secure.knottysurprisexoxo.com
Open in
urlscan Pro
91.209.70.247
Malicious Activity!
Public Scan
Submission: On August 06 via api from JP — Scanned from JP
Summary
TLS certificate: Issued by R3 on August 4th 2023. Valid for: 3 months.
This is the only time secure.knottysurprisexoxo.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: PayPal (Financial)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
28 | 91.209.70.247 91.209.70.247 | 43317 (VEESP-AS) (VEESP-AS) | |
1 2 | 172.217.26.228 172.217.26.228 | 15169 (GOOGLE) (GOOGLE) | |
1 | 142.250.207.35 142.250.207.35 | 15169 (GOOGLE) (GOOGLE) | |
1 1 | 142.251.42.194 142.251.42.194 | 15169 (GOOGLE) (GOOGLE) | |
1 | 172.217.175.99 172.217.175.99 | 15169 (GOOGLE) (GOOGLE) | |
4 | 151.101.194.133 151.101.194.133 | 54113 (FASTLY) (FASTLY) | |
4 | 151.101.1.21 151.101.1.21 | 54113 (FASTLY) (FASTLY) | |
3 | 151.101.193.35 151.101.193.35 | 54113 (FASTLY) (FASTLY) | |
3 | 142.250.199.99 142.250.199.99 | 15169 (GOOGLE) (GOOGLE) | |
1 | 151.101.65.35 151.101.65.35 | 54113 (FASTLY) (FASTLY) | |
48 | 10 |
ASN15169 (GOOGLE, US)
PTR: nrt13s55-in-f3.1e100.net
www.google.co.in |
ASN15169 (GOOGLE, US)
PTR: nrt12s47-in-f2.1e100.net
googleads.g.doubleclick.net |
ASN15169 (GOOGLE, US)
PTR: nrt20s21-in-f3.1e100.net
www.google.co.jp |
ASN15169 (GOOGLE, US)
PTR: nrt13s52-in-f3.1e100.net
www.gstatic.com | |
www.recaptcha.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
28 |
knottysurprisexoxo.com
secure.knottysurprisexoxo.com |
2 MB |
8 |
paypal.com
c.paypal.com — Cisco Umbrella Rank: 5493 b.stats.paypal.com Failed t.paypal.com — Cisco Umbrella Rank: 3221 c6.paypal.com — Cisco Umbrella Rank: 6322 |
27 KB |
4 |
paypalobjects.com
www.paypalobjects.com — Cisco Umbrella Rank: 2334 |
92 KB |
2 |
gstatic.com
www.gstatic.com |
|
2 |
google.com
1 redirects
www.google.com — Cisco Umbrella Rank: 3 |
987 B |
1 |
recaptcha.net
www.recaptcha.net — Cisco Umbrella Rank: 1905 |
2 KB |
1 |
google.co.jp
www.google.co.jp — Cisco Umbrella Rank: 21858 |
455 B |
1 |
doubleclick.net
1 redirects
googleads.g.doubleclick.net — Cisco Umbrella Rank: 54 |
952 B |
1 |
google.co.in
www.google.co.in — Cisco Umbrella Rank: 13483 |
455 B |
48 | 9 |
Domain | Requested by | |
---|---|---|
28 | secure.knottysurprisexoxo.com |
secure.knottysurprisexoxo.com
|
4 | c.paypal.com |
secure.knottysurprisexoxo.com
c.paypal.com |
4 | www.paypalobjects.com |
secure.knottysurprisexoxo.com
|
3 | t.paypal.com |
secure.knottysurprisexoxo.com
|
2 | www.gstatic.com |
secure.knottysurprisexoxo.com
www.recaptcha.net |
2 | www.google.com |
1 redirects
secure.knottysurprisexoxo.com
|
1 | www.recaptcha.net |
secure.knottysurprisexoxo.com
|
1 | c6.paypal.com |
secure.knottysurprisexoxo.com
|
1 | www.google.co.jp |
secure.knottysurprisexoxo.com
|
1 | googleads.g.doubleclick.net | 1 redirects |
1 | www.google.co.in |
secure.knottysurprisexoxo.com
