johnsworld.com Open in urlscan Pro
66.71.253.146  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response johnsworld.com/pp/signin/	15 KB 2 KB	504ms 128ms	Document text/html	66.71.253.146 PERFORMIVE
General Check archive.org Show headers Download Go to Full URL https://johnsworld.com/pp/signin/?country=Netherlands&local=en_NL Protocol H2 Security TLS 1.3, , CHACHA20_POLY1305 Server 66.71.253.146 Atlanta, United States, ASN46562 (PERFORMIVE, US), Reverse DNS ironsides.degster.com Software LiteSpeed / Resource Hash 6c9631863c7a6a98010012a9b8d82266a2fd9b3a2ac242fb2740f8e94a4b10d2 Request headers :method GET :authority johnsworld.com :scheme https :path /pp/signin/?country=Netherlands&local=en_NL pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers content-type text/html; charset=UTF-8 content-encoding br vary Accept-Encoding date Thu, 13 May 2021 13:52:04 GMT server LiteSpeed alt-svc quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-25=":443"; ma=2592000, h3-27=":443"; ma=2592000
GET H2	200	style.css johnsworld.com/pp/signin/style/css/	81 KB 12 KB	432ms 130ms	Stylesheet text/css	66.71.253.146 PERFORMIVE
General Check archive.org Show headers Download Go to Full URL https://johnsworld.com/pp/signin/style/css/style.css Requested by Host: johnsworld.com URL: https://johnsworld.com/pp/signin/?country=Netherlands&local=en_NL Protocol H2 Security TLS 1.3, , CHACHA20_POLY1305 Server 66.71.253.146 Atlanta, United States, ASN46562 (PERFORMIVE, US), Reverse DNS ironsides.degster.com Software LiteSpeed / Resource Hash 6bf42ac9af545040fb05db88daa2d3cbfe910024b014403c2e9635d1bc18f768 Request headers :path /pp/signin/style/css/style.css pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept text/css,*/*;q=0.1 cache-control no-cache sec-fetch-dest style :authority johnsworld.com referer https://johnsworld.com/pp/signin/?country=Netherlands&local=en_NL :scheme https sec-fetch-site same-origin :method GET Referer https://johnsworld.com/pp/signin/?country=Netherlands&local=en_NL User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 13 May 2021 13:52:04 GMT content-encoding br last-modified Mon, 01 Oct 2018 20:24:32 GMT server LiteSpeed etag "1448d-5bb28280-43e67281c774462f;br" vary Accept-Encoding content-type text/css cache-control public, max-age=604800 accept-ranges bytes content-length 12210 expires Thu, 20 May 2021 13:52:04 GMT
GET H2	200	jquery.min.js Show response johnsworld.com/pp/summary/js/	156 KB 38 KB	548ms 246ms	Script application/javascript	66.71.253.146 PERFORMIVE
General Check archive.org Show headers Download Go to Full URL https://johnsworld.com/pp/summary/js/jquery.min.js Requested by Host: johnsworld.com URL: https://johnsworld.com/pp/signin/?country=Netherlands&local=en_NL Protocol H2 Security TLS 1.3, , CHACHA20_POLY1305 Server 66.71.253.146 Atlanta, United States, ASN46562 (PERFORMIVE, US), Reverse DNS ironsides.degster.com Software LiteSpeed / Resource Hash 89db88fadaf63fd4e91d869fed81834918debd6eacbe6e47b5ad54e061996aed Request headers :path /pp/summary/js/jquery.min.js pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority johnsworld.com referer https://johnsworld.com/pp/signin/?country=Netherlands&local=en_NL :scheme https sec-fetch-site same-origin :method GET Referer https://johnsworld.com/pp/signin/?country=Netherlands&local=en_NL User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 13 May 2021 13:52:04 GMT content-encoding br last-modified Thu, 12 Jul 2018 15:40:24 GMT server LiteSpeed etag "26f30-5b477668-a3370ae9a45301dc;br" vary Accept-Encoding content-type application/javascript cache-control public, max-age=604800 accept-ranges bytes content-length 38749 expires Thu, 20 May 2021 13:52:04 GMT
GET H2	200	jquery.validate.min.js Show response johnsworld.com/pp/summary/js/	49 KB 12 KB	664ms 362ms	Script application/javascript	66.71.253.146 PERFORMIVE
General Check archive.org Show headers Download Go to Full URL https://johnsworld.com/pp/summary/js/jquery.validate.min.js Requested by Host: johnsworld.com URL: https://johnsworld.com/pp/signin/?country=Netherlands&local=en_NL Protocol H2 Security TLS 1.3, , CHACHA20_POLY1305 Server 66.71.253.146 Atlanta, United States, ASN46562 (PERFORMIVE, US), Reverse DNS ironsides.degster.com Software LiteSpeed / Resource Hash d95dd82cb0993b7f8c02c28a72c871ab393b93d329a5f5f6aa27b738c626a6b6 Request headers :path /pp/summary/js/jquery.validate.min.js pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority johnsworld.com referer https://johnsworld.com/pp/signin/?country=Netherlands&local=en_NL :scheme https sec-fetch-site same-origin :method GET Referer https://johnsworld.com/pp/signin/?country=Netherlands&local=en_NL User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 13 May 2021 13:52:04 GMT content-encoding br last-modified Mon, 01 Oct 2018 18:01:46 GMT server LiteSpeed etag "c27e-5bb2610a-2133ae9288743038;br" vary Accept-Encoding content-type application/javascript cache-control public, max-age=604800 accept-ranges bytes content-length 12610 expires Thu, 20 May 2021 13:52:04 GMT
GET H2	200	paypal-logo-129x32.svg johnsworld.com/pp/signin/style/img/	5 KB 5 KB	428ms 127ms	Image image/svg+xml	66.71.253.146 PERFORMIVE
General Check archive.org Show headers Download Go to Show image Full URL https://johnsworld.com/pp/signin/style/img/paypal-logo-129x32.svg Requested by Host: johnsworld.com URL: https://johnsworld.com/pp/signin/style/css/style.css Protocol H2 Security TLS 1.3, , CHACHA20_POLY1305 Server 66.71.253.146 Atlanta, United States, ASN46562 (PERFORMIVE, US), Reverse DNS ironsides.degster.com Software LiteSpeed / Resource Hash b3cc50b9e94bbecaaeb1079b64b8ca50616d1732824964c1cc2c5422627a0ec5 Request headers :path /pp/signin/style/img/paypal-logo-129x32.svg pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority johnsworld.com referer https://johnsworld.com/pp/signin/style/css/style.css :scheme https sec-fetch-site same-origin :method GET Referer https://johnsworld.com/pp/signin/style/css/style.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 13 May 2021 13:52:05 GMT last-modified Mon, 01 Oct 2018 17:15:14 GMT server LiteSpeed etag "1351-5bb25622-c48b909f8b6789c5;;;" content-type image/svg+xml cache-control public, max-age=604800 accept-ranges bytes content-length 4945 expires Thu, 20 May 2021 13:52:05 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

johnsworld.com
66.71.253.146
6bf42ac9af545040fb05db88daa2d3cbfe910024b014403c2e9635d1bc18f768
6c9631863c7a6a98010012a9b8d82266a2fd9b3a2ac242fb2740f8e94a4b10d2
89db88fadaf63fd4e91d869fed81834918debd6eacbe6e47b5ad54e061996aed
b3cc50b9e94bbecaaeb1079b64b8ca50616d1732824964c1cc2c5422627a0ec5
d95dd82cb0993b7f8c02c28a72c871ab393b93d329a5f5f6aa27b738c626a6b6