![](/screenshots/c578d1a5-7456-4663-bdbe-9db9d7eb87aa.png)
secure.knottysurprisexoxo.com
Open in
urlscan Pro
91.209.70.247
Malicious Activity!
Public Scan
Submission: On August 06 via api from US — Scanned from US
Summary
TLS certificate: Issued by R3 on August 4th 2023. Valid for: 3 months.
This is the only time secure.knottysurprisexoxo.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: PayPal (Financial)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
36 | 91.209.70.247 91.209.70.247 | 43317 (VEESP-AS) (VEESP-AS) | |
2 | 2607:f8b0:402... 2607:f8b0:4020:805::2004 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2607:f8b0:402... 2607:f8b0:4020:806::2003 | 15169 (GOOGLE) (GOOGLE) | |
1 1 | 2607:f8b0:402... 2607:f8b0:4020:807::2002 | 15169 (GOOGLE) (GOOGLE) | |
4 | 192.229.210.155 192.229.210.155 | 15133 (EDGECAST) (EDGECAST) | |
9 | 151.101.193.21 151.101.193.21 | 54113 (FASTLY) (FASTLY) | |
2 4 | 64.4.251.12 64.4.251.12 | 17012 (PAYPAL) (PAYPAL) | |
3 | 151.101.193.35 151.101.193.35 | 54113 (FASTLY) (FASTLY) | |
3 | 2607:f8b0:402... 2607:f8b0:4020:805::2003 | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a04:4e42:600... 2a04:4e42:600::291 | 54113 (FASTLY) (FASTLY) | |
1 | 2607:f8b0:402... 2607:f8b0:4020:804::2003 | 15169 (GOOGLE) (GOOGLE) | |
63 | 10 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
36 |
knottysurprisexoxo.com
secure.knottysurprisexoxo.com |
2 MB |
18 |
paypal.com
2 redirects
c.paypal.com — Cisco Umbrella Rank: 5493 b.stats.paypal.com — Cisco Umbrella Rank: 4894 chd.stats.paypal.com — Cisco Umbrella Rank: 9306 t.paypal.com — Cisco Umbrella Rank: 3221 c6.paypal.com — Cisco Umbrella Rank: 6322 |
75 KB |
4 |
paypalobjects.com
www.paypalobjects.com — Cisco Umbrella Rank: 2334 |
92 KB |
3 |
gstatic.com
www.gstatic.com |
|
2 |
google.com
www.google.com — Cisco Umbrella Rank: 3 |
563 B |
1 |
recaptcha.net
www.recaptcha.net — Cisco Umbrella Rank: 1905 |
2 KB |
1 |
doubleclick.net
1 redirects
googleads.g.doubleclick.net — Cisco Umbrella Rank: 54 |
952 B |
1 |
google.co.in
www.google.co.in — Cisco Umbrella Rank: 13483 |
455 B |
63 | 8 |
Domain | Requested by | |
---|---|---|
36 | secure.knottysurprisexoxo.com |
secure.knottysurprisexoxo.com
|
9 | c.paypal.com |
secure.knottysurprisexoxo.com
c.paypal.com |
4 | www.paypalobjects.com |
secure.knottysurprisexoxo.com
|
3 | www.gstatic.com |
secure.knottysurprisexoxo.com
www.recaptcha.net |
3 | t.paypal.com |
secure.knottysurprisexoxo.com
|
2 | c6.paypal.com |
secure.knottysurprisexoxo.com
|
2 | chd.stats.paypal.com |
secure.knottysurprisexoxo.com
|
2 | b.stats.paypal.com | 2 redirects |
2 | www.google.com |
secure.knottysurprisexoxo.com
|
1 | www.recaptcha.net |
secure.knottysurprisexoxo.com
|
1 | googleads.g.doubleclick.net | 1 redirects |
1 | www.google.co.in |
secure.knottysurprisexoxo.com
|
63 | 12 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.paypal.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
