knickelbein.com Open in urlscan Pro
143.95.229.33 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://ppservp.mariposamusic.net/
Effective URL:
https://knickelbein.com/lgs/bgs/new_ups/myaccount/signin/?country.x=DE&locale.x=en_DE
Submission Tags: @ipnigh
Submission: On September 14 via api (September 14th 2019, 11:16:07 pm UTC) from GB

Summary HTTP 11 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 11 HTTP transactions. The main IP is 143.95.229.33, located in Los Angeles, United States and belongs to ASMALLORANGE1 - A Small Orange LLC, US. The main domain is knickelbein.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on September 13th 2019. Valid for: 3 months.

This is the only time knickelbein.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: PayPal (Financial)

Domain & IP information

	IP Address	AS Autonomous System
3 7	143.95.229.33 143.95.229.33	62729 (ASMALLORA...) (ASMALLORANGE1 - A Small Orange LLC)
3	2.18.232.160 2.18.232.160	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
4	104.109.80.100 104.109.80.100	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
11	3

7 143.95.229.33 (Los Angeles, United States) 3 redirects

ASN62729 (ASMALLORANGE1 - A Small Orange LLC, US)
PTR: omkeng.gr

ppservp.mariposamusic.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
knickelbein.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2.18.232.160 (Ascension Island)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a2-18-232-160.deploy.static.akamaitechnologies.com

cdn.livechatinc.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
accounts.livechatinc.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 104.109.80.100 (Netherlands)

ASN20940 (AKAMAI-ASN1, US)
PTR: a104-109-80-100.deploy.static.akamaitechnologies.com

secure.livechatinc.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	livechatinc.com cdn.livechatinc.com secure.livechatinc.com accounts.livechatinc.com	74 KB
6	knickelbein.com 2 redirects knickelbein.com	47 KB
1	mariposamusic.net 1 redirects ppservp.mariposamusic.net	234 B
11	3

	Domain	Requested by
6	knickelbein.com	2 redirects knickelbein.com
4	secure.livechatinc.com	cdn.livechatinc.com knickelbein.com
2	cdn.livechatinc.com	knickelbein.com
1	accounts.livechatinc.com	cdn.livechatinc.com
1	ppservp.mariposamusic.net	1 redirects
11	5

This site contains no links.

Subject Issuer	Validity	Valid
knickelbein.com Let's Encrypt Authority X3	`2019-09-13` - `2019-12-12`	3 months	crt.sh
*.livechatinc.com DigiCert ECC Secure Server CA	`2019-02-10` - `2020-05-11`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://knickelbein.com/lgs/bgs/new_ups/myaccount/signin/?country.x=DE&locale.x=en_DE
Frame ID: 48F4E983678D29113E086EEB00B82BD2
Requests: 10 HTTP requests in this frame

Frame: https://secure.livechatinc.com/licence/11290317/v2/open_chat.cgi?license=11290317&group=0&embedded=1&widget_version=3&unique_groups=0
Frame ID: 5C82B4C8773025C1021BB25E7C1F1585
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://ppservp.mariposamusic.net/ HTTP 301
https://knickelbein.com/lgs/bgs/new_ups HTTP 301
https://knickelbein.com/lgs/bgs/new_ups/ HTTP 302
https://knickelbein.com/lgs/bgs/new_ups/myaccount/signin/?country.x=DE&locale.x=en_DE Page URL

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

LiveChat (Live Chat) Expand

Overall confidence: 100%
Detected patterns

script /cdn\.livechatinc\.com\/.*tracking\.js/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

