435436435636--vikawom700.repl.co Open in urlscan Pro
35.186.245.55 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://konooc.com/1.php
Effective URL:
https://435436435636--vikawom700.repl.co/
Submission: On September 08 via automatic, source openphish (September 8th 2023, 6:27:31 am UTC) — Scanned from DE

Summary HTTP 11 Redirects Behaviour Indicators

Summary

This website contacted 6 IPs in 2 countries across 5 domains to perform 11 HTTP transactions. The main IP is 35.186.245.55, located in Kansas City, United States and belongs to GOOGLE, US. The main domain is 435436435636--vikawom700.repl.co.
TLS certificate: Issued by GTS CA 1P5 on August 21st 2023. Valid for: 3 months.

This is the only time 435436435636--vikawom700.repl.co was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banco BISA (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1	198.204.249.226 198.204.249.226	33387 (NOCIX) (NOCIX)
7	35.186.245.55 35.186.245.55	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:82b::200a	15169 (GOOGLE) (GOOGLE)
1	64.185.227.156 64.185.227.156	18450 (WEBNX) (WEBNX)
1	34.117.59.81 34.117.59.81	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
11	6

1 198.204.249.226 (United States)

ASN33387 (NOCIX, US)
PTR: server5.hostingspty.com

konooc.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 35.186.245.55 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 55.245.186.35.bc.googleusercontent.com

435436435636--vikawom700.repl.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 64.185.227.156 (United States)

ASN18450 (WEBNX, US)
PTR: 64-185-227-156.static.webnx.com

api.ipify.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.117.59.81 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 81.59.117.34.bc.googleusercontent.com

ipinfo.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	repl.co 435436435636--vikawom700.repl.co	1 MB
1	ipinfo.io ipinfo.io — Cisco Umbrella Rank: 6959	522 B
1	ipify.org api.ipify.org — Cisco Umbrella Rank: 2940	222 B
1	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 406	31 KB
1	konooc.com konooc.com	327 B
11	5

	Domain	Requested by
7	435436435636--vikawom700.repl.co	konooc.com 435436435636--vikawom700.repl.co
1	ipinfo.io	ajax.googleapis.com
1	api.ipify.org	ajax.googleapis.com
1	ajax.googleapis.com	435436435636--vikawom700.repl.co
1	konooc.com
11	5

This site contains no links.

Subject Issuer	Validity	Valid
*.konooc.com R3	`2023-08-28` - `2023-11-26`	3 months	crt.sh
repl.co GTS CA 1P5	`2023-08-21` - `2023-11-19`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-08-14` - `2023-11-06`	3 months	crt.sh
*.ipify.org Sectigo RSA Domain Validation Secure Server CA	`2023-02-07` - `2024-02-18`	a year	crt.sh
ipinfo.io R3	`2023-08-09` - `2023-11-07`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://435436435636--vikawom700.repl.co/
Frame ID: FEBB03C603FE9FB84C43D87E42DB3BDE
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

e-BISA+

Page URL History Show full URLs

https://konooc.com/1.php Page URL
https://435436435636--vikawom700.repl.co/ Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

11
Requests

100 %
HTTPS

20 %
IPv6

5
Domains

5
Subdomains

6
IPs

2
Countries

1385 kB
Transfer

1439 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://konooc.com/1.php Page URL
https://435436435636--vikawom700.repl.co/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 1.php
konooc.com/ 105 B
327 B 510ms
133ms Document
text/html 198.204.249.226
NOCIX

General

Check archive.org

Show headers Download Go to

Full URL: https://konooc.com/1.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 198.204.249.226 , United States, ASN33387 (NOCIX, US),
Reverse DNS: server5.hostingspty.com
Software: /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-encoding: br
content-length: 93
content-type: text/html; charset=UTF-8
date: Fri, 08 Sep 2023 06:27:24 GMT
vary: Accept-Encoding

GET
H2 200 Primary Request / Show response
435436435636--vikawom700.repl.co/ 617 KB
618 KB 581ms
258ms Document
text/html 35.186.245.55
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://435436435636--vikawom700.repl.co/

