

URL: https://https/us/webapps/mpp/country-worldwide
Title: Worldwide

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/ua/upcoming-policies-full,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium HTTP 307
https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/ua/upcoming-policies-full,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium Page URL
https://bbad6693.15ab0ot.pages.dev/cdn-cgi/phish-bypass?atok=vrIusCjKKkEr7eJH52o42a2M6X33S6z6h93UiAXHjkU-1729908437-0.0.1.1-%2Fus%2Fwebapps%2Fmpp%2Fua%2Fupcoming-policies-full%2Cn%2Fa%2Chttps%3A%2Fopenphish.com%2Ffeed.txt%2C10-oct-24%2Chigh%2Cmedium HTTP 301
https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/ua/upcoming-policies-full,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/ua/upcoming-policies-full,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium HTTP 307
https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/ua/upcoming-policies-full,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Request Chain 31

https://b.stats.paypal.com/v1/counter.cgi?r=cD1mOWRhZGU2MDE1YWI0OTVmODBiYWY1ZjM1NDUzMTQ4YiZpPTMxLjEzLjE4OS40JnQ9MTY5NTk3ODE1Ny40NzYmYT0yMSZzPVVOSUZJRURfTE9HSU42dqrCAJneY3SWrSmdZkDPIT8EYA HTTP 302
https://lvs.stats.paypal.com/v1/counter2.cgi?r=cD1mOWRhZGU2MDE1YWI0OTVmODBiYWY1ZjM1NDUzMTQ4YiZpPTMxLjEzLjE4OS40JnQ9MTY5NTk3ODE1Ny40NzYmYT0yMSZzPVVOSUZJRURfTE9HSU42dqrCAJneY3SWrSmdZkDPIT8EYA

Request Chain 54

https://b.stats.paypal.com/v1/counter.cgi?r=cD1mOWRhZGU2MDE1YWI0OTVmODBiYWY1ZjM1NDUzMTQ4YiZpPTMxLjEzLjE4OS40JnQ9MTY5NTk3ODE1Ny40NzYmYT0yMSZzPVVOSUZJRURfTE9HSU42dqrCAJneY3SWrSmdZkDPIT8EYA HTTP 302
https://lvs.stats.paypal.com/v1/counter2.cgi?r=cD1mOWRhZGU2MDE1YWI0OTVmODBiYWY1ZjM1NDUzMTQ4YiZpPTMxLjEzLjE4OS40JnQ9MTY5NTk3ODE1Ny40NzYmYT0yMSZzPVVOSUZJRURfTE9HSU42dqrCAJneY3SWrSmdZkDPIT8EYA

Request Chain 62

https://px.ads.linkedin.com/collect/?pid=2786969&fmt=gif HTTP 302
https://px.ads.linkedin.com/collect/?pid=2786969&fmt=gif&cookiesTest=true HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%2F%3Fpid%3D2786969%26fmt%3Dgif%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect/?pid=2786969&fmt=gif&cookiesTest=true&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect/?pid=2786969&fmt=gif&cookiesTest=true&liSync=true&e_ipv6=AQJL7zywAPvZeAAAAZLGlBE3YBi0rTf-sA_nwle4xir-ut76JP-JVJaONy8fp7W9qWrvPMZmpJRan9p01nfKtpeLlKSzxTo

65 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3

403

feed.txt,10-oct-24,high,medium Show response
bbad6693.15ab0ot.pages.dev/us/webapps/mpp/ua/upcoming-policies-full,n/a,https:/openphish.com/
Redirect Chain

http://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/ua/upcoming-policies-full,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium
https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/ua/upcoming-policies-full,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

4 KB
2 KB

75ms
16ms

Document
text/html

2606:4700:310c::ac42:2f03
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/ua/upcoming-policies-full,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2f03 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

defb7a60dfd2b17480941b708b773524f8777d7af4082dbb3028cc536b2f8a8b

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

cf-ray: 8d86e4589b40335a-EWR
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Sat, 26 Oct 2024 02:07:17 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xEhonm%2FhKNs9%2FB27SPIct0YiEIWpvsNs0jNov9S2uw8ix8uxF2mLEj9rVGwCq93%2F%2Fx6AQ5DS72GAJLmlg%2BMNOw7gskl1MnEvlRinkOa%2F7rWpQmv3H%2FZA8tvcGMTtoaJhV0Y1RwuMW66t262pS%2F9WVoiVo6dmJzQbgw%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-frame-options: SAMEORIGIN

Redirect headers

Cross-Origin-Resource-Policy: Cross-Origin
Location: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/ua/upcoming-policies-full,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium
Non-Authoritative-Reason: HSTS

GET
H3 200 cf.errors.css
bbad6693.15ab0ot.pages.dev/cdn-cgi/styles/ 23 KB
5 KB 16ms
15ms Stylesheet
text/css 2606:4700:310c::ac42:2f03
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bbad6693.15ab0ot.pages.dev/cdn-cgi/styles/cf.errors.css

Requested by

Host: bbad6693.15ab0ot.pages.dev
URL: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/ua/upcoming-policies-full,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2f03 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/ua/upcoming-policies-full,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Response headers

vary: Accept-Encoding
cache-control: max-age=7200, public
content-encoding: gzip
etag: W/"67180f5f-5df3"
x-content-type-options: nosniff
cf-ray: 8d86e45a4c6a335a-EWR
expires: Sat, 26 Oct 2024 04:07:18 GMT
date: Sat, 26 Oct 2024 02:07:18 GMT
content-type: text/css
last-modified: Tue, 22 Oct 2024 20:47:27 GMT
server: cloudflare
x-frame-options: DENY

GET
H3 200 icon-exclamation.png
bbad6693.15ab0ot.pages.dev/cdn-cgi/images/ 452 B
634 B 16ms
15ms Image
image/png 2606:4700:310c::ac42:2f03
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bbad6693.15ab0ot.pages.dev/cdn-cgi/images/icon-exclamation.png?1376755637

Requested by

Host: bbad6693.15ab0ot.pages.dev
URL: https://bbad6693.15ab0ot.pages.dev/cdn-cgi/styles/cf.errors.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2f03 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bbad6693.15ab0ot.pages.dev/cdn-cgi/styles/cf.errors.css

Response headers

vary: Accept-Encoding
cache-control: max-age=7200, public
etag: "67180f5f-1c4"
x-content-type-options: nosniff
cf-ray: 8d86e45c5e18335a-EWR
expires: Sat, 26 Oct 2024 04:07:18 GMT
accept-ranges: bytes
content-length: 452
date: Sat, 26 Oct 2024 02:07:18 GMT
content-type: image/png
last-modified: Tue, 22 Oct 2024 20:47:27 GMT
server: cloudflare
x-frame-options: DENY

GET
H3 403 favicon.ico
bbad6693.15ab0ot.pages.dev/ 4 KB
2 KB 21ms
19ms Other
text/html 2606:4700:310c::ac42:2f03
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bbad6693.15ab0ot.pages.dev/favicon.ico

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2f03 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d21c70bbd03f485294c60c115caf030605f24c7181fd0ce4110a06b472595eda

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/ua/upcoming-policies-full,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Response headers

nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: gzip
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uU5Vh4ehJF93jOssObzuyVPBVONSlEoxFWweFMguW76bjaP%2FeJvhlLssXsY6oPJiowwBEQgvgvHP1qpaQwudOhFRDnMeQ%2BX4GcxcBHPxu8uMAZiATAH7uQ5RivW%2BpqYDyS7lxPljqWmCYRjNX9NNlr7OkG0loq3PDA%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8d86e45cee9d335a-EWR
date: Sat, 26 Oct 2024 02:07:18 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: cloudflare
x-frame-options: SAMEORIGIN

GET
H3

200

Primary Request feed.txt,10-oct-24,high,medium Show response
bbad6693.15ab0ot.pages.dev/us/webapps/mpp/ua/upcoming-policies-full,n/a,https:/openphish.com/
Redirect Chain

https://bbad6693.15ab0ot.pages.dev/cdn-cgi/phish-bypass?atok=vrIusCjKKkEr7eJH52o42a2M6X33S6z6h93UiAXHjkU-1729908437-0.0.1.1-%2Fus%2Fwebapps%2Fmpp%2Fua%2Fupcoming-policies-full%2Cn%2Fa%2Chttps%3A%2F...
https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/ua/upcoming-policies-full,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

70 KB
18 KB

59ms
58ms

Document
text/html

2606:4700:310c::ac42:2f03
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/ua/upcoming-policies-full,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2f03 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8102e9e9aacd7429d30cf0a40c351dcbbc8c92d6e9783e4b1c1168504b5a36a3

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/ua/upcoming-policies-full,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
cache-control: public, max-age=0, must-revalidate
cf-ray: 8d86e47f4acb335a-EWR
content-encoding: br
content-type: text/html; charset=utf-8
date: Sat, 26 Oct 2024 02:07:24 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
priority: u=0,i
referrer-policy: strict-origin-when-cross-origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mx4VR4je2CZfOLCFz%2B6wPZ31HxbxXsL%2FcGTueA%2BSPlR2dqCPJH%2BqGt2Wmre2ZmBaY4R6J3rUZZcIvIbNv%2Bmcrh%2FDadaeqW6BPyc%2FcKPrRJRKosqOhat4SDj0utSO1pzSajWw33HY9mgqLG9%2BNAMQeDvFEjfXPu%2Fw9w%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfL4;desc="?proto=QUIC&rtt=9673&sent=29&recv=23&lost=0&retrans=0&sent_bytes=15035&recv_bytes=7401&delivery_rate=816&cwnd=12000&unsent_bytes=0&cid=127324ecf15e92e3&ts=6290&x=1" cfExtPri cfHdrFlush;dur=0
vary: Accept-Encoding
x-content-type-options: nosniff
x-robots-tag: noindex

Redirect headers

cache-control: private, no-cache
cf-ray: 8d86e47f2ab6335a-EWR
content-length: 167
content-type: text/html
date: Sat, 26 Oct 2024 02:07:24 GMT
location: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/ua/upcoming-policies-full,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium
server: cloudflare
x-content-type-options: nosniff
x-frame-options: DENY

GET
H3 200 conversion_async.js Show response
www.google.com/pagead/ 56 KB
20 KB 192ms
33ms Script
text/javascript 2607:f8b0:400d:c07::63
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/pagead/conversion_async.js

Requested by

Host: bbad6693.15ab0ot.pages.dev
URL: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/ua/upcoming-policies-full,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c07::63 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d1167e51674d24090301dfc7f4f739b34787fcec9cd94a94becf2c17625031ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bbad6693.15ab0ot.pages.dev/

Response headers

content-encoding: br
etag: 18263278860643454076
x-content-type-options: nosniff
expires: Sat, 26 Oct 2024 02:07:24 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sat, 26 Oct 2024 02:07:24 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 20710
x-xss-protection: 0
server: cafe

GET
H2 200 analytics.js Show response
www.paypalobjects.com/pa/mi/3p/gtag/ 44 KB
17 KB 46ms
15ms Script
application/javascript 192.229.210.155
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/pa/mi/3p/gtag/analytics.js

