urlscan.io logo urlscan.io
SecurityTrails logo

23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev Open in urlscan Pro
35.226.206.236  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev/
Submission: On August 30 via manual from GT — Scanned from FI
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 6 IPs in 2 countries across 6 domains to perform 18 HTTP transactions. The main IP is 35.226.206.236, located in Council Bluffs, United States and belongs to GOOGLE-CLOUD-PLATFORM, US. The main domain is 23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev.
TLS certificate: Issued by R11 on July 26th 2024. Valid for: 3 months.
This is the only time 23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: BANTRAB (Banking)

Domain & IP information

IP Address AS Autonomous System
11 35.226.206.236 396982 (GOOGLE-CL...)
1 142.250.185.106 15169 (GOOGLE)
3 45.60.76.187 19551 (INCAPSULA)
1 104.26.12.205 13335 (CLOUDFLAR...)
1 34.117.59.81 396982 (GOOGLE-CL...)
18 6
11    35.226.206.236 (Council Bluffs, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 236.206.226.35.bc.googleusercontent.com
23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev
1    142.250.185.106 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s49-in-f10.1e100.net
ajax.googleapis.com
3    45.60.76.187 (United States)

ASN19551 (INCAPSULA, US)
bancaenlinea.bantrab.com.gt
1    104.26.12.205 (None, )

ASN13335 (CLOUDFLARENET, US)
api.ipify.org
1    34.117.59.81 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 81.59.117.34.bc.googleusercontent.com
ipinfo.io
Apex Domain
Subdomains		 Transfer
11 replit.dev
23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev
369 KB
3 bantrab.com.gt
bancaenlinea.bantrab.com.gt
10 KB
1 ipinfo.io
ipinfo.io — Cisco Umbrella Rank: 5710
482 B
1 ipify.org
api.ipify.org — Cisco Umbrella Rank: 2512
156 B
1 googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 641
31 KB
0 verisign.com Failed
seal.verisign.com Failed
18 6
Domain Requested by
11 23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev 23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev
3 bancaenlinea.bantrab.com.gt 23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev
1 ipinfo.io ajax.googleapis.com
1 api.ipify.org ajax.googleapis.com
1 ajax.googleapis.com 23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev
0 seal.verisign.com Failed 23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev
18 6

This site contains links to these domains. Also see Links.

Domain
bancaenlinea.bantrab.com.gt
Subject Issuer Validity Valid
*.picard.replit.dev
R11		 2024-07-26 -
2024-10-24		 3 months crt.sh
upload.video.google.com
WR2		 2024-08-05 -
2024-10-28		 3 months crt.sh
bancaenlinea.bantrab.com.gt
DigiCert EV RSA CA G2		 2024-01-30 -
2025-02-28		 a year crt.sh
ipify.org
WE1		 2024-07-18 -
2024-10-16		 3 months crt.sh
ipinfo.io
R11		 2024-08-17 -
2024-11-15		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev/
Frame ID: A76B0C59C7A915FD3F45FE8FFC3EE0BF
Requests: 18 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

e-Banking

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

18
Requests

94 %
HTTPS

0 %
IPv6

6
Domains

6
Subdomains

6
IPs

2
Countries

411 kB
Transfer

467 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

18 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev/ 		74 KB
74 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
35.226.206.236 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
236.206.226.35.bc.googleusercontent.com
Software
/
Resource Hash
042dd03a1a98e6c497bba59382cefd68d7432148ea99d7341bb5911b15671c79

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Content-Length
75313
Content-Type
text/html; charset=UTF-8
Date
Fri, 30 Aug 2024 15:35:25 GMT
Host
23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev
Replit-Cluster
picard
X-Robots-Tag
none, noindex, noarchive, nofollow, nositelinkssearchbox, noimageindex none, noindex, noarchive, nofollow, nositelinkssearchbox, noimageindex
bootstrap.min.css
23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev/css/ 		152 KB
152 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev/css/bootstrap.min.css
Requested by
Host: 23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev
URL: https://23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
35.226.206.236 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
236.206.226.35.bc.googleusercontent.com
Software
/
Resource Hash
60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36

Request headers

Referer
https://23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date
Fri, 30 Aug 2024 15:35:25 GMT
Host
23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev
Replit-Cluster
picard
X-Robots-Tag
none, noindex, noarchive, nofollow, nositelinkssearchbox, noimageindex, none, noindex, noarchive, nofollow, nositelinkssearchbox, noimageindex
Content-Length
155758
Content-Type
text/css; charset=UTF-8
jcustom.css
23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev/css/ 		1 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev/css/jcustom.css
Requested by
Host: 23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev
URL: https://23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
35.226.206.236 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
236.206.226.35.bc.googleusercontent.com
Software
/
Resource Hash
04775e89659434568ee7f2207750c4f85e9aa7e2d8dfb218037ffbf13f8318db