11
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

5
Subdomains

3
IPs

3
Countries

121 kB
Transfer

336 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://ppservp.mariposamusic.net/ HTTP 301
https://knickelbein.com/lgs/bgs/new_ups HTTP 301
https://knickelbein.com/lgs/bgs/new_ups/ HTTP 302
https://knickelbein.com/lgs/bgs/new_ups/myaccount/signin/?country.x=DE&locale.x=en_DE Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response knickelbein.com/lgs/bgs/new_ups/myaccount/signin/ Redirect Chain http://ppservp.mariposamusic.net/ https://knickelbein.com/lgs/bgs/new_ups https://knickelbein.com/lgs/bgs/new_ups/ https://knickelbein.com/lgs/bgs/new_ups/myaccount/signin/?country.x=DE&locale.x=en_DE	8 KB 3 KB	374ms 374ms	Document text/html	143.95.229.33 A Small Orange LLC
General Check archive.org Show headers Download Go to Full URL https://knickelbein.com/lgs/bgs/new_ups/myaccount/signin/?country.x=DE&locale.x=en_DE Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 143.95.229.33 Los Angeles, United States, ASN62729 (ASMALLORANGE1 - A Small Orange LLC, US), Reverse DNS omkeng.gr Software nginx/1.16.0 / Resource Hash `627eb28cf0efe6d8e9900fb562dce96f5b0c595e89e11d937613003865394af1` Request headers Host knickelbein.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3 Sec-Fetch-Site none Accept-Encoding gzip, deflate, br Cookie PHPSESSID=aibb59ni1piah1p415cbf03921 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Server nginx/1.16.0 Date Sat, 14 Sep 2019 23:15:50 GMT Content-Type text/html; charset=UTF-8 Transfer-Encoding chunked Connection keep-alive Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma no-cache Content-Encoding gzip Redirect headers Server nginx/1.16.0 Date Sat, 14 Sep 2019 23:15:49 GMT Content-Type text/html; charset=UTF-8 Content-Length 0 Connection keep-alive Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma no-cache Set-Cookie PHPSESSID=aibb59ni1piah1p415cbf03921; path=/ LOCATION myaccount/signin/?country.x=DE&locale.x=en_DE
GET H/1.1	200 OK	L-Z118.css knickelbein.com/lgs/bgs/new_ups/lib/css/	13 KB 4 KB	293ms 292ms	Stylesheet text/css	143.95.229.33 A Small Orange LLC
General Check archive.org Show headers Download Go to Full URL https://knickelbein.com/lgs/bgs/new_ups/lib/css/L-Z118.css Requested by Host: knickelbein.com URL: https://knickelbein.com/lgs/bgs/new_ups/myaccount/signin/?country.x=DE&locale.x=en_DE Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 143.95.229.33 Los Angeles, United States, ASN62729 (ASMALLORANGE1 - A Small Orange LLC, US), Reverse DNS omkeng.gr Software nginx/1.16.0 / Resource Hash `1bcda772b32139bbd18696ba5a08fc2da9731cecf88d6b904cb953107484f55f` Request headers Sec-Fetch-Mode no-cors Referer https://knickelbein.com/lgs/bgs/new_ups/myaccount/signin/?country.x=DE&locale.x=en_DE User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Sat, 14 Sep 2019 23:15:50 GMT Content-Encoding gzip Last-Modified Tue, 22 Nov 2016 18:08:20 GMT Server nginx/1.16.0 Connection keep-alive Transfer-Encoding chunked Content-Type text/css
GET H/1.1	200 OK	jquery.js Show response knickelbein.com/lgs/bgs/new_ups/lib/js/	84 KB 34 KB	375ms 374ms	Script application/javascript	143.95.229.33 A Small Orange LLC
General Check archive.org Show headers Download Go to Full URL https://knickelbein.com/lgs/bgs/new_ups/lib/js/jquery.js Requested by Host: knickelbein.com URL: https://knickelbein.com/lgs/bgs/new_ups/myaccount/signin/?country.x=DE&locale.x=en_DE Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 143.95.229.33 Los Angeles, United States, ASN62729 (ASMALLORANGE1 - A Small Orange LLC, US), Reverse DNS omkeng.gr Software nginx/1.16.0 / Resource Hash `2a1f1370eb7b24a307312112427dfd544fb838a8bef66babc936f5e870a22e52` Request headers Sec-Fetch-Mode no-cors Referer https://knickelbein.com/lgs/bgs/new_ups/myaccount/signin/?country.x=DE&locale.x=en_DE User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Sat, 14 Sep 2019 23:15:50 GMT Content-Encoding gzip Last-Modified Sun, 04 Sep 2016 13:12:42 GMT Server nginx/1.16.0 Connection keep-alive Transfer-Encoding chunked Content-Type application/javascript
GET H/1.1	200 OK	kl_h4aXX6987PO.svg knickelbein.com/lgs/bgs/new_ups/lib/img/	5 KB 5 KB	244ms 243ms	Image image/svg+xml	143.95.229.33 A Small Orange LLC
General Check archive.org Show headers Download Go to Show image Full URL https://knickelbein.com/lgs/bgs/new_ups/lib/img/kl_h4aXX6987PO.svg Requested by Host: knickelbein.com URL: https://knickelbein.com/lgs/bgs/new_ups/myaccount/signin/?country.x=DE&locale.x=en_DE Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 143.95.229.33 Los Angeles, United States, ASN62729 (ASMALLORANGE1 - A Small Orange LLC, US), Reverse DNS omkeng.gr Software nginx/1.16.0 / Resource Hash `b3cc50b9e94bbecaaeb1079b64b8ca50616d1732824964c1cc2c5422627a0ec5` Request headers Sec-Fetch-Mode no-cors Referer https://knickelbein.com/lgs/bgs/new_ups/lib/css/L-Z118.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Sat, 14 Sep 2019 23:15:50 GMT Last-Modified Tue, 13 Sep 2016 19:20:10 GMT Server nginx/1.16.0 Connection keep-alive Accept-Ranges bytes Content-Length 4945 Content-Type image/svg+xml
