galicia.galiciavaliidac.repl.co Open in urlscan Pro
34.149.204.188 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://galicia.galiciavaliidac.repl.co/
Effective URL:
https://galicia.galiciavaliidac.repl.co/
Submission: On August 10 via api (August 10th 2022, 4:52:23 pm UTC) from JP — Scanned from JP

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 9 HTTP transactions. The main IP is 34.149.204.188, located in Kansas City, United States and belongs to GOOGLE, US. The main domain is galicia.galiciavaliidac.repl.co.
TLS certificate: Issued by R3 on August 8th 2022. Valid for: 3 months.

This is the only time galicia.galiciavaliidac.repl.co was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banco Galicia (Banking)

Domain & IP information

	IP Address	AS Autonomous System
7	34.149.204.188 34.149.204.188	15169 (GOOGLE) (GOOGLE)
1	2001:4de0:ac1... 2001:4de0:ac18::1:a:1a	20446 (STACKPATH...) (STACKPATH-CDN)
1	2404:6800:400... 2404:6800:4004:80a::200a	15169 (GOOGLE) (GOOGLE)
9	3

7 34.149.204.188 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 188.204.149.34.bc.googleusercontent.com

galicia.galiciavaliidac.repl.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac18::1:a:1a (Netherlands)

ASN20446 (STACKPATH-CDN, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2404:6800:4004:80a::200a (Australia)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	repl.co galicia.galiciavaliidac.repl.co	807 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 67	1 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 615	30 KB
9	3

	Domain	Requested by
7	galicia.galiciavaliidac.repl.co	galicia.galiciavaliidac.repl.co
1	fonts.googleapis.com	galicia.galiciavaliidac.repl.co
1	code.jquery.com	galicia.galiciavaliidac.repl.co
9	3

This site contains no links.

Subject Issuer	Validity	Valid
galiciavaliidac.repl.co R3	`2022-08-08` - `2022-11-06`	3 months	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2021-07-14` - `2022-08-14`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2022-07-18` - `2022-10-10`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://galicia.galiciavaliidac.repl.co/
Frame ID: CD4CC71ACBFE24DAC7B0CA4C65FC759D
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Home

Detected technologies

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

9
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

838 kB
Transfer

895 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
galicia.galiciavaliidac.repl.co/ 1 KB
1 KB 661ms
362ms Document
text/html 34.149.204.188
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://galicia.galiciavaliidac.repl.co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.204.188 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 188.204.149.34.bc.googleusercontent.com
Software: /
Resource Hash: 9e87fdc7b8386cb786e3cf277239b44f2cd6538af6beda97e282c4851420188d

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: jp-JP,jp;q=0.9

Response headers

content-length: 1291
content-type: text/html; charset=UTF-8
date: Wed, 10 Aug 2022 16:52:18 GMT
expect-ct: max-age=2592000, report-uri="https://sentry.repl.it/api/10/security/?sentry_key=615192fd532445bfbbbe966cd7131791"
host: galicia.galiciavaliidac.repl.co
replit-cluster: global

GET
H2 200 main.css
galicia.galiciavaliidac.repl.co/st/ 6 KB
6 KB 314ms
313ms Stylesheet
text/css 34.149.204.188
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://galicia.galiciavaliidac.repl.co/st/main.css
Requested by: Host: galicia.galiciavaliidac.repl.co
URL: https://galicia.galiciavaliidac.repl.co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.204.188 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 188.204.149.34.bc.googleusercontent.com
Software: /
Resource Hash: bac754b72350122de47365bff13baa9359e1715715e71d1afcb1b6442341c8f8

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://galicia.galiciavaliidac.repl.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Wed, 10 Aug 2022 16:52:18 GMT
host: galicia.galiciavaliidac.repl.co
replit-cluster: global
content-length: 6429
expect-ct: max-age=2592000, report-uri="https://sentry.repl.it/api/10/security/?sentry_key=615192fd532445bfbbbe966cd7131791"
content-type: text/css; charset=UTF-8

