36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev Open in urlscan Pro
34.100.254.222 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://fwei.short.gy/On-Sbi
Effective URL:
https://36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev/
Submission: On July 11 via manual (July 11th 2024, 5:23:44 pm UTC) from IN — Scanned from DE

Summary HTTP 12 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 4 domains to perform 12 HTTP transactions. The main IP is 34.100.254.222, located in Mumbai, India and belongs to GOOGLE-CLOUD-PLATFORM, US. The main domain is 36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev.
TLS certificate: Issued by R3 on May 27th 2024. Valid for: 3 months.

This is the only time 36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: State Bank of India (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 1	52.59.165.42 52.59.165.42	16509 (AMAZON-02) (AMAZON-02)
10	34.100.254.222 34.100.254.222	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	2a00:1450:400... 2a00:1450:4001:81c::200a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80b::2003	15169 (GOOGLE) (GOOGLE)
12	3

1 52.59.165.42 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: eu-ip-1.short.io

fwei.short.gy	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 34.100.254.222 (Mumbai, India)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 222.254.100.34.bc.googleusercontent.com

36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81c::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	replit.dev 36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev	184 KB
1	gstatic.com fonts.gstatic.com	48 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 108	2 KB
1	short.gy 1 redirects fwei.short.gy	102 B
12	4

	Domain	Requested by
10	36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev	36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev
1	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev
1	fwei.short.gy	1 redirects
12	4

This site contains links to these domains. Also see Links.

Domain
retail.onlinesbi.com

Subject Issuer	Validity	Valid
*.sisko.replit.dev R3	`2024-05-27` - `2024-08-25`	3 months	crt.sh
upload.video.google.com WR2	`2024-06-24` - `2024-09-16`	3 months	crt.sh
*.gstatic.com WR2	`2024-06-24` - `2024-09-16`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev/
Frame ID: E5E814B8A0A605E03A2B68735E4B400D
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

State Bank of India | PAN Update

Page URL History Show full URLs

https://fwei.short.gy/On-Sbi HTTP 302
https://36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev/ Page URL

Detected technologies

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Page Statistics

12
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

234 kB
Transfer

257 kB
Size

0
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://retail.onlinesbi.com/preretail/lockunlockuseraccess.htm
Title: Lock Access

Search URL Search Domain Scan URL

URL: https://retail.onlinesbi.com/retail/troubleloginhome.htm?bankCode=0
Title: Forgot Password

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://fwei.short.gy/On-Sbi HTTP 302
https://36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev/
Redirect Chain

https://fwei.short.gy/On-Sbi
https://36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev/

8 KB
8 KB

648ms
171ms

Document
text/html

34.100.254.222
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.100.254.222 Mumbai, India, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 222.254.100.34.bc.googleusercontent.com
Software: /
Resource Hash: 5403e9c032c45fd85392645c5f3520a8d15171b9f4bce03c23731f7b36e6d672

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Length: 8241
Content-Type: text/html; charset=UTF-8
Date: Thu, 11 Jul 2024 17:23:39 GMT
Host: 36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev
Replit-Cluster: sisko
X-Robots-Tag: none, noindex, noarchive, nofollow, nositelinkssearchbox, noimageindex none, noindex, noarchive, nofollow, nositelinkssearchbox, noimageindex

Redirect headers

content-length: 0
date: Thu, 11 Jul 2024 17:23:38 GMT
location: https://36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev/

GET
H/1.1 200
OK Style_Main.css
36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev/ 3 KB
4 KB 159ms
158ms Stylesheet
text/css 34.100.254.222
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev/Style_Main.css
Requested by: Host: 36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev
URL: https://36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.100.254.222 Mumbai, India, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 222.254.100.34.bc.googleusercontent.com
Software: /
Resource Hash: 9154ef68d6703be71a2448c5ed08151627cfa502c2f976a450b727231ea2e37d

Request headers

Referer: https://36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date: Thu, 11 Jul 2024 17:23:39 GMT
Host: 36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev
Replit-Cluster: sisko
X-Robots-Tag: none, noindex, noarchive, nofollow, nositelinkssearchbox, noimageindex, none, noindex, noarchive, nofollow, nositelinkssearchbox, noimageindex
Content-Length: 3396
Content-Type: text/css; charset=UTF-8

GET
H2 200 css2
fonts.googleapis.com/ 28 KB
2 KB 78ms
30ms Stylesheet
text/css 2a00:1450:4001:81c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Open+Sans:wght@300;400;500;600;700&display=swap

Requested by

Host: 36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev
URL: https://36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

