bbad6693.15ab0ot.pages.dev Open in urlscan Pro
172.66.47.3 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/country-worldwide,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium
Submission: On October 26 via api (October 26th 2024, 1:50:29 pm UTC) from US — Scanned from DE

Summary HTTP 65 Redirects Links 13 Behaviour Indicators

Summary

This website contacted 12 IPs in 3 countries across 11 domains to perform 65 HTTP transactions. The main IP is 172.66.47.3, located in United States and belongs to CLOUDFLARENET, US. The main domain is bbad6693.15ab0ot.pages.dev.
TLS certificate: Issued by WE1 on October 12th 2024. Valid for: 3 months.

This is the only time bbad6693.15ab0ot.pages.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: PayPal (Financial) Generic Cloudflare (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 6	172.66.47.3 172.66.47.3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 3	142.250.185.228 142.250.185.228	15169 (GOOGLE) (GOOGLE)
32	192.229.221.25 192.229.221.25	15133 (EDGECAST) (EDGECAST)
1	142.250.186.34 142.250.186.34	15169 (GOOGLE) (GOOGLE)
1	216.58.206.35 216.58.206.35	15169 (GOOGLE) (GOOGLE)
2 4	34.147.177.40 34.147.177.40	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2	2606:2800:233... 2606:2800:233:ce53:4396:b914:64c2:638e	15133 (EDGECAST) (EDGECAST)
1	2600:9000:a71... 2600:9000:a717:2fb3:95f4:1d0e:8cc4:1c6a	16509 (AMAZON-02) (AMAZON-02)
1	2a03:2880:f17... 2a03:2880:f177:185:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	2a00:1450:400... 2a00:1450:4001:828::200e	15169 (GOOGLE) (GOOGLE)
1 1	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
65	12

6 172.66.47.3 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

bbad6693.15ab0ot.pages.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.185.228 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s53-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

32 192.229.221.25 (United States)

ASN15133 (EDGECAST, US)

www.paypalobjects.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.paypal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
t.paypal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.34 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f2.1e100.net

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.58.206.35 (United States)

ASN15169 (GOOGLE, US)
PTR: lcfraa-aa-in-f3.1e100.net

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 34.147.177.40 (London, United Kingdom) 2 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 40.177.147.34.bc.googleusercontent.com

b.stats.paypal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
lhr.stats.paypal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:2800:233:ce53:4396:b914:64c2:638e (United States)

ASN15133 (EDGECAST, US)

c6.paypal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:a717:2fb3:95f4:1d0e:8cc4:1c6a (United States)

ASN16509 (AMAZON-02, US)

api.bigdatacloud.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f177:185:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:828::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:21::14 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
25	paypalobjects.com www.paypalobjects.com — Cisco Umbrella Rank: 2817	492 KB
13	paypal.com 2 redirects c.paypal.com — Cisco Umbrella Rank: 8333 b.stats.paypal.com — Cisco Umbrella Rank: 6677 lhr.stats.paypal.com — Cisco Umbrella Rank: 48786 c6.paypal.com — Cisco Umbrella Rank: 9992 t.paypal.com — Cisco Umbrella Rank: 3852	25 KB
6	pages.dev 1 redirects bbad6693.15ab0ot.pages.dev	28 KB
3	google.com 1 redirects www.google.com — Cisco Umbrella Rank: 3	23 KB
2	linkedin.com 1 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 321 px4.ads.linkedin.com — Cisco Umbrella Rank: 6828	1 KB
1	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 34	603 B
1	facebook.com www.facebook.com — Cisco Umbrella Rank: 113	274 B
1	bigdatacloud.net api.bigdatacloud.net — Cisco Umbrella Rank: 33730	183 B
1	google.de www.google.de — Cisco Umbrella Rank: 11271	64 B
1	doubleclick.net googleads.g.doubleclick.net — Cisco Umbrella Rank: 42	61 B
0	Failed function sub() { [native code] }. Failed
65	11

	Domain	Requested by
25	www.paypalobjects.com	bbad6693.15ab0ot.pages.dev www.paypalobjects.com
6	bbad6693.15ab0ot.pages.dev	1 redirects bbad6693.15ab0ot.pages.dev
4	c.paypal.com	bbad6693.15ab0ot.pages.dev c.paypal.com
3	t.paypal.com
3	www.google.com	1 redirects bbad6693.15ab0ot.pages.dev
2	c6.paypal.com	bbad6693.15ab0ot.pages.dev
2	lhr.stats.paypal.com	bbad6693.15ab0ot.pages.dev
2	b.stats.paypal.com	2 redirects
1	px4.ads.linkedin.com
1	px.ads.linkedin.com	1 redirects
1	www.google-analytics.com
1	www.facebook.com
1	api.bigdatacloud.net	www.paypalobjects.com
1	www.google.de	bbad6693.15ab0ot.pages.dev
1	googleads.g.doubleclick.net	bbad6693.15ab0ot.pages.dev
0	192.55.233.1 Failed	www.paypalobjects.com
0	https Failed	www.paypalobjects.com
65	17

This site contains links to these domains. Also see Links.

Domain
https

Subject Issuer	Validity	Valid
15ab0ot.pages.dev WE1	`2024-10-12` - `2025-01-10`	3 months	crt.sh
*.google.com WR2	`2024-10-07` - `2024-12-30`	3 months	crt.sh
www.paypal.com DigiCert SHA2 Extended Validation Server CA	`2024-06-13` - `2025-06-12`	a year	crt.sh
*.g.doubleclick.net WR2	`2024-10-07` - `2024-12-30`	3 months	crt.sh
*.bigdatacloud.net Amazon RSA 2048 M02	`2024-04-01` - `2025-04-29`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2024-08-04` - `2024-11-02`	3 months	crt.sh
*.google-analytics.com WR2	`2024-10-07` - `2024-12-30`	3 months	crt.sh

This page contains 8 frames:

Primary Page: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/country-worldwide,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium
Frame ID: B950F04175CE5022665433F26C175113
Requests: 50 HTTP requests in this frame

Frame: https://www.paypalobjects.com/webcaptcha/grcenterprise_v3_static.html
Frame ID: B07C3E6C73FE2AFAA887393EB1172963
Requests: 1 HTTP requests in this frame

Frame: https://www.paypalobjects.com/webcaptcha/grcenterprise_v3_static.html
Frame ID: B0F989A0BDB00E611CEC80D173B6C931
Requests: 1 HTTP requests in this frame

Frame: https://c.paypal.com/v1/r/d/i?js_src=https://c.paypal.com/da/r/fb.js
Frame ID: FCB348CBB1EF50D9031FF0A077C37CCC
Requests: 1 HTTP requests in this frame

Frame: https://lhr.stats.paypal.com/v1/counter2.cgi?r=cD1mOWRhZGU2MDE1YWI0OTVmODBiYWY1ZjM1NDUzMTQ4YiZpPTMxLjEzLjE4OS40JnQ9MTY5NTk3ODE1Ny40NzYmYT0yMSZzPVVOSUZJRURfTE9HSU42dqrCAJneY3SWrSmdZkDPIT8EYA
Frame ID: 00F779714D9278A00101C4C54F93BADC
Requests: 1 HTTP requests in this frame

Frame: https://c.paypal.com/v1/r/d/i?js_src=https://c.paypal.com/da/r/fb.js
Frame ID: 0296B38937D055C929537705A0547048
Requests: 1 HTTP requests in this frame

Frame: https://lhr.stats.paypal.com/v1/counter2.cgi?r=cD1mOWRhZGU2MDE1YWI0OTVmODBiYWY1ZjM1NDUzMTQ4YiZpPTMxLjEzLjE4OS40JnQ9MTY5NTk3ODE1Ny40NzYmYT0yMSZzPVVOSUZJRURfTE9HSU42dqrCAJneY3SWrSmdZkDPIT8EYA
Frame ID: 7579E30723CF7C731047E2064EC34A2E
Requests: 1 HTTP requests in this frame

Frame: https://c.paypal.com/v1/r/d/i?js_src=https://c.paypal.com/da/r/fb.js
Frame ID: 0946EC8C84FD2742A3862A0EB481E7B2
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Log in to your PayPal account

Page URL History Show full URLs

https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/country-worldwide,n/a,https:/openphish.com/feed.txt,10-oct-24... Page URL
https://bbad6693.15ab0ot.pages.dev/cdn-cgi/phish-bypass?atok=oawiR8KqU2hjd7sJg1LW0xLKPv8qDXm_qjwoQtuFINA-172995... HTTP 301
https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/country-worldwide,n/a,https:/openphish.com/feed.txt,10-oct-24... Page URL

Detected technologies

PayPal (Payment Processors) Expand

Overall confidence: 100%
Detected patterns

paypalobjects\.com

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Modernizr (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

([\d.]+)?/modernizr(?:\.([\d.]+))?.*\.js

Page Statistics

65
Requests

69 %
HTTPS

42 %
IPv6

11
Domains

17
Subdomains

12
IPs

3
Countries

568 kB
Transfer

2084 kB
Size

15
Cookies

13 Outgoing links

These are links going to different origins than the main page.

URL: https://https//www.paypal.com/signin
Title: Change

Search URL Search Domain Scan URL

URL: https://https/signin?country.x=US&locale.x=en_US&langTgl=en
Title: English

Search URL Search Domain Scan URL

URL: https://https/signin?country.x=US&locale.x=fr_XC&langTgl=fr
Title: Français

Search URL Search Domain Scan URL

URL: https://https/signin?country.x=US&locale.x=es_XC&langTgl=es
Title: Español

Search URL Search Domain Scan URL

URL: https://https/signin?country.x=US&locale.x=zh_XC&langTgl=zh
Title: 中文

Search URL Search Domain Scan URL

URL: https://https/authflow/password-recovery/?country.x=US&locale.x=en_US&redirectUri=%252Fsignin
Title: Forgot password?

Search URL Search Domain Scan URL

URL: https://https//www.paypal.com/signin
Title: Use password instead

Search URL Search Domain Scan URL

URL: https://https/%7BcoBrand%7D/cgi-bin/helpscr?cmd=_help
Title: We can help

Search URL Search Domain Scan URL

URL: https://https/us/smarthelp/contact-us
Title: Contact Us

Search URL Search Domain Scan URL

URL: https://https/us/webapps/mpp/ua/privacy-full
Title: Privacy

Search URL Search Domain Scan URL

URL: https://https/us/webapps/mpp/ua/legalhub-full
Title: Legal

Search URL Search Domain Scan URL

URL: https://https/us/webapps/mpp/ua/upcoming-policies-full
Title: Policy Updates

Search URL Search Domain Scan URL

URL: https://https/us/webapps/mpp/country-worldwide
Title: Worldwide

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/country-worldwide,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium Page URL
https://bbad6693.15ab0ot.pages.dev/cdn-cgi/phish-bypass?atok=oawiR8KqU2hjd7sJg1LW0xLKPv8qDXm_qjwoQtuFINA-1729950616-0.0.1.1-%2Fus%2Fwebapps%2Fmpp%2Fcountry-worldwide%2Cn%2Fa%2Chttps%3A%2Fopenphish.com%2Ffeed.txt%2C10-oct-24%2Chigh%2Cmedium HTTP 301
https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/country-worldwide,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 27

https://www.google.com/pagead/1p-conversion/992191228/?random=28568274&cv=9&fst=1695978158083&num=1&label=vTDjCL3nvv4CEPzFjtkD&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=466465926%2C512247839&u_h=900&u_w=1600&u_ah=821&u_aw=1600&u_cd=24&u_his=3&u_tz=390&u_java=false&u_nplug=5&u_nmime=2&sendb=1&ig=0&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fwww.paypal.com%2Fsignin&tiba=Log%20in%20to%20your%20PayPal%20account&hn=www.google.com&gcp=2&sscte=1&ct_cookie_present=1&async=1&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECSid0cmlnZ2VyLCBldmVudC1zb3VyY2U7bmF2aWdhdGlvbi1zb3VyY2VaAwoBAWIECgICAw&pscrd=IhMI0NzwopisiQMVNKqDBx3i1A7iMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOiNodHRwczovL2JiYWQ2NjkzLjE1YWIwb3QucGFnZXMuZGV2Lw HTTP 302
https://www.google.de/pagead/1p-conversion/992191228/?random=28568274&cv=9&fst=1695978158083&num=1&label=vTDjCL3nvv4CEPzFjtkD&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=466465926%2C512247839&u_h=900&u_w=1600&u_ah=821&u_aw=1600&u_cd=24&u_his=3&u_tz=390&u_java=false&u_nplug=5&u_nmime=2&sendb=1&ig=0&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fwww.paypal.com%2Fsignin&tiba=Log%20in%20to%20your%20PayPal%20account&hn=www.google.com&gcp=2&sscte=1&ct_cookie_present=1&async=1&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECSid0cmlnZ2VyLCBldmVudC1zb3VyY2U7bmF2aWdhdGlvbi1zb3VyY2VaAwoBAWIECgICAw&pscrd=IhMI0NzwopisiQMVNKqDBx3i1A7iMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOiNodHRwczovL2JiYWQ2NjkzLjE1YWIwb3QucGFnZXMuZGV2Lw&ipr=y

