05b2-155-94-185-26.ngrok.io Open in urlscan Pro
3.134.39.220 Malicious Activity! Private Scan

Go To Rescan
Add Verdict Report

URL:
https://05b2-155-94-185-26.ngrok.io/
Submission: On October 19 via api (October 19th 2021, 4:34:52 pm UTC) from US — Scanned from DE

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 8 HTTP transactions. The main IP is 3.134.39.220, located in Seattle, United States and belongs to AMAZON-02, US. The main domain is 05b2-155-94-185-26.ngrok.io.
TLS certificate: Issued by R3 on September 30th 2021. Valid for: 3 months.

This is the only time 05b2-155-94-185-26.ngrok.io was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address		AS Autonomous System
8	3.134.39.220 3.134.39.220		16509 (AMAZON-02) (AMAZON-02)
8	1

8 3.134.39.220 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-134-39-220.us-east-2.compute.amazonaws.com

05b2-155-94-185-26.ngrok.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	ngrok.io 05b2-155-94-185-26.ngrok.io	452 KB
8	1

	Domain	Requested by
8	05b2-155-94-185-26.ngrok.io	05b2-155-94-185-26.ngrok.io
8	1

This site contains no links.

Subject Issuer	Validity	Valid
*.ngrok.io R3	`2021-09-30` - `2021-12-29`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://05b2-155-94-185-26.ngrok.io/
Frame ID: 249AD8D9D62C0051EA1E22A8BDB576B5
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign in to your MicrosoftSign in to your Microsoft account

