onlinebankingalicia.galiciarverify.repl.co Open in urlscan Pro
34.149.204.188 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://onlinebankingalicia.galiciarverify.repl.co/
Effective URL:
http://onlinebankingalicia.galiciarverify.repl.co/
Submission Tags: replit-anti-abuse
Submission: On August 30 via api (August 30th 2022, 6:28:28 pm UTC) from US — Scanned from DE

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 9 HTTP transactions. The main IP is 34.149.204.188, located in Kansas City, United States and belongs to GOOGLE, US. The main domain is onlinebankingalicia.galiciarverify.repl.co.

This is the only time onlinebankingalicia.galiciarverify.repl.co was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banco Galicia (Banking)

Domain & IP information

	IP Address	AS Autonomous System
7	34.149.204.188 34.149.204.188	15169 (GOOGLE) (GOOGLE)
1	2001:4de0:ac1... 2001:4de0:ac18::1:a:3a	20446 (STACKPATH...) (STACKPATH-CDN)
1	2a00:1450:400... 2a00:1450:400e:80c::200a	15169 (GOOGLE) (GOOGLE)
9	3

7 34.149.204.188 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 188.204.149.34.bc.googleusercontent.com

onlinebankingalicia.galiciarverify.repl.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac18::1:a:3a (Netherlands)

ASN20446 (STACKPATH-CDN, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400e:80c::200a (Ireland)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	repl.co onlinebankingalicia.galiciarverify.repl.co	807 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 54	1 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 615	30 KB
9	3

	Domain	Requested by
7	onlinebankingalicia.galiciarverify.repl.co	onlinebankingalicia.galiciarverify.repl.co
1	fonts.googleapis.com	onlinebankingalicia.galiciarverify.repl.co
1	code.jquery.com	onlinebankingalicia.galiciarverify.repl.co
9	3

This site contains no links.

Subject Issuer	Validity	Valid
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2022-08-03` - `2023-07-14`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2022-08-08` - `2022-10-31`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://onlinebankingalicia.galiciarverify.repl.co/
Frame ID: 026BF86427C8BE975E2B3E7BF1CF0F54
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Home

Detected technologies

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

9
Requests

22 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

838 kB
Transfer

895 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
onlinebankingalicia.galiciarverify.repl.co/ 1 KB
1 KB 647ms
290ms Document
text/html 34.149.204.188
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: http://onlinebankingalicia.galiciarverify.repl.co/
Protocol: HTTP/1.1
Server: 34.149.204.188 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 188.204.149.34.bc.googleusercontent.com
Software: /
Resource Hash: 9e87fdc7b8386cb786e3cf277239b44f2cd6538af6beda97e282c4851420188d

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Content-Length: 1291
Content-Type: text/html; charset=UTF-8
Date: Tue, 30 Aug 2022 18:28:15 GMT
Host: onlinebankingalicia.galiciarverify.repl.co
Replit-Cluster: global
Via: 1.1 google

GET
H/1.1 200
OK main.css
onlinebankingalicia.galiciarverify.repl.co/st/ 6 KB
6 KB 320ms
320ms Stylesheet
text/css 34.149.204.188
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: http://onlinebankingalicia.galiciarverify.repl.co/st/main.css
Requested by: Host: onlinebankingalicia.galiciarverify.repl.co
URL: http://onlinebankingalicia.galiciarverify.repl.co/
Protocol: HTTP/1.1
Server: 34.149.204.188 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 188.204.149.34.bc.googleusercontent.com
Software: /
Resource Hash: bac754b72350122de47365bff13baa9359e1715715e71d1afcb1b6442341c8f8

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://onlinebankingalicia.galiciarverify.repl.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Date: Tue, 30 Aug 2022 18:28:15 GMT
Via: 1.1 google
Host: onlinebankingalicia.galiciarverify.repl.co
Replit-Cluster: global
Content-Length: 6429
Content-Type: text/css; charset=UTF-8