Request Chain 33

https://b.stats.paypal.com/v1/counter.cgi?r=cD1mOWRhZGU2MDE1YWI0OTVmODBiYWY1ZjM1NDUzMTQ4YiZpPTMxLjEzLjE4OS40JnQ9MTY5NTk3ODE1Ny40NzYmYT0yMSZzPVVOSUZJRURfTE9HSU42dqrCAJneY3SWrSmdZkDPIT8EYA HTTP 302
https://lhr.stats.paypal.com/v1/counter2.cgi?r=cD1mOWRhZGU2MDE1YWI0OTVmODBiYWY1ZjM1NDUzMTQ4YiZpPTMxLjEzLjE4OS40JnQ9MTY5NTk3ODE1Ny40NzYmYT0yMSZzPVVOSUZJRURfTE9HSU42dqrCAJneY3SWrSmdZkDPIT8EYA

Request Chain 52

https://b.stats.paypal.com/v1/counter.cgi?r=cD1mOWRhZGU2MDE1YWI0OTVmODBiYWY1ZjM1NDUzMTQ4YiZpPTMxLjEzLjE4OS40JnQ9MTY5NTk3ODE1Ny40NzYmYT0yMSZzPVVOSUZJRURfTE9HSU42dqrCAJneY3SWrSmdZkDPIT8EYA HTTP 302
https://lhr.stats.paypal.com/v1/counter2.cgi?r=cD1mOWRhZGU2MDE1YWI0OTVmODBiYWY1ZjM1NDUzMTQ4YiZpPTMxLjEzLjE4OS40JnQ9MTY5NTk3ODE1Ny40NzYmYT0yMSZzPVVOSUZJRURfTE9HSU42dqrCAJneY3SWrSmdZkDPIT8EYA

Request Chain 61

https://px.ads.linkedin.com/collect/?pid=2786969&fmt=gif HTTP 302
https://px4.ads.linkedin.com/collect/?pid=2786969&fmt=gif&e_ipv6=AQIJseam_3At-AAAAZLJF6tz-A3LonQDtbBBQP5uMCh06LwQH2nfwGu_iVjlK7ckwAPSZwE

65 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3 403 feed.txt,10-oct-24,high,medium Show response
bbad6693.15ab0ot.pages.dev/us/webapps/mpp/country-worldwide,n/a,https:/openphish.com/ 4 KB
2 KB 124ms
33ms Document
text/html 172.66.47.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/country-worldwide,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.47.3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dffbf1e03a7b33f462ebe78658f895301e8b25b10ff52f004cd7e24c1c208d03

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

cf-ray: 8d8aea1b4d6de51f-TXL
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Sat, 26 Oct 2024 13:50:16 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xSzlJt%2BluxFCMtmMUKOTLWCV7ZS9D5UBwJMHRvZhBK%2Bv6JjEZKWUS4D5RtqOjqPHfptbxl8QnkzEV59r8wyPouh7JQQgEpBWCPjUQn5s2tI50CmKuz963Q97GqG5t60bdYGz4t8l7T6LLR1SHQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-frame-options: SAMEORIGIN

GET
H3 200 cf.errors.css
bbad6693.15ab0ot.pages.dev/cdn-cgi/styles/ 23 KB
5 KB 33ms
32ms Stylesheet
text/css 172.66.47.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bbad6693.15ab0ot.pages.dev/cdn-cgi/styles/cf.errors.css

Requested by

Host: bbad6693.15ab0ot.pages.dev
URL: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/country-worldwide,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.47.3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/country-worldwide,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Response headers

vary: Accept-Encoding
cache-control: max-age=7200, public
content-encoding: gzip
etag: W/"67180f5f-5df3"
x-content-type-options: nosniff
cf-ray: 8d8aea1c789fe51f-TXL
expires: Sat, 26 Oct 2024 15:50:17 GMT
date: Sat, 26 Oct 2024 13:50:17 GMT
content-type: text/css
last-modified: Tue, 22 Oct 2024 20:47:27 GMT
server: cloudflare
x-frame-options: DENY

GET
H3 200 icon-exclamation.png
bbad6693.15ab0ot.pages.dev/cdn-cgi/images/ 452 B
634 B 44ms
38ms Image
image/png 172.66.47.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bbad6693.15ab0ot.pages.dev/cdn-cgi/images/icon-exclamation.png?1376755637

Requested by

Host: bbad6693.15ab0ot.pages.dev
URL: https://bbad6693.15ab0ot.pages.dev/cdn-cgi/styles/cf.errors.css

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.47.3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bbad6693.15ab0ot.pages.dev/cdn-cgi/styles/cf.errors.css

Response headers

vary: Accept-Encoding
cache-control: max-age=7200, public
etag: "67180f5f-1c4"
x-content-type-options: nosniff
cf-ray: 8d8aea1d1a1de51f-TXL
expires: Sat, 26 Oct 2024 15:50:17 GMT
accept-ranges: bytes
content-length: 452
date: Sat, 26 Oct 2024 13:50:17 GMT
content-type: image/png
last-modified: Tue, 22 Oct 2024 20:47:27 GMT
server: cloudflare
x-frame-options: DENY

GET
H3 403 favicon.ico
bbad6693.15ab0ot.pages.dev/ 4 KB
2 KB 35ms
34ms Other
text/html 172.66.47.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bbad6693.15ab0ot.pages.dev/favicon.ico

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.47.3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

612ed2dee283ca8cb0258ed73b67e21feaa79a3927fd896396cdb87bb79c94d7

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/country-worldwide,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Response headers

nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: gzip
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IRpt98XyqihYITU7nN60l3JVXR9HE9672MrxGext44AsYGxaCBj3kT5ytaSXPN461pVNbc8Bw6wE9zJ94aHRQRWcnxQIbfBs3vP%2Bu02nySi5UGtFG00GdSh%2BjZgJ7MixH7%2B7pMyg6J0HLK6pRA%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8d8aea1d5b18e51f-TXL
date: Sat, 26 Oct 2024 13:50:17 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: cloudflare
x-frame-options: SAMEORIGIN

GET
H3

200

Primary Request feed.txt,10-oct-24,high,medium Show response
bbad6693.15ab0ot.pages.dev/us/webapps/mpp/country-worldwide,n/a,https:/openphish.com/
Redirect Chain

https://bbad6693.15ab0ot.pages.dev/cdn-cgi/phish-bypass?atok=oawiR8KqU2hjd7sJg1LW0xLKPv8qDXm_qjwoQtuFINA-1729950616-0.0.1.1-%2Fus%2Fwebapps%2Fmpp%2Fcountry-worldwide%2Cn%2Fa%2Chttps%3A%2Fopenphish....
https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/country-worldwide,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

70 KB
18 KB

118ms
115ms

Document
text/html

172.66.47.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/country-worldwide,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.47.3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8102e9e9aacd7429d30cf0a40c351dcbbc8c92d6e9783e4b1c1168504b5a36a3

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/country-worldwide,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
cache-control: public, max-age=0, must-revalidate
cf-ray: 8d8aea3cba1be51f-TXL
content-encoding: br
content-type: text/html; charset=utf-8
date: Sat, 26 Oct 2024 13:50:22 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
priority: u=0,i
referrer-policy: strict-origin-when-cross-origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yowgFJVEz8U9if%2BV3B68ZnaFx%2F4LkQZPwZzGgqZ84Hrnp9IpX96X%2BW9U3kLW7WZ9bnWXMXiOeGgrI%2F4M04p65G3gSTT3ktVv%2BwDOHzwD4OzSuenQPMqO7T%2BS42xvPOKhapFOFSPcyqoGlBFJzQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfL4;desc="?proto=QUIC&rtt=31746&sent=30&recv=23&lost=0&retrans=0&sent_bytes=14971&recv_bytes=7420&delivery_rate=467&cwnd=12000&unsent_bytes=0&cid=6ddc79e2771a2b82&ts=5500&x=1" cfExtPri cfHdrFlush;dur=0
vary: Accept-Encoding
x-content-type-options: nosniff
x-robots-tag: noindex

Redirect headers

cache-control: private, no-cache
cf-ray: 8d8aea3c6954e51f-TXL
content-length: 167
content-type: text/html
date: Sat, 26 Oct 2024 13:50:22 GMT
location: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/country-worldwide,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium
server: cloudflare
x-content-type-options: nosniff
x-frame-options: DENY

GET
H3 200 conversion_async.js Show response
www.google.com/pagead/ 56 KB
20 KB 157ms
52ms Script
text/javascript 142.250.185.228
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/pagead/conversion_async.js

Requested by

Host: bbad6693.15ab0ot.pages.dev
URL: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/country-worldwide,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.228 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f4.1e100.net

Software

cafe /

Resource Hash

702863c9f873351ea934d09f4b479b45cd7a8a175974586974cb37870c3e9230

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bbad6693.15ab0ot.pages.dev/

Response headers

content-encoding: br
etag: 11956566925980570316
x-content-type-options: nosniff
expires: Sat, 26 Oct 2024 13:50:22 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sat, 26 Oct 2024 13:50:22 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 20707
x-xss-protection: 0
server: cafe

GET
H2 200 analytics.js Show response
www.paypalobjects.com/pa/mi/3p/gtag/ 44 KB
17 KB 503ms
49ms Script
application/javascript 192.229.221.25
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/pa/mi/3p/gtag/analytics.js

Requested by

Host: bbad6693.15ab0ot.pages.dev
URL: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/country-worldwide,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.221.25 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (frc/4CD8) /

Resource Hash

62bb5685d837089cd6aedb6f5fe5375c83ce5facc879632628e1e63e51399580

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bbad6693.15ab0ot.pages.dev/

Response headers

paypal-debug-id: 76d31abbdf083
content-encoding: br
etag: W/"670429ca-aed9"
access-control-allow-methods: GET
x-content-type-options: nosniff
expires: Sat, 26 Oct 2024 14:50:22 GMT
traceparent: 00-000000000000000000076d31abbdf083-e75758f02fcbe1b5-01
dc: ccg11-origin-www-1.paypal.com
x-cache: HIT
date: Sat, 26 Oct 2024 13:50:22 GMT
content-type: application/javascript
last-modified: Mon, 07 Oct 2024 18:34:50 GMT
vary: Accept-Encoding
access-control-allow-headers: x-csrf-token
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: s-maxage=31536000, public,max-age=3600
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
accept-ranges: bytes
access-control-allow-origin: *
content-length: 17356
server: ECAcc (frc/4CD8)

GET
H2 200 latmconf.js Show response
www.paypalobjects.com/pa/mi/paypal/ 15 KB
4 KB 497ms
44ms Script
application/javascript 192.229.221.25
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/pa/mi/paypal/latmconf.js

Requested by

Host: bbad6693.15ab0ot.pages.dev
URL: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/country-worldwide,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.221.25 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (frc/4CDC) /

Resource Hash

0311e7cd1ff9b287c7099126ae78265a48fc8adb1a6e060731a503b2e41313f0

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://bbad6693.15ab0ot.pages.dev
Referer: https://bbad6693.15ab0ot.pages.dev/

Response headers

paypal-debug-id: 30a569854aa11
content-encoding: br
etag: "670429ca-3a4c"
access-control-allow-methods: GET
x-content-type-options: nosniff
expires: Sat, 26 Oct 2024 14:50:22 GMT
traceparent: 00-000000000000000000030a569854aa11-a2ef2206c066567e-01
dc: ccg11-origin-www-1.paypal.com
x-cache: HIT
date: Sat, 26 Oct 2024 13:50:22 GMT
content-type: application/javascript
last-modified: Mon, 07 Oct 2024 18:34:50 GMT
vary: Accept-Encoding
access-control-allow-headers: x-csrf-token
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: s-maxage=31536000, public,max-age=3600
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
accept-ranges: bytes
access-control-allow-origin: *
content-length: 4115
server: ECAcc (frc/4CDC)

GET
H2 200 ngrlCaptcha.min.js Show response
www.paypalobjects.com/webcaptcha/ 23 KB
7 KB 47ms
41ms Script
application/javascript 192.229.221.25
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/webcaptcha/ngrlCaptcha.min.js

Requested by

Host: bbad6693.15ab0ot.pages.dev
URL: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/country-worldwide,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.221.25 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (frc/4CED) /

Resource Hash

d81bfefd8585b694222d3e94e9dee5d7935049c65355f9fd096800301d51545b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bbad6693.15ab0ot.pages.dev/