www.secure.knottysurprisexoxo.com R3 |
2023-08-04 - 2023-11-02 |
3 months | crt.sh |
www.google.com GTS CA 1C3 |
2023-07-10 - 2023-10-02 |
3 months | crt.sh |
*.google.co.in GTS CA 1C3 |
2023-07-10 - 2023-10-02 |
3 months | crt.sh |
www.paypal.com DigiCert SHA2 Extended Validation Server CA |
2022-11-09 - 2023-12-10 |
a year | crt.sh |
t.paypal.com DigiCert SHA2 Extended Validation Server CA |
2022-10-19 - 2023-11-19 |
a year | crt.sh |
*.gstatic.com GTS CA 1C3 |
2023-07-10 - 2023-10-02 |
3 months | crt.sh |
misc.google.com GTS CA 1C3 |
2023-07-10 - 2023-10-02 |
3 months | crt.sh |
This page contains 10 frames:
Primary Page:
https://secure.knottysurprisexoxo.com/signin/
Frame ID: E7002AB1AF9DFB48C04236B688072E04
Requests: 38 HTTP requests in this frame
Frame:
https://secure.knottysurprisexoxo.com/KNYGHT/inc/grcenterprise_v3.htm
Frame ID: C253BAD449D996CD9F01C0BE3C1FD993
Requests: 4 HTTP requests in this frame
Frame:
https://c.paypal.com/v1/r/d/i?js_src=https://c.paypal.com/da/r/fb.js
Frame ID: 89835817BA4E5DFD0C9E6FCEEDD31468
Requests: 5 HTTP requests in this frame
Frame:
https://chd.stats.paypal.com/v1/counter2.cgi?r=cD1lMWQ1NmRmZTg1ZTg0Y2FhOTBhZTU4YTU4N2Q3OWRjOCZpPTIyMy4yMjYuNTEuNjAmdD0xNjM5ODIxMDM2LjM2MiZhPTIxJnM9VU5JRklFRF9MT0dJTqyzufzl5ewrr23xXsolwTVJLPNQ
Frame ID: 3E6ACCD7E4C9E24CA79736B0AA602F0C
Requests: 1 HTTP requests in this frame
Frame:
https://secure.knottysurprisexoxo.com/KNYGHT/inc/grcenterprise_v3_data/anchor_data/a.htm
Frame ID: CF398B232C09A199B1D3B0AD543927D6
Requests: 1 HTTP requests in this frame
Frame:
https://secure.knottysurprisexoxo.com/KNYGHT/inc/i.htm
Frame ID: 3BCD7A14F468F5BCC13DC195A7BC6609
Requests: 2 HTTP requests in this frame
Frame:
https://secure.knottysurprisexoxo.com/KNYGHT/inc/grcenterprise_v3_data/anchor.htm
Frame ID: 07FF2B5D86411B72314CCE0BA9EE385D
Requests: 3 HTTP requests in this frame
Frame:
https://www.recaptcha.net/recaptcha/enterprise/anchor?ar=1&k=6LdCCOUUAAAAAHTE-Snr6hi4HJGtJk_d1_ce-gWB&co=aHR0cHM6Ly9zZWN1cmUua25vdHR5c3VycHJpc2V4b3hvLmNvbTo0NDM.&hl=en&v=VZKEDW9wslPbEc9RmzMqaOAP&size=invisible&cb=5vb3uzogp1hz
Frame ID: 2E9D72B034525A73202FA3CA758E6398
Requests: 3 HTTP requests in this frame
Frame:
https://c.paypal.com/v1/r/d/i?js_src=https://c.paypal.com/da/r/fb.js
Frame ID: 55A2325A823A6EB2F6C5EB83A4CA4F82
Requests: 5 HTTP requests in this frame
Frame:
https://chd.stats.paypal.com/v1/counter2.cgi?r=cD1lMWQ1NmRmZTg1ZTg0Y2FhOTBhZTU4YTU4N2Q3OWRjOCZpPTIyMy4yMjYuNTEuNjAmdD0xNjM5ODIxMDM2LjM2MiZhPTIxJnM9VU5JRklFRF9MT0dJTqyzufzl5ewrr23xXsolwTVJLPNQ
Frame ID: 61283DD1748036834918D95C6C3B66FE
Requests: 1 HTTP requests in this frame
Screenshot
![](/screenshots/c578d1a5-7456-4663-bdbe-9db9d7eb87aa.png)
Page Title
Log in to your PayPal accountDetected technologies
Detected patterns
- paypalobjects\.com
Detected patterns
- ([\d.]+)?/modernizr(?:\.([\d.]+))?.*\.js
Page Statistics
6 Outgoing links
These are links going to different origins than the main page.