Page Statistics

8
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

452 kB
Transfer

451 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response 05b2-155-94-185-26.ngrok.io/	4 KB 4 KB	722ms 483ms	Document text/html	3.134.39.220 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://05b2-155-94-185-26.ngrok.io/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.134.39.220 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-134-39-220.us-east-2.compute.amazonaws.com Software / Resource Hash `17bb5e600ffec8de71547b81c43d991f7f2e0ab6e2d11c41ad8598751a12198e` Request headers :method GET :authority 05b2-155-94-185-26.ngrok.io :scheme https :path / pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 accept-language de-DE,de;q=0.9 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers accept-ranges bytes cache-control public, max-age=0 content-type text/html; charset=UTF-8 date Tue, 19 Oct 2021 16:34:47 GMT etag W/"b82-17c77232b30" last-modified Wed, 13 Oct 2021 00:52:46 GMT content-length 4127
GET H2	200	main.eed55297.chunk.css 05b2-155-94-185-26.ngrok.io/static/css/	100 KB 100 KB	547ms 546ms	Stylesheet text/css	3.134.39.220 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://05b2-155-94-185-26.ngrok.io/static/css/main.eed55297.chunk.css Requested by Host: 05b2-155-94-185-26.ngrok.io URL: https://05b2-155-94-185-26.ngrok.io/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.134.39.220 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-134-39-220.us-east-2.compute.amazonaws.com Software / Resource Hash `cfdc51ce209ac8c41dcd6a1c044a4a2f6d71eb18807cfa07f8dd00ef75f1d3d8` Request headers :path /static/css/main.eed55297.chunk.css pragma no-cache accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept text/css,/;q=0.1 cache-control no-cache sec-fetch-dest style :authority 05b2-155-94-185-26.ngrok.io referer https://05b2-155-94-185-26.ngrok.io/ :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://05b2-155-94-185-26.ngrok.io/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Tue, 19 Oct 2021 16:34:47 GMT cache-control public, max-age=0 last-modified Wed, 13 Oct 2021 00:52:46 GMT accept-ranges bytes etag W/"18e8a-17c77232b30" content-length 102026 content-type text/css; charset=UTF-8
GET H2	200	2.f3d271e8.chunk.js Show response 05b2-155-94-185-26.ngrok.io/static/js/	157 KB 157 KB	654ms 654ms	Script application/javascript	3.134.39.220 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://05b2-155-94-185-26.ngrok.io/static/js/2.f3d271e8.chunk.js Requested by Host: 05b2-155-94-185-26.ngrok.io URL: https://05b2-155-94-185-26.ngrok.io/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.134.39.220 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-134-39-220.us-east-2.compute.amazonaws.com Software / Resource Hash `64887dba882ace5b677b1b3b727a8cfbea9bc6f63dbbcd73e1762361b809e32b` Request headers :path /static/js/2.f3d271e8.chunk.js pragma no-cache accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept / cache-control no-cache sec-fetch-dest script :authority 05b2-155-94-185-26.ngrok.io referer https://05b2-155-94-185-26.ngrok.io/ :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://05b2-155-94-185-26.ngrok.io/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Tue, 19 Oct 2021 16:34:47 GMT cache-control public, max-age=0 last-modified Wed, 13 Oct 2021 00:52:46 GMT accept-ranges bytes etag W/"273f8-17c77232b30" content-length 160760 content-type application/javascript; charset=UTF-8
GET H2	200	main.71fd1b13.chunk.js Show response 05b2-155-94-185-26.ngrok.io/static/js/	73 KB 74 KB	178ms 177ms	Script application/javascript	3.134.39.220 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://05b2-155-94-185-26.ngrok.io/static/js/main.71fd1b13.chunk.js Requested by Host: 05b2-155-94-185-26.ngrok.io URL: https://05b2-155-94-185-26.ngrok.io/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.134.39.220 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-134-39-220.us-east-2.compute.amazonaws.com Software / Resource Hash `9180c633f44f29e9e43bc56d4ab2f4ce8dee2d21e77ddedb4ad2a7e1cefe86ce` Request headers :path /static/js/main.71fd1b13.chunk.js pragma no-cache accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept / cache-control no-cache sec-fetch-dest script :authority 05b2-155-94-185-26.ngrok.io referer https://05b2-155-94-185-26.ngrok.io/ :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://05b2-155-94-185-26.ngrok.io/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Tue, 19 Oct 2021 16:34:47 GMT cache-control public, max-age=0 last-modified Wed, 13 Oct 2021 00:52:46 GMT accept-ranges bytes etag W/"125a4-17c77232b30" content-length 75172 content-type application/javascript; charset=UTF-8
GET H2	200	Converged_v21033__M8MTZS7Nv0I1zR18wdR-g2.css 05b2-155-94-185-26.ngrok.io/assets/	107 KB 107 KB	482ms 482ms	Stylesheet text/css	3.134.39.220 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://05b2-155-94-185-26.ngrok.io/assets/Converged_v21033__M8MTZS7Nv0I1zR18wdR-g2.css Requested by Host: 05b2-155-94-185-26.ngrok.io URL: https://05b2-155-94-185-26.ngrok.io/static/js/2.f3d271e8.chunk.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.134.39.220 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-134-39-220.us-east-2.compute.amazonaws.com Software / Resource Hash `6099ca3afb2bad6883021c5aa6941615a9e92428d9936d09c522c371f803cbdc` Request headers :path /assets/Converged_v21033__M8MTZS7Nv0I1zR18wdR-g2.css pragma no-cache accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept text/css,/;q=0.1 cache-control no-cache sec-fetch-dest style :authority 05b2-155-94-185-26.ngrok.io referer https://05b2-155-94-185-26.ngrok.io/ :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://05b2-155-94-185-26.ngrok.io/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Tue, 19 Oct 2021 16:34:48 GMT cache-control public, max-age=0 last-modified Wed, 13 Oct 2021 00:52:42 GMT accept-ranges bytes etag W/"1ab4a-17c77231b90" content-length 109386 content-type text/css; charset=UTF-8
GET H2	200	microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg 05b2-155-94-185-26.ngrok.io/assets/	5 KB 5 KB	180ms 179ms	Image image/svg+xml	3.134.39.220 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://05b2-155-94-185-26.ngrok.io/assets/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg Requested by Host: 05b2-155-94-185-26.ngrok.io URL: https://05b2-155-94-185-26.ngrok.io/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.134.39.220 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-134-39-220.us-east-2.compute.amazonaws.com Software / Resource Hash `844ce15f37c0a09ad359931f29fa747bcbb9155d27d033ecad3634293630c602` Request headers :path /assets/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg pragma no-cache accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 cache-control* no-cache sec-fetch-dest image :authority 05b2-155-94-185-26.ngrok.io referer https://05b2-155-94-185-26.ngrok.io/ :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://05b2-155-94-185-26.ngrok.io/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Tue, 19 Oct 2021 16:34:48 GMT cache-control public, max-age=0 last-modified Wed, 13 Oct 2021 00:52:42 GMT accept-ranges bytes etag W/"e43-17c77231b90" content-length 4832 content-type image/svg+xml
GET H2	200	documentation_bcb4d1dc4eae64f0b2b2538209d8435a.svg 05b2-155-94-185-26.ngrok.io/assets/	3 KB 3 KB	180ms 179ms	Image image/svg+xml	3.134.39.220 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://05b2-155-94-185-26.ngrok.io/assets/documentation_bcb4d1dc4eae64f0b2b2538209d8435a.svg Requested by Host: 05b2-155-94-185-26.ngrok.io URL: https://05b2-155-94-185-26.ngrok.io/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.134.39.220 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-134-39-220.us-east-2.compute.amazonaws.com Software / Resource Hash `4d86bd9d1824a5049b5afdd6448ddbb4cb47de2b5030d6de5373ec3837534545` Request headers :path /assets/documentation_bcb4d1dc4eae64f0b2b2538209d8435a.svg pragma no-cache accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 cache-control* no-cache sec-fetch-dest image :authority 05b2-155-94-185-26.ngrok.io referer https://05b2-155-94-185-26.ngrok.io/ :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://05b2-155-94-185-26.ngrok.io/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Tue, 19 Oct 2021 16:34:48 GMT cache-control public, max-age=0 last-modified Wed, 13 Oct 2021 00:52:42 GMT accept-ranges bytes etag W/"613-17c77231b90" content-length 2736 content-type image/svg+xml
GET H2	200	2_bc3d32a696895f78c19df6c717586a5d.svg 05b2-155-94-185-26.ngrok.io/assets/	3 KB 3 KB	552ms 552ms	Image image/svg+xml	3.134.39.220 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://05b2-155-94-185-26.ngrok.io/assets/2_bc3d32a696895f78c19df6c717586a5d.svg Requested by Host: 05b2-155-94-185-26.ngrok.io URL: https://05b2-155-94-185-26.ngrok.io/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.134.39.220 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-134-39-220.us-east-2.compute.amazonaws.com Software / Resource Hash `21a4ea0b1787bbdd694e55ba9d1a4d97c13e8efc2aa56361a9c6e06dbb19423b` Request headers :path /assets/2_bc3d32a696895f78c19df6c717586a5d.svg pragma no-cache accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 cache-control* no-cache sec-fetch-dest image :authority 05b2-155-94-185-26.ngrok.io referer https://05b2-155-94-185-26.ngrok.io/ :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://05b2-155-94-185-26.ngrok.io/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Tue, 19 Oct 2021 16:34:48 GMT cache-control public, max-age=0 last-modified Wed, 13 Oct 2021 00:52:42 GMT accept-ranges bytes etag W/"748-17c77231b90" content-length 3045 content-type image/svg+xml