Response headers

paypal-debug-id: 6729ed606f4b1
content-encoding: br
etag: "6697f682-5a55+gzip+br"
x-content-type-options: nosniff
expires: Sat, 26 Oct 2024 14:50:22 GMT
traceparent: 00-00000000000000000006729ed606f4b1-2548558857f0ae38-01
dc: ccg11-origin-www-1.paypal.com
x-cache: HIT
date: Sat, 26 Oct 2024 13:50:22 GMT
content-type: application/javascript
last-modified: Wed, 17 Jul 2024 16:51:14 GMT
vary: Accept-Encoding
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: s-maxage=31536000, public,max-age=3600
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
content-length: 6901
server: ECAcc (frc/4CED)

GET
H2 200 contextualLoginElementalUIv2.css
www.paypalobjects.com/web/res/0e5/418cc87f0ab9fcb01f588e89a18d7/css/ 148 KB
24 KB 505ms
52ms Stylesheet
text/css 192.229.221.25
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/web/res/0e5/418cc87f0ab9fcb01f588e89a18d7/css/contextualLoginElementalUIv2.css

Requested by

Host: bbad6693.15ab0ot.pages.dev
URL: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/country-worldwide,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.221.25 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (frc/4CFE) /

Resource Hash

4f3ce6ed02764246b3431d0a8e1aeec9ea10915d801a4b48957ed264d98a28dd

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bbad6693.15ab0ot.pages.dev/

Response headers

paypal-debug-id: 941b0b13104f3
content-encoding: br
etag: W/"650c92ef-250a9"
access-control-allow-methods: GET
x-content-type-options: nosniff
expires: Sun, 26 Oct 2025 13:50:22 GMT
traceparent: 00-0000000000000000000941b0b13104f3-3185a5cd88c1a1ce-01
dc: ccg11-origin-www-1.paypal.com
x-cache: HIT
date: Sat, 26 Oct 2024 13:50:22 GMT
content-type: text/css
last-modified: Thu, 21 Sep 2023 19:01:03 GMT
vary: Accept-Encoding
access-control-allow-headers: x-csrf-token
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: max-age=31536000, s-maxage=31536000
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
access-control-allow-origin: *
content-length: 24142
server: ECAcc (frc/4CFE)

GET
H2 200 modernizr-2.6.1.js Show response
www.paypalobjects.com/web/res/0e5/418cc87f0ab9fcb01f588e89a18d7/js/lib/ 4 KB
2 KB 499ms
46ms Script
application/javascript 192.229.221.25
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/web/res/0e5/418cc87f0ab9fcb01f588e89a18d7/js/lib/modernizr-2.6.1.js

Requested by

Host: bbad6693.15ab0ot.pages.dev
URL: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/country-worldwide,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.221.25 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (frc/4CB8) /

Resource Hash

a6c3bff965978df8093c3a29f7071c21d7439a212af41e7b40ce70d94d6bcc44

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bbad6693.15ab0ot.pages.dev/

Response headers

paypal-debug-id: 0026b815a5817
content-encoding: br
etag: W/"650c92f0-edf"
access-control-allow-methods: GET
x-content-type-options: nosniff
expires: Sun, 26 Oct 2025 13:50:22 GMT
traceparent: 00-00000000000000000000026b815a5817-199541f43f47bd9d-01
dc: ccg11-origin-www-1.paypal.com
x-cache: HIT
date: Sat, 26 Oct 2024 13:50:22 GMT
content-type: application/javascript
last-modified: Thu, 21 Sep 2023 19:01:04 GMT
vary: Accept-Encoding
access-control-allow-headers: x-csrf-token
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: max-age=31536000, s-maxage=31536000
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
access-control-allow-origin: *
content-length: 1747
server: ECAcc (frc/4CB8)

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/992191228/ 43 B
61 B 179ms
76ms Script
text/javascript 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/992191228/?random=1695978158079&cv=9&fst=1695978158079&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=466465926&u_h=900&u_w=1600&u_ah=821&u_aw=1600&u_cd=24&u_his=3&u_tz=390&u_java=false&u_nplug=5&u_nmime=2&sendb=1&ig=0&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.paypal.com%2Fsignin&tiba=Log%20in%20to%20your%20PayPal%20account&hn=www.google.com&async=1&rfmt=3&fmt=4

Requested by

Host: bbad6693.15ab0ot.pages.dev
URL: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/country-worldwide,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

77d5fe96defd6c8c1e3b0466b4827cf83dc7e5c727a10177e115d25132fa86f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bbad6693.15ab0ot.pages.dev/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 37
date: Sat, 26 Oct 2024 13:50:23 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H3 200 / Show response
www.google.com/pagead/1p-conversion/992191228/ 5 KB
3 KB 103ms
100ms Script
text/javascript 142.250.185.228
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/pagead/1p-conversion/992191228/?random=1695978158083&cv=9&fst=1695978158083&num=1&label=vTDjCL3nvv4CEPzFjtkD&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=466465926%2C512247839&u_h=900&u_w=1600&u_ah=821&u_aw=1600&u_cd=24&u_his=3&u_tz=390&u_java=false&u_nplug=5&u_nmime=2&sendb=1&ig=0&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fwww.paypal.com%2Fsignin&tiba=Log%20in%20to%20your%20PayPal%20account&hn=www.google.com&gcp=1&sscte=1&ct_cookie_present=1&async=1&rfmt=3&fmt=4

Requested by

Host: bbad6693.15ab0ot.pages.dev
URL: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/country-worldwide,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.228 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f4.1e100.net

Software

cafe /

Resource Hash

a552fd96fd272c7f809539fe8f33e9dd5a57d2566182eae300811532e4e8ee72

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bbad6693.15ab0ot.pages.dev/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: gzip
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 2583
date: Sat, 26 Oct 2024 13:50:22 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 icon-PN-check.png
www.paypalobjects.com/images/shared/ 2 KB
3 KB 474ms
45ms Image
image/png 192.229.221.25
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.paypalobjects.com/images/shared/icon-PN-check.png

Requested by

Host: bbad6693.15ab0ot.pages.dev
URL: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/country-worldwide,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.221.25 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (frc/4CAF) /

Resource Hash

4a77d272b8cf508cc4a7e0da5763faa9958e42a5554fdb5d29fc3be51d685653

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bbad6693.15ab0ot.pages.dev/

Response headers

paypal-debug-id: 4abf1c601a2fd
etag: "60271b47-8bc"
x-content-type-options: nosniff
expires: Sat, 26 Oct 2024 14:50:22 GMT
traceparent: 00-00000000000000000004abf1c601a2fd-22ae4ce310be28ce-01
dc: ccg11-origin-www-1.paypal.com
x-cache: HIT
date: Sat, 26 Oct 2024 13:50:22 GMT
content-type: image/png
last-modified: Sat, 13 Feb 2021 00:20:23 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: s-maxage=31536000, public,max-age=3600
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
accept-ch: DPR, Viewport-Width, Width, ECT, Downlink
accept-ranges: bytes
content-length: 2236
server: ECAcc (frc/4CAF)

GET
H2 200 glyph_alert_critical_big-2x.png
www.paypalobjects.com/images/shared/ 6 KB
6 KB 477ms
49ms Image
image/png 192.229.221.25
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.paypalobjects.com/images/shared/glyph_alert_critical_big-2x.png

Requested by

Host: bbad6693.15ab0ot.pages.dev
URL: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/country-worldwide,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.221.25 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (frc/4CA8) /

Resource Hash

13e4806e5c517e074ab1ea26fe0f2b7b87eaa3988006f35ed0bd4c89502d0d79

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bbad6693.15ab0ot.pages.dev/

Response headers

paypal-debug-id: 7e4aca33794e3
etag: "54130c54-16c4"
x-content-type-options: nosniff
expires: Sat, 26 Oct 2024 14:50:22 GMT
traceparent: 00-00000000000000000007e4aca33794e3-0f9a8994d0e013d4-01
dc: ccg11-origin-www-1.paypal.com
x-cache: HIT
date: Sat, 26 Oct 2024 13:50:22 GMT
content-type: image/png
last-modified: Fri, 12 Sep 2014 15:08:04 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: s-maxage=31536000, public,max-age=3600
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
accept-ch: DPR, Viewport-Width, Width, ECT, Downlink
accept-ranges: bytes
content-length: 5828
server: ECAcc (frc/4CA8)

GET
H2 200 fn-sync-telemetry-min.js Show response
www.paypalobjects.com/web/res/0e5/418cc87f0ab9fcb01f588e89a18d7/js/lib/ 5 KB
2 KB 83ms
81ms Script
application/javascript 192.229.221.25
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/web/res/0e5/418cc87f0ab9fcb01f588e89a18d7/js/lib/fn-sync-telemetry-min.js

Requested by

Host: bbad6693.15ab0ot.pages.dev
URL: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/country-worldwide,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.221.25 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (frc/4CD7) /

Resource Hash

8b202d5bd55968ce4bfc21c063166eaebe62104275ce7ec362d78b64b2581c95

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bbad6693.15ab0ot.pages.dev/

Response headers

paypal-debug-id: b7b5a1e3f8213
content-encoding: br
etag: W/"650c92f0-159e"
access-control-allow-methods: GET
x-content-type-options: nosniff
expires: Sun, 26 Oct 2025 13:50:22 GMT
traceparent: 00-0000000000000000000b7b5a1e3f8213-608c2e09b53273e8-01
dc: ccg11-origin-www-1.paypal.com
x-cache: HIT
date: Sat, 26 Oct 2024 13:50:22 GMT
content-type: application/javascript
last-modified: Thu, 21 Sep 2023 19:01:04 GMT
vary: Accept-Encoding
access-control-allow-headers: x-csrf-token
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: max-age=31536000, s-maxage=31536000
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
access-control-allow-origin: *
content-length: 2321
server: ECAcc (frc/4CD7)

GET
H2 200 signin-split.js Show response
www.paypalobjects.com/web/res/0e5/418cc87f0ab9fcb01f588e89a18d7/js/ 436 KB
91 KB 77ms
76ms Script
application/javascript 192.229.221.25
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/web/res/0e5/418cc87f0ab9fcb01f588e89a18d7/js/signin-split.js

Requested by

Host: bbad6693.15ab0ot.pages.dev
URL: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/country-worldwide,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.221.25 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (frc/4CB1) /

Resource Hash

55ed4f12d94d0e62c76d391eb9c1ed1b4358fae88f0636a3c039b7b6d449115a

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bbad6693.15ab0ot.pages.dev/

Response headers

paypal-debug-id: 90671d58bfa47
content-encoding: br
etag: W/"650c92f0-6cf97"
access-control-allow-methods: GET
x-content-type-options: nosniff
expires: Sun, 26 Oct 2025 13:50:22 GMT
traceparent: 00-000000000000000000090671d58bfa47-2c0718c120798ed0-01
dc: ccg11-origin-www-1.paypal.com
x-cache: HIT
date: Sat, 26 Oct 2024 13:50:22 GMT
content-type: application/javascript
last-modified: Thu, 21 Sep 2023 19:01:04 GMT
vary: Accept-Encoding
access-control-allow-headers: x-csrf-token
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: max-age=31536000, s-maxage=31536000
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
access-control-allow-origin: *
content-length: 92615
server: ECAcc (frc/4CB1)

GET
H2 200 ioc.js Show response
www.paypalobjects.com/web/res/0e5/418cc87f0ab9fcb01f588e89a18d7/js/ 5 KB
2 KB 68ms
57ms Script
application/javascript 192.229.221.25
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/web/res/0e5/418cc87f0ab9fcb01f588e89a18d7/js/ioc.js

Requested by

Host: bbad6693.15ab0ot.pages.dev
URL: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/country-worldwide,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.221.25 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (frc/4CDC) /

Resource Hash

07d4a44d248156a0e3d0c604d7359e54f3b021eeec70b7c3a1d127a141f76d97

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bbad6693.15ab0ot.pages.dev/

Response headers

paypal-debug-id: 112d370f0076f
content-encoding: br
etag: W/"650c92f0-1407"
access-control-allow-methods: GET
x-content-type-options: nosniff
expires: Sun, 26 Oct 2025 13:50:22 GMT
traceparent: 00-0000000000000000000112d370f0076f-091aeb62883f78dd-01
dc: ccg11-origin-www-1.paypal.com
x-cache: HIT
date: Sat, 26 Oct 2024 13:50:22 GMT
content-type: application/javascript
last-modified: Thu, 21 Sep 2023 19:01:04 GMT
vary: Accept-Encoding
access-control-allow-headers: x-csrf-token
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: max-age=31536000, s-maxage=31536000
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
access-control-allow-origin: *
content-length: 1984
server: ECAcc (frc/4CDC)

GET
H2 200 pa.js Show response
www.paypalobjects.com/pa/js/min/ 69 KB
24 KB 49ms
41ms Script
application/javascript 192.229.221.25
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/pa/js/min/pa.js

Requested by

Host: bbad6693.15ab0ot.pages.dev
URL: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/country-worldwide,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.221.25 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (frc/4CFA) /