Requested by

Host: bbad6693.15ab0ot.pages.dev
URL: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/ua/upcoming-policies-full,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.210.155 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (nyd/D15A) /

Resource Hash

62bb5685d837089cd6aedb6f5fe5375c83ce5facc879632628e1e63e51399580

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bbad6693.15ab0ot.pages.dev/

Response headers

paypal-debug-id: 2697ff8e64c5b
content-encoding: br
etag: "670429ca-aed9"
access-control-allow-methods: GET
x-content-type-options: nosniff
expires: Sat, 26 Oct 2024 03:07:24 GMT
traceparent: 00-00000000000000000002697ff8e64c5b-0999a843952a11e5-01
dc: ccg11-origin-www-1.paypal.com
x-cache: HIT
date: Sat, 26 Oct 2024 02:07:24 GMT
content-type: application/javascript
last-modified: Mon, 07 Oct 2024 18:34:50 GMT
vary: Accept-Encoding
access-control-allow-headers: x-csrf-token
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: s-maxage=31536000, public,max-age=3600
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
accept-ranges: bytes
access-control-allow-origin: *
content-length: 17356
server: ECAcc (nyd/D15A)

GET
H2 200 latmconf.js Show response
www.paypalobjects.com/pa/mi/paypal/ 15 KB
4 KB 47ms
16ms Script
application/javascript 192.229.210.155
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/pa/mi/paypal/latmconf.js

Requested by

Host: bbad6693.15ab0ot.pages.dev
URL: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/ua/upcoming-policies-full,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.210.155 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (nyd/D14C) /

Resource Hash

0311e7cd1ff9b287c7099126ae78265a48fc8adb1a6e060731a503b2e41313f0

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://bbad6693.15ab0ot.pages.dev
Referer: https://bbad6693.15ab0ot.pages.dev/

Response headers

paypal-debug-id: 8a7ef7d5f5158
content-encoding: br
etag: "670429ca-3a4c"
access-control-allow-methods: GET
x-content-type-options: nosniff
expires: Sat, 26 Oct 2024 03:07:24 GMT
traceparent: 00-00000000000000000008a7ef7d5f5158-cceddb232cfcb07f-01
dc: ccg11-origin-www-1.paypal.com
x-cache: HIT
date: Sat, 26 Oct 2024 02:07:24 GMT
content-type: application/javascript
last-modified: Mon, 07 Oct 2024 18:34:50 GMT
vary: Accept-Encoding
access-control-allow-headers: x-csrf-token
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: s-maxage=31536000, public,max-age=3600
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
accept-ranges: bytes
access-control-allow-origin: *
content-length: 4115
server: ECAcc (nyd/D14C)

GET
H2 200 ngrlCaptcha.min.js Show response
www.paypalobjects.com/webcaptcha/ 23 KB
6 KB 18ms
15ms Script
application/javascript 192.229.210.155
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/webcaptcha/ngrlCaptcha.min.js

Requested by

Host: bbad6693.15ab0ot.pages.dev
URL: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/ua/upcoming-policies-full,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.210.155 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (nyd/D10D) /

Resource Hash

d81bfefd8585b694222d3e94e9dee5d7935049c65355f9fd096800301d51545b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bbad6693.15ab0ot.pages.dev/

Response headers

paypal-debug-id: 71280eff5b5ae
content-encoding: br
etag: W/"6697f682-5a55"
x-content-type-options: nosniff
expires: Sat, 26 Oct 2024 03:07:24 GMT
traceparent: 00-000000000000000000071280eff5b5ae-9f9c1f2f8210c085-01
dc: ccg11-origin-www-1.paypal.com
x-cache: HIT
date: Sat, 26 Oct 2024 02:07:24 GMT
content-type: application/javascript
last-modified: Wed, 17 Jul 2024 16:51:14 GMT
vary: Accept-Encoding
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: s-maxage=31536000, public,max-age=3600
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
accept-ranges: bytes
content-length: 6477
server: ECAcc (nyd/D10D)

GET
H2 200 contextualLoginElementalUIv2.css
www.paypalobjects.com/web/res/0e5/418cc87f0ab9fcb01f588e89a18d7/css/ 148 KB
24 KB 43ms
12ms Stylesheet
text/css 192.229.210.155
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/web/res/0e5/418cc87f0ab9fcb01f588e89a18d7/css/contextualLoginElementalUIv2.css

Requested by

Host: bbad6693.15ab0ot.pages.dev
URL: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/ua/upcoming-policies-full,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.210.155 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (nyd/D185) /

Resource Hash

4f3ce6ed02764246b3431d0a8e1aeec9ea10915d801a4b48957ed264d98a28dd

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bbad6693.15ab0ot.pages.dev/

Response headers

paypal-debug-id: 941b0b13104f3
content-encoding: br
etag: W/"650c92ef-250a9"
access-control-allow-methods: GET
x-content-type-options: nosniff
expires: Sun, 26 Oct 2025 02:07:24 GMT
traceparent: 00-0000000000000000000941b0b13104f3-3185a5cd88c1a1ce-01
dc: ccg11-origin-www-1.paypal.com
x-cache: HIT
date: Sat, 26 Oct 2024 02:07:24 GMT
content-type: text/css
last-modified: Thu, 21 Sep 2023 19:01:03 GMT
vary: Accept-Encoding
access-control-allow-headers: x-csrf-token
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: max-age=31536000, s-maxage=31536000
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
access-control-allow-origin: *
content-length: 24142
server: ECAcc (nyd/D185)

GET
H2 200 modernizr-2.6.1.js Show response
www.paypalobjects.com/web/res/0e5/418cc87f0ab9fcb01f588e89a18d7/js/lib/ 4 KB
2 KB 43ms
13ms Script
application/javascript 192.229.210.155
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/web/res/0e5/418cc87f0ab9fcb01f588e89a18d7/js/lib/modernizr-2.6.1.js

Requested by

Host: bbad6693.15ab0ot.pages.dev
URL: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/ua/upcoming-policies-full,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.210.155 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (nyd/D15E) /

Resource Hash

a6c3bff965978df8093c3a29f7071c21d7439a212af41e7b40ce70d94d6bcc44

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bbad6693.15ab0ot.pages.dev/

Response headers

paypal-debug-id: 0026b815a5817
content-encoding: br
etag: W/"650c92f0-edf"
access-control-allow-methods: GET
x-content-type-options: nosniff
expires: Sun, 26 Oct 2025 02:07:24 GMT
traceparent: 00-00000000000000000000026b815a5817-199541f43f47bd9d-01
dc: ccg11-origin-www-1.paypal.com
x-cache: HIT
date: Sat, 26 Oct 2024 02:07:24 GMT
content-type: application/javascript
last-modified: Thu, 21 Sep 2023 19:01:04 GMT
vary: Accept-Encoding
access-control-allow-headers: x-csrf-token
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: max-age=31536000, s-maxage=31536000
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
access-control-allow-origin: *
content-length: 1747
server: ECAcc (nyd/D15E)

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/992191228/ 4 KB
2 KB 126ms
29ms Script
text/javascript 2607:f8b0:400d:c09::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/992191228/?random=1695978158079&cv=9&fst=1695978158079&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=466465926&u_h=900&u_w=1600&u_ah=821&u_aw=1600&u_cd=24&u_his=3&u_tz=390&u_java=false&u_nplug=5&u_nmime=2&sendb=1&ig=0&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.paypal.com%2Fsignin&tiba=Log%20in%20to%20your%20PayPal%20account&hn=www.google.com&async=1&rfmt=3&fmt=4

Requested by

Host: bbad6693.15ab0ot.pages.dev
URL: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/ua/upcoming-policies-full,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c09::9a Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

34135471cc68abab36b4e9ccad8ea5e442905ab3380e091ba108e4c765091c1c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bbad6693.15ab0ot.pages.dev/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 2268
date: Sat, 26 Oct 2024 02:07:24 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H3 200 / Show response
www.google.com/pagead/1p-conversion/992191228/ 5 KB
3 KB 123ms
29ms Script
text/javascript 2607:f8b0:400d:c07::63
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/pagead/1p-conversion/992191228/?random=1695978158083&cv=9&fst=1695978158083&num=1&label=vTDjCL3nvv4CEPzFjtkD&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=466465926%2C512247839&u_h=900&u_w=1600&u_ah=821&u_aw=1600&u_cd=24&u_his=3&u_tz=390&u_java=false&u_nplug=5&u_nmime=2&sendb=1&ig=0&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fwww.paypal.com%2Fsignin&tiba=Log%20in%20to%20your%20PayPal%20account&hn=www.google.com&gcp=1&sscte=1&ct_cookie_present=1&async=1&rfmt=3&fmt=4

Requested by

Host: bbad6693.15ab0ot.pages.dev
URL: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/ua/upcoming-policies-full,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c07::63 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

dec0e4727f606e4438e481e8ad46aaed50ba3aa040daeb77e119df14c5de2f2b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bbad6693.15ab0ot.pages.dev/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: gzip
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 2581
date: Sat, 26 Oct 2024 02:07:24 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 icon-PN-check.png
www.paypalobjects.com/images/shared/ 2 KB
3 KB 24ms
11ms Image
image/png 192.229.210.155
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.paypalobjects.com/images/shared/icon-PN-check.png

Requested by

Host: bbad6693.15ab0ot.pages.dev
URL: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/ua/upcoming-policies-full,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.210.155 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (nyd/D142) /

Resource Hash

4a77d272b8cf508cc4a7e0da5763faa9958e42a5554fdb5d29fc3be51d685653

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bbad6693.15ab0ot.pages.dev/

Response headers

paypal-debug-id: b30183cafa1e5
etag: "60271b47-8bc"
x-content-type-options: nosniff
expires: Sat, 26 Oct 2024 03:07:24 GMT
traceparent: 00-0000000000000000000b30183cafa1e5-59eeae2e4b9ec5a1-01
dc: ccg11-origin-www-1.paypal.com
x-cache: HIT
date: Sat, 26 Oct 2024 02:07:24 GMT
content-type: image/png
last-modified: Sat, 13 Feb 2021 00:20:23 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: s-maxage=31536000, public,max-age=3600
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
accept-ch: DPR, Viewport-Width, Width, ECT, Downlink
accept-ranges: bytes
content-length: 2236
server: ECAcc (nyd/D142)

GET
H2 200 glyph_alert_critical_big-2x.png
www.paypalobjects.com/images/shared/ 6 KB
6 KB 25ms
11ms Image
image/png 192.229.210.155
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.paypalobjects.com/images/shared/glyph_alert_critical_big-2x.png

Requested by

Host: bbad6693.15ab0ot.pages.dev
URL: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/ua/upcoming-policies-full,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.210.155 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (nyd/D1A2) /

