ronku-exe-gonficonfigg.herokuapp.com Open in urlscan Pro
54.73.53.134  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://ronku-exe-gonficonfigg.herokuapp.com/84942-8494284942 Page URL
2. https://ronku-exe-gonficonfigg.herokuapp.com/84942-8494284942?&cmd=login_submit&id=1961104464.2331398&session=487f7b22f68312d2c1bbc93b1aea445b487f7b22f68312d2c1bbc93b1aea445b Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	84942-8494284942 Show response ronku-exe-gonficonfigg.herokuapp.com/	7 KB 7 KB	217ms 54ms	Document text/html	54.73.53.134 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://ronku-exe-gonficonfigg.herokuapp.com/84942-8494284942 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.73.53.134 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-54-73-53-134.eu-west-1.compute.amazonaws.com Software Cowboy / Express Resource Hash 5955910e789eae406dda02f4934d87ce5fcad4d41aa0fe61c3ad63980b0d53a9 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Accept-Language it-IT,it;q=0.9 Response headers Server Cowboy Connection keep-alive X-Powered-By Express Accept-Ranges bytes Cache-Control public, max-age=0 Last-Modified Wed, 23 Feb 2022 08:18:40 GMT Etag W/"1c1c-17f25a93300" Content-Type text/html; charset=UTF-8 Content-Length 7196 Date Thu, 24 Feb 2022 14:57:40 GMT Via 1.1 vegur
GET H2	200	bootstrap.min.css cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/	152 KB 24 KB	80ms 37ms	Stylesheet text/css	2606:4700::6810:5514 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css Requested by Host: ronku-exe-gonficonfigg.herokuapp.com URL: https://ronku-exe-gonficonfigg.herokuapp.com/84942-8494284942 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:5514 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7633b7c0c97d19e682feee8afa2738523fcb2a14544a550572caeecd2eefe66b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://ronku-exe-gonficonfigg.herokuapp.com/ Origin https://ronku-exe-gonficonfigg.herokuapp.com Accept-Language it-IT,it;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Thu, 24 Feb 2022 14:57:40 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT age 928874 x-jsd-version 5.0.2 x-cache HIT, HIT cross-origin-resource-policy cross-origin strict-transport-security max-age=31536000; includeSubDomains; preload alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 x-served-by cache-fra19153-FRA, cache-mxp6963-MXP timing-allow-origin * x-jsd-version-type version server cloudflare etag W/"260c5-fByeBXPlzqi603M74vxjqoxo6o0" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css; charset=utf-8 access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=31536000, s-maxage=31536000, immutable cf-ray 6e298c3279f283a0-MXP
GET H2	200	font-awesome.min.css cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/	30 KB 6 KB	68ms 25ms	Stylesheet text/css	2606:4700::6810:125e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css Requested by Host: ronku-exe-gonficonfigg.herokuapp.com URL: https://ronku-exe-gonficonfigg.herokuapp.com/84942-8494284942 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Accept-Language it-IT,it;q=0.9 Referer https://ronku-exe-gonficonfigg.herokuapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Thu, 24 Feb 2022 14:57:40 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 1282911 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 5631 timing-allow-origin * last-modified Mon, 04 May 2020 16:10:07 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb03e5f-7918" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ApJi2uVzmFJVpIXE0l16xdOnTfxR4dnqrSKN1TjFeUvmb3c0qZy9T3cGO3UY%2BSli42P72f2MimmA1Q%2F4ufNjfIxTrRMIm3E88hBsGNWi70kiFCQhfxd8ZMFg9%2BWpKNIEdtGuKWGPmryQFI9aaX0Lozpl"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 6e298c327a0859e9-MXP expires Tue, 14 Feb 2023 14:57:40 GMT
