updatedapp.co.in - urlscan.io

Summary

This website contacted 3 IPs in 2 countries across 4 domains to perform 6 HTTP transactions. The main IP is 68.178.247.78, located in United States and belongs to AS-26496-GO-DADDY-COM-LLC, US. The main domain is updatedapp.co.in.

This is the only time updatedapp.co.in was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: State Bank of India (Banking)

Domain & IP information

	IP Address	AS Autonomous System
2 2	2606:4700:20:... 2606:4700:20::6819:e935	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	68.178.247.78 68.178.247.78	26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC)
2	2606:4700::68... 2606:4700::6812:acf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:80e::200a	15169 (GOOGLE) (GOOGLE)
6	3

2 2606:4700:20::6819:e935 (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

is.gd	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 68.178.247.78 (United States)

ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: ip-68-178-247-78.ip.secureserver.net

updatedapp.co.in	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:acf (United States)

ASN13335 (CLOUDFLARENET, US)

maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80e::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	updatedapp.co.in updatedapp.co.in	140 KB
2	bootstrapcdn.com maxcdn.bootstrapcdn.com	32 KB
2	is.gd 2 redirects is.gd	1 KB
1	googleapis.com ajax.googleapis.com	31 KB
6	4

	Domain	Requested by
3	updatedapp.co.in	updatedapp.co.in
2	maxcdn.bootstrapcdn.com	updatedapp.co.in
2	is.gd	2 redirects
1	ajax.googleapis.com	updatedapp.co.in
6	4

This site contains no links.

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-03-01` - `2022-02-28`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2021-11-29` - `2022-02-21`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://updatedapp.co.in/
Frame ID: F99E82A2FD1B56626AAD21714F75922D
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://is.gd/w6JSm3 HTTP 301
https://is.gd/w6JSm3 HTTP 301
http://updatedapp.co.in/ Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

6
Requests

50 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

202 kB
Transfer

384 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://is.gd/w6JSm3 HTTP 301
https://is.gd/w6JSm3 HTTP 301
http://updatedapp.co.in/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
updatedapp.co.in/
Redirect Chain

http://is.gd/w6JSm3
https://is.gd/w6JSm3
http://updatedapp.co.in/

2 KB
1 KB

351ms
329ms

Document
text/html

68.178.247.78
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: http://updatedapp.co.in/
Protocol: HTTP/1.1
Server: 68.178.247.78 , United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS: ip-68-178-247-78.ip.secureserver.net
Software: Apache / PHP/7.4.26
Resource Hash: 6d1865b3f7e7a1768cff6f21bfae6aaccaa858f628ecc3738f6dd42e3c99ec93

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

Date: Sun, 02 Jan 2022 14:58:16 GMT
Server: Apache
X-Powered-By: PHP/7.4.26
Upgrade: h2,h2c
Connection: Upgrade, Keep-Alive
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 752
Keep-Alive: timeout=5
Content-Type: text/html; charset=UTF-8

Redirect headers

date: Sun, 02 Jan 2022 14:58:16 GMT
content-type: text/html; charset=UTF-8
location: http://updatedapp.co.in
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yPZ0DWFAPDvFDakkbRCjB0XjT%2BaUFFPi7aWYKBcMvhD3a0B8vOtf0IC%2FZTKj2ia7FGWZUL5EDvjshzmu%2BGu9S1ZrpWMCHSm%2FfmwbhuLnH0iC7BOJeg8qpb7Y0aetvofluxHb"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 6c74d8320f9883a8-MXP

GET
H2 200 bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/3.4.1/css/ 119 KB
21 KB 75ms
33ms Stylesheet
text/css 2606:4700::6812:acf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/bootstrap/3.4.1/css/bootstrap.min.css

Requested by

Host: updatedapp.co.in
URL: http://updatedapp.co.in/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6d92dfc1700fd38cd130ad818e23bc8aef697f815b2ea5face2b5dfad22f2e11

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://updatedapp.co.in/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Sun, 02 Jan 2022 14:58:16 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 632, 617, 617
age: 2634174
cdn-cachedat: 2021-06-08 21:08:18
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
timing-allow-origin: *
access-control-allow-origin: *
last-modified: Mon, 25 Jan 2021 22:04:00 GMT
server: cloudflare
cdn-requestpullcode: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=utf-8
cdn-cache: HIT
vary: Accept-Encoding
cache-control: public, max-age=31919000
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: beb038914d4d18181f9cc9b53e9cd9fb
cf-ray: 6c74d8358d7959b9-MXP
cdn-requestcountrycode: DE
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.5.1/ 87 KB
31 KB 30ms
8ms Script
text/javascript 2a00:1450:4001:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js