Resource Hash

13e4806e5c517e074ab1ea26fe0f2b7b87eaa3988006f35ed0bd4c89502d0d79

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bbad6693.15ab0ot.pages.dev/

Response headers

paypal-debug-id: ee96c6367f612
etag: "54130c54-16c4"
x-content-type-options: nosniff
expires: Sat, 26 Oct 2024 03:07:24 GMT
traceparent: 00-0000000000000000000ee96c6367f612-abf803167a788aa0-01
dc: ccg11-origin-www-1.paypal.com
x-cache: HIT
date: Sat, 26 Oct 2024 02:07:24 GMT
content-type: image/png
last-modified: Fri, 12 Sep 2014 15:08:04 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: s-maxage=31536000, public,max-age=3600
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
accept-ch: DPR, Viewport-Width, Width, ECT, Downlink
accept-ranges: bytes
content-length: 5828
server: ECAcc (nyd/D1A2)

GET
H2 200 fn-sync-telemetry-min.js Show response
www.paypalobjects.com/web/res/0e5/418cc87f0ab9fcb01f588e89a18d7/js/lib/ 5 KB
2 KB 13ms
11ms Script
application/javascript 192.229.210.155
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/web/res/0e5/418cc87f0ab9fcb01f588e89a18d7/js/lib/fn-sync-telemetry-min.js

Requested by

Host: bbad6693.15ab0ot.pages.dev
URL: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/ua/upcoming-policies-full,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.210.155 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (nyd/D121) /

Resource Hash

8b202d5bd55968ce4bfc21c063166eaebe62104275ce7ec362d78b64b2581c95

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bbad6693.15ab0ot.pages.dev/

Response headers

paypal-debug-id: b7b5a1e3f8213
content-encoding: br
etag: W/"650c92f0-159e"
access-control-allow-methods: GET
x-content-type-options: nosniff
expires: Sun, 26 Oct 2025 02:07:24 GMT
traceparent: 00-0000000000000000000b7b5a1e3f8213-608c2e09b53273e8-01
dc: ccg11-origin-www-1.paypal.com
x-cache: HIT
date: Sat, 26 Oct 2024 02:07:24 GMT
content-type: application/javascript
last-modified: Thu, 21 Sep 2023 19:01:04 GMT
vary: Accept-Encoding
access-control-allow-headers: x-csrf-token
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: max-age=31536000, s-maxage=31536000
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
access-control-allow-origin: *
content-length: 2321
server: ECAcc (nyd/D121)

GET
H2 200 signin-split.js Show response
www.paypalobjects.com/web/res/0e5/418cc87f0ab9fcb01f588e89a18d7/js/ 436 KB
91 KB 12ms
11ms Script
application/javascript 192.229.210.155
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/web/res/0e5/418cc87f0ab9fcb01f588e89a18d7/js/signin-split.js

Requested by

Host: bbad6693.15ab0ot.pages.dev
URL: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/ua/upcoming-policies-full,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.210.155 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (nyd/D13B) /

Resource Hash

55ed4f12d94d0e62c76d391eb9c1ed1b4358fae88f0636a3c039b7b6d449115a

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bbad6693.15ab0ot.pages.dev/

Response headers

paypal-debug-id: 90671d58bfa47
content-encoding: br
etag: W/"650c92f0-6cf97"
access-control-allow-methods: GET
x-content-type-options: nosniff
expires: Sun, 26 Oct 2025 02:07:24 GMT
traceparent: 00-000000000000000000090671d58bfa47-2c0718c120798ed0-01
dc: ccg11-origin-www-1.paypal.com
x-cache: HIT
date: Sat, 26 Oct 2024 02:07:24 GMT
content-type: application/javascript
last-modified: Thu, 21 Sep 2023 19:01:04 GMT
vary: Accept-Encoding
access-control-allow-headers: x-csrf-token
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: max-age=31536000, s-maxage=31536000
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
access-control-allow-origin: *
content-length: 92615
server: ECAcc (nyd/D13B)

GET
H2 200 ioc.js Show response
www.paypalobjects.com/web/res/0e5/418cc87f0ab9fcb01f588e89a18d7/js/ 5 KB
2 KB 21ms
15ms Script
application/javascript 192.229.210.155
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/web/res/0e5/418cc87f0ab9fcb01f588e89a18d7/js/ioc.js

Requested by

Host: bbad6693.15ab0ot.pages.dev
URL: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/ua/upcoming-policies-full,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.210.155 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (nyd/D189) /

Resource Hash

07d4a44d248156a0e3d0c604d7359e54f3b021eeec70b7c3a1d127a141f76d97

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bbad6693.15ab0ot.pages.dev/

Response headers

paypal-debug-id: 112d370f0076f
content-encoding: br
etag: W/"650c92f0-1407"
access-control-allow-methods: GET
x-content-type-options: nosniff
expires: Sun, 26 Oct 2025 02:07:24 GMT
traceparent: 00-0000000000000000000112d370f0076f-091aeb62883f78dd-01
dc: ccg11-origin-www-1.paypal.com
x-cache: HIT
date: Sat, 26 Oct 2024 02:07:24 GMT
content-type: application/javascript
last-modified: Thu, 21 Sep 2023 19:01:04 GMT
vary: Accept-Encoding
access-control-allow-headers: x-csrf-token
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: max-age=31536000, s-maxage=31536000
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
access-control-allow-origin: *
content-length: 1984
server: ECAcc (nyd/D189)

GET
H2 200 pa.js Show response
www.paypalobjects.com/pa/js/min/ 69 KB
26 KB 19ms
14ms Script
application/javascript 192.229.210.155
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/pa/js/min/pa.js

Requested by

Host: bbad6693.15ab0ot.pages.dev
URL: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/ua/upcoming-policies-full,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.210.155 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (nyd/D137) /

Resource Hash

2c6bd1749d24699d1800314c498bfff3eaf5ded67fe354f96fd00d274ca9513c

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bbad6693.15ab0ot.pages.dev/

Response headers

paypal-debug-id: 7ded75c26c9d7
content-encoding: br
etag: "670429cc-112e1+br"
access-control-allow-methods: GET
x-content-type-options: nosniff
expires: Sat, 26 Oct 2024 03:07:24 GMT
traceparent: 00-00000000000000000007ded75c26c9d7-22c74b1a15be4ae5-01
dc: ccg11-origin-www-1.paypal.com
x-cache: HIT
date: Sat, 26 Oct 2024 02:07:24 GMT
content-type: application/javascript
last-modified: Mon, 07 Oct 2024 18:34:52 GMT
vary: Accept-Encoding
access-control-allow-headers: x-csrf-token
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: s-maxage=31536000, public,max-age=3600
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
access-control-allow-origin: *
content-length: 26290
server: ECAcc (nyd/D137)

GET
H2 200 grcenterprise_v3_static.js Show response
www.paypalobjects.com/webcaptcha/ 6 KB
2 KB 18ms
15ms Script
application/javascript 192.229.210.155
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/webcaptcha/grcenterprise_v3_static.js

Requested by

Host: bbad6693.15ab0ot.pages.dev
URL: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/ua/upcoming-policies-full,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.210.155 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (nyd/D178) /

Resource Hash

75c159c9974a7207171cf1f4ed302f91f90ae95233fdd64e994fd66ada89ab20

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bbad6693.15ab0ot.pages.dev/

Response headers

paypal-debug-id: b3ccb366af5af
content-encoding: br
etag: W/"65f1e42c-180e"
x-content-type-options: nosniff
expires: Sat, 26 Oct 2024 03:07:24 GMT
traceparent: 00-0000000000000000000b3ccb366af5af-57e51581fae364c4-01
dc: ccg11-origin-www-1.paypal.com
x-cache: HIT
date: Sat, 26 Oct 2024 02:07:24 GMT
content-type: application/javascript
last-modified: Wed, 13 Mar 2024 17:36:44 GMT
vary: Accept-Encoding
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: s-maxage=31536000, public,max-age=3600
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
content-length: 1820
server: ECAcc (nyd/D178)

GET
H2 200 patleaf.js Show response
www.paypalobjects.com/pa/3pjs/tl/6.2.0/ 191 KB
53 KB 16ms
11ms Script
application/javascript 192.229.210.155
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/pa/3pjs/tl/6.2.0/patleaf.js

Requested by

Host: bbad6693.15ab0ot.pages.dev
URL: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/ua/upcoming-policies-full,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.210.155 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (nyd/D13B) /

Resource Hash

586f0eb92dcb65651bb48a4d846c39f6cb02d7f9ce88943a2a45fbac7d863334

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://bbad6693.15ab0ot.pages.dev
Referer: https://bbad6693.15ab0ot.pages.dev/

Response headers

paypal-debug-id: daafa8e4aebce
content-encoding: br
etag: "670429cc-2fbb4+br"
access-control-allow-methods: GET
x-content-type-options: nosniff
expires: Sat, 26 Oct 2024 03:07:24 GMT
traceparent: 00-0000000000000000000daafa8e4aebce-5e08f8d54c2b1e59-01
dc: ccg11-origin-www-1.paypal.com
x-cache: HIT
date: Sat, 26 Oct 2024 02:07:24 GMT
content-type: application/javascript
last-modified: Mon, 07 Oct 2024 18:34:52 GMT
vary: Accept-Encoding
access-control-allow-headers: x-csrf-token
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: s-maxage=31536000, public,max-age=3600
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
access-control-allow-origin: *
content-length: 54591
server: ECAcc (nyd/D13B)

GET
H2 200 gtag.js Show response
www.paypalobjects.com/pa/mi/3p/gtag/ 79 KB
29 KB 17ms
12ms Script
application/javascript 192.229.210.155
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/pa/mi/3p/gtag/gtag.js

Requested by

Host: bbad6693.15ab0ot.pages.dev
URL: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/ua/upcoming-policies-full,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.210.155 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (nyd/D19A) /

Resource Hash

f982a9dad50b916735a08b8e6f40efa7f97163106b18da079b144764c86a44a1

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://bbad6693.15ab0ot.pages.dev
Referer: https://bbad6693.15ab0ot.pages.dev/

Response headers

paypal-debug-id: 474a254d97419
content-encoding: br
etag: W/"670429ca-13bba"
access-control-allow-methods: GET
x-content-type-options: nosniff
expires: Sat, 26 Oct 2024 03:07:24 GMT
traceparent: 00-0000000000000000000474a254d97419-5d99c31cc7038247-01
dc: ccg11-origin-www-1.paypal.com
x-cache: HIT
date: Sat, 26 Oct 2024 02:07:24 GMT
content-type: application/javascript
last-modified: Mon, 07 Oct 2024 18:34:50 GMT
vary: Accept-Encoding
access-control-allow-headers: x-csrf-token
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: s-maxage=31536000, public,max-age=3600
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
accept-ranges: bytes
access-control-allow-origin: *
content-length: 29845
server: ECAcc (nyd/D19A)

GET
H2 200 patlcfg.js Show response
www.paypalobjects.com/pa/3pjs/tl/6.2.0/ 6 KB
3 KB 15ms
10ms Script
application/javascript 192.229.210.155
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/pa/3pjs/tl/6.2.0/patlcfg.js

Requested by

Host: bbad6693.15ab0ot.pages.dev
URL: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/ua/upcoming-policies-full,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.210.155 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (nyd/D12C) /

Resource Hash

aa3020d20fe753464cc473d2afb758a43f77a2404671c663d511f686d4f4c0e2

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://bbad6693.15ab0ot.pages.dev
Referer: https://bbad6693.15ab0ot.pages.dev/