Resource Hash

2c6bd1749d24699d1800314c498bfff3eaf5ded67fe354f96fd00d274ca9513c

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bbad6693.15ab0ot.pages.dev/

Response headers

paypal-debug-id: e21f8f3f392b8
content-encoding: br
etag: "670429cc-112e1"
access-control-allow-methods: GET
x-content-type-options: nosniff
expires: Sat, 26 Oct 2024 14:50:22 GMT
traceparent: 00-0000000000000000000e21f8f3f392b8-e0c414b99a530cf3-01
dc: ccg11-origin-www-1.paypal.com
x-cache: HIT
date: Sat, 26 Oct 2024 13:50:22 GMT
content-type: application/javascript
last-modified: Mon, 07 Oct 2024 18:34:52 GMT
vary: Accept-Encoding
access-control-allow-headers: x-csrf-token
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: s-maxage=31536000, public,max-age=3600
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
accept-ranges: bytes
access-control-allow-origin: *
content-length: 24745
server: ECAcc (frc/4CFA)

GET
H2 200 grcenterprise_v3_static.js Show response
www.paypalobjects.com/webcaptcha/ 6 KB
2 KB 46ms
42ms Script
application/javascript 192.229.221.25
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/webcaptcha/grcenterprise_v3_static.js

Requested by

Host: bbad6693.15ab0ot.pages.dev
URL: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/country-worldwide,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.221.25 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (frc/4C8F) /

Resource Hash

75c159c9974a7207171cf1f4ed302f91f90ae95233fdd64e994fd66ada89ab20

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bbad6693.15ab0ot.pages.dev/

Response headers

paypal-debug-id: 09d846e0181a0
content-encoding: br
etag: W/"65f1e42c-180e"
x-content-type-options: nosniff
expires: Sat, 26 Oct 2024 14:50:22 GMT
traceparent: 00-000000000000000000009d846e0181a0-03b7f9ee2b5df5e3-01
dc: ccg11-origin-www-1.paypal.com
x-cache: HIT
date: Sat, 26 Oct 2024 13:50:22 GMT
content-type: application/javascript
last-modified: Wed, 13 Mar 2024 17:36:44 GMT
vary: Accept-Encoding
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: s-maxage=31536000, public,max-age=3600
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
content-length: 1820
server: ECAcc (frc/4C8F)

GET
H2 200 patleaf.js Show response
www.paypalobjects.com/pa/3pjs/tl/6.2.0/ 191 KB
49 KB 77ms
69ms Script
application/javascript 192.229.221.25
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/pa/3pjs/tl/6.2.0/patleaf.js

Requested by

Host: bbad6693.15ab0ot.pages.dev
URL: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/country-worldwide,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.221.25 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (frc/4CC0) /

Resource Hash

586f0eb92dcb65651bb48a4d846c39f6cb02d7f9ce88943a2a45fbac7d863334

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://bbad6693.15ab0ot.pages.dev
Referer: https://bbad6693.15ab0ot.pages.dev/

Response headers

paypal-debug-id: 82b235b328de5
content-encoding: br
etag: "670429cc-2fbb4"
access-control-allow-methods: GET
x-content-type-options: nosniff
expires: Sat, 26 Oct 2024 14:50:22 GMT
traceparent: 00-000000000000000000082b235b328de5-ceca9a906717911f-01
dc: ccg11-origin-www-1.paypal.com
x-cache: HIT
date: Sat, 26 Oct 2024 13:50:22 GMT
content-type: application/javascript
last-modified: Mon, 07 Oct 2024 18:34:52 GMT
vary: Accept-Encoding
access-control-allow-headers: x-csrf-token
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: s-maxage=31536000, public,max-age=3600
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
accept-ranges: bytes
access-control-allow-origin: *
content-length: 50030
server: ECAcc (frc/4CC0)

GET
H2 200 gtag.js Show response
www.paypalobjects.com/pa/mi/3p/gtag/ 79 KB
29 KB 50ms
43ms Script
application/javascript 192.229.221.25
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/pa/mi/3p/gtag/gtag.js

Requested by

Host: bbad6693.15ab0ot.pages.dev
URL: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/country-worldwide,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.221.25 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (frc/4CBC) /

Resource Hash

f982a9dad50b916735a08b8e6f40efa7f97163106b18da079b144764c86a44a1

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://bbad6693.15ab0ot.pages.dev
Referer: https://bbad6693.15ab0ot.pages.dev/

Response headers

paypal-debug-id: d2d3396076957
content-encoding: br
etag: "670429ca-13bba"
access-control-allow-methods: GET
x-content-type-options: nosniff
expires: Sat, 26 Oct 2024 14:50:22 GMT
traceparent: 00-0000000000000000000d2d3396076957-43cde10d8a6a0f79-01
dc: ccg11-origin-www-1.paypal.com
x-cache: HIT
date: Sat, 26 Oct 2024 13:50:22 GMT
content-type: application/javascript
last-modified: Mon, 07 Oct 2024 18:34:50 GMT
vary: Accept-Encoding
access-control-allow-headers: x-csrf-token
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: s-maxage=31536000, public,max-age=3600
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
accept-ranges: bytes
access-control-allow-origin: *
content-length: 29845
server: ECAcc (frc/4CBC)

GET
H2 200 patlcfg.js Show response
www.paypalobjects.com/pa/3pjs/tl/6.2.0/ 6 KB
3 KB 51ms
44ms Script
application/javascript 192.229.221.25
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/pa/3pjs/tl/6.2.0/patlcfg.js

Requested by

Host: bbad6693.15ab0ot.pages.dev
URL: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/country-worldwide,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.221.25 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (frc/4C83) /

Resource Hash

aa3020d20fe753464cc473d2afb758a43f77a2404671c663d511f686d4f4c0e2

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://bbad6693.15ab0ot.pages.dev
Referer: https://bbad6693.15ab0ot.pages.dev/

Response headers

paypal-debug-id: 13247bd77cdb7
content-encoding: br
etag: "670429cc-190a"
access-control-allow-methods: GET
x-content-type-options: nosniff
expires: Sat, 26 Oct 2024 14:50:22 GMT
traceparent: 00-000000000000000000013247bd77cdb7-33fb39807afa6f0e-01
dc: ccg11-origin-www-1.paypal.com
x-cache: HIT
date: Sat, 26 Oct 2024 13:50:22 GMT
content-type: application/javascript
last-modified: Mon, 07 Oct 2024 18:34:52 GMT
vary: Accept-Encoding
access-control-allow-headers: x-csrf-token
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: s-maxage=31536000, public,max-age=3600
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
accept-ranges: bytes
access-control-allow-origin: *
content-length: 2510
server: ECAcc (frc/4C83)

GET
H2 200 fb.js Show response
c.paypal.com/da/r/ 69 KB
22 KB 238ms
212ms Script
application/javascript 192.229.221.25
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://c.paypal.com/da/r/fb.js

Requested by

Host: bbad6693.15ab0ot.pages.dev
URL: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/country-worldwide,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.221.25 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (dac/9C7D) /

Resource Hash

62a4e3fe56286026c23ae5891f4222bd9a455f393af54d88ba443eecba0e6600

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bbad6693.15ab0ot.pages.dev/

Response headers

access-control-max-age: 86400
paypal-debug-id: 81d3c32ede380
content-encoding: br
etag: W/"66bc0232-112e9"
access-control-allow-methods: GET
x-content-type-options: nosniff
expires: Sun, 27 Oct 2024 13:50:23 GMT
traceparent: 00-000000000000000000081d3c32ede380-965173a67b22f69d-01
server-timing: content-encoding;desc="", x-cdn;desc="edgecast"
dc: ccg11-origin-www-1.paypal.com
date: Sat, 26 Oct 2024 13:50:23 GMT
content-type: application/javascript
last-modified: Wed, 14 Aug 2024 01:02:42 GMT
vary: Accept-Encoding, Accept-Encoding
access-control-allow-headers: x-csrf-token
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: max-age=86400
timing-allow-origin: *
access-control-allow-credentials: false
access-control-allow-origin: *
server: ECAcc (dac/9C7D)

GET
H2 200 paypal-mark-color.svg
www.paypalobjects.com/paypal-ui/logos/svg/ 709 B
808 B 60ms
50ms Image
image/svg+xml 192.229.221.25
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.paypalobjects.com/paypal-ui/logos/svg/paypal-mark-color.svg

Requested by

Host: www.paypalobjects.com
URL: https://www.paypalobjects.com/web/res/0e5/418cc87f0ab9fcb01f588e89a18d7/css/contextualLoginElementalUIv2.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.221.25 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (frc/4CF9) /

Resource Hash

8766a4211434d2c318fbfa412ea9633b385ecf1cab6119f8894019d91ed7e027

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.paypalobjects.com/web/res/0e5/418cc87f0ab9fcb01f588e89a18d7/css/contextualLoginElementalUIv2.css

Response headers

paypal-debug-id: 94461365fb7cf
content-encoding: br
etag: "66d9ab63-2c5+gzip+br"
x-content-type-options: nosniff
expires: Sat, 26 Oct 2024 14:50:22 GMT
traceparent: 00-000000000000000000094461365fb7cf-1bf39fc9bc7ff5e6-01
dc: ccg11-origin-www-1.paypal.com
x-cache: HIT
date: Sat, 26 Oct 2024 13:50:22 GMT
content-type: image/svg+xml
last-modified: Thu, 05 Sep 2024 13:00:19 GMT
vary: Accept-Encoding
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: s-maxage=31536000, public,max-age=3600
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
access-control-allow-origin: *
content-length: 422
server: ECAcc (frc/4CF9)

GET
H2 200 PayPalSansBig-Regular.woff2
www.paypalobjects.com/paypal-ui/fonts/ 25 KB
25 KB 54ms
21ms Font
application/font-woff2 192.229.221.25
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/paypal-ui/fonts/PayPalSansBig-Regular.woff2

Requested by

Host: www.paypalobjects.com
URL: https://www.paypalobjects.com/web/res/0e5/418cc87f0ab9fcb01f588e89a18d7/css/contextualLoginElementalUIv2.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.221.25 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (frc/4D0A) /

Resource Hash

1f70ff447ed799a34f4c3ae37ef1f49ed4af71123ba2c2aefe354565354284be

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://bbad6693.15ab0ot.pages.dev
Referer: https://www.paypalobjects.com/web/res/0e5/418cc87f0ab9fcb01f588e89a18d7/css/contextualLoginElementalUIv2.css

Response headers

paypal-debug-id: 7c57aa5636a42
etag: "60271cda-6318"
access-control-allow-methods: GET
x-content-type-options: nosniff
expires: Sat, 26 Oct 2024 14:50:23 GMT
traceparent: 00-00000000000000000007c57aa5636a42-8b0c0e1608f99039-01
dc: ccg11-origin-www-1.paypal.com
x-cache: HIT
date: Sat, 26 Oct 2024 13:50:23 GMT
content-type: application/font-woff2
last-modified: Sat, 13 Feb 2021 00:27:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: s-maxage=31536000, public,max-age=31536000
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
accept-ranges: bytes
access-control-allow-origin: *
content-length: 25368
server: ECAcc (frc/4D0A)

GET
H2 200 sprite_countries_flag4.png
www.paypalobjects.com/webstatic/mktg/icons/ 108 KB
108 KB 64ms
60ms Image
image/png 192.229.221.25
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.paypalobjects.com/webstatic/mktg/icons/sprite_countries_flag4.png

Requested by

Host: bbad6693.15ab0ot.pages.dev
URL: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/country-worldwide,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.221.25 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (frc/4CF1) /

Resource Hash

21f89c7c27f0eab13388645aea1eedb4a342c06333a14d74c1a10dfca04d6455

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bbad6693.15ab0ot.pages.dev/

Response headers

paypal-debug-id: ca1c7ef240600
etag: "60271d86-1ae61"
x-content-type-options: nosniff
expires: Sat, 26 Oct 2024 14:50:22 GMT
traceparent: 00-0000000000000000000ca1c7ef240600-c8b6ff8d8fcc6475-01
dc: ccg11-origin-www-1.paypal.com
x-cache: HIT
date: Sat, 26 Oct 2024 13:50:22 GMT
content-type: image/png
last-modified: Sat, 13 Feb 2021 00:29:58 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: s-maxage=31536000, public,max-age=3600
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
accept-ch: DPR, Viewport-Width, Width, ECT, Downlink
accept-ranges: bytes
content-length: 110177
server: ECAcc (frc/4CF1)

GET
H2 200 PayPalSansBig-Medium.woff2
www.paypalobjects.com/paypal-ui/fonts/ 18 KB
18 KB 77ms
44ms Font
application/font-woff2 192.229.221.25
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/paypal-ui/fonts/PayPalSansBig-Medium.woff2

Requested by

Host: www.paypalobjects.com
URL: https://www.paypalobjects.com/web/res/0e5/418cc87f0ab9fcb01f588e89a18d7/css/contextualLoginElementalUIv2.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.221.25 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (frc/4C95) /

Resource Hash

2ae6779c6c3579643ab6deb5cfb822e843bf637d006a4ec25d9857ec7fb6d8c1

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://bbad6693.15ab0ot.pages.dev
Referer: https://www.paypalobjects.com/web/res/0e5/418cc87f0ab9fcb01f588e89a18d7/css/contextualLoginElementalUIv2.css

Response headers

paypal-debug-id: 7698ba90049f5
etag: "60271cda-484c"
access-control-allow-methods: GET
x-content-type-options: nosniff
expires: Sat, 26 Oct 2024 14:50:23 GMT
traceparent: 00-00000000000000000007698ba90049f5-aee7dc2427ad713f-01
dc: ccg11-origin-www-1.paypal.com
x-cache: HIT
date: Sat, 26 Oct 2024 13:50:23 GMT
content-type: application/font-woff2
last-modified: Sat, 13 Feb 2021 00:27:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: s-maxage=31536000, public,max-age=31536000
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
accept-ranges: bytes
access-control-allow-origin: *
content-length: 18508
server: ECAcc (frc/4C95)

GET
H3

200

/
www.google.de/pagead/1p-conversion/992191228/
Redirect Chain

https://www.google.com/pagead/1p-conversion/992191228/?random=28568274&cv=9&fst=1695978158083&num=1&label=vTDjCL3nvv4CEPzFjtkD&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=466465926%2C512247839&u_h=...
https://www.google.de/pagead/1p-conversion/992191228/?random=28568274&cv=9&fst=1695978158083&num=1&label=vTDjCL3nvv4CEPzFjtkD&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=466465926%2C512247839&u_h=9...

