{"report_id":"3ec26952-577c-4d3f-86f3-1ccf943a9675","version":6,"status":"done","tags":[],"date":"2026-01-06T13:48:45Z","url":{"schema":"http","addr":"paypal.whapps.com","fqdn":"paypal.whapps.com","domain":"whapps.com","tld":"com"},"ip":{"addr":"18.233.218.64","port":0,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"paypal.whapps.com/","fqdn":"paypal.whapps.com","domain":"whapps.com","tld":"com"},"title":"Welcome| PayPal Rewards","dom":{"size":5983,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (637)","md5":"7f92b5aa394da0b5b77fa90b6fe34166","sha1":"7165a119a488bf4400fae863cbde8de41767e7e9","sha256":"df8c2daa875f538ac91beea39e1fc811448c69a1ec46742060ff0e2cd59e13ec","sha512":"83b49439c2cb54a14e728b021daf023ff01bd8529823b3fb51594ce66a35ed82ec2278cfc83e557d0182dd068305a3c8aac4bae9772e9ae9d3f22db88533e633","ssdeep":"96:T/+vhgmGAKBTItDOrtsEMVsk3pHedvgKBKV3E2G9tnVfVf2+o:yZgmGLBTItDOre73pHedvrwV3vGvnVfk","tlshash":"c5c18577ac40857f016325e1bd31b228f5e3aa4fde06c815b5fe82291fa0fc98d1298d","dom_hash":"domhash71ac9537fe5aa21d1d065a8dbd83bed0","first_seen":"2026-01-06T04:18:20.046189Z","last_seen":"2026-01-06T13:48:50.743883Z","times_seen":3,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"paypal.whapps.com","fqdn":"paypal.whapps.com","domain":"whapps.com","tld":"com"},"ip":{"addr":"18.233.218.64","port":0,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-02-10T13:48:45Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"paypal.whapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"paypal.whapps.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"paypal.whapps.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null},"summary":[{"fqdn":"www.googletagmanager.com","ip":{"addr":"142.250.178.104","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2011-11-11","domain_rank":283,"first_seen":"2012-10-04T01:07:32Z","last_seen":"2026-01-04T22:18:41.67311Z","alert_count":0,"request_count":1,"received_data":307252,"sent_data":436,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"paypal.whapps.com","ip":{"addr":"18.233.218.64","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"domain_registered":"2002-09-11","domain_rank":0,"first_seen":"2025-10-25T16:59:14.966901Z","last_seen":"2026-01-06T04:18:21.780206Z","alert_count":41,"request_count":14,"received_data":3542496,"sent_data":7155,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"jQuery Modal:0.9.1","description":"jQuery Modal is an overlay dialog box or in other words, a popup window that is made to display on the top or 'overlayed' on the current page.","website":"https://jquerymodal.com","common_platform_enumeration":"","icon":"jQuery Modal.png","categories":["JavaScript libraries"]},{"name":"ZURB Foundation","description":"Zurb Foundation is used to prototype in the browser. Allows rapid creation of websites or applications while leveraging mobile and responsive technology. The front end framework is the collection of HTML, CSS, and Javascript containing design patterns.","website":"https://foundation.zurb.com","common_platform_enumeration":"","icon":"ZURB Foundation.png","categories":["UI frameworks"]},{"name":"Modernizr","description":"Modernizr is a JavaScript library that detects the features available in a user's browser.","website":"https://modernizr.com","common_platform_enumeration":"","icon":"Modernizr.svg","categories":["JavaScript libraries"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Glyphicons","description":"Glyphicons are icon fonts which you can use in your web projects.","website":"https://glyphicons.com","common_platform_enumeration":"","icon":"Glyphicons.png","categories":["Font scripts"]},{"name":"cdnjs","description":"cdnjs is a free distributed JS library delivery service.","website":"https://cdnjs.com","common_platform_enumeration":"","icon":"cdnjs.svg","categories":["CDN"]},{"name":"Google Tag Manager","description":"Google Tag Manager is a tag management system (TMS) that allows you to quickly and easily update measurement codes and related code fragments collectively known as tags on your website or mobile app.","website":"https://www.google.com/tagmanager","common_platform_enumeration":"","icon":"Google Tag Manager.svg","categories":["Tag managers"]},{"name":"jQuery:1.10.2","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"jQuery UI:1.10.4","description":"jQuery UI is a collection of GUI widgets, animated visual effects, and themes implemented with jQuery, Cascading Style Sheets, and HTML.","website":"https://jqueryui.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery_ui:*:*:*:*:*:*:*:*","icon":"jQuery UI.svg","categories":["JavaScript libraries"]}]},{"fqdn":"cdnjs.cloudflare.com","ip":{"addr":"104.17.25.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2009-02-17","domain_rank":1222,"first_seen":"2012-05-23T12:49:49Z","last_seen":"2026-01-04T22:21:06.427471Z","alert_count":0,"request_count":2,"received_data":10185,"sent_data":933,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/jquery-modal/0.9.1/jquery.modal.min.js","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.25.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"c8f50397e0560719c62a35318f413e16","sha1":"a643db87287e6e940fbabe6d8cfee5a8775692d8","sha256":"a7e8ed2d7bbdbcaeeee81c3433f057d64a32c000112bbd09b5969fc658d0a655","sha512":"fcf2d708251c814a4b84572e7c2f6ca64c0162267f7f5a6007e94e7a475abb4b9ee36da58a91a19196c451bf6ef223b6249d9171bb620b2bdb50fa11d88bc2a0","ssdeep":"96:jPCbS/KZzQeF0VczC5x4MIKG3okQ9vGmzSUXd7INVdYH9LzYIED1OlX:jKbS2QeqV3v4MdG3zQBHzS+PYIED1O","tlshash":"65a11f0beebc635902ff90aa3d9e1d394135a2b06407448c7578cbd979a8c08606fe7a","size":4953,"data":"","first_seen":"2023-03-07T01:17:29Z","last_seen":"2026-08-05T14:46:03.395572Z","times_seen":9202,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.googletagmanager.com/gtm.js?id=GTM-T7ZF7ZZ","fqdn":"www.googletagmanager.com","domain":"googletagmanager.com","tld":"com"},"ip":{"addr":"142.250.178.104","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"a6f870dcb47b0ef8bf9f3678a8b52739","sha1":"2fcd82b5d0e8fc392dd6fcc1c43dea2929b2aa07","sha256":"3ba81262dc4d5affee378f791aa003f6124f563f9a6d0bdac80f18f9863c87ca","sha512":"d9c6fe28164de7b1cb1113a873361863d17d2b8be924f4ec673f17b4b6c35e4d16ffca1c1d79d9cfb73356d4bf7f6a1fe7185c1927ca24b0ec23fb65a671e4a2","ssdeep":"3072:Ntb7EgrCXsmRnE07T4oKtis+KkJAHGkiUgAlXbBeitt28M9O9pC6MRKkaWIL9LKL:TwsmT1BIiU7lkOt28Mk9TMRKkaWILhKL","tlshash":"0f6419c9b3da742683a36478503f114bb23b79d1f84cd894e186d8d42e74aaa4237f7d","size":306602,"data":"","first_seen":"2026-01-06T13:48:50.769007Z","last_seen":"2026-01-06T13:48:50.769007Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"paypal.whapps.com/js/jquery-ui-1.10.4.custom.min.js","fqdn":"paypal.whapps.com","domain":"whapps.com","tld":"com"},"ip":{"addr":"18.233.218.64","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