Requested by

Host: updatedapp.co.in
URL: http://updatedapp.co.in/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://updatedapp.co.in/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 19:02:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 330957
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31021
x-xss-protection: 0
last-modified: Fri, 08 May 2020 07:05:03 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 29 Dec 2022 19:02:19 GMT

GET
H2 200 bootstrap.min.js Show response
maxcdn.bootstrapcdn.com/bootstrap/3.4.1/js/ 39 KB
11 KB 80ms
39ms Script
application/javascript 2606:4700::6812:acf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/bootstrap/3.4.1/js/bootstrap.min.js

Requested by

Host: updatedapp.co.in
URL: http://updatedapp.co.in/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9ee2fcff6709e4d0d24b09ca0fc56aade12b4961ed9c43fd13b03248bfb57afe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://updatedapp.co.in/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Sun, 02 Jan 2022 14:58:16 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 601, 617
age: 2638075
cdn-cachedat: 2021-03-11 11:58:00
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
timing-allow-origin: *
access-control-allow-origin: *
last-modified: Mon, 25 Jan 2021 22:04:00 GMT
server: cloudflare
cdn-requestpullcode: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
cdn-cache: HIT
vary: Accept-Encoding
cache-control: public, max-age=31919000
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: be000bfdd4f127260b29957f966b0f38
cf-ray: 6c74d8358d7b59b9-MXP
cdn-requestcountrycode: DE
cdn-requestpullsuccess: True

GET
H/1.1 200
OK header.png
updatedapp.co.in/img/screenshots/ 9 KB
9 KB 163ms
162ms Image
image/png 68.178.247.78
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://updatedapp.co.in/img/screenshots/header.png
Requested by: Host: updatedapp.co.in
URL: http://updatedapp.co.in/
Protocol: HTTP/1.1
Server: 68.178.247.78 , United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS: ip-68-178-247-78.ip.secureserver.net
Software: Apache /
Resource Hash: fb9e97109e6d88d3363214240f4b84aa0d88587311ce8572937beb611c84bfd4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://updatedapp.co.in/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Sun, 02 Jan 2022 14:58:16 GMT
Last-Modified: Wed, 18 Aug 2021 16:05:58 GMT
Server: Apache
ETag: "3181135-238c-5c9d79c1f4580"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5
Content-Length: 9100

GET
H/1.1 200
OK first.png
updatedapp.co.in/img/screenshots/ 129 KB
130 KB 310ms
304ms Image
image/png 68.178.247.78
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://updatedapp.co.in/img/screenshots/first.png
Requested by: Host: updatedapp.co.in
URL: http://updatedapp.co.in/
Protocol: HTTP/1.1
Server: 68.178.247.78 , United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS: ip-68-178-247-78.ip.secureserver.net
Software: Apache /
Resource Hash: 24b99551c4df58d31bc41dfbd31f4dbb4b5b0ea4bd74d711cb5f7620b7935611

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://updatedapp.co.in/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Sun, 02 Jan 2022 14:58:16 GMT
Last-Modified: Wed, 18 Aug 2021 16:05:58 GMT
Server: Apache
ETag: "3181132-2050f-5c9d79c1f4580"
Upgrade: h2,h2c
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Content-Type: image/png
Keep-Alive: timeout=5
Content-Length: 132367

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: State Bank of India (Banking)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
is.gd
maxcdn.bootstrapcdn.com
updatedapp.co.in
2606:4700:20::6819:e935
2606:4700::6812:acf
2a00:1450:4001:80e::200a
68.178.247.78
24b99551c4df58d31bc41dfbd31f4dbb4b5b0ea4bd74d711cb5f7620b7935611
6d1865b3f7e7a1768cff6f21bfae6aaccaa858f628ecc3738f6dd42e3c99ec93
6d92dfc1700fd38cd130ad818e23bc8aef697f815b2ea5face2b5dfad22f2e11
9ee2fcff6709e4d0d24b09ca0fc56aade12b4961ed9c43fd13b03248bfb57afe
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
fb9e97109e6d88d3363214240f4b84aa0d88587311ce8572937beb611c84bfd4

updatedapp.co.in Open in urlscan Pro 68.178.247.78 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

6 Requests

50 %HTTPS

75 %IPv6

4 Domains

4 Subdomains

3 IPs

2 Countries

202 kBTransfer

384 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

0 Cookies

Indicators

updatedapp.co.in Open in urlscan Pro
68.178.247.78 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

50 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

202 kB
Transfer

384 kB
Size

0
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!