1099kk.xyz Open in urlscan Pro
93.157.63.185 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://1099kk.xyz/depositfundsnow.xyz/in/fer.html
Submission: On October 24 via api (October 24th 2018, 3:01:41 am UTC) from CA

Summary HTTP 18 Redirects Behaviour Indicators

Summary

This website contacted 11 IPs in 4 countries across 11 domains to perform 18 HTTP transactions. The main IP is 93.157.63.185, located in Moscow, Russian Federation and belongs to NFORCE, NL. The main domain is 1099kk.xyz.

This is the only time 1099kk.xyz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Interac (Banking)

Domain & IP information

	IP Address	AS Autonomous System
6	93.157.63.185 93.157.63.185	43350 (NFORCE) (NFORCE)
1 1	2606:4700:30:... 2606:4700:30::6812:3aa4	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	2606:4700:30:... 2606:4700:30::6812:3ba4	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	50.87.145.76 50.87.145.76	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1 - Unified Layer)
1	45.40.181.129 45.40.181.129	26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com)
1	2605:de00:1:1... 2605:de00:1:1:4a:3c:0:82	30083 (HEG-US) (HEG-US - HEG US Inc.)
1	23.43.121.59 23.43.121.59	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	52.216.100.141 52.216.100.141	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	104.154.250.30 104.154.250.30	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a00:1450:400... 2a00:1450:4001:819::2008	15169 (GOOGLE) (GOOGLE - Google LLC)
3	2a00:1450:400... 2a00:1450:4001:819::200e	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a00:1450:400... 2a00:1450:400c:c0c::9a	15169 (GOOGLE) (GOOGLE - Google LLC)
18	11

6 93.157.63.185 (Moscow, Russian Federation)

ASN43350 (NFORCE, NL)
PTR: server.dnsfreedom.net

1099kk.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:30::6812:3aa4 (United States) 1 redirects

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

portalbrasil10.com.br	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:30::6812:3ba4 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

portalbrasil10.com.br	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 50.87.145.76 (Provo, United States)

ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US)
PTR: 50-87-145-76.unifiedlayer.com

www.the-boardwalk.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 45.40.181.129 (Scottsdale, United States)

ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-45-40-181-129.ip.secureserver.net

moneybloggess.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2605:de00:1:1:4a:3c:0:82 (United States)

ASN30083 (HEG-US - HEG US Inc., US)

downtownptbo.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.43.121.59 (Amsterdam, Netherlands)

ASN20940 (AKAMAI-ASN1, US)
PTR: a23-43-121-59.deploy.static.akamaitechnologies.com

www.rbcroyalbank.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.216.100.141 (Ashburn, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)

s3.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.154.250.30 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: 30.250.154.104.bc.googleusercontent.com

letstalkpayments.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:819::2008 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:819::200e (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c0c::9a (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	1099kk.xyz 1099kk.xyz	139 KB
3	google-analytics.com www.google-analytics.com	18 KB
2	portalbrasil10.com.br 1 redirects portalbrasil10.com.br	85 KB
1	doubleclick.net stats.g.doubleclick.net	136 B
1	googletagmanager.com www.googletagmanager.com	36 KB
1	letstalkpayments.com letstalkpayments.com	31 KB
1	amazonaws.com s3.amazonaws.com	6 KB
1	rbcroyalbank.com www.rbcroyalbank.com	40 KB
1	downtownptbo.ca downtownptbo.ca	13 KB
1	moneybloggess.com moneybloggess.com	13 KB
1	the-boardwalk.ca www.the-boardwalk.ca	4 KB
18	11

	Domain	Requested by
6	1099kk.xyz	1099kk.xyz
3	www.google-analytics.com	1099kk.xyz
2	portalbrasil10.com.br	1 redirects 1099kk.xyz
1	stats.g.doubleclick.net	1099kk.xyz
1	www.googletagmanager.com	1099kk.xyz
1	letstalkpayments.com	1099kk.xyz
1	s3.amazonaws.com	1099kk.xyz
1	www.rbcroyalbank.com	1099kk.xyz
1	downtownptbo.ca	1099kk.xyz
1	moneybloggess.com	1099kk.xyz
1	www.the-boardwalk.ca	1099kk.xyz
18	11

This site contains no links.