42 B
64 B

159ms
75ms

Image
image/gif

216.58.206.35
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-conversion/992191228/?random=28568274&cv=9&fst=1695978158083&num=1&label=vTDjCL3nvv4CEPzFjtkD&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=466465926%2C512247839&u_h=900&u_w=1600&u_ah=821&u_aw=1600&u_cd=24&u_his=3&u_tz=390&u_java=false&u_nplug=5&u_nmime=2&sendb=1&ig=0&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fwww.paypal.com%2Fsignin&tiba=Log%20in%20to%20your%20PayPal%20account&hn=www.google.com&gcp=2&sscte=1&ct_cookie_present=1&async=1&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECSid0cmlnZ2VyLCBldmVudC1zb3VyY2U7bmF2aWdhdGlvbi1zb3VyY2VaAwoBAWIECgICAw&pscrd=IhMI0NzwopisiQMVNKqDBx3i1A7iMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOiNodHRwczovL2JiYWQ2NjkzLjE1YWIwb3QucGFnZXMuZGV2Lw&ipr=y

Requested by

Host: bbad6693.15ab0ot.pages.dev
URL: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/country-worldwide,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Protocol

Server

216.58.206.35 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lcfraa-aa-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bbad6693.15ab0ot.pages.dev/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Sat, 26 Oct 2024 13:50:23 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
location: https://www.google.de/pagead/1p-conversion/992191228/?random=28568274&cv=9&fst=1695978158083&num=1&label=vTDjCL3nvv4CEPzFjtkD&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=466465926%2C512247839&u_h=900&u_w=1600&u_ah=821&u_aw=1600&u_cd=24&u_his=3&u_tz=390&u_java=false&u_nplug=5&u_nmime=2&sendb=1&ig=0&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fwww.paypal.com%2Fsignin&tiba=Log%20in%20to%20your%20PayPal%20account&hn=www.google.com&gcp=2&sscte=1&ct_cookie_present=1&async=1&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgjCybECSid0cmlnZ2VyLCBldmVudC1zb3VyY2U7bmF2aWdhdGlvbi1zb3VyY2VaAwoBAWIECgICAw&pscrd=IhMI0NzwopisiQMVNKqDBx3i1A7iMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOiNodHRwczovL2JiYWQ2NjkzLjE1YWIwb3QucGFnZXMuZGV2Lw&ipr=y
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Sat, 26 Oct 2024 13:50:23 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 mktgtagmanager.js Show response
www.paypalobjects.com/martech/tm/paypal/ 16 KB
7 KB 80ms
59ms Script
application/javascript 192.229.221.25
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/martech/tm/paypal/mktgtagmanager.js

Requested by

Host: www.paypalobjects.com
URL: https://www.paypalobjects.com/pa/js/min/pa.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.221.25 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (frc/4CA8) /

Resource Hash

efc3ad603dca3c78e67493adb079676731fd72c4204dbf7264d22e897a271267

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://bbad6693.15ab0ot.pages.dev
Referer: https://bbad6693.15ab0ot.pages.dev/

Response headers

paypal-debug-id: 47422d3eb868f
content-encoding: br
etag: "67042d91-3eb4+gzip+br"
access-control-allow-methods: GET
x-content-type-options: nosniff
expires: Sat, 26 Oct 2024 14:50:23 GMT
traceparent: 00-000000000000000000047422d3eb868f-450fed1ed93d76c8-01
dc: ccg11-origin-www-1.paypal.com
x-cache: HIT
date: Sat, 26 Oct 2024 13:50:23 GMT
content-type: application/javascript
last-modified: Mon, 07 Oct 2024 18:50:57 GMT
vary: Accept-Encoding
access-control-allow-headers: x-csrf-token
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: s-maxage=31536000, public,max-age=3600
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
access-control-allow-origin: *
content-length: 6604
server: ECAcc (frc/4CA8)

GET
H2 200 grcenterprise_v3_static.html
www.paypalobjects.com/webcaptcha/ Frame B07C 0
0 190ms
42ms Document
text/html 192.229.221.25
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/webcaptcha/grcenterprise_v3_static.html

Requested by

Host: bbad6693.15ab0ot.pages.dev
URL: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/country-worldwide,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.221.25 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (frc/4C97) /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://bbad6693.15ab0ot.pages.dev/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: s-maxage=31536000, public,max-age=3600
content-encoding: br
content-length: 1880
content-type: text/html
date: Sat, 26 Oct 2024 13:50:23 GMT
dc: ccg11-origin-www-1.paypal.com
etag: W/"6633898b-19bd"
expires: Sat, 26 Oct 2024 14:50:23 GMT
last-modified: Thu, 02 May 2024 12:39:39 GMT
paypal-debug-id: 5c8f7450badc3
server: ECAcc (frc/4C97)
strict-transport-security: max-age=63072000; includeSubDomains; preload
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
traceparent: 00-00000000000000000005c8f7450badc3-9d357118f9285a0c-01
vary: Accept-Encoding
x-cache: HIT
x-content-type-options: nosniff

GET
H2 200 grcenterprise_v3_static.html
www.paypalobjects.com/webcaptcha/ Frame B0F9 0
0 183ms
182ms Document
text/html 192.229.221.25
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/webcaptcha/grcenterprise_v3_static.html

Requested by

Host: www.paypalobjects.com
URL: https://www.paypalobjects.com/webcaptcha/grcenterprise_v3_static.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.221.25 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (frc/4C97) /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://bbad6693.15ab0ot.pages.dev/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: s-maxage=31536000, public,max-age=3600
content-encoding: br
content-length: 1880
content-type: text/html
date: Sat, 26 Oct 2024 13:50:23 GMT
dc: ccg11-origin-www-1.paypal.com
etag: W/"6633898b-19bd"
expires: Sat, 26 Oct 2024 14:50:23 GMT
last-modified: Thu, 02 May 2024 12:39:39 GMT
paypal-debug-id: 5c8f7450badc3
server: ECAcc (frc/4C97)
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
traceparent: 00-00000000000000000005c8f7450badc3-9d357118f9285a0c-01
vary: Accept-Encoding
x-cache: HIT
x-content-type-options: nosniff

GET
H2 200 mktconf.js Show response
www.paypalobjects.com/martech/tm/paypal/ 563 KB
36 KB 51ms
47ms Script
application/javascript 192.229.221.25
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/martech/tm/paypal/mktconf.js

Requested by

Host: www.paypalobjects.com
URL: https://www.paypalobjects.com/martech/tm/paypal/mktgtagmanager.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.221.25 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (frc/4CD5) /

Resource Hash

49e8d721e0cc0242208a27afeca5ef43d413f9c76964e177951e2ea473dadc35

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://bbad6693.15ab0ot.pages.dev
Referer: https://bbad6693.15ab0ot.pages.dev/

Response headers

paypal-debug-id: 06383b5dfc04f
content-encoding: br
etag: W/"6711371f-8cab9"
access-control-allow-methods: GET
x-content-type-options: nosniff
expires: Sat, 26 Oct 2024 14:50:23 GMT
traceparent: 00-000000000000000000006383b5dfc04f-c6c98da4b92be9a7-01
dc: ccg11-origin-www-1.paypal.com
x-cache: HIT
date: Sat, 26 Oct 2024 13:50:23 GMT
content-type: application/javascript
last-modified: Thu, 17 Oct 2024 16:11:11 GMT
vary: Accept-Encoding
access-control-allow-headers: x-csrf-token
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: s-maxage=31536000, public,max-age=3600
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
access-control-allow-origin: *
content-length: 36205
server: ECAcc (frc/4CD5)

GET
H2 200 i
c.paypal.com/v1/r/d/ Frame FCB3 0
0 221ms
207ms Document
text/html 192.229.221.25
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://c.paypal.com/v1/r/d/i?js_src=https://c.paypal.com/da/r/fb.js

Requested by

Host: c.paypal.com
URL: https://c.paypal.com/da/r/fb.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.221.25 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (frc/4CB7) /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://bbad6693.15ab0ot.pages.dev/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

accept-ch: sec-ch-ua, sec-ch-ua-mobile, sec-ch-ua-full-version, sec-ch-ua-full-version-list, sec-ch-ua-platform, sec-ch-ua-platform-version, sec-ch-ua-arch, sec-ch-ua-wow64, sec-ch-ua-bitness, sec-ch-ua-model, sec-ch-ua-full
access-control-expose-headers: Server-Timing
cache-control: max-age=0, no-cache, no-store, must-revalidate
content-encoding: gzip
content-length: 141
content-security-policy-report-only: default-src 'self' https://*.paypal.com https://*.paypalobjects.com; script-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.paypalinc.com https://www.facebook.com 'unsafe-eval' 'unsafe-inline' blob:; connect-src 'self' https://*.paypal.com; style-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; font-src 'self' https://*.paypal.com https://*.paypalobjects.com data:; img-src 'self' https: data:; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; object-src 'self' https://*.paypal.com https://*.paypalobjects.com; report-uri https://www.paypal.com/csplog/api/log/csp
content-type: text/html;charset=UTF-8
correlation-id: 9761694bc256f
date: Sat, 26 Oct 2024 13:50:23 GMT
origin-trial: A0A/uBW0ogQIica1KkPCeSOoHfvTATXdyRg8F/Ka8gjK4pCprEDwF3d3wTxNzSPn1ASb5ncpd46h7RQiSqGYpA8AAACMeyJvcmlnaW4iOiJodHRwczovL2MucGF5cGFsLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY5NTUxMzU5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=
paypal-debug-id: 9761694bc256f
server: ECAcc (frc/4CB7)
server-timing: traceparent;desc="00-00000000000000000009761694bc256f-06058e3cf2a6bca4-01" content-encoding;desc="", x-cdn;desc="edgecast"
strict-transport-security: max-age=63072000; includeSubDomains; preload
timing-allow-origin: *
traceparent: 00-00000000000000000009761694bc256f-b213ed748550bc18-01
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H/1.1

200
OK

counter2.cgi
lhr.stats.paypal.com/v1/ Frame 00F7
Redirect Chain

https://b.stats.paypal.com/v1/counter.cgi?r=cD1mOWRhZGU2MDE1YWI0OTVmODBiYWY1ZjM1NDUzMTQ4YiZpPTMxLjEzLjE4OS40JnQ9MTY5NTk3ODE1Ny40NzYmYT0yMSZzPVVOSUZJRURfTE9HSU42dqrCAJneY3SWrSmdZkDPIT8EYA
https://lhr.stats.paypal.com/v1/counter2.cgi?r=cD1mOWRhZGU2MDE1YWI0OTVmODBiYWY1ZjM1NDUzMTQ4YiZpPTMxLjEzLjE4OS40JnQ9MTY5NTk3ODE1Ny40NzYmYT0yMSZzPVVOSUZJRURfTE9HSU42dqrCAJneY3SWrSmdZkDPIT8EYA

42 B
299 B

168ms
52ms

Image
image/jpeg

34.147.177.40
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://lhr.stats.paypal.com/v1/counter2.cgi?r=cD1mOWRhZGU2MDE1YWI0OTVmODBiYWY1ZjM1NDUzMTQ4YiZpPTMxLjEzLjE4OS40JnQ9MTY5NTk3ODE1Ny40NzYmYT0yMSZzPVVOSUZJRURfTE9HSU42dqrCAJneY3SWrSmdZkDPIT8EYA
Requested by: Host: bbad6693.15ab0ot.pages.dev
URL: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/country-worldwide,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium
Protocol: HTTP/1.1
Server: 34.147.177.40 London, United Kingdom, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 40.177.147.34.bc.googleusercontent.com
Software: PayPal-B.Stats/1.0 /
Resource Hash: 47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bbad6693.15ab0ot.pages.dev/

