creatingsoptions-connects.com

Summary

This website contacted 2 IPs in 2 countries across 3 domains to perform 3 HTTP transactions. The main IP is 2606:4700:3033::6815:5d7d, located in United States and belongs to CLOUDFLARENET, US. The main domain is creatingsoptions-connects.com.
TLS certificate: Issued by WE1 on December 21st 2024. Valid for: 3 months.

This is the only time creatingsoptions-connects.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	188.114.96.3 188.114.96.3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700:303... 2606:4700:3033::6815:5d7d	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	192.229.221.25 192.229.221.25	15133 (EDGECAST) (EDGECAST)
3	2

1 188.114.96.3 (Amsterdam, Netherlands) 1 redirects

ASN13335 (CLOUDFLARENET, US)

creditoraccountingradiologist.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:3033::6815:5d7d (United States)

ASN13335 (CLOUDFLARENET, US)

creatingsoptions-connects.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.229.221.25 (United States)

ASN15133 (EDGECAST, US)

www.paypalobjects.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	creatingsoptions-connects.com creatingsoptions-connects.com	2 KB
1	paypalobjects.com www.paypalobjects.com — Cisco Umbrella Rank: 2811	4 KB
1	creditoraccountingradiologist.com 1 redirects creditoraccountingradiologist.com	494 B
3	3

	Domain	Requested by
2	creatingsoptions-connects.com	creatingsoptions-connects.com
1	www.paypalobjects.com	creatingsoptions-connects.com
1	creditoraccountingradiologist.com	1 redirects
3	3

This site contains no links.

Subject Issuer	Validity	Valid
creatingsoptions-connects.com WE1	`2024-12-21` - `2025-03-21`	3 months	crt.sh
www.paypal.com DigiCert SHA2 Extended Validation Server CA	`2024-06-13` - `2025-06-12`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://creatingsoptions-connects.com/2/
Frame ID: 55EC9DB3F0753391C66D8A33FA2C4287
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Chargement...

Page URL History Show full URLs

http://creditoraccountingradiologist.com/ HTTP 307
https://creditoraccountingradiologist.com/ HTTP 301
https://creatingsoptions-connects.com/2/ Page URL

Detected technologies

PayPal (Payment Processors) Expand

Overall confidence: 100%
Detected patterns

paypalobjects\.com

Page Statistics

3
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

6 kB
Transfer

13 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://creditoraccountingradiologist.com/ HTTP 307
https://creditoraccountingradiologist.com/ HTTP 301
https://creatingsoptions-connects.com/2/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
creatingsoptions-connects.com/2/
Redirect Chain

http://creditoraccountingradiologist.com/
https://creditoraccountingradiologist.com/
https://creatingsoptions-connects.com/2/

786 B
1 KB

1672ms
1597ms

Document
text/html

2606:4700:3033::6815:5d7d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://creatingsoptions-connects.com/2/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::6815:5d7d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/8.1.29
Resource Hash: 2f09328076027568a77f0054b884bc0da485d2b5e2428017c4534cd1cc783859

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Android 13; Mobile; rv:112.0) Gecko/112.0 Firefox/112.0

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-store, no-cache, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 8f6b94cdfe9ab8be-AMS
content-encoding: zstd
content-type: text/html; charset=UTF-8
date: Mon, 23 Dec 2024 21:52:55 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pcGkS4%2F0a2YWTI5mq5w9ty31P56pvS%2BkIoqc%2BSUW3DVCQxwqa86FPWHw3LgmiS0G9w85X35m9el%2FP%2BN72RlAOtxs%2BAKi1jT0sEtqPrGvxhjYoxN%2BGgoK0%2F5BUrznkOtjq3uh0iANQh1GYRUzJUCwXMo1xfQaH%2B1W3YaCzA%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfL4;desc="?proto=TCP&rtt=15050&min_rtt=14654&rtt_var=2647&sent=7&recv=11&lost=0&retrans=0&sent_bytes=3989&recv_bytes=2367&delivery_rate=261123&cwnd=253&unsent_bytes=0&cid=3b349bd444a0c598&ts=1602&x=0"
vary: Accept-Encoding
x-powered-by: PHP/8.1.29

