77c8-161-10-58-203.ngrok-free.app Open in urlscan Pro
2406:da14:540:e901::6e:1 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://77c8-161-10-58-203.ngrok-free.app/
Submission: On November 20 via api (November 20th 2024, 11:50:57 pm UTC) from US — Scanned from JP

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 12 HTTP transactions. The main IP is 2406:da14:540:e901::6e:1, located in Tokyo, Japan and belongs to AMAZON-02, US. The main domain is 77c8-161-10-58-203.ngrok-free.app.
TLS certificate: Issued by E5 on October 5th 2024. Valid for: 3 months.

This is the only time 77c8-161-10-58-203.ngrok-free.app was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banco Galicia (Banking)

Domain & IP information

	IP Address		AS Autonomous System
12	2406:da14:540... 2406:da14:540:e901::6e:1		16509 (AMAZON-02) (AMAZON-02)
12	1

12 2406:da14:540:e901::6e:1 (Tokyo, Japan)

ASN16509 (AMAZON-02, US)

77c8-161-10-58-203.ngrok-free.app	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	ngrok-free.app 77c8-161-10-58-203.ngrok-free.app	127 KB
12	1

	Domain	Requested by
12	77c8-161-10-58-203.ngrok-free.app	77c8-161-10-58-203.ngrok-free.app
12	1

This site contains no links.

Subject Issuer	Validity	Valid
*.ngrok-free.app E5	`2024-10-05` - `2025-01-03`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://77c8-161-10-58-203.ngrok-free.app/
Frame ID: CCC8C0A435F3A7E240A782545B08B0CA
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Empresa