GET H2	200	core.min.js Show response cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/	4 KB 2 KB	70ms 27ms	Script application/javascript	2606:4700::6810:125e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/core.min.js Requested by Host: ronku-exe-gonficonfigg.herokuapp.com URL: https://ronku-exe-gonficonfigg.herokuapp.com/84942-8494284942 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 80d0635fe9783bec07a43419deb4e9969bf30a78f008386826c9723b7651f43c Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Accept-Language it-IT,it;q=0.9 Referer https://ronku-exe-gonficonfigg.herokuapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Thu, 24 Feb 2022 14:57:40 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 7216548 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 1387 timing-allow-origin * last-modified Mon, 04 May 2020 16:09:17 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb03e2d-f33" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gJqtUM0d6WzFajhP2Vb4Q3YFgvFcVMdRXsB0GirVI7NyH58xRczmIX6DoRA%2BvIIHtFRyKN8eybzv25KrlDFmC5p3KY1FfOb6oPjhHrcAO2Z0%2FsZdg5wqJT%2B%2B4uoco7yefUcv8UHMdd%2Bm35veoUHNhNgr"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 6e298c327a0c59e9-MXP expires Tue, 14 Feb 2023 14:57:40 GMT
GET H2	200	md5.js Show response cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.9-1/	9 KB 2 KB	83ms 40ms	Script application/javascript	2606:4700::6810:125e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.9-1/md5.js Requested by Host: ronku-exe-gonficonfigg.herokuapp.com URL: https://ronku-exe-gonficonfigg.herokuapp.com/84942-8494284942 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 97dc67431dbd3360ea838fecad611a30f540f8389bbd15b89a1e14ba8dbb54aa Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Accept-Language it-IT,it;q=0.9 Referer https://ronku-exe-gonficonfigg.herokuapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Thu, 24 Feb 2022 14:57:40 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 75661 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 1699 timing-allow-origin * last-modified Mon, 04 May 2020 16:09:17 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb03e2d-24ca" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BtsBrpy6Z8JhETxgNhenSsU%2B%2BIFIhQq%2BFg13NjbSmKmKnTKbNfpQOhe%2FauiTGvyRrEVvEeyirV1O9Hnl%2FT6hUnAc%2BPMvav2U%2F62QLxKrIfvtBoecI9y5D7WqPB%2BJFB97RPo45TsNXumHzO2Co32vQ2TC"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 6e298c327a0e59e9-MXP expires Tue, 14 Feb 2023 14:57:40 GMT
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.3.1/	85 KB 30 KB	95ms 28ms	Script text/javascript	2a00:1450:4001:82b::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js Requested by Host: ronku-exe-gonficonfigg.herokuapp.com URL: https://ronku-exe-gonficonfigg.herokuapp.com/84942-8494284942 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language it-IT,it;q=0.9 Referer https://ronku-exe-gonficonfigg.herokuapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Thu, 24 Feb 2022 08:51:02 GMT content-encoding gzip x-content-type-options nosniff age 21998 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 30399 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Fri, 24 Feb 2023 08:51:02 GMT
GET H/1.1	200 OK	Primary Request 84942-8494284942 Show response ronku-exe-gonficonfigg.herokuapp.com/	7 KB 7 KB	56ms 56ms	Document text/html	54.73.53.134 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://ronku-exe-gonficonfigg.herokuapp.com/84942-8494284942?&cmd=login_submit&id=1961104464.2331398&session=487f7b22f68312d2c1bbc93b1aea445b487f7b22f68312d2c1bbc93b1aea445b Requested by Host: ronku-exe-gonficonfigg.herokuapp.com URL: https://ronku-exe-gonficonfigg.herokuapp.com/84942-8494284942 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.73.53.134 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-54-73-53-134.eu-west-1.compute.amazonaws.com Software Cowboy / Express Resource Hash 5955910e789eae406dda02f4934d87ce5fcad4d41aa0fe61c3ad63980b0d53a9 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Accept-Language it-IT,it;q=0.9 Referer https://ronku-exe-gonficonfigg.herokuapp.com/84942-8494284942 Response headers Server Cowboy Connection keep-alive X-Powered-By Express Accept-Ranges bytes Cache-Control public, max-age=0 Last-Modified Wed, 23 Feb 2022 08:18:40 GMT Etag W/"1c1c-17f25a93300" Content-Type text/html; charset=UTF-8 Content-Length 7196 Date Thu, 24 Feb 2022 14:57:40 GMT Via 1.1 vegur