"56f60b8ac0f9071db25d47be95f317f5","sha1":"956dc8fc66832f0ead42f7e35e4482a9df6f0d22","sha256":"629ecc8ed5b1fb1b78f8bdeef193d6920ad87c0628c5776b06fd94abed845dc2","sha512":"6e096e1b1e516fc4d0eeb5b50008551278d55f03128b88578f3c660ae9940887735f31843ebddba79041c7af0adcdf61babebc8d6ef0e654dd18cbd9d53535fc","ssdeep":"3072:RIIzwZCUDmOPpYAFGh+5S+T8B0FBXiW1q:GEwjDDWf+VT8CFB+","tlshash":"5824084d72413636a1efe265103b260ba237655da605805cb03ccede5e7de0472bbfba","size":217751,"data":"","first_seen":"2025-01-27T19:01:15.204594Z","last_seen":"2026-06-17T14:59:44.672918Z","times_seen":28,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"paypal.whapps.com/","fqdn":"paypal.whapps.com","domain":"whapps.com","tld":"com"},"ip":{"addr":"18.233.218.64","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"ceb3a7ab124bef742206e49a9e9af1ee","sha1":"78edbbe6b02f920f90b73ea54140b2266b3b0ada","sha256":"49e3dec9589ef52324718d53dec9f9a917a3d38f0485c2974603211bd814a22f","sha512":"6c5bfa53ed1fafcceb8c39bee7e49ccc15bc89b8c28e2a50389209bc4927d128c55ab79000dffc1e598e1c5b0e85aedf71f8970feb2eefcde45c753d2192c65d","ssdeep":"","tlshash":"58e0c0db70121871619f8ab633b5e1247253260d780d1c23fdfd88242f58587483219c","size":405,"data":"","first_seen":"2026-01-06T04:18:20.084061Z","last_seen":"2026-06-17T14:59:44.679814Z","times_seen":23,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"paypal.whapps.com/js/jquery-1.10.2.min.js","fqdn":"paypal.whapps.com","domain":"whapps.com","tld":"com"},"ip":{"addr":"18.233.218.64","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"628072e7212db1e8cdacb22b21752cda","sha1":"0511abe9863c2ea7084efa7e24d1d86c5b3974f1","sha256":"0ba081f546084bd5097aa8a73c75931d5aa1fc4d6e846e53c21f98e6a1509988","sha512":"3aa68568ff2592ead412a0c7f5c39abc37ac562f00b7c16af07cd5eff881aadce77ec71040b36c0ad9c2d2aa4edd7744fa72b0f44cb8b485d4f283b1b49c2141","ssdeep":"1536:L4mCgi8DyCuXXFiJ+L0kJQsJVPEKLQRZdC/RlfDknv+p0WzH/IoSZ7qABZnu0sFv:LGsKXlI2p0WPSbDrstfam","tlshash":"3f93f8ddb2d1b06257bb21bd006f540ff236195e280d8850f129e8eabc74a4d9277fad","size":93107,"data":"","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-08-06T00:00:27.92152Z","times_seen":16923,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"paypal.whapps.com/js/foundation-5.3.1.hacked.min.js","fqdn":"paypal.whapps.com","domain":"whapps.com","tld":"com"},"ip":{"addr":"18.233.218.64","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"de30f608db481b699682f3be406e47ee","sha1":"5a33c06b98543e49c6bd04e99c7819302781c17f","sha256":"61a591d617bf0952a2fbdfb4a3732a965f3d6f811744459e23a8c97804ce907a","sha512":"b14885443e9dae9b893828fe6db0530e2a20fc5a823dc5ecd207fa95eead0b67aacc5552b82e47dab021b424fd7ef624651e1f35d6945847a5c85a7bfd835302","ssdeep":"1536:QrwQRo+aCWsQC0ZNDHbeO5eTjYRPj0QQMfEWfSKBUQwF4AEVdihVNPFk+8NXQpB1:Q43YTWh+H8QMgXlt8pu","tlshash":"ac93e706f2a1306a11ff75b5412f130121335869aa15a83cbd7cc6e99ab8d8d2177ffe","size":91942,"data":"","first_seen":"2025-01-27T19:01:15.209868Z","last_seen":"2026-06-17T14:59:44.666562Z","times_seen":28,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"paypal.whapps.com/","fqdn":"paypal.whapps.com","domain":"whapps.com","tld":"com"},"ip":{"addr":"18.233.218.64","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"e339e1517cc1b5fd85e1abb607d2070b","sha1":"0e27049b08c55bc951902ad9da3c9b0b857adda5","sha256":"43b79dcc045b93930935506f934a5874fd7d8592aceb82599bc0902fa3515cbb","sha512":"1a28fe8cb5da04220f15317faa6706c7ee232d463356ac6f1d4ef9a4f70912927f91d16dc7019a1d09e821a4e0daa537b60cbcd690c10bbc79e0936673862ae1","ssdeep":"","tlshash":"9d01a35964b9e711083330f00e3fa4405f37712b520dde50380e5aa40f5e9008229f58","size":759,"data":"","first_seen":"2026-01-06T04:18:20.085971Z","last_seen":"2026-05-30T23:52:40.549618Z","times_seen":22,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"paypal.whapps.com/js/modernizr.js","fqdn":"paypal.whapps.com","domain":"whapps.com","tld":"com"},"ip":{"addr":"18.233.218.64","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"f9c69557ae28ea51a2c81ae0795eaef5","sha1":"a44970d8bbe4637ae926e700f7645b18f6ef7a8e","sha256":"3485afabf51bc73fae971d455ee54a9a569fa03f450aa8cc9c7f8561c9db894d","sha512":"ce9dff7bc8c3069f395898fa4450fd027b8cfb6d3dc8f422861fd41433e1c9d4e7b3fd48e89ea65f0a6739bf93049be57157948198fa40dd4ad4680ba3b73d76","ssdeep":"192:lzMdVOKMW+dftBRCzHYxqG1uTyKVOlzEf7jQLJZMYWABl8xAfo:lYdV7MjCjYxqG1uTulAfXQLJRNCxAQ","tlshash":"ef32c78eb2937109535ba07b21bf460ff27d98d9552848e4e059c5acbe34ce4427bf2d","size":11252,"data":"","first_seen":"2023-03-09T11:38:30Z","last_seen":"2026-06-17T14:59:44.656982Z","times_seen":70,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"paypal.whapps.com/css/app.css","fqdn":"paypal.whapps.com","domain":"whapps.com","tld":"com"},"ip":{"addr":"18.233.218.64","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://paypal.whapps.com/","date":"2026-01-06T13:48:24.524Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.claim.whapps.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Fri, 06 Jun 2025 00:00:00 GMT","end":"Sat, 04 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"52:FC:FC:E2:E2:0B:C7:C2:93:6A:F1:A2:FA:DF:3B:A7:79:E0:7F:C8","sha256":"42:7A:07:98:46:98:93:89:3A:0F:DE:1D:09:57:77:0E:45:E5:A2:59:77:94:A8:F2:8D:27:74:95:A2:6F:26:1F"}}},"request":{"raw":"GET /css/app.css HTTP/1.1\r\nHost: paypal.whapps.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://paypal.whapps.com/\r\nCookie: plack_session=a319e7460150263b378b3de371b6152ab2e65ab2\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 06 Jan 2026 13:48:24 GMT\r\ncontent-type: text/css\r\nserver: nginx\r\nlast-modified: Fri, 10 Sep 2021 16:50:05 GMT\r\netag: \"613b8cbd-69f07\"\r\nexpires: Tue, 06 Jan 2026 13:53:24 GMT\r\npragma: public\r\ncache-control: max-age=300, public, must-revalidate, proxy-revalidate\r\naccept-ranges: bytes\r\ncontent-encoding: gzip\r\nx-cham: c5-utility-prod-us-east-1b-1\r\ncorrelation-id: i-07987cf8d5762b29b:us-east-1b:695D129B:10F248F:5014\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":433927,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"bcf9b231511cdd5325b1b641e3dd1a06","sha1":"d9b202a7381c9e6a370bc7c17b370b737f2c846b","sha256":"9ab04e389afebc03d540e62b2a6dd4b9934982963a9af8c60486c155d13cb858","sha512":"b424ff49ba436b12fcd7b87eacb5c005a85f7df672db43455184d3043914776a5da4df8cd0cd4ad0be9b7a0e0c4d9c9e93f63ed76dad9991e09d05e0a523e689","ssdeep":"3072:zkTlT9MMT6qqEAfUTOXHEPUJTjT6qyReQO:UMBEAhXMzReQO","tlshash":"7494a8831bf313053612c6a56b776a5573260443c66edc78becc21a8ef8e9c541a3bdb","first_seen":"2026-01-06T04:18:20.077965Z","last_seen":"2026-02-14T18:51:48.821284Z","times_seen":18,"resource_available":false,"data":null}},"time_used":189,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":189,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"paypal.whapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"paypal.whapps.