Response headers

paypal-debug-id: 303254d1cc111
content-encoding: br
etag: "670429cc-190a"
access-control-allow-methods: GET
x-content-type-options: nosniff
expires: Sat, 26 Oct 2024 03:07:24 GMT
traceparent: 00-0000000000000000000303254d1cc111-d03c07bbc868a4b4-01
dc: ccg11-origin-www-1.paypal.com
x-cache: HIT
date: Sat, 26 Oct 2024 02:07:24 GMT
content-type: application/javascript
last-modified: Mon, 07 Oct 2024 18:34:52 GMT
vary: Accept-Encoding
access-control-allow-headers: x-csrf-token
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: s-maxage=31536000, public,max-age=3600
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
accept-ranges: bytes
access-control-allow-origin: *
content-length: 2510
server: ECAcc (nyd/D12C)

GET
H2 200 fb.js Show response
c.paypal.com/da/r/ 69 KB
22 KB 116ms
111ms Script
application/javascript 192.229.210.155
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://c.paypal.com/da/r/fb.js

Requested by

Host: bbad6693.15ab0ot.pages.dev
URL: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/ua/upcoming-policies-full,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.210.155 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (dac/9C7D) /

Resource Hash

62a4e3fe56286026c23ae5891f4222bd9a455f393af54d88ba443eecba0e6600

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bbad6693.15ab0ot.pages.dev/

Response headers

access-control-max-age: 86400
paypal-debug-id: b1413ba619bfb
content-encoding: br
etag: W/"66bc0232-112e9"
access-control-allow-methods: GET
x-content-type-options: nosniff
expires: Sun, 27 Oct 2024 02:07:24 GMT
traceparent: 00-0000000000000000000b1413ba619bfb-6f12489692fc58f1-01
server-timing: content-encoding;desc="", x-cdn;desc="edgecast"
dc: ccg11-origin-www-1.paypal.com
date: Sat, 26 Oct 2024 02:07:24 GMT
content-type: application/javascript
last-modified: Wed, 14 Aug 2024 01:02:42 GMT
vary: Accept-Encoding, Accept-Encoding
access-control-allow-headers: x-csrf-token
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: max-age=86400
timing-allow-origin: *
access-control-allow-credentials: false
access-control-allow-origin: *
server: ECAcc (dac/9C7D)

GET
H2 200 paypal-mark-color.svg
www.paypalobjects.com/paypal-ui/logos/svg/ 709 B
584 B 19ms
18ms Image
image/svg+xml 192.229.210.155
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.paypalobjects.com/paypal-ui/logos/svg/paypal-mark-color.svg

Requested by

Host: www.paypalobjects.com
URL: https://www.paypalobjects.com/web/res/0e5/418cc87f0ab9fcb01f588e89a18d7/css/contextualLoginElementalUIv2.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.210.155 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (nyd/D14E) /

Resource Hash

8766a4211434d2c318fbfa412ea9633b385ecf1cab6119f8894019d91ed7e027

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.paypalobjects.com/web/res/0e5/418cc87f0ab9fcb01f588e89a18d7/css/contextualLoginElementalUIv2.css

Response headers

paypal-debug-id: b75dbc1a5cc15
content-encoding: br
etag: "66d9ab63-2c5+gzip+br"
x-content-type-options: nosniff
expires: Sat, 26 Oct 2024 03:07:24 GMT
traceparent: 00-0000000000000000000b75dbc1a5cc15-1b23e5d8e53dfd26-01
dc: ccg11-origin-www-1.paypal.com
x-cache: HIT
date: Sat, 26 Oct 2024 02:07:24 GMT
content-type: image/svg+xml
last-modified: Thu, 05 Sep 2024 13:00:19 GMT
vary: Accept-Encoding
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: s-maxage=31536000, public,max-age=3600
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
access-control-allow-origin: *
content-length: 422
server: ECAcc (nyd/D14E)

GET
H2 200 PayPalSansBig-Regular.woff2
www.paypalobjects.com/paypal-ui/fonts/ 25 KB
25 KB 16ms
10ms Font
application/font-woff2 192.229.210.155
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/paypal-ui/fonts/PayPalSansBig-Regular.woff2

Requested by

Host: www.paypalobjects.com
URL: https://www.paypalobjects.com/web/res/0e5/418cc87f0ab9fcb01f588e89a18d7/css/contextualLoginElementalUIv2.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.210.155 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (nyd/D193) /

Resource Hash

1f70ff447ed799a34f4c3ae37ef1f49ed4af71123ba2c2aefe354565354284be

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://bbad6693.15ab0ot.pages.dev
Referer: https://www.paypalobjects.com/web/res/0e5/418cc87f0ab9fcb01f588e89a18d7/css/contextualLoginElementalUIv2.css

Response headers

paypal-debug-id: 6f225e1b3eca7
etag: "60271cda-6318"
access-control-allow-methods: GET
x-content-type-options: nosniff
expires: Sat, 26 Oct 2024 03:07:24 GMT
traceparent: 00-00000000000000000006f225e1b3eca7-65a10b2e8586bdff-01
dc: ccg11-origin-www-1.paypal.com
x-cache: HIT
date: Sat, 26 Oct 2024 02:07:24 GMT
content-type: application/font-woff2
last-modified: Sat, 13 Feb 2021 00:27:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: s-maxage=31536000, public,max-age=31536000
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
accept-ranges: bytes
access-control-allow-origin: *
content-length: 25368
server: ECAcc (nyd/D193)

GET
H2 200 sprite_countries_flag4.png
www.paypalobjects.com/webstatic/mktg/icons/ 108 KB
108 KB 14ms
13ms Image
image/png 192.229.210.155
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.paypalobjects.com/webstatic/mktg/icons/sprite_countries_flag4.png

Requested by

Host: bbad6693.15ab0ot.pages.dev
URL: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/ua/upcoming-policies-full,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.210.155 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (nyd/D142) /

Resource Hash

21f89c7c27f0eab13388645aea1eedb4a342c06333a14d74c1a10dfca04d6455

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bbad6693.15ab0ot.pages.dev/

Response headers

paypal-debug-id: 8d3b3b77a25ed
etag: "60271d86-1ae61"
x-content-type-options: nosniff
expires: Sat, 26 Oct 2024 03:07:24 GMT
traceparent: 00-00000000000000000008d3b3b77a25ed-d7f784da7958ecc2-01
dc: ccg11-origin-www-1.paypal.com
x-cache: HIT
date: Sat, 26 Oct 2024 02:07:24 GMT
content-type: image/png
last-modified: Sat, 13 Feb 2021 00:29:58 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: s-maxage=31536000, public,max-age=3600
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
accept-ch: DPR, Viewport-Width, Width, ECT, Downlink
accept-ranges: bytes
content-length: 110177
server: ECAcc (nyd/D142)

GET
H2 200 PayPalSansBig-Medium.woff2
www.paypalobjects.com/paypal-ui/fonts/ 18 KB
18 KB 17ms
12ms Font
application/font-woff2 192.229.210.155
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/paypal-ui/fonts/PayPalSansBig-Medium.woff2

Requested by

Host: www.paypalobjects.com
URL: https://www.paypalobjects.com/web/res/0e5/418cc87f0ab9fcb01f588e89a18d7/css/contextualLoginElementalUIv2.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.210.155 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (nyd/D14B) /

Resource Hash

2ae6779c6c3579643ab6deb5cfb822e843bf637d006a4ec25d9857ec7fb6d8c1

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://bbad6693.15ab0ot.pages.dev
Referer: https://www.paypalobjects.com/web/res/0e5/418cc87f0ab9fcb01f588e89a18d7/css/contextualLoginElementalUIv2.css

Response headers

paypal-debug-id: 08b8aaa5a9b01
etag: "60271cda-484c"
access-control-allow-methods: GET
x-content-type-options: nosniff
expires: Sat, 26 Oct 2024 03:07:24 GMT
traceparent: 00-000000000000000000008b8aaa5a9b01-25292c51e557567b-01
dc: ccg11-origin-www-1.paypal.com
x-cache: HIT
date: Sat, 26 Oct 2024 02:07:24 GMT
content-type: application/font-woff2
last-modified: Sat, 13 Feb 2021 00:27:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: s-maxage=31536000, public,max-age=31536000
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
accept-ranges: bytes
access-control-allow-origin: *
content-length: 18508
server: ECAcc (nyd/D14B)

GET
H2 200 mktgtagmanager.js Show response
www.paypalobjects.com/martech/tm/paypal/ 16 KB
7 KB 12ms
12ms Script
application/javascript 192.229.210.155
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/martech/tm/paypal/mktgtagmanager.js

Requested by

Host: www.paypalobjects.com
URL: https://www.paypalobjects.com/pa/js/min/pa.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.210.155 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (nyd/D188) /

Resource Hash

efc3ad603dca3c78e67493adb079676731fd72c4204dbf7264d22e897a271267

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://bbad6693.15ab0ot.pages.dev
Referer: https://bbad6693.15ab0ot.pages.dev/

Response headers

paypal-debug-id: af5e1cdd9c7f4
content-encoding: br
etag: "67042d91-3eb4+gzip+br"
access-control-allow-methods: GET
x-content-type-options: nosniff
expires: Sat, 26 Oct 2024 03:07:24 GMT
traceparent: 00-0000000000000000000af5e1cdd9c7f4-9a81930e99282a63-01
dc: ccg11-origin-www-1.paypal.com
x-cache: HIT
date: Sat, 26 Oct 2024 02:07:24 GMT
content-type: application/javascript
last-modified: Mon, 07 Oct 2024 18:50:57 GMT
vary: Accept-Encoding
access-control-allow-headers: x-csrf-token
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: s-maxage=31536000, public,max-age=3600
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
access-control-allow-origin: *
content-length: 6604
server: ECAcc (nyd/D188)

GET
H2 200 grcenterprise_v3_static.html
www.paypalobjects.com/webcaptcha/ Frame D3CA 0
0 32ms
10ms Document
text/html 192.229.210.155
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/webcaptcha/grcenterprise_v3_static.html

Requested by

Host: bbad6693.15ab0ot.pages.dev
URL: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/ua/upcoming-policies-full,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.210.155 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (nyd/D18D) /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://bbad6693.15ab0ot.pages.dev/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

cache-control: s-maxage=31536000, public,max-age=3600
content-encoding: br
content-length: 2084
content-type: text/html
date: Sat, 26 Oct 2024 02:07:24 GMT
dc: ccg11-origin-www-1.paypal.com
etag: "6633898b-19bd+gzip+br"
expires: Sat, 26 Oct 2024 03:07:24 GMT
last-modified: Thu, 02 May 2024 12:39:39 GMT
paypal-debug-id: 3e337e25f1733
server: ECAcc (nyd/D18D)
strict-transport-security: max-age=63072000; includeSubDomains; preload
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
traceparent: 00-00000000000000000003e337e25f1733-5972509d51136c7e-01
vary: Accept-Encoding
x-cache: HIT
x-content-type-options: nosniff

GET
H2 200 grcenterprise_v3_static.html
www.paypalobjects.com/webcaptcha/ Frame EF61 0
0 23ms
23ms Document
text/html 192.229.210.155
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/webcaptcha/grcenterprise_v3_static.html

