urlscan.io logo urlscan.io
SecurityTrails logo

15590f63-0bb5-4e64-b550-f42bb2c2516c-00-1agpqj3bdmahm.worf.replit.dev Open in urlscan Pro
34.75.151.117  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://15590f63-0bb5-4e64-b550-f42bb2c2516c-00-1agpqj3bdmahm.worf.replit.dev/
Submission: On February 20 via api from IL — Scanned from JP
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 2 countries across 4 domains to perform 4 HTTP transactions. The main IP is 34.75.151.117, located in North Charleston, United States and belongs to GOOGLE-CLOUD-PLATFORM, US. The main domain is 15590f63-0bb5-4e64-b550-f42bb2c2516c-00-1agpqj3bdmahm.worf.replit.dev.
TLS certificate: Issued by R3 on January 24th 2024. Valid for: 3 months.
This is the only time 15590f63-0bb5-4e64-b550-f42bb2c2516c-00-1agpqj3bdmahm.worf.replit.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banco de la Provincia de Buenos Aires (Banking)

Domain & IP information

IP Address AS Autonomous System
1 34.75.151.117 396982 (GOOGLE-CL...)
1 181.191.187.17 265806 (BANCO DE ...)
1 181.191.186.34 265806 (BANCO DE ...)
1 2a04:4e42::485 54113 (FASTLY)
4 5
Domain Requested by
1 cdn.jsdelivr.net 15590f63-0bb5-4e64-b550-f42bb2c2516c-00-1agpqj3bdmahm.worf.replit.dev
1 www.bancoprovincia.bancainternet.com.ar 15590f63-0bb5-4e64-b550-f42bb2c2516c-00-1agpqj3bdmahm.worf.replit.dev
1 www.bancoprovincia.com.ar 15590f63-0bb5-4e64-b550-f42bb2c2516c-00-1agpqj3bdmahm.worf.replit.dev
1 15590f63-0bb5-4e64-b550-f42bb2c2516c-00-1agpqj3bdmahm.worf.replit.dev
4 4

This site contains no links.

Subject Issuer Validity Valid
*.worf.replit.dev
R3		 2024-01-24 -
2024-04-23		 3 months crt.sh
www.bancoprovincia.com.ar
Sectigo RSA Extended Validation Secure Server CA		 2024-01-12 -
2025-01-31		 a year crt.sh
www.bancoprovincia.bancainternet.com.ar
Sectigo RSA Extended Validation Secure Server CA		 2023-10-26 -
2024-11-12		 a year crt.sh
jsdelivr.net
GlobalSign Atlas R3 DV TLS CA 2023 Q3		 2023-09-27 -
2024-10-28		 a year crt.sh

This page contains 1 frames:

Primary Page: https://15590f63-0bb5-4e64-b550-f42bb2c2516c-00-1agpqj3bdmahm.worf.replit.dev/
Frame ID: 26EA0C568054B65AF685089206BE6143
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Login Form

Detected technologies

Overall confidence: 100%
Detected patterns
  • /axios(@|/)([\d.]+)(?:/[a-z]+)?/axios(?:.min)?\.js
Overall confidence: 100%
Detected patterns
  • //cdn\.jsdelivr\.net/

Page Statistics

4
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

5
IPs

2
Countries

112 kB
Transfer

140 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
15590f63-0bb5-4e64-b550-f42bb2c2516c-00-1agpqj3bdmahm.worf.replit.dev/ 		23 KB
24 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://15590f63-0bb5-4e64-b550-f42bb2c2516c-00-1agpqj3bdmahm.worf.replit.dev/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
34.75.151.117 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
117.151.75.34.bc.googleusercontent.com
Software
/
Resource Hash
fbfb91dfe7624c30cd24461a50d4ec35511efb5054949564922595b0ccd53d72

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
accept-language
jp-JP,jp;q=0.9

Response headers

Content-Length
23999
Content-Type
text/html; charset=UTF-8
Date
Tue, 20 Feb 2024 14:29:50 GMT
Host
15590f63-0bb5-4e64-b550-f42bb2c2516c-00-1agpqj3bdmahm.worf.replit.dev
Replit-Cluster
worf
X-Robots-Tag
none, noindex, noarchive, nofollow, nositelinkssearchbox, noimageindex none, noindex, noarchive, nofollow, nositelinkssearchbox, noimageindex
logo_mobile_bip
www.bancoprovincia.com.ar/CDN/Get/ 		6 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bancoprovincia.com.ar/CDN/Get/logo_mobile_bip
Requested by
Host: 15590f63-0bb5-4e64-b550-f42bb2c2516c-00-1agpqj3bdmahm.worf.replit.dev
URL: https://15590f63-0bb5-4e64-b550-f42bb2c2516c-00-1agpqj3bdmahm.worf.replit.dev/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
181.191.187.17 Buenos Aires, Argentina, ASN265806 (BANCO DE LA PROVINCIA DE BUENOS AIRES, AR),
Reverse DNS
jxnet.bancoprovincia.com.ar
Software
nginx / ASP.NET
Resource Hash
bd7f1be0f6563bb760345728beb5523d71117903c2693faf17a09e5a8929b418

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://15590f63-0bb5-4e64-b550-f42bb2c2516c-00-1agpqj3bdmahm.worf.replit.dev/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Date
Tue, 20 Feb 2024 14:29:53 GMT
X-AspNetMvc-Version
3.0
Last-Modified
Tue, 20 Feb 2024 14:29:53 GMT
Server
nginx
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Vary
*
Content-Type
image/svg+xml
Access-Control-Allow-Origin
*
Cache-Control
public, no-cache="Set-Cookie", max-age=900,public
Connection
keep-alive
Content-Length
6158
Expires
Tue, 20 Feb 2024 14:44:53 GMT
login-ef23bd4d.png
www.bancoprovincia.bancainternet.com.ar/spa/assets/ 		70 KB
71 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bancoprovincia.bancainternet.com.ar/spa/assets/login-ef23bd4d.png
Requested by
Host: 15590f63-0bb5-4e64-b550-f42bb2c2516c-00-1agpqj3bdmahm.worf.replit.dev
URL: https://15590f63-0bb5-4e64-b550-f42bb2c2516c-00-1agpqj3bdmahm.worf.replit.dev/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
181.191.186.34 Buenos Aires, Argentina, ASN265806 (BANCO DE LA PROVINCIA DE BUENOS AIRES, AR),
Reverse DNS
Software
/
Resource Hash
ef23bd4df94bc553e61e5ec91431691a0d342bfa73864765ca1d98eda71b24de
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' http://localhost https://localhost https://*.bancoprovincia.bancainternet.com.ar bipmovil://*.bancoprovincia.bancainternet.com.ar
Strict-Transport-Security max-age=63072000; includeSubdomains; preload

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://15590f63-0bb5-4e64-b550-f42bb2c2516c-00-1agpqj3bdmahm.worf.replit.dev/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Date
Tue, 20 Feb 2024 14:29:52 GMT
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Content-Security-Policy