GET H/1.1	200 OK	tracking.js Show response cdn.livechatinc.com/	210 KB 57 KB	17ms 6ms	Script application/javascript	2.18.232.160 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://cdn.livechatinc.com/tracking.js Requested by Host: knickelbein.com URL: https://knickelbein.com/lgs/bgs/new_ups/myaccount/signin/?country.x=DE&locale.x=en_DE Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 2.18.232.160 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a2-18-232-160.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash `ac5687d8eee03b3dc86398afc44333393fa89efa173fd10b8d993c83c0e21d94` Request headers Sec-Fetch-Mode no-cors Referer https://knickelbein.com/lgs/bgs/new_ups/myaccount/signin/?country.x=DE&locale.x=en_DE User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers x-amz-version-id ffoAxJbYHJAGFApjMzJjgXsAVPQiclIb Content-Encoding gzip Last-Modified Thu, 12 Sep 2019 13:14:53 GMT Server AmazonS3 X-Amz-Cf-Pop FRA50-C1 Date Sat, 14 Sep 2019 23:15:50 GMT Vary Accept-Encoding Content-Type application/javascript; charset=utf-8 Access-Control-Allow-Origin * Cache-Control max-age=28800 Connection keep-alive Content-Length 57941 X-Amz-Cf-Id UvUC6mK5BNj8JbVNeFQIAY60AwrVH3Dd1oFZQf0u90FYvPyz_zdLCA== Expires Sun, 15 Sep 2019 07:15:50 GMT
GET H/1.1	200 OK	get_dynamic_config.js Show response secure.livechatinc.com/licence/11290317/v2/	1 KB 2 KB	255ms 239ms	Script application/javascript	104.109.80.100 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://secure.livechatinc.com/licence/11290317/v2/get_dynamic_config.js?t=1568502950870&referrer=&url=https%3A%2F%2Fknickelbein.com%2Flgs%2Fbgs%2Fnew_ups%2Fmyaccount%2Fsignin%2F%3Fcountry.x%3DDE%26locale.x%3Den_DE&params=&channel_type=code&jsonp=__lc_data_744863 Requested by Host: cdn.livechatinc.com URL: https://cdn.livechatinc.com/tracking.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 104.109.80.100 , Netherlands, ASN20940 (AKAMAI-ASN1, US), Reverse DNS a104-109-80-100.deploy.static.akamaitechnologies.com Software / Resource Hash `add000d47537735288c3aac031d0761edfcc6a3d3eda236012170da7b96be8f4` Request headers Sec-Fetch-Mode no-cors Referer https://knickelbein.com/lgs/bgs/new_ups/myaccount/signin/?country.x=DE&locale.x=en_DE User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Sat, 14 Sep 2019 23:15:51 GMT Content-Encoding gzip Vary Accept-Encoding Content-Type application/javascript; charset=UTF-8 Access-Control-Expose-Headers X-RateLimit-Remaining, X-RateLimit-Reset Cache-Control max-age=0, no-cache, no-store X-RateLimit-Reset 1568502956 X-RateLimit-Remaining 4999 Connection keep-alive Content-Length 530 Expires Sat, 14 Sep 2019 23:15:51 GMT
GET H/1.1	200 OK	get_static_config.0.5.1.1.12.33.9.7.1.1.1.1.17.js Show response secure.livechatinc.com/licence/11290317/v2/	4 KB 2 KB	30ms 29ms	Script application/javascript	104.109.80.100 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://secure.livechatinc.com/licence/11290317/v2/get_static_config.0.5.1.1.12.33.9.7.1.1.1.1.17.js?&jsonp=__lc_data_static_config Requested by Host: cdn.livechatinc.com URL: https://cdn.livechatinc.com/tracking.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 104.109.80.100 , Netherlands, ASN20940 (AKAMAI-ASN1, US), Reverse DNS a104-109-80-100.deploy.static.akamaitechnologies.com Software / Resource Hash `4efbf18ff75077e2f2735ea84d854e3b9356fcbbdc433cda712ff995b6bceb1b` Request headers Sec-Fetch-Mode no-cors Referer https://knickelbein.com/lgs/bgs/new_ups/myaccount/signin/?country.x=DE&locale.x=en_DE User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Sat, 14 Sep 2019 23:15:51 GMT Content-Encoding gzip Vary Accept-Encoding Access-Control-Allow-Methods GET, HEAD, OPTIONS, POST Content-Type application/javascript; charset=UTF-8 Access-Control-Allow-Origin https://api.chat.io Access-Control-Expose-Headers location Cache-Control public, max-age=61 Access-Control-Allow-Credentials true Access-Control-Max-Age 86400 Connection keep-alive Access-Control-Allow-Headers origin, x-requested-with, content-type, accept Content-Length 1666 Expires Sat, 14 Sep 2019 23:16:52 GMT
GET H/1.1	200 OK	11290317 Show response accounts.livechatinc.com/licence/	0 2 KB	157ms 139ms	Script text/plain	2.18.232.160 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://accounts.livechatinc.com/licence/11290317 Requested by Host: cdn.livechatinc.com URL: https://cdn.livechatinc.com/tracking.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 2.18.232.160 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a2-18-232-160.deploy.static.akamaitechnologies.com Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Sec-Fetch-Mode no-cors Referer https://knickelbein.com/lgs/bgs/new_ups/myaccount/signin/?country.x=DE&locale.x=en_DE User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Connection keep-alive Date Sat, 14 Sep 2019 23:15:51 GMT Content-Length 0