|
0 | b.stats.paypal.com Failed |
secure.knottysurprisexoxo.com
|
48 | 12 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.paypal.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
www.secure.knottysurprisexoxo.com R3 |
2023-08-04 - 2023-11-02 |
3 months | crt.sh |
www.google.com GTS CA 1C3 |
2023-07-10 - 2023-10-02 |
3 months | crt.sh |
*.google.co.in GTS CA 1C3 |
2023-07-10 - 2023-10-02 |
3 months | crt.sh |
www.paypalobjects.com DigiCert SHA2 Extended Validation Server CA |
2022-10-13 - 2023-11-13 |
a year | crt.sh |
www.paypal.com DigiCert SHA2 Extended Validation Server CA |
2022-11-10 - 2023-11-10 |
a year | crt.sh |
t.paypal.com DigiCert SHA2 Extended Validation Server CA |
2022-10-19 - 2023-11-19 |
a year | crt.sh |
*.gstatic.com GTS CA 1C3 |
2023-07-10 - 2023-10-02 |
3 months | crt.sh |
misc.google.com GTS CA 1C3 |
2023-07-10 - 2023-10-02 |
3 months | crt.sh |
This page contains 8 frames:
Primary Page:
https://secure.knottysurprisexoxo.com/signin/
Frame ID: DD00F16AF26C948FFF57EE7D71EA8717
Requests: 29 HTTP requests in this frame
Frame:
https://secure.knottysurprisexoxo.com/KNYGHT/inc/grcenterprise_v3.htm
Frame ID: 71E293F1CC801531D503CE5AF3C0FEB5
Requests: 4 HTTP requests in this frame
Frame:
https://c.paypal.com/v1/r/d/i?js_src=https://c.paypal.com/da/r/fb.js
Frame ID: E58EA0D449123FA77BC72AFA90457F77
Requests: 5 HTTP requests in this frame
Frame:
https://b.stats.paypal.com/v1/counter.cgi?r=cD1lMWQ1NmRmZTg1ZTg0Y2FhOTBhZTU4YTU4N2Q3OWRjOCZpPTIyMy4yMjYuNTEuNjAmdD0xNjM5ODIxMDM2LjM2MiZhPTIxJnM9VU5JRklFRF9MT0dJTqyzufzl5ewrr23xXsolwTVJLPNQ
Frame ID: 0CB52E38877A603AD8323AA203BDEF75
Requests: 1 HTTP requests in this frame
Frame:
https://secure.knottysurprisexoxo.com/KNYGHT/inc/grcenterprise_v3_data/anchor_data/a.htm
Frame ID: 264FA196925BB1E9415C1CCD93B87107
Requests: 1 HTTP requests in this frame
Frame:
https://secure.knottysurprisexoxo.com/KNYGHT/inc/i.htm
Frame ID: 8AE4C1B0B3D2DBEFD2A4906DAB983A11
Requests: 2 HTTP requests in this frame
Frame:
https://secure.knottysurprisexoxo.com/KNYGHT/inc/grcenterprise_v3_data/anchor.htm
Frame ID: 4C3E3F3292E51B400695EF813C02D851
Requests: 3 HTTP requests in this frame
Frame:
https://www.recaptcha.net/recaptcha/enterprise/anchor?ar=1&k=6LdCCOUUAAAAAHTE-Snr6hi4HJGtJk_d1_ce-gWB&co=aHR0cHM6Ly9zZWN1cmUua25vdHR5c3VycHJpc2V4b3hvLmNvbTo0NDM.&hl=en&v=VZKEDW9wslPbEc9RmzMqaOAP&size=invisible&cb=ckij9wyuhlh8
Frame ID: C929EA9E6C406479EFBDED0551A7946A
Requests: 3 HTTP requests in this frame
Screenshot
Page Title
Log in to your PayPal accountDetected technologies
PayPal (Payment Processors) ExpandDetected patterns
- paypalobjects\.com
Modernizr (JavaScript Libraries) Expand
Detected patterns
- ([\d.]+)?/modernizr(?:\.([\d.]+))?.*\.js
Page Statistics
6 Outgoing links
These are links going to different origins than the main page.
Title: Forgotten password?