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"paypal.whapps.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"paypal.whapps.com/css/glyphicons.css","fqdn":"paypal.whapps.com","domain":"whapps.com","tld":"com"},"ip":{"addr":"18.233.218.64","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://paypal.whapps.com/","date":"2026-01-06T13:48:24.532Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.claim.whapps.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Fri, 06 Jun 2025 00:00:00 GMT","end":"Sat, 04 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"52:FC:FC:E2:E2:0B:C7:C2:93:6A:F1:A2:FA:DF:3B:A7:79:E0:7F:C8","sha256":"42:7A:07:98:46:98:93:89:3A:0F:DE:1D:09:57:77:0E:45:E5:A2:59:77:94:A8:F2:8D:27:74:95:A2:6F:26:1F"}}},"request":{"raw":"GET /css/glyphicons.css HTTP/1.1\r\nHost: paypal.whapps.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://paypal.whapps.com/\r\nCookie: plack_session=a319e7460150263b378b3de371b6152ab2e65ab2\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 06 Jan 2026 13:48:24 GMT\r\ncontent-type: text/css\r\nserver: nginx\r\nlast-modified: Wed, 19 May 2021 15:40:59 GMT\r\netag: \"60a5318b-e5ae\"\r\nexpires: Tue, 06 Jan 2026 13:53:24 GMT\r\npragma: public\r\ncache-control: max-age=300, public, must-revalidate, proxy-revalidate\r\naccept-ranges: bytes\r\ncontent-encoding: gzip\r\nx-cham: c5-utility-prod-us-east-1b-1\r\ncorrelation-id: i-07987cf8d5762b29b:us-east-1b:695D12A8:10F24CC:5014\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":58798,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"f64a405f390c68a64667d9876657ff10","sha1":"c404cef0a940118a22ce3271634cd875fa163729","sha256":"50f9b7b3df481dad6cc9f1417a16a248499cb0caeb67963db64b2336b081b4c2","sha512":"a9ed0f731c599ec8fa53a1bfe1f5607f1517a1942168e279ba50b91b98523745990b784448d1b5e6a2d97d0008c95c55d466cd15b34429dc5756c24d09faf112","ssdeep":"192:WE1pONmEau7JbEh4zX0jxrQvPvpuCD+Cw7MwysjFCt0PRjd3wSQUFYGfQXpgTVoK:GwEauaCgyGw04HDRjGmPK2eYoRr/","tlshash":"8043c691b6ab98467707d1b1299123526b2ef385dc2aad5cc27f3dacb3f01b0e0535e4","first_seen":"2024-08-29T17:36:55.711232Z","last_seen":"2026-06-17T14:59:44.670321Z","times_seen":31,"resource_available":false,"data":null}},"time_used":282,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":282,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"paypal.whapps.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"paypal.whapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"paypal.whapps.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"paypal.whapps.com/js/jquery-1.10.2.min.js","fqdn":"paypal.whapps.com","domain":"whapps.com","tld":"com"},"ip":{"addr":"18.233.218.64","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://paypal.whapps.com/","date":"2026-01-06T13:48:24.537Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.claim.whapps.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Fri, 06 Jun 2025 00:00:00 GMT","end":"Sat, 04 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"52:FC:FC:E2:E2:0B:C7:C2:93:6A:F1:A2:FA:DF:3B:A7:79:E0:7F:C8","sha256":"42:7A:07:98:46:98:93:89:3A:0F:DE:1D:09:57:77:0E:45:E5:A2:59:77:94:A8:F2:8D:27:74:95:A2:6F:26:1F"}}},"request":{"raw":"GET /js/jquery-1.10.2.min.js HTTP/1.1\r\nHost: paypal.whapps.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://paypal.whapps.com/\r\nCookie: plack_session=a319e7460150263b378b3de371b6152ab2e65ab2\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 06 Jan 2026 13:48:24 GMT\r\ncontent-type: application/x-javascript\r\nserver: nginx\r\nlast-modified: Wed, 19 May 2021 15:40:59 GMT\r\netag: \"60a5318b-16bb3\"\r\nexpires: Tue, 06 Jan 2026 13:53:24 GMT\r\npragma: public\r\ncache-control: max-age=300, public, must-revalidate, proxy-revalidate\r\naccept-ranges: bytes\r\ncontent-encoding: gzip\r\nx-cham: c5-utility-prod-us-east-1b-1\r\ncorrelation-id: i-07987cf8d5762b29b:us-east-1b:695D12A8:10F24CE:5014\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":93107,"size_decoded":0,"mime_type":"application/x-javascript","magic":"JavaScript source, ASCII text, with very long lines (32072)","md5":"628072e7212db1e8cdacb22b21752cda","sha1":"0511abe9863c2ea7084efa7e24d1d86c5b3974f1","sha256":"0ba081f546084bd5097aa8a73c75931d5aa1fc4d6e846e53c21f98e6a1509988","sha512":"3aa68568ff2592ead412a0c7f5c39abc37ac562f00b7c16af07cd5eff881aadce77ec71040b36c0ad9c2d2aa4edd7744fa72b0f44cb8b485d4f283b1b49c2141","ssdeep":"1536:L4mCgi8DyCuXXFiJ+L0kJQsJVPEKLQRZdC/RlfDknv+p0WzH/IoSZ7qABZnu0sFv:LGsKXlI2p0WPSbDrstfam","tlshash":"3f93f8ddb2d1b06257bb21bd006f540ff236195e280d8850f129e8eabc74a4d9277fad","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-08-06T00:00:27.92152Z","times_seen":16923,"resource_available":true,"data":null}},"time_used":279,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":279,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"paypal.whapps.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"paypal.whapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"paypal.whapps.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"paypal.whapps.com/js/jquery-ui-1.10.4.custom.min.js","fqdn":"paypal.whapps.com","domain":"whapps.com","tld":"com"},"ip":{"addr":"18.233.218.64","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://paypal.whapps.com/","date":"2026-01-06T13:48:24.539Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.claim.whapps.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Fri, 06 Jun 2025 00:00:00 GMT","end":"Sat, 04 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"52:FC:FC:E2:E2:0B:C7:C2:93:6A:F1:A2:FA:DF:3B:A7:79:E0:7F:C8","sha256":"42:7A:07:98:46:98:93:89:3A:0F:DE:1D:09:57:77:0E:45:E5:A2:59:77:94:A8:F2:8D:27:74:95:A2:6F:26:1F"}}},"request":{"raw":"GET /js/jquery-ui-1.10.4.custom.min.js HTTP/1.1\r\nHost: paypal.whapps.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://paypal.whapps.com/\r\nCookie: plack_session=a319e7460150263b378b3de371b6152ab2e65ab2\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 06 Jan 2026 13:48:24 GMT\r\ncontent-type: application/x-javascript\r\nserver: nginx\r\nlast-modified: Wed, 19 May 2021 15:40:59 GMT\r\netag: \"60a5318b-35297\"\r\nexpires: Tue, 06 Jan 2026 13:53:24 GMT\r\npragma: public\r\ncache-control: max-age=300, public, must-revalidate, proxy-revalidate\r\naccept-ranges: bytes\r\ncontent-encoding: gzip\r\nx-cham: c5-utility-prod-us-east-1b-1\r\ncorrelation-id: i-07987cf8d5762b29b:us-east-1b:695D12A8:10F24D0:5014\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":217751,"size_decoded":0,"mime_type":"application/x-javascript","magic":"JavaScript source, ASCII text, with very long lines (64836)","md5":"56f60b8ac0f9071db25d47be95f317f5","sha1":"956dc8fc66832f0ead42f7e35e4482a9df6f0d22","sha256":"629ecc8ed5b1fb1b78f8bdeef193d6920ad87c0628c5776b06fd94abed845dc2","sha512":"6e096e1b1e516fc4d0eeb5b50008551278d55f03128b88578f3c660ae9940887735f31843ebddba79041c7af0adcdf61babebc8d6ef0e654dd18cbd9d53535fc","ssdeep":"3072:RIIzwZCUDmOPpYAFGh+5S+T8B0FBXiW1q:GEwjDDWf+VT8CFB+","tlshash":"5824084d72413636a1efe265103b260ba237655da605805cb03ccede5e7de0472bbfba","first_seen":"2025-01-27T19:01:15.204594Z","last_seen":"2026-06-17T14:59:44.672918Z","times_seen":28,"resource_available":true,"data":null}},"time_used":279,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":279,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"paypal.whapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"paypal.whapps.