GET
H2 200 jquery-3.6.0.min.js Show response
code.jquery.com/ 87 KB
30 KB 333ms
111ms Script
application/javascript 2001:4de0:ac18::1:a:1a
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.6.0.min.js
Requested by: Host: galicia.galiciavaliidac.repl.co
URL: https://galicia.galiciavaliidac.repl.co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:1a , Netherlands, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software: nginx /
Resource Hash: ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Request headers

Referer: https://galicia.galiciavaliidac.repl.co/
Origin: https://galicia.galiciavaliidac.repl.co
accept-language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Wed, 10 Aug 2022 16:52:18 GMT
content-encoding: gzip
last-modified: Fri, 20 Aug 2021 17:47:53 GMT
server: nginx
etag: W/"611feac9-15d9d"
vary: Accept-Encoding
x-hw: 1660150338.dop050.sj3.t,1660150338.cds220.sj3.hn,1660150338.cds046.sj3.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 30875

GET
H2 200 css2
fonts.googleapis.com/ 2 KB
1 KB 77ms
38ms Stylesheet
text/css 2404:6800:4004:80a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Inter&display=swap

Requested by

Host: galicia.galiciavaliidac.repl.co
URL: https://galicia.galiciavaliidac.repl.co/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4004:80a::200a , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

0370a4223069208a01c9a4c3f1ba1da1954f4bbad2ab3ec4467d29f7ff77a7b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://galicia.galiciavaliidac.repl.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 10 Aug 2022 15:53:25 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Wed, 10 Aug 2022 16:52:18 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 10 Aug 2022 16:52:18 GMT

GET
H2 200 lg-gal.svg
galicia.galiciavaliidac.repl.co/im/ 5 KB
5 KB 316ms
315ms Image
image/svg+xml 34.149.204.188
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://galicia.galiciavaliidac.repl.co/im/lg-gal.svg
Requested by: Host: galicia.galiciavaliidac.repl.co
URL: https://galicia.galiciavaliidac.repl.co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.204.188 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 188.204.149.34.bc.googleusercontent.com
Software: /
Resource Hash: fad6369e7b4e8af718c87cf1d5e13e9f3c3e831725a388ad52a971ee70c1abe8

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://galicia.galiciavaliidac.repl.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Wed, 10 Aug 2022 16:52:19 GMT
host: galicia.galiciavaliidac.repl.co
replit-cluster: global
content-length: 5259
expect-ct: max-age=2592000, report-uri="https://sentry.repl.it/api/10/security/?sentry_key=615192fd532445bfbbbe966cd7131791"
content-type: image/svg+xml

GET
H2 200 on-bn.svg
galicia.galiciavaliidac.repl.co/im/ 5 KB
5 KB 317ms
316ms Image
image/svg+xml 34.149.204.188
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://galicia.galiciavaliidac.repl.co/im/on-bn.svg
Requested by: Host: galicia.galiciavaliidac.repl.co
URL: https://galicia.galiciavaliidac.repl.co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.204.188 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 188.204.149.34.bc.googleusercontent.com
Software: /
Resource Hash: 9983d3ae405b251b4ab6077cabd1e5d6a5f9e84eff85756da7c502763d47f017

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://galicia.galiciavaliidac.repl.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Wed, 10 Aug 2022 16:52:19 GMT
host: galicia.galiciavaliidac.repl.co
replit-cluster: global
content-length: 5489
expect-ct: max-age=2592000, report-uri="https://sentry.repl.it/api/10/security/?sentry_key=615192fd532445bfbbbe966cd7131791"
content-type: image/svg+xml

GET
H2 200 scrp.js Show response
galicia.galiciavaliidac.repl.co/js/ 1003 B
1 KB 316ms
315ms Script
application/javascript 34.149.204.188
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://galicia.galiciavaliidac.repl.co/js/scrp.js
Requested by: Host: galicia.galiciavaliidac.repl.co
URL: https://galicia.galiciavaliidac.repl.co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.204.188 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 188.204.149.34.bc.googleusercontent.com
Software: /
Resource Hash: a8f3588de2b236f29077f1ae7e87619bcbe4f0fe3a657d6794fb331e09fd2ac0