Subject Issuer	Validity	Valid
sni57525.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2018-09-14` - `2019-03-23`	6 months	crt.sh
s3.amazonaws.com DigiCert Baltimore CA-2 G2	`2018-08-02` - `2019-10-25`	a year	crt.sh
letstalkpayments.com Let's Encrypt Authority X3	`2018-10-06` - `2019-01-04`	3 months	crt.sh
*.google-analytics.com Google Internet Authority G3	`2018-10-02` - `2018-12-25`	3 months	crt.sh
*.g.doubleclick.net Google Internet Authority G3	`2018-10-02` - `2018-12-25`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://1099kk.xyz/depositfundsnow.xyz/in/fer.html
Frame ID: 3324F3DC7D187AD7F239485E0B7E48D5
Requests: 18 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|(analytics))\.js/i
env /^gaGlobal$/i

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

env /^google_tag_manager$/i

Page Statistics

18
Requests

39 %
HTTPS

50 %
IPv6

11
Domains

11
Subdomains

11
IPs

4
Countries

386 kB
Transfer

479 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 5

http://portalbrasil10.com.br/wp-content/uploads/2016/11/bmo-1.jpg HTTP 301
https://portalbrasil10.com.br/wp-content/uploads/2016/11/bmo-1.jpg

Request Chain 13

http://www.google-analytics.com/plugins/ua/linkid.js HTTP 307
https://www.google-analytics.com/plugins/ua/linkid.js

Request Chain 14

http://www.google-analytics.com/analytics.js HTTP 307
https://www.google-analytics.com/analytics.js

Request Chain 15

http://www.google-analytics.com/collect?v=1&_v=j49&aip=1&a=2114603888&t=pageview&_s=1&dl=http%3A%2F%2F1099kk.xyz%2Fdepositfundsnow.xyz%2Fin%2Ffer.html&ul=en-us&de=UTF-8&dt=120%20Claim&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=SGAAgAAjE~&jid=1423189727&cid=846130175.1540350087&tid=UA-53324311-1&gtm=Gaf5SR238&z=1933943111 HTTP 307
https://www.google-analytics.com/collect?v=1&_v=j49&aip=1&a=2114603888&t=pageview&_s=1&dl=http%3A%2F%2F1099kk.xyz%2Fdepositfundsnow.xyz%2Fin%2Ffer.html&ul=en-us&de=UTF-8&dt=120%20Claim&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=SGAAgAAjE~&jid=1423189727&cid=846130175.1540350087&tid=UA-53324311-1&gtm=Gaf5SR238&z=1933943111

18 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request fer.html Show response
1099kk.xyz/depositfundsnow.xyz/in/ 16 KB
16 KB 46ms
14ms Document
text/html 93.157.63.185
NFORCE

General

Check archive.org

Show headers Download Go to

Full URL: http://1099kk.xyz/depositfundsnow.xyz/in/fer.html
Protocol: HTTP/1.1
Server: 93.157.63.185 Moscow, Russian Federation, ASN43350 (NFORCE, NL),
Reverse DNS: server.dnsfreedom.net
Software: Apache /
Resource Hash: 62214f2f6a7e31c5fc8036eac2a6b1d272bdeb1e4184ab2aac2203d0208749fc

Request headers

Host: 1099kk.xyz
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 24 Oct 2018 03:01:26 GMT
Server: Apache
Last-Modified: Mon, 16 Jul 2018 08:40:46 GMT
Accept-Ranges: bytes
Content-Length: 16051
Keep-Alive: timeout=5, max=80
Connection: Keep-Alive
Content-Type: text/html

GET
H/1.1 200
OK analytics.js.download Show response
1099kk.xyz/depositfundsnow.xyz/in/INTERAC%20e-Transfer_files/ 29 KB
29 KB 41ms
16ms Script
application/javascript 93.157.63.185
NFORCE