GET H/1.1	200 OK	chat_widget_init secure.livechatinc.com/licence/11290317/v2/metrics/	0 203 B	145ms 145ms	Image text/plain	104.109.80.100 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://secure.livechatinc.com/licence/11290317/v2/metrics/chat_widget_init?data=%7B%22script_load_duration_ms%22%3A455%2C%22license_number%22%3A11290317%2C%22lc_version%22%3A%222%22%2C%22chat_widget_type%22%3A%22embedded%22%2C%22timezone_offset%22%3A%22-120%22%2C%22region%22%3A%22dal%22%2C%22script_version%22%3A%2220190912143646%22%2C%22navigation_load_duration_ms%22%3A2868%7D Requested by Host: knickelbein.com URL: https://knickelbein.com/lgs/bgs/new_ups/myaccount/signin/?country.x=DE&locale.x=en_DE Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 104.109.80.100 , Netherlands, ASN20940 (AKAMAI-ASN1, US), Reverse DNS a104-109-80-100.deploy.static.akamaitechnologies.com Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Sec-Fetch-Mode no-cors Referer https://knickelbein.com/lgs/bgs/new_ups/myaccount/signin/?country.x=DE&locale.x=en_DE User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Sat, 14 Sep 2019 23:15:51 GMT Cache-Control max-age=0, no-cache, no-store Connection keep-alive Content-Length 0 Expires Sat, 14 Sep 2019 23:15:51 GMT
GET H/1.1	200 OK	open_chat.cgi secure.livechatinc.com/licence/11290317/v2/ Frame 5C82	0 0	158ms 147ms	Document text/html	104.109.80.100 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://secure.livechatinc.com/licence/11290317/v2/open_chat.cgi?license=11290317&group=0&embedded=1&widget_version=3&unique_groups=0 Requested by Host: cdn.livechatinc.com URL: https://cdn.livechatinc.com/tracking.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 104.109.80.100 , Netherlands, ASN20940 (AKAMAI-ASN1, US), Reverse DNS a104-109-80-100.deploy.static.akamaitechnologies.com Software / Resource Hash Request headers Host secure.livechatinc.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Mode nested-navigate Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3 Sec-Fetch-Site cross-site Referer https://knickelbein.com/lgs/bgs/new_ups/myaccount/signin/?country.x=DE&locale.x=en_DE Accept-Encoding gzip, deflate, br Cookie __livechat=lc_all_invitation%3D0%26lc_auto_invites_shown%3D%26lc_chat_number%3D0%26lc_client_version%3D%26lc_goals_achieved%3D%26lc_integration_params%3D%26lc_lang%3Den%26lc_last_chat_start_time%3D0%26lc_last_conference_id%3D%26lc_last_operator_id%3D%26lc_last_operator_key%3D%26lc_last_operator_key_per_skill%3D%26lc_last_operator_per_skill%3D%26lc_last_visit%3D1568502951%26lc_nick%3D%26lc_ok_invitation%3D0%26lc_page_view%3D0%26lc_session%3DS1568502951.e551350835%26lc_visit_number%3D0%26mcid%3D8361557e-0e03-4d60-46ef-24f0c38a69fb%26mcid_done%3D0 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Mode nested-navigate Referer https://knickelbein.com/lgs/bgs/new_ups/myaccount/signin/?country.x=DE&locale.x=en_DE Response headers Content-Type text/html; charset=utf-8 Vary Accept-Encoding Content-Encoding gzip Expires Sat, 14 Sep 2019 23:15:51 GMT Cache-Control max-age=0, no-cache, no-store Pragma no-cache Date Sat, 14 Sep 2019 23:15:51 GMT Content-Length 1480 Connection keep-alive
GET H/1.1	206 Partial Content	new_message.a37211a6.ogg cdn.livechatinc.com/widget/static/media/	11 KB 12 KB	38ms 38ms	Media application/octet-stream	2.18.232.160 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://cdn.livechatinc.com/widget/static/media/new_message.a37211a6.ogg Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 2.18.232.160 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a2-18-232-160.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash `1d0bdbe8013ddd58bf31229ea12bd42dfe6bf4cb022cc65d519a45a13c403b5d` Request headers Sec-Fetch-Mode no-cors Referer https://knickelbein.com/lgs/bgs/new_ups/myaccount/signin/?country.x=DE&locale.x=en_DE Accept-Encoding identity;q=1, ;q=0 User-Agent* Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Range bytes=0- Response headers x-amz-version-id zRdEy7iD0zUuwnU_iwMvYg5i5CX4xJxN Last-Modified Thu, 27 Jun 2019 11:06:23 GMT Server AmazonS3 X-Amz-Cf-Pop FRA53-C1 ETag "a37211a6cfcda45352d5abcff1e446bb" Content-Type application/octet-stream Content-Range bytes 0-11403/11404 Cache-Control max-age=31536000 Date Sat, 14 Sep 2019 23:15:52 GMT Connection keep-alive Accept-Ranges bytes Access-Control-Allow-Origin * Content-Length 11404 X-Amz-Cf-Id KkHBfAT3my9xEMzowpNekVwwNNdbpCoZlNSNzozzSpjNHQJsNHPKNQ== Expires Sun, 13 Sep 2020 23:15:52 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.livechatinc.com/licence/11290317	1970-01-19 12:27:18	Name: __livechat Value: lc_all_invitation%3D0%26lc_auto_invites_shown%3D%26lc_chat_number%3D0%26lc_client_version%3D%26lc_goals_achieved%3D%26lc_integration_params%3D%26lc_lang%3Den%26lc_last_chat_start_time%3D0%26lc_last_conference_id%3D%26lc_last_operator_id%3D%26lc_last_operator_key%3D%26lc_last_operator_key_per_skill%3D%26lc_last_operator_per_skill%3D%26lc_last_visit%3D1568502951%26lc_nick%3D%26lc_ok_invitation%3D0%26lc_page_view%3D0%26lc_session%3DS1568502951.e551350835%26lc_visit_number%3D0%26mcid%3D8361557e-0e03-4d60-46ef-24f0c38a69fb%26mcid_done%3D0
.knickelbein.com/	1970-01-20 03:41:42	Name: lc_sso11290317 Value: 1568502951165
knickelbein.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: aibb59ni1piah1p415cbf03921

