www.hylocoka.com
Open in
urlscan Pro
162.213.248.100
Malicious Activity!
Public Scan
Effective URL: https://www.hylocoka.com/FR/LD_ddbcsa/?uclick=7va8fy9r&uclickhash=7va8fy9r-7va8fy9r-1nbl-0-h9y9-cih98n-usk2vr-ad7fce
Submission: On October 05 via api from BE — Scanned from DE
Summary
TLS certificate: Issued by R3 on September 27th 2022. Valid for: 3 months.
This is the only time www.hylocoka.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Tracking (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 52.217.200.137 52.217.200.137 | 16509 (AMAZON-02) (AMAZON-02) | |
1 1 | 104.219.250.36 104.219.250.36 | 22612 (NAMECHEAP...) (NAMECHEAP-NET) | |
12 | 162.213.248.100 162.213.248.100 | 22612 (NAMECHEAP...) (NAMECHEAP-NET) | |
1 | 2a00:1450:400... 2a00:1450:4001:803::200a | 15169 (GOOGLE) (GOOGLE) | |
3 | 2606:4700::68... 2606:4700::6812:e234 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 52.219.75.120 52.219.75.120 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2606:4700:20:... 2606:4700:20::681a:82c | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
19 | 6 |
ASN16509 (AMAZON-02, US)
PTR: s3-1-w.amazonaws.com
ovrmc.s3.amazonaws.com |
ASN22612 (NAMECHEAP-NET, US)
PTR: nc-ph-0762-26.web-hosting.com
dekvalo.com |
ASN22612 (NAMECHEAP-NET, US)
PTR: nc-ph-2118-70.web-hosting.com
www.hylocoka.com |
ASN16509 (AMAZON-02, US)
PTR: s3-r-w.eu-central-1.amazonaws.com
mediamcdn.s3.eu-central-1.amazonaws.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
hylocoka.com
www.hylocoka.com |
297 KB |
3 |
onesignal.com
cdn.onesignal.com — Cisco Umbrella Rank: 3445 onesignal.com — Cisco Umbrella Rank: 868 |
73 KB |
2 |
amazonaws.com
ovrmc.s3.amazonaws.com mediamcdn.s3.eu-central-1.amazonaws.com |
638 B |
1 |
ipapi.co
ipapi.co — Cisco Umbrella Rank: 21429 |
645 B |
1 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 485 |
31 KB |
1 |
dekvalo.com
1 redirects
dekvalo.com |
538 B |
19 | 6 |
Domain | Requested by | |
---|---|---|
12 | www.hylocoka.com |
ovrmc.s3.amazonaws.com
www.hylocoka.com |
2 | cdn.onesignal.com |
www.hylocoka.com
cdn.onesignal.com |
1 | onesignal.com |
cdn.onesignal.com
|
1 | ipapi.co |
www.hylocoka.com
|
1 | mediamcdn.s3.eu-central-1.amazonaws.com |
www.hylocoka.com
|
1 | ajax.googleapis.com |
www.hylocoka.com
|
1 | dekvalo.com | 1 redirects |
1 | ovrmc.s3.amazonaws.com | |
19 | 8 |
This site contains links to these domains. Also see Links.
Domain |
---|
dekvalo.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.s3.amazonaws.com Amazon |
2021-12-15 - 2022-12-03 |
a year | crt.sh |
www.hylocoka.com R3 |
2022-09-27 - 2022-12-26 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2022-09-12 - 2022-12-05 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-06-03 - 2023-06-02 |
a year | crt.sh |
*.s3.eu-central-1.amazonaws.com Amazon |
2021-12-09 - 2022-12-06 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.hylocoka.com/FR/LD_ddbcsa/?uclick=7va8fy9r&uclickhash=7va8fy9r-7va8fy9r-1nbl-0-h9y9-cih98n-usk2vr-ad7fce
Frame ID: F61DC976C9864DEB23B2013C1D96BADA
Requests: 19 HTTP requests in this frame
Screenshot
Page Title
(1) Colis en attentePage URL History Show full URLs
- https://ovrmc.s3.amazonaws.com/paq.html Page URL
-
http://dekvalo.com/click.php?key=tgp7a7sxeulg2sqiylrd&batchid=paq
HTTP 302
https://www.hylocoka.com/FR/LD_ddbcsa/?uclick=7va8fy9r&uclickhash=7va8fy9r-7va8fy9r-1nbl-0-h9y9-cih98... Page URL
Detected technologies
OneSignal (Marketing automation) ExpandDetected patterns
- cdn\.onesignal\.com
jQuery (JavaScript Libraries) Expand
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: Entrez les informations d’expédition
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://ovrmc.s3.amazonaws.com/paq.html Page URL
-
http://dekvalo.com/click.php?key=tgp7a7sxeulg2sqiylrd&batchid=paq
HTTP 302
https://www.hylocoka.com/FR/LD_ddbcsa/?uclick=7va8fy9r&uclickhash=7va8fy9r-7va8fy9r-1nbl-0-h9y9-cih98n-usk2vr-ad7fce Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
19 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
paq.html
ovrmc.s3.amazonaws.com/ |
282 B 638 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
/
www.hylocoka.com/FR/LD_ddbcsa/ Redirect Chain
|
13 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
styles.css
www.hylocoka.com/FR/LD_ddbcsa/(1)%20Parcel%20Pending_files/ |