General

Check archive.org

Show headers Download Go to

Full URL: http://1099kk.xyz/depositfundsnow.xyz/in/INTERAC%20e-Transfer_files/analytics.js.download
Requested by: Host: 1099kk.xyz
URL: http://1099kk.xyz/depositfundsnow.xyz/in/fer.html
Protocol: HTTP/1.1
Server: 93.157.63.185 Moscow, Russian Federation, ASN43350 (NFORCE, NL),
Reverse DNS: server.dnsfreedom.net
Software: Apache /
Resource Hash: 48475eb50a92ad0ac29a9d4741ea7c2c87719c3f2c76b5000be094597f23b503

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: 1099kk.xyz
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: */*
Referer: http://1099kk.xyz/depositfundsnow.xyz/in/fer.html
Connection: keep-alive
Cache-Control: no-cache
Referer: http://1099kk.xyz/depositfundsnow.xyz/in/fer.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 24 Oct 2018 03:01:26 GMT
Last-Modified: Tue, 07 Mar 2017 18:15:28 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=80
Content-Length: 29455

GET
H/1.1 200
OK / Show response
1099kk.xyz/depositfundsnow.xyz/in/ 3 KB
3 KB 57ms
32ms Script
text/html 93.157.63.185
NFORCE

General

Check archive.org

Show headers Download Go to

Full URL: http://1099kk.xyz/depositfundsnow.xyz/in/
Requested by: Host: 1099kk.xyz
URL: http://1099kk.xyz/depositfundsnow.xyz/in/fer.html
Protocol: HTTP/1.1
Server: 93.157.63.185 Moscow, Russian Federation, ASN43350 (NFORCE, NL),
Reverse DNS: server.dnsfreedom.net
Software: Apache /
Resource Hash: 480211579abd5b236e8f3b482e20c4a4b646cdcf0275035d71668e3690560de6

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: 1099kk.xyz
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: */*
Referer: http://1099kk.xyz/depositfundsnow.xyz/in/fer.html
Connection: keep-alive
Cache-Control: no-cache
Referer: http://1099kk.xyz/depositfundsnow.xyz/in/fer.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 24 Oct 2018 03:01:26 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=80
Content-Length: 2619
Content-Type: text/html;charset=ISO-8859-1

GET
H/1.1 200
OK generalCSS.css
1099kk.xyz/depositfundsnow.xyz/in/INTERAC%20e-Transfer_files/ 17 KB
17 KB 22ms
14ms Stylesheet
text/css 93.157.63.185
NFORCE

General

Check archive.org

Show headers Download Go to

Full URL: http://1099kk.xyz/depositfundsnow.xyz/in/INTERAC%20e-Transfer_files/generalCSS.css
Requested by: Host: 1099kk.xyz
URL: http://1099kk.xyz/depositfundsnow.xyz/in/fer.html
Protocol: HTTP/1.1
Server: 93.157.63.185 Moscow, Russian Federation, ASN43350 (NFORCE, NL),
Reverse DNS: server.dnsfreedom.net
Software: Apache /
Resource Hash: 169ab263f661ef50eab404e6be618a16523d35822615ebb6d9d29228945ea7d5

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: 1099kk.xyz
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://1099kk.xyz/depositfundsnow.xyz/in/fer.html
Connection: keep-alive
Cache-Control: no-cache
Referer: http://1099kk.xyz/depositfundsnow.xyz/in/fer.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 24 Oct 2018 03:01:26 GMT
Last-Modified: Tue, 07 Mar 2017 18:15:30 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=79
Content-Length: 16962

GET
H/1.1 200
OK GTIe8CSS.css
1099kk.xyz/depositfundsnow.xyz/in/INTERAC%20e-Transfer_files/ 31 KB
31 KB 37ms
14ms Stylesheet
text/css 93.157.63.185
NFORCE

