ripe6.net Open in urlscan Pro
2606:4700:3035::681c:296  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Cookie set / Show response ripe6.net/paypal-update/-fr/	23 KB 7 KB	60ms 26ms	Document text/html	2606:4700:3035::681c:296 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://ripe6.net/paypal-update/-fr/ Protocol HTTP/1.1 Server 2606:4700:3035::681c:296 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 61b8f0e2d21b908df27f4bdeb12d5faa4c3fe9d1daeda40ae9ea1cf32e3d6f4d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Host ripe6.net Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Thu, 07 May 2020 13:24:58 GMT Content-Type text/html; charset=UTF-8 Transfer-Encoding chunked Connection keep-alive Set-Cookie __cfduid=d31353de297bcdb5709616b66d5eacbaa1588857898; expires=Sat, 06-Jun-20 13:24:58 GMT; path=/; domain=.ripe6.net; HttpOnly; SameSite=Lax Vary Accept-Encoding X-Content-Type-Options nosniff X-XSS-Protection 1; mode=block X-Frame-Options SAMEORIGIN Strict-Transport-Security max-age=31536000; includeSubDomains; preload CF-Cache-Status DYNAMIC Server cloudflare CF-RAY 58fb43a77d2305c8-FRA Content-Encoding gzip cf-request-id 0290e89caf000005c83f357200000001
GET H/1.1	200 OK	contextualLogin.css ripe6.net/paypal-update/-fr/Log%20in%20to%20your%20PayPal%20account_files/	98 KB 17 KB	13ms 12ms	Stylesheet text/css	2606:4700:3035::681c:296 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://ripe6.net/paypal-update/-fr/Log%20in%20to%20your%20PayPal%20account_files/contextualLogin.css Requested by Host: ripe6.net URL: http://ripe6.net/paypal-update/-fr/ Protocol HTTP/1.1 Server 2606:4700:3035::681c:296 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c1a148a87b8a7dcf84e0759c4be59ef8626979bdc9cc3a3e9a10e00d7aa4eec0 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer http://ripe6.net/paypal-update/-fr/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Thu, 07 May 2020 13:24:58 GMT Content-Encoding gzip X-Content-Type-Options nosniff CF-Cache-Status HIT Age 42293 Transfer-Encoding chunked Connection keep-alive X-XSS-Protection 1; mode=block Last-Modified Wed, 06 May 2020 23:46:55 GMT Server cloudflare X-Frame-Options SAMEORIGIN ETag W/"5eb34c6f-18639" Vary Accept-Encoding Strict-Transport-Security max-age=31536000; includeSubDomains; preload Content-Type text/css Cache-Control max-age=31536000 cf-request-id 0290e89cd1000005c83f35f200000001 CF-RAY 58fb43a7be2705c8-FRA Expires Fri, 07 May 2021 01:40:05 GMT
GET H/1.1	200 OK	modernizr-2.6.1.js.download Show response ripe6.net/paypal-update/-fr/Log%20in%20to%20your%20PayPal%20account_files/	4 KB 4 KB	26ms 21ms	Script application/octet-stream	2606:4700:3035::681c:296 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://ripe6.net/paypal-update/-fr/Log%20in%20to%20your%20PayPal%20account_files/modernizr-2.6.1.js.download Requested by Host: ripe6.net URL: http://ripe6.net/paypal-update/-fr/ Protocol HTTP/1.1 Server 2606:4700:3035::681c:296 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a6c3bff965978df8093c3a29f7071c21d7439a212af41e7b40ce70d94d6bcc44 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer http://ripe6.net/paypal-update/-fr/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Thu, 07 May 2020 13:24:58 GMT X-Content-Type-Options nosniff CF-Cache-Status DYNAMIC Last-Modified Thu, 07 May 2020 02:30:43 GMT Server cloudflare X-Frame-Options SAMEORIGIN ETag "5eb372d3-edf" Strict-Transport-Security max-age=31536000; includeSubDomains; preload Content-Type application/octet-stream X-XSS-Protection 1; mode=block Connection keep-alive Accept-Ranges bytes CF-RAY 58fb43a7bc420eb3-FRA Content-Length 3807 cf-request-id 0290e89cd700000eb3cd0e2200000001