Response headers

Content-Length: 42
Date: Sat, 26 Oct 2024 13:50:23 GMT
Content-Type: image/jpeg
Connection: close
Server: PayPal-B.Stats/1.0

Redirect headers

Location: https://lhr.stats.paypal.com/v1/counter2.cgi?r=cD1mOWRhZGU2MDE1YWI0OTVmODBiYWY1ZjM1NDUzMTQ4YiZpPTMxLjEzLjE4OS40JnQ9MTY5NTk3ODE1Ny40NzYmYT0yMSZzPVVOSUZJRURfTE9HSU42dqrCAJneY3SWrSmdZkDPIT8EYA
Content-Length: 0
Date: Sat, 26 Oct 2024 13:50:23 GMT
Content-Type: application/octet-stream
Connection: close
Server: PayPal-B.Stats/1.0

GET
H2 200 p3
c6.paypal.com/v1/r/d/b/ 0
424 B 410ms
243ms Image
text/plain 2606:2800:233:ce53:4396:b914:64c2:638e
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c6.paypal.com/v1/r/d/b/p3?f=f9dade6015ab495f80baf5f35453148b&s=UNIFIED_LOGIN_INPUT_PASSWORD

Requested by

Host: bbad6693.15ab0ot.pages.dev
URL: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/country-worldwide,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:233:ce53:4396:b914:64c2:638e , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (frc/4CE9) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bbad6693.15ab0ot.pages.dev/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-expose-headers: Server-Timing
cache-control: max-age=0, no-cache, no-store, must-revalidate
content-encoding: gzip
paypal-debug-id: 9851eb622d3d5
timing-allow-origin: *
correlation-id: 9851eb622d3d5
traceparent: 00-00000000000000000009851eb622d3d5-feb65bb6f19ba9ac-01
server-timing: traceparent;desc="00-00000000000000000009851eb622d3d5-b923ad698181207f-01", content-encoding;desc="", x-cdn;desc="edgecast"
content-length: 20
date: Sat, 26 Oct 2024 13:50:23 GMT
vary: Accept-Encoding
server: ECAcc (frc/4CE9)

GET
H2 200 i
c.paypal.com/v1/r/d/ Frame 0296 0
0 382ms
194ms Document
text/html 192.229.221.25
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://c.paypal.com/v1/r/d/i?js_src=https://c.paypal.com/da/r/fb.js

Requested by

Host: bbad6693.15ab0ot.pages.dev
URL: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/country-worldwide,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.221.25 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (frc/4CB7) /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://bbad6693.15ab0ot.pages.dev/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

accept-ch: sec-ch-ua, sec-ch-ua-mobile, sec-ch-ua-full-version, sec-ch-ua-full-version-list, sec-ch-ua-platform, sec-ch-ua-platform-version, sec-ch-ua-arch, sec-ch-ua-wow64, sec-ch-ua-bitness, sec-ch-ua-model, sec-ch-ua-full
access-control-expose-headers: Server-Timing
cache-control: max-age=0, no-cache, no-store, must-revalidate
content-encoding: gzip
content-length: 141
content-security-policy-report-only: default-src 'self' https://*.paypal.com https://*.paypalobjects.com; script-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.paypalinc.com https://www.facebook.com 'unsafe-eval' 'unsafe-inline' blob:; connect-src 'self' https://*.paypal.com; style-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; font-src 'self' https://*.paypal.com https://*.paypalobjects.com data:; img-src 'self' https: data:; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; object-src 'self' https://*.paypal.com https://*.paypalobjects.com; report-uri https://www.paypal.com/csplog/api/log/csp
content-type: text/html;charset=UTF-8
correlation-id: aa0ce344df048
date: Sat, 26 Oct 2024 13:50:23 GMT
origin-trial: A0A/uBW0ogQIica1KkPCeSOoHfvTATXdyRg8F/Ka8gjK4pCprEDwF3d3wTxNzSPn1ASb5ncpd46h7RQiSqGYpA8AAACMeyJvcmlnaW4iOiJodHRwczovL2MucGF5cGFsLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY5NTUxMzU5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=
paypal-debug-id: aa0ce344df048
server: ECAcc (frc/4CB7)
server-timing: traceparent;desc="00-0000000000000000000aa0ce344df048-5a0d4b7e941b34d0-01" content-encoding;desc="", x-cdn;desc="edgecast"
strict-transport-security: max-age=63072000; includeSubDomains; preload
timing-allow-origin: *
traceparent: 00-0000000000000000000aa0ce344df048-282fba66139ce202-01
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 200 client-ip Show response
api.bigdatacloud.net/data/ 59 B
183 B 159ms
59ms Fetch
application/json 2600:9000:a717:2fb3:95f4:1d0e:8cc4:1c6a
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.bigdatacloud.net/data/client-ip
Requested by: Host: www.paypalobjects.com
URL: https://www.paypalobjects.com/webcaptcha/ngrlCaptcha.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:a717:2fb3:95f4:1d0e:8cc4:1c6a , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 8ae269bece96624485d4de4e57b844f1dbbdf8444bf72c914f25126b1277bd4f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bbad6693.15ab0ot.pages.dev/

Response headers

access-control-allow-origin: *
content-length: 59
date: Sat, 26 Oct 2024 13:50:23 GMT
content-type: application/json; charset=utf-8
x-response-time-ms: 19.80

GET
H2 200 gtag.js Show response
www.paypalobjects.com/martech/tm/paypal/3pjs/gtag/ 79 KB
31 KB 47ms
46ms Script
application/javascript 192.229.221.25
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/martech/tm/paypal/3pjs/gtag/gtag.js

Requested by

Host: www.paypalobjects.com
URL: https://www.paypalobjects.com/martech/tm/paypal/mktgtagmanager.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.221.25 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (frc/4CEC) /

Resource Hash

0c62a9cf7b3703895bc10abed5bd122b584a9b599071216816bf997a1333b423

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://bbad6693.15ab0ot.pages.dev
Referer: https://bbad6693.15ab0ot.pages.dev/

Response headers

paypal-debug-id: 79567e95e7752
content-encoding: br
etag: "66f1ab0e-13bc8+gzip+br"
access-control-allow-methods: GET
x-content-type-options: nosniff
expires: Sat, 26 Oct 2024 14:50:23 GMT
traceparent: 00-000000000000000000079567e95e7752-8d54b027ad0768c8-01
dc: ccg11-origin-www-1.paypal.com
x-cache: HIT
date: Sat, 26 Oct 2024 13:50:23 GMT
content-type: application/javascript
last-modified: Mon, 23 Sep 2024 17:53:18 GMT
vary: Accept-Encoding
access-control-allow-headers: x-csrf-token
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: s-maxage=31536000, public,max-age=3600
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
access-control-allow-origin: *
content-length: 31866
server: ECAcc (frc/4CEC)

OPTIONS client-log
https/signin/ Frame 0
0

OPTIONS challenge.js
https/auth/createchallenge/b85e6d8ea45ea267/ Frame 0
0

OPTIONS resourceaccesstoken
192.55.233.1/ Frame 0
0

OPTIONS cookie-banner
https/signin/ Frame 0
0

OPTIONS load-resource
https/signin/ Frame 0
0

OPTIONS client-log
https/signin/ Frame 0
0

POST client-log
https/signin/ 0
0

GET challenge.js
https/auth/createchallenge/b85e6d8ea45ea267/ 0
0

POST resourceaccesstoken
192.55.233.1/ 0
0

GET cookie-banner
https/signin/ 0
0

POST load-resource
https/signin/ 0
0

POST client-log
https/signin/ 0
0

GET
H/1.1

200
OK

counter2.cgi
lhr.stats.paypal.com/v1/ Frame 7579
Redirect Chain

https://b.stats.paypal.com/v1/counter.cgi?r=cD1mOWRhZGU2MDE1YWI0OTVmODBiYWY1ZjM1NDUzMTQ4YiZpPTMxLjEzLjE4OS40JnQ9MTY5NTk3ODE1Ny40NzYmYT0yMSZzPVVOSUZJRURfTE9HSU42dqrCAJneY3SWrSmdZkDPIT8EYA
https://lhr.stats.paypal.com/v1/counter2.cgi?r=cD1mOWRhZGU2MDE1YWI0OTVmODBiYWY1ZjM1NDUzMTQ4YiZpPTMxLjEzLjE4OS40JnQ9MTY5NTk3ODE1Ny40NzYmYT0yMSZzPVVOSUZJRURfTE9HSU42dqrCAJneY3SWrSmdZkDPIT8EYA

42 B
299 B

157ms
49ms

Image
image/jpeg

34.147.177.40
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://lhr.stats.paypal.com/v1/counter2.cgi?r=cD1mOWRhZGU2MDE1YWI0OTVmODBiYWY1ZjM1NDUzMTQ4YiZpPTMxLjEzLjE4OS40JnQ9MTY5NTk3ODE1Ny40NzYmYT0yMSZzPVVOSUZJRURfTE9HSU42dqrCAJneY3SWrSmdZkDPIT8EYA
Protocol: HTTP/1.1
Server: 34.147.177.40 London, United Kingdom, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 40.177.147.34.bc.googleusercontent.com
Software: PayPal-B.Stats/1.0 /
Resource Hash: 47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bbad6693.15ab0ot.pages.dev/

Response headers

Content-Length: 42
Date: Sat, 26 Oct 2024 13:50:24 GMT
Content-Type: image/jpeg
Connection: close
Server: PayPal-B.Stats/1.0

Redirect headers

Location: https://lhr.stats.paypal.com/v1/counter2.cgi?r=cD1mOWRhZGU2MDE1YWI0OTVmODBiYWY1ZjM1NDUzMTQ4YiZpPTMxLjEzLjE4OS40JnQ9MTY5NTk3ODE1Ny40NzYmYT0yMSZzPVVOSUZJRURfTE9HSU42dqrCAJneY3SWrSmdZkDPIT8EYA
Content-Length: 0
Date: Sat, 26 Oct 2024 13:50:23 GMT
Content-Type: application/octet-stream
Connection: close
Server: PayPal-B.Stats/1.0

GET
H2 200 i
c.paypal.com/v1/r/d/ Frame 0946 0
0 208ms
206ms Document
text/html 192.229.221.25
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://c.paypal.com/v1/r/d/i?js_src=https://c.paypal.com/da/r/fb.js

Requested by

Host: c.paypal.com
URL: https://c.paypal.com/da/r/fb.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.221.25 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (frc/4CB7) /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://bbad6693.15ab0ot.pages.dev/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

accept-ch: sec-ch-ua, sec-ch-ua-mobile, sec-ch-ua-full-version, sec-ch-ua-full-version-list, sec-ch-ua-platform, sec-ch-ua-platform-version, sec-ch-ua-arch, sec-ch-ua-wow64, sec-ch-ua-bitness, sec-ch-ua-model, sec-ch-ua-full
access-control-expose-headers: Server-Timing
cache-control: max-age=0, no-cache, no-store, must-revalidate
content-encoding: gzip
content-length: 141
content-security-policy-report-only: default-src 'self' https://*.paypal.com https://*.paypalobjects.com; script-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.paypalinc.com https://www.facebook.com 'unsafe-eval' 'unsafe-inline' blob:; connect-src 'self' https://*.paypal.com; style-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; font-src 'self' https://*.paypal.com https://*.paypalobjects.com data:; img-src 'self' https: data:; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; object-src 'self' https://*.paypal.com https://*.paypalobjects.com; report-uri https://www.paypal.com/csplog/api/log/csp
content-type: text/html;charset=UTF-8
correlation-id: 3a0577a8b96a5
date: Sat, 26 Oct 2024 13:50:23 GMT
origin-trial: A0A/uBW0ogQIica1KkPCeSOoHfvTATXdyRg8F/Ka8gjK4pCprEDwF3d3wTxNzSPn1ASb5ncpd46h7RQiSqGYpA8AAACMeyJvcmlnaW4iOiJodHRwczovL2MucGF5cGFsLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY5NTUxMzU5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=
paypal-debug-id: 3a0577a8b96a5
server: ECAcc (frc/4CB7)
server-timing: traceparent;desc="00-00000000000000000003a0577a8b96a5-bf2e9392f31bcfce-01" content-encoding;desc="", x-cdn;desc="edgecast"
strict-transport-security: max-age=63072000; includeSubDomains; preload
timing-allow-origin: *
traceparent: 00-00000000000000000003a0577a8b96a5-67d7f1dd7344cdef-01
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 200 p3
c6.paypal.com/v1/r/d/b/ 0
189 B 254ms
253ms Image
text/plain 2606:2800:233:ce53:4396:b914:64c2:638e
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c6.paypal.com/v1/r/d/b/p3?f=f9dade6015ab495f80baf5f35453148b&s=UNIFIED_LOGIN_INPUT_PASSWORD