General

Check archive.org

Show headers Download Go to

Full URL: http://1099kk.xyz/depositfundsnow.xyz/in/INTERAC%20e-Transfer_files/GTIe8CSS.css
Requested by: Host: 1099kk.xyz
URL: http://1099kk.xyz/depositfundsnow.xyz/in/fer.html
Protocol: HTTP/1.1
Server: 93.157.63.185 Moscow, Russian Federation, ASN43350 (NFORCE, NL),
Reverse DNS: server.dnsfreedom.net
Software: Apache /
Resource Hash: 821734d4a16909cf3979879c3a5c8b9f39bb747824ce7711dd53320ae1df791b

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: 1099kk.xyz
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://1099kk.xyz/depositfundsnow.xyz/in/fer.html
Connection: keep-alive
Cache-Control: no-cache
Referer: http://1099kk.xyz/depositfundsnow.xyz/in/fer.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 24 Oct 2018 03:01:26 GMT
Last-Modified: Tue, 07 Mar 2017 18:15:30 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=78
Content-Length: 31901

GET
H/1.1 200
OK top.jpg
1099kk.xyz/depositfundsnow.xyz/in/INTERAC%20e-Transfer_files/ 43 KB
44 KB 40ms
16ms Image
image/jpeg 93.157.63.185
NFORCE

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://1099kk.xyz/depositfundsnow.xyz/in/INTERAC%20e-Transfer_files/top.jpg
Requested by: Host: 1099kk.xyz
URL: http://1099kk.xyz/depositfundsnow.xyz/in/fer.html
Protocol: HTTP/1.1
Server: 93.157.63.185 Moscow, Russian Federation, ASN43350 (NFORCE, NL),
Reverse DNS: server.dnsfreedom.net
Software: Apache /
Resource Hash: e0aa0851665ceb0dfbf0ece00b225be0b44ab27b84caafa715632e9f5e838e4b

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: 1099kk.xyz
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://1099kk.xyz/depositfundsnow.xyz/in/fer.html
Connection: keep-alive
Cache-Control: no-cache
Referer: http://1099kk.xyz/depositfundsnow.xyz/in/fer.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 24 Oct 2018 03:01:26 GMT
Last-Modified: Sun, 07 Oct 2018 09:32:44 GMT
Server: Apache
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=80
Content-Length: 44369

GET
S

200

bmo-1.jpg
portalbrasil10.com.br/wp-content/uploads/2016/11/
Redirect Chain

http://portalbrasil10.com.br/wp-content/uploads/2016/11/bmo-1.jpg
https://portalbrasil10.com.br/wp-content/uploads/2016/11/bmo-1.jpg

84 KB
85 KB

242ms
191ms

Image
image/jpeg

2606:4700:30::6812:3ba4
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://portalbrasil10.com.br/wp-content/uploads/2016/11/bmo-1.jpg
Requested by: Host: 1099kk.xyz
URL: http://1099kk.xyz/depositfundsnow.xyz/in/fer.html
Protocol: SPDY
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700:30::6812:3ba4 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: eb7cf672bea32c87b331d18b4b63f75aef9db478cf6cc90d060843389c338c88

Request headers

Referer: http://1099kk.xyz/depositfundsnow.xyz/in/fer.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 24 Oct 2018 03:01:27 GMT
cf-cache-status: REVALIDATED
last-modified: Mon, 28 Nov 2016 11:50:02 GMT
server: cloudflare
etag: "150c1-5425b12778d89"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
status: 200
accept-ranges: bytes
cf-ray: 46e932eb9a5b9744-FRA
content-length: 86209

Redirect headers

Date: Wed, 24 Oct 2018 03:01:26 GMT
Server: cloudflare
Vary: Accept-Encoding
Location: https://portalbrasil10.com.br/wp-content/uploads/2016/11/bmo-1.jpg
Cache-Control: max-age=3600
Transfer-Encoding: chunked
Connection: keep-alive
CF-RAY: 46e932eb12ab6355-FRA
Expires: Wed, 24 Oct 2018 04:01:26 GMT