Page Statistics

12
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

127 kB
Transfer

126 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response 77c8-161-10-58-203.ngrok-free.app/	14 KB 14 KB	373ms 351ms	Document text/html	2406:da14:540:e901::6e:1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://77c8-161-10-58-203.ngrok-free.app/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2406:da14:540:e901::6e:1 Tokyo, Japan, ASN16509 (AMAZON-02, US), Reverse DNS Software / Express Resource Hash `3bde6bd1106b052e9f269ba3dc21bf6f434276c04fdfb1544b403b9d8dbed12f` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Response headers accept-ranges bytes cache-control public, max-age=0 content-length 14273 content-type text/html; charset=UTF-8 date Wed, 20 Nov 2024 23:50:53 GMT etag W/"37c1-1934a7a10d5" last-modified Wed, 20 Nov 2024 16:48:53 GMT ngrok-skip-browser-warning true x-powered-by Express
GET H2	200	style94923.css 77c8-161-10-58-203.ngrok-free.app/assets/css/	6 KB 6 KB	341ms 341ms	Stylesheet text/css	2406:da14:540:e901::6e:1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://77c8-161-10-58-203.ngrok-free.app/assets/css/style94923.css Requested by Host: 77c8-161-10-58-203.ngrok-free.app URL: https://77c8-161-10-58-203.ngrok-free.app/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2406:da14:540:e901::6e:1 Tokyo, Japan, ASN16509 (AMAZON-02, US), Reverse DNS Software / Express Resource Hash `5367554be615058422223d4c25900befe627e06112850307b552922b92c9ff4c` Request headers User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Referer https://77c8-161-10-58-203.ngrok-free.app/ Response headers cache-control public, max-age=0 etag W/"186e-1934a310bc1" ngrok-skip-browser-warning true accept-ranges bytes content-length 6254 date Wed, 20 Nov 2024 23:50:53 GMT content-type text/css; charset=UTF-8 last-modified Wed, 20 Nov 2024 15:29:08 GMT x-powered-by Express
GET H2	200	new.png 77c8-161-10-58-203.ngrok-free.app/assets/img/	4 KB 4 KB	354ms 354ms	Image image/png	2406:da14:540:e901::6e:1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://77c8-161-10-58-203.ngrok-free.app/assets/img/new.png Requested by Host: 77c8-161-10-58-203.ngrok-free.app URL: https://77c8-161-10-58-203.ngrok-free.app/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2406:da14:540:e901::6e:1 Tokyo, Japan, ASN16509 (AMAZON-02, US), Reverse DNS Software / Express Resource Hash `c1ac115788f922e9bb68fc1e4710ed077bcae6e5014bc163c434b598e1e17ec9` Request headers User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Referer https://77c8-161-10-58-203.ngrok-free.app/ Response headers cache-control public, max-age=0 etag W/"e05-1916f9e4fae" ngrok-skip-browser-warning true accept-ranges bytes content-length 3589 date Wed, 20 Nov 2024 23:50:53 GMT content-type image/png last-modified Tue, 20 Aug 2024 11:48:51 GMT x-powered-by Express
GET H2	200	ob.png 77c8-161-10-58-203.ngrok-free.app/assets/img/	40 KB 40 KB	352ms 352ms	Image image/png	2406:da14:540:e901::6e:1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://77c8-161-10-58-203.ngrok-free.app/assets/img/ob.png Requested by Host: 77c8-161-10-58-203.ngrok-free.app URL: https://77c8-161-10-58-203.ngrok-free.app/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2406:da14:540:e901::6e:1 Tokyo, Japan, ASN16509 (AMAZON-02, US), Reverse DNS Software / Express Resource Hash `8ba5487a3441be54f0d77878bdde04863c7918e7551eae45e7d4d039d701d313` Request headers User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Referer https://77c8-161-10-58-203.ngrok-free.app/ Response headers cache-control public, max-age=0 etag W/"a122-1916f9ebde1" ngrok-skip-browser-warning true accept-ranges bytes content-length 41250 date Wed, 20 Nov 2024 23:50:53 GMT content-type image/png last-modified Tue, 20 Aug 2024 11:49:19 GMT x-powered-by Express
GET H2	200	baner.jpg 77c8-161-10-58-203.ngrok-free.app/assets/img/	52 KB 52 KB	422ms 421ms	Image image/jpeg	2406:da14:540:e901::6e:1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://77c8-161-10-58-203.ngrok-free.app/assets/img/baner.jpg Requested by Host: 77c8-161-10-58-203.ngrok-free.app URL: https://77c8-161-10-58-203.ngrok-free.app/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2406:da14:540:e901::6e:1 Tokyo, Japan, ASN16509 (AMAZON-02, US), Reverse DNS Software / Express Resource Hash `231d504017220c1691f43fe8d2b5e12a86475a7541748a238353dd451eabbbf6` Request headers User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Referer https://77c8-161-10-58-203.ngrok-free.app/ Response headers cache-control public, max-age=0 etag W/"d14d-1916f9f1d6e" ngrok-skip-browser-warning true accept-ranges bytes content-length 53581 date Wed, 20 Nov 2024 23:50:53 GMT content-type image/jpeg last-modified Tue, 20 Aug 2024 11:49:44 GMT x-powered-by Express
GET H2	200	icons.jpg 77c8-161-10-58-203.ngrok-free.app/assets/img/	3 KB 3 KB	418ms 417ms	Image image/jpeg	2406:da14:540:e901::6e:1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://77c8-161-10-58-203.ngrok-free.app/assets/img/icons.jpg Requested by Host: 77c8-161-10-58-203.ngrok-free.app URL: https://77c8-161-10-58-203.ngrok-free.app/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2406:da14:540:e901::6e:1 Tokyo, Japan, ASN16509 (AMAZON-02, US), Reverse DNS Software / Express Resource Hash `82180f9b3fc5d595f79fe0cd9e42502a0d8070bc8596b8cd0baa8ad426bd0277` Request headers User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Referer https://77c8-161-10-58-203.ngrok-free.app/ Response headers cache-control public, max-age=0 etag W/"aed-1916f9fd33c" ngrok-skip-browser-warning true accept-ranges bytes content-length 2797 date Wed, 20 Nov 2024 23:50:53 GMT content-type image/jpeg last-modified Tue, 20 Aug 2024 11:50:30 GMT x-powered-by Express
