zigzagdownrightclicks.htmlmicrosft.repl.co Open in urlscan Pro
34.149.204.188  Malicious Activity! Public Scan

URL: https://zigzagdownrightclicks.htmlmicrosft.repl.co/
Submission Tags: replit-anti-abuse twitter Search All
Submission: On November 29 via api from US — Scanned from DE

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 7 HTTP transactions. The main IP is 34.149.204.188, located in Kansas City, United States and belongs to GOOGLE, US. The main domain is zigzagdownrightclicks.htmlmicrosft.repl.co.
TLS certificate: Issued by R3 on November 29th 2022. Valid for: 3 months.
This is the only time zigzagdownrightclicks.htmlmicrosft.repl.co was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
6 34.149.204.188 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
7 2
Apex Domain
Subdomains
Transfer
6 repl.co
zigzagdownrightclicks.htmlmicrosft.repl.co
279 KB
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 107
922 B
7 2
Domain Requested by
6 zigzagdownrightclicks.htmlmicrosft.repl.co zigzagdownrightclicks.htmlmicrosft.repl.co
1 fonts.googleapis.com zigzagdownrightclicks.htmlmicrosft.repl.co
7 2

This site contains no links.

Subject Issuer Validity Valid
htmlmicrosft.repl.co
R3
2022-11-29 -
2023-02-27
3 months crt.sh
upload.video.google.com
GTS CA 1C3
2022-11-02 -
2023-01-25
3 months crt.sh

This page contains 1 frames:

Primary Page: https://zigzagdownrightclicks.htmlmicrosft.repl.co/
Frame ID: 46BD5F264C4D78913CDDAFC207291086
Requests: 7 HTTP requests in this frame

Screenshot

Page Title

Panel de configuracion

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css

Page Statistics

7
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

280 kB
Transfer

280 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
zigzagdownrightclicks.htmlmicrosft.repl.co/
3 KB
3 KB
Document
General
Full URL
https://zigzagdownrightclicks.htmlmicrosft.repl.co/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.149.204.188 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
188.204.149.34.bc.googleusercontent.com
Software
/
Resource Hash
791c5fe31470ca4ee8358819f728aafd51c9936688e32b7eb9953da924c05556
Security Headers
Name Value
Strict-Transport-Security max-age=7760896; includeSubDomains