Requested by

Host: konooc.com
URL: https://konooc.com/1.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.186.245.55 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

55.245.186.35.bc.googleusercontent.com

Software

Resource Hash

bbf34ae249a1899607a38fdf256fcdaef76815864ad480d688468fbfbf65e405

Security Headers

Name	Value
Strict-Transport-Security	max-age=6258101; includeSubDomains

Request headers

Referer: https://konooc.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-length: 631512
content-type: text/html; charset=UTF-8
date: Fri, 08 Sep 2023 06:27:25 GMT
expect-ct: max-age=2592000, report-uri="https://sentry.repl.it/api/10/security/?sentry_key=615192fd532445bfbbbe966cd7131791"
host: 435436435636--vikawom700.repl.co
replit-cluster: global
strict-transport-security: max-age=6258101; includeSubDomains

GET
H2 200 styles.f0d1f1ae4dd1d41f6107.bundle.css
435436435636--vikawom700.repl.co/css/ 138 KB
138 KB 299ms
299ms Stylesheet
text/css 35.186.245.55
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://435436435636--vikawom700.repl.co/css/styles.f0d1f1ae4dd1d41f6107.bundle.css

Requested by

Host: 435436435636--vikawom700.repl.co
URL: https://435436435636--vikawom700.repl.co/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.186.245.55 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

55.245.186.35.bc.googleusercontent.com

Software

Resource Hash

c7b0b9048f280ede68f5fbfc2586313badc1a4d2864b8530969faa6cf7bef1ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=6258101; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://435436435636--vikawom700.repl.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Fri, 08 Sep 2023 06:27:25 GMT
strict-transport-security: max-age=6258101; includeSubDomains
host: 435436435636--vikawom700.repl.co
replit-cluster: global
expect-ct: max-age=2592000, report-uri="https://sentry.repl.it/api/10/security/?sentry_key=615192fd532445bfbbbe966cd7131791"
content-length: 140961
content-type: text/css; charset=UTF-8

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.5.1/ 87 KB
31 KB 30ms
8ms Script
text/javascript 2a00:1450:4001:82b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js

Requested by

Host: 435436435636--vikawom700.repl.co
URL: https://435436435636--vikawom700.repl.co/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://435436435636--vikawom700.repl.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Thu, 07 Sep 2023 20:16:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 36640
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31021
x-xss-protection: 0
last-modified: Fri, 08 May 2020 07:05:03 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 06 Sep 2024 20:16:45 GMT

GET
H/1.1 200
OK / Show response
api.ipify.org/ 22 B
222 B 269ms
85ms XHR
application/json 64.185.227.156
WEBNX

General

Check archive.org

Show headers Download Go to

Full URL: https://api.ipify.org/?format=json
Requested by: Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 64.185.227.156 , United States, ASN18450 (WEBNX, US),
Reverse DNS: 64-185-227-156.static.webnx.com
Software: nginx/1.25.1 /
Resource Hash: 8f9b8ac599577f559a58d40afccbc1d7f5eaf8678c85d4840a31f6309bfa543d

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://435436435636--vikawom700.repl.co/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Fri, 08 Sep 2023 06:27:26 GMT
Server: nginx/1.25.1
Connection: keep-alive
Content-Length: 22
Vary: Origin
Content-Type: application/json

GET
H2 200 / Show response
ipinfo.io/ 254 B
522 B 150ms
124ms XHR
application/json 34.117.59.81
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://ipinfo.io/

Requested by

Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.117.59.81 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

81.59.117.34.bc.googleusercontent.com

Software

Resource Hash

e72f940e94a7d8d0ad7bb7d94e8b8d946d48dcf7c58b123ce4bb63d56cf6cf14

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://435436435636--vikawom700.repl.co/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Fri, 08 Sep 2023 06:27:26 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-encoding: gzip
via: 1.1 google
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: *
x-envoy-upstream-service-time: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1; mode=block

GET
DATA 200
OK truncated
/ 10 KB
10 KB Font
font/woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fa10e688206d34d4b293b1524cc091415c551daae4b73e3cc68d7398408edf62