GET
H2 200 jquery-3.6.0.min.js Show response
code.jquery.com/ 87 KB
30 KB 84ms
40ms Script
application/javascript 2001:4de0:ac18::1:a:3a
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.6.0.min.js
Requested by: Host: onlinebankingalicia.galiciarverify.repl.co
URL: http://onlinebankingalicia.galiciarverify.repl.co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:3a , Netherlands, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software: nginx /
Resource Hash: ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Request headers

Referer: http://onlinebankingalicia.galiciarverify.repl.co/
Origin: http://onlinebankingalicia.galiciarverify.repl.co
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Tue, 30 Aug 2022 18:28:15 GMT
content-encoding: gzip
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
server: nginx
etag: W/"28feccc0-15d9d"
vary: Accept-Encoding
x-hw: 1661884095.dop203.am5.t,1661884095.cds122.am5.hn,1661884095.cds210.am5.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 30875

GET
H2 200 css2
fonts.googleapis.com/ 2 KB
1 KB 54ms
21ms Stylesheet
text/css 2a00:1450:400e:80c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Inter&display=swap

Requested by

Host: onlinebankingalicia.galiciarverify.repl.co
URL: http://onlinebankingalicia.galiciarverify.repl.co/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400e:80c::200a , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

0370a4223069208a01c9a4c3f1ba1da1954f4bbad2ab3ec4467d29f7ff77a7b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://onlinebankingalicia.galiciarverify.repl.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 30 Aug 2022 18:20:51 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Tue, 30 Aug 2022 18:28:15 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 30 Aug 2022 18:28:15 GMT

GET
H/1.1 200
OK lg-gal.svg
onlinebankingalicia.galiciarverify.repl.co/im/ 5 KB
5 KB 272ms
271ms Image
image/svg+xml 34.149.204.188
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://onlinebankingalicia.galiciarverify.repl.co/im/lg-gal.svg
Requested by: Host: onlinebankingalicia.galiciarverify.repl.co
URL: http://onlinebankingalicia.galiciarverify.repl.co/
Protocol: HTTP/1.1
Server: 34.149.204.188 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 188.204.149.34.bc.googleusercontent.com
Software: /
Resource Hash: fad6369e7b4e8af718c87cf1d5e13e9f3c3e831725a388ad52a971ee70c1abe8

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://onlinebankingalicia.galiciarverify.repl.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Date: Tue, 30 Aug 2022 18:28:16 GMT
Via: 1.1 google
Host: onlinebankingalicia.galiciarverify.repl.co
Replit-Cluster: global
Content-Length: 5259
Content-Type: image/svg+xml

GET
H/1.1 200
OK on-bn.svg
onlinebankingalicia.galiciarverify.repl.co/im/ 5 KB
6 KB 292ms
279ms Image
image/svg+xml 34.149.204.188
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://onlinebankingalicia.galiciarverify.repl.co/im/on-bn.svg
Requested by: Host: onlinebankingalicia.galiciarverify.repl.co
URL: http://onlinebankingalicia.galiciarverify.repl.co/
Protocol: HTTP/1.1
Server: 34.149.204.188 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 188.204.149.34.bc.googleusercontent.com
Software: /
Resource Hash: 9983d3ae405b251b4ab6077cabd1e5d6a5f9e84eff85756da7c502763d47f017

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://onlinebankingalicia.galiciarverify.repl.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Date: Tue, 30 Aug 2022 18:28:16 GMT
Via: 1.1 google
Host: onlinebankingalicia.galiciarverify.repl.co
Replit-Cluster: global
Content-Length: 5489
Content-Type: image/svg+xml

GET
H/1.1 200
OK scrp.js Show response
onlinebankingalicia.galiciarverify.repl.co/js/ 1003 B
1 KB 281ms
267ms Script
application/javascript 34.149.204.188
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: http://onlinebankingalicia.galiciarverify.repl.co/js/scrp.js
Requested by: Host: onlinebankingalicia.galiciarverify.repl.co
URL: http://onlinebankingalicia.galiciarverify.repl.co/
Protocol: HTTP/1.1
Server: 34.149.204.188 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 188.204.149.34.bc.googleusercontent.com
Software: /
Resource Hash: a8f3588de2b236f29077f1ae7e87619bcbe4f0fe3a657d6794fb331e09fd2ac0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://onlinebankingalicia.galiciarverify.repl.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Date: Tue, 30 Aug 2022 18:28:16 GMT
Via: 1.1 google
Host: onlinebankingalicia.galiciarverify.repl.co
Replit-Cluster: global
Content-Length: 1003
Content-Type: application/javascript