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"paypal.whapps.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/jquery-modal/0.9.1/jquery.modal.min.css","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.25.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://paypal.whapps.com/","date":"2026-01-06T13:48:24.544Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 15 Nov 2025 20:49:06 GMT","end":"Fri, 13 Feb 2026 21:49:04 GMT"},"fingerprint":{"sha1":"9A:71:C8:6F:E2:4B:9A:91:7D:C8:4A:1D:79:98:2F:97:C1:85:D8:79","sha256":"4E:C5:BB:7A:81:A0:D9:00:73:8D:D5:57:59:3D:A0:C3:D3:BE:62:18:4E:6F:6D:98:DA:F0:90:94:5E:E0:0B:63"}}},"request":{"raw":"GET /ajax/libs/jquery-modal/0.9.1/jquery.modal.min.css HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://paypal.whapps.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 06 Jan 2026 13:48:24 GMT\r\ncontent-type: text/css; charset=utf-8\r\ncontent-length: 1541\r\ncf-ray: 9b9bac3d6e2856a9-OSL\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=30672000\r\ncontent-encoding: br\r\netag: \"5eb03ec2-c81\"\r\nlast-modified: Mon, 04 May 2020 16:11:46 GMT\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\ncf-cdnjs-via: cfworker/kv\r\nvary: Accept-Encoding\r\ncf-cache-status: HIT\r\nage: 2814323\r\nexpires: Sun, 27 Dec 2026 13:48:24 GMT\r\naccept-ranges: bytes\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=lm1ZOnOs5mQ5%2BuVCmm1%2BcLMaZaJ0wMXOvKjLepB4kYpCQgWj%2BjjE3HYtwmUrrIPgge6w11MpxsTK5dlT406%2BlP%2F%2B1nCWOnH7D%2FWUiMLTcgSgLNh%2BCX7kteMC7EHpCIXOTuJ9U7EU\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nstrict-transport-security: max-age=15780000\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3201,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (3201), with no line terminators","md5":"54e7ff4998b2900efc138ead15e54a93","sha1":"928eeaad352ee4698ec1dddad216ec38424cfee3","sha256":"eaa593bcfe485f4b5a8ac997cf9936604f9fbef91652db94a8e22b75d612bfc1","sha512":"4f754bd6aea331423318b441f73f3aa0983d3e017b039e5e0b65e407ddf3c964aa430dc9bbee8810965805f4fb13dc0e1ccec708c08e652a5cb2cc67527e8079","ssdeep":"","tlshash":"8961b6b20d57056a72abc77287d51ba80475ca37e6130bbeb1267138c25a8d425f721f","first_seen":"2023-04-05T06:18:56Z","last_seen":"2026-08-05T14:46:03.375147Z","times_seen":8556,"resource_available":false,"data":null}},"time_used":50,"timings":{"blocked":6,"dns":1,"connect":5,"send":0,"wait":18,"receive":0,"ssl":15},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/jquery-modal/0.9.1/jquery.modal.min.js","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.25.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://paypal.whapps.com/","date":"2026-01-06T13:48:24.543Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 15 Nov 2025 20:49:06 GMT","end":"Fri, 13 Feb 2026 21:49:04 GMT"},"fingerprint":{"sha1":"9A:71:C8:6F:E2:4B:9A:91:7D:C8:4A:1D:79:98:2F:97:C1:85:D8:79","sha256":"4E:C5:BB:7A:81:A0:D9:00:73:8D:D5:57:59:3D:A0:C3:D3:BE:62:18:4E:6F:6D:98:DA:F0:90:94:5E:E0:0B:63"}}},"request":{"raw":"GET /ajax/libs/jquery-modal/0.9.1/jquery.modal.min.js HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://paypal.whapps.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 06 Jan 2026 13:48:24 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-length: 1399\r\ncf-ray: 9b9bac3d6e2556a9-OSL\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=30672000\r\ncontent-encoding: br\r\netag: \"5eb03ec2-1359\"\r\nlast-modified: Mon, 04 May 2020 16:11:46 GMT\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\ncf-cdnjs-via: cfworker/kv\r\nvary: Accept-Encoding\r\ncf-cache-status: HIT\r\nage: 1666583\r\nexpires: Sun, 27 Dec 2026 13:48:24 GMT\r\naccept-ranges: bytes\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=AYjAbcFPG7KfYPi3iL8AuWzRjOm3zWvK27tAniwFbXa9j2f5ZPcYyeDbFr0wkYKLYi0xzaVbTK9CfA4hKsOPFcGi2BOh19lKUeKl4rqo3cI1%2FvXe%2BCg6xTVmW8y%2BMMSw2%2BGU1S35\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nstrict-transport-security: max-age=15780000\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4953,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (4862)","md5":"c8f50397e0560719c62a35318f413e16","sha1":"a643db87287e6e940fbabe6d8cfee5a8775692d8","sha256":"a7e8ed2d7bbdbcaeeee81c3433f057d64a32c000112bbd09b5969fc658d0a655","sha512":"fcf2d708251c814a4b84572e7c2f6ca64c0162267f7f5a6007e94e7a475abb4b9ee36da58a91a19196c451bf6ef223b6249d9171bb620b2bdb50fa11d88bc2a0","ssdeep":"96:jPCbS/KZzQeF0VczC5x4MIKG3okQ9vGmzSUXd7INVdYH9LzYIED1OlX:jKbS2QeqV3v4MdG3zQBHzS+PYIED1O","tlshash":"65a11f0beebc635902ff90aa3d9e1d394135a2b06407448c7578cbd979a8c08606fe7a","first_seen":"2023-03-07T01:17:29Z","last_seen":"2026-08-05T14:46:03.395572Z","times_seen":9202,"resource_available":true,"data":null}},"time_used":52,"timings":{"blocked":6,"dns":0,"connect":1,"send":0,"wait":15,"receive":1,"ssl":25},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"paypal.whapps.com/favicon.ico","fqdn":"paypal.whapps.com","domain":"whapps.com","tld":"com"},"ip":{"addr":"18.233.218.64","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://paypal.whapps.com/","date":"2026-01-06T13:48:25.325Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.claim.whapps.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Fri, 06 Jun 2025 00:00:00 GMT","end":"Sat, 04 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"52:FC:FC:E2:E2:0B:C7:C2:93:6A:F1:A2:FA:DF:3B:A7:79:E0:7F:C8","sha256":"42:7A:07:98:46:98:93:89:3A:0F:DE:1D:09:57:77:0E:45:E5:A2:59:77:94:A8:F2:8D:27:74:95:A2:6F:26:1F"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: paypal.whapps.