GET
H/1.1 200
OK th_ddc772f125835b4ca64d4befb178b34b_tenants_logo_cibcbank98.jpg
www.the-boardwalk.ca/wp-content/files_mf/cache/ 4 KB
4 KB 784ms
159ms Image
image/jpeg 50.87.145.76
Unified Layer

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.the-boardwalk.ca/wp-content/files_mf/cache/th_ddc772f125835b4ca64d4befb178b34b_tenants_logo_cibcbank98.jpg
Requested by: Host: 1099kk.xyz
URL: http://1099kk.xyz/depositfundsnow.xyz/in/fer.html
Protocol: HTTP/1.1
Server: 50.87.145.76 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US),
Reverse DNS: 50-87-145-76.unifiedlayer.com
Software: nginx/1.14.0 /
Resource Hash: d00cf2734fc34ee323de7bb6a3add150e0021c03e344ef94aeb4122409e2f050

Request headers

Referer: http://1099kk.xyz/depositfundsnow.xyz/in/fer.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 24 Oct 2018 03:01:27 GMT
Last-Modified: Thu, 01 Feb 2018 14:31:56 GMT
Server: nginx/1.14.0
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3786
Content-Type: image/jpeg

GET
H/1.1 200
OK CIBC___Corporate_CIBC_launches_new_direct_banking_brand_through.jpg
moneybloggess.com/wp-content/uploads/2017/09/ 12 KB
13 KB 336ms
158ms Image
image/jpeg 45.40.181.129
GoDaddy.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://moneybloggess.com/wp-content/uploads/2017/09/CIBC___Corporate_CIBC_launches_new_direct_banking_brand_through.jpg
Requested by: Host: 1099kk.xyz
URL: http://1099kk.xyz/depositfundsnow.xyz/in/fer.html
Protocol: HTTP/1.1
Server: 45.40.181.129 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS: ip-45-40-181-129.ip.secureserver.net
Software: Apache /
Resource Hash: 9e8018d4aeca258a8ecb3445cb7eef6f926d9ebbc1e8869188d9c12392b01a28

Request headers

Referer: http://1099kk.xyz/depositfundsnow.xyz/in/fer.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 24 Oct 2018 03:01:27 GMT
Last-Modified: Sun, 17 Sep 2017 23:56:08 GMT
Server: Apache
ETag: "30ef-5596b5ea81600"
Content-Type: image/jpeg
Cache-Control: max-age=5184000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 12527
Expires: Sun, 23 Dec 2018 03:01:27 GMT

GET
H/1.1 200
OK dbia_td.jpg
downtownptbo.ca/assets/img/uploads/ 13 KB
13 KB 493ms
121ms Image
image/jpeg 2605:de00:1:1:4a:3c:0:82
HEG US Inc.

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://downtownptbo.ca/assets/img/uploads/dbia_td.jpg?1405109643
Requested by: Host: 1099kk.xyz
URL: http://1099kk.xyz/depositfundsnow.xyz/in/fer.html
Protocol: HTTP/1.1
Server: 2605:de00:1:1:4a:3c:0:82 , United States, ASN30083 (HEG-US - HEG US Inc., US),
Reverse DNS
Software: nginx /
Resource Hash: 8c35a549583baa99980f4c9dc146f44aedc8521d5f18dde5002be384c7bd3710

Request headers

Referer: http://1099kk.xyz/depositfundsnow.xyz/in/fer.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 24 Oct 2018 03:01:58 GMT
Last-Modified: Fri, 11 Jul 2014 20:14:03 GMT
Server: nginx
ETag: "34f7-4fdf0952438c0"
Content-Type: image/jpeg
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 13559

GET
H/1.1 200
OK PopUp_ModalWindow_logoTablet.png
www.rbcroyalbank.com/mobile/_assets-custom/images/ 40 KB
40 KB 151ms
106ms Image
image/png 23.43.121.59
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.rbcroyalbank.com/mobile/_assets-custom/images/PopUp_ModalWindow_logoTablet.png
Requested by: Host: 1099kk.xyz
URL: http://1099kk.xyz/depositfundsnow.xyz/in/fer.html
Protocol: HTTP/1.1
Server: 23.43.121.59 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a23-43-121-59.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: ad54ff7eb1aff99a1bbc35059cb82c599a59ef88f1da9a0063faded9fb3af935