90787ca0e77942034765d1f69eff786ed8fbb616ed49ba6fbc8e9f56207c579e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 11 Jul 2024 17:23:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 11 Jul 2024 15:49:26 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 11 Jul 2024 17:23:39 GMT

GET
H/1.1 200
OK Header.png
36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev/ 28 KB
29 KB 333ms
165ms Image
image/png 34.100.254.222
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev/Header.png
Requested by: Host: 36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev
URL: https://36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.100.254.222 Mumbai, India, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 222.254.100.34.bc.googleusercontent.com
Software: /
Resource Hash: 83c892de120304d45f34d5338687edb7166c5721e6aeb852583e7bb8bbb40c88

Request headers

Referer: https://36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date: Thu, 11 Jul 2024 17:23:39 GMT
Host: 36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev
Replit-Cluster: sisko
X-Robots-Tag: none, noindex, noarchive, nofollow, nositelinkssearchbox, noimageindex, none, noindex, noarchive, nofollow, nositelinkssearchbox, noimageindex
Content-Length: 28856
Content-Type: image/png

GET
H/1.1 200
OK Menu.png
36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev/ 6 KB
6 KB 626ms
180ms Image
image/png 34.100.254.222
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev/Menu.png
Requested by: Host: 36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev
URL: https://36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.100.254.222 Mumbai, India, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 222.254.100.34.bc.googleusercontent.com
Software: /
Resource Hash: c70622ae897db583c1854311b48a99ed7666f4506870bdf736bb053dd013d846

Request headers

Referer: https://36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date: Thu, 11 Jul 2024 17:23:40 GMT
Host: 36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev
Replit-Cluster: sisko
X-Robots-Tag: none, noindex, noarchive, nofollow, nositelinkssearchbox, noimageindex, none, noindex, noarchive, nofollow, nositelinkssearchbox, noimageindex
Content-Length: 6095
Content-Type: image/png

GET
H/1.1 200
OK YONO_Logo.png
36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev/ 6 KB
7 KB 614ms
162ms Image
image/png 34.100.254.222
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev/YONO_Logo.png
Requested by: Host: 36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev
URL: https://36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.100.254.222 Mumbai, India, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 222.254.100.34.bc.googleusercontent.com
Software: /
Resource Hash: 8c58ba744e72432b14a82846756d3de5bedca9e88403eea10e1fa38fdc4d44fc

Request headers

Referer: https://36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date: Thu, 11 Jul 2024 17:23:40 GMT
Host: 36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev
Replit-Cluster: sisko
X-Robots-Tag: none, noindex, noarchive, nofollow, nositelinkssearchbox, noimageindex, none, noindex, noarchive, nofollow, nositelinkssearchbox, noimageindex
Content-Length: 6619
Content-Type: image/png

GET
H/1.1 200
OK Captcha.jpg
36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev/ 29 KB
30 KB 615ms
164ms Image
image/jpeg 34.100.254.222
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev/Captcha.jpg
Requested by: Host: 36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev
URL: https://36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.100.254.222 Mumbai, India, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 222.254.100.34.bc.googleusercontent.com
Software: /
Resource Hash: b2dabedca78701a111daf52b2195b5c8819479d1e6f20480c48d67381741802d

Request headers

Referer: https://36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date: Thu, 11 Jul 2024 17:23:40 GMT
Host: 36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev
Replit-Cluster: sisko
X-Robots-Tag: none, noindex, noarchive, nofollow, nositelinkssearchbox, noimageindex, none, noindex, noarchive, nofollow, nositelinkssearchbox, noimageindex
Content-Length: 30123
Content-Type: image/jpeg

GET
H/1.1 200
OK SecurityA.jpg
36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev/ 71 KB
71 KB 615ms
153ms Image
image/jpeg 34.100.254.222
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev/SecurityA.jpg
Requested by: Host: 36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev
URL: https://36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.100.254.222 Mumbai, India, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 222.254.100.34.bc.googleusercontent.com
Software: /
Resource Hash: 9155b652e97af387d349e5b981284d5d01f763e7cdaa0ec9807046e61c8a445b

Request headers

Referer: https://36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date: Thu, 11 Jul 2024 17:23:40 GMT
Host: 36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev
Replit-Cluster: sisko
X-Robots-Tag: none, noindex, noarchive, nofollow, nositelinkssearchbox, noimageindex, none, noindex, noarchive, nofollow, nositelinkssearchbox, noimageindex
Content-Length: 72538
Content-Type: image/jpeg

GET
H/1.1 200
OK Footer.png
36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev/ 28 KB
28 KB 640ms
165ms Image
image/png 34.100.254.222
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev/Footer.png
Requested by: Host: 36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev
URL: https://36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.100.254.222 Mumbai, India, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 222.254.100.34.bc.googleusercontent.com
Software: /
Resource Hash: 127724b9264e03352b4321b468361f3b0ed3cfe06da96f7c189c4feaecb4f325

