urlscan.io logo urlscan.io
SecurityTrails logo

azuredapperruntime.daravicltd.repl.co Open in urlscan Pro
35.186.245.55  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://azuredapperruntime.daravicltd.repl.co/
Submission: On August 07 via manual from HU — Scanned from CA
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 2 countries across 3 domains to perform 3 HTTP transactions. The main IP is 35.186.245.55, located in Kansas City, United States and belongs to GOOGLE, US. The main domain is azuredapperruntime.daravicltd.repl.co.
TLS certificate: Issued by GTS CA 1P5 on June 20th 2023. Valid for: 3 months.
This is the only time azuredapperruntime.daravicltd.repl.co was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Excel / PDF download (Online)

Domain & IP information

IP Address AS Autonomous System
1 35.186.245.55 15169 (GOOGLE)
1 104.17.25.14 13335 (CLOUDFLAR...)
1 64.185.227.156 18450 (WEBNX)
3 4
Apex Domain
Subdomains		 Transfer
1 ipify.org
api.ipify.org — Cisco Umbrella Rank: 2694
221 B
1 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 257
27 KB
1 repl.co
azuredapperruntime.daravicltd.repl.co
641 KB
3 3
Domain Requested by
1 api.ipify.org cdnjs.cloudflare.com
1 cdnjs.cloudflare.com azuredapperruntime.daravicltd.repl.co
1 azuredapperruntime.daravicltd.repl.co
3 3

This site contains no links.

Subject Issuer Validity Valid
daravicltd.repl.co
GTS CA 1P5		 2023-06-20 -
2023-09-18		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2023-07-03 -
2024-07-02		 a year crt.sh
*.ipify.org
Sectigo RSA Domain Validation Secure Server CA		 2023-02-07 -
2024-02-18		 a year crt.sh

This page contains 1 frames:

Primary Page: https://azuredapperruntime.daravicltd.repl.co/
Frame ID: D92C34EA3C9960909E03E6DDD3799B1F
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Adobe Online - Pdf Reader!

Detected technologies

Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

3
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

668 kB
Transfer

1135 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
azuredapperruntime.daravicltd.repl.co/ 		640 KB
641 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://azuredapperruntime.daravicltd.repl.co/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.186.245.55 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
55.245.186.35.bc.googleusercontent.com
Software
/
Resource Hash
57a5f733336f8434ff6cb35074fbe8d6b6cf89dbdbe97c02cc0d9a491381c06c
Security Headers
Name Value
Strict-Transport-Security max-age=3633615; includeSubDomains

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-origin
*
content-length
655781
content-type
text/html; charset=utf-8
date
Mon, 07 Aug 2023 17:58:26 GMT
expect-ct
max-age=2592000, report-uri="https://sentry.repl.it/api/10/security/?sentry_key=615192fd532445bfbbbe966cd7131791"
replit-cluster
global
strict-transport-security
max-age=3633615; includeSubDomains
truncated
/ 		330 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
173ccb5de106362df171d127b711be29c5b9d6c9bca6970ed1b13961584f8c3a

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Content-Type
image/png
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/ 		85 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/jquery.min.js
Requested by
Host: azuredapperruntime.daravicltd.repl.co
URL: https://azuredapperruntime.daravicltd.repl.co/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://azuredapperruntime.daravicltd.repl.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Mon, 07 Aug 2023 17:58:26 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
943959
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
27233
last-modified
Thu, 22 Jun 2023 11:06:06 GMT
server
cloudflare
cf-cdnjs-via
cfworker/r2
etag
"64942b1e-6a61"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aSEjplEw56hD%2BMpUQNFhCBCZeANz52G5O7pluLblbiv4f5FBinkneNmfA2h0Tn56WL8WTz5rgr8SpFRpLyeriersvMpXV%2BDTkTeI5bqkv223bilaq6AfpE%2FNtvx70SEqgdssrhaA"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
7f3168623f0ea1ea-YYZ
expires
Sat, 27 Jul 2024 17:58:26 GMT
truncated
/ 		80 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
40ce82b3cbf8de9e2dd6ecfa54a4ad3986d89a90b1df1371b99d97f01c8dd72f

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Content-Type
image/png
/
api.ipify.org/ 		21 B
221 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.ipify.org/?format=json
Requested by
Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/jquery.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
64.185.227.156 Los Angeles, United States, ASN18450 (WEBNX, US),
Reverse DNS
64-185-227-156.static.webnx.com
Software
nginx/1.25.1 /
Resource Hash
3421d71049ccd51cd79c8efe9985236f203e9148237a9420f188d661cdff9564

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://azuredapperruntime.daravicltd.repl.co/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Mon, 07 Aug 2023 17:58:27 GMT
Server
nginx/1.25.1
Connection
keep-alive
Content-Length
21
Vary
Origin
Content-Type
application/json

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Excel / PDF download (Online)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery function| submitForm

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=3633615; includeSubDomains