3ef2-2409-4064-2d92-517c-83-b5a4-5d31-8705.in.ngrok.io Open in urlscan Pro
2406:da1a:e91:9300::6e:3  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response 3ef2-2409-4064-2d92-517c-83-b5a4-5d31-8705.in.ngrok.io/	849 B 1 KB	565ms 550ms	Document text/html	2406:da1a:e91:9300::6e:3 AMAZON-02
General Check archive.org Show headers Download Go to Full URL http://3ef2-2409-4064-2d92-517c-83-b5a4-5d31-8705.in.ngrok.io/ Protocol HTTP/1.1 Server 2406:da1a:e91:9300::6e:3 Mumbai, India, ASN16509 (AMAZON-02, US), Reverse DNS Software Apache/2.4.51 (Win64) OpenSSL/1.1.1l PHP/7.3.31 / PHP/7.3.31 Resource Hash 918eddbc04c9fdd920b6efa0db782cdfdf0782947a6cab8098d2e4e3469e01d9 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers Content-Length 849 Content-Type text/html; charset=UTF-8 Date Sun, 05 Dec 2021 14:39:12 GMT Server Apache/2.4.51 (Win64) OpenSSL/1.1.1l PHP/7.3.31 X-Powered-By PHP/7.3.31
GET H/1.1	200 OK	css fonts.googleapis.com/	2 KB 1 KB	21ms 15ms	Stylesheet text/css	2a00:1450:4001:802::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL http://fonts.googleapis.com/css?family=Ubuntu+Condensed Requested by Host: 3ef2-2409-4064-2d92-517c-83-b5a4-5d31-8705.in.ngrok.io URL: http://3ef2-2409-4064-2d92-517c-83-b5a4-5d31-8705.in.ngrok.io/ Protocol HTTP/1.1 Server 2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 3916d9ebc0339d16ee5b88583353a25f449e8833dee112543729919ed566202f Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer http://3ef2-2409-4064-2d92-517c-83-b5a4-5d31-8705.in.ngrok.io/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Date Sun, 05 Dec 2021 14:39:13 GMT Content-Encoding gzip X-Content-Type-Options nosniff Transfer-Encoding chunked Cross-Origin-Resource-Policy cross-origin X-XSS-Protection 0 Last-Modified Sun, 05 Dec 2021 14:39:13 GMT Server ESF Cross-Origin-Opener-Policy same-origin-allow-popups X-Frame-Options SAMEORIGIN Content-Type text/css; charset=utf-8 Access-Control-Allow-Origin * Cache-Control private, max-age=86400, stale-while-revalidate=604800 Timing-Allow-Origin * Link <http://fonts.gstatic.com>; rel=preconnect; crossorigin Expires Sun, 05 Dec 2021 14:39:13 GMT
GET H/1.1	200 OK	look.jpg 3ef2-2409-4064-2d92-517c-83-b5a4-5d31-8705.in.ngrok.io/	313 KB 314 KB	788ms 788ms	Image image/jpeg	2406:da1a:e91:9300::6e:3 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL http://3ef2-2409-4064-2d92-517c-83-b5a4-5d31-8705.in.ngrok.io/look.jpg Requested by Host: 3ef2-2409-4064-2d92-517c-83-b5a4-5d31-8705.in.ngrok.io URL: http://3ef2-2409-4064-2d92-517c-83-b5a4-5d31-8705.in.ngrok.io/ Protocol HTTP/1.1 Server 2406:da1a:e91:9300::6e:3 Mumbai, India, ASN16509 (AMAZON-02, US), Reverse DNS Software Apache/2.4.51 (Win64) OpenSSL/1.1.1l PHP/7.3.31 / Resource Hash f26cd63251bcad4975ccd13226f76eb7aa48a041619606fb641b26de9c0c1f02 Request headers Accept-Language de-DE,de;q=0.9 Referer http://3ef2-2409-4064-2d92-517c-83-b5a4-5d31-8705.in.ngrok.io/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Date Sun, 05 Dec 2021 14:39:13 GMT Last-Modified Fri, 16 Apr 2021 16:12:21 GMT Server Apache/2.4.51 (Win64) OpenSSL/1.1.1l PHP/7.3.31 Accept-Ranges bytes Etag "4e5a5-5c0193ea0e340" Content-Length 320933 Content-Type image/jpeg

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: State Bank of India (Banking)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler function| hideURLbar

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

3ef2-2409-4064-2d92-517c-83-b5a4-5d31-8705.in.ngrok.io
fonts.googleapis.com
2406:da1a:e91:9300::6e:3
2a00:1450:4001:802::200a
3916d9ebc0339d16ee5b88583353a25f449e8833dee112543729919ed566202f
918eddbc04c9fdd920b6efa0db782cdfdf0782947a6cab8098d2e4e3469e01d9
f26cd63251bcad4975ccd13226f76eb7aa48a041619606fb641b26de9c0c1f02