Request headers

Referer: https://36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date: Thu, 11 Jul 2024 17:23:40 GMT
Host: 36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev
Replit-Cluster: sisko
X-Robots-Tag: none, noindex, noarchive, nofollow, nositelinkssearchbox, noimageindex, none, noindex, noarchive, nofollow, nositelinkssearchbox, noimageindex
Content-Length: 28365
Content-Type: image/png

GET
H/1.1 404
Not Found ipl.svg
36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev/ 540 B
540 B 438ms
179ms Image
text/html 34.100.254.222
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev/ipl.svg
Requested by: Host: 36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev
URL: https://36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev/Style_Main.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.100.254.222 Mumbai, India, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 222.254.100.34.bc.googleusercontent.com
Software: /
Resource Hash: b476c76c5c56b2e50fd83f2a3b3b9c068b45af275cf071975336ba269a31f207

Request headers

Referer: https://36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev/Style_Main.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date: Thu, 11 Jul 2024 17:23:40 GMT
Host: 36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev
Replit-Cluster: sisko
X-Robots-Tag: none, noindex, noarchive, nofollow, nositelinkssearchbox, noimageindex, none, noindex, noarchive, nofollow, nositelinkssearchbox, noimageindex
Content-Length: 540
Content-Type: text/html; charset=UTF-8

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v40/ 47 KB
48 KB 72ms
19ms Font
font/woff2 2a00:1450:4001:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Open+Sans:wght@300;400;500;600;700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 11 Jul 2024 09:37:33 GMT
x-content-type-options: nosniff
age: 27966
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 48236
x-xss-protection: 0
last-modified: Thu, 14 Dec 2023 02:08:40 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 11 Jul 2025 09:37:33 GMT

GET
H/1.1 200
OK favicon-32x32.png
36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev/ 668 B
1 KB 149ms
149ms Other
image/png 34.100.254.222
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev/favicon-32x32.png
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.100.254.222 Mumbai, India, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 222.254.100.34.bc.googleusercontent.com
Software: /
Resource Hash: c482378231dbe0d292dbf0d6cea351533010785f051f7470fb2ad143f1b4267d

Request headers

Referer: https://36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date: Thu, 11 Jul 2024 17:23:40 GMT
Host: 36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev
Replit-Cluster: sisko
X-Robots-Tag: none, noindex, noarchive, nofollow, nositelinkssearchbox, noimageindex, none, noindex, noarchive, nofollow, nositelinkssearchbox, noimageindex
Content-Length: 668
Content-Type: image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: State Bank of India (Banking)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 string| message function| clickIE4 function| clickNS4

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev/ipl.svg Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev
fonts.googleapis.com
fonts.gstatic.com
fwei.short.gy
2a00:1450:4001:80b::2003
2a00:1450:4001:81c::200a
34.100.254.222
52.59.165.42
127724b9264e03352b4321b468361f3b0ed3cfe06da96f7c189c4feaecb4f325
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa
5403e9c032c45fd85392645c5f3520a8d15171b9f4bce03c23731f7b36e6d672
83c892de120304d45f34d5338687edb7166c5721e6aeb852583e7bb8bbb40c88
8c58ba744e72432b14a82846756d3de5bedca9e88403eea10e1fa38fdc4d44fc
90787ca0e77942034765d1f69eff786ed8fbb616ed49ba6fbc8e9f56207c579e
9154ef68d6703be71a2448c5ed08151627cfa502c2f976a450b727231ea2e37d
9155b652e97af387d349e5b981284d5d01f763e7cdaa0ec9807046e61c8a445b
b2dabedca78701a111daf52b2195b5c8819479d1e6f20480c48d67381741802d
b476c76c5c56b2e50fd83f2a3b3b9c068b45af275cf071975336ba269a31f207
c482378231dbe0d292dbf0d6cea351533010785f051f7470fb2ad143f1b4267d
c70622ae897db583c1854311b48a99ed7666f4506870bdf736bb053dd013d846

36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev Open in urlscan Pro 34.100.254.222 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

12 Requests

100 %HTTPS

50 %IPv6

4 Domains

4 Subdomains

3 IPs

2 Countries

234 kBTransfer

257 kBSize

0 Cookies

2 Outgoing links

Page URL History

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

36f2c262-9028-4f21-af1f-2d2838e6186d-00-34p6hrbi9j6ka.sisko.replit.dev Open in urlscan Pro
34.100.254.222 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

234 kB
Transfer

257 kB
Size

0
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!