Title: Forgotten password?
Search URL Search Domain Scan URL
Title: We can help
Search URL Search Domain Scan URL
Title: Contact Us
Search URL Search Domain Scan URL
Title: Privacy
Search URL Search Domain Scan URL
Title: Legal
Search URL Search Domain Scan URL
Title: Worldwide
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 20- https://googleads.g.doubleclick.net/pagead/viewthroughconversion/965352860/?random=669066909&cv=9&fst=1639560941351&num=1&label=K7FtCJDsl_4CEJy7qMwD&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=667&u_w=375&u_ah=667&u_aw=375&u_cd=24&u_his=13&u_tz=330&u_java=false&u_nplug=0&u_nmime=0>m=2oi4f0&sendb=1&ig=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fwww.paypal.com%2Fin%2Fsignin&ref=https%3A%2F%2Fwww.paypal.com%2Fin%2Fhome&tiba=Log%20in%20to%20your%20PayPal%20account&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=7a69YcWdDcDErtoPpYiCyAI&sscte=1&crd= HTTP 302
- https://www.google.com/pagead/1p-conversion/965352860/?random=669066909&cv=9&fst=1639560941351&num=1&label=K7FtCJDsl_4CEJy7qMwD&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=667&u_w=375&u_ah=667&u_aw=375&u_cd=24&u_his=13&u_tz=330&u_java=false&u_nplug=0&u_nmime=0>m=2oi4f0&sendb=1&ig=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fwww.paypal.com%2Fin%2Fsignin&ref=https%3A%2F%2Fwww.paypal.com%2Fin%2Fhome&tiba=Log%20in%20to%20your%20PayPal%20account&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=7a69YcWdDcDErtoPpYiCyAI&random=3749515895&resp=GooglemKTybQhCsO
- https://b.stats.paypal.com/v1/counter.cgi?r=cD1lMWQ1NmRmZTg1ZTg0Y2FhOTBhZTU4YTU4N2Q3OWRjOCZpPTIyMy4yMjYuNTEuNjAmdD0xNjM5ODIxMDM2LjM2MiZhPTIxJnM9VU5JRklFRF9MT0dJTqyzufzl5ewrr23xXsolwTVJLPNQ HTTP 302
- https://chd.stats.paypal.com/v1/counter2.cgi?r=cD1lMWQ1NmRmZTg1ZTg0Y2FhOTBhZTU4YTU4N2Q3OWRjOCZpPTIyMy4yMjYuNTEuNjAmdD0xNjM5ODIxMDM2LjM2MiZhPTIxJnM9VU5JRklFRF9MT0dJTqyzufzl5ewrr23xXsolwTVJLPNQ
- https://b.stats.paypal.com/v1/counter.cgi?r=cD1lMWQ1NmRmZTg1ZTg0Y2FhOTBhZTU4YTU4N2Q3OWRjOCZpPTIyMy4yMjYuNTEuNjAmdD0xNjM5ODIxMDM2LjM2MiZhPTIxJnM9VU5JRklFRF9MT0dJTqyzufzl5ewrr23xXsolwTVJLPNQ HTTP 302
- https://chd.stats.paypal.com/v1/counter2.cgi?r=cD1lMWQ1NmRmZTg1ZTg0Y2FhOTBhZTU4YTU4N2Q3OWRjOCZpPTIyMy4yMjYuNTEuNjAmdD0xNjM5ODIxMDM2LjM2MiZhPTIxJnM9VU5JRklFRF9MT0dJTqyzufzl5ewrr23xXsolwTVJLPNQ
63 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
secure.knottysurprisexoxo.com/signin/ |
43 KB 43 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
conversion_async.js
secure.knottysurprisexoxo.com/KNYGHT/inc/ |
37 KB 37 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
analytics.js
secure.knottysurprisexoxo.com/KNYGHT/inc/ |
44 KB 44 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
gtag.js
secure.knottysurprisexoxo.com/KNYGHT/inc/ |
79 KB 79 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
latmconf.js
secure.knottysurprisexoxo.com/KNYGHT/inc/ |
132 KB 132 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ngrlCaptcha.js
secure.knottysurprisexoxo.com/KNYGHT/inc/ |
21 KB 21 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
contextualLoginElementalUI.css
secure.knottysurprisexoxo.com/KNYGHT/inc/ |
120 KB 121 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
modernizr-2.js
secure.knottysurprisexoxo.com/KNYGHT/inc/ |
4 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
a
secure.knottysurprisexoxo.com/KNYGHT/inc/ |
2 KB 3 KB |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
a_002
secure.knottysurprisexoxo.com/KNYGHT/inc/ |
2 KB 2 KB |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon-PN-check.png