GET
H/1.1 200
OK frm-1.svg
onlinebankingalicia.galiciarverify.repl.co/im/ 110 KB
110 KB 396ms
382ms Image
image/svg+xml 34.149.204.188
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://onlinebankingalicia.galiciarverify.repl.co/im/frm-1.svg
Requested by: Host: onlinebankingalicia.galiciarverify.repl.co
URL: http://onlinebankingalicia.galiciarverify.repl.co/st/main.css
Protocol: HTTP/1.1
Server: 34.149.204.188 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 188.204.149.34.bc.googleusercontent.com
Software: /
Resource Hash: 1dfc5d6886da8c3bf7af8e7a751c9424d381e1373c709b1342f99501964a1191

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://onlinebankingalicia.galiciarverify.repl.co/st/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Date: Tue, 30 Aug 2022 18:28:16 GMT
Via: 1.1 google
Host: onlinebankingalicia.galiciarverify.repl.co
Replit-Cluster: global
Content-Length: 112140
Content-Type: image/svg+xml

GET
H/1.1 200
OK pnl-img.jpg
onlinebankingalicia.galiciarverify.repl.co/im/ 677 KB
677 KB 275ms
261ms Image
image/jpeg 34.149.204.188
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://onlinebankingalicia.galiciarverify.repl.co/im/pnl-img.jpg
Requested by: Host: onlinebankingalicia.galiciarverify.repl.co
URL: http://onlinebankingalicia.galiciarverify.repl.co/st/main.css
Protocol: HTTP/1.1
Server: 34.149.204.188 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 188.204.149.34.bc.googleusercontent.com
Software: /
Resource Hash: 01ff410f5fb85b606ae2311c145047e1f40cffc13a7d5c118395f394ca16c67a

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://onlinebankingalicia.galiciarverify.repl.co/st/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Date: Tue, 30 Aug 2022 18:28:16 GMT
Via: 1.1 google
Host: onlinebankingalicia.galiciarverify.repl.co
Replit-Cluster: global
Content-Length: 693066
Content-Type: image/jpeg

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banco Galicia (Banking)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code.jquery.com
fonts.googleapis.com
onlinebankingalicia.galiciarverify.repl.co
2001:4de0:ac18::1:a:3a
2a00:1450:400e:80c::200a
34.149.204.188
01ff410f5fb85b606ae2311c145047e1f40cffc13a7d5c118395f394ca16c67a
0370a4223069208a01c9a4c3f1ba1da1954f4bbad2ab3ec4467d29f7ff77a7b0
1dfc5d6886da8c3bf7af8e7a751c9424d381e1373c709b1342f99501964a1191
9983d3ae405b251b4ab6077cabd1e5d6a5f9e84eff85756da7c502763d47f017
9e87fdc7b8386cb786e3cf277239b44f2cd6538af6beda97e282c4851420188d
a8f3588de2b236f29077f1ae7e87619bcbe4f0fe3a657d6794fb331e09fd2ac0
bac754b72350122de47365bff13baa9359e1715715e71d1afcb1b6442341c8f8
fad6369e7b4e8af718c87cf1d5e13e9f3c3e831725a388ad52a971ee70c1abe8
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

onlinebankingalicia.galiciarverify.repl.co Open in urlscan Pro 34.149.204.188 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

9 Requests

22 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

3 IPs

3 Countries

838 kBTransfer

895 kBSize

0 Cookies

0 Outgoing links

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

11 JavaScript Global Variables

0 Cookies

Indicators

onlinebankingalicia.galiciarverify.repl.co Open in urlscan Pro
34.149.204.188 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

22 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

838 kB
Transfer

895 kB
Size

0
Cookies

9 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!