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

accounts.livechatinc.com
cdn.livechatinc.com
knickelbein.com
ppservp.mariposamusic.net
secure.livechatinc.com
104.109.80.100
143.95.229.33
2.18.232.160
1bcda772b32139bbd18696ba5a08fc2da9731cecf88d6b904cb953107484f55f
1d0bdbe8013ddd58bf31229ea12bd42dfe6bf4cb022cc65d519a45a13c403b5d
2a1f1370eb7b24a307312112427dfd544fb838a8bef66babc936f5e870a22e52
4efbf18ff75077e2f2735ea84d854e3b9356fcbbdc433cda712ff995b6bceb1b
627eb28cf0efe6d8e9900fb562dce96f5b0c595e89e11d937613003865394af1
ac5687d8eee03b3dc86398afc44333393fa89efa173fd10b8d993c83c0e21d94
add000d47537735288c3aac031d0761edfcc6a3d3eda236012170da7b96be8f4
b3cc50b9e94bbecaaeb1079b64b8ca50616d1732824964c1cc2c5422627a0ec5
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

knickelbein.com Open in urlscan Pro 143.95.229.33 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

11 Requests

100 %HTTPS

0 %IPv6

3 Domains

5 Subdomains

3 IPs

3 Countries

121 kBTransfer

336 kBSize

3 Cookies

0 Outgoing links

Page URL History

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

10 JavaScript Global Variables

3 Cookies

Indicators

knickelbein.com Open in urlscan Pro
143.95.229.33 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

5
Subdomains

3
IPs

3
Countries

121 kB
Transfer

336 kB
Size

3
Cookies

11 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!