Request headers

Referer: http://1099kk.xyz/depositfundsnow.xyz/in/fer.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 24 Oct 2018 03:01:26 GMT
Last-Modified: Mon, 19 Dec 2016 19:15:18 GMT
ETag: "54407bd7b7d80"
Content-Type: image/png
X-EdgeConnect-Cache-Status: 2
Cache-Control: max-age=0
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 40934
Expires: Wed, 03 Oct 2018 22:09:51 GMT

GET
H/1.1 200
OK logo_bnc_facebook_en.jpg
s3.amazonaws.com/bnc/img/ 6 KB
6 KB 429ms
109ms Image
image/jpeg 52.216.100.141
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/bnc/img/logo_bnc_facebook_en.jpg
Requested by: Host: 1099kk.xyz
URL: http://1099kk.xyz/depositfundsnow.xyz/in/fer.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.216.100.141 Ashburn, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 99d19a95f0b95c7a6f0accbf5e2600637db0ac0f00352cd748a7eef65cb36bc5

Request headers

Referer: http://1099kk.xyz/depositfundsnow.xyz/in/fer.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 24 Oct 2018 03:01:28 GMT
Last-Modified: Wed, 29 Oct 2014 15:43:49 GMT
Server: AmazonS3
x-amz-request-id: A81BF37A6FB397C8
ETag: "1f9fd253063f1738d2a66c034a2b5daf"
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 5974
x-amz-id-2: vB5MIzS0uXDEdnmssk3dmvL9mYBWC7KVu1gvJd7b7jzsr5yTiWljuRGqAPClaGElsvKVB8Dho8M=

GET
S 200 9127979.jpg
letstalkpayments.com/wp-content/uploads/2016/01/ 31 KB
31 KB 493ms
220ms Image
image/jpeg 104.154.250.30
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://letstalkpayments.com/wp-content/uploads/2016/01/9127979.jpg
Requested by: Host: 1099kk.xyz
URL: http://1099kk.xyz/depositfundsnow.xyz/in/fer.html
Protocol: SPDY
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.154.250.30 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 30.250.154.104.bc.googleusercontent.com
Software: nginx /
Resource Hash: 287d767e8243adaad484218ddca546c7c95e28501d2f5f33b7aebcc51b434867

Request headers

Referer: http://1099kk.xyz/depositfundsnow.xyz/in/fer.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-type: static/known
date: Wed, 24 Oct 2018 03:01:27 GMT
last-modified: Sat, 27 May 2017 12:34:11 GMT
server: nginx
status: 200
etag: "59297243-7aa0"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
content-length: 31392

GET
H/1.1 200
OK gtm.js Show response
www.googletagmanager.com/ 107 KB
36 KB 39ms
17ms Script
application/javascript 2a00:1450:4001:819::2008
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

http://www.googletagmanager.com/gtm.js?id=GTM-5SR238

Requested by

Host: 1099kk.xyz
URL: http://1099kk.xyz/depositfundsnow.xyz/in/fer.html

Protocol

HTTP/1.1

Server

2a00:1450:4001:819::2008 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Google Tag Manager (scaffolding) /

Resource Hash

52f5fc47b51ff039f7b712077ca192efdcd45c2ac27113a6711f37d9e86c1e39

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: http://1099kk.xyz/depositfundsnow.xyz/in/fer.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 24 Oct 2018 03:01:26 GMT
Content-Encoding: gzip
Server: Google Tag Manager (scaffolding)
Vary: Accept-Encoding
Content-Type: application/javascript; charset=UTF-8
Access-Control-Allow-Origin: http://www.googletagmanager.com
Cache-Control: private, max-age=900
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: Cache-Control
Content-Length: 36631
X-XSS-Protection: 1; mode=block
Expires: Wed, 24 Oct 2018 03:01:26 GMT

