vikoli.000webhostapp.com

Summary

This website contacted 4 IPs in 2 countries across 5 domains to perform 6 HTTP transactions. The main IP is 2a02:4780:dead:6eb3::1, located in Lithuania and belongs to AWEX, US. The main domain is vikoli.000webhostapp.com.

This is the only time vikoli.000webhostapp.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Excel / PDF download (Online)

Domain & IP information

	IP Address	AS Autonomous System
3	2a02:4780:dea... 2a02:4780:dead:6eb3::1	204915 (AWEX) (AWEX)
2 2	172.104.14.217 172.104.14.217	63949 (LINODE-AP...) (LINODE-AP Linode)
1	2606:4700:30:... 2606:4700:30::681b:8b8d	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1 1	192.240.180.202 192.240.180.202	36444 (NEXCESS-NET) (NEXCESS-NET - NEXCESS.NET L.L.C.)
1	96.43.149.26 96.43.149.26	14340 (SALESFORCE) (SALESFORCE - Salesforce.com)
1	2606:4700:10:... 2606:4700:10::6814:432e	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
6	4

3 2a02:4780:dead:6eb3::1 (Lithuania)

ASN204915 (AWEX, US)

vikoli.000webhostapp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.104.14.217 (Absecon, United States) 2 redirects

ASN63949 (LINODE-AP Linode, LLC, US)
PTR: li1749-217.members.linode.com

www.guidingtech.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:30::681b:8b8d (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

cdn.guidingtech.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.240.180.202 (Southfield, United States) 1 redirects

ASN36444 (NEXCESS-NET - NEXCESS.NET L.L.C., US)
PTR: eep5-07.nexcess.net

www.demandware.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 96.43.149.26 (San Francisco, United States)

ASN14340 (SALESFORCE - Salesforce.com, Inc., US)
PTR: www-was-2.salesforce.com

www.salesforce.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::6814:432e (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

cdn.000webhost.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	guidingtech.com 2 redirects www.guidingtech.com cdn.guidingtech.com	12 KB
3	000webhostapp.com vikoli.000webhostapp.com	5 KB
1	000webhost.com cdn.000webhost.com	2 KB
1	salesforce.com www.salesforce.com	1 KB
1	demandware.com 1 redirects www.demandware.com	479 B
6	5

	Domain	Requested by
3	vikoli.000webhostapp.com	vikoli.000webhostapp.com
2	www.guidingtech.com	2 redirects
1	cdn.000webhost.com	vikoli.000webhostapp.com
1	www.salesforce.com	vikoli.000webhostapp.com
1	www.demandware.com	1 redirects
1	cdn.guidingtech.com	vikoli.000webhostapp.com
6	6

This site contains links to these domains. Also see Links.

Domain
www.000webhost.com

Subject Issuer	Validity	Valid
sni38003.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2019-03-09` - `2019-09-15`	6 months	crt.sh
www.salesforce.com DigiCert SHA2 Secure Server CA	`2018-06-23` - `2020-06-22`	2 years	crt.sh
*.000webhost.com COMODO RSA Domain Validation Secure Server CA	`2018-10-19` - `2020-12-17`	2 years	crt.sh

This page contains 1 frames:

Primary Page: http://vikoli.000webhostapp.com/adobe/secure_pdf.html
Frame ID: 4ABDB12362FCCB07AF1C038B0BA357BD
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Windows Server (Operating Systems) Expand

Overall confidence: 50%
Detected patterns

html /<input[^>]+name="__VIEWSTATE/i

Microsoft ASP.NET (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<input[^>]+name="__VIEWSTATE/i

IIS (Web Servers) Expand

Overall confidence: 50%
Detected patterns

html /<input[^>]+name="__VIEWSTATE/i

List.js (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

env /^List$/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
script /jquery.*\.js/i

Page Statistics

6
Requests

50 %
HTTPS

50 %
IPv6

5
Domains

6
Subdomains

4
IPs

2
Countries

20 kB
Transfer

23 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.000webhost.com/?utm_source=000webhostapp&utm_campaign=000_logo&utm_medium=website&utm_content=footer_img

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://www.guidingtech.com/assets/postimages/2014/02/logo-adobe-pdf.jpg HTTP 301
https://www.guidingtech.com/assets/postimages/2014/02/logo-adobe-pdf.jpg HTTP 301
https://cdn.guidingtech.com/media/assets/WordPress-Import/2014/02/logo-adobe-pdf.jpg

Request Chain 1

http://www.demandware.com/uploads/home/icon-lock-circle.svg HTTP 307
https://www.demandware.com/uploads/home/icon-lock-circle.svg HTTP 301
https://www.salesforce.com/products/commerce-cloud/overview/?cc=dwdcmain

