helpfulknowingworkspace.segurity123.repl.co Open in urlscan Pro
34.149.204.188 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://helpfulknowingworkspace.segurity123.repl.co/
Effective URL:
http://helpfulknowingworkspace.segurity123.repl.co/
Submission Tags: replit-anti-abuse
Submission: On October 09 via api (October 9th 2022, 6:44:15 pm UTC) from US — Scanned from DE

Summary HTTP 16 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 16 HTTP transactions. The main IP is 34.149.204.188, located in Kansas City, United States and belongs to GOOGLE, US. The main domain is helpfulknowingworkspace.segurity123.repl.co.

This is the only time helpfulknowingworkspace.segurity123.repl.co was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banco Agrícola (Banking)

Domain & IP information

	IP Address	AS Autonomous System
9	34.149.204.188 34.149.204.188	15169 (GOOGLE) (GOOGLE)
7	201.131.122.35 201.131.122.35	263695 (BANCO AGR...) (BANCO AGRICOLA)
16	2

9 34.149.204.188 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 188.204.149.34.bc.googleusercontent.com

helpfulknowingworkspace.segurity123.repl.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 201.131.122.35 (El Salvador)

ASN263695 (BANCO AGRICOLA, SV)
PTR: ns.pcbac.com

www.pcbac.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	repl.co helpfulknowingworkspace.segurity123.repl.co	2 MB
7	pcbac.com www.pcbac.com	1 MB
16	2

	Domain	Requested by
9	helpfulknowingworkspace.segurity123.repl.co	helpfulknowingworkspace.segurity123.repl.co
7	www.pcbac.com	helpfulknowingworkspace.segurity123.repl.co
16	2

This site contains no links.

Subject Issuer	Validity	Valid
www.pcbac.com DigiCert SHA2 Extended Validation Server CA	`2022-09-28` - `2023-09-28`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://helpfulknowingworkspace.segurity123.repl.co/
Frame ID: F53B833C2036F772D83A29ECD2819488
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Agrícola

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

16
Requests

44 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

2844 kB
Transfer

2835 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
helpfulknowingworkspace.segurity123.repl.co/ 5 KB
5 KB 611ms
403ms Document
text/html 34.149.204.188
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: http://helpfulknowingworkspace.segurity123.repl.co/
Protocol: HTTP/1.1
Server: 34.149.204.188 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 188.204.149.34.bc.googleusercontent.com
Software: / PHP/7.4.21
Resource Hash: 2e7ab9930bdc5f86491340b999396838c5c1e5a6cebf8289ca266d265e8345f6

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Content-Type: text/html; charset=UTF-8
Date: Sun, 09 Oct 2022 18:44:07 GMT
Host: helpfulknowingworkspace.segurity123.repl.co
Replit-Cluster: global
Transfer-Encoding: chunked
Via: 1.1 google
X-Powered-By: PHP/7.4.21

GET
H/1.1 200
OK app.css
helpfulknowingworkspace.segurity123.repl.co/style/ 931 KB
931 KB 252ms
251ms Stylesheet
text/css 34.149.204.188
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: http://helpfulknowingworkspace.segurity123.repl.co/style/app.css
Requested by: Host: helpfulknowingworkspace.segurity123.repl.co
URL: http://helpfulknowingworkspace.segurity123.repl.co/
Protocol: HTTP/1.1
Server: 34.149.204.188 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 188.204.149.34.bc.googleusercontent.com
Software: /
Resource Hash: 8bb72d28136c4f365c2f562aa95b5b1c86b55996d5915bc74990b25a36df2484

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://helpfulknowingworkspace.segurity123.repl.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date: Sun, 09 Oct 2022 18:44:07 GMT
Via: 1.1 google
Host: helpfulknowingworkspace.segurity123.repl.co
Replit-Cluster: global
Content-Length: 953184
Content-Type: text/css; charset=UTF-8

GET
H/1.1 200
OK image.gif
helpfulknowingworkspace.segurity123.repl.co/img/ 43 B
236 B 299ms
280ms Image
image/gif 34.149.204.188
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://helpfulknowingworkspace.segurity123.repl.co/img/image.gif
Requested by: Host: helpfulknowingworkspace.segurity123.repl.co
URL: http://helpfulknowingworkspace.segurity123.repl.co/
Protocol: HTTP/1.1
Server: 34.149.204.188 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 188.204.149.34.bc.googleusercontent.com
Software: /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://helpfulknowingworkspace.segurity123.repl.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date: Sun, 09 Oct 2022 18:44:08 GMT
Via: 1.1 google
Host: helpfulknowingworkspace.segurity123.repl.co
Replit-Cluster: global
Content-Length: 43
Content-Type: image/gif