GET
S

200

linkid.js Show response
www.google-analytics.com/plugins/ua/
Redirect Chain

http://www.google-analytics.com/plugins/ua/linkid.js
https://www.google-analytics.com/plugins/ua/linkid.js

2 KB
947 B

6ms
5ms

Script
text/javascript

2a00:1450:4001:819::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/plugins/ua/linkid.js

Requested by

Host: 1099kk.xyz
URL: http://1099kk.xyz/depositfundsnow.xyz/in/fer.html

Protocol

SPDY

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:819::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://1099kk.xyz/depositfundsnow.xyz/in/fer.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 24 Oct 2018 02:22:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 21 Apr 2016 03:17:22 GMT
server: sffe
age: 2323
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=3600
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 856
x-xss-protection: 1; mode=block
expires: Wed, 24 Oct 2018 03:22:43 GMT

Redirect headers

Location: https://www.google-analytics.com/plugins/ua/linkid.js
Non-Authoritative-Reason: HSTS

GET
S

200

analytics.js Show response
www.google-analytics.com/
Redirect Chain

http://www.google-analytics.com/analytics.js
https://www.google-analytics.com/analytics.js

42 KB
17 KB

5ms
5ms

Script
text/javascript

2a00:1450:4001:819::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: 1099kk.xyz
URL: http://1099kk.xyz/depositfundsnow.xyz/in/fer.html

Protocol

SPDY

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:819::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8cb05b675fe6419a9e91eb587c60902c7ed1cb6c42b8cff8ce404ef89f635cde

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: http://1099kk.xyz/depositfundsnow.xyz/in/fer.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 11 Oct 2018 19:41:26 GMT
server: Golfe2
age: 2343
date: Wed, 24 Oct 2018 02:22:23 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 17301
expires: Wed, 24 Oct 2018 04:22:23 GMT

Redirect headers

Location: https://www.google-analytics.com/analytics.js
Non-Authoritative-Reason: HSTS

GET
S

200

collect
www.google-analytics.com/
Redirect Chain

http://www.google-analytics.com/collect?v=1&_v=j49&aip=1&a=2114603888&t=pageview&_s=1&dl=http%3A%2F%2F1099kk.xyz%2Fdepositfundsnow.xyz%2Fin%2Ffer.html&ul=en-us&de=UTF-8&dt=120%20Claim&sd=24-bit&sr=...
https://www.google-analytics.com/collect?v=1&_v=j49&aip=1&a=2114603888&t=pageview&_s=1&dl=http%3A%2F%2F1099kk.xyz%2Fdepositfundsnow.xyz%2Fin%2Ffer.html&ul=en-us&de=UTF-8&dt=120%20Claim&sd=24-bit&sr...

35 B
99 B

6ms
6ms

Image
image/gif

2a00:1450:4001:819::200e
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j49&aip=1&a=2114603888&t=pageview&_s=1&dl=http%3A%2F%2F1099kk.xyz%2Fdepositfundsnow.xyz%2Fin%2Ffer.html&ul=en-us&de=UTF-8&dt=120%20Claim&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=SGAAgAAjE~&jid=1423189727&cid=846130175.1540350087&tid=UA-53324311-1&gtm=Gaf5SR238&z=1933943111

Requested by

Host: 1099kk.xyz
URL: http://1099kk.xyz/depositfundsnow.xyz/in/fer.html

Protocol

SPDY

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:819::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://1099kk.xyz/depositfundsnow.xyz/in/fer.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 06 Oct 2018 19:31:24 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 1495803
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://www.google-analytics.com/collect?v=1&_v=j49&aip=1&a=2114603888&t=pageview&_s=1&dl=http%3A%2F%2F1099kk.xyz%2Fdepositfundsnow.xyz%2Fin%2Ffer.html&ul=en-us&de=UTF-8&dt=120%20Claim&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=SGAAgAAjE~&jid=1423189727&cid=846130175.1540350087&tid=UA-53324311-1&gtm=Gaf5SR238&z=1933943111
Non-Authoritative-Reason: HSTS

