6424-2409-4064-4d05-5b9d-d9c5-4b6b-eef-4b65.ap.ngrok.io

Summary

This website contacted 1 IPs in 2 countries across 2 domains to perform 5 HTTP transactions. The main IP is 2406:da18:27f:c801::6e:4, located in Singapore, Singapore and belongs to AMAZON-02, US. The main domain is 6424-2409-4064-4d05-5b9d-d9c5-4b6b-eef-4b65.ap.ngrok.io.
TLS certificate: Issued by R3 on November 3rd 2021. Valid for: 3 months.

This is the only time 6424-2409-4064-4d05-5b9d-d9c5-4b6b-eef-4b65.ap.ngrok.io was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: State Bank of India (Banking)

Domain & IP information

	IP Address	AS Autonomous System
2 2	2606:4700:10:... 2606:4700:10::ac43:8ee	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	2406:da18:27f... 2406:da18:27f:c801::6e:4	16509 (AMAZON-02) (AMAZON-02)
5	1

2 2606:4700:10::ac43:8ee (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

cutt.ly	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2406:da18:27f:c801::6e:4 (Singapore, Singapore)

ASN16509 (AMAZON-02, US)

6424-2409-4064-4d05-5b9d-d9c5-4b6b-eef-4b65.ap.ngrok.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	ngrok.io 6424-2409-4064-4d05-5b9d-d9c5-4b6b-eef-4b65.ap.ngrok.io	198 KB
2	cutt.ly 2 redirects cutt.ly	984 B
5	2

	Domain	Requested by
5	6424-2409-4064-4d05-5b9d-d9c5-4b6b-eef-4b65.ap.ngrok.io	6424-2409-4064-4d05-5b9d-d9c5-4b6b-eef-4b65.ap.ngrok.io
2	cutt.ly	2 redirects
5	2

This site contains no links.

Subject Issuer	Validity	Valid
*.ap.ngrok.io R3	`2021-11-03` - `2022-02-01`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://6424-2409-4064-4d05-5b9d-d9c5-4b6b-eef-4b65.ap.ngrok.io/
Frame ID: 7F456ED22D6505B59A3BD61EFD1F279C
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

login

Page URL History Show full URLs

http://cutt.ly/kUryujZ HTTP 301
https://cutt.ly/kUryujZ HTTP 301
https://6424-2409-4064-4d05-5b9d-d9c5-4b6b-eef-4b65.ap.ngrok.io/ Page URL

