urlquery Phishing - Fake Human Verification Gate
VerdictPhishing
Severityhigh
WEBSITE ANALYSIS REPORT
https://apis.google.com/additnow/l?applicationId=1&__ls=ogb&__lu=https://l.wl.co/l?u=https%253A%252F%252Fjdcargomentor.com%252FUAcJofRjUz3QCs
public
Phishing detected
Review evidence →3 detections · review the detection signals
Report summary
Submitted and final observations · captured HTTP activity
- Submitted URL
- https://apis.google.com/additnow/l?applicationId=1&__ls=ogb&__lu=https://l.wl.co/l?u=https%253A%252F%252Fjdcargomentor.com%252FUAcJofRjUz3QCs
- Submitted IP / ASN
172.217.20.174 AS15169 · Google LLC
- Final URL
- https://balcon-cityrep.xyz/?272b9fb9
- Final IP / ASN
172.67.191.61 AS13335 · CLOUDFLARENET
Final page
- Page title
- One more step before you proceed...
- Final DOM MIME
- text/html; charset=utf-8
- Final DOM size
- 2.8 KB (2838 bytes)
Detections
Activity
- HTTP requests
- 28
- Observed hosts
- 8
- Script records
- 72
Estimated HTTP data
- Sent
- ~281.0 KB
- Received
- ~3.18 MB
Page capture
Final browser state
balcon-cityrep.xyz
Screenshot unavailableNo screenshot pixels areavailable for this report.
Detection signals
URLQuery findings, Threat Detection Systems, and IDS alerts
URLQuery
2urlquery Phishing - Unknown AiTM Kit (Vela)
VerdictPhishing
Severityhigh
Threat Detection Systems
1DigiCert UltraDNS Sinkholed
VerdictMalicious
Severitymedium
Host infrastructure
Observed hosts are context, not independent maliciousness verdicts
| Host | Rank | Registered | First seen | Last seen | Sent | Received | IP | Fingerprints |
|---|---|---|---|---|---|---|---|---|
| apis.google.com | 1075 | 1997-09-15 | 2013-05-06 | 2026-10-19 | 601 B | 123.4 KB | 142.250.178.46 | HSTS Security HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS. Google Analytics Analytics Google Analytics is a free web analytics service that tracks and reports website traffic. |
| www.gstatic.com | 146047 | 2008-02-11 | 2012-05-29 | 2026-10-18 | 658 B | 0 B | 142.251.150.120 | |
| l.wl.co | 1438664 | 2010-04-26 | 2018-06-13 | 2026-10-13 | 490 B | 412 B |  31.13.72.52 | |
| challenges.cloudflare.com | 11393 | 2009-02-17 | 2021-10-20 | 2026-10-18 | 12.3 KB | 2.40 MB | 104.18.95.41 | Cloudflare CDN Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services. |
| balcon-cityrep.xyz 3 alerts | N/A | 2026-10-20 | 2026-10-21 | 2026-10-21 | 1.6 KB | 4.5 KB | 172.67.191.61 | Express Web frameworks, Web servers Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs. Node.js Programming languages Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser. Cloudflare CDN Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services. |
| href.li 1 alerts | 30988 | N/A | 2012-05-22 | 2026-10-19 | 541 B | 400 B | 192.0.78.26 | HSTS Security HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS. Nginx Web servers, Reverse proxies Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache. |
| jdcargomentor.com 7 alerts | N/A | N/A | N/A | N/A | 5.6 KB | 660.2 KB | 172.67.142.100 | Cloudflare CDN Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services. PHP Programming languages PHP is a general-purpose scripting language used for web development. |
| brunhild.challenges.cloudflare.com | N/A | 2009-02-17 | 2026-06-24 | 2026-10-14 | 1.2 KB | 0 B | Not recorded |