wa47bc7309gd7gswk848m.zxjargalbavyar.repl.co
Open in
urlscan Pro
35.201.120.147
Malicious Activity!
Public Scan
Submission: On September 30 via automatic, source openphish
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on September 29th 2020. Valid for: 3 months.
This is the only time wa47bc7309gd7gswk848m.zxjargalbavyar.repl.co was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Outlook Web Access (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 35.201.120.147 35.201.120.147 | 15169 (GOOGLE) (GOOGLE) | |
2 | 2 |
ASN15169 (GOOGLE, US)
PTR: 147.120.201.35.bc.googleusercontent.com
wa47bc7309gd7gswk848m.zxjargalbavyar.repl.co |
Apex Domain Subdomains |
Transfer | |
---|---|---|
2 |
repl.co
wa47bc7309gd7gswk848m.zxjargalbavyar.repl.co |
57 KB |
2 | 1 |
Domain | Requested by | |
---|---|---|
2 | wa47bc7309gd7gswk848m.zxjargalbavyar.repl.co |
wa47bc7309gd7gswk848m.zxjargalbavyar.repl.co
|
2 | 1 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
zxjargalbavyar.repl.co Let's Encrypt Authority X3 |
2020-09-29 - 2020-12-28 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://wa47bc7309gd7gswk848m.zxjargalbavyar.repl.co/?3c3344e3709b00a0b433d96e69212tRW1haWwtXV0cmd=loginid
Frame ID: 6BE9462FA2C019A1BDDEFF0697E321B7
Requests: 7 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
2 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
wa47bc7309gd7gswk848m.zxjargalbavyar.repl.co/ |
57 KB 57 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
4 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
8 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
segoeui-regular.ttf
wa47bc7309gd7gswk848m.zxjargalbavyar.repl.co/images/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
7 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Outlook Web Access (Online)11 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| trustedTypes function| validateForm number| g_fFcs object| _0x58eb function| _0x598b function| _0x1905d4 function| _0x202c97 function| _0x180425 string| hash function| suc function| _0x50f6bd0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
wa47bc7309gd7gswk848m.zxjargalbavyar.repl.co
35.201.120.147
257526b3e18469edef0487caa12d08b4ba2a9daffebc3ece45de636762471dbe
4de8fc175826d9f78fce9f9f2b71a63fe832fc7507e0394125c823b0909fa54a
6710ee6e22d5e3e82f70554804806c37aac5789b110d944383ea393d93eb627a
80eeae0d5644489d32adf05d4edcf1bb30c5c92c8a5d54630bc3b266e12596c1
a7c14ee84d81a536a4cd54e3a144f388f2174a4a5c409ae118ea49f0da6b4aa6
d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b