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://paypal.whapps.com/\r\nCookie: plack_session=a319e7460150263b378b3de371b6152ab2e65ab2\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 403 Forbidden\r\ndate: Tue, 06 Jan 2026 13:48:25 GMT\r\ncontent-type: application/xml\r\nx-amz-request-id: ZF4PPGMMHNHHWVBM\r\nx-amz-id-2: D8rDlXl7rvoFVqrdf6Yo08O35Zah0MI9pa8ChQp1Z/PjdlQtC1h9PiipBLpUGQxseojK9bg/4dUVZcUjGpu7H7zaKfPyYDY5XGDs28Vc14o=\r\nserver: AmazonS3\r\nx-cham: s3-static-or\r\ncache-control-authority: implicit\r\ncache-control: no-cache, private\r\ncorrelation-id: i-07987cf8d5762b29b:us-east-1b:695D12A9:10F24DD:5014\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":275,"size_decoded":0,"mime_type":"application/xml","magic":"XML 1.0 document, ASCII text","md5":"f2fd35f9d38967218f3100aa787843f1","sha1":"ea329fc30fa25a730b51812c8544df7caadfbe9b","sha256":"9d71360c0d74591c76a47432579f517117c677b5c60bd729f067e7d8aadbcd24","sha512":"8ef1e6edab1f937bdcfd20c17342f49cdd8bdd96950e4cece20da6d335565ab4e1e5da1a0878aea0626da54b4b387a6ee5886f49047d25f51dbd08346afa605b","ssdeep":"","tlshash":"68d02b72b388789d1e018e29566ae535bf84583051c438795aa296530b854899b29674","first_seen":"2026-01-06T13:48:50.764321Z","last_seen":"2026-01-06T13:48:50.764321Z","times_seen":1,"resource_available":false,"data":null}},"time_used":272,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":272,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"paypal.whapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"paypal.whapps.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"paypal.whapps.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"paypal.whapps.com/css/jquery-ui-1.10.4.custom.min.css","fqdn":"paypal.whapps.com","domain":"whapps.com","tld":"com"},"ip":{"addr":"18.233.218.64","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://paypal.whapps.com/","date":"2026-01-06T13:48:24.526Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.claim.whapps.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Fri, 06 Jun 2025 00:00:00 GMT","end":"Sat, 04 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"52:FC:FC:E2:E2:0B:C7:C2:93:6A:F1:A2:FA:DF:3B:A7:79:E0:7F:C8","sha256":"42:7A:07:98:46:98:93:89:3A:0F:DE:1D:09:57:77:0E:45:E5:A2:59:77:94:A8:F2:8D:27:74:95:A2:6F:26:1F"}}},"request":{"raw":"GET /css/jquery-ui-1.10.4.custom.min.css HTTP/1.1\r\nHost: paypal.whapps.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://paypal.whapps.com/\r\nCookie: plack_session=a319e7460150263b378b3de371b6152ab2e65ab2\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 06 Jan 2026 13:48:24 GMT\r\ncontent-type: text/css\r\nserver: nginx\r\nlast-modified: Wed, 19 May 2021 15:40:59 GMT\r\netag: \"60a5318b-6a8c\"\r\nexpires: Tue, 06 Jan 2026 13:53:24 GMT\r\npragma: public\r\ncache-control: max-age=300, public, must-revalidate, proxy-revalidate\r\naccept-ranges: bytes\r\ncontent-encoding: gzip\r\nx-cham: c5-utility-prod-us-east-1b-1\r\ncorrelation-id: i-07987cf8d5762b29b:us-east-1b:695D12A8:10F24CB:5014\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":27276,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (25375)","md5":"40b691f60bcfdaf07e77dae7eb84dd3c","sha1":"c999aea8265175b93ed2ddb40662260500eeda3f","sha256":"66668176675a49289e0c577f29239c314e5d8fbf6a79e29141e50ecc35cc8178","sha512":"bff2c9bec66b4947602104fa4d087216219ccca0324f55ac0ae88b49af56dbcd8a1c6263482392f3da4003a056b48c17aa6f04ddbf530256c31e2c44ef16e127","ssdeep":"192:h1XtwSW4wuxrjM1bXrJLzB3NCNPHyV6C2MZuQEjQDMsrsUR9C27sVZ+VzMR+4pgi:uSxDGFLzBEVx2U+4c7eL/72fZBhVg5","tlshash":"68c22330a5c2202efe33d130a1e11ff4523bc242eda65f7db09ab65953e98e4857b971","first_seen":"2025-01-27T19:01:15.198747Z","last_seen":"2026-06-17T14:59:44.655814Z","times_seen":28,"resource_available":false,"data":null}},"time_used":99,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":99,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"paypal.whapps.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"paypal.whapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"paypal.whapps.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"paypal.whapps.com/js/foundation-5.3.1.hacked.min.js","fqdn":"paypal.whapps.com","domain":"whapps.com","tld":"com"},"ip":{"addr":"18.233.218.64","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://paypal.whapps.com/","date":"2026-01-06T13:48:24.541Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.claim.whapps.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Fri, 06 Jun 2025 00:00:00 GMT","end":"Sat, 04 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"52:FC:FC:E2:E2:0B:C7:C2:93:6A:F1:A2:FA:DF:3B:A7:79:E0:7F:C8","sha256":"42:7A:07:98:46:98:93:89:3A:0F:DE:1D:09:57:77:0E:45:E5:A2:59:77:94:A8:F2:8D:27:74:95:A2:6F:26:1F"}}},"request":{"raw":"GET /js/foundation-5.3.1.hacked.min.js HTTP/1.1\r\nHost: paypal.whapps.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://paypal.whapps.com/\r\nCookie: plack_session=a319e7460150263b378b3de371b6152ab2e65ab2\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 06 Jan 2026 13:48:24 GMT\r\ncontent-type: application/x-javascript\r\nserver: nginx\r\nlast-modified: Wed, 19 May 2021 15:40:59 GMT\r\netag: \"60a5318b-16726\"\r\nexpires: Tue, 06 Jan 2026 13:53:24 GMT\r\npragma: public\r\ncache-control: max-age=300, public, must-revalidate, proxy-revalidate\r\naccept-ranges: bytes\r\ncontent-encoding: gzip\r\nx-cham: c5-utility-prod-us-east-1b-1\r\ncorrelation-id: i-07987cf8d5762b29b:us-east-1b:695D12A8:10F24D1:5014\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":91942,"size_decoded":0,"mime_type":"application/x-javascript","magic":"JavaScript source, ASCII text, with very long lines (32047)","md5":"de30f608db481b699682f3be406e47ee","sha1":"5a33c06b98543e49c6bd04e99c7819302781c17f","sha256":"61a591d617bf0952a2fbdfb4a3732a965f3d6f811744459e23a8c97804ce907a","sha512":"b14885443e9dae9b893828fe6db0530e2a20fc5a823dc5ecd207fa95eead0b67aacc5552b82e47dab021b424fd7ef624651e1f35d6945847a5c85a7bfd835302","ssdeep":"1536:QrwQRo+aCWsQC0ZNDHbeO5eTjYRPj0QQMfEWfSKBUQwF4AEVdihVNPFk+8NXQpB1:Q43YTWh+H8QMgXlt8pu","tlshash":"ac93e706f2a1306a11ff75b5412f130121335869aa15a83cbd7cc6e99ab8d8d2177ffe","first_seen":"2025-01-27T19:01:15.209868Z","last_seen":"2026-06-17T14:59:44.666562Z","times_seen":28,"resource_available":true,"data":null}},"time_used":278,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":278,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"paypal.whapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"paypal.whapps.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"paypal.whapps.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.googletagmanager.com/gtm.js?id=GTM-T7ZF7ZZ","fqdn":"www.googletagmanager.com","domain":"googletagmanager.com","tld":"com"},"ip":{"addr":"142.250.178.104","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://paypal.whapps.com/","date":"2026-01-06T13:48:24.636Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.google-analytics.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 15:49:40 GMT","end":"Wed, 25 Feb 2026 15:49:39 GMT"},"fingerprint":{"sha1":"A1:49:37:FE:E0:3E:26:88:A3:64:37:DC:04:D7:8D:D1:D3:F3:91:75","sha256":"BB:61:22:1A:6C:67:5D:C0:C8:A6:73:93:B9:53:82:98:95:54:B5:52:8B:33:FC:08:58:01:D2:3B:FF:E6:35:12"}}},"request":{"raw":"GET /gtm.js?id=GTM-T7ZF7ZZ HTTP/1.1\r\nHost: www.googletagmanager.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://paypal.whapps.