GET H2	200	usu.png 77c8-161-10-58-203.ngrok-free.app/assets/img/	366 B 446 B	421ms 420ms	Image image/png	2406:da14:540:e901::6e:1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://77c8-161-10-58-203.ngrok-free.app/assets/img/usu.png Requested by Host: 77c8-161-10-58-203.ngrok-free.app URL: https://77c8-161-10-58-203.ngrok-free.app/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2406:da14:540:e901::6e:1 Tokyo, Japan, ASN16509 (AMAZON-02, US), Reverse DNS Software / Express Resource Hash `c24addf8950016131d4d043a6a10c51daf7501e53f1497976120c7416cbec224` Request headers User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Referer https://77c8-161-10-58-203.ngrok-free.app/ Response headers cache-control public, max-age=0 etag W/"16e-1916fa09f47" ngrok-skip-browser-warning true accept-ranges bytes content-length 366 date Wed, 20 Nov 2024 23:50:53 GMT content-type image/png last-modified Tue, 20 Aug 2024 11:51:23 GMT x-powered-by Express
GET H2	200	candado.png 77c8-161-10-58-203.ngrok-free.app/assets/img/	400 B 479 B	420ms 419ms	Image image/png	2406:da14:540:e901::6e:1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://77c8-161-10-58-203.ngrok-free.app/assets/img/candado.png Requested by Host: 77c8-161-10-58-203.ngrok-free.app URL: https://77c8-161-10-58-203.ngrok-free.app/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2406:da14:540:e901::6e:1 Tokyo, Japan, ASN16509 (AMAZON-02, US), Reverse DNS Software / Express Resource Hash `3598349ada6fb2f8a20c79e8fc90f302d2f1efca049745d4e3bf2c400bf4f416` Request headers User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Referer https://77c8-161-10-58-203.ngrok-free.app/ Response headers cache-control public, max-age=0 etag W/"190-1916fa0e1ee" ngrok-skip-browser-warning true accept-ranges bytes content-length 400 date Wed, 20 Nov 2024 23:50:53 GMT content-type image/png last-modified Tue, 20 Aug 2024 11:51:40 GMT x-powered-by Express
GET H2	200	tecl.png 77c8-161-10-58-203.ngrok-free.app/assets/img/	723 B 803 B	418ms 417ms	Image image/png	2406:da14:540:e901::6e:1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://77c8-161-10-58-203.ngrok-free.app/assets/img/tecl.png Requested by Host: 77c8-161-10-58-203.ngrok-free.app URL: https://77c8-161-10-58-203.ngrok-free.app/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2406:da14:540:e901::6e:1 Tokyo, Japan, ASN16509 (AMAZON-02, US), Reverse DNS Software / Express Resource Hash `f6de8891fa9cd13b00424da192a30a12ac6bb4694c26d2bfda516439c9ba3cff` Request headers User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Referer https://77c8-161-10-58-203.ngrok-free.app/ Response headers cache-control public, max-age=0 etag W/"2d3-1916fa1867b" ngrok-skip-browser-warning true accept-ranges bytes content-length 723 date Wed, 20 Nov 2024 23:50:53 GMT content-type image/png last-modified Tue, 20 Aug 2024 11:52:22 GMT x-powered-by Express
GET H2	200	fle.png 77c8-161-10-58-203.ngrok-free.app/assets/img/	382 B 462 B	418ms 418ms	Image image/png	2406:da14:540:e901::6e:1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://77c8-161-10-58-203.ngrok-free.app/assets/img/fle.png Requested by Host: 77c8-161-10-58-203.ngrok-free.app URL: https://77c8-161-10-58-203.ngrok-free.app/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2406:da14:540:e901::6e:1 Tokyo, Japan, ASN16509 (AMAZON-02, US), Reverse DNS Software / Express Resource Hash `9fac7018c691c89daff7c93fb35dde0f82bb03e722e1bd76dda71fffad9e3fa9` Request headers User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Referer https://77c8-161-10-58-203.ngrok-free.app/ Response headers cache-control public, max-age=0 etag W/"17e-1916fa20da2" ngrok-skip-browser-warning true accept-ranges bytes content-length 382 date Wed, 20 Nov 2024 23:50:53 GMT content-type image/png last-modified Tue, 20 Aug 2024 11:52:56 GMT x-powered-by Express
GET H2	200	segu.png 77c8-161-10-58-203.ngrok-free.app/assets/img/	3 KB 4 KB	417ms 417ms	Image image/png	2406:da14:540:e901::6e:1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://77c8-161-10-58-203.ngrok-free.app/assets/img/segu.png Requested by Host: 77c8-161-10-58-203.ngrok-free.app URL: https://77c8-161-10-58-203.ngrok-free.app/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2406:da14:540:e901::6e:1 Tokyo, Japan, ASN16509 (AMAZON-02, US), Reverse DNS Software / Express Resource Hash `d4df40c25970c7b6409982d063d8a16f2915ed3d0eb5bf0482b17b2bb5c26026` Request headers User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Referer https://77c8-161-10-58-203.ngrok-free.app/ Response headers cache-control public, max-age=0 etag W/"ddb-192f535b8f9" ngrok-skip-browser-warning true accept-ranges bytes content-length 3547 date Wed, 20 Nov 2024 23:50:53 GMT content-type image/png last-modified Mon, 04 Nov 2024 03:26:31 GMT x-powered-by Express
GET H2	200	icon.ico 77c8-161-10-58-203.ngrok-free.app/assets/favicon/	2 KB 2 KB	218ms 218ms	Other image/x-icon	2406:da14:540:e901::6e:1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://77c8-161-10-58-203.ngrok-free.app/assets/favicon/icon.ico Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2406:da14:540:e901::6e:1 Tokyo, Japan, ASN16509 (AMAZON-02, US), Reverse DNS Software / Express Resource Hash `f20a33fd40173f122bec15a105374059fb3ec612d51146485ed84ef0001f2f03` Request headers User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Referer https://77c8-161-10-58-203.ngrok-free.app/ Response headers cache-control public, max-age=0 etag W/"617-1916fc6af60" ngrok-skip-browser-warning true accept-ranges bytes content-length 1559 date Wed, 20 Nov 2024 23:50:54 GMT content-type image/x-icon last-modified Tue, 20 Aug 2024 12:32:57 GMT x-powered-by Express