Requested by

Host: www.paypalobjects.com
URL: https://www.paypalobjects.com/webcaptcha/grcenterprise_v3_static.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.210.155 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (nyd/D18D) /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://bbad6693.15ab0ot.pages.dev/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

cache-control: s-maxage=31536000, public,max-age=3600
content-encoding: br
content-length: 2084
content-type: text/html
date: Sat, 26 Oct 2024 02:07:24 GMT
dc: ccg11-origin-www-1.paypal.com
etag: "6633898b-19bd+gzip+br"
expires: Sat, 26 Oct 2024 03:07:24 GMT
last-modified: Thu, 02 May 2024 12:39:39 GMT
paypal-debug-id: 3e337e25f1733
server: ECAcc (nyd/D18D)
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
traceparent: 00-00000000000000000003e337e25f1733-5972509d51136c7e-01
vary: Accept-Encoding
x-cache: HIT
x-content-type-options: nosniff

GET
H2 200 i
c.paypal.com/v1/r/d/ Frame EE49 0
0 105ms
105ms Document
text/html 192.229.210.155
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://c.paypal.com/v1/r/d/i?js_src=https://c.paypal.com/da/r/fb.js

Requested by

Host: c.paypal.com
URL: https://c.paypal.com/da/r/fb.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.210.155 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (dcd/7D1A) /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://bbad6693.15ab0ot.pages.dev/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

accept-ch: sec-ch-ua, sec-ch-ua-mobile, sec-ch-ua-full-version, sec-ch-ua-full-version-list, sec-ch-ua-platform, sec-ch-ua-platform-version, sec-ch-ua-arch, sec-ch-ua-wow64, sec-ch-ua-bitness, sec-ch-ua-model, sec-ch-ua-full
access-control-expose-headers: Server-Timing
cache-control: max-age=0, no-cache, no-store, must-revalidate
content-encoding: gzip
content-length: 141
content-security-policy-report-only: default-src 'self' https://*.paypal.com https://*.paypalobjects.com; script-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.paypalinc.com https://www.facebook.com 'unsafe-eval' 'unsafe-inline' blob:; connect-src 'self' https://*.paypal.com; style-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; font-src 'self' https://*.paypal.com https://*.paypalobjects.com data:; img-src 'self' https: data:; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; object-src 'self' https://*.paypal.com https://*.paypalobjects.com; report-uri https://www.paypal.com/csplog/api/log/csp
content-type: text/html;charset=UTF-8
correlation-id: a80e7bc5266d3
date: Sat, 26 Oct 2024 02:07:23 GMT
origin-trial: A0A/uBW0ogQIica1KkPCeSOoHfvTATXdyRg8F/Ka8gjK4pCprEDwF3d3wTxNzSPn1ASb5ncpd46h7RQiSqGYpA8AAACMeyJvcmlnaW4iOiJodHRwczovL2MucGF5cGFsLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY5NTUxMzU5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=
paypal-debug-id: a80e7bc5266d3
server: ECAcc (dcd/7D1A)
server-timing: traceparent;desc="00-0000000000000000000a80e7bc5266d3-09cc59d65bc185c6-01" content-encoding;desc="", x-cdn;desc="edgecast"
strict-transport-security: max-age=63072000; includeSubDomains; preload
timing-allow-origin: *
traceparent: 00-0000000000000000000a80e7bc5266d3-2c45710deb56f13f-01
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET

counter2.cgi
lvs.stats.paypal.com/v1/ Frame F694
Redirect Chain

https://b.stats.paypal.com/v1/counter.cgi?r=cD1mOWRhZGU2MDE1YWI0OTVmODBiYWY1ZjM1NDUzMTQ4YiZpPTMxLjEzLjE4OS40JnQ9MTY5NTk3ODE1Ny40NzYmYT0yMSZzPVVOSUZJRURfTE9HSU42dqrCAJneY3SWrSmdZkDPIT8EYA
https://lvs.stats.paypal.com/v1/counter2.cgi?r=cD1mOWRhZGU2MDE1YWI0OTVmODBiYWY1ZjM1NDUzMTQ4YiZpPTMxLjEzLjE4OS40JnQ9MTY5NTk3ODE1Ny40NzYmYT0yMSZzPVVOSUZJRURfTE9HSU42dqrCAJneY3SWrSmdZkDPIT8EYA

0
0

GET
H2 200 p3
c6.paypal.com/v1/r/d/b/ 0
501 B 237ms
117ms Image
text/plain 2a04:4e42:400::291
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c6.paypal.com/v1/r/d/b/p3?f=f9dade6015ab495f80baf5f35453148b&s=UNIFIED_LOGIN_INPUT_PASSWORD

Requested by

Host: bbad6693.15ab0ot.pages.dev
URL: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/ua/upcoming-policies-full,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:400::291 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bbad6693.15ab0ot.pages.dev/

Response headers

paypal-debug-id: f2a532dba3934
access-control-expose-headers: Server-Timing
correlation-id: f2a532dba3934
traceparent: 00-0000000000000000000f2a532dba3934-4bd159d8971f5b5f-01
server-timing: "traceparent;desc="00-0000000000000000000f2a532dba3934-7297d13718992401-01"";content-encoding;desc="",x-cdn;desc="fastly"
x-cache: MISS, MISS
date: Sat, 26 Oct 2024 02:07:24 GMT
x-served-by: cache-iad-kcgs7200129-IAD, cache-lga21980-LGA
x-cache-hits: 0, 0
vary: Accept-Encoding
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: max-age=0, no-cache, no-store, must-revalidate
timing-allow-origin: *
x-timer: S1729908444.461474,VS0,VE107
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
content-length: 0

GET
H3 200 /
www.google.com/pagead/1p-conversion/992191228/ 42 B
64 B 31ms
30ms Image
image/gif 2607:f8b0:400d:c07::63
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-conversion/992191228/?random=480957979&cv=9&fst=1695978158083&num=1&label=vTDjCL3nvv4CEPzFjtkD&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=466465926%2C512247839&u_h=900&u_w=1600&u_ah=821&u_aw=1600&u_cd=24&u_his=3&u_tz=390&u_java=false&u_nplug=5&u_nmime=2&sendb=1&ig=0&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fwww.paypal.com%2Fsignin&tiba=Log%20in%20to%20your%20PayPal%20account&hn=www.google.com&gcp=2&sscte=1&ct_cookie_present=1&async=1&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECSidldmVudC1zb3VyY2UsIHRyaWdnZXI9bmF2aWdhdGlvbi1zb3VyY2VaAwoBAWIECgICAw&pscrd=IhMIyLbCkvuqiQMVoi2ICR0W5Dj4MgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOiNodHRwczovL2JiYWQ2NjkzLjE1YWIwb3QucGFnZXMuZGV2Lw

Requested by

Host: bbad6693.15ab0ot.pages.dev
URL: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/ua/upcoming-policies-full,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c07::63 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bbad6693.15ab0ot.pages.dev/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Sat, 26 Oct 2024 02:07:24 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 /
www.google.com/pagead/1p-user-list/992191228/ 42 B
64 B 30ms
29ms Image
image/gif 2607:f8b0:400d:c07::63
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/992191228/?random=1695978158079&cv=9&fst=1695978000000&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=466465926&u_h=900&u_w=1600&u_ah=821&u_aw=1600&u_cd=24&u_his=3&u_tz=390&u_java=false&u_nplug=5&u_nmime=2&sendb=1&ig=0&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.paypal.com%2Fsignin&tiba=Log%20in%20to%20your%20PayPal%20account&hn=www.google.com&async=1&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwDpaXnfdGWvvg_OfSWm7SiL_gcJ40D-t-1IDA&random=3677409554&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: bbad6693.15ab0ot.pages.dev
URL: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/ua/upcoming-policies-full,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c07::63 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bbad6693.15ab0ot.pages.dev/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Sat, 26 Oct 2024 02:07:24 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 i
c.paypal.com/v1/r/d/ Frame D708 0
0 193ms
89ms Document
text/html 192.229.210.155
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://c.paypal.com/v1/r/d/i?js_src=https://c.paypal.com/da/r/fb.js

Requested by

Host: bbad6693.15ab0ot.pages.dev
URL: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/ua/upcoming-policies-full,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.210.155 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (dcd/7D44) /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://bbad6693.15ab0ot.pages.dev/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

accept-ch: sec-ch-ua, sec-ch-ua-mobile, sec-ch-ua-full-version, sec-ch-ua-full-version-list, sec-ch-ua-platform, sec-ch-ua-platform-version, sec-ch-ua-arch, sec-ch-ua-wow64, sec-ch-ua-bitness, sec-ch-ua-model, sec-ch-ua-full
access-control-expose-headers: Server-Timing
cache-control: max-age=0, no-cache, no-store, must-revalidate
content-encoding: gzip
content-length: 141
content-security-policy-report-only: default-src 'self' https://*.paypal.com https://*.paypalobjects.com; script-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.paypalinc.com https://www.facebook.com 'unsafe-eval' 'unsafe-inline' blob:; connect-src 'self' https://*.paypal.com; style-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; font-src 'self' https://*.paypal.com https://*.paypalobjects.com data:; img-src 'self' https: data:; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; object-src 'self' https://*.paypal.com https://*.paypalobjects.com; report-uri https://www.paypal.com/csplog/api/log/csp
content-type: text/html;charset=UTF-8
correlation-id: 1ff1f7aea6ffa
date: Sat, 26 Oct 2024 02:07:24 GMT
origin-trial: A0A/uBW0ogQIica1KkPCeSOoHfvTATXdyRg8F/Ka8gjK4pCprEDwF3d3wTxNzSPn1ASb5ncpd46h7RQiSqGYpA8AAACMeyJvcmlnaW4iOiJodHRwczovL2MucGF5cGFsLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY5NTUxMzU5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=
paypal-debug-id: 1ff1f7aea6ffa
server: ECAcc (dcd/7D44)
server-timing: traceparent;desc="00-00000000000000000001ff1f7aea6ffa-5be33cd9e0746e53-01" content-encoding;desc="", x-cdn;desc="edgecast"
strict-transport-security: max-age=63072000; includeSubDomains; preload
timing-allow-origin: *
traceparent: 00-00000000000000000001ff1f7aea6ffa-838a3097b8fb63a2-01
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 200 mktconf.js Show response
www.paypalobjects.com/martech/tm/paypal/ 563 KB
36 KB 10ms
9ms Script
application/javascript 192.229.210.155
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/martech/tm/paypal/mktconf.js

Requested by

Host: www.paypalobjects.com
URL: https://www.paypalobjects.com/martech/tm/paypal/mktgtagmanager.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.210.155 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (nyd/D11E) /

Resource Hash

49e8d721e0cc0242208a27afeca5ef43d413f9c76964e177951e2ea473dadc35

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://bbad6693.15ab0ot.pages.dev
Referer: https://bbad6693.15ab0ot.pages.dev/