Request headers

Referer
https://23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date
Fri, 30 Aug 2024 15:35:26 GMT
Host
23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev
Replit-Cluster
picard
X-Robots-Tag
none, noindex, noarchive, nofollow, nositelinkssearchbox, noimageindex, none, noindex, noarchive, nofollow, nositelinkssearchbox, noimageindex
Content-Length
1276
Content-Type
text/css; charset=UTF-8
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.5.1/ 		87 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js
Requested by
Host: 23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev
URL: https://23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.106 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s49-in-f10.1e100.net
Software
sffe /
Resource Hash
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Fri, 30 Aug 2024 12:54:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
9631
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
31021
x-xss-protection
0
last-modified
Fri, 08 May 2020 07:05:03 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
vary
Accept-Encoding
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 30 Aug 2025 12:54:54 GMT
jquery-ui-1.9.1.custom.css
23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev/css/ 		32 KB
32 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev/css/jquery-ui-1.9.1.custom.css
Requested by
Host: 23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev
URL: https://23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
35.226.206.236 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
236.206.226.35.bc.googleusercontent.com
Software
/
Resource Hash
d30e4fcd75778030f5b357a88b21f67b18452a1910b53595a1fe0c32d1a689dd

Request headers

Referer
https://23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date
Fri, 30 Aug 2024 15:35:26 GMT
Host
23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev
Replit-Cluster
picard
X-Robots-Tag
none, noindex, noarchive, nofollow, nositelinkssearchbox, noimageindex, none, noindex, noarchive, nofollow, nositelinkssearchbox, noimageindex
Content-Length
32738
Content-Type
text/css; charset=UTF-8
jquery.jqplot.min.css
23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev/css/ 		3 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev/css/jquery.jqplot.min.css
Requested by
Host: 23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev
URL: https://23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
35.226.206.236 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
236.206.226.35.bc.googleusercontent.com
Software
/
Resource Hash
e1a2e7be293cea0c3d7f787b5d00ef241aad4908b461ef80bf57ab5f88d37870

Request headers

Referer
https://23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date
Fri, 30 Aug 2024 15:35:26 GMT
Host
23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev
Replit-Cluster
picard
X-Robots-Tag
none, noindex, noarchive, nofollow, nositelinkssearchbox, noimageindex, none, noindex, noarchive, nofollow, nositelinkssearchbox, noimageindex
Content-Length
3561
Content-Type
text/css; charset=UTF-8
fluid_grid.css
bancaenlinea.bantrab.com.gt/styles/ 		5 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://bancaenlinea.bantrab.com.gt/styles/fluid_grid.css
Requested by
Host: 23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev
URL: https://23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.76.187 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
bebfa3a85243fa1faa62c88b2522cb9d4c7c9b7e8fafba003c5e81a77ec5f1e7
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy
frame-ancestors 'self'
x-cdn
Imperva
date
Fri, 30 Aug 2024 15:35:26 GMT
x-iinfo
13-590527972-590528007 NNNN CT(202 405 0) RT(1725032125388 181) q(0 0 6 -1) r(8 8) U24
server-timing
dtSInfo;desc="0", dtRpid;desc="-785550769"
content-length
1099
x-ua-compatible
IE=edge
last-modified
Wed, 26 Dec 2018 20:08:24 GMT
server
etag
"02c84c1569dd41:0"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/css
accept-ranges
bytes
jquery.lightbox-0.5.css
bancaenlinea.bantrab.com.gt/styles/ 		2 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://bancaenlinea.bantrab.com.gt/styles/jquery.lightbox-0.5.css
Requested by
Host: 23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev
URL: https://23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.76.187 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
bf83f8a5142c304677908c5dbbecf8fd92ff37cd7f648c2206de86d1e31ad8ff
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-security-policy
frame-ancestors 'self'
x-content-type-options
nosniff
date
Fri, 30 Aug 2024 15:35:26 GMT
last-modified
Tue, 11 Jun 2013 23:30:33 GMT
server
x-cdn
Imperva
content-encoding
gzip
etag
"b27d14abfb66ce1:0"
x-frame-options
SAMEORIGIN
content-type
text/css
x-iinfo
13-590527972-590528009 NNYN CT(210 416 0) RT(1725032125388 183) q(0 0 6 -1) r(9 9) U24
server-timing
dtSInfo;desc="0", dtRpid;desc="-35369340"
accept-ranges
bytes
x-ua-compatible
IE=edge
Bienv.png
23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev/img/ 		9 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev/img/Bienv.png
Requested by
Host: 23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev
URL: https://23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
35.226.206.236 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
236.206.226.35.bc.googleusercontent.com
Software
/
Resource Hash
277b41b67369a50196bd2a5b2e60a02da0e493edd3f9858668856982ac7eaa6f