Page Statistics

5
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

1
IPs

2
Countries

198 kB
Transfer

199 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://cutt.ly/kUryujZ HTTP 301
https://cutt.ly/kUryujZ HTTP 301
https://6424-2409-4064-4d05-5b9d-d9c5-4b6b-eef-4b65.ap.ngrok.io/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response 6424-2409-4064-4d05-5b9d-d9c5-4b6b-eef-4b65.ap.ngrok.io/ Redirect Chain http://cutt.ly/kUryujZ https://cutt.ly/kUryujZ https://6424-2409-4064-4d05-5b9d-d9c5-4b6b-eef-4b65.ap.ngrok.io/	2 KB 853 B	658ms 307ms	Document text/html	2406:da18:27f:c801::6e:4 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://6424-2409-4064-4d05-5b9d-d9c5-4b6b-eef-4b65.ap.ngrok.io/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2406:da18:27f:c801::6e:4 Singapore, Singapore, ASN16509 (AMAZON-02, US), Reverse DNS Software Apache/2.4.33 (Win64) OpenSSL/1.0.2u mod_fcgid/2.3.9 PHP/7.4.16 / PHP/7.4.16 Resource Hash `742b8b26d1870d909feec5684fa5b4ceb6a89d0270b5f7c15561a3369c7ce298` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers content-encoding gzip content-type text/html; charset=UTF-8 date Tue, 21 Dec 2021 11:55:39 GMT ngrok-agent-ips 2409:4064:248f:bf49:79dc:9ed2:6933:1f1e server Apache/2.4.33 (Win64) OpenSSL/1.0.2u mod_fcgid/2.3.9 PHP/7.4.16 vary Accept-Encoding x-powered-by PHP/7.4.16 content-length 642 Redirect headers date Tue, 21 Dec 2021 11:55:37 GMT content-type text/html; charset=UTF-8 location https://6424-2409-4064-4d05-5b9d-d9c5-4b6b-eef-4b65.ap.ngrok.io expires Thu, 19 Nov 1981 08:52:00 GMT cache-control no-cache, no-store, must-revalidate pragma no-cache vary Accept-Encoding x-xss-protection 1; mode=block x-frame-options SAMEORIGIN x-content-type-options nosniff alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 cf-cache-status DYNAMIC expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" server cloudflare cf-ray 6c10ec23afea5a07-MXP
GET H2	200	second.jpeg 6424-2409-4064-4d05-5b9d-d9c5-4b6b-eef-4b65.ap.ngrok.io/	64 KB 64 KB	716ms 715ms	Image image/jpeg	2406:da18:27f:c801::6e:4 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://6424-2409-4064-4d05-5b9d-d9c5-4b6b-eef-4b65.ap.ngrok.io/second.jpeg Requested by Host: 6424-2409-4064-4d05-5b9d-d9c5-4b6b-eef-4b65.ap.ngrok.io URL: https://6424-2409-4064-4d05-5b9d-d9c5-4b6b-eef-4b65.ap.ngrok.io/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2406:da18:27f:c801::6e:4 Singapore, Singapore, ASN16509 (AMAZON-02, US), Reverse DNS Software Apache/2.4.33 (Win64) OpenSSL/1.0.2u mod_fcgid/2.3.9 PHP/7.4.16 / Resource Hash `4859f37545a3638afb5135183bd7d0dd561034649f8944079e166ab4269b0b00` Request headers Accept-Language de-DE,de;q=0.9 Referer https://6424-2409-4064-4d05-5b9d-d9c5-4b6b-eef-4b65.ap.ngrok.io/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 21 Dec 2021 11:55:40 GMT last-modified Thu, 02 Dec 2021 10:05:01 GMT server Apache/2.4.33 (Win64) OpenSSL/1.0.2u mod_fcgid/2.3.9 PHP/7.4.16 etag "100ff-5d226ec716d40" content-type image/jpeg accept-ranges bytes content-length 65791 ngrok-agent-ips 2409:4064:248f:bf49:79dc:9ed2:6933:1f1e
GET H2	200	fifth.jpeg 6424-2409-4064-4d05-5b9d-d9c5-4b6b-eef-4b65.ap.ngrok.io/	32 KB 32 KB	1041ms 1041ms	Image image/jpeg	2406:da18:27f:c801::6e:4 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://6424-2409-4064-4d05-5b9d-d9c5-4b6b-eef-4b65.ap.ngrok.io/fifth.jpeg Requested by Host: 6424-2409-4064-4d05-5b9d-d9c5-4b6b-eef-4b65.ap.ngrok.io URL: https://6424-2409-4064-4d05-5b9d-d9c5-4b6b-eef-4b65.ap.ngrok.io/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2406:da18:27f:c801::6e:4 Singapore, Singapore, ASN16509 (AMAZON-02, US), Reverse DNS Software Apache/2.4.33 (Win64) OpenSSL/1.0.2u mod_fcgid/2.3.9 PHP/7.4.16 / Resource Hash `704cbc8c7cce4ca10879990312bb9028f728c8426bc50a0a1fb537aa3b75e86b` Request headers Accept-Language de-DE,de;q=0.9 Referer https://6424-2409-4064-4d05-5b9d-d9c5-4b6b-eef-4b65.ap.ngrok.io/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 21 Dec 2021 11:55:40 GMT last-modified Fri, 03 Dec 2021 13:55:14 GMT server Apache/2.4.33 (Win64) OpenSSL/1.0.2u mod_fcgid/2.3.9 PHP/7.4.16 etag "7e3a-5d23e419a7480" content-type image/jpeg accept-ranges bytes content-length 32314 ngrok-agent-ips 2409:4064:248f:bf49:79dc:9ed2:6933:1f1e
GET H2	200	last.jpeg 6424-2409-4064-4d05-5b9d-d9c5-4b6b-eef-4b65.ap.ngrok.io/	71 KB 71 KB	1490ms 1490ms	Image image/jpeg	2406:da18:27f:c801::6e:4 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://6424-2409-4064-4d05-5b9d-d9c5-4b6b-eef-4b65.ap.ngrok.io/last.jpeg Requested by Host: 6424-2409-4064-4d05-5b9d-d9c5-4b6b-eef-4b65.ap.ngrok.io URL: https://6424-2409-4064-4d05-5b9d-d9c5-4b6b-eef-4b65.ap.ngrok.io/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2406:da18:27f:c801::6e:4 Singapore, Singapore, ASN16509 (AMAZON-02, US), Reverse DNS Software Apache/2.4.33 (Win64) OpenSSL/1.0.2u mod_fcgid/2.3.9 PHP/7.4.16 / Resource Hash `e90eed2ef9c236b4f4b605614d0ffb12453ce5166680234c94bbefc6958d3267` Request headers Accept-Language de-DE,de;q=0.9 Referer https://6424-2409-4064-4d05-5b9d-d9c5-4b6b-eef-4b65.ap.ngrok.io/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 21 Dec 2021 11:55:40 GMT last-modified Fri, 03 Dec 2021 14:00:43 GMT server Apache/2.4.33 (Win64) OpenSSL/1.0.2u mod_fcgid/2.3.9 PHP/7.4.16 etag "11a62-5d23e553698c0" content-type image/jpeg accept-ranges bytes content-length 72290 ngrok-agent-ips 2409:4064:248f:bf49:79dc:9ed2:6933:1f1e
GET H2	200	sixth.jpeg 6424-2409-4064-4d05-5b9d-d9c5-4b6b-eef-4b65.ap.ngrok.io/	31 KB 31 KB	1199ms 1199ms	Image image/jpeg	2406:da18:27f:c801::6e:4 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://6424-2409-4064-4d05-5b9d-d9c5-4b6b-eef-4b65.ap.ngrok.io/sixth.jpeg Requested by Host: 6424-2409-4064-4d05-5b9d-d9c5-4b6b-eef-4b65.ap.ngrok.io URL: https://6424-2409-4064-4d05-5b9d-d9c5-4b6b-eef-4b65.ap.ngrok.io/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2406:da18:27f:c801::6e:4 Singapore, Singapore, ASN16509 (AMAZON-02, US), Reverse DNS Software Apache/2.4.33 (Win64) OpenSSL/1.0.2u mod_fcgid/2.3.9 PHP/7.4.16 / Resource Hash `a3af3ed5fcef86976ed75590c6992970557814df6986856bb8d19690920979b3` Request headers Accept-Language de-DE,de;q=0.9 Referer https://6424-2409-4064-4d05-5b9d-d9c5-4b6b-eef-4b65.ap.ngrok.io/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 21 Dec 2021 11:55:40 GMT last-modified Fri, 03 Dec 2021 13:59:49 GMT server Apache/2.4.33 (Win64) OpenSSL/1.0.2u mod_fcgid/2.3.9 PHP/7.4.16 etag "7a17-5d23e51fe9f40" content-type image/jpeg accept-ranges bytes content-length 31255 ngrok-agent-ips 2409:4064:248f:bf49:79dc:9ed2:6933:1f1e