Search URL Search Domain Scan URL
Title: We can help
Search URL Search Domain Scan URL
Title: Contact Us
Search URL Search Domain Scan URL
Title: Privacy
Search URL Search Domain Scan URL
Title: Legal
Search URL Search Domain Scan URL
Title: Worldwide
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 20- https://googleads.g.doubleclick.net/pagead/viewthroughconversion/965352860/?random=669066909&cv=9&fst=1639560941351&num=1&label=K7FtCJDsl_4CEJy7qMwD&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=667&u_w=375&u_ah=667&u_aw=375&u_cd=24&u_his=13&u_tz=330&u_java=false&u_nplug=0&u_nmime=0>m=2oi4f0&sendb=1&ig=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fwww.paypal.com%2Fin%2Fsignin&ref=https%3A%2F%2Fwww.paypal.com%2Fin%2Fhome&tiba=Log%20in%20to%20your%20PayPal%20account&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=7a69YcWdDcDErtoPpYiCyAI&sscte=1&crd= HTTP 302
- https://www.google.com/pagead/1p-conversion/965352860/?random=669066909&cv=9&fst=1639560941351&num=1&label=K7FtCJDsl_4CEJy7qMwD&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=667&u_w=375&u_ah=667&u_aw=375&u_cd=24&u_his=13&u_tz=330&u_java=false&u_nplug=0&u_nmime=0>m=2oi4f0&sendb=1&ig=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fwww.paypal.com%2Fin%2Fsignin&ref=https%3A%2F%2Fwww.paypal.com%2Fin%2Fhome&tiba=Log%20in%20to%20your%20PayPal%20account&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=7a69YcWdDcDErtoPpYiCyAI&random=2413672463&resp=GooglemKTybQhCsO HTTP 302
- https://www.google.co.jp/pagead/1p-conversion/965352860/?random=669066909&cv=9&fst=1639560941351&num=1&label=K7FtCJDsl_4CEJy7qMwD&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=667&u_w=375&u_ah=667&u_aw=375&u_cd=24&u_his=13&u_tz=330&u_java=false&u_nplug=0&u_nmime=0>m=2oi4f0&sendb=1&ig=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fwww.paypal.com%2Fin%2Fsignin&ref=https%3A%2F%2Fwww.paypal.com%2Fin%2Fhome&tiba=Log%20in%20to%20your%20PayPal%20account&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=7a69YcWdDcDErtoPpYiCyAI&random=2413672463&resp=GooglemKTybQhCsO&ipr=y
48 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
secure.knottysurprisexoxo.com/signin/ |
43 KB 43 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
conversion_async.js
secure.knottysurprisexoxo.com/KNYGHT/inc/ |
37 KB 37 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
analytics.js
secure.knottysurprisexoxo.com/KNYGHT/inc/ |
44 KB 44 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
gtag.js
secure.knottysurprisexoxo.com/KNYGHT/inc/ |
79 KB 79 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
latmconf.js
secure.knottysurprisexoxo.com/KNYGHT/inc/ |
132 KB 132 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ngrlCaptcha.js
secure.knottysurprisexoxo.com/KNYGHT/inc/ |
21 KB 21 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
contextualLoginElementalUI.css
secure.knottysurprisexoxo.com/KNYGHT/inc/ |
120 KB 121 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
modernizr-2.js
secure.knottysurprisexoxo.com/KNYGHT/inc/ |
4 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
a
secure.knottysurprisexoxo.com/KNYGHT/inc/ |
2 KB 3 KB |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
a_002
secure.knottysurprisexoxo.com/KNYGHT/inc/ |
2 KB 2 KB |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon-PN-check.png
secure.knottysurprisexoxo.com/KNYGHT/inc/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
glyph_alert_critical_big-2x.png
secure.knottysurprisexoxo.com/KNYGHT/inc/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
fn-sync-telemetry-min.js
secure.knottysurprisexoxo.com/KNYGHT/inc/ |
5 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
signin-split.js
secure.knottysurprisexoxo.com/KNYGHT/inc/ |
320 KB 320 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
pa.js
secure.knottysurprisexoxo.com/KNYGHT/inc/ |
59 KB 59 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
recaptchav3.js
secure.knottysurprisexoxo.com/KNYGHT/inc/ |
11 KB 11 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
patleaf.js
secure.knottysurprisexoxo.com/KNYGHT/inc/ |
130 KB 130 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
patlcfg.js
secure.knottysurprisexoxo.com/KNYGHT/inc/ |