Request headers

Referer
Origin: https://435436435636--vikawom700.repl.co
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

Content-Type: font/woff2

GET
H2 200 streamline.8871b90e0d45ac05a272.woff
435436435636--vikawom700.repl.co/css/ 451 KB
451 KB 132ms
131ms Font
font/woff 35.186.245.55
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://435436435636--vikawom700.repl.co/css/streamline.8871b90e0d45ac05a272.woff?19c5cw

Requested by

Host: 435436435636--vikawom700.repl.co
URL: https://435436435636--vikawom700.repl.co/css/styles.f0d1f1ae4dd1d41f6107.bundle.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.186.245.55 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

55.245.186.35.bc.googleusercontent.com

Software

Resource Hash

552b2f7c9461a7f6f109dbeeac8d70b3dfd949c88430f49082cce113fde6b94d

Security Headers

Name	Value
Strict-Transport-Security	max-age=6258100; includeSubDomains

Request headers

Referer: https://435436435636--vikawom700.repl.co/css/styles.f0d1f1ae4dd1d41f6107.bundle.css
Origin: https://435436435636--vikawom700.repl.co
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Fri, 08 Sep 2023 06:27:26 GMT
strict-transport-security: max-age=6258100; includeSubDomains
host: 435436435636--vikawom700.repl.co
replit-cluster: global
expect-ct: max-age=2592000, report-uri="https://sentry.repl.it/api/10/security/?sentry_key=615192fd532445bfbbbe966cd7131791"
content-length: 461348
content-type: font/woff

GET
H2 404 keyboardLowerCaseLowContrast.png
435436435636--vikawom700.repl.co/bix_files/ 575 B
575 B 186ms
186ms Image
text/html 35.186.245.55
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://435436435636--vikawom700.repl.co/bix_files/keyboardLowerCaseLowContrast.png

Requested by

Host: 435436435636--vikawom700.repl.co
URL: https://435436435636--vikawom700.repl.co/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.186.245.55 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

55.245.186.35.bc.googleusercontent.com

Software

Resource Hash

c8131485472e18a84f5d3c9aaf7038103a7ae1d64bd47e3f1d1165c659dc744c

Security Headers

Name	Value
Strict-Transport-Security	max-age=6258100; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://435436435636--vikawom700.repl.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Fri, 08 Sep 2023 06:27:26 GMT
strict-transport-security: max-age=6258100; includeSubDomains
host: 435436435636--vikawom700.repl.co
replit-cluster: global
expect-ct: max-age=2592000, report-uri="https://sentry.repl.it/api/10/security/?sentry_key=615192fd532445bfbbbe966cd7131791"
content-length: 575
content-type: text/html; charset=UTF-8

GET
H2 200 logo_positivo_login.fdfc7cdb2cdff8e6b41a.png
435436435636--vikawom700.repl.co/img/ 12 KB
12 KB 200ms
200ms Image
image/png 35.186.245.55
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://435436435636--vikawom700.repl.co/img/logo_positivo_login.fdfc7cdb2cdff8e6b41a.png

Requested by

Host: 435436435636--vikawom700.repl.co
URL: https://435436435636--vikawom700.repl.co/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.186.245.55 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

55.245.186.35.bc.googleusercontent.com

Software

Resource Hash

36d48d1067480fa1685bc04929815eaf079fc40920be4790b5a5dfc59f803b82

Security Headers

Name	Value
Strict-Transport-Security	max-age=6258100; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://435436435636--vikawom700.repl.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Fri, 08 Sep 2023 06:27:26 GMT
strict-transport-security: max-age=6258100; includeSubDomains
host: 435436435636--vikawom700.repl.co
replit-cluster: global
expect-ct: max-age=2592000, report-uri="https://sentry.repl.it/api/10/security/?sentry_key=615192fd532445bfbbbe966cd7131791"
content-length: 12247
content-type: image/png

GET
H2 200 cbimage.png
435436435636--vikawom700.repl.co/img/ 123 KB
123 KB 198ms
198ms Image
image/png 35.186.245.55
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://435436435636--vikawom700.repl.co/img/cbimage.png