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://galicia.galiciavaliidac.repl.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Wed, 10 Aug 2022 16:52:18 GMT
host: galicia.galiciavaliidac.repl.co
replit-cluster: global
content-length: 1003
expect-ct: max-age=2592000, report-uri="https://sentry.repl.it/api/10/security/?sentry_key=615192fd532445bfbbbe966cd7131791"
content-type: application/javascript

GET
H2 200 frm-1.svg
galicia.galiciavaliidac.repl.co/im/ 110 KB
110 KB 354ms
353ms Image
image/svg+xml 34.149.204.188
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://galicia.galiciavaliidac.repl.co/im/frm-1.svg
Requested by: Host: galicia.galiciavaliidac.repl.co
URL: https://galicia.galiciavaliidac.repl.co/st/main.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.204.188 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 188.204.149.34.bc.googleusercontent.com
Software: /
Resource Hash: 1dfc5d6886da8c3bf7af8e7a751c9424d381e1373c709b1342f99501964a1191

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://galicia.galiciavaliidac.repl.co/st/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Wed, 10 Aug 2022 16:52:19 GMT
host: galicia.galiciavaliidac.repl.co
replit-cluster: global
content-length: 112140
expect-ct: max-age=2592000, report-uri="https://sentry.repl.it/api/10/security/?sentry_key=615192fd532445bfbbbe966cd7131791"
content-type: image/svg+xml

GET
H2 200 pnl-img.jpg
galicia.galiciavaliidac.repl.co/im/ 677 KB
678 KB 329ms
328ms Image
image/jpeg 34.149.204.188
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://galicia.galiciavaliidac.repl.co/im/pnl-img.jpg
Requested by: Host: galicia.galiciavaliidac.repl.co
URL: https://galicia.galiciavaliidac.repl.co/st/main.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.204.188 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 188.204.149.34.bc.googleusercontent.com
Software: /
Resource Hash: 01ff410f5fb85b606ae2311c145047e1f40cffc13a7d5c118395f394ca16c67a

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://galicia.galiciavaliidac.repl.co/st/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Wed, 10 Aug 2022 16:52:19 GMT
host: galicia.galiciavaliidac.repl.co
replit-cluster: global
content-length: 693066
expect-ct: max-age=2592000, report-uri="https://sentry.repl.it/api/10/security/?sentry_key=615192fd532445bfbbbe966cd7131791"
content-type: image/jpeg

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banco Galicia (Banking)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code.jquery.com
fonts.googleapis.com
galicia.galiciavaliidac.repl.co
2001:4de0:ac18::1:a:1a
2404:6800:4004:80a::200a
34.149.204.188
01ff410f5fb85b606ae2311c145047e1f40cffc13a7d5c118395f394ca16c67a
0370a4223069208a01c9a4c3f1ba1da1954f4bbad2ab3ec4467d29f7ff77a7b0
1dfc5d6886da8c3bf7af8e7a751c9424d381e1373c709b1342f99501964a1191
9983d3ae405b251b4ab6077cabd1e5d6a5f9e84eff85756da7c502763d47f017
9e87fdc7b8386cb786e3cf277239b44f2cd6538af6beda97e282c4851420188d
a8f3588de2b236f29077f1ae7e87619bcbe4f0fe3a657d6794fb331e09fd2ac0
bac754b72350122de47365bff13baa9359e1715715e71d1afcb1b6442341c8f8
fad6369e7b4e8af718c87cf1d5e13e9f3c3e831725a388ad52a971ee70c1abe8
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

galicia.galiciavaliidac.repl.co Open in urlscan Pro 34.149.204.188 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

9 Requests

100 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

3 IPs

3 Countries

838 kBTransfer

895 kBSize

0 Cookies

0 Outgoing links

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

13 JavaScript Global Variables

0 Cookies

Indicators

galicia.galiciavaliidac.repl.co Open in urlscan Pro
34.149.204.188 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

838 kB
Transfer

895 kB
Size

0
Cookies

9 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!