Redirect headers

cache-control: max-age=3600
cf-ray: 8f6b94cd5e1eb7ae-AMS
content-length: 167
content-type: text/html
date: Mon, 23 Dec 2024 21:52:53 GMT
expires: Mon, 23 Dec 2024 22:52:53 GMT
location: https://creatingsoptions-connects.com/2/
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PpvMFXXEqyzi27lJmpalmef4v9TxPteSTniEuoAjIZf3qyeDWQOpYi1TzXPsWs4cWIyE1sXZWydw73yPSCbo6T3mFEP1r7rh%2BjvgivDDrfBOaKgpItCmnIKKIcF7ymUWjzNDrf12wgsQQ9JwuEveMZLf6hQ%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H2 200 pp_fc_hl.svg
www.paypalobjects.com/digitalassets/c/website/logo/full-text/ 11 KB
4 KB 83ms
19ms Image
image/svg+xml 192.229.221.25
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.paypalobjects.com/digitalassets/c/website/logo/full-text/pp_fc_hl.svg

Requested by

Host: creatingsoptions-connects.com
URL: https://creatingsoptions-connects.com/2/

Protocol

H2

Security

TLS 1.3, , AES_256_GCM

Server

192.229.221.25 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (ama/4904) /

Resource Hash

036f5ec2d493c1c70c99b98eb3a666241af203a93f3fc3b8b64316794b4dcd3f

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Android 13; Mobile; rv:112.0) Gecko/112.0 Firefox/112.0
Referer: https://creatingsoptions-connects.com/

Response headers

paypal-debug-id: 55929dbf68d30
content-encoding: br
etag: W/"56e84b0a-2b4b"
x-content-type-options: nosniff
expires: Mon, 23 Dec 2024 22:52:55 GMT
traceparent: 00-000000000000000000055929dbf68d30-a3e160f79bf5b93c-01
dc: ccg11-origin-www-1.paypal.com
x-cache: HIT
date: Mon, 23 Dec 2024 21:52:55 GMT
content-type: image/svg+xml
last-modified: Tue, 15 Mar 2016 17:48:58 GMT
vary: Accept-Encoding
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: s-maxage=31536000, public,max-age=3600
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
access-control-allow-origin: *
content-length: 3716
server: ECAcc (ama/4904)

GET
H2 200 antibot.js Show response
creatingsoptions-connects.com/2/ 950 B
1013 B 31ms
30ms Script
application/javascript 2606:4700:3033::6815:5d7d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://creatingsoptions-connects.com/2/antibot.js
Requested by: Host: creatingsoptions-connects.com
URL: https://creatingsoptions-connects.com/2/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::6815:5d7d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9688e03d6aa3f6a5781822aaf87dd0cfb150c7a258434ed98ca12876b1a3340f

Request headers

User-Agent: Mozilla/5.0 (Android 13; Mobile; rv:112.0) Gecko/112.0 Firefox/112.0
Referer: https://creatingsoptions-connects.com/2/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"67663c41-3b6"
age: 196229
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dCrbWbYwRdja7MSYDynQZxmeUXraeRL4H0dTMeW9DZRc5SLc2prkXOjDC%2BvrIkjwB%2FR%2F6d80O4KO0S6koqUnmlczpJ%2BhHn%2BiS5oZ6E1Nm4nQoqmdtYNbdpWcsznYdqFiYwyWnhP4P0wUuFECSUFQw4O1Fk81%2BbL5ZSnHFQ%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: Thu, 31 Dec 2037 23:55:55 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=17522&min_rtt=14654&rtt_var=6404&sent=11&recv=13&lost=0&retrans=0&sent_bytes=5338&recv_bytes=2517&delivery_rate=261123&cwnd=256&unsent_bytes=0&cid=3b349bd444a0c598&ts=1650&x=0"
date: Mon, 23 Dec 2024 21:52:55 GMT
content-type: application/javascript
last-modified: Sat, 21 Dec 2024 03:55:45 GMT
vary: Accept-Encoding
cache-control: max-age=315360000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8f6b94d8082fb8be-AMS
server: cloudflare

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| o

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			creatingsoptions-connects.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: nbqs831uak5bg8d8s66mnattjo

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

creatingsoptions-connects.com
creditoraccountingradiologist.com
www.paypalobjects.com
188.114.96.3
192.229.221.25
2606:4700:3033::6815:5d7d
036f5ec2d493c1c70c99b98eb3a666241af203a93f3fc3b8b64316794b4dcd3f
2f09328076027568a77f0054b884bc0da485d2b5e2428017c4534cd1cc783859
9688e03d6aa3f6a5781822aaf87dd0cfb150c7a258434ed98ca12876b1a3340f

creatingsoptions-connects.com Open in urlscan Pro 2606:4700:3033::6815:5d7d Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

3 Requests

100 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

2 IPs

2 Countries

6 kBTransfer

13 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

1 Cookies

Indicators

creatingsoptions-connects.com Open in urlscan Pro
2606:4700:3033::6815:5d7d Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

3
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

6 kB
Transfer

13 kB
Size

1
Cookies

3 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!