supportincteam.com
Open in
urlscan Pro
208.109.65.254
Malicious Activity!
Public Scan
Submission: On May 18 via manual from US
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on May 15th 2021. Valid for: 3 months.
This is the only time supportincteam.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: PayPal (Financial)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 4 | 208.109.65.254 208.109.65.254 | 398101 (GO-DADDY-...) (GO-DADDY-COM-LLC) | |
1 | 151.101.129.21 151.101.129.21 | 54113 (FASTLY) (FASTLY) | |
4 | 2a00:1450:400... 2a00:1450:4001:802::2004 | 15169 (GOOGLE) (GOOGLE) | |
6 | 2a00:1450:400... 2a00:1450:4001:82f::2003 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:80f::2003 | 15169 (GOOGLE) (GOOGLE) | |
15 | 6 |
ASN398101 (GO-DADDY-COM-LLC, US)
PTR: ip-208-109-65-254.ip.secureserver.net
supportincteam.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
gstatic.com
www.gstatic.com fonts.gstatic.com |
513 KB |
4 |
google.com
www.google.com |
21 KB |
4 |
supportincteam.com
1 redirects
supportincteam.com |
160 KB |
1 |
paypal.com
www.paypal.com |
|
15 | 4 |
Domain | Requested by | |
---|---|---|
6 | www.gstatic.com |
www.google.com
www.gstatic.com |
4 | www.google.com |
supportincteam.com
www.gstatic.com |
4 | supportincteam.com |
1 redirects
supportincteam.com
|
1 | fonts.gstatic.com |
www.google.com
|
1 | www.paypal.com |
supportincteam.com
|
15 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
supportincteam.com cPanel, Inc. Certification Authority |
2021-05-15 - 2021-08-13 |
3 months | crt.sh |
www.paypal.com DigiCert SHA2 Extended Validation Server CA |
2021-04-16 - 2022-03-15 |
a year | crt.sh |
www.google.com GTS CA 1C3 |
2021-04-13 - 2021-07-06 |
3 months | crt.sh |
*.google.com GTS CA 1O1 |
2021-04-13 - 2021-07-06 |
3 months | crt.sh |
This page contains 3 frames:
Primary Page:
https://supportincteam.com/webapps/Verify/
Frame ID: E2B20B3E2859FA07CAF9FC7D95C51678
Requests: 6 HTTP requests in this frame
Frame:
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Le1zNUaAAAAAGavsCpRF0O4w2uupxibu4hnpIDo&co=aHR0cHM6Ly9zdXBwb3J0aW5jdGVhbS5jb206NDQz&hl=en&v=f-bnnOuahiYKuei7dmAd3kgv&size=normal&cb=shz7oxv9wxp2
Frame ID: E8C0D272D16D52F71279627ADBD9978C
Requests: 8 HTTP requests in this frame
Frame:
https://www.google.com/recaptcha/api2/bframe?hl=en&v=f-bnnOuahiYKuei7dmAd3kgv&k=6Le1zNUaAAAAAGavsCpRF0O4w2uupxibu4hnpIDo&cb=6cahpzl1kmpl
Frame ID: D83F5A15330ED50152BCFA1C798CCF6F
Requests: 3 HTTP requests in this frame
Screenshot
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
reCAPTCHA (Captchas) Expand
Detected patterns
- html /<div[^>]+class="g-recaptcha"/i
- script /\/recaptcha\/api\.js/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://supportincteam.com/webapps/Verify/sc/app/lib/scs/log.scs HTTP 302
- https://www.paypal.com/webapps/mpp/paypal-safety-and-security
15 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
supportincteam.com/webapps/Verify/ |
2 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
paypal-safety-and-security
www.paypal.com/webapps/mpp/ Redirect Chain
|
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headersRedirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
api.js
www.google.com/recaptcha/ |
850 B 642 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pp.svg
supportincteam.com/webapps/Verify/sc/app/lib/img/ |
4 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
recaptcha__en.js
www.gstatic.com/recaptcha/releases/f-bnnOuahiYKuei7dmAd3kgv/ |
335 KB 131 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bck.jpeg
supportincteam.com/webapps/Verify/sc/app/lib/img/ |
156 KB 157 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
anchor
www.google.com/recaptcha/api2/ Frame E8C0 |
39 KB 20 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
styles__ltr.css
www.gstatic.com/recaptcha/releases/f-bnnOuahiYKuei7dmAd3kgv/ Frame E8C0 |
51 KB 52 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
recaptcha__en.js
www.gstatic.com/recaptcha/releases/f-bnnOuahiYKuei7dmAd3kgv/ Frame E8C0 |
335 KB 131 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame E8C0 |
14 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame E8C0 |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
logo_48.png
www.gstatic.com/recaptcha/api2/ Frame E8C0 |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame E8C0 |
15 KB 15 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
webworker.js
www.google.com/recaptcha/api2/ Frame E8C0 |
102 B 133 B |
Other
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
bframe
www.google.com/recaptcha/api2/ Frame D83F |
7 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
styles__ltr.css
www.gstatic.com/recaptcha/releases/f-bnnOuahiYKuei7dmAd3kgv/ Frame D83F |
51 KB 52 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
recaptcha__en.js
www.gstatic.com/recaptcha/releases/f-bnnOuahiYKuei7dmAd3kgv/ Frame D83F |
335 KB 131 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: PayPal (Financial)21 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 object| 2 object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated object| ___grecaptcha_cfg object| grecaptcha string| __recaptcha_api boolean| __google_recaptcha_client function| correctCaptcha object| recaptcha object| closure_lm_8058470 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fonts.gstatic.com
supportincteam.com
www.google.com
www.gstatic.com
www.paypal.com
151.101.129.21
208.109.65.254
2a00:1450:4001:802::2004
2a00:1450:4001:80f::2003
2a00:1450:4001:82f::2003
0964d141519db34adc6aa127a33dbc6761cda1e56b584ea402082d99c44afb9e
19455abeb5d16262ebc0ad8c9d07c8e7832510dabc6bc821937b7e22b51c5004
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
1fb0140eac079c8f8cc4df2380db9cf976d01b110e68e3924d5dbee0c54bc430
2a299b3fc8f2cb4e4fa6093c4e79fbc3e0edaf08acbb3822c2a571bba0a37431
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
43ef4025567f7a15859b5252b6ccc1efe2ff8c7331b1aefbea7ce88eb5084d27
57458829ef97d6d97783f6e62743dbae340091ae9d7428b1184b363fec9aeead
84724ec0c0c1d45462b38db8ef8368ca70f387279c06fab3b87d6a2a1d17a38a
85816cdb3190281e1d4ce7ef9bb5688a68ed4e1d43fa366ba2197680e528e490
94b328f86382cda7d83cebb40ee8dd8f567582a60ba91a90a37f490b0f0edefa
d9b2d8510b8c0b4bded2bcae2c75293d532ac27afb357d691f429f907e9cd57e
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ee8f2a6ea8c02259b3f4d068d0607f92ba9cd2a6f06d915ca317b75a39676932