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: application/javascript; charset=UTF-8\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: Cache-Control\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ndate: Tue, 06 Jan 2026 13:48:24 GMT\r\nexpires: Tue, 06 Jan 2026 13:48:24 GMT\r\ncache-control: private, max-age=900\r\nlast-modified: Tue, 06 Jan 2026 12:00:00 GMT\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncross-origin-resource-policy: cross-origin\r\nserver: Google Tag Manager\r\ncontent-length: 107254\r\nx-xss-protection: 0\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":306602,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (3349)","md5":"a6f870dcb47b0ef8bf9f3678a8b52739","sha1":"2fcd82b5d0e8fc392dd6fcc1c43dea2929b2aa07","sha256":"3ba81262dc4d5affee378f791aa003f6124f563f9a6d0bdac80f18f9863c87ca","sha512":"d9c6fe28164de7b1cb1113a873361863d17d2b8be924f4ec673f17b4b6c35e4d16ffca1c1d79d9cfb73356d4bf7f6a1fe7185c1927ca24b0ec23fb65a671e4a2","ssdeep":"3072:Ntb7EgrCXsmRnE07T4oKtis+KkJAHGkiUgAlXbBeitt28M9O9pC6MRKkaWIL9LKL:TwsmT1BIiU7lkOt28Mk9TMRKkaWILhKL","tlshash":"0f6419c9b3da742683a36478503f114bb23b79d1f84cd894e186d8d42e74aaa4237f7d","first_seen":"2026-01-06T13:48:50.769007Z","last_seen":"2026-01-06T13:48:50.769007Z","times_seen":1,"resource_available":true,"data":null}},"time_used":375,"timings":{"blocked":115,"dns":16,"connect":28,"send":0,"wait":61,"receive":67,"ssl":85},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"paypal.whapps.com/img/smileguy.jpg","fqdn":"paypal.whapps.com","domain":"whapps.com","tld":"com"},"ip":{"addr":"18.233.218.64","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://paypal.whapps.com/","date":"2026-01-06T13:48:25.117Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.claim.whapps.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Fri, 06 Jun 2025 00:00:00 GMT","end":"Sat, 04 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"52:FC:FC:E2:E2:0B:C7:C2:93:6A:F1:A2:FA:DF:3B:A7:79:E0:7F:C8","sha256":"42:7A:07:98:46:98:93:89:3A:0F:DE:1D:09:57:77:0E:45:E5:A2:59:77:94:A8:F2:8D:27:74:95:A2:6F:26:1F"}}},"request":{"raw":"GET /img/smileguy.jpg HTTP/1.1\r\nHost: paypal.whapps.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://paypal.whapps.com/css/app.css\r\nCookie: plack_session=a319e7460150263b378b3de371b6152ab2e65ab2\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 06 Jan 2026 13:48:25 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 2461157\r\nserver: nginx\r\nlast-modified: Wed, 19 May 2021 15:40:59 GMT\r\netag: \"60a5318b-258de5\"\r\nexpires: Tue, 06 Jan 2026 13:53:25 GMT\r\npragma: public\r\ncache-control: max-age=300, public, must-revalidate, proxy-revalidate\r\naccept-ranges: bytes\r\nx-cham: c5-utility-prod-us-east-1b-1\r\ncorrelation-id: i-07987cf8d5762b29b:us-east-1b:695D12A9:10F24DA:5014\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2461157,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, progressive, precision 8, 3004x1500, components 3","md5":"a17b35dafa418ded9cabfc59011f9d40","sha1":"00de64a83f74b537bbdfbeb6458a1aed85d80ff2","sha256":"2a2e865196b7bf3589132320af37f26bb3da2d549600dbfe515c8018c58ebe24","sha512":"eb415a270c513e49b8e71f55a057c37a78669bee92b3ac30de56a7c99b94cc2938262766f8ba4ba8e9585927f195dd6cb5ba91a521118f2a2c6750260c061b0b","ssdeep":"24576:W07u3x52EELl3tFLDwrxMcohW8NiLSrsLgnpqqdCJU2OK:Wn37uldFwMcohbAL9As6U","tlshash":"f82533334a05cdd3dc8833382e8b106f5944a3f873e8f839569d67e78be54d5e858a62","first_seen":"2026-01-06T04:18:20.072702Z","last_seen":"2026-06-17T14:59:44.660302Z","times_seen":23,"resource_available":false,"data":null}},"time_used":479,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":95,"receive":384,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"paypal.whapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"paypal.whapps.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"paypal.whapps.com/css/font-awesome/css/font-awesome.min.css","fqdn":"paypal.whapps.com","domain":"whapps.com","tld":"com"},"ip":{"addr":"18.233.218.64","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://paypal.whapps.com/","date":"2026-01-06T13:48:24.528Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.claim.whapps.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Fri, 06 Jun 2025 00:00:00 GMT","end":"Sat, 04 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"52:FC:FC:E2:E2:0B:C7:C2:93:6A:F1:A2:FA:DF:3B:A7:79:E0:7F:C8","sha256":"42:7A:07:98:46:98:93:89:3A:0F:DE:1D:09:57:77:0E:45:E5:A2:59:77:94:A8:F2:8D:27:74:95:A2:6F:26:1F"}}},"request":{"raw":"GET /css/font-awesome/css/font-awesome.min.css HTTP/1.1\r\nHost: paypal.whapps.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://paypal.whapps.com/\r\nCookie: plack_session=a319e7460150263b378b3de371b6152ab2e65ab2\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 06 Jan 2026 13:48:24 GMT\r\ncontent-type: text/css\r\nserver: nginx\r\nlast-modified: Wed, 19 May 2021 15:40:59 GMT\r\netag: \"60a5318b-511e\"\r\nexpires: Tue, 06 Jan 2026 13:53:24 GMT\r\npragma: public\r\ncache-control: max-age=300, public, must-revalidate, proxy-revalidate\r\naccept-ranges: bytes\r\ncontent-encoding: gzip\r\nx-cham: c5-utility-prod-us-east-1b-1\r\ncorrelation-id: i-07987cf8d5762b29b:us-east-1b:695D129B:10F248D:5014\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":20766,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (20604)","md5":"bbfef9385083d307ad2692c0cf99f611","sha1":"63a234ea4d60f6643a60a4d79e28f291b93c1743","sha256":"b769324e0921f9f649611113e65f528ebae5e140da8a7e63c5d6ea7bc7a33bc0","sha512":"efb922772183246596989d0c54ed02469fba9d181944aebb7eb515051be72f5cc2726730f45902431a431eae7649e6d6f8a5930279ee5f4424dbf3105a8816a1","ssdeep":"192:xq9jjI+ab2edrK/TUKIErArKlcZJVrJ3ee+cR6waWW215Uvf0:+jPyW/TUK1+KlkJ5de2UWWyAf0","tlshash":"c99266f8e54d01c66731c48bff85b36862baf33dd5804d99f11f294c29d22a912c5bba","first_seen":"2023-04-05T10:34:03Z","last_seen":"2026-08-05T23:27:51.26016Z","times_seen":10645,"resource_available":false,"data":null}},"time_used":191,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":191,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"paypal.whapps.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"paypal.whapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"paypal.whapps.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"paypal.whapps.com/js/modernizr.js","fqdn":"paypal.whapps.com","domain":"whapps.com","tld":"com"},"ip":{"addr":"18.233.218.64","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://paypal.whapps.com/","date":"2026-01-06T13:48:24.534Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.claim.whapps.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Fri, 06 Jun 2025 00:00:00 GMT","end":"Sat, 04 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"52:FC:FC:E2:E2:0B:C7:C2:93:6A:F1:A2:FA:DF:3B:A7:79:E0:7F:C8","sha256":"42:7A:07:98:46:98:93:89:3A:0F:DE:1D:09:57:77:0E:45:E5:A2:59:77:94:A8:F2:8D:27:74:95:A2:6F:26:1F"}}},"request":{"raw":"GET /js/modernizr.js HTTP/1.1\r\nHost: paypal.whapps.