GET H2	200	bootstrap.min.css cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/	152 KB 24 KB	30ms 28ms	Stylesheet text/css	2606:4700::6810:5514 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css Requested by Host: ronku-exe-gonficonfigg.herokuapp.com URL: https://ronku-exe-gonficonfigg.herokuapp.com/84942-8494284942?&cmd=login_submit&id=1961104464.2331398&session=487f7b22f68312d2c1bbc93b1aea445b487f7b22f68312d2c1bbc93b1aea445b Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:5514 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7633b7c0c97d19e682feee8afa2738523fcb2a14544a550572caeecd2eefe66b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://ronku-exe-gonficonfigg.herokuapp.com/ Origin https://ronku-exe-gonficonfigg.herokuapp.com Accept-Language it-IT,it;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Thu, 24 Feb 2022 14:57:40 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT age 928874 x-jsd-version 5.0.2 x-cache HIT, HIT cross-origin-resource-policy cross-origin strict-transport-security max-age=31536000; includeSubDomains; preload alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 x-served-by cache-fra19153-FRA, cache-mxp6963-MXP timing-allow-origin * x-jsd-version-type version server cloudflare etag W/"260c5-fByeBXPlzqi603M74vxjqoxo6o0" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css; charset=utf-8 access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=31536000, s-maxage=31536000, immutable cf-ray 6e298c338cca83a0-MXP
GET H2	200	font-awesome.min.css cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/	30 KB 6 KB	30ms 29ms	Stylesheet text/css	2606:4700::6810:125e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css Requested by Host: ronku-exe-gonficonfigg.herokuapp.com URL: https://ronku-exe-gonficonfigg.herokuapp.com/84942-8494284942?&cmd=login_submit&id=1961104464.2331398&session=487f7b22f68312d2c1bbc93b1aea445b487f7b22f68312d2c1bbc93b1aea445b Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Accept-Language it-IT,it;q=0.9 Referer https://ronku-exe-gonficonfigg.herokuapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Thu, 24 Feb 2022 14:57:40 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 1282911 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 5631 timing-allow-origin * last-modified Mon, 04 May 2020 16:10:07 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb03e5f-7918" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hIe2gYcvqKxpmsb73tegp9RTtfmkMgDsMQZYgufuZrmZCWBMWeiyE9PSwXM4tJalPUnhjgyxpqylFuDY2ObuIIUtkcimworhB7H4AkBAQ%2FnWX4sEoM1ChrL6FYJWXjL%2BDtQDhmnhzqKJh%2F3Zoj4gcvwT"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 6e298c338d8659e9-MXP expires Tue, 14 Feb 2023 14:57:40 GMT
GET H2	200	core.min.js Show response cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/	4 KB 2 KB	27ms 26ms	Script application/javascript	2606:4700::6810:125e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/core.min.js Requested by Host: ronku-exe-gonficonfigg.herokuapp.com URL: https://ronku-exe-gonficonfigg.herokuapp.com/84942-8494284942?&cmd=login_submit&id=1961104464.2331398&session=487f7b22f68312d2c1bbc93b1aea445b487f7b22f68312d2c1bbc93b1aea445b Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 80d0635fe9783bec07a43419deb4e9969bf30a78f008386826c9723b7651f43c Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Accept-Language it-IT,it;q=0.9 Referer https://ronku-exe-gonficonfigg.herokuapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Thu, 24 Feb 2022 14:57:40 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 7216548 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 1387 timing-allow-origin * last-modified Mon, 04 May 2020 16:09:17 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb03e2d-f33" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BqpOPT731LZ2l%2FiO%2B15%2B59%2BQrECEtI%2Fs94uU2Y3IDkfRkDwPvKJCP1XWF1hqfUUtD5%2FxjoJKGlfMQxQhPTBuA3KmjH8oLSqZbXzMa%2BxAWIcrf89OqznOo1ldoiGvqauHl%2FTDq15rLGMQxmazKfEfOaaS"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 6e298c338d8959e9-MXP expires Tue, 14 Feb 2023 14:57:40 GMT