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: State Bank of India (Banking)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			cutt.ly/	1969-12-31 23:59:59	Name: PHPSESSID Value: h03206nhf1nf5jsn3j7llf0cmt

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

6424-2409-4064-4d05-5b9d-d9c5-4b6b-eef-4b65.ap.ngrok.io
cutt.ly
2406:da18:27f:c801::6e:4
2606:4700:10::ac43:8ee
4859f37545a3638afb5135183bd7d0dd561034649f8944079e166ab4269b0b00
704cbc8c7cce4ca10879990312bb9028f728c8426bc50a0a1fb537aa3b75e86b
742b8b26d1870d909feec5684fa5b4ceb6a89d0270b5f7c15561a3369c7ce298
a3af3ed5fcef86976ed75590c6992970557814df6986856bb8d19690920979b3
e90eed2ef9c236b4f4b605614d0ffb12453ce5166680234c94bbefc6958d3267

6424-2409-4064-4d05-5b9d-d9c5-4b6b-eef-4b65.ap.ngrok.io Open in urlscan Pro 2406:da18:27f:c801::6e:4 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

5 Requests

100 %HTTPS

100 %IPv6

2 Domains

2 Subdomains

1 IPs

2 Countries

198 kBTransfer

199 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

1 Cookies

Indicators

6424-2409-4064-4d05-5b9d-d9c5-4b6b-eef-4b65.ap.ngrok.io Open in urlscan Pro
2406:da18:27f:c801::6e:4 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

1
IPs

2
Countries

198 kB
Transfer

199 kB
Size

1
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!