Response headers

paypal-debug-id: 4c613bf35d4d8
content-encoding: br
etag: "6711371f-8cab9+gzip+br"
access-control-allow-methods: GET
x-content-type-options: nosniff
expires: Sat, 26 Oct 2024 03:07:24 GMT
traceparent: 00-00000000000000000004c613bf35d4d8-f92c0ce4abb37542-01
dc: ccg11-origin-www-1.paypal.com
x-cache: HIT
date: Sat, 26 Oct 2024 02:07:24 GMT
content-type: application/javascript
last-modified: Thu, 17 Oct 2024 16:11:11 GMT
vary: Accept-Encoding
access-control-allow-headers: x-csrf-token
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: s-maxage=31536000, public,max-age=3600
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
access-control-allow-origin: *
content-length: 36205
server: ECAcc (nyd/D11E)

GET
H2 200 client-ip Show response
api.bigdatacloud.net/data/ 77 B
201 B 128ms
35ms Fetch
application/json 2600:9000:a717:2fb3:95f4:1d0e:8cc4:1c6a
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.bigdatacloud.net/data/client-ip
Requested by: Host: www.paypalobjects.com
URL: https://www.paypalobjects.com/webcaptcha/ngrlCaptcha.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:a717:2fb3:95f4:1d0e:8cc4:1c6a , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: dc0ffa99c457d14245f4e30a850b66ecd34a4d5609431d6d0086e34445b12ce2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bbad6693.15ab0ot.pages.dev/

Response headers

access-control-allow-origin: *
content-length: 77
date: Sat, 26 Oct 2024 02:07:24 GMT
content-type: application/json; charset=utf-8
x-response-time-ms: 21.15

GET
H2 200 gtag.js Show response
www.paypalobjects.com/martech/tm/paypal/3pjs/gtag/ 79 KB
31 KB 16ms
15ms Script
application/javascript 192.229.210.155
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/martech/tm/paypal/3pjs/gtag/gtag.js

Requested by

Host: www.paypalobjects.com
URL: https://www.paypalobjects.com/martech/tm/paypal/mktgtagmanager.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.210.155 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (nyd/D124) /

Resource Hash

0c62a9cf7b3703895bc10abed5bd122b584a9b599071216816bf997a1333b423

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://bbad6693.15ab0ot.pages.dev
Referer: https://bbad6693.15ab0ot.pages.dev/

Response headers

paypal-debug-id: dff110bc79e8d
content-encoding: br
etag: W/"66f1ab0e-13bc8"
access-control-allow-methods: GET
x-content-type-options: nosniff
expires: Sat, 26 Oct 2024 03:07:24 GMT
traceparent: 00-0000000000000000000dff110bc79e8d-6d8e31dd29104bbb-01
dc: ccg11-origin-www-1.paypal.com
x-cache: HIT
date: Sat, 26 Oct 2024 02:07:24 GMT
content-type: application/javascript
last-modified: Mon, 23 Sep 2024 17:53:18 GMT
vary: Accept-Encoding
access-control-allow-headers: x-csrf-token
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: s-maxage=31536000, public,max-age=3600
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
access-control-allow-origin: *
content-length: 31866
server: ECAcc (nyd/D124)

OPTIONS client-log
https/signin/ Frame 0
0

OPTIONS challenge.js
https/auth/createchallenge/b85e6d8ea45ea267/ Frame 0
0

OPTIONS resourceaccesstoken
192.55.233.1/ Frame 0
0

OPTIONS cookie-banner
https/signin/ Frame 0
0

OPTIONS load-resource
https/signin/ Frame 0
0

OPTIONS client-log
https/signin/ Frame 0
0

POST client-log
https/signin/ 0
0

GET challenge.js
https/auth/createchallenge/b85e6d8ea45ea267/ 0
0

POST resourceaccesstoken
192.55.233.1/ 0
0

GET cookie-banner
https/signin/ 0
0

POST load-resource
https/signin/ 0
0

POST client-log
https/signin/ 0
0

GET
H2 200 i
c.paypal.com/v1/r/d/ Frame 8077 0
0 116ms
116ms Document
text/html 192.229.210.155
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://c.paypal.com/v1/r/d/i?js_src=https://c.paypal.com/da/r/fb.js

Requested by

Host: c.paypal.com
URL: https://c.paypal.com/da/r/fb.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.210.155 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (dcd/7D28) /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://bbad6693.15ab0ot.pages.dev/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

accept-ch: sec-ch-ua, sec-ch-ua-mobile, sec-ch-ua-full-version, sec-ch-ua-full-version-list, sec-ch-ua-platform, sec-ch-ua-platform-version, sec-ch-ua-arch, sec-ch-ua-wow64, sec-ch-ua-bitness, sec-ch-ua-model, sec-ch-ua-full
access-control-expose-headers: Server-Timing
cache-control: max-age=0, no-cache, no-store, must-revalidate
content-encoding: gzip
content-length: 141
content-security-policy-report-only: default-src 'self' https://*.paypal.com https://*.paypalobjects.com; script-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.paypalinc.com https://www.facebook.com 'unsafe-eval' 'unsafe-inline' blob:; connect-src 'self' https://*.paypal.com; style-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; font-src 'self' https://*.paypal.com https://*.paypalobjects.com data:; img-src 'self' https: data:; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; object-src 'self' https://*.paypal.com https://*.paypalobjects.com; report-uri https://www.paypal.com/csplog/api/log/csp
content-type: text/html;charset=UTF-8
correlation-id: ca1ea58d14e4c
date: Sat, 26 Oct 2024 02:07:24 GMT
origin-trial: A0A/uBW0ogQIica1KkPCeSOoHfvTATXdyRg8F/Ka8gjK4pCprEDwF3d3wTxNzSPn1ASb5ncpd46h7RQiSqGYpA8AAACMeyJvcmlnaW4iOiJodHRwczovL2MucGF5cGFsLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY5NTUxMzU5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=
paypal-debug-id: ca1ea58d14e4c
server: ECAcc (dcd/7D28)
server-timing: traceparent;desc="00-0000000000000000000ca1ea58d14e4c-0127e1cbad8ca60b-01" content-encoding;desc="", x-cdn;desc="edgecast"
strict-transport-security: max-age=63072000; includeSubDomains; preload
timing-allow-origin: *
traceparent: 00-0000000000000000000ca1ea58d14e4c-972213e7c0e80ee8-01
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H/1.1

200
OK

counter2.cgi
lvs.stats.paypal.com/v1/ Frame EAEB
Redirect Chain

https://b.stats.paypal.com/v1/counter.cgi?r=cD1mOWRhZGU2MDE1YWI0OTVmODBiYWY1ZjM1NDUzMTQ4YiZpPTMxLjEzLjE4OS40JnQ9MTY5NTk3ODE1Ny40NzYmYT0yMSZzPVVOSUZJRURfTE9HSU42dqrCAJneY3SWrSmdZkDPIT8EYA
https://lvs.stats.paypal.com/v1/counter2.cgi?r=cD1mOWRhZGU2MDE1YWI0OTVmODBiYWY1ZjM1NDUzMTQ4YiZpPTMxLjEzLjE4OS40JnQ9MTY5NTk3ODE1Ny40NzYmYT0yMSZzPVVOSUZJRURfTE9HSU42dqrCAJneY3SWrSmdZkDPIT8EYA

42 B
299 B

80ms
79ms

Image
image/jpeg

35.235.122.5
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://lvs.stats.paypal.com/v1/counter2.cgi?r=cD1mOWRhZGU2MDE1YWI0OTVmODBiYWY1ZjM1NDUzMTQ4YiZpPTMxLjEzLjE4OS40JnQ9MTY5NTk3ODE1Ny40NzYmYT0yMSZzPVVOSUZJRURfTE9HSU42dqrCAJneY3SWrSmdZkDPIT8EYA
Protocol: HTTP/1.1
Server: 35.235.122.5 Los Angeles, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 5.122.235.35.bc.googleusercontent.com
Software: PayPal-B.Stats/1.0 /
Resource Hash: 47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bbad6693.15ab0ot.pages.dev/

Response headers

Content-Length: 42
Date: Sat, 26 Oct 2024 02:07:25 GMT
Content-Type: image/jpeg
Connection: close
Server: PayPal-B.Stats/1.0

Redirect headers

Location: https://lvs.stats.paypal.com/v1/counter2.cgi?r=cD1mOWRhZGU2MDE1YWI0OTVmODBiYWY1ZjM1NDUzMTQ4YiZpPTMxLjEzLjE4OS40JnQ9MTY5NTk3ODE1Ny40NzYmYT0yMSZzPVVOSUZJRURfTE9HSU42dqrCAJneY3SWrSmdZkDPIT8EYA
Content-Length: 0
Date: Sat, 26 Oct 2024 02:07:24 GMT
Content-Type: application/octet-stream
Connection: close
Server: PayPal-B.Stats/1.0

GET
H2 200 p3
c6.paypal.com/v1/r/d/b/ 0
242 B 103ms
103ms Image
text/plain 2a04:4e42:400::291
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c6.paypal.com/v1/r/d/b/p3?f=f9dade6015ab495f80baf5f35453148b&s=UNIFIED_LOGIN_INPUT_PASSWORD

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:400::291 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bbad6693.15ab0ot.pages.dev/

Response headers

paypal-debug-id: e7fdcf907afc3
access-control-expose-headers: Server-Timing
correlation-id: e7fdcf907afc3
traceparent: 00-0000000000000000000e7fdcf907afc3-7afab16b023f4394-01
server-timing: "traceparent;desc="00-0000000000000000000e7fdcf907afc3-d033775108ba6849-01"";content-encoding;desc="",x-cdn;desc="fastly"
x-cache: MISS, MISS
date: Sat, 26 Oct 2024 02:07:24 GMT
x-served-by: cache-iad-kiad7000131-IAD, cache-lga21980-LGA
x-cache-hits: 0, 0
vary: Accept-Encoding
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: max-age=0, no-cache, no-store, must-revalidate
timing-allow-origin: *
x-timer: S1729908445.737184,VS0,VE94
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
content-length: 0

GET
H2 200 pp_favicon_x.ico
www.paypalobjects.com/en_US/i/icon/ 5 KB
2 KB 12ms
12ms Other
image/x-icon 192.229.210.155
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/en_US/i/icon/pp_favicon_x.ico

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.210.155 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (nyd/D15E) /

Resource Hash

1690c4e20869c3763b7fc111e2f94035b0a7ee830311dd680ac91421daad3667

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bbad6693.15ab0ot.pages.dev/

Response headers

paypal-debug-id: 17748390dc4cf
content-encoding: br
etag: W/"5d5637bd-1536"
x-content-type-options: nosniff
expires: Sat, 26 Oct 2024 03:07:24 GMT
traceparent: 00-000000000000000000017748390dc4cf-d10b3e60678d6ae0-01
dc: ccg11-origin-www-1.paypal.com
x-cache: HIT
date: Sat, 26 Oct 2024 02:07:24 GMT
content-type: image/x-icon
last-modified: Fri, 16 Aug 2019 04:57:33 GMT
vary: Accept-Encoding
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: s-maxage=31536000, public,max-age=3600
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
content-length: 1471
server: ECAcc (nyd/D15E)