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-length
3011
content-type
text/html; charset=UTF-8
date
Tue, 29 Nov 2022 21:07:50 GMT
expect-ct
max-age=2592000, report-uri="https://sentry.repl.it/api/10/security/?sentry_key=615192fd532445bfbbbe966cd7131791"
host
zigzagdownrightclicks.htmlmicrosft.repl.co
replit-cluster
global
strict-transport-security
max-age=7760896; includeSubDomains
bootstrap.min.css
zigzagdownrightclicks.htmlmicrosft.repl.co/
0
0
Stylesheet
General
Full URL
https://zigzagdownrightclicks.htmlmicrosft.repl.co/bootstrap.min.css
Requested by
Host: zigzagdownrightclicks.htmlmicrosft.repl.co
URL: https://zigzagdownrightclicks.htmlmicrosft.repl.co/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.149.204.188 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
188.204.149.34.bc.googleusercontent.com
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=7760896; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://zigzagdownrightclicks.htmlmicrosft.repl.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Tue, 29 Nov 2022 21:07:50 GMT
strict-transport-security
max-age=7760896; includeSubDomains
host
zigzagdownrightclicks.htmlmicrosft.repl.co
replit-cluster
global
expect-ct
max-age=2592000, report-uri="https://sentry.repl.it/api/10/security/?sentry_key=615192fd532445bfbbbe966cd7131791"
content-length
550
content-type
text/html; charset=UTF-8
util.css
zigzagdownrightclicks.htmlmicrosft.repl.co/
85 KB
85 KB
Stylesheet
General
Full URL
https://zigzagdownrightclicks.htmlmicrosft.repl.co/util.css
Requested by
Host: zigzagdownrightclicks.htmlmicrosft.repl.co
URL: https://zigzagdownrightclicks.htmlmicrosft.repl.co/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.149.204.188 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
188.204.149.34.bc.googleusercontent.com
Software
/
Resource Hash
27751cc48fb8c009d013ffb85f0f2b1db36530791eca74d317aec90d34f09b39
Security Headers
Name Value
Strict-Transport-Security max-age=7760896; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://zigzagdownrightclicks.htmlmicrosft.repl.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Tue, 29 Nov 2022 21:07:50 GMT
strict-transport-security
max-age=7760896; includeSubDomains
host
zigzagdownrightclicks.htmlmicrosft.repl.co
replit-cluster
global
expect-ct
max-age=2592000, report-uri="https://sentry.repl.it/api/10/security/?sentry_key=615192fd532445bfbbbe966cd7131791"
content-length
86814
content-type
text/css; charset=UTF-8
main.css
zigzagdownrightclicks.htmlmicrosft.repl.co/
9 KB
9 KB
Stylesheet
General
Full URL
https://zigzagdownrightclicks.htmlmicrosft.repl.co/main.css
Requested by
Host: zigzagdownrightclicks.htmlmicrosft.repl.co
URL: https://zigzagdownrightclicks.htmlmicrosft.repl.co/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.149.204.188 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
188.204.149.34.bc.googleusercontent.com
Software
/
Resource Hash
4ce93074a45d5647eb4187a22b283f147cf7aa905ffa9eb48c44893a576c3186
Security Headers
Name Value
Strict-Transport-Security max-age=7760896; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://zigzagdownrightclicks.htmlmicrosft.repl.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Tue, 29 Nov 2022 21:07:50 GMT
strict-transport-security
max-age=7760896; includeSubDomains
host
zigzagdownrightclicks.htmlmicrosft.repl.co
replit-cluster
global
expect-ct
max-age=2592000, report-uri="https://sentry.repl.it/api/10/security/?sentry_key=615192fd532445bfbbbe966cd7131791"
content-length
8998
content-type
text/css; charset=UTF-8
icondem.svg
zigzagdownrightclicks.htmlmicrosft.repl.co/
4 KB
4 KB
Image
General
Full URL
https://zigzagdownrightclicks.htmlmicrosft.repl.co/icondem.svg
Requested by
Host: zigzagdownrightclicks.htmlmicrosft.repl.co
URL: https://zigzagdownrightclicks.htmlmicrosft.repl.co/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.149.204.188 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
188.204.149.34.bc.googleusercontent.com
Software
/
Resource Hash
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
Security Headers
Name Value
Strict-Transport-Security max-age=7760896; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://zigzagdownrightclicks.htmlmicrosft.repl.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Tue, 29 Nov 2022 21:07:50 GMT
strict-transport-security
max-age=7760896; includeSubDomains
host
zigzagdownrightclicks.htmlmicrosft.repl.co
replit-cluster
global
expect-ct
max-age=2592000, report-uri="https://sentry.repl.it/api/10/security/?sentry_key=615192fd532445bfbbbe966cd7131791"
content-length
3651
content-type
image/svg+xml
backing.jpg
zigzagdownrightclicks.htmlmicrosft.repl.co/
179 KB
179 KB
Image
General
Full URL
https://zigzagdownrightclicks.htmlmicrosft.repl.co/backing.jpg
Requested by
Host: zigzagdownrightclicks.htmlmicrosft.repl.co
URL: https://zigzagdownrightclicks.htmlmicrosft.repl.co/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.149.204.188 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
188.204.149.34.bc.googleusercontent.com
Software
/
Resource Hash
e547345793cdae90c1e1b0762f3b6f830c2d47d698bec3ebc9f0d46cda6f1502
Security Headers
Name Value
Strict-Transport-Security max-age=7760896; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://zigzagdownrightclicks.htmlmicrosft.repl.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Tue, 29 Nov 2022 21:07:50 GMT
strict-transport-security
max-age=7760896; includeSubDomains
host
zigzagdownrightclicks.htmlmicrosft.repl.co
replit-cluster
global
expect-ct
max-age=2592000, report-uri="https://sentry.repl.it/api/10/security/?sentry_key=615192fd532445bfbbbe966cd7131791"
content-length
182872
content-type
image/jpeg
css
fonts.googleapis.com/
1003 B
922 B
Font
General
Full URL
https://fonts.googleapis.com/css?family=Poppins
Requested by
Host: zigzagdownrightclicks.htmlmicrosft.repl.co
URL: https://zigzagdownrightclicks.htmlmicrosft.repl.co/main.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
f93eabed9db1894c7c76ceaaa899450f82a3f9e4a003b1753985ad35b2e86ce0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://zigzagdownrightclicks.htmlmicrosft.repl.co/
Origin
https://zigzagdownrightclicks.htmlmicrosft.repl.co
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Tue, 29 Nov 2022 21:07:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Tue, 29 Nov 2022 20:21:39 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 29 Nov 2022 21:07:50 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

9 Console Messages

Source Level URL
Text
network error URL: https://zigzagdownrightclicks.htmlmicrosft.repl.co/bootstrap.min.css
Message:
Failed to load resource: the server responded with a status of 404 ()
other warning URL: https://zigzagdownrightclicks.htmlmicrosft.repl.co/
Message:
Failed to decode downloaded font: https://fonts.googleapis.com/css?family=Poppins
other warning URL: https://zigzagdownrightclicks.htmlmicrosft.repl.co/
Message:
OTS parsing error: invalid sfntVersion: 791289956
other warning URL: https://zigzagdownrightclicks.htmlmicrosft.repl.co/
Message:
Failed to decode downloaded font: https://fonts.googleapis.com/css?family=Poppins
other warning URL: https://zigzagdownrightclicks.htmlmicrosft.repl.co/
Message:
OTS parsing error: invalid sfntVersion: 791289956
other warning URL: https://zigzagdownrightclicks.htmlmicrosft.repl.co/
Message:
Failed to decode downloaded font: https://fonts.googleapis.com/css?family=Poppins
other warning URL: https://zigzagdownrightclicks.htmlmicrosft.repl.co/
Message:
OTS parsing error: invalid sfntVersion: 791289956
other warning URL: https://zigzagdownrightclicks.htmlmicrosft.repl.co/
Message:
Failed to decode downloaded font: https://fonts.googleapis.com/css?family=Poppins
other warning URL: https://zigzagdownrightclicks.htmlmicrosft.repl.co/
Message:
OTS parsing error: invalid sfntVersion: 791289956

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=7760896; includeSubDomains