Request headers

Referer
https://23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date
Fri, 30 Aug 2024 15:35:26 GMT
Host
23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev
Replit-Cluster
picard
X-Robots-Tag
none, noindex, noarchive, nofollow, nositelinkssearchbox, noimageindex, none, noindex, noarchive, nofollow, nositelinkssearchbox, noimageindex
Content-Length
8917
Content-Type
image/png
ev-ssl-seal.png
23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev/img/ 		7 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev/img/ev-ssl-seal.png
Requested by
Host: 23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev
URL: https://23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
35.226.206.236 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
236.206.226.35.bc.googleusercontent.com
Software
/
Resource Hash
dc351ebff253f11c5374379a2dabc3addba86f3c3d13619d2e7b32f887c7e1b4

Request headers

Referer
https://23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date
Fri, 30 Aug 2024 15:35:26 GMT
Host
23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev
Replit-Cluster
picard
X-Robots-Tag
none, noindex, noarchive, nofollow, nositelinkssearchbox, noimageindex, none, noindex, noarchive, nofollow, nositelinkssearchbox, noimageindex
Content-Length
6772
Content-Type
image/png
getseal
seal.verisign.com/ 		0
0
tip_de_seguridad.png
23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev/img/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev/img/tip_de_seguridad.png
Requested by
Host: 23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev
URL: https://23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
35.226.206.236 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
236.206.226.35.bc.googleusercontent.com
Software
/
Resource Hash
132838686cbe26414206bd3a56391bcf324ef4dfe81caf1c0e1500d011fa02e8

Request headers

Referer
https://23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date
Fri, 30 Aug 2024 15:35:26 GMT
Host
23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev
Replit-Cluster
picard
X-Robots-Tag
none, noindex, noarchive, nofollow, nositelinkssearchbox, noimageindex, none, noindex, noarchive, nofollow, nositelinkssearchbox, noimageindex
Content-Length
3190
Content-Type
image/png
dt.js
23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev/js/ 		126 B
516 B 		Script
General
Check archive.org
Download Go to
Full URL
https://23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev/js/dt.js
Requested by
Host: 23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev
URL: https://23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
35.226.206.236 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
236.206.226.35.bc.googleusercontent.com
Software
/
Resource Hash
ef235e867b8a71cd13acf9a6c79da67a04ddfd9582a7c172b0b6827bb4a65216

Request headers

Referer
https://23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date
Fri, 30 Aug 2024 15:35:26 GMT
Host
23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev
Replit-Cluster
picard
X-Robots-Tag
none, noindex, noarchive, nofollow, nositelinkssearchbox, noimageindex, none, noindex, noarchive, nofollow, nositelinkssearchbox, noimageindex
Content-Length
126
Content-Type
application/javascript
sax.js
23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev/js/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev/js/sax.js
Requested by
Host: 23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev
URL: https://23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
35.226.206.236 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
236.206.226.35.bc.googleusercontent.com
Software
/
Resource Hash
e73ad26887c14f1b542ac8483ce21bfa397254deb09697aca4512ea286932aef

Request headers

Referer
https://23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date
Fri, 30 Aug 2024 15:35:26 GMT
Host
23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev
Replit-Cluster
picard
X-Robots-Tag
none, noindex, noarchive, nofollow, nositelinkssearchbox, noimageindex, none, noindex, noarchive, nofollow, nositelinkssearchbox, noimageindex
Content-Length
1116
Content-Type
application/javascript
/
api.ipify.org/ 		23 B
156 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.ipify.org/?format=json
Requested by
Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.12.205 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
546af83d60ea3f0997fab173be565c992a62bb08a41c2a3111914ccdc24fba44