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:233:ce53:4396:b914:64c2:638e , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (frc/4C9A) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bbad6693.15ab0ot.pages.dev/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-expose-headers: Server-Timing
cache-control: max-age=0, no-cache, no-store, must-revalidate
content-encoding: gzip
paypal-debug-id: 1c8396b3713af
timing-allow-origin: *
correlation-id: 1c8396b3713af
traceparent: 00-00000000000000000001c8396b3713af-758954e21fca153d-01
server-timing: traceparent;desc="00-00000000000000000001c8396b3713af-639c40d8391b3b78-01", content-encoding;desc="", x-cdn;desc="edgecast"
content-length: 20
date: Sat, 26 Oct 2024 13:50:23 GMT
vary: Accept-Encoding
server: ECAcc (frc/4C9A)

GET
H2 200 pp_favicon_x.ico
www.paypalobjects.com/en_US/i/icon/ 5 KB
2 KB 43ms
42ms Other
image/x-icon 192.229.221.25
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/en_US/i/icon/pp_favicon_x.ico

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.221.25 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (frc/4CC7) /

Resource Hash

1690c4e20869c3763b7fc111e2f94035b0a7ee830311dd680ac91421daad3667

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bbad6693.15ab0ot.pages.dev/

Response headers

paypal-debug-id: 24d3439d2f8c5
content-encoding: br
etag: W/"5d5637bd-1536"
x-content-type-options: nosniff
expires: Sat, 26 Oct 2024 14:50:23 GMT
traceparent: 00-000000000000000000024d3439d2f8c5-1240c8c31ae4cbf8-01
dc: ccg11-origin-www-1.paypal.com
x-cache: HIT
date: Sat, 26 Oct 2024 13:50:23 GMT
content-type: image/x-icon
last-modified: Fri, 16 Aug 2019 04:57:33 GMT
vary: Accept-Encoding
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: s-maxage=31536000, public,max-age=3600
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
content-length: 1471
server: ECAcc (frc/4CC7)

POST sms
https/signin/challenge/ 0
0

OPTIONS sms
https/signin/challenge/ Frame 0
0

GET
H2 200 ts
t.paypal.com/ 42 B
633 B 236ms
206ms Image
image/gif 192.229.221.25
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.paypal.com/ts?v=1.9.2&t=1729950624407&g=-120&pgrp=main%3Aunifiedlogin%3A%3A%3Alogin&page=main%3Aunifiedlogin%3A%3A%3Alogin%3A%3A%3A&pgst=1695978157415&calc=0273691a8b51a&nsid=9r7B_qrDjlOD_M7OTOQw-ZLUlcIiJ-X0&rsta=en_US&pgtf=Nodejs&env=live&s=ci&ccpg=US&csci=1f94898facae4981aa2f255ac50754df&comp=unifiedloginnodeweb&tsrce=authchallengenodeweb&cu=1&gacook=1501423379.1729950624&ef_policy=ccpa&c_prefs=T%3D1%2CP%3D1%2CF%3D1%2Ctype%3Dexplicit_banner&transition_name=ss_prepare_pwd&userRedirected=true&xe=101735%2C101216%2C104200%2C100644%2C106273%2C106057%2C108141%2C101820%2C101817%2C108076&xt=105856%2C103864%2C127485%2C101702%2C130870%2C127561%2C138360%2C106324%2C110524%2C138090&ctx_login_ot_content=0&obex=signin&landing_page=login&browser_client_type=Browser&state_name=begin_pwd&ctx_login_ctxid_fetch=ctxid-not-exist&ctx_login_content_fetch=success&ctx_login_lang_footer=shown&ctx_login_signup_btn=shown%7Cdefault&ctx_login_intent=signin&ctx_login_flow=Signin&ctx_login_state_transition=login_loaded&post_login_redirect=default&ret_url=%2F&e=im&imsrc=setup&view=%7B%22t10%22%3A12%2C%22t11%22%3A1793%2C%22tcp%22%3A1068%2C%22et%22%3A%224g%22%2C%22nt%22%3A%22navigate%22%2C%22bt%22%3A84%7D&pt=Log%20in%20to%20your%20PayPal%20account&ru=https%3A%2F%2Fbbad6693.15ab0ot.pages.dev%2Fus%2Fwebapps%2Fmpp%2Fcountry-worldwide%2Cn%2Fa%2Chttps%3A%2Fopenphish.com%2Ffeed.txt%2C10-oct-24%2Chigh%2Cmedium&cd=24&sw=1600&sh=1200&dw=1600&dh=1200&bw=1600&bh=1200&ce=1&t1=12&t1c=0&t1d=0&t1s=0&t2=115&t3=34&t4d=0&t4=0&t4e=12&tt=1714&rdc=1&protocol=h3&res=%7B%7D&t12=1216&3p_vid=21bcd0cf2fb1dcce&3p_fpti=714b777e6ce7a8a1

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.221.25 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (frc/4CFB) /

Resource Hash

6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/country-worldwide,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-expose-headers: Server-Timing
cache-control: max-age=0, no-cache, no-store, must-revalidate
timing-allow-origin: *
paypal-debug-id: a3ac6015c7bb7
pragma: no-cache
correlation-id: a3ac6015c7bb7
expires: Sat, 26 Oct 2024 13:50:24 GMT
server-timing: traceparent;desc="00-0000000000000000000a3ac6015c7bb7-14f33222d727458b-01", content-encoding;desc="", x-cdn;desc="edgecast"
p3p: CP="CAO IND OUR SAM UNI STA COR COM"
traceparent: 00-0000000000000000000a3ac6015c7bb7-4aa392e2e402fafd-01
date: Sat, 26 Oct 2024 13:50:24 GMT
content-type: image/gif
vary: Accept-Encoding
server: ECAcc (frc/4CFB)

GET
H2 200 tr
www.facebook.com/ 0
274 B 140ms
39ms Image
text/plain 2a03:2880:f177:185:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr?id=1674696026155243&noscript=1&cd[MerchantID]=NA&cd[MerchantTransaction]=NA&cd[P2PTransaction]=NA&ev=ViewContent

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f177:185:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/country-worldwide,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=39, rtx=0, c=10, mss=1297, tbw=2885, tp=-1, tpl=-1, uplat=0, ullat=0
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
date: Sat, 26 Oct 2024 13:50:24 GMT
content-type: text/plain
server: proxygen-bolt

GET
H2 200 collect
www.google-analytics.com/r/ 35 B
603 B 152ms
50ms Image
image/gif 2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/r/collect?v=1&_v=j79&aip=1&a=1013674314&t=pageview&_s=1&dl=https%3A%2F%2Fbbad6693.15ab0ot.pages.dev%2Fus%2Fwebapps%2Fmpp%2Fcountry-worldwide%2Cn%2Fa%2Chttps%3A%2Fopenphish.com%2Ffeed.txt%2C10-oct-24%2Chigh%2Cmedium&ul=de-de&de=UTF-8&dt=Log%20in%20to%20your%20PayPal%20account&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=KGBACUABF~&jid=375109023&gjid=578703021&cid=1501423379.1729950624&tid=UA-53389718-12&_gid=1076069008.1729950624&_r=1&cd1=1501423379.1729950624&cd2=&cd3=0&cd4=https%3A%2F%2Fbbad6693.15ab0ot.pages.dev%2Fus%2Fwebapps%2Fmpp%2Fcountry-worldwide%2Cn%2Fa%2Chttps%3A%2Fopenphish.com%2Ffeed.txt%2C10-oct-24%2Chigh%2Cmedium&cd5=us&cd6=en_US&cd7=&cd10=unifiedloginnodeweb&cd19=101735%2C101216%2C104200%2C100644%2C106273%2C106057%2C108141%2C101820%2C101817%2C108076&cd20=105856%2C103864%2C127485%2C101702%2C130870%2C127561%2C138360%2C106324%2C110524%2C138090&cd22=main%3Aunifiedlogin%3A%3A%3Alogin&cd26=0&gtm=2oi4f0&z=1144939926

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bbad6693.15ab0ot.pages.dev/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:169:0"}],}
x-content-type-options: nosniff
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:169:0
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 35
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 26 Oct 2024 13:50:24 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: image/gif
server: Golfe2

GET
H2

200

/
px4.ads.linkedin.com/collect/
Redirect Chain

https://px.ads.linkedin.com/collect/?pid=2786969&fmt=gif
https://px4.ads.linkedin.com/collect/?pid=2786969&fmt=gif&e_ipv6=AQIJseam_3At-AAAAZLJF6tz-A3LonQDtbBBQP5uMCh06LwQH2nfwGu_iVjlK7ckwAPSZwE

43 B
349 B

254ms
139ms

Image
image/gif

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect/?pid=2786969&fmt=gif&e_ipv6=AQIJseam_3At-AAAAZLJF6tz-A3LonQDtbBBQP5uMCh06LwQH2nfwGu_iVjlK7ckwAPSZwE
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/country-worldwide,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
content-encoding: gzip
x-msedge-ref: Ref A: CEDAC376F96643758DF09AA5B8543783 Ref B: FRAEDGE1908 Ref C: 2024-10-26T13:50:24Z
x-li-fabric: prod-lva1
x-li-uuid: AAYlYYR5jZTOZjb7CMEn3A==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 65
date: Sat, 26 Oct 2024 13:50:24 GMT
content-type: image/gif
vary: Accept-Encoding

Redirect headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
location: https://px4.ads.linkedin.com/collect/?pid=2786969&fmt=gif&e_ipv6=AQIJseam_3At-AAAAZLJF6tz-A3LonQDtbBBQP5uMCh06LwQH2nfwGu_iVjlK7ckwAPSZwE
x-msedge-ref: Ref A: 541CA100E16740A698C9825D3C7EC3C1 Ref B: FRAEDGE1814 Ref C: 2024-10-26T13:50:24Z
x-li-fabric: prod-lva1
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-uuid: AAYlYYR1nixAMJUy0dyZog==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Sat, 26 Oct 2024 13:50:24 GMT

GET
H2 200 ts
t.paypal.com/ 42 B
456 B 193ms
192ms Image
image/gif 192.229.221.25
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.paypal.com/ts?v=1.9.2&t=1729950625408&g=-120&pgrp=main%3Aunifiedlogin%3A%3A%3Alogin&page=main%3Aunifiedlogin%3A%3A%3Alogin%3A%3A%3A&pgst=1695978157415&calc=0273691a8b51a&nsid=9r7B_qrDjlOD_M7OTOQw-ZLUlcIiJ-X0&rsta=en_US&pgtf=Nodejs&env=live&s=ci&ccpg=US&csci=1f94898facae4981aa2f255ac50754df&comp=unifiedloginnodeweb&tsrce=authchallengenodeweb&cu=1&gacook=1592299682.1695977940&ef_policy=ccpa&c_prefs=T%3D1%2CP%3D1%2CF%3D1%2Ctype%3Dexplicit_banner&transition_name=ss_prepare_pwd&userRedirected=true&xe=101735%2C101216%2C104200%2C100644%2C106273%2C106057%2C108141%2C101820%2C101817%2C108076&xt=105856%2C103864%2C127485%2C101702%2C130870%2C127561%2C138360%2C106324%2C110524%2C138090&ctx_login_ot_content=0&obex=signin&landing_page=login&browser_client_type=Browser&state_name=begin_pwd&ctx_login_ctxid_fetch=ctxid-not-exist&ctx_login_content_fetch=success&ctx_login_lang_footer=shown&ctx_login_signup_btn=shown%7Cdefault&ctx_login_intent=signin&ctx_login_flow=Signin&ctx_login_state_transition=login_loaded&post_login_redirect=default&ret_url=%2F&event_name=t_paypal_cpl&t1=28&t1c=0&t1d=0&t1s=0&t2=208&t3=2&tt=238&protocol=h2&cdn=edgecast&tmpl=%2F%2Ft.paypal.&view=%7B%22t10%22%3A28%2C%22t11%22%3A238%2C%22nt%22%3A%22res%22%7D&e=pf&3p_vid=21bcd0cf2fb1dcce&3p_fpti=714b777e6ce7a8a1

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.221.25 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (frc/4CBC) /

Resource Hash

6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/country-worldwide,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-expose-headers: Server-Timing
cache-control: max-age=0, no-cache, no-store, must-revalidate
timing-allow-origin: *
paypal-debug-id: 5efc5233d24cf
pragma: no-cache
correlation-id: 5efc5233d24cf
expires: Sat, 26 Oct 2024 13:50:25 GMT
server-timing: traceparent;desc="00-00000000000000000005efc5233d24cf-bed73afcb4af21ac-01", content-encoding;desc="", x-cdn;desc="edgecast"
p3p: CP="CAO IND OUR SAM UNI STA COR COM"
traceparent: 00-00000000000000000005efc5233d24cf-eb0dc4c8098969b9-01
date: Sat, 26 Oct 2024 13:50:25 GMT
content-type: image/gif
vary: Accept-Encoding
server: ECAcc (frc/4CBC)

