paypkonto.app
Open in
urlscan Pro
160.153.41.196
Malicious Activity!
Public Scan
Effective URL: https://paypkonto.app/ch-de/webapp/5bd7a578347d2f90e8046e169a16ba32/signinauth.php?country.x=BE&locale.x=fr_BE&custome...
Submission Tags: phishing malicious Search All
Submission: On March 10 via api from US
Summary
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on March 10th 2020. Valid for: a year.
This is the only time paypkonto.app was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: PayPal (Financial)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 64.98.145.30 64.98.145.30 | 32491 (TUCOWS-3) (TUCOWS-3) | |
4 12 | 160.153.41.196 160.153.41.196 | 26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC) | |
8 | 1 |
ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: ip-160-153-41-196.ip.secureserver.net
paypkonto.app |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
paypkonto.app
4 redirects
paypkonto.app |
73 KB |
1 |
globalsecureredirect.com
1 redirects
globalsecureredirect.com |
580 B |
8 | 2 |
Domain | Requested by | |
---|---|---|
12 | paypkonto.app |
4 redirects
paypkonto.app
|
1 | globalsecureredirect.com | 1 redirects |
8 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
paypkonto.app Go Daddy Secure Certificate Authority - G2 |
2020-03-10 - 2021-03-10 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://paypkonto.app/ch-de/webapp/5bd7a578347d2f90e8046e169a16ba32/signinauth.php?country.x=BE&locale.x=fr_BE&customer.x=ID-PA$1$26y/MUdq$ZwDQLQfTEDLxoUWNosGbS0&safety=Ea8fafF1fXs6i3kUjM7882Qfdrd3ebPB6TgadyhaS1H6ceqJ7NceltVm335baIvn1fbeAzDRZ228Kup9GaL40Ox0CYwWo0
Frame ID: BAD6A4E20CF1B7D67A8AB45BDBA8CCCB
Requests: 8 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://globalsecureredirect.com/redirecting
HTTP 303
https://paypkonto.app/redirecting Page URL
-
https://paypkonto.app/ch-de/webapp
HTTP 301
https://paypkonto.app/ch-de/webapp/ HTTP 302
https://paypkonto.app/ch-de/webapp/XYSDIRX.php HTTP 302
https://paypkonto.app/ch-de/webapp/5bd7a578347d2f90e8046e169a16ba32 HTTP 301
https://paypkonto.app/ch-de/webapp/5bd7a578347d2f90e8046e169a16ba32/ Page URL
- https://paypkonto.app/ch-de/webapp/5bd7a578347d2f90e8046e169a16ba32/signinauth.php?country.x=BE&lo... Page URL
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://globalsecureredirect.com/redirecting
HTTP 303
https://paypkonto.app/redirecting Page URL
-
https://paypkonto.app/ch-de/webapp
HTTP 301
https://paypkonto.app/ch-de/webapp/ HTTP 302
https://paypkonto.app/ch-de/webapp/XYSDIRX.php HTTP 302
https://paypkonto.app/ch-de/webapp/5bd7a578347d2f90e8046e169a16ba32 HTTP 301
https://paypkonto.app/ch-de/webapp/5bd7a578347d2f90e8046e169a16ba32/ Page URL
- https://paypkonto.app/ch-de/webapp/5bd7a578347d2f90e8046e169a16ba32/signinauth.php?country.x=BE&locale.x=fr_BE&customer.x=ID-PA$1$26y/MUdq$ZwDQLQfTEDLxoUWNosGbS0&safety=Ea8fafF1fXs6i3kUjM7882Qfdrd3ebPB6TgadyhaS1H6ceqJ7NceltVm335baIvn1fbeAzDRZ228Kup9GaL40Ox0CYwWo0 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://globalsecureredirect.com/redirecting HTTP 303
- https://paypkonto.app/redirecting
- https://paypkonto.app/ch-de/webapp HTTP 301
- https://paypkonto.app/ch-de/webapp/ HTTP 302
- https://paypkonto.app/ch-de/webapp/XYSDIRX.php HTTP 302
- https://paypkonto.app/ch-de/webapp/5bd7a578347d2f90e8046e169a16ba32 HTTP 301
- https://paypkonto.app/ch-de/webapp/5bd7a578347d2f90e8046e169a16ba32/
8 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
redirecting
paypkonto.app/ Redirect Chain
|
94 B 202 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
paypkonto.app/ch-de/webapp/5bd7a578347d2f90e8046e169a16ba32/ Redirect Chain
|
277 B 338 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
signinauth.php
paypkonto.app/ch-de/webapp/5bd7a578347d2f90e8046e169a16ba32/ |
4 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
xcontexLogx.css
paypkonto.app/ch-de/webapp/5bd7a578347d2f90e8046e169a16ba32/XYSASSETSX/css/ |
95 KB 14 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
paypkonto.app/ch-de/webapp/5bd7a578347d2f90e8046e169a16ba32/XYSASSETSX/js/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
xsinauthx.js
paypkonto.app/ch-de/webapp/5bd7a578347d2f90e8046e169a16ba32/XYSASSETSX/js/ |
6 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
xppappx.js
paypkonto.app/ch-de/webapp/5bd7a578347d2f90e8046e169a16ba32/XYSASSETSX/js/ |
62 KB 23 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
loginlogo.svg
paypkonto.app/ch-de/webapp/5bd7a578347d2f90e8046e169a16ba32/XYSASSETSX/img/ |
5 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: PayPal (Financial)23 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| $ function| jQuery string| sc_code_ver string| s_account object| s function| s_doPlugins string| s_code undefined| s_objectID function| s_gi function| s_giqf string| s_an function| s_sp function| s_jn function| s_rep function| s_d function| s_fe function| s_fa function| s_ft object| s_c_il number| s_c_in number| s_giq2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.paypkonto.app/ | Name: s_sess Value: %20s_ppv%3D100%3B |
|
paypkonto.app/ | Name: PHPSESSID Value: 7457bd49da0746046afdee92c1710d43 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
globalsecureredirect.com
paypkonto.app
160.153.41.196
64.98.145.30
36b360980867ad906788319227a2985598db4d889d8c3cc5c53fc1ad03f78d49
5cec133c9d62052e05ada3caf5a770143f12150a608291deea4eaee7a50a28c1
86cdcd99c3701ce8da6608b83349cb0907e53b28b2512b4ed79efbefeba83826
a9520041348006227b2835613ad8c94d90f6c7ba93338b7aa7d1eb3e6e404989
b3cc50b9e94bbecaaeb1079b64b8ca50616d1732824964c1cc2c5422627a0ec5
c50e99c8d4144a7f9ca200f70afad65c1aacbd70070d70018c440bc15f821fcb
d30b6114fb9496ae46b2a8cdf59379c8ffdb957534bd1dd73e626c7c61c7e67d
fb64006eaf447c7008b2146d5f920cd1e9f55059dbd4ad2a4147a293873a589a