![](/screenshots/731f6a82-965c-4e50-bf3d-93c90a14682b.png)
1099kk.xyz
Open in
urlscan Pro
93.157.63.185
Malicious Activity!
Public Scan
Submission: On October 24 via api from CA
Summary
This is the only time 1099kk.xyz was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Interac (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
6 | 93.157.63.185 93.157.63.185 | 43350 (NFORCE) (NFORCE) | |
1 1 | 2606:4700:30:... 2606:4700:30::6812:3aa4 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
1 | 2606:4700:30:... 2606:4700:30::6812:3ba4 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
1 | 50.87.145.76 50.87.145.76 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1 - Unified Layer) | |
1 | 45.40.181.129 45.40.181.129 | 26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com) | |
1 | 2605:de00:1:1... 2605:de00:1:1:4a:3c:0:82 | 30083 (HEG-US) (HEG-US - HEG US Inc.) | |
1 | 23.43.121.59 23.43.121.59 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
1 | 52.216.100.141 52.216.100.141 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
1 | 104.154.250.30 104.154.250.30 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 | 2a00:1450:400... 2a00:1450:4001:819::2008 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
3 | 2a00:1450:400... 2a00:1450:4001:819::200e | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 | 2a00:1450:400... 2a00:1450:400c:c0c::9a | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
18 | 11 |
ASN43350 (NFORCE, NL)
PTR: server.dnsfreedom.net
1099kk.xyz |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
portalbrasil10.com.br |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
portalbrasil10.com.br |
ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US)
PTR: 50-87-145-76.unifiedlayer.com
www.the-boardwalk.ca |
ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-45-40-181-129.ip.secureserver.net
moneybloggess.com |
ASN20940 (AKAMAI-ASN1, US)
PTR: a23-43-121-59.deploy.static.akamaitechnologies.com
www.rbcroyalbank.com |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
s3.amazonaws.com |
ASN15169 (GOOGLE - Google LLC, US)
PTR: 30.250.154.104.bc.googleusercontent.com
letstalkpayments.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
1099kk.xyz
1099kk.xyz |
139 KB |
3 |
google-analytics.com
www.google-analytics.com |
18 KB |
2 |
portalbrasil10.com.br
1 redirects
portalbrasil10.com.br |
85 KB |
1 |
doubleclick.net
stats.g.doubleclick.net |
136 B |
1 |
googletagmanager.com
www.googletagmanager.com |
36 KB |
1 |
letstalkpayments.com
letstalkpayments.com |
31 KB |
1 |
amazonaws.com
s3.amazonaws.com |
6 KB |
1 |
rbcroyalbank.com
www.rbcroyalbank.com |
40 KB |
1 |
downtownptbo.ca
downtownptbo.ca |
13 KB |
1 |
moneybloggess.com
moneybloggess.com |
13 KB |
1 |
the-boardwalk.ca
www.the-boardwalk.ca |
4 KB |
18 | 11 |
Domain | Requested by | |
---|---|---|
6 | 1099kk.xyz |
1099kk.xyz
|
3 | www.google-analytics.com |
1099kk.xyz
|
2 | portalbrasil10.com.br |
1 redirects
1099kk.xyz
|
1 | stats.g.doubleclick.net |
1099kk.xyz
|
1 | www.googletagmanager.com |
1099kk.xyz
|
1 | letstalkpayments.com |
1099kk.xyz
|
1 | s3.amazonaws.com |
1099kk.xyz
|
1 | www.rbcroyalbank.com |
1099kk.xyz
|
1 | downtownptbo.ca |
1099kk.xyz
|
1 | moneybloggess.com |
1099kk.xyz
|
1 | www.the-boardwalk.ca |
1099kk.xyz
|
18 | 11 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni57525.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2 |
2018-09-14 - 2019-03-23 |
6 months | crt.sh |
s3.amazonaws.com DigiCert Baltimore CA-2 G2 |
2018-08-02 - 2019-10-25 |
a year | crt.sh |
letstalkpayments.com Let's Encrypt Authority X3 |
2018-10-06 - 2019-01-04 |
3 months | crt.sh |
*.google-analytics.com Google Internet Authority G3 |
2018-10-02 - 2018-12-25 |
3 months | crt.sh |
*.g.doubleclick.net Google Internet Authority G3 |
2018-10-02 - 2018-12-25 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
http://1099kk.xyz/depositfundsnow.xyz/in/fer.html
Frame ID: 3324F3DC7D187AD7F239485E0B7E48D5
Requests: 18 HTTP requests in this frame
Screenshot
![](/screenshots/731f6a82-965c-4e50-bf3d-93c90a14682b.png)
Detected technologies
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
Detected patterns
- script /google-analytics\.com\/(?:ga|urchin|(analytics))\.js/i
- env /^gaGlobal$/i
![](/vendor/wappa/icons/Google Tag Manager.png)
Detected patterns
- env /^google_tag_manager$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 5- http://portalbrasil10.com.br/wp-content/uploads/2016/11/bmo-1.jpg HTTP 301
- https://portalbrasil10.com.br/wp-content/uploads/2016/11/bmo-1.jpg
- http://www.google-analytics.com/plugins/ua/linkid.js HTTP 307
- https://www.google-analytics.com/plugins/ua/linkid.js
- http://www.google-analytics.com/analytics.js HTTP 307
- https://www.google-analytics.com/analytics.js