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect boolean| originAgentCluster object| webpackJsonpzzbossman

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

05b2-155-94-185-26.ngrok.io
3.134.39.220
17bb5e600ffec8de71547b81c43d991f7f2e0ab6e2d11c41ad8598751a12198e
21a4ea0b1787bbdd694e55ba9d1a4d97c13e8efc2aa56361a9c6e06dbb19423b
4d86bd9d1824a5049b5afdd6448ddbb4cb47de2b5030d6de5373ec3837534545
6099ca3afb2bad6883021c5aa6941615a9e92428d9936d09c522c371f803cbdc
64887dba882ace5b677b1b3b727a8cfbea9bc6f63dbbcd73e1762361b809e32b
844ce15f37c0a09ad359931f29fa747bcbb9155d27d033ecad3634293630c602
9180c633f44f29e9e43bc56d4ab2f4ce8dee2d21e77ddedb4ad2a7e1cefe86ce
cfdc51ce209ac8c41dcd6a1c044a4a2f6d71eb18807cfa07f8dd00ef75f1d3d8

05b2-155-94-185-26.ngrok.io Open in urlscan Pro 3.134.39.220 Malicious Activity! Private Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

8 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

452 kBTransfer

451 kBSize

0 Cookies

0 Outgoing links

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

0 Cookies

Indicators

05b2-155-94-185-26.ngrok.io Open in urlscan Pro
3.134.39.220 Malicious Activity! Private Scan

Screenshot
Live screenshot

Full Image

8
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

452 kB
Transfer

451 kB
Size

0
Cookies

8 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!