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request secure_pdf.html Show response
vikoli.000webhostapp.com/adobe/ 10 KB
5 KB 233ms
116ms Document
text/html 2a02:4780:dead:6eb3::1
AWEX

General

Check archive.org

Show headers Download Go to

Full URL

http://vikoli.000webhostapp.com/adobe/secure_pdf.html

Protocol

HTTP/1.1

Server

2a02:4780:dead:6eb3::1 , Lithuania, ASN204915 (AWEX, US),

Reverse DNS

Software

awex /

Resource Hash

980d3b4d3df6755a3de655566ceaabea7338a7243d6fd907c9addf5b4c930019

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Host: vikoli.000webhostapp.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sun, 10 Mar 2019 00:25:26 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Server: awex
X-Xss-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-Request-ID: 908743986c6abd6530b6d2d4b5accdda
Content-Encoding: gzip

GET
H2

200

logo-adobe-pdf.jpg
cdn.guidingtech.com/media/assets/WordPress-Import/2014/02/
Redirect Chain

http://www.guidingtech.com/assets/postimages/2014/02/logo-adobe-pdf.jpg
https://www.guidingtech.com/assets/postimages/2014/02/logo-adobe-pdf.jpg
https://cdn.guidingtech.com/media/assets/WordPress-Import/2014/02/logo-adobe-pdf.jpg

11 KB
11 KB

75ms
16ms

Image
image/jpeg

2606:4700:30::681b:8b8d
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.guidingtech.com/media/assets/WordPress-Import/2014/02/logo-adobe-pdf.jpg
Requested by: Host: vikoli.000webhostapp.com
URL: http://vikoli.000webhostapp.com/adobe/secure_pdf.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681b:8b8d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 85e1682716795b2048d4f397901cf6612d63a713e7ef0e8a98f3192bef88721f

Request headers

Referer: http://vikoli.000webhostapp.com/adobe/secure_pdf.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sun, 10 Mar 2019 00:25:27 GMT
cf-cache-status: HIT
last-modified: Fri, 13 Oct 2017 13:37:09 GMT
server: cloudflare
etag: "59e0c185-2c38"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
status: 200
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 4b5126caae219732-FRA
content-length: 11320
expires: Tue, 09 Apr 2019 00:25:27 GMT

Redirect headers

pragma: no-cache
date: Sun, 10 Mar 2019 00:25:27 GMT
x-content-type-options: nosniff
server: nginx
location: https://cdn.guidingtech.com/media/assets/WordPress-Import/2014/02/logo-adobe-pdf.jpg
x-frame-options: SAMEORIGIN
x-cache: STALE
content-type: text/html; charset=UTF-8
status: 301
cache-control: no-store, no-cache, must-revalidate
strict-transport-security: max-age=31536000
x-xss-protection: 1; mode=block
expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H/1.1

200
OK

/
www.salesforce.com/products/commerce-cloud/overview/
Redirect Chain

http://www.demandware.com/uploads/home/icon-lock-circle.svg
https://www.demandware.com/uploads/home/icon-lock-circle.svg
https://www.salesforce.com/products/commerce-cloud/overview/?cc=dwdcmain

0
1 KB

602ms
186ms

Image
text/html

96.43.149.26
Salesforce.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.salesforce.com/products/commerce-cloud/overview/?cc=dwdcmain
Requested by: Host: vikoli.000webhostapp.com
URL: http://vikoli.000webhostapp.com/adobe/secure_pdf.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 96.43.149.26 San Francisco, United States, ASN14340 (SALESFORCE - Salesforce.com, Inc., US),
Reverse DNS: www-was-2.salesforce.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://vikoli.000webhostapp.com/adobe/secure_pdf.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Redirect headers

Date: Sun, 10 Mar 2019 00:25:27 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
Location: https://www.salesforce.com/products/commerce-cloud/overview/?cc=dwdcmain
Cache-Control: max-age=0
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Keep-Alive: timeout=5, max=100
Content-Length: 227
Expires: Sun, 10 Mar 2019 00:25:27 GMT

GET
H/1.1 404
Not Found jquery-1.4.4.min.js
vikoli.000webhostapp.com/adobe/Scripts/ 0
0 117ms
116ms Script
text/html 2a02:4780:dead:6eb3::1
AWEX

General

Check archive.org

Show headers Download Go to

Full URL

http://vikoli.000webhostapp.com/adobe/Scripts/jquery-1.4.4.min.js

Requested by

Host: vikoli.000webhostapp.com
URL: http://vikoli.000webhostapp.com/adobe/secure_pdf.html