- http://www.google-analytics.com/collect?v=1&_v=j49&aip=1&a=2114603888&t=pageview&_s=1&dl=http%3A%2F%2F1099kk.xyz%2Fdepositfundsnow.xyz%2Fin%2Ffer.html&ul=en-us&de=UTF-8&dt=120%20Claim&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=SGAAgAAjE~&jid=1423189727&cid=846130175.1540350087&tid=UA-53324311-1>m=Gaf5SR238&z=1933943111 HTTP 307
- https://www.google-analytics.com/collect?v=1&_v=j49&aip=1&a=2114603888&t=pageview&_s=1&dl=http%3A%2F%2F1099kk.xyz%2Fdepositfundsnow.xyz%2Fin%2Ffer.html&ul=en-us&de=UTF-8&dt=120%20Claim&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=SGAAgAAjE~&jid=1423189727&cid=846130175.1540350087&tid=UA-53324311-1>m=Gaf5SR238&z=1933943111
18 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
fer.html
1099kk.xyz/depositfundsnow.xyz/in/ |
16 KB 16 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
analytics.js.download
1099kk.xyz/depositfundsnow.xyz/in/INTERAC%20e-Transfer_files/ |
29 KB 29 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
1099kk.xyz/depositfundsnow.xyz/in/ |
3 KB 3 KB |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
generalCSS.css
1099kk.xyz/depositfundsnow.xyz/in/INTERAC%20e-Transfer_files/ |
17 KB 17 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
GTIe8CSS.css
1099kk.xyz/depositfundsnow.xyz/in/INTERAC%20e-Transfer_files/ |
31 KB 31 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
top.jpg
1099kk.xyz/depositfundsnow.xyz/in/INTERAC%20e-Transfer_files/ |
43 KB 44 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
bmo-1.jpg
portalbrasil10.com.br/wp-content/uploads/2016/11/ Redirect Chain
|
84 KB 85 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
th_ddc772f125835b4ca64d4befb178b34b_tenants_logo_cibcbank98.jpg
www.the-boardwalk.ca/wp-content/files_mf/cache/ |
4 KB 4 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
CIBC___Corporate_CIBC_launches_new_direct_banking_brand_through.jpg
moneybloggess.com/wp-content/uploads/2017/09/ |
12 KB 13 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
dbia_td.jpg
downtownptbo.ca/assets/img/uploads/ |
13 KB 13 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
PopUp_ModalWindow_logoTablet.png
www.rbcroyalbank.com/mobile/_assets-custom/images/ |
40 KB 40 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo_bnc_facebook_en.jpg
s3.amazonaws.com/bnc/img/ |
6 KB 6 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
9127979.jpg
letstalkpayments.com/wp-content/uploads/2016/01/ |
31 KB 31 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
gtm.js
www.googletagmanager.com/ |
107 KB 36 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
linkid.js
www.google-analytics.com/plugins/ua/ Redirect Chain
|
2 KB 947 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
analytics.js
www.google-analytics.com/ Redirect Chain
|
42 KB 17 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
collect
www.google-analytics.com/ Redirect Chain
|
35 B 99 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
collect
stats.g.doubleclick.net/r/ |
35 B 136 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Interac (Banking)11 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| dataLayer function| submitAbout function| openWindow function| ga object| gaplugins object| google_tag_manager function| postscribe string| GoogleAnalyticsObject object| gaGlobal object| gaData object| google_tag_data2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.1099kk.xyz/ | Name: _dc_gtm_UA-53324311-1 Value: 1 |
|
.1099kk.xyz/ | Name: _ga Value: GA1.2.846130175.1540350087 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
1099kk.xyz
downtownptbo.ca
letstalkpayments.com
moneybloggess.com
portalbrasil10.com.br
s3.amazonaws.com
stats.g.doubleclick.net
www.google-analytics.com
www.googletagmanager.com
www.rbcroyalbank.com
www.the-boardwalk.ca
104.154.250.30
23.43.121.59
2605:de00:1:1:4a:3c:0:82
2606:4700:30::6812:3aa4
2606:4700:30::6812:3ba4
2a00:1450:4001:819::2008
2a00:1450:4001:819::200e
2a00:1450:400c:c0c::9a
45.40.181.129
50.87.145.76
52.216.100.141
93.157.63.185
169ab263f661ef50eab404e6be618a16523d35822615ebb6d9d29228945ea7d5
287d767e8243adaad484218ddca546c7c95e28501d2f5f33b7aebcc51b434867
480211579abd5b236e8f3b482e20c4a4b646cdcf0275035d71668e3690560de6
48475eb50a92ad0ac29a9d4741ea7c2c87719c3f2c76b5000be094597f23b503
52f5fc47b51ff039f7b712077ca192efdcd45c2ac27113a6711f37d9e86c1e39
62214f2f6a7e31c5fc8036eac2a6b1d272bdeb1e4184ab2aac2203d0208749fc
821734d4a16909cf3979879c3a5c8b9f39bb747824ce7711dd53320ae1df791b
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8c35a549583baa99980f4c9dc146f44aedc8521d5f18dde5002be384c7bd3710
8cb05b675fe6419a9e91eb587c60902c7ed1cb6c42b8cff8ce404ef89f635cde
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
99d19a95f0b95c7a6f0accbf5e2600637db0ac0f00352cd748a7eef65cb36bc5
9e8018d4aeca258a8ecb3445cb7eef6f926d9ebbc1e8869188d9c12392b01a28
ad54ff7eb1aff99a1bbc35059cb82c599a59ef88f1da9a0063faded9fb3af935
d00cf2734fc34ee323de7bb6a3add150e0021c03e344ef94aeb4122409e2f050
e0aa0851665ceb0dfbf0ece00b225be0b44ab27b84caafa715632e9f5e838e4b
eb7cf672bea32c87b331d18b4b63f75aef9db478cf6cc90d060843389c338c88