POST sms
https/signin/challenge/ 0
0

OPTIONS sms
https/signin/challenge/ Frame 0
0

GET
H2 200 ts
t.paypal.com/ 42 B
885 B 151ms
97ms Image
image/gif 151.101.195.1
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.paypal.com/ts?v=1.9.2&t=1729908445188&g=600&pgrp=main%3Aunifiedlogin%3A%3A%3Alogin&page=main%3Aunifiedlogin%3A%3A%3Alogin%3A%3A%3A&pgst=1695978157415&calc=0273691a8b51a&nsid=9r7B_qrDjlOD_M7OTOQw-ZLUlcIiJ-X0&rsta=en_US&pgtf=Nodejs&env=live&s=ci&ccpg=US&csci=1f94898facae4981aa2f255ac50754df&comp=unifiedloginnodeweb&tsrce=authchallengenodeweb&cu=1&gacook=2050824883.1729908444&ef_policy=ccpa&c_prefs=T%3D1%2CP%3D1%2CF%3D1%2Ctype%3Dexplicit_banner&transition_name=ss_prepare_pwd&userRedirected=true&xe=101735%2C101216%2C104200%2C100644%2C106273%2C106057%2C108141%2C101820%2C101817%2C108076&xt=105856%2C103864%2C127485%2C101702%2C130870%2C127561%2C138360%2C106324%2C110524%2C138090&ctx_login_ot_content=0&obex=signin&landing_page=login&browser_client_type=Browser&state_name=begin_pwd&ctx_login_ctxid_fetch=ctxid-not-exist&ctx_login_content_fetch=success&ctx_login_lang_footer=shown&ctx_login_signup_btn=shown%7Cdefault&ctx_login_intent=signin&ctx_login_flow=Signin&ctx_login_state_transition=login_loaded&post_login_redirect=default&ret_url=%2F&e=im&imsrc=setup&view=%7B%22t10%22%3A1%2C%22t11%22%3A747%2C%22tcp%22%3A196%2C%22et%22%3A%224g%22%2C%22nt%22%3A%22navigate%22%2C%22bt%22%3A56%7D&pt=Log%20in%20to%20your%20PayPal%20account&ru=https%3A%2F%2Fbbad6693.15ab0ot.pages.dev%2Fus%2Fwebapps%2Fmpp%2Fua%2Fupcoming-policies-full%2Cn%2Fa%2Chttps%3A%2Fopenphish.com%2Ffeed.txt%2C10-oct-24%2Chigh%2Cmedium&cd=24&sw=1600&sh=1200&dw=1600&dh=1200&bw=1600&bh=1200&ce=1&t1=1&t1c=0&t1d=0&t1s=0&t2=58&t3=13&t4d=0&t4=0&t4e=9&tt=695&rdc=1&protocol=h3&res=%7B%7D&t12=338&3p_vid=5ab58ccf3125931&3p_fpti=31bfe28173c08ba9

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.195.1 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/ua/upcoming-policies-full,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Response headers

access-control-expose-headers: Server-Timing
paypal-debug-id: fce2ff8b493cc
correlation-id: fce2ff8b493cc
expires: Sat, 26 Oct 2024 02:07:25 GMT
traceparent: 00-0000000000000000000fce2ff8b493cc-e39ddb429b1c0869-01
x-cache: MISS, MISS
p3p: CP="CAO IND OUR SAM UNI STA COR COM"
server-timing: "traceparent;desc="00-0000000000000000000fce2ff8b493cc-ad2855c075b57ce2-01"";content-encoding;desc="",x-cdn;desc="fastly"
date: Sat, 26 Oct 2024 02:07:25 GMT
content-type: image/gif
x-served-by: cache-iad-kiad7000022-IAD, cache-lga21958-LGA
x-cache-hits: 0, 0
vary: Accept-Encoding
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: max-age=0, no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
x-timer: S1729908445.247896,VS0,VE88
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes

GET
H2 200 tr
www.facebook.com/ 0
274 B 45ms
13ms Image
text/plain 2a03:2880:f103:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr?id=1674696026155243&noscript=1&cd[MerchantID]=NA&cd[MerchantTransaction]=NA&cd[P2PTransaction]=NA&ev=ViewContent

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f103:181:face:b00c:0:25de Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/ua/upcoming-policies-full,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=12, rtx=0, c=10, mss=1328, tbw=2886, tp=-1, tpl=-1, uplat=0, ullat=0
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
date: Sat, 26 Oct 2024 02:07:25 GMT
content-type: text/plain
server: proxygen-bolt

GET
H2 200 collect
www.google-analytics.com/r/ 35 B
603 B 74ms
22ms Image
image/gif 2607:f8b0:400d:c07::8b
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/r/collect?v=1&_v=j79&aip=1&a=346039186&t=pageview&_s=1&dl=https%3A%2F%2Fbbad6693.15ab0ot.pages.dev%2Fus%2Fwebapps%2Fmpp%2Fua%2Fupcoming-policies-full%2Cn%2Fa%2Chttps%3A%2Fopenphish.com%2Ffeed.txt%2C10-oct-24%2Chigh%2Cmedium&ul=en-us&de=UTF-8&dt=Log%20in%20to%20your%20PayPal%20account&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=KGBACUABF~&jid=1554588875&gjid=1250947751&cid=2050824883.1729908444&tid=UA-53389718-12&_gid=668960211.1729908444&_r=1&cd1=2050824883.1729908444&cd2=&cd3=0&cd4=https%3A%2F%2Fbbad6693.15ab0ot.pages.dev%2Fus%2Fwebapps%2Fmpp%2Fua%2Fupcoming-policies-full%2Cn%2Fa%2Chttps%3A%2Fopenphish.com%2Ffeed.txt%2C10-oct-24%2Chigh%2Cmedium&cd5=us&cd6=en_US&cd7=&cd10=unifiedloginnodeweb&cd19=101735%2C101216%2C104200%2C100644%2C106273%2C106057%2C108141%2C101820%2C101817%2C108076&cd20=105856%2C103864%2C127485%2C101702%2C130870%2C127561%2C138360%2C106324%2C110524%2C138090&cd22=main%3Aunifiedlogin%3A%3A%3Alogin&cd26=0&gtm=2oi4f0&z=377468251

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c07::8b Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bbad6693.15ab0ot.pages.dev/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:169:0"}],}
x-content-type-options: nosniff
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:169:0
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 35
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 26 Oct 2024 02:07:25 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: image/gif
server: Golfe2

GET
H2

200

/
px4.ads.linkedin.com/collect/
Redirect Chain

https://px.ads.linkedin.com/collect/?pid=2786969&fmt=gif
https://px.ads.linkedin.com/collect/?pid=2786969&fmt=gif&cookiesTest=true
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%2F%3Fpid%3D2786969%26fmt%3Dgif%26cookiesTest%3Dtrue%26liSync%3Dtrue
https://px.ads.linkedin.com/collect/?pid=2786969&fmt=gif&cookiesTest=true&liSync=true
https://px4.ads.linkedin.com/collect/?pid=2786969&fmt=gif&cookiesTest=true&liSync=true&e_ipv6=AQJL7zywAPvZeAAAAZLGlBE3YBi0rTf-sA_nwle4xir-ut76JP-JVJaONy8fp7W9qWrvPMZmpJRan9p01nfKtpeLlKSzxTo

43 B
572 B

133ms
73ms

Image
image/gif

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect/?pid=2786969&fmt=gif&cookiesTest=true&liSync=true&e_ipv6=AQJL7zywAPvZeAAAAZLGlBE3YBi0rTf-sA_nwle4xir-ut76JP-JVJaONy8fp7W9qWrvPMZmpJRan9p01nfKtpeLlKSzxTo
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/ua/upcoming-policies-full,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Response headers

linkedin-action: 1
x-li-pop: afd-prod-ltx1-x
content-encoding: gzip
x-msedge-ref: Ref A: AF80A30D788341A5A257808085F4DFFF Ref B: EWR30EDGE1011 Ref C: 2024-10-26T02:07:25Z
x-li-fabric: prod-ltx1
x-li-uuid: AAYlV7JlMLloqHubW0F87w==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 65
date: Sat, 26 Oct 2024 02:07:25 GMT
content-type: image/gif
vary: Accept-Encoding

Redirect headers

linkedin-action: 1
x-li-pop: afd-prod-ltx1-x
location: https://px4.ads.linkedin.com/collect/?pid=2786969&fmt=gif&cookiesTest=true&liSync=true&e_ipv6=AQJL7zywAPvZeAAAAZLGlBE3YBi0rTf-sA_nwle4xir-ut76JP-JVJaONy8fp7W9qWrvPMZmpJRan9p01nfKtpeLlKSzxTo
x-msedge-ref: Ref A: 313F225AC74B4FBB81406FCD8EF728E3 Ref B: EWR30EDGE0218 Ref C: 2024-10-26T02:07:25Z
x-li-fabric: prod-ltx1
x-li-uuid: AAYlV7JjIWnbtAmE52I4Bg==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Sat, 26 Oct 2024 02:07:25 GMT

GET
H2 200 ts
t.paypal.com/ 42 B
584 B 100ms
100ms Image
image/gif 151.101.195.1
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.paypal.com/ts?v=1.9.2&t=1729908446190&g=600&pgrp=main%3Aunifiedlogin%3A%3A%3Alogin&page=main%3Aunifiedlogin%3A%3A%3Alogin%3A%3A%3A&pgst=1695978157415&calc=0273691a8b51a&nsid=9r7B_qrDjlOD_M7OTOQw-ZLUlcIiJ-X0&rsta=en_US&pgtf=Nodejs&env=live&s=ci&ccpg=US&csci=1f94898facae4981aa2f255ac50754df&comp=unifiedloginnodeweb&tsrce=authchallengenodeweb&cu=1&gacook=1592299682.1695977940&ef_policy=ccpa&c_prefs=T%3D1%2CP%3D1%2CF%3D1%2Ctype%3Dexplicit_banner&transition_name=ss_prepare_pwd&userRedirected=true&xe=101735%2C101216%2C104200%2C100644%2C106273%2C106057%2C108141%2C101820%2C101817%2C108076&xt=105856%2C103864%2C127485%2C101702%2C130870%2C127561%2C138360%2C106324%2C110524%2C138090&ctx_login_ot_content=0&obex=signin&landing_page=login&browser_client_type=Browser&state_name=begin_pwd&ctx_login_ctxid_fetch=ctxid-not-exist&ctx_login_content_fetch=success&ctx_login_lang_footer=shown&ctx_login_signup_btn=shown%7Cdefault&ctx_login_intent=signin&ctx_login_flow=Signin&ctx_login_state_transition=login_loaded&post_login_redirect=default&ret_url=%2F&event_name=c_paypal_cpl&t1=102&t1c=0&t1d=0&t1s=0&t2=116&t3=1&tt=219&protocol=h2&cdn=edgecast&tmpl=%2F%2Fc.paypal.&view=%7B%22t10%22%3A102%2C%22t11%22%3A219%2C%22nt%22%3A%22res%22%7D&e=pf&3p_vid=5ab58ccf3125931&3p_fpti=31bfe28173c08ba9