secure.knottysurprisexoxo.com/KNYGHT/inc/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
glyph_alert_critical_big-2x.png
secure.knottysurprisexoxo.com/KNYGHT/inc/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
fn-sync-telemetry-min.js
secure.knottysurprisexoxo.com/KNYGHT/inc/ |
5 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
signin-split.js
secure.knottysurprisexoxo.com/KNYGHT/inc/ |
320 KB 320 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
pa.js
secure.knottysurprisexoxo.com/KNYGHT/inc/ |
59 KB 59 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
recaptchav3.js
secure.knottysurprisexoxo.com/KNYGHT/inc/ |
11 KB 11 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
patleaf.js
secure.knottysurprisexoxo.com/KNYGHT/inc/ |
130 KB 130 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
patlcfg.js
secure.knottysurprisexoxo.com/KNYGHT/inc/ |
6 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
fb.js
secure.knottysurprisexoxo.com/KNYGHT/inc/ |
55 KB 55 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.google.com/pagead/1p-user-list/965352860/ |
42 B 455 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.google.co.in/pagead/1p-user-list/965352860/ |
42 B 455 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.google.com/pagead/1p-conversion/965352860/ Redirect Chain
|
42 B 108 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
momgram@2x.png
www.paypalobjects.com/images/shared/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
PayPalSansSmall-Regular.woff
www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/ |
46 KB 47 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
PayPalSansBig-Regular.woff2
www.paypalobjects.com/paypal-ui/fonts/ |
25 KB 25 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
PayPalSansBig-Medium.woff2
www.paypalobjects.com/paypal-ui/fonts/ |
18 KB 18 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
grcenterprise_v3.htm
secure.knottysurprisexoxo.com/KNYGHT/inc/ Frame C253 |
7 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
i
c.paypal.com/v1/r/d/ Frame 8983 |
160 B 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
counter2.cgi
chd.stats.paypal.com/v1/ Frame 3E6A Redirect Chain
|
42 B 299 B |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
a.htm
secure.knottysurprisexoxo.com/KNYGHT/inc/grcenterprise_v3_data/anchor_data/ Frame CF39 |
108 B 349 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ts
t.paypal.com/ |
42 B 789 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
i.htm
secure.knottysurprisexoxo.com/KNYGHT/inc/ Frame 3BCD |
208 B 449 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ts
t.paypal.com/ |
42 B 203 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
recaptcha__en.js
secure.knottysurprisexoxo.com/KNYGHT/inc/grcenterprise_v3_data/ Frame C253 |
344 KB 345 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
enterprise.js
secure.knottysurprisexoxo.com/KNYGHT/inc/grcenterprise_v3_data/ Frame C253 |
977 B 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
anchor.htm
secure.knottysurprisexoxo.com/KNYGHT/inc/grcenterprise_v3_data/ Frame 07FF |
40 KB 41 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
fb.js
secure.knottysurprisexoxo.com/KNYGHT/inc/ Frame 3BCD |
55 KB 55 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fb.js
c.paypal.com/da/r/ Frame 8983 |
63 KB 22 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
recaptcha__en.js
www.gstatic.com/recaptcha/releases/VZKEDW9wslPbEc9RmzMqaOAP/ Frame C253 |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
styles__ltr.css
secure.knottysurprisexoxo.com/KNYGHT/inc/grcenterprise_v3_data/anchor_data/ Frame 07FF |