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://paypal.whapps.com/\r\nCookie: plack_session=a319e7460150263b378b3de371b6152ab2e65ab2\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 06 Jan 2026 13:48:24 GMT\r\ncontent-type: application/x-javascript\r\nserver: nginx\r\nlast-modified: Wed, 19 May 2021 15:40:59 GMT\r\netag: \"60a5318b-2bf4\"\r\nexpires: Tue, 06 Jan 2026 13:53:24 GMT\r\npragma: public\r\ncache-control: max-age=300, public, must-revalidate, proxy-revalidate\r\naccept-ranges: bytes\r\ncontent-encoding: gzip\r\nx-cham: c5-utility-prod-us-east-1b-1\r\ncorrelation-id: i-07987cf8d5762b29b:us-east-1b:695D12A8:10F24CD:5014\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":11252,"size_decoded":0,"mime_type":"application/x-javascript","magic":"JavaScript source, ASCII text, with very long lines (11074)","md5":"f9c69557ae28ea51a2c81ae0795eaef5","sha1":"a44970d8bbe4637ae926e700f7645b18f6ef7a8e","sha256":"3485afabf51bc73fae971d455ee54a9a569fa03f450aa8cc9c7f8561c9db894d","sha512":"ce9dff7bc8c3069f395898fa4450fd027b8cfb6d3dc8f422861fd41433e1c9d4e7b3fd48e89ea65f0a6739bf93049be57157948198fa40dd4ad4680ba3b73d76","ssdeep":"192:lzMdVOKMW+dftBRCzHYxqG1uTyKVOlzEf7jQLJZMYWABl8xAfo:lYdV7MjCjYxqG1uTulAfXQLJRNCxAQ","tlshash":"ef32c78eb2937109535ba07b21bf460ff27d98d9552848e4e059c5acbe34ce4427bf2d","first_seen":"2023-03-09T11:38:30Z","last_seen":"2026-06-17T14:59:44.656982Z","times_seen":70,"resource_available":true,"data":null}},"time_used":186,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":186,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"paypal.whapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"paypal.whapps.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"paypal.whapps.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"paypal.whapps.com/img/pp-logo.png","fqdn":"paypal.whapps.com","domain":"whapps.com","tld":"com"},"ip":{"addr":"18.233.218.64","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://paypal.whapps.com/","date":"2026-01-06T13:48:24.535Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.claim.whapps.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Fri, 06 Jun 2025 00:00:00 GMT","end":"Sat, 04 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"52:FC:FC:E2:E2:0B:C7:C2:93:6A:F1:A2:FA:DF:3B:A7:79:E0:7F:C8","sha256":"42:7A:07:98:46:98:93:89:3A:0F:DE:1D:09:57:77:0E:45:E5:A2:59:77:94:A8:F2:8D:27:74:95:A2:6F:26:1F"}}},"request":{"raw":"GET /img/pp-logo.png HTTP/1.1\r\nHost: paypal.whapps.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://paypal.whapps.com/\r\nCookie: plack_session=a319e7460150263b378b3de371b6152ab2e65ab2\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 06 Jan 2026 13:48:24 GMT\r\ncontent-type: image/png\r\ncontent-length: 15411\r\nserver: nginx\r\nlast-modified: Wed, 19 May 2021 15:40:59 GMT\r\netag: \"60a5318b-3c33\"\r\nexpires: Tue, 06 Jan 2026 13:53:24 GMT\r\npragma: public\r\ncache-control: max-age=300, public, must-revalidate, proxy-revalidate\r\naccept-ranges: bytes\r\nx-cham: c5-utility-prod-us-east-1b-1\r\ncorrelation-id: i-07987cf8d5762b29b:us-east-1b:695D129B:10F248E:5014\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":15411,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 200 x 51, 8-bit/color RGBA, non-interlaced","md5":"128b5fa32dd65c3d374eb267967710cc","sha1":"42ffd393fe702d3ca9766de6867ec669c477db9b","sha256":"e3215f3027689fdeea8f2cbeb3953857b189c419bd57162f48c9eab11f840bf8","sha512":"9f1f74f84e6ecaff7671320c16bf5f83b1927e0276346e43541d18918e9a502191b6d3d7bb83366ca3dcb594dc284ca3ec7926ad3beb90268f0d8962909b35a9","ssdeep":"384:8qXGbcf7ieOPOXIFg6StshGVkRAmKEIOaLJKzBD1:75f7PObgXtshGa63OaLJK9D1","tlshash":"dd62cfff670408fc9058e12d7ab52a0cae3e29385e0d02a3b09449676dda4e78771963","first_seen":"2026-01-06T04:18:20.060718Z","last_seen":"2026-01-24T14:47:37.073862Z","times_seen":12,"resource_available":false,"data":null}},"time_used":277,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":276,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"paypal.whapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"paypal.whapps.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"paypal.whapps.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"paypal.whapps.com/fonts/paypal-sans-big-regular.ttf","fqdn":"paypal.whapps.com","domain":"whapps.com","tld":"com"},"ip":{"addr":"18.233.218.64","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://paypal.whapps.com/","date":"2026-01-06T13:48:24.990Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.claim.whapps.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Fri, 06 Jun 2025 00:00:00 GMT","end":"Sat, 04 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"52:FC:FC:E2:E2:0B:C7:C2:93:6A:F1:A2:FA:DF:3B:A7:79:E0:7F:C8","sha256":"42:7A:07:98:46:98:93:89:3A:0F:DE:1D:09:57:77:0E:45:E5:A2:59:77:94:A8:F2:8D:27:74:95:A2:6F:26:1F"}}},"request":{"raw":"GET /fonts/paypal-sans-big-regular.ttf HTTP/1.1\r\nHost: paypal.whapps.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://paypal.whapps.com/css/app.css\r\nCookie: plack_session=a319e7460150263b378b3de371b6152ab2e65ab2\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 06 Jan 2026 13:48:25 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 91380\r\nserver: nginx\r\nlast-modified: Wed, 19 May 2021 15:40:59 GMT\r\netag: \"60a5318b-164f4\"\r\nexpires: Tue, 06 Jan 2026 13:53:25 GMT\r\npragma: public\r\ncache-control: max-age=300, public, must-revalidate, proxy-revalidate\r\naccept-ranges: bytes\r\nx-cham: c5-utility-prod-us-east-1b-1\r\ncorrelation-id: i-07987cf8d5762b29b:us-east-1b:695D12A8:10F24D3:5014\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":91380,"size_decoded":0,"mime_type":"application/octet-stream","magic":"TrueType Font data, 19 tables, 1st \"BASE\", 26 names, Macintosh","md5":"44994582bcefd02119158ff8b0d16b75","sha1":"1af7adfbdfe86a128fe41031584313bc2c1bb885","sha256":"9040753469143850acc5dc47b7d5f63b8f0e0b19b86e60af959bc80af0ea4ffd","sha512":"6964964cf4ed4826598f8606e65fd7ed2335f8cca051e97f2404017e4c894fe34a3fa918de5023ca32e4b75ffa9b62efa03acdad4e352ea3224504bac9968e97","ssdeep":"1536:2KHg0TFQyROwqgoBLli8hKk77G+N/EjKOb1MvErpfkVycy0b6u:VH3T2yRMBLs8wo7VN/dOR8sFhu","tlshash":"66931801f2cac631ce866b3c859e83ff4a38f539f95e571b60909bb0944db451e8adb1","first_seen":"2026-01-06T04:18:20.070939Z","last_seen":"2026-06-17T14:59:44.659459Z","times_seen":23,"resource_available":false,"data":null}},"time_used":100,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":96,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"paypal.whapps.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"paypal.whapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"paypal.whapps.