GET
H/1.1 200
OK jquery-3.6.0.min.js Show response
helpfulknowingworkspace.segurity123.repl.co/js/ 87 KB
88 KB 300ms
281ms Script
application/javascript 34.149.204.188
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: http://helpfulknowingworkspace.segurity123.repl.co/js/jquery-3.6.0.min.js
Requested by: Host: helpfulknowingworkspace.segurity123.repl.co
URL: http://helpfulknowingworkspace.segurity123.repl.co/
Protocol: HTTP/1.1
Server: 34.149.204.188 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 188.204.149.34.bc.googleusercontent.com
Software: /
Resource Hash: ce9d07500ad91ec2b524c270764ec4c9a33e78320d8d374ec400ede488f6251b

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://helpfulknowingworkspace.segurity123.repl.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date: Sun, 09 Oct 2022 18:44:08 GMT
Via: 1.1 google
Host: helpfulknowingworkspace.segurity123.repl.co
Replit-Cluster: global
Content-Length: 89503
Content-Type: application/javascript

GET
H/1.1 200
OK function.js Show response
helpfulknowingworkspace.segurity123.repl.co/js/ 14 KB
14 KB 308ms
289ms Script
application/javascript 34.149.204.188
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: http://helpfulknowingworkspace.segurity123.repl.co/js/function.js
Requested by: Host: helpfulknowingworkspace.segurity123.repl.co
URL: http://helpfulknowingworkspace.segurity123.repl.co/
Protocol: HTTP/1.1
Server: 34.149.204.188 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 188.204.149.34.bc.googleusercontent.com
Software: /
Resource Hash: 2578ebc536f1fd6adac6629fa311a6aed7e6b12e7f52cf8fb13eedd8d9c71656

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://helpfulknowingworkspace.segurity123.repl.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date: Sun, 09 Oct 2022 18:44:08 GMT
Via: 1.1 google
Host: helpfulknowingworkspace.segurity123.repl.co
Replit-Cluster: global
Content-Length: 14105
Content-Type: application/javascript

GET
H/1.1 200
OK help_button_fenix.svg
www.pcbac.com/web/img/ 6 KB
7 KB 2170ms
186ms Image
image/svg+xml 201.131.122.35
BANCO AGRICOLA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.pcbac.com/web/img/help_button_fenix.svg

Requested by

Host: helpfulknowingworkspace.segurity123.repl.co
URL: http://helpfulknowingworkspace.segurity123.repl.co/style/app.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

201.131.122.35 , El Salvador, ASN263695 (BANCO AGRICOLA, SV),

Reverse DNS

ns.pcbac.com

Software

Resource Hash

41ff7ea71edd1f8537b04146fb3b9b71391ce490fa5bddb8fe3d4a84435673bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=2628000 ; includeSubDomains
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://helpfulknowingworkspace.segurity123.repl.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date: Sun, 09 Oct 2022 18:44:10 GMT
Strict-Transport-Security: max-age=2628000 ; includeSubDomains
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Sat, 16 Jul 2022 01:45:50 GMT
Content-Language: en-US
Content-Type: image/svg+xml
X-OneAgent-JS-Injection: true
Cache-Control: no-cache="set-cookie, set-cookie2"
Access-Control-Allow-Origin: https://www.pcbac.com
Content-Length: 5867
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H/1.1 200
OK positivo.svg
www.pcbac.com/web/img/ 12 KB
13 KB 2169ms
185ms Image
image/svg+xml 201.131.122.35
BANCO AGRICOLA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.pcbac.com/web/img/positivo.svg

Requested by

Host: helpfulknowingworkspace.segurity123.repl.co
URL: http://helpfulknowingworkspace.segurity123.repl.co/style/app.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

201.131.122.35 , El Salvador, ASN263695 (BANCO AGRICOLA, SV),

Reverse DNS

ns.pcbac.com

Software

Resource Hash

c92a3c915df8cc35e7a55be54cf022b77355d14705af9715a8def5fcf1a8b4db

Security Headers

Name	Value
Strict-Transport-Security	max-age=2628000 ; includeSubDomains
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://helpfulknowingworkspace.segurity123.repl.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date: Sun, 09 Oct 2022 18:44:10 GMT
Strict-Transport-Security: max-age=2628000 ; includeSubDomains
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Sat, 16 Jul 2022 01:45:50 GMT
Content-Language: en-US
Content-Type: image/svg+xml
X-OneAgent-JS-Injection: true
Cache-Control: no-cache="set-cookie, set-cookie2"
Access-Control-Allow-Origin: https://www.pcbac.com
Content-Length: 12499
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H/1.1 200
OK imagen-fondo-login.jpg
www.pcbac.com/web/img/ 1 MB
1 MB 2181ms
187ms Image
image/jpeg 201.131.122.35
BANCO AGRICOLA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.pcbac.com/web/img/imagen-fondo-login.jpg

