![](/screenshots/8f8bbc38-b71e-489d-99a7-6ace3e9f0f90.png)
469985a7-fcd2-47a5-b46c-6086893a95c8-00-27pnk9xn232li.kirk.replit.dev
Open in
urlscan Pro
35.247.106.28
Malicious Activity!
Public Scan
Effective URL: https://469985a7-fcd2-47a5-b46c-6086893a95c8-00-27pnk9xn232li.kirk.replit.dev/
Submission Tags: falconsandbox
Submission: On February 07 via api from US — Scanned from DE
Summary
TLS certificate: Issued by R3 on January 24th 2024. Valid for: 3 months.
This is the only time 469985a7-fcd2-47a5-b46c-6086893a95c8-00-27pnk9xn232li.kirk.replit.dev was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: WeTransfer (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 35.247.106.28 35.247.106.28 | 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM) | |
5 | 2606:4700:310... 2606:4700:310c::ac42:2c54 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2a06:98c1:312... 2a06:98c1:3120::3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
8 | 4 |
ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 28.106.247.35.bc.googleusercontent.com
469985a7-fcd2-47a5-b46c-6086893a95c8-00-27pnk9xn232li.kirk.replit.dev |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
pages.dev
sdfvgbh.pages.dev wetr-3p0.pages.dev |
1002 KB |
1 |
replit.dev
469985a7-fcd2-47a5-b46c-6086893a95c8-00-27pnk9xn232li.kirk.replit.dev |
278 KB |
8 | 2 |
Domain | Requested by | |
---|---|---|
5 | sdfvgbh.pages.dev |
469985a7-fcd2-47a5-b46c-6086893a95c8-00-27pnk9xn232li.kirk.replit.dev
|
2 | wetr-3p0.pages.dev |
469985a7-fcd2-47a5-b46c-6086893a95c8-00-27pnk9xn232li.kirk.replit.dev
|
1 | 469985a7-fcd2-47a5-b46c-6086893a95c8-00-27pnk9xn232li.kirk.replit.dev | |
8 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.kirk.replit.dev R3 |
2024-01-24 - 2024-04-23 |
3 months | crt.sh |
sdfvgbh.pages.dev GTS CA 1P5 |
2024-01-09 - 2024-04-08 |
3 months | crt.sh |
wetr-3p0.pages.dev GTS CA 1P5 |
2024-02-04 - 2024-05-04 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://469985a7-fcd2-47a5-b46c-6086893a95c8-00-27pnk9xn232li.kirk.replit.dev/
Frame ID: EAD597D58B2B9A69A76F8CC49DC20E29
Requests: 11 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
8 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
469985a7-fcd2-47a5-b46c-6086893a95c8-00-27pnk9xn232li.kirk.replit.dev/ |
277 KB 278 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bg.png
sdfvgbh.pages.dev/ |
783 KB 784 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
GT-Super-Display-Light.woff
sdfvgbh.pages.dev/ |
54 KB 55 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
GT-Super-Display-Bold.woff
sdfvgbh.pages.dev/ |
58 KB 58 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ActiefGrotesque-Regular.woff
sdfvgbh.pages.dev/ |
30 KB 31 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
4 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
wetr-3p0.pages.dev/ |
164 KB 39 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
script.min.js
wetr-3p0.pages.dev/ |
6 KB 3 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ActiefGrotesque-Medium.woff
sdfvgbh.pages.dev/ |
31 KB 32 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: WeTransfer (Online)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
469985a7-fcd2-47a5-b46c-6086893a95c8-00-27pnk9xn232li.kirk.replit.dev
sdfvgbh.pages.dev
wetr-3p0.pages.dev
2606:4700:310c::ac42:2c54
2a06:98c1:3120::3
35.247.106.28
1f39a1017906d512934d04cef8dbd816ebe0206eab872da92d30fdb554c84a89
562892609732b7374aa3c5f488b555236db7a26a8f73c16624407fad46d946f8
62e704e04089cc468b4bfdd61705d93959532d630e88de5ecef6064ebfd9d29e
6977cb3f0d5e82b58012a0046e16665df036092909dea2a81837e549b20550ad
6dbba1863bcfe251266f22a6c3b047f788a4851623c58c7b6b750809f0885dad
7b18f49b87cf2ce19da6e9ddff3b99cdbb7d79baaddc3911a2d9b5ca74538994
97915ef3518cf57623d185b62663441724cc9afdd8927518e45c36cffc84be2f
b6046a8f13361f175a3717ef126c0d566f845a69ab36d997f33ed5397fdeb847
d88b3d358e709fc9e7691fd77af0bcad9d5c8fbe1f408259fe21de34dff97e27
d8b94fe72cf56de9a06e40ac775760e625540ffec7572ad7aa620462bcdcca8f
eaddc3fb78d635f6abe0194b732e54a2fb4fc0c71669b50c98b02ac36feb813d