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"paypal.whapps.com/","fqdn":"paypal.whapps.com","domain":"whapps.com","tld":"com"},"ip":{"addr":"18.233.218.64","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-06T13:48:23.761Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.claim.whapps.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Fri, 06 Jun 2025 00:00:00 GMT","end":"Sat, 04 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"52:FC:FC:E2:E2:0B:C7:C2:93:6A:F1:A2:FA:DF:3B:A7:79:E0:7F:C8","sha256":"42:7A:07:98:46:98:93:89:3A:0F:DE:1D:09:57:77:0E:45:E5:A2:59:77:94:A8:F2:8D:27:74:95:A2:6F:26:1F"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: paypal.whapps.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 06 Jan 2026 13:48:24 GMT\r\ncontent-type: text/html\r\nserver: nginx\r\ncache-control: no-store, must-revalidate, proxy-revalidate, max-age=0\r\nset-cookie: plack_session=a319e7460150263b378b3de371b6152ab2e65ab2; path=/; HttpOnly\r\ncontent-encoding: gzip\r\nx-cham: c5-utility-prod-us-east-1b-1\r\ncorrelation-id: i-07987cf8d5762b29b:us-east-1b:695D12A8:10F24C7:5014\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"jQuery Modal:0.9.1","description":"jQuery Modal is an overlay dialog box or in other words, a popup window that is made to display on the top or 'overlayed' on the current page.","website":"https://jquerymodal.com","common_platform_enumeration":"","icon":"jQuery Modal.png","categories":["JavaScript libraries"]},{"name":"ZURB Foundation","description":"Zurb Foundation is used to prototype in the browser. Allows rapid creation of websites or applications while leveraging mobile and responsive technology. The front end framework is the collection of HTML, CSS, and Javascript containing design patterns.","website":"https://foundation.zurb.com","common_platform_enumeration":"","icon":"ZURB Foundation.png","categories":["UI frameworks"]},{"name":"Modernizr","description":"Modernizr is a JavaScript library that detects the features available in a user's browser.","website":"https://modernizr.com","common_platform_enumeration":"","icon":"Modernizr.svg","categories":["JavaScript libraries"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Glyphicons","description":"Glyphicons are icon fonts which you can use in your web projects.","website":"https://glyphicons.com","common_platform_enumeration":"","icon":"Glyphicons.png","categories":["Font scripts"]},{"name":"cdnjs","description":"cdnjs is a free distributed JS library delivery service.","website":"https://cdnjs.com","common_platform_enumeration":"","icon":"cdnjs.svg","categories":["CDN"]},{"name":"Google Tag Manager","description":"Google Tag Manager is a tag management system (TMS) that allows you to quickly and easily update measurement codes and related code fragments collectively known as tags on your website or mobile app.","website":"https://www.google.com/tagmanager","common_platform_enumeration":"","icon":"Google Tag Manager.svg","categories":["Tag managers"]},{"name":"jQuery:1.10.2","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"jQuery UI:1.10.4","description":"jQuery UI is a collection of GUI widgets, animated visual effects, and themes implemented with jQuery, Cascading Style Sheets, and HTML.","website":"https://jqueryui.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery_ui:*:*:*:*:*:*:*:*","icon":"jQuery UI.svg","categories":["JavaScript libraries"]}],"data":{"size":5377,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (374)","md5":"b69ace52572de9d1d90194bce7de2413","sha1":"b38b44cdbe2fcf47330a899b373c7d9a60c2afc8","sha256":"96218cb1710c364122ebedcd09d5f400efb4fcbc18fa109dda70e243990651fc","sha512":"77fe7f4b47fb33c3362948ec197aaa95c91cb80cac0437614f3cd460fcedc51160bcbe313b4682b86c6695b39a80b5b14f0f7c1d3eded13817c89663608a38b1","ssdeep":"96:djKYoAKBTItYOrtsEMVskVTHUdtgKBKV3TG9tnVfVf2+I:PoLBTItYOre7VTHUdtrwV3TGvnVfVu+I","tlshash":"0fb16536ac94967b01a369d27d32b619f5d3a64fde07881475fd86291fe0fcacc1184c","first_seen":"2026-01-06T04:18:20.059348Z","last_seen":"2026-01-06T13:48:50.77555Z","times_seen":3,"resource_available":false,"data":null}},"time_used":985,"timings":{"blocked":426,"dns":51,"connect":94,"send":0,"wait":133,"receive":0,"ssl":279},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"paypal.whapps.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"paypal.whapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"paypal.whapps.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"paypal.whapps.com/css/normalize-2.1.2.css","fqdn":"paypal.whapps.com","domain":"whapps.com","tld":"com"},"ip":{"addr":"18.233.218.64","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://paypal.whapps.com/","date":"2026-01-06T13:48:24.522Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.claim.whapps.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Fri, 06 Jun 2025 00:00:00 GMT","end":"Sat, 04 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"52:FC:FC:E2:E2:0B:C7:C2:93:6A:F1:A2:FA:DF:3B:A7:79:E0:7F:C8","sha256":"42:7A:07:98:46:98:93:89:3A:0F:DE:1D:09:57:77:0E:45:E5:A2:59:77:94:A8:F2:8D:27:74:95:A2:6F:26:1F"}}},"request":{"raw":"GET /css/normalize-2.1.2.css HTTP/1.1\r\nHost: paypal.whapps.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://paypal.whapps.com/\r\nCookie: plack_session=a319e7460150263b378b3de371b6152ab2e65ab2\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 06 Jan 2026 13:48:24 GMT\r\ncontent-type: text/css\r\nserver: nginx\r\nlast-modified: Wed, 19 May 2021 15:40:59 GMT\r\netag: \"60a5318b-1d9c\"\r\nexpires: Tue, 06 Jan 2026 13:53:24 GMT\r\npragma: public\r\ncache-control: max-age=300, public, must-revalidate, proxy-revalidate\r\naccept-ranges: bytes\r\ncontent-encoding: gzip\r\nx-cham: c5-utility-prod-us-east-1b-1\r\ncorrelation-id: i-07987cf8d5762b29b:us-east-1b:695D12A8:10F24C8:5014\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7580,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"818790cf059fac69a61f5ae15cc5f22a","sha1":"5f8dcedbe9d2e47589e56a0eae886c4381447775","sha256":"02e71a081ec1ba2141f4c6af915cf730c4c2ef31d761c437f9816a61a15497db","sha512":"279261b15205adc11b4e8b5a980f569ea836b5c3ba2452f1e11e56cf597afefb642eefa43c21914b43d0b45f359831250336f8143a2a2d67cd37327184556752","ssdeep":"96:5gPe0tyAZP//lIrxTMIhWhGpEUyG4bDCK7zn6Xo58u4a5ZL0Kl:54ei79qdIAK+E/GGzn4oeu4a5OY","tlshash":"3df1739617607a4292b54e7937ebd39533080227826c78eeb8d642ec8f48759c3b6fd4","first_seen":"2023-04-15T20:54:03Z","last_seen":"2026-07-11T20:30:24.129184Z","times_seen":105,"resource_available":false,"data":null}},"time_used":97,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":97,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"paypal.whapps.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"paypal.whapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"paypal.whapps.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}}]}