uoxcdz.000webhostapp.com Open in urlscan Pro
145.14.145.82  Malicious Activity! Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request applogin.html Show response uoxcdz.000webhostapp.com/adrescomlogin/	19 KB 4 KB	773ms 146ms	Document text/html	145.14.145.82 AWEX
General Check archive.org Show headers Download Go to Full URL https://uoxcdz.000webhostapp.com/adrescomlogin/applogin.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 145.14.145.82 , Netherlands, ASN204915 (AWEX, CY), Reverse DNS Software awex / Resource Hash 559d05a2dd99a5e800504b5cd4a001e59c4767548d52da76057d20fb48d35ccf Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers :method GET :authority uoxcdz.000webhostapp.com :scheme https :path /adrescomlogin/applogin.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 accept-language de-DE,de;q=0.9 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers date Fri, 01 Oct 2021 00:10:19 GMT content-type text/html; charset=UTF-8 server awex x-xss-protection 1; mode=block x-content-type-options nosniff x-request-id a8e72fc40201732a2e12e55306ddba4c content-encoding gzip
GET H/1.1	200 OK	facebook_logos_PNG19749.png komisi-informasi.jogjaprov.go.id/app/modules/subdomain/images/	79 KB 79 KB	2528ms 1155ms	Image image/png	103.255.15.93 IDNIC-JOGJAPROV-A...
General Check archive.org Show headers Download Go to Show image Full URL https://komisi-informasi.jogjaprov.go.id/app/modules/subdomain/images/facebook_logos_PNG19749.png Requested by Host: uoxcdz.000webhostapp.com URL: https://uoxcdz.000webhostapp.com/adrescomlogin/applogin.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 103.255.15.93 Bantul, Indonesia, ASN59151 (IDNIC-JOGJAPROV-AS-ID Bidang Layanan Teknologi dan Informasi Dinas Perhubungan, ID), Reverse DNS Software Apache / Resource Hash 1471cc727502133d1eec36368a868ddd84019312c8586cc9d01b7a8ac23e39f0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://uoxcdz.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Fri, 01 Oct 2021 00:10:22 GMT Last-Modified Wed, 08 Aug 2018 04:43:29 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 80595
GET H2	404	script.js uoxcdz.000webhostapp.com/adrescomlogin/	0 0	144ms 144ms	Script text/html	145.14.145.82 AWEX
General Check archive.org Show headers Download Go to Full URL https://uoxcdz.000webhostapp.com/adrescomlogin/script.js Requested by Host: uoxcdz.000webhostapp.com URL: https://uoxcdz.000webhostapp.com/adrescomlogin/applogin.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 145.14.145.82 , Netherlands, ASN204915 (AWEX, CY), Reverse DNS Software awex / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers :path /adrescomlogin/script.js pragma no-cache accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority uoxcdz.000webhostapp.com referer https://uoxcdz.000webhostapp.com/adrescomlogin/applogin.html :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://uoxcdz.000webhostapp.com/adrescomlogin/applogin.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Fri, 01 Oct 2021 00:10:19 GMT content-encoding gzip x-content-type-options nosniff server awex x-xss-protection 1; mode=block x-request-id a354e29859bdf7574430aa40a35d4f09 content-type text/html; charset=UTF-8
GET H2	200	footer-powered-by-000webhost-white2.png cdn.000webhost.com/000webhost/logo/	2 KB 2 KB	167ms 60ms	Image image/webp	104.19.184.120 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.000webhost.com/000webhost/logo/footer-powered-by-000webhost-white2.png Requested by Host: uoxcdz.000webhostapp.com URL: https://uoxcdz.000webhostapp.com/adrescomlogin/applogin.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.19.184.120 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 86f2673ec74a632865109a76b2232f4f5b3587daa219e07a17ef1d9c76a0fda5 Security Headers Name Value Strict-Transport-Security max-age=2592000 X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://uoxcdz.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Fri, 01 Oct 2021 00:10:19 GMT x-content-type-options nosniff cf-cache-status HIT age 2935 cf-polished origFmt=png, origSize=2046 content-disposition inline; filename="footer-powered-by-000webhost-white2.webp" cf-bgj imgq:100,h2pri x-hostinger-datacenter srv alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 content-length 1696 x-xss-protection 1; mode=block last-modified Wed, 29 Sep 2021 14:01:21 GMT server cloudflare x-frame-options sameorigin etag "615471b1-7fe" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=2592000 content-type image/webp vary Accept cache-control public, max-age=14400 x-hostinger-node nl-srv-cdn1 accept-ranges bytes cf-ray 697177a22d142163-DUS expires Fri, 01 Oct 2021 04:10:19 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

21 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect boolean| originAgentCluster function| getCookie undefined| wordpressAdminBody object| notification object| hostingerLogo undefined| mainContent undefined| googleFont undefined| css undefined| style undefined| sheet undefined| button undefined| link undefined| mainContentHolder undefined| h1Tag undefined| h2Tag undefined| paragraph undefined| list undefined| org_html undefined| new_html undefined| saleImage

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://uoxcdz.000webhostapp.com/adrescomlogin/script.js Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.000webhost.com
komisi-informasi.jogjaprov.go.id
uoxcdz.000webhostapp.com
103.255.15.93
104.19.184.120
145.14.145.82
1471cc727502133d1eec36368a868ddd84019312c8586cc9d01b7a8ac23e39f0
559d05a2dd99a5e800504b5cd4a001e59c4767548d52da76057d20fb48d35ccf
86f2673ec74a632865109a76b2232f4f5b3587daa219e07a17ef1d9c76a0fda5