GET
S 200 collect
stats.g.doubleclick.net/r/ 35 B
136 B 15ms
15ms Image
image/gif 2a00:1450:400c:c0c::9a
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j49&tid=UA-53324311-1&cid=846130175.1540350087&jid=1423189727&_u=SGAAgAAjE~&z=1216949727

Requested by

Host: 1099kk.xyz
URL: http://1099kk.xyz/depositfundsnow.xyz/in/fer.html

Protocol

SPDY

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:400c:c0c::9a , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: http://1099kk.xyz/depositfundsnow.xyz/in/fer.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Wed, 24 Oct 2018 03:01:27 GMT
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Interac (Banking)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.1099kk.xyz/	1970-01-18 19:52:30	Name: _dc_gtm_UA-53324311-1 Value: 1
			.1099kk.xyz/	1970-01-19 13:23:42	Name: _ga Value: GA1.2.846130175.1540350087

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

1099kk.xyz
downtownptbo.ca
letstalkpayments.com
moneybloggess.com
portalbrasil10.com.br
s3.amazonaws.com
stats.g.doubleclick.net
www.google-analytics.com
www.googletagmanager.com
www.rbcroyalbank.com
www.the-boardwalk.ca
104.154.250.30
23.43.121.59
2605:de00:1:1:4a:3c:0:82
2606:4700:30::6812:3aa4
2606:4700:30::6812:3ba4
2a00:1450:4001:819::2008
2a00:1450:4001:819::200e
2a00:1450:400c:c0c::9a
45.40.181.129
50.87.145.76
52.216.100.141
93.157.63.185
169ab263f661ef50eab404e6be618a16523d35822615ebb6d9d29228945ea7d5
287d767e8243adaad484218ddca546c7c95e28501d2f5f33b7aebcc51b434867
480211579abd5b236e8f3b482e20c4a4b646cdcf0275035d71668e3690560de6
48475eb50a92ad0ac29a9d4741ea7c2c87719c3f2c76b5000be094597f23b503
52f5fc47b51ff039f7b712077ca192efdcd45c2ac27113a6711f37d9e86c1e39
62214f2f6a7e31c5fc8036eac2a6b1d272bdeb1e4184ab2aac2203d0208749fc
821734d4a16909cf3979879c3a5c8b9f39bb747824ce7711dd53320ae1df791b
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8c35a549583baa99980f4c9dc146f44aedc8521d5f18dde5002be384c7bd3710
8cb05b675fe6419a9e91eb587c60902c7ed1cb6c42b8cff8ce404ef89f635cde
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
99d19a95f0b95c7a6f0accbf5e2600637db0ac0f00352cd748a7eef65cb36bc5
9e8018d4aeca258a8ecb3445cb7eef6f926d9ebbc1e8869188d9c12392b01a28
ad54ff7eb1aff99a1bbc35059cb82c599a59ef88f1da9a0063faded9fb3af935
d00cf2734fc34ee323de7bb6a3add150e0021c03e344ef94aeb4122409e2f050
e0aa0851665ceb0dfbf0ece00b225be0b44ab27b84caafa715632e9f5e838e4b
eb7cf672bea32c87b331d18b4b63f75aef9db478cf6cc90d060843389c338c88

1099kk.xyz Open in urlscan Pro 93.157.63.185 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

18 Requests

39 %HTTPS

50 %IPv6

11 Domains

11 Subdomains

11 IPs

4 Countries

386 kBTransfer

479 kBSize

2 Cookies

0 Outgoing links

Redirected requests

18 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

11 JavaScript Global Variables

2 Cookies

Indicators

1099kk.xyz Open in urlscan Pro
93.157.63.185 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

18
Requests

39 %
HTTPS

50 %
IPv6

11
Domains

11
Subdomains

11
IPs

4
Countries

386 kB
Transfer

479 kB
Size

2
Cookies

18 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!