paypkonto.app
Open in
urlscan Pro
160.153.41.196
Malicious Activity!
Public Scan
Effective URL: https://paypkonto.app/ch-de/webapp/36d16c64020f8f82412fe96aa42bab10/signinauth.php?country.x=DE&locale.x=de_DE&custome...
Submission: On March 12 via api from DE
Summary
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on March 10th 2020. Valid for: a year.
This is the only time paypkonto.app was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: PayPal (Financial)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 64.98.145.30 64.98.145.30 | 32491 (TUCOWS-3) (TUCOWS-3) | |
4 12 | 160.153.41.196 160.153.41.196 | 26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC) | |
8 | 1 |
ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: ip-160-153-41-196.ip.secureserver.net
paypkonto.app |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
paypkonto.app
4 redirects
paypkonto.app |
73 KB |
1 |
realbitly.com
1 redirects
realbitly.com |
568 B |
8 | 2 |
Domain | Requested by | |
---|---|---|
12 | paypkonto.app |
4 redirects
paypkonto.app
|
1 | realbitly.com | 1 redirects |
8 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
paypkonto.app Go Daddy Secure Certificate Authority - G2 |
2020-03-10 - 2021-03-10 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://paypkonto.app/ch-de/webapp/36d16c64020f8f82412fe96aa42bab10/signinauth.php?country.x=DE&locale.x=de_DE&customer.x=ID-PA$1$r/lMQAji$uCynqg3J/SnGT2YUnQNM3/&safety=ceLoAX7Dterfx49d2nibghj2d7JWa0k41d329IY42a2VOz851uMCG86K2amHqfBPw1TU99l3FcvcRfEsZp65y25Q0N7bdS
Frame ID: AF3D169D56E056318C7F4A1683A0C38E
Requests: 8 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://realbitly.com/
HTTP 303
https://paypkonto.app/ Page URL
-
https://paypkonto.app/ch-de/webapp
HTTP 301
https://paypkonto.app/ch-de/webapp/ HTTP 302
https://paypkonto.app/ch-de/webapp/XYSDIRX.php HTTP 302
https://paypkonto.app/ch-de/webapp/36d16c64020f8f82412fe96aa42bab10 HTTP 301
https://paypkonto.app/ch-de/webapp/36d16c64020f8f82412fe96aa42bab10/ Page URL
- https://paypkonto.app/ch-de/webapp/36d16c64020f8f82412fe96aa42bab10/signinauth.php?country.x=DE&lo... Page URL
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://realbitly.com/
HTTP 303
https://paypkonto.app/ Page URL
-
https://paypkonto.app/ch-de/webapp
HTTP 301
https://paypkonto.app/ch-de/webapp/ HTTP 302
https://paypkonto.app/ch-de/webapp/XYSDIRX.php HTTP 302
https://paypkonto.app/ch-de/webapp/36d16c64020f8f82412fe96aa42bab10 HTTP 301
https://paypkonto.app/ch-de/webapp/36d16c64020f8f82412fe96aa42bab10/ Page URL
- https://paypkonto.app/ch-de/webapp/36d16c64020f8f82412fe96aa42bab10/signinauth.php?country.x=DE&locale.x=de_DE&customer.x=ID-PA$1$r/lMQAji$uCynqg3J/SnGT2YUnQNM3/&safety=ceLoAX7Dterfx49d2nibghj2d7JWa0k41d329IY42a2VOz851uMCG86K2amHqfBPw1TU99l3FcvcRfEsZp65y25Q0N7bdS Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://realbitly.com/ HTTP 303
- https://paypkonto.app/
- https://paypkonto.app/ch-de/webapp HTTP 301
- https://paypkonto.app/ch-de/webapp/ HTTP 302
- https://paypkonto.app/ch-de/webapp/XYSDIRX.php HTTP 302
- https://paypkonto.app/ch-de/webapp/36d16c64020f8f82412fe96aa42bab10 HTTP 301
- https://paypkonto.app/ch-de/webapp/36d16c64020f8f82412fe96aa42bab10/
8 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
paypkonto.app/ Redirect Chain
|
94 B 252 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
paypkonto.app/ch-de/webapp/36d16c64020f8f82412fe96aa42bab10/ Redirect Chain
|
277 B 321 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
signinauth.php
paypkonto.app/ch-de/webapp/36d16c64020f8f82412fe96aa42bab10/ |
4 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
xcontexLogx.css
paypkonto.app/ch-de/webapp/36d16c64020f8f82412fe96aa42bab10/XYSASSETSX/css/ |
95 KB 14 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
paypkonto.app/ch-de/webapp/36d16c64020f8f82412fe96aa42bab10/XYSASSETSX/js/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
xsinauthx.js
paypkonto.app/ch-de/webapp/36d16c64020f8f82412fe96aa42bab10/XYSASSETSX/js/ |
6 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
xppappx.js
paypkonto.app/ch-de/webapp/36d16c64020f8f82412fe96aa42bab10/XYSASSETSX/js/ |
62 KB 23 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
loginlogo.svg
paypkonto.app/ch-de/webapp/36d16c64020f8f82412fe96aa42bab10/XYSASSETSX/img/ |
5 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: PayPal (Financial)23 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| $ function| jQuery string| sc_code_ver string| s_account object| s function| s_doPlugins string| s_code undefined| s_objectID function| s_gi function| s_giqf string| s_an function| s_sp function| s_jn function| s_rep function| s_d function| s_fe function| s_fa function| s_ft object| s_c_il number| s_c_in number| s_giq2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.paypkonto.app/ | Name: s_sess Value: %20s_ppv%3D100%3B |
|
paypkonto.app/ | Name: PHPSESSID Value: 5cd046e72b55fd5c439e0804b8338d4a |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
paypkonto.app
realbitly.com
160.153.41.196
64.98.145.30
36b360980867ad906788319227a2985598db4d889d8c3cc5c53fc1ad03f78d49
442b92596d0c075077f5f0f993969c55c3e275b995c8a661ddb9a6e07e3bbce1
5cec133c9d62052e05ada3caf5a770143f12150a608291deea4eaee7a50a28c1
86cdcd99c3701ce8da6608b83349cb0907e53b28b2512b4ed79efbefeba83826
b3cc50b9e94bbecaaeb1079b64b8ca50616d1732824964c1cc2c5422627a0ec5
c50e99c8d4144a7f9ca200f70afad65c1aacbd70070d70018c440bc15f821fcb
d30b6114fb9496ae46b2a8cdf59379c8ffdb957534bd1dd73e626c7c61c7e67d
d74143da2410f9b1ecdfc5435a6df19a55bc4934ac208e62d4da7c52d7178980