Requested by

Host: helpfulknowingworkspace.segurity123.repl.co
URL: http://helpfulknowingworkspace.segurity123.repl.co/style/app.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

201.131.122.35 , El Salvador, ASN263695 (BANCO AGRICOLA, SV),

Reverse DNS

ns.pcbac.com

Software

Resource Hash

2f7a7b328ddb00fd5fd60c9d15eb464b694df54f5e813eeccc453d34b306ea9d

Security Headers

Name	Value
Strict-Transport-Security	max-age=2628000 ; includeSubDomains
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://helpfulknowingworkspace.segurity123.repl.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date: Sun, 09 Oct 2022 18:44:10 GMT
Strict-Transport-Security: max-age=2628000 ; includeSubDomains
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Sat, 16 Jul 2022 01:45:50 GMT
Content-Language: en-US
Content-Type: image/jpeg
X-OneAgent-JS-Injection: true
Cache-Control: no-cache="set-cookie, set-cookie2"
Access-Control-Allow-Origin: https://www.pcbac.com
Content-Length: 1155580
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H/1.1 200
OK arrow-right.svg
www.pcbac.com/web/img/ 1 KB
2 KB 2181ms
187ms Image
image/svg+xml 201.131.122.35
BANCO AGRICOLA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.pcbac.com/web/img/arrow-right.svg

Requested by

Host: helpfulknowingworkspace.segurity123.repl.co
URL: http://helpfulknowingworkspace.segurity123.repl.co/style/app.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

201.131.122.35 , El Salvador, ASN263695 (BANCO AGRICOLA, SV),

Reverse DNS

ns.pcbac.com

Software

Resource Hash

9e6dc804b2b4010497921b345c144aecd360e79d58acada1b61b9fd93aeb27a2

Security Headers

Name	Value
Strict-Transport-Security	max-age=2628000 ; includeSubDomains
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://helpfulknowingworkspace.segurity123.repl.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date: Sun, 09 Oct 2022 18:44:10 GMT
Strict-Transport-Security: max-age=2628000 ; includeSubDomains
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Sat, 16 Jul 2022 01:45:50 GMT
Content-Language: en-US
Content-Type: image/svg+xml
X-OneAgent-JS-Injection: true
Cache-Control: no-cache="set-cookie, set-cookie2"
Access-Control-Allow-Origin: https://www.pcbac.com
Content-Length: 1498
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H/1.1 200
OK pencil.svg
www.pcbac.com/web/img/ 1 KB
2 KB 2182ms
185ms Image
image/svg+xml 201.131.122.35
BANCO AGRICOLA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.pcbac.com/web/img/pencil.svg

Requested by

Host: helpfulknowingworkspace.segurity123.repl.co
URL: http://helpfulknowingworkspace.segurity123.repl.co/style/app.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

201.131.122.35 , El Salvador, ASN263695 (BANCO AGRICOLA, SV),

Reverse DNS

ns.pcbac.com

Software

Resource Hash

961f31ae8a32d930bf2be4688a8fa420d292c09c099db79ec86e128a4f9af4d1

Security Headers

Name	Value
Strict-Transport-Security	max-age=2628000 ; includeSubDomains
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://helpfulknowingworkspace.segurity123.repl.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date: Sun, 09 Oct 2022 18:44:10 GMT
Strict-Transport-Security: max-age=2628000 ; includeSubDomains
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Sat, 16 Jul 2022 01:45:50 GMT
Content-Language: en-US
Content-Type: image/svg+xml
X-OneAgent-JS-Injection: true
Cache-Control: no-cache="set-cookie, set-cookie2"
Access-Control-Allow-Origin: https://www.pcbac.com
Content-Length: 1269
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H/1.1 200
OK telephone-icon.svg
www.pcbac.com/web/img/ 3 KB
4 KB 2339ms
171ms Image
image/svg+xml 201.131.122.35
BANCO AGRICOLA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.pcbac.com/web/img/telephone-icon.svg

Requested by

Host: helpfulknowingworkspace.segurity123.repl.co
URL: http://helpfulknowingworkspace.segurity123.repl.co/style/app.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