34 KB 34 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.5.1/ |
87 KB 31 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
OneSignalSDK.js
cdn.onesignal.com/sdks/ |
9 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
os.js
www.hylocoka.com/ |
3 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.min.js
www.hylocoka.com/FR/LD_ddbcsa/(1)%20Parcel%20Pending_files/ |
88 KB 88 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo.png
www.hylocoka.com/FR/LD_ddbcsa/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon-box.svg
www.hylocoka.com/FR/LD_ddbcsa/(1)%20Parcel%20Pending_files/ |
1 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
iphone12.png
www.hylocoka.com/FR/LD_ddbcsa/(1)%20Parcel%20Pending_files/ |
58 KB 58 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
foot-icon01.svg
www.hylocoka.com/FR/LD_ddbcsa/(1)%20Parcel%20Pending_files/ |
8 KB 8 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
foot-icon02.svg
www.hylocoka.com/FR/LD_ddbcsa/(1)%20Parcel%20Pending_files/ |
4 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
foot-icon03.svg
www.hylocoka.com/FR/LD_ddbcsa/(1)%20Parcel%20Pending_files/ |
4 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.min.js.download
www.hylocoka.com/FR/LD_ddbcsa/(1)%20Parcel%20Pending_files/ |
85 KB 85 KB |
Script
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
svg4everybody.min.js.download
www.hylocoka.com/FR/LD_ddbcsa/(1)%20Parcel%20Pending_files/ |
2 KB 2 KB |
Script
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.js
mediamcdn.s3.eu-central-1.amazonaws.com/ |
0 0 |
Script
application/xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
ipapi.co/json/ |
116 B 645 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
OneSignalPageSDKES6.js
cdn.onesignal.com/sdks/ |
283 KB 68 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
web
onesignal.com/api/v1/sync/8693097e-160c-448c-90c9-63f587a91735/ |
3 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Tracking (Transportation)39 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| $ function| jQuery string| a1a4f1_gfhyX string| kx47Rtv_jbqbb string| iubby_4q1zxa string| nqb7qu_xxbqyt string| nqxyT_4fvcyr string| am4vyi_11qxc string| ny4Aub_ancu8 string| iBNIobib_asa74q string| yBatqgf_anbdq85 string| ikoahugb_4Qafn string| nYbqu_fnq48qx1 string| kjbqYUDX4_sxfny44 string| aisfnas_aafrrFG string| sdgouihjbioJNBI_dafjnh object| asffd_zasf25421as string| Ngsd54_sfdfb string| x_zdgf454a_vsdf string| hexkjfnhCDX55_fffgsdvv string| ofnjwD41_gfbwbXX number| n function| svg4everybody boolean| changed_title function| OneSignal number| __oneSignalSdkLoadCount function| promptAndSubscribeUser string| a string| x function| __jp02 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
dekvalo.com/ | Name: uclick Value: 7va8fy9r |
|
dekvalo.com/ | Name: uclickhash Value: 7va8fy9r-7va8fy9r-1nbl-0-h9y9-cih98n-usk2vr-ad7fce |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
cdn.onesignal.com
dekvalo.com
ipapi.co
mediamcdn.s3.eu-central-1.amazonaws.com
onesignal.com
ovrmc.s3.amazonaws.com
www.hylocoka.com
104.219.250.36
162.213.248.100
2606:4700:20::681a:82c
2606:4700::6812:e234
2a00:1450:4001:803::200a
52.217.200.137
52.219.75.120
00b79e96e2324306f897649364907340e7d6ed2199bd7cd928cc2bec37d7c287
1bfbcc359e4042dd695253de4e38fb6e3f1293699c2ade2187b1fd47e65f2c7b
3263bb41c37e93568aa88421e753f4247c809c3dc7b8e21c701c966d16eee5b0
62f7ef6281d5e0db3f14298ca3707ee3a9f61d1ee85ac5fa5dade011eafb32e9
72b5508eefd5a9c85c53de4e82c9e8821dea88160cddd36d31644506c1cbfa13
8411705dc2cef48dc09df31d15033120bf634ca563524dd2dd8d4dafe19bf86f
843114448aaeeda7e8caa0cf76d61e0c63b8bffccd34517483363fdb15cdc80c
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
8c73f559fa6c2c433821208b143c5dc1db07217a55ddc11a1a4859196c2d75dc
9137b33ceb0e8b966c5942abeff0ff11670e36afe176b73480fc24e7f214632d
998bfe3b4410efb87170bd53f25c520115b2ff15a69ef046e09ca8135f027cd3
c40eb6d50cee55cd98e628b786109035413fef21587791221d06070e99e9e25b
cee2b2a97e73e2e67784aad9a83ff1ec80869caeb86aa338a23e5a2319efa305
d12c6745eca14e06d4dea70f4c2bd875769b349770d04300477ab18d0db005d4
d52ff89939db49166f6affa29b4fee48135884563bef1459100f1eb408dca680
e609252c6af2c3e4ba3e893422a4c94a7174bfd890bd10353c93e3cf977c707c
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d