51 KB 51 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
recaptcha__en.js
secure.knottysurprisexoxo.com/KNYGHT/inc/grcenterprise_v3_data/ Frame 07FF |
344 KB 345 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
p1
c.paypal.com/v1/r/d/b/ Frame 8983 |
125 B 1 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
e
c.paypal.com/v1/r/d/b/ Frame 8983 |
0 230 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
p3
c6.paypal.com/v1/r/d/b/ Frame 8983 |
0 512 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
anchor
www.recaptcha.net/recaptcha/enterprise/ Frame 2E9D |
7 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
styles__ltr.css
www.gstatic.com/recaptcha/releases/VZKEDW9wslPbEc9RmzMqaOAP/ Frame 2E9D |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
recaptcha__en.js
www.gstatic.com/recaptcha/releases/VZKEDW9wslPbEc9RmzMqaOAP/ Frame 2E9D |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
client-log
secure.knottysurprisexoxo.com/signin/ |
683 B 859 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fb.js
c.paypal.com/da/r/ |
63 KB 22 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
client-log
secure.knottysurprisexoxo.com/signin/ |
683 B 859 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
challenge.js
secure.knottysurprisexoxo.com/auth/createchallenge/62ca065f41739ead/ |
683 B 859 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
client-log
secure.knottysurprisexoxo.com/signin/ |
683 B 859 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
load-resource
secure.knottysurprisexoxo.com/signin/ |
683 B 859 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
i
c.paypal.com/v1/r/d/ Frame 55A2 |
160 B 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
counter2.cgi
chd.stats.paypal.com/v1/ Frame 6128 Redirect Chain
|
42 B 299 B |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
load-resource
secure.knottysurprisexoxo.com/signin/ |
683 B 859 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
load-resource
secure.knottysurprisexoxo.com/signin/ |
683 B 859 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fb.js
c.paypal.com/da/r/ Frame 55A2 |
63 KB 22 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
p1
c.paypal.com/v1/r/d/b/ Frame 55A2 |
125 B 696 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
e
c.paypal.com/v1/r/d/b/ Frame 55A2 |
0 471 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
p3
c6.paypal.com/v1/r/d/b/ Frame 55A2 |
0 278 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ts
t.paypal.com/ |
42 B 493 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
tealeaftarget
secure.knottysurprisexoxo.com/platform/ |
683 B 859 B |
Fetch
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: PayPal (Financial)33 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 object| 2 object| 3 object| 4 function| preback object| google_tag_manager object| gDataLayer object| latmconf boolean| paypalADSInterceptorInjected object| html5 object| Modernizr function| isEligibleIntegration object| antiClickjack object| PAYPAL function| GooglemKTybQhCsO function| google_trackConversion object| google_tag_data function| ga object| gaplugins function| $ object| fpti string| fptiserverurl object| _ifpti object| pako object| TLT object| _0x57c4 function| _0x1a3e object| _0x5a43 function| _0x2c64 object| d function| ccabaabfccb object| err8 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
secure.knottysurprisexoxo.com/ | Name: PHPSESSID Value: 088326e6f20b28e0647769f2f0336fad |
|
.doubleclick.net/ | Name: test_cookie Value: CheckForPermission |
|