201.131.122.35 , El Salvador, ASN263695 (BANCO AGRICOLA, SV),

Reverse DNS

ns.pcbac.com

Software

Resource Hash

3a1239f849d66ebdf10905da2b566e038a5f5601359982fbb82d99975f606e10

Security Headers

Name	Value
Strict-Transport-Security	max-age=2628000 ; includeSubDomains
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://helpfulknowingworkspace.segurity123.repl.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date: Sun, 09 Oct 2022 18:44:10 GMT
Strict-Transport-Security: max-age=2628000 ; includeSubDomains
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Sat, 16 Jul 2022 01:45:50 GMT
Content-Language: en-US
Content-Type: image/svg+xml
X-OneAgent-JS-Injection: true
Cache-Control: no-cache="set-cookie, set-cookie2"
Access-Control-Allow-Origin: https://www.pcbac.com
Content-Length: 3197
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H/1.1 200
OK negro.svg
www.pcbac.com/web/img/ 3 KB
4 KB 2161ms
185ms Image
image/svg+xml 201.131.122.35
BANCO AGRICOLA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.pcbac.com/web/img/negro.svg

Requested by

Host: helpfulknowingworkspace.segurity123.repl.co
URL: http://helpfulknowingworkspace.segurity123.repl.co/style/app.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

201.131.122.35 , El Salvador, ASN263695 (BANCO AGRICOLA, SV),

Reverse DNS

ns.pcbac.com

Software

Resource Hash

df4429dace07dd1341653a1762d1aceed7c32c33a971dc1d4d3b55bf6dcf6fef

Security Headers

Name	Value
Strict-Transport-Security	max-age=2628000 ; includeSubDomains
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://helpfulknowingworkspace.segurity123.repl.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date: Sun, 09 Oct 2022 18:44:10 GMT
Strict-Transport-Security: max-age=2628000 ; includeSubDomains
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Sat, 16 Jul 2022 01:45:50 GMT
Content-Language: en-US
Content-Type: image/svg+xml
X-OneAgent-JS-Injection: true
Cache-Control: no-cache="set-cookie, set-cookie2"
Access-Control-Allow-Origin: https://www.pcbac.com
Content-Length: 2714
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H/1.1 200
OK CIBFontSans-Light.ttf
helpfulknowingworkspace.segurity123.repl.co/style/font/ 108 KB
108 KB 243ms
242ms Font
font/ttf 34.149.204.188
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: http://helpfulknowingworkspace.segurity123.repl.co/style/font/CIBFontSans-Light.ttf
Requested by: Host: helpfulknowingworkspace.segurity123.repl.co
URL: http://helpfulknowingworkspace.segurity123.repl.co/style/app.css
Protocol: HTTP/1.1
Server: 34.149.204.188 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 188.204.149.34.bc.googleusercontent.com
Software: /
Resource Hash: decf1c3cb09b3e38d867e0d5cf648220584404c9cf8d18a6c51bdfa2af5047cc

Request headers

Referer: http://helpfulknowingworkspace.segurity123.repl.co/style/app.css
Origin: http://helpfulknowingworkspace.segurity123.repl.co
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date: Sun, 09 Oct 2022 18:44:08 GMT
Via: 1.1 google
Host: helpfulknowingworkspace.segurity123.repl.co
Replit-Cluster: global
Content-Length: 110612
Content-Type: font/ttf

GET
H/1.1 200
OK CIBFontSans-Bold.ttf
helpfulknowingworkspace.segurity123.repl.co/style/font/ 107 KB
107 KB 294ms
293ms Font
font/ttf 34.149.204.188
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: http://helpfulknowingworkspace.segurity123.repl.co/style/font/CIBFontSans-Bold.ttf
Requested by: Host: helpfulknowingworkspace.segurity123.repl.co
URL: http://helpfulknowingworkspace.segurity123.repl.co/style/app.css
Protocol: HTTP/1.1
Server: 34.149.204.188 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 188.204.149.34.bc.googleusercontent.com
Software: /
Resource Hash: f304e75fb39329f3997aa75b545565575f3f8ceab8c9e3f32c1c847812d8acd9

Request headers

Referer: http://helpfulknowingworkspace.segurity123.repl.co/style/app.css
Origin: http://helpfulknowingworkspace.segurity123.repl.co
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date: Sun, 09 Oct 2022 18:44:08 GMT
Via: 1.1 google
Host: helpfulknowingworkspace.segurity123.repl.co
Replit-Cluster: global
Content-Length: 109792
Content-Type: font/ttf