Requested by

Host: 435436435636--vikawom700.repl.co
URL: https://435436435636--vikawom700.repl.co/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.186.245.55 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

55.245.186.35.bc.googleusercontent.com

Software

Resource Hash

b0f9228b2e5e619030653462e782fd7d0c66a4dbbc9097269e88671d591a163a

Security Headers

Name	Value
Strict-Transport-Security	max-age=6258100; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://435436435636--vikawom700.repl.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Fri, 08 Sep 2023 06:27:26 GMT
strict-transport-security: max-age=6258100; includeSubDomains
host: 435436435636--vikawom700.repl.co
replit-cluster: global
expect-ct: max-age=2592000, report-uri="https://sentry.repl.it/api/10/security/?sentry_key=615192fd532445bfbbbe966cd7131791"
content-length: 125813
content-type: image/png

GET
H2 200 sax.js Show response
435436435636--vikawom700.repl.co/js/ 1 KB
1 KB 191ms
191ms Script
application/javascript 35.186.245.55
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://435436435636--vikawom700.repl.co/js/sax.js

Requested by

Host: 435436435636--vikawom700.repl.co
URL: https://435436435636--vikawom700.repl.co/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.186.245.55 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

55.245.186.35.bc.googleusercontent.com

Software

Resource Hash

3c580026c91cb99b8b90c4010f48f25f0c34ef1d975ea9c833f4c40cb8885f87

Security Headers

Name	Value
Strict-Transport-Security	max-age=6258100; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://435436435636--vikawom700.repl.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Fri, 08 Sep 2023 06:27:26 GMT
strict-transport-security: max-age=6258100; includeSubDomains
host: 435436435636--vikawom700.repl.co
replit-cluster: global
expect-ct: max-age=2592000, report-uri="https://sentry.repl.it/api/10/security/?sentry_key=615192fd532445bfbbbe966cd7131791"
content-length: 1076
content-type: application/javascript

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banco BISA (Banking)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://435436435636--vikawom700.repl.co/bix_files/keyboardLowerCaseLowContrast.png Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

435436435636--vikawom700.repl.co
ajax.googleapis.com
api.ipify.org
ipinfo.io
konooc.com
198.204.249.226
2a00:1450:4001:82b::200a
34.117.59.81
35.186.245.55
64.185.227.156
36d48d1067480fa1685bc04929815eaf079fc40920be4790b5a5dfc59f803b82
3c580026c91cb99b8b90c4010f48f25f0c34ef1d975ea9c833f4c40cb8885f87
552b2f7c9461a7f6f109dbeeac8d70b3dfd949c88430f49082cce113fde6b94d
8f9b8ac599577f559a58d40afccbc1d7f5eaf8678c85d4840a31f6309bfa543d
b0f9228b2e5e619030653462e782fd7d0c66a4dbbc9097269e88671d591a163a
bbf34ae249a1899607a38fdf256fcdaef76815864ad480d688468fbfbf65e405
c7b0b9048f280ede68f5fbfc2586313badc1a4d2864b8530969faa6cf7bef1ea
c8131485472e18a84f5d3c9aaf7038103a7ae1d64bd47e3f1d1165c659dc744c
e72f940e94a7d8d0ad7bb7d94e8b8d946d48dcf7c58b123ce4bb63d56cf6cf14
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
fa10e688206d34d4b293b1524cc091415c551daae4b73e3cc68d7398408edf62

435436435636--vikawom700.repl.co Open in urlscan Pro 35.186.245.55 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

11 Requests

100 %HTTPS

20 %IPv6

5 Domains

5 Subdomains

6 IPs

2 Countries

1385 kBTransfer

1439 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

10 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

435436435636--vikawom700.repl.co Open in urlscan Pro
35.186.245.55 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

100 %
HTTPS

20 %
IPv6

5
Domains

5
Subdomains

6
IPs

2
Countries

1385 kB
Transfer

1439 kB
Size

0
Cookies

11 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!