.knottysurprisexoxo.com/ | Name: TLTSID Value: 98676370316973505152043689998396 |
|
.paypal.com/ | Name: ts_c Value: vr%3D5117dca22ea20ad8%26vt%3D649884c533fed34 |
|
.c.paypal.com/ | Name: sc_f Value: IOb4Mll7r8iHoigIYARZ6O6cm_a22adpk2XqCXvU_r-FhjyiIadOHhjCE6dack-BZI1i2eu0RSwBabjfc6VmtdpRghH8KOYrfdv-fG |
|
.paypal.com/ | Name: KHcl0EuY7AKSMgfvHl7J5E7hPtK Value: bfB9WjGIWuQ_d7AzJa0RVlUa3aaY6h5x2HsgBppkEZF8pZOVH0JMdpZ7Y5rq0YbBOjJNemCwGK0xPHzv |
|
.paypal.com/ | Name: l7_az Value: dcg02.phx |
|
.paypal.com/ | Name: ts Value: vreXpYrS%3D1785942902%26vteXpYrS%3D1691336702%26vr%3D5117dca22ea20ad8%26vt%3D649884c533fed34 |
14 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
b.stats.paypal.com
c.paypal.com
c6.paypal.com
chd.stats.paypal.com
googleads.g.doubleclick.net
secure.knottysurprisexoxo.com
t.paypal.com
www.google.co.in
www.google.com
www.gstatic.com
www.paypalobjects.com
www.recaptcha.net
151.101.193.21
151.101.193.35
192.229.210.155
2607:f8b0:4020:804::2003
2607:f8b0:4020:805::2003
2607:f8b0:4020:805::2004
2607:f8b0:4020:806::2003
2607:f8b0:4020:807::2002
2a04:4e42:600::291
64.4.251.12
91.209.70.247
070403d1b51ba80edb8fbaf732fa96b33b2aab9a7f8eb3e879f62f1399071d9b
149960d3127ec5afd4557373318c6f6cb15e767f81fdce7cc16bb2c6f4094de3
1c9dd1b0663ba2324632f0ffebb21112a92f039305241661c289c88af523cb1a
1f70ff447ed799a34f4c3ae37ef1f49ed4af71123ba2c2aefe354565354284be
2ae6779c6c3579643ab6deb5cfb822e843bf637d006a4ec25d9857ec7fb6d8c1
3ba795672c78c8f0f52ecd5d1a0a317d1e5c059509a6bead9d26b46fc831d83b
47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292
4927e0f833929aa3794709b3512ae8c12ec3ab7d8508a8e57356a1e4365b8465
4b16c98214d45bedb1513b7fd53a02ce204f6a2091a920c3122fb213168c3139
509d4f435d5d6474e7f1ab39b5d73059243233d062d9bf08cd548a8228bf8399
62bb5685d837089cd6aedb6f5fe5375c83ce5facc879632628e1e63e51399580
6aac96a4d83a622212c71c8616225f4a478ad81b6b9ce05ba4666c33ce4a9042
6b487cf8647fb6f235227f22add45723bcbcd74e0996b69bdec306e03a751be8
6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93
71399ff1720fa4e82d94d92941a8fe5ec96a4449d5f83bae63da5d361d1bcdf8
7317a02358b2b617ba0934b570c313ee76f29176c4821a9a5fd1656413e5f41b
848b6b139810dfbade9a4da3f27e954a32eeb0f01a38490d7b36efeea4b5bbfa
8b202d5bd55968ce4bfc21c063166eaebe62104275ce7ec362d78b64b2581c95
8ba56f6b8db4984684e70e96502fb1a4f4d436e22e147ad693f70e78c3921a41
9321bc63a75b3ac6d384b411665b6e77a8b326a4b176ca2049872d3b5d4974f5
93d5ad6a49a0fea03d881cfc4dea0fd62fc3fee105fab6838bb0313b79f02806
a6c3bff965978df8093c3a29f7071c21d7439a212af41e7b40ce70d94d6bcc44
a913d18a0cf3d623822483c8c7456cff16fbe286a5006167e6caa4143887cc39
ad3cc24a66bae714bcb1536ba2be070d636f61bbdfedf1e66de4d2a610a4f9e1
ae79dcc3eb016922caa1d095cfd936446bc65a46bb3364b242dfc556f7e3c6a8
afd8f1e0ddd618e91e0749c475e0d25ed12b92c73018d8e0446aaabe6c9221b3
bdf26bf839a21919969834fdeb91e9d39266897ec9d7245959ea5965a3891313
d2847bea03b68a100caf41aca4d972b58368b4ee956ab13dde15963d905d7c24
de40f8e9a13821460fad3250442ee45458a1073661d67758f325b3a354995dd3
dfb64b8e6d5e9b918a78d41825cb9d47dc230f8206360226c9fa4c6ad5e6cb7e
e1c32475b054daff0f2c3742e21952a7701bca38cdd00af6926d5f961a34bbea
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4e9a7be6ec3c6d1d3bc600e82525526de6ab1a585128aeb7635021e5311d555
eae3a28f54234453b4d8f9515e1ffdbc978e7a313aa32ab92b7156e895ca53e3
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef874a3d6245d4f2e40a23f48506597695793045ea66f899bcab6cfa2794f348
f1ac5bc2d2f0c446b2d5bc135db7414a2662ade7b701bc199456d05f51bfc261
f3e86c407d903034a9e0287a4ac6676f5b5f5f5954655593ce9defed3c86bd31
f982a9dad50b916735a08b8e6f40efa7f97163106b18da079b144764c86a44a1