GET H2	200	md5.js Show response cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.9-1/	9 KB 2 KB	27ms 26ms	Script application/javascript	2606:4700::6810:125e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.9-1/md5.js Requested by Host: ronku-exe-gonficonfigg.herokuapp.com URL: https://ronku-exe-gonficonfigg.herokuapp.com/84942-8494284942?&cmd=login_submit&id=1961104464.2331398&session=487f7b22f68312d2c1bbc93b1aea445b487f7b22f68312d2c1bbc93b1aea445b Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 97dc67431dbd3360ea838fecad611a30f540f8389bbd15b89a1e14ba8dbb54aa Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Accept-Language it-IT,it;q=0.9 Referer https://ronku-exe-gonficonfigg.herokuapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Thu, 24 Feb 2022 14:57:40 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 75661 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 1699 timing-allow-origin * last-modified Mon, 04 May 2020 16:09:17 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb03e2d-24ca" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ogLgcmWPFcOZmm7%2BoWa36SIW2OXG8oxRaRuB0e2DWqb4P6Hh8NEFpCZO6wlF3%2Btso6P22DYQAbK7aXCQLUDOaDXOBmbbTdBQeUs%2BxJZde9L2xIc61AJcDD7YRytGZKqLrXFCZB00u3WuU7OC6cChsNFx"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 6e298c338d8a59e9-MXP expires Tue, 14 Feb 2023 14:57:40 GMT
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.3.1/	85 KB 30 KB	28ms 27ms	Script text/javascript	2a00:1450:4001:82b::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js Requested by Host: ronku-exe-gonficonfigg.herokuapp.com URL: https://ronku-exe-gonficonfigg.herokuapp.com/84942-8494284942?&cmd=login_submit&id=1961104464.2331398&session=487f7b22f68312d2c1bbc93b1aea445b487f7b22f68312d2c1bbc93b1aea445b Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language it-IT,it;q=0.9 Referer https://ronku-exe-gonficonfigg.herokuapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Thu, 24 Feb 2022 08:51:02 GMT content-encoding gzip x-content-type-options nosniff age 21998 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 30399 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Fri, 24 Feb 2023 08:51:02 GMT
GET H2	200	bg.jpg kiwiapptiwiz.firebaseapp.com/zcxbnjykjbfzxsa/themes/imgs/	91 KB 88 KB	66ms 16ms	Image image/jpeg	2620:0:890::100 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://kiwiapptiwiz.firebaseapp.com/zcxbnjykjbfzxsa/themes/imgs/bg.jpg Requested by Host: ronku-exe-gonficonfigg.herokuapp.com URL: https://ronku-exe-gonficonfigg.herokuapp.com/84942-8494284942?&cmd=login_submit&id=1961104464.2331398&session=487f7b22f68312d2c1bbc93b1aea445b487f7b22f68312d2c1bbc93b1aea445b Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2620:0:890::100 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 22236f16b68e0a8108921ff2d5118bc93e12127bf436c0fc3d2a29e2f21ad757 Security Headers Name Value Strict-Transport-Security max-age=31556926; includeSubDomains; preload Request headers Accept-Language it-IT,it;q=0.9 Referer https://ronku-exe-gonficonfigg.herokuapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers strict-transport-security max-age=31556926; includeSubDomains; preload content-encoding br last-modified Fri, 06 Aug 2021 16:27:36 GMT x-timer S1645714661.508037,VS0,VE1 etag "2a4f159ec92ba2204e1b79d68aac240c1b2cf9e911162df2a85e0f40843d07e6-br" x-served-by cache-mxp6964-MXP vary x-fh-requested-host, accept-encoding x-cache HIT content-type image/jpeg cache-control max-age=3600 date Thu, 24 Feb 2022 14:57:40 GMT accept-ranges bytes content-length 89425 x-cache-hits 1

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: OneDrive (Online)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone object| CryptoJS function| $ function| jQuery boolean| loading string| href object| regex undefined| md5 function| submit function| fetchMX function| send

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
cdn.jsdelivr.net
cdnjs.cloudflare.com
kiwiapptiwiz.firebaseapp.com
ronku-exe-gonficonfigg.herokuapp.com
2606:4700::6810:125e
2606:4700::6810:5514
2620:0:890::100
2a00:1450:4001:82b::200a
54.73.53.134
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
22236f16b68e0a8108921ff2d5118bc93e12127bf436c0fc3d2a29e2f21ad757
5955910e789eae406dda02f4934d87ce5fcad4d41aa0fe61c3ad63980b0d53a9
7633b7c0c97d19e682feee8afa2738523fcb2a14544a550572caeecd2eefe66b
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
80d0635fe9783bec07a43419deb4e9969bf30a78f008386826c9723b7651f43c
97dc67431dbd3360ea838fecad611a30f540f8389bbd15b89a1e14ba8dbb54aa