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.195.1 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/ua/upcoming-policies-full,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Response headers

access-control-expose-headers: Server-Timing
paypal-debug-id: 758e71be8e309
correlation-id: 758e71be8e309
expires: Sat, 26 Oct 2024 02:07:26 GMT
traceparent: 00-0000000000000000000758e71be8e309-654b86ed18233102-01
x-cache: MISS, MISS
p3p: CP="CAO IND OUR SAM UNI STA COR COM"
server-timing: "traceparent;desc="00-0000000000000000000758e71be8e309-2e03440619e77b08-01"";content-encoding;desc="",x-cdn;desc="fastly"
date: Sat, 26 Oct 2024 02:07:26 GMT
content-type: image/gif
x-served-by: cache-iad-kjyo7100034-IAD, cache-lga21958-LGA
x-cache-hits: 0, 0
vary: Accept-Encoding
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: max-age=0, no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
x-timer: S1729908446.195722,VS0,VE89
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: lvs.stats.paypal.com
URL: https://lvs.stats.paypal.com/v1/counter2.cgi?r=cD1mOWRhZGU2MDE1YWI0OTVmODBiYWY1ZjM1NDUzMTQ4YiZpPTMxLjEzLjE4OS40JnQ9MTY5NTk3ODE1Ny40NzYmYT0yMSZzPVVOSUZJRURfTE9HSU42dqrCAJneY3SWrSmdZkDPIT8EYA

Domain: https
URL: https://https/signin/client-log

Domain: https
URL: https://https/signin/client-log

Domain: https
URL: https://https/auth/createchallenge/b85e6d8ea45ea267/challenge.js

Domain: 192.55.233.1
URL: https://192.55.233.1/resourceaccesstoken

Domain: https
URL: https://https/signin/cookie-banner?

Domain: https
URL: https://https/signin/load-resource

Domain: https
URL: https://https/signin/client-log

Domain: https
URL: https://https/signin/client-log

Domain: https
URL: https://https/signin/client-log

Domain: https
URL: https://https/auth/createchallenge/b85e6d8ea45ea267/challenge.js

Domain: 192.55.233.1
URL: https://192.55.233.1/resourceaccesstoken

Domain: https
URL: https://https/signin/cookie-banner?

Domain: https
URL: https://https/signin/load-resource

Domain: https
URL: https://https/signin/client-log

Domain: https
URL: https://https/signin/challenge/sms

Domain: https
URL: https://https/signin/challenge/sms

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial) Generic Cloudflare (Online)

47 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

16 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.bbad6693.15ab0ot.pages.dev/	1970-01-21 00:33:14	Name: __cf_mw_byp Value: vrIusCjKKkEr7eJH52o42a2M6X33S6z6h93UiAXHjkU-1729908437-0.0.1.1-/us/webapps/mpp/ua/upcoming-policies-full,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium
.doubleclick.net/	1970-01-21 00:31:49	Name: test_cookie Value: CheckForPermission
.15ab0ot.pages.dev/	1969-12-31 23:59:59	Name: TLTSID Value: 94014683766215764835444870053452
.15ab0ot.pages.dev/	1970-01-21 02:41:24	Name: _gcl_au Value: 1.1.681796123.1729908444
.15ab0ot.pages.dev/	1970-01-21 10:07:48	Name: _ga Value: GA1.3.2050824883.1729908444
.15ab0ot.pages.dev/	1970-01-21 00:33:14	Name: _gid Value: GA1.3.668960211.1729908444
.paypal.com/	1970-01-21 00:31:50	Name: l7_az Value: dcg16.slc
.15ab0ot.pages.dev/	1970-01-21 00:31:48	Name: _gat_gtag_UA_53389718_12 Value: 1
.linkedin.com/	1970-01-21 02:41:24	Name: li_sugr Value: d8d82dd8-c317-43e4-9ecf-bb2bf2cdfbc6
.linkedin.com/	1970-01-21 09:17:24	Name: bcookie Value: "v=2&758335e1-fa17-4568-82c3-e33523d58d71"
.linkedin.com/	1970-01-21 00:33:14	Name: lidc Value: "b=TGST07:s=T:r=T:a=T:p=T:g=2962:u=1:x=1:i=1729908445:t=1729994845:v=2:sig=AQHrTNcn_cRZ0zhFeDPWhO_KvpLww8gV"
.paypal.com/	1970-01-21 10:07:48	Name: ts_c Value: vr%3D31bfe28173c08ba9%26vt%3D5ab58ccf3125931
.linkedin.com/	1970-01-21 01:15:00	Name: UserMatchHistory Value: AQIhsyCrmZdwUwAAAZLGlBCbuxPi9Kr-pF9U7Kh-kfql0AFfmdk54MsnITpBy1F-7Z9q6FLbvkbGOQ
.linkedin.com/	1970-01-21 01:15:00	Name: AnalyticsSyncHistory Value: AQKj8kGrMmRDpQAAAZLGlBCb5G2dgcpXxucduPX2-Rj7z86OsWRXZrUY6zbTetggkvWEwRK3JNPaeeVefUjC1A
.www.linkedin.com/	1970-01-21 09:17:24	Name: bscookie Value: "v=1&2024102602072520910bec-c845-4235-86bf-885b90943559AQGjpm6oMHZEuHbQlZ_YTZlX06kE0WyJ"
.paypal.com/	1970-01-21 10:07:48	Name: ts Value: vreXpYrS%3D1824516446%26vteXpYrS%3D1729910246%26vr%3D31bfe28173c08ba9%26vt%3D5ab58ccf3125931

11 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/ua/upcoming-policies-full,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://bbad6693.15ab0ot.pages.dev/favicon.ico Message: Failed to load resource: the server responded with a status of 403 ()
recommendation	verbose	URL: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/ua/upcoming-policies-full,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o
network	error	URL: https://https/signin/client-log Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: https://https/auth/createchallenge/b85e6d8ea45ea267/challenge.js Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: https://https/signin/cookie-banner? Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: https://https/signin/client-log Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: https://https/signin/load-resource Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: https://https/signin/client-log Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: https://https/signin/challenge/sms Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
javascript	error	URL: https://www.paypalobjects.com/webcaptcha/ngrlCaptcha.min.js Message: Fetch API cannot load https://https/platform/tealeaftarget. Request mode is "same-origin" but the URL's origin is not same as the request origin https://bbad6693.15ab0ot.pages.dev.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

192.55.233.1
api.bigdatacloud.net
b.stats.paypal.com
bbad6693.15ab0ot.pages.dev
c.paypal.com
c6.paypal.com
googleads.g.doubleclick.net
https
lvs.stats.paypal.com
px.ads.linkedin.com
px4.ads.linkedin.com
t.paypal.com
www.facebook.com
www.google-analytics.com
www.google.com
www.linkedin.com
www.paypalobjects.com
192.55.233.1
https
lvs.stats.paypal.com
13.107.42.14
151.101.195.1
192.229.210.155
2600:9000:a717:2fb3:95f4:1d0e:8cc4:1c6a
2606:4700:310c::ac42:2f03
2607:f8b0:400d:c07::63
2607:f8b0:400d:c07::8b
2607:f8b0:400d:c09::9a
2620:1ec:21::14
2a03:2880:f103:181:face:b00c:0:25de
2a04:4e42:400::291
35.235.122.5
0311e7cd1ff9b287c7099126ae78265a48fc8adb1a6e060731a503b2e41313f0
07d4a44d248156a0e3d0c604d7359e54f3b021eeec70b7c3a1d127a141f76d97
0c62a9cf7b3703895bc10abed5bd122b584a9b599071216816bf997a1333b423
13e4806e5c517e074ab1ea26fe0f2b7b87eaa3988006f35ed0bd4c89502d0d79
1690c4e20869c3763b7fc111e2f94035b0a7ee830311dd680ac91421daad3667
1f70ff447ed799a34f4c3ae37ef1f49ed4af71123ba2c2aefe354565354284be
21f89c7c27f0eab13388645aea1eedb4a342c06333a14d74c1a10dfca04d6455
2ae6779c6c3579643ab6deb5cfb822e843bf637d006a4ec25d9857ec7fb6d8c1
2c6bd1749d24699d1800314c498bfff3eaf5ded67fe354f96fd00d274ca9513c
34135471cc68abab36b4e9ccad8ea5e442905ab3380e091ba108e4c765091c1c
47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292
49e8d721e0cc0242208a27afeca5ef43d413f9c76964e177951e2ea473dadc35
4a77d272b8cf508cc4a7e0da5763faa9958e42a5554fdb5d29fc3be51d685653
4f3ce6ed02764246b3431d0a8e1aeec9ea10915d801a4b48957ed264d98a28dd
55ed4f12d94d0e62c76d391eb9c1ed1b4358fae88f0636a3c039b7b6d449115a
586f0eb92dcb65651bb48a4d846c39f6cb02d7f9ce88943a2a45fbac7d863334
62a4e3fe56286026c23ae5891f4222bd9a455f393af54d88ba443eecba0e6600
62bb5685d837089cd6aedb6f5fe5375c83ce5facc879632628e1e63e51399580
6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93
75c159c9974a7207171cf1f4ed302f91f90ae95233fdd64e994fd66ada89ab20
8102e9e9aacd7429d30cf0a40c351dcbbc8c92d6e9783e4b1c1168504b5a36a3
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091
8766a4211434d2c318fbfa412ea9633b385ecf1cab6119f8894019d91ed7e027
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
8b202d5bd55968ce4bfc21c063166eaebe62104275ce7ec362d78b64b2581c95
a6c3bff965978df8093c3a29f7071c21d7439a212af41e7b40ce70d94d6bcc44
aa3020d20fe753464cc473d2afb758a43f77a2404671c663d511f686d4f4c0e2
d1167e51674d24090301dfc7f4f739b34787fcec9cd94a94becf2c17625031ba
d21c70bbd03f485294c60c115caf030605f24c7181fd0ce4110a06b472595eda
d81bfefd8585b694222d3e94e9dee5d7935049c65355f9fd096800301d51545b
dc0ffa99c457d14245f4e30a850b66ecd34a4d5609431d6d0086e34445b12ce2
dec0e4727f606e4438e481e8ad46aaed50ba3aa040daeb77e119df14c5de2f2b
defb7a60dfd2b17480941b708b773524f8777d7af4082dbb3028cc536b2f8a8b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efc3ad603dca3c78e67493adb079676731fd72c4204dbf7264d22e897a271267
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016
f982a9dad50b916735a08b8e6f40efa7f97163106b18da079b144764c86a44a1

bbad6693.15ab0ot.pages.dev Open in urlscan Pro 2606:4700:310c::ac42:2f03 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

65 Requests

71 %HTTPS

67 %IPv6

10 Domains

17 Subdomains

12 IPs

1 Countries

575 kBTransfer

2089 kBSize

16 Cookies

13 Outgoing links

Page URL History

Redirected requests

65 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

bbad6693.15ab0ot.pages.dev Open in urlscan Pro
2606:4700:310c::ac42:2f03 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

65
Requests

71 %
HTTPS

67 %
IPv6

10
Domains

17
Subdomains

12
IPs

1
Countries

575 kB
Transfer

2089 kB
Size

16
Cookies

65 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!