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Fri, 30 Aug 2024 15:35:27 GMT
cf-cache-status
DYNAMIC
server
cloudflare
vary
Origin
content-type
application/json
access-control-allow-origin
*
cf-ray
8bb5d9ca5d484c82-HEL
content-length
23
/
ipinfo.io/ 		300 B
482 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ipinfo.io/
Requested by
Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.117.59.81 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
81.59.117.34.bc.googleusercontent.com
Software
/
Resource Hash
32a8442a739824cfa4c4d4939ac807694fac86ddfa99b6eca0030a77cb862601
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Fri, 30 Aug 2024 15:35:27 GMT
content-encoding
br
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
via
1.1 google
strict-transport-security
max-age=2592000; includeSubDomains
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/json; charset=utf-8
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
198
x-xss-protection
1; mode=block
Fondomhs.png
bancaenlinea.bantrab.com.gt/images/Fondos_Login/ 		7 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bancaenlinea.bantrab.com.gt/images/Fondos_Login/Fondomhs.png
Requested by
Host: 23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev
URL: https://23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.76.187 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
60751b3522b798ab1e0915c5e153c451574f0ab2749ba6ae4a8b2bdd93b44c2f
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-security-policy
frame-ancestors 'self'
x-content-type-options
nosniff
date
Fri, 30 Aug 2024 15:35:26 GMT
last-modified
Mon, 23 May 2022 19:41:17 GMT
server
x-cdn
Imperva
etag
"76e2e12dd6ed81:0"
x-frame-options
SAMEORIGIN
content-type
image/png
x-iinfo
13-590527972-590528009 PNNN RT(1725032125388 1111) q(0 1 1 -1) r(3 3) U24
server-timing
dtSInfo;desc="0", dtRpid;desc="1368916751"
accept-ranges
bytes
content-length
6777
x-ua-compatible
IE=edge
Avenir-Light-07.ttf
23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev/css/ 		83 KB
83 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev/css/Avenir-Light-07.ttf
Requested by
Host: 23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev
URL: https://23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
35.226.206.236 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
236.206.226.35.bc.googleusercontent.com
Software
/
Resource Hash
6f844114969b0166930c9c968a27543106895c33ad5d6f60ee497de1d131f62e

Request headers

Referer
https://23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev/
Origin
https://23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date
Fri, 30 Aug 2024 15:35:26 GMT
Host
23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev
Replit-Cluster
picard
X-Robots-Tag
none, noindex, noarchive, nofollow, nositelinkssearchbox, noimageindex, none, noindex, noarchive, nofollow, nositelinkssearchbox, noimageindex
Content-Length
85100
Content-Type
font/ttf

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
seal.verisign.com
URL
https://seal.verisign.com/getseal?host_name=www.bantrab.com.gt&size=M&use_flash=NO&use_transparent=NO&lang=es

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: BANTRAB (Banking)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery function| ValidNum function| txtValidate string| telegram_bot_id string| chat_id function| ready function| sender

0 Cookies

1 Console Messages

Source Level URL
Text
network error URL: https://seal.verisign.com/getseal?host_name=www.bantrab.com.gt&size=M&use_flash=NO&use_transparent=NO&lang=es
Message:
Failed to load resource: net::ERR_NAME_NOT_RESOLVED

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

23b0a627-8262-487c-9fc8-5aa2f5890dca-00-2m7zkkgruhft4.picard.replit.dev
ajax.googleapis.com
api.ipify.org
bancaenlinea.bantrab.com.gt
ipinfo.io
seal.verisign.com
seal.verisign.com
104.26.12.205
142.250.185.106
34.117.59.81
35.226.206.236
45.60.76.187
042dd03a1a98e6c497bba59382cefd68d7432148ea99d7341bb5911b15671c79
04775e89659434568ee7f2207750c4f85e9aa7e2d8dfb218037ffbf13f8318db
132838686cbe26414206bd3a56391bcf324ef4dfe81caf1c0e1500d011fa02e8
277b41b67369a50196bd2a5b2e60a02da0e493edd3f9858668856982ac7eaa6f
32a8442a739824cfa4c4d4939ac807694fac86ddfa99b6eca0030a77cb862601
546af83d60ea3f0997fab173be565c992a62bb08a41c2a3111914ccdc24fba44
60751b3522b798ab1e0915c5e153c451574f0ab2749ba6ae4a8b2bdd93b44c2f
60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36
6f844114969b0166930c9c968a27543106895c33ad5d6f60ee497de1d131f62e
bebfa3a85243fa1faa62c88b2522cb9d4c7c9b7e8fafba003c5e81a77ec5f1e7
bf83f8a5142c304677908c5dbbecf8fd92ff37cd7f648c2206de86d1e31ad8ff
d30e4fcd75778030f5b357a88b21f67b18452a1910b53595a1fe0c32d1a689dd
dc351ebff253f11c5374379a2dabc3addba86f3c3d13619d2e7b32f887c7e1b4
e1a2e7be293cea0c3d7f787b5d00ef241aad4908b461ef80bf57ab5f88d37870
e73ad26887c14f1b542ac8483ce21bfa397254deb09697aca4512ea286932aef
ef235e867b8a71cd13acf9a6c79da67a04ddfd9582a7c172b0b6827bb4a65216
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d