GET
H2 200 ts
t.paypal.com/ 42 B
499 B 192ms
192ms Image
image/gif 192.229.221.25
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.paypal.com/ts?v=1.9.2&t=1729950625409&g=-120&pgrp=main%3Aunifiedlogin%3A%3A%3Alogin&page=main%3Aunifiedlogin%3A%3A%3Alogin%3A%3A%3A&pgst=1695978157415&calc=0273691a8b51a&nsid=9r7B_qrDjlOD_M7OTOQw-ZLUlcIiJ-X0&rsta=en_US&pgtf=Nodejs&env=live&s=ci&ccpg=US&csci=1f94898facae4981aa2f255ac50754df&comp=unifiedloginnodeweb&tsrce=authchallengenodeweb&cu=1&gacook=1592299682.1695977940&ef_policy=ccpa&c_prefs=T%3D1%2CP%3D1%2CF%3D1%2Ctype%3Dexplicit_banner&transition_name=ss_prepare_pwd&userRedirected=true&xe=101735%2C101216%2C104200%2C100644%2C106273%2C106057%2C108141%2C101820%2C101817%2C108076&xt=105856%2C103864%2C127485%2C101702%2C130870%2C127561%2C138360%2C106324%2C110524%2C138090&ctx_login_ot_content=0&obex=signin&landing_page=login&browser_client_type=Browser&state_name=begin_pwd&ctx_login_ctxid_fetch=ctxid-not-exist&ctx_login_content_fetch=success&ctx_login_lang_footer=shown&ctx_login_signup_btn=shown%7Cdefault&ctx_login_intent=signin&ctx_login_flow=Signin&ctx_login_state_transition=login_loaded&post_login_redirect=default&ret_url=%2F&event_name=c_paypal_cpl&t1=8&t1c=0&t1d=0&t1s=0&t2=207&t3=1&tt=217&protocol=h2&cdn=edgecast&tmpl=%2F%2Fc.paypal.&view=%7B%22t10%22%3A8%2C%22t11%22%3A217%2C%22nt%22%3A%22res%22%7D&e=pf&3p_vid=21bcd0cf2fb1dcce&3p_fpti=714b777e6ce7a8a1

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.221.25 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (frc/4CBE) /

Resource Hash

6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/country-worldwide,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-expose-headers: Server-Timing
cache-control: max-age=0, no-cache, no-store, must-revalidate
timing-allow-origin: *
paypal-debug-id: 7af60fdae0d18
pragma: no-cache
correlation-id: 7af60fdae0d18
expires: Sat, 26 Oct 2024 13:50:25 GMT
server-timing: traceparent;desc="00-00000000000000000007af60fdae0d18-d10ff9f50f0ac907-01", content-encoding;desc="", x-cdn;desc="edgecast"
p3p: CP="CAO IND OUR SAM UNI STA COR COM"
traceparent: 00-00000000000000000007af60fdae0d18-16cc0fc2972ad341-01
date: Sat, 26 Oct 2024 13:50:25 GMT
content-type: image/gif
vary: Accept-Encoding
server: ECAcc (frc/4CBE)

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: https
URL: https://https/signin/client-log

Domain: https
URL: https://https/signin/client-log

Domain: https
URL: https://https/auth/createchallenge/b85e6d8ea45ea267/challenge.js

Domain: 192.55.233.1
URL: https://192.55.233.1/resourceaccesstoken

Domain: https
URL: https://https/signin/cookie-banner?

Domain: https
URL: https://https/signin/load-resource

Domain: https
URL: https://https/signin/client-log

Domain: https
URL: https://https/signin/client-log

Domain: https
URL: https://https/signin/client-log

Domain: https
URL: https://https/auth/createchallenge/b85e6d8ea45ea267/challenge.js

Domain: 192.55.233.1
URL: https://192.55.233.1/resourceaccesstoken

Domain: https
URL: https://https/signin/cookie-banner?

Domain: https
URL: https://https/signin/load-resource

Domain: https
URL: https://https/signin/client-log

Domain: https
URL: https://https/signin/challenge/sms

Domain: https
URL: https://https/signin/challenge/sms

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial) Generic Cloudflare (Online)

48 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

15 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.bbad6693.15ab0ot.pages.dev/	1970-01-21 00:33:57	Name: __cf_mw_byp Value: oawiR8KqU2hjd7sJg1LW0xLKPv8qDXm_qjwoQtuFINA-1729950616-0.0.1.1-/us/webapps/mpp/country-worldwide,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium
.doubleclick.net/	1970-01-21 00:32:31	Name: test_cookie Value: CheckForPermission
.15ab0ot.pages.dev/	1969-12-31 23:59:59	Name: TLTSID Value: 24588412331441648046950073290101
.15ab0ot.pages.dev/	1970-01-21 02:42:06	Name: _gcl_au Value: 1.1.1521642211.1729950623
.15ab0ot.pages.dev/	1970-01-21 10:08:30	Name: _ga Value: GA1.3.1501423379.1729950624
.15ab0ot.pages.dev/	1970-01-21 00:33:57	Name: _gid Value: GA1.3.1076069008.1729950624
.paypal.com/	1970-01-21 10:08:30	Name: sc_f Value: PulUAM8q5pu-H-k97eeuWyHy1JxuY-RbpcwtPtSy8X13xk3BtlOF6Qw6iMSuIePj7axuTLym1hIFafRvZ9pppz6IMZV-TKHSqegXI0
.paypal.com/	1970-01-21 10:08:30	Name: KHcl0EuY7AKSMgfvHl7J5E7hPtK Value: 6DafThxwLi1xLp3hvvUOaaHgq8LRpGcHhu3Kojojr9xxU7o1U_HHbtWPMgrfqI6OnEvWXmxxHb7jKXtA
.paypal.com/	1970-01-21 00:32:32	Name: l7_az Value: dcg16.slc
.15ab0ot.pages.dev/	1970-01-21 00:32:30	Name: _gat_gtag_UA_53389718_12 Value: 1
.paypal.com/	1970-01-21 10:08:30	Name: ts_c Value: vr%3D714b777e6ce7a8a1%26vt%3D21bcd0cf2fb1dcce
.linkedin.com/	1970-01-21 09:18:06	Name: bcookie Value: "v=2&a068eeb1-1d11-4cf0-8b14-882d1cfbf23f"
.linkedin.com/	1970-01-21 04:51:42	Name: li_gc Value: MTswOzE3Mjk5NTA2MjQ7MjswMjFt0c+LpxRveEygcGjPRuHCdiSO2Ve7FdeP24eQx6QGeQ==
.linkedin.com/	1970-01-21 00:33:57	Name: lidc Value: "b=VGST08:s=V:r=V:a=V:p=V:g=3052:u=1:x=1:i=1729950624:t=1730037024:v=2:sig=AQGksojkaEmBx5LtR09yaJlVgdWACMJ2"
.paypal.com/	1970-01-21 10:08:30	Name: ts Value: vreXpYrS%3D1824558625%26vteXpYrS%3D1729952425%26vr%3D714b777e6ce7a8a1%26vt%3D21bcd0cf2fb1dcce

11 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/country-worldwide,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://bbad6693.15ab0ot.pages.dev/favicon.ico Message: Failed to load resource: the server responded with a status of 403 ()
recommendation	verbose	URL: https://bbad6693.15ab0ot.pages.dev/us/webapps/mpp/country-worldwide,n/a,https:/openphish.com/feed.txt,10-oct-24,high,medium Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o
network	error	URL: https://https/signin/client-log Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: https://https/signin/load-resource Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: https://https/auth/createchallenge/b85e6d8ea45ea267/challenge.js Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: https://https/signin/cookie-banner? Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: https://https/signin/client-log Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: https://https/signin/client-log Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: https://https/signin/challenge/sms Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
javascript	error	URL: https://www.paypalobjects.com/webcaptcha/ngrlCaptcha.min.js Message: Fetch API cannot load https://https/platform/tealeaftarget. Request mode is "same-origin" but the URL's origin is not same as the request origin https://bbad6693.15ab0ot.pages.dev.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

192.55.233.1
api.bigdatacloud.net
b.stats.paypal.com
bbad6693.15ab0ot.pages.dev
c.paypal.com
c6.paypal.com
googleads.g.doubleclick.net
https
lhr.stats.paypal.com
px.ads.linkedin.com
px4.ads.linkedin.com
t.paypal.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.paypalobjects.com
192.55.233.1
https
13.107.42.14
142.250.185.228
142.250.186.34
172.66.47.3
192.229.221.25
216.58.206.35
2600:9000:a717:2fb3:95f4:1d0e:8cc4:1c6a
2606:2800:233:ce53:4396:b914:64c2:638e
2620:1ec:21::14
2a00:1450:4001:828::200e
2a03:2880:f177:185:face:b00c:0:25de
34.147.177.40
0311e7cd1ff9b287c7099126ae78265a48fc8adb1a6e060731a503b2e41313f0
07d4a44d248156a0e3d0c604d7359e54f3b021eeec70b7c3a1d127a141f76d97
0c62a9cf7b3703895bc10abed5bd122b584a9b599071216816bf997a1333b423
13e4806e5c517e074ab1ea26fe0f2b7b87eaa3988006f35ed0bd4c89502d0d79
1690c4e20869c3763b7fc111e2f94035b0a7ee830311dd680ac91421daad3667
1f70ff447ed799a34f4c3ae37ef1f49ed4af71123ba2c2aefe354565354284be
21f89c7c27f0eab13388645aea1eedb4a342c06333a14d74c1a10dfca04d6455
2ae6779c6c3579643ab6deb5cfb822e843bf637d006a4ec25d9857ec7fb6d8c1
2c6bd1749d24699d1800314c498bfff3eaf5ded67fe354f96fd00d274ca9513c
47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292
49e8d721e0cc0242208a27afeca5ef43d413f9c76964e177951e2ea473dadc35
4a77d272b8cf508cc4a7e0da5763faa9958e42a5554fdb5d29fc3be51d685653
4f3ce6ed02764246b3431d0a8e1aeec9ea10915d801a4b48957ed264d98a28dd
55ed4f12d94d0e62c76d391eb9c1ed1b4358fae88f0636a3c039b7b6d449115a
586f0eb92dcb65651bb48a4d846c39f6cb02d7f9ce88943a2a45fbac7d863334
612ed2dee283ca8cb0258ed73b67e21feaa79a3927fd896396cdb87bb79c94d7
62a4e3fe56286026c23ae5891f4222bd9a455f393af54d88ba443eecba0e6600
62bb5685d837089cd6aedb6f5fe5375c83ce5facc879632628e1e63e51399580
6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93
702863c9f873351ea934d09f4b479b45cd7a8a175974586974cb37870c3e9230
75c159c9974a7207171cf1f4ed302f91f90ae95233fdd64e994fd66ada89ab20
77d5fe96defd6c8c1e3b0466b4827cf83dc7e5c727a10177e115d25132fa86f6
8102e9e9aacd7429d30cf0a40c351dcbbc8c92d6e9783e4b1c1168504b5a36a3
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091
8766a4211434d2c318fbfa412ea9633b385ecf1cab6119f8894019d91ed7e027
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
8ae269bece96624485d4de4e57b844f1dbbdf8444bf72c914f25126b1277bd4f
8b202d5bd55968ce4bfc21c063166eaebe62104275ce7ec362d78b64b2581c95
a552fd96fd272c7f809539fe8f33e9dd5a57d2566182eae300811532e4e8ee72
a6c3bff965978df8093c3a29f7071c21d7439a212af41e7b40ce70d94d6bcc44
aa3020d20fe753464cc473d2afb758a43f77a2404671c663d511f686d4f4c0e2
d81bfefd8585b694222d3e94e9dee5d7935049c65355f9fd096800301d51545b
dffbf1e03a7b33f462ebe78658f895301e8b25b10ff52f004cd7e24c1c208d03
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efc3ad603dca3c78e67493adb079676731fd72c4204dbf7264d22e897a271267
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016
f982a9dad50b916735a08b8e6f40efa7f97163106b18da079b144764c86a44a1

bbad6693.15ab0ot.pages.dev Open in urlscan Pro 172.66.47.3 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

65 Requests

69 %HTTPS

42 %IPv6

11 Domains

17 Subdomains

12 IPs

3 Countries

568 kBTransfer

2084 kBSize

15 Cookies

13 Outgoing links

Page URL History

Redirected requests

65 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

bbad6693.15ab0ot.pages.dev Open in urlscan Pro
172.66.47.3 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

65
Requests

69 %
HTTPS

42 %
IPv6

11
Domains

17
Subdomains

12
IPs

3
Countries

568 kB
Transfer

2084 kB
Size

15
Cookies

65 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!