6 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
fb.js
secure.knottysurprisexoxo.com/KNYGHT/inc/ |
55 KB 55 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.google.com/pagead/1p-user-list/965352860/ |
42 B 455 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.google.co.in/pagead/1p-user-list/965352860/ |
42 B 455 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.google.co.jp/pagead/1p-conversion/965352860/ Redirect Chain
|
42 B 455 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
momgram@2x.png
www.paypalobjects.com/images/shared/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
PayPalSansSmall-Regular.woff
www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/ |
46 KB 46 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
PayPalSansBig-Regular.woff2
www.paypalobjects.com/paypal-ui/fonts/ |
25 KB 25 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
PayPalSansBig-Medium.woff2
www.paypalobjects.com/paypal-ui/fonts/ |
18 KB 18 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
grcenterprise_v3.htm
secure.knottysurprisexoxo.com/KNYGHT/inc/ Frame 71E2 |
7 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
i
c.paypal.com/v1/r/d/ Frame E58E |
160 B 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
counter.cgi
b.stats.paypal.com/v1/ Frame 0CB5 |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
a.htm
secure.knottysurprisexoxo.com/KNYGHT/inc/grcenterprise_v3_data/anchor_data/ Frame 264F |
108 B 349 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ts
t.paypal.com/ |
42 B 793 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
i.htm
secure.knottysurprisexoxo.com/KNYGHT/inc/ Frame 8AE4 |
208 B 449 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ts
t.paypal.com/ |
42 B 209 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
recaptcha__en.js
secure.knottysurprisexoxo.com/KNYGHT/inc/grcenterprise_v3_data/ Frame 71E2 |
344 KB 345 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
enterprise.js
secure.knottysurprisexoxo.com/KNYGHT/inc/grcenterprise_v3_data/ Frame 71E2 |
977 B 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
anchor.htm
secure.knottysurprisexoxo.com/KNYGHT/inc/grcenterprise_v3_data/ Frame 4C3E |
40 KB 41 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fb.js
c.paypal.com/da/r/ Frame E58E |
63 KB 22 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
fb.js
secure.knottysurprisexoxo.com/KNYGHT/inc/ Frame 8AE4 |
55 KB 55 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
recaptcha__en.js
www.gstatic.com/recaptcha/releases/VZKEDW9wslPbEc9RmzMqaOAP/ Frame 71E2 |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
styles__ltr.css
secure.knottysurprisexoxo.com/KNYGHT/inc/grcenterprise_v3_data/anchor_data/ Frame 4C3E |
51 KB 51 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
recaptcha__en.js
secure.knottysurprisexoxo.com/KNYGHT/inc/grcenterprise_v3_data/ Frame 4C3E |
148 KB 0 |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
p1
c.paypal.com/v1/r/d/b/ Frame E58E |
125 B 874 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
e
c.paypal.com/v1/r/d/b/ Frame E58E |
0 464 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
p3
c6.paypal.com/v1/r/d/b/ Frame E58E |
0 502 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
anchor
www.recaptcha.net/recaptcha/enterprise/ Frame C929 |
7 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
styles__ltr.css
www.gstatic.com/recaptcha/releases/VZKEDW9wslPbEc9RmzMqaOAP/ Frame C929 |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
recaptcha__en.js
www.gstatic.com/recaptcha/releases/VZKEDW9wslPbEc9RmzMqaOAP/ Frame C929 |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ts
t.paypal.com/ |
42 B 488 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- b.stats.paypal.com
- URL
- https://b.stats.paypal.com/v1/counter.cgi?r=cD1lMWQ1NmRmZTg1ZTg0Y2FhOTBhZTU4YTU4N2Q3OWRjOCZpPTIyMy4yMjYuNTEuNjAmdD0xNjM5ODIxMDM2LjM2MiZhPTIxJnM9VU5JRklFRF9MT0dJTqyzufzl5ewrr23xXsolwTVJLPNQ
- Domain
- www.gstatic.com
- URL
- https://www.gstatic.com/recaptcha/releases/VZKEDW9wslPbEc9RmzMqaOAP/recaptcha__en.js