GET
H/1.1 200
OK OpenSans-Regular.ttf
helpfulknowingworkspace.segurity123.repl.co/style/font/ 212 KB
212 KB 312ms
311ms Font
font/ttf 34.149.204.188
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: http://helpfulknowingworkspace.segurity123.repl.co/style/font/OpenSans-Regular.ttf
Requested by: Host: helpfulknowingworkspace.segurity123.repl.co
URL: http://helpfulknowingworkspace.segurity123.repl.co/style/app.css
Protocol: HTTP/1.1
Server: 34.149.204.188 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 188.204.149.34.bc.googleusercontent.com
Software: /
Resource Hash: 13c03e22a633919beb2847c58c8285fb8a735ee97097d7c48fd403f8294b05f8

Request headers

Referer: http://helpfulknowingworkspace.segurity123.repl.co/style/app.css
Origin: http://helpfulknowingworkspace.segurity123.repl.co
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date: Sun, 09 Oct 2022 18:44:08 GMT
Via: 1.1 google
Host: helpfulknowingworkspace.segurity123.repl.co
Replit-Cluster: global
Content-Length: 217276
Content-Type: font/ttf

GET
H/1.1 200
OK OpenSans-SemiBold.ttf
helpfulknowingworkspace.segurity123.repl.co/style/font/ 216 KB
216 KB 287ms
287ms Font
font/ttf 34.149.204.188
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: http://helpfulknowingworkspace.segurity123.repl.co/style/font/OpenSans-SemiBold.ttf
Requested by: Host: helpfulknowingworkspace.segurity123.repl.co
URL: http://helpfulknowingworkspace.segurity123.repl.co/style/app.css
Protocol: HTTP/1.1
Server: 34.149.204.188 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 188.204.149.34.bc.googleusercontent.com
Software: /
Resource Hash: b4c2050b25d3d296d5cf58589ca00816dc72df42262c2f629d5c6a984a161aa4

Request headers

Referer: http://helpfulknowingworkspace.segurity123.repl.co/style/app.css
Origin: http://helpfulknowingworkspace.segurity123.repl.co
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date: Sun, 09 Oct 2022 18:44:08 GMT
Via: 1.1 google
Host: helpfulknowingworkspace.segurity123.repl.co
Replit-Cluster: global
Content-Length: 221164
Content-Type: font/ttf

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banco Agrícola (Banking)

34 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

helpfulknowingworkspace.segurity123.repl.co
www.pcbac.com
201.131.122.35
34.149.204.188
13c03e22a633919beb2847c58c8285fb8a735ee97097d7c48fd403f8294b05f8
2578ebc536f1fd6adac6629fa311a6aed7e6b12e7f52cf8fb13eedd8d9c71656
2e7ab9930bdc5f86491340b999396838c5c1e5a6cebf8289ca266d265e8345f6
2f7a7b328ddb00fd5fd60c9d15eb464b694df54f5e813eeccc453d34b306ea9d
3a1239f849d66ebdf10905da2b566e038a5f5601359982fbb82d99975f606e10
41ff7ea71edd1f8537b04146fb3b9b71391ce490fa5bddb8fe3d4a84435673bf
8bb72d28136c4f365c2f562aa95b5b1c86b55996d5915bc74990b25a36df2484
961f31ae8a32d930bf2be4688a8fa420d292c09c099db79ec86e128a4f9af4d1
9e6dc804b2b4010497921b345c144aecd360e79d58acada1b61b9fd93aeb27a2
b4c2050b25d3d296d5cf58589ca00816dc72df42262c2f629d5c6a984a161aa4
c92a3c915df8cc35e7a55be54cf022b77355d14705af9715a8def5fcf1a8b4db
ce9d07500ad91ec2b524c270764ec4c9a33e78320d8d374ec400ede488f6251b
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
decf1c3cb09b3e38d867e0d5cf648220584404c9cf8d18a6c51bdfa2af5047cc
df4429dace07dd1341653a1762d1aceed7c32c33a971dc1d4d3b55bf6dcf6fef
f304e75fb39329f3997aa75b545565575f3f8ceab8c9e3f32c1c847812d8acd9

helpfulknowingworkspace.segurity123.repl.co Open in urlscan Pro 34.149.204.188 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

16 Requests

44 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

2844 kBTransfer

2835 kBSize

0 Cookies

0 Outgoing links

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

34 JavaScript Global Variables

0 Cookies

Indicators

helpfulknowingworkspace.segurity123.repl.co Open in urlscan Pro
34.149.204.188 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

44 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

2844 kB
Transfer

2835 kB
Size

0
Cookies

16 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!