irresponsibletediousshockwave.alexis06dalexis.repl.co
Open in
urlscan Pro
35.201.120.147
Malicious Activity!
Public Scan
Submission Tags: phishtake
Submission: On January 25 via api from JP
Summary
TLS certificate: Issued by R3 on December 9th 2020. Valid for: 3 months.
This is the only time irresponsibletediousshockwave.alexis06dalexis.repl.co was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Facebook (Social Network)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 | 35.201.120.147 35.201.120.147 | 15169 (GOOGLE) (GOOGLE) | |
1 3 | 94.242.61.143 94.242.61.143 | 43317 (FISHNET-AS) (FISHNET-AS) | |
1 | 2606:4700:20:... 2606:4700:20::681a:164 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 3 | 67.202.94.94 67.202.94.94 | 32748 (STEADFAST) (STEADFAST) | |
2 | 2606:4700:10:... 2606:4700:10::6816:4bab | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
9 | 6 |
ASN15169 (GOOGLE, US)
PTR: 147.120.201.35.bc.googleusercontent.com
irresponsibletediousshockwave.alexis06dalexis.repl.co |
ASN43317 (FISHNET-AS, RU)
PTR: server3.server-sz.com
nomejodasmas.xyz |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
amung.us
2 redirects
whos.amung.us widgets.amung.us |
4 KB |
3 |
nomejodasmas.xyz
1 redirects
nomejodasmas.xyz |
500 KB |
3 |
repl.co
irresponsibletediousshockwave.alexis06dalexis.repl.co |
1 KB |
1 |
geojs.io
get.geojs.io |
1 KB |
9 | 4 |
Domain | Requested by | |
---|---|---|
3 | whos.amung.us | 2 redirects |
3 | nomejodasmas.xyz |
1 redirects
irresponsibletediousshockwave.alexis06dalexis.repl.co
|
3 | irresponsibletediousshockwave.alexis06dalexis.repl.co |
irresponsibletediousshockwave.alexis06dalexis.repl.co
|
2 | widgets.amung.us | |
1 | get.geojs.io |
irresponsibletediousshockwave.alexis06dalexis.repl.co
|
9 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
alexis06dalexis.repl.co R3 |
2020-12-09 - 2021-03-09 |
3 months | crt.sh |
nomejodasmas.xyz cPanel, Inc. Certification Authority |
2020-12-04 - 2021-03-04 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2020-07-09 - 2021-07-09 |
a year | crt.sh |
whos.amung.us Sectigo RSA Domain Validation Secure Server CA |
2020-05-21 - 2022-05-21 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://irresponsibletediousshockwave.alexis06dalexis.repl.co/index.html
Frame ID: 17807C1359C0F21D2631F7648D92CEB1
Requests: 11 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 3- https://nomejodasmas.xyz/location HTTP 301
- https://nomejodasmas.xyz/location/
- https://whos.amung.us/widget/8qssz0zznj HTTP 307
- https://widgets.amung.us/classic/00/6.png
- https://whos.amung.us/widget/2z7muo8aev HTTP 307
- https://widgets.amung.us/classic/00/6.png
9 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
index.html
irresponsibletediousshockwave.alexis06dalexis.repl.co/ |
1002 B 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
nomejodasmas.xyz/ |
717 KB 500 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
irresponsibletediousshockwave.alexis06dalexis.repl.co/ |
0 33 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
script.js
irresponsibletediousshockwave.alexis06dalexis.repl.co/ |
0 34 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
/
nomejodasmas.xyz/location/ Redirect Chain
|
1 KB 545 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
geo.json
get.geojs.io/v1/ip/ |
364 B 1 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
whos.amung.us/pingjs/ |
28 B 28 B |
Image
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
6.png
widgets.amung.us/classic/00/ Redirect Chain
|
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
6.png
widgets.amung.us/classic/00/ Redirect Chain
|
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
51 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Facebook (Social Network)23 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| sh boolean| IS_MOBILE number| limit_bot string| object string| type string| OUTPUT object| ___ object| params number| tt undefined| to_object string| a function| checking function| creatingInput function| searchingForms0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
6 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
get.geojs.io
irresponsibletediousshockwave.alexis06dalexis.repl.co
nomejodasmas.xyz
whos.amung.us
widgets.amung.us
2606:4700:10::6816:4bab
2606:4700:20::681a:164
35.201.120.147
67.202.94.94
94.242.61.143
1230532f79456753fb73f559ece9b95c17cfb36325dc313a3eda5ac22dfd9a2b
2e5394fcee90cd231cd51d4bd0604762a25290d413592b95f2458507da0dceec
7281941fed81ed9caf5728727e05da4a94b442c36796e1a5b1d6106f242ed11f
bc3e7db71d51e988b6a4b7089f9b44a5c5464b3f5e425c23e10305b47f6827dc
c8a534024e9cc41a762cf27f44303b696f56cd20dcc9947126bd6192d4c3226e
ce0b3cc4048b5dd27f352533ac47cbdef8f4bb9a5170a7fa6d2a917428946599
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3c9a255fa658db8a0ece25c4529341124d7238fad6026854268b4722fee4576