GET H2	200	paypal-logo-129x32.svg www.paypalobjects.com/images/shared/	5 KB 2 KB	151ms 49ms	Image image/svg+xml	151.101.114.133 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.paypalobjects.com/images/shared/paypal-logo-129x32.svg Requested by Host: ripe6.net URL: http://ripe6.net/paypal-update/-fr/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.114.133 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software Apache / Resource Hash b3cc50b9e94bbecaaeb1079b64b8ca50616d1732824964c1cc2c5422627a0ec5 Security Headers Name Value Strict-Transport-Security max-age=31557600 X-Content-Type-Options nosniff Request headers Referer http://ripe6.net/paypal-update/-fr/Log%20in%20to%20your%20PayPal%20account_files/contextualLogin.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 07 May 2020 13:24:58 GMT content-encoding gzip x-content-type-options nosniff age 4125080 x-cache HIT, HIT status 200 surrorage-key /images/shared/paypal-logo-129x32.svg /images/shared/paypal-logo-129x32.svg /images/shared/paypal-logo-129x32.svg /images/shared/paypal-logo-129x32.svg /images/shared/paypal-logo-129x32.svg /images/shared/paypal-logo-129x32.svg /images/shared/paypal-logo-129x32.svg /images/shared /images vary Accept-Encoding content-length 1929 via 1.1 varnish, 1.1 varnish x-served-by cache-lax8645-LAX, cache-hhn4053-HHN last-modified Fri, 24 Oct 2014 22:52:57 GMT server Apache x-timer S1588857898.351400,VS0,VE0 strict-transport-security max-age=31557600 content-type image/svg+xml access-control-allow-origin * cache-control max-age=3600 accept-ranges bytes x-cache-hits 173263, 787187
GET H2	200	fingerprint-paypal.png www.paypalobjects.com/images/shared/	5 KB 5 KB	137ms 50ms	Image image/png	151.101.114.133 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.paypalobjects.com/images/shared/fingerprint-paypal.png Requested by Host: ripe6.net URL: http://ripe6.net/paypal-update/-fr/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.114.133 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software Apache / Resource Hash 8356ff3eb802d52db40a1714aee50ae9ae36aa6e3d789aae7126a53c620156dd Security Headers Name Value Strict-Transport-Security max-age=31557600 X-Content-Type-Options nosniff Request headers Referer http://ripe6.net/paypal-update/-fr/Log%20in%20to%20your%20PayPal%20account_files/contextualLogin.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 07 May 2020 13:24:58 GMT via 1.1 varnish, 1.1 varnish x-content-type-options nosniff age 4125067 x-cache HIT, HIT status 200 surrorage-key /images/shared/fingerprint-paypal.png /images/shared/fingerprint-paypal.png /images/shared/fingerprint-paypal.png /images/shared/fingerprint-paypal.png /images/shared/fingerprint-paypal.png /images/shared/fingerprint-paypal.png /images/shared/fingerprint-paypal.png /images/shared /images content-length 4650 x-served-by cache-sjc10048-SJC, cache-hhn4053-HHN last-modified Tue, 13 Jun 2017 03:49:56 GMT server Apache x-timer S1588857898.351725,VS0,VE0 strict-transport-security max-age=31557600 content-type image/png cache-control max-age=3600 accept-ranges bytes x-cache-hits 1, 192991

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ripe6.net
www.paypalobjects.com
151.101.114.133
2606:4700:3035::681c:296
61b8f0e2d21b908df27f4bdeb12d5faa4c3fe9d1daeda40ae9ea1cf32e3d6f4d
8356ff3eb802d52db40a1714aee50ae9ae36aa6e3d789aae7126a53c620156dd
a6c3bff965978df8093c3a29f7071c21d7439a212af41e7b40ce70d94d6bcc44
b3cc50b9e94bbecaaeb1079b64b8ca50616d1732824964c1cc2c5422627a0ec5
c1a148a87b8a7dcf84e0759c4be59ef8626979bdc9cc3a3e9a10e00d7aa4eec0