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banco Galicia (Banking)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| showOverlay function| hideOverlay function| disableSubmitButton function| enableSubmitButton

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://77c8-161-10-58-203.ngrok-free.app/ Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

77c8-161-10-58-203.ngrok-free.app
2406:da14:540:e901::6e:1
231d504017220c1691f43fe8d2b5e12a86475a7541748a238353dd451eabbbf6
3598349ada6fb2f8a20c79e8fc90f302d2f1efca049745d4e3bf2c400bf4f416
3bde6bd1106b052e9f269ba3dc21bf6f434276c04fdfb1544b403b9d8dbed12f
5367554be615058422223d4c25900befe627e06112850307b552922b92c9ff4c
82180f9b3fc5d595f79fe0cd9e42502a0d8070bc8596b8cd0baa8ad426bd0277
8ba5487a3441be54f0d77878bdde04863c7918e7551eae45e7d4d039d701d313
9fac7018c691c89daff7c93fb35dde0f82bb03e722e1bd76dda71fffad9e3fa9
c1ac115788f922e9bb68fc1e4710ed077bcae6e5014bc163c434b598e1e17ec9
c24addf8950016131d4d043a6a10c51daf7501e53f1497976120c7416cbec224
d4df40c25970c7b6409982d063d8a16f2915ed3d0eb5bf0482b17b2bb5c26026
f20a33fd40173f122bec15a105374059fb3ec612d51146485ed84ef0001f2f03
f6de8891fa9cd13b00424da192a30a12ac6bb4694c26d2bfda516439c9ba3cff

77c8-161-10-58-203.ngrok-free.app Open in urlscan Pro 2406:da14:540:e901::6e:1 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

12 Requests

100 %HTTPS

100 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

127 kBTransfer

126 kBSize

0 Cookies

0 Outgoing links

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

77c8-161-10-58-203.ngrok-free.app Open in urlscan Pro
2406:da14:540:e901::6e:1 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

127 kB
Transfer

126 kB
Size

0
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!