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: PayPal (Financial)33 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 object| 2 object| 3 object| 4 function| preback object| google_tag_manager object| gDataLayer function| GooglemKTybQhCsO function| google_trackConversion object| google_tag_data function| ga object| gaplugins object| latmconf boolean| paypalADSInterceptorInjected object| html5 object| Modernizr function| isEligibleIntegration object| antiClickjack object| PAYPAL function| $ object| fpti string| fptiserverurl object| _ifpti object| pako object| TLT object| _0x57c4 function| _0x1a3e object| _0x5a43 function| _0x2c64 object| d function| ccabaabfccb object| err8 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
secure.knottysurprisexoxo.com/ | Name: PHPSESSID Value: 3e31bda4209d6b2fc93fa25d1f71e7ed |
|
.doubleclick.net/ | Name: test_cookie Value: CheckForPermission |
|
.knottysurprisexoxo.com/ | Name: TLTSID Value: 21531635969338511266866976337770 |
|
.paypal.com/ | Name: ts_c Value: vr%3D4c73161dc23e987%26vt%3D20903bf7206d5fea |
|
.c.paypal.com/ | Name: sc_f Value: 4lF6cxA52rYbDfIv6uF9w13V7tnV9u4M9WLg-J51FlWLa6xdN0FeATPtoB9oyRPkgv-j5jJXpU4I6H2YhTZPGwRfCpXw1Dntcn72em |
|
.paypal.com/ | Name: KHcl0EuY7AKSMgfvHl7J5E7hPtK Value: KOaBk1B17ZV3_Nhh4nYmSZrXmFE3ZUnt9tnPonEMRemgNQu68QOV61yh7M1cmQe0C75IlYFC7y7LGI2P |
|
.paypal.com/ | Name: l7_az Value: dcg01.phx |
|
.paypal.com/ | Name: ts Value: vreXpYrS%3D1785972037%26vteXpYrS%3D1691365837%26vr%3D4c73161dc23e987%26vt%3D20903bf7206d5fea |
6 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
b.stats.paypal.com
c.paypal.com
c6.paypal.com
googleads.g.doubleclick.net
secure.knottysurprisexoxo.com
t.paypal.com
www.google.co.in
www.google.co.jp
www.google.com
www.gstatic.com
www.paypalobjects.com
www.recaptcha.net
b.stats.paypal.com
www.gstatic.com
142.250.199.99
142.250.207.35
142.251.42.194
151.101.1.21
151.101.193.35
151.101.194.133
151.101.65.35
172.217.175.99
172.217.26.228
91.209.70.247
070403d1b51ba80edb8fbaf732fa96b33b2aab9a7f8eb3e879f62f1399071d9b
149960d3127ec5afd4557373318c6f6cb15e767f81fdce7cc16bb2c6f4094de3
1f70ff447ed799a34f4c3ae37ef1f49ed4af71123ba2c2aefe354565354284be
2ae6779c6c3579643ab6deb5cfb822e843bf637d006a4ec25d9857ec7fb6d8c1
3ba795672c78c8f0f52ecd5d1a0a317d1e5c059509a6bead9d26b46fc831d83b
4927e0f833929aa3794709b3512ae8c12ec3ab7d8508a8e57356a1e4365b8465
4b16c98214d45bedb1513b7fd53a02ce204f6a2091a920c3122fb213168c3139
509d4f435d5d6474e7f1ab39b5d73059243233d062d9bf08cd548a8228bf8399
62bb5685d837089cd6aedb6f5fe5375c83ce5facc879632628e1e63e51399580
6b487cf8647fb6f235227f22add45723bcbcd74e0996b69bdec306e03a751be8
6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93
71399ff1720fa4e82d94d92941a8fe5ec96a4449d5f83bae63da5d361d1bcdf8
7317a02358b2b617ba0934b570c313ee76f29176c4821a9a5fd1656413e5f41b
77951013a7eec2075cbf39c0bee73b01991476df2560c2dc35ed3b2ee0e53400
8b202d5bd55968ce4bfc21c063166eaebe62104275ce7ec362d78b64b2581c95
8ba56f6b8db4984684e70e96502fb1a4f4d436e22e147ad693f70e78c3921a41
9321bc63a75b3ac6d384b411665b6e77a8b326a4b176ca2049872d3b5d4974f5
93d5ad6a49a0fea03d881cfc4dea0fd62fc3fee105fab6838bb0313b79f02806
a6c3bff965978df8093c3a29f7071c21d7439a212af41e7b40ce70d94d6bcc44
a913d18a0cf3d623822483c8c7456cff16fbe286a5006167e6caa4143887cc39
ad3cc24a66bae714bcb1536ba2be070d636f61bbdfedf1e66de4d2a610a4f9e1
ae79dcc3eb016922caa1d095cfd936446bc65a46bb3364b242dfc556f7e3c6a8
afd8f1e0ddd618e91e0749c475e0d25ed12b92c73018d8e0446aaabe6c9221b3
b3f1bf1d5e25838bcad8535a2b700486644f4ea888e46c77d3e82783cb9da1b4
bdf26bf839a21919969834fdeb91e9d39266897ec9d7245959ea5965a3891313
d2847bea03b68a100caf41aca4d972b58368b4ee956ab13dde15963d905d7c24
de40f8e9a13821460fad3250442ee45458a1073661d67758f325b3a354995dd3
dfb64b8e6d5e9b918a78d41825cb9d47dc230f8206360226c9fa4c6ad5e6cb7e
e1c32475b054daff0f2c3742e21952a7701bca38cdd00af6926d5f961a34bbea
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4e9a7be6ec3c6d1d3bc600e82525526de6ab1a585128aeb7635021e5311d555
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef874a3d6245d4f2e40a23f48506597695793045ea66f899bcab6cfa2794f348
efc2b9f484b5ac1b12b80b5512d69ecb219c6e107ba0544124168fd89a80a553
f1ac5bc2d2f0c446b2d5bc135db7414a2662ade7b701bc199456d05f51bfc261
f3e86c407d903034a9e0287a4ac6676f5b5f5f5954655593ce9defed3c86bd31
f982a9dad50b916735a08b8e6f40efa7f97163106b18da079b144764c86a44a1