Protocol

HTTP/1.1

Server

2a02:4780:dead:6eb3::1 , Lithuania, ASN204915 (AWEX, US),

Reverse DNS

Software

awex /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: vikoli.000webhostapp.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: */*
Referer: http://vikoli.000webhostapp.com/adobe/secure_pdf.html
Connection: keep-alive
Cache-Control: no-cache
Referer: http://vikoli.000webhostapp.com/adobe/secure_pdf.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sun, 10 Mar 2019 00:25:26 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: awex
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
X-Xss-Protection: 1; mode=block
X-Request-ID: a92481aedfae153f2737a763a0776454

GET
H/1.1 404
Not Found jquery.h5validate.js
vikoli.000webhostapp.com/adobe/Scripts/ 0
0 234ms
117ms Script
text/html 2a02:4780:dead:6eb3::1
AWEX

General

Check archive.org

Show headers Download Go to

Full URL

http://vikoli.000webhostapp.com/adobe/Scripts/jquery.h5validate.js

Requested by

Host: vikoli.000webhostapp.com
URL: http://vikoli.000webhostapp.com/adobe/secure_pdf.html

Protocol

HTTP/1.1

Server

2a02:4780:dead:6eb3::1 , Lithuania, ASN204915 (AWEX, US),

Reverse DNS

Software

awex /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: vikoli.000webhostapp.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: */*
Referer: http://vikoli.000webhostapp.com/adobe/secure_pdf.html
Connection: keep-alive
Cache-Control: no-cache
Referer: http://vikoli.000webhostapp.com/adobe/secure_pdf.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sun, 10 Mar 2019 00:25:27 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: awex
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
X-Xss-Protection: 1; mode=block
X-Request-ID: e81f83075f64fa5653fe35ff1ef385ac

GET
H2 200 footer-powered-by-000webhost-white2.png
cdn.000webhost.com/000webhost/logo/ 2 KB
2 KB 60ms
9ms Image
image/webp 2606:4700:10::6814:432e
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.000webhost.com/000webhost/logo/footer-powered-by-000webhost-white2.png
Requested by: Host: vikoli.000webhostapp.com
URL: http://vikoli.000webhostapp.com/adobe/secure_pdf.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:432e , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 86f2673ec74a632865109a76b2232f4f5b3587daa219e07a17ef1d9c76a0fda5

Request headers

Referer: http://vikoli.000webhostapp.com/adobe/secure_pdf.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sun, 10 Mar 2019 00:25:26 GMT
cf-cache-status: HIT
cf-polished: origFmt=png, origSize=2046
status: 200
content-disposition: inline; filename="footer-powered-by-000webhost-white2.webp"
cf-bgj: imgq:100
x-hostinger-datacenter: srv
content-length: 1696
last-modified: Fri, 08 Mar 2019 16:21:16 GMT
server: cloudflare
etag: "5c82967c-7fe"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
cache-control: public, max-age=14400
x-hostinger-node: nl-srv-cdn2
accept-ranges: bytes
cf-ray: 4b5126c74d75c300-FRA
expires: Sun, 10 Mar 2019 04:25:26 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Excel / PDF download (Online)

22 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.000webhost.com
cdn.guidingtech.com
vikoli.000webhostapp.com
www.demandware.com
www.guidingtech.com
www.salesforce.com
172.104.14.217
192.240.180.202
2606:4700:10::6814:432e
2606:4700:30::681b:8b8d
2a02:4780:dead:6eb3::1
96.43.149.26
85e1682716795b2048d4f397901cf6612d63a713e7ef0e8a98f3192bef88721f
86f2673ec74a632865109a76b2232f4f5b3587daa219e07a17ef1d9c76a0fda5
980d3b4d3df6755a3de655566ceaabea7338a7243d6fd907c9addf5b4c930019
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

vikoli.000webhostapp.com Open in urlscan Pro 2a02:4780:dead:6eb3::1 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

6 Requests

50 %HTTPS

50 %IPv6

5 Domains

6 Subdomains

4 IPs

2 Countries

20 kBTransfer

23 kBSize

0 Cookies

1 Outgoing links

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

22 JavaScript Global Variables

0 Cookies

Security Headers

Indicators

vikoli.000webhostapp.com Open in urlscan Pro
2a02:4780:dead:6eb3::1 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

50 %
HTTPS

50 %
IPv6

5
Domains

6
Subdomains

4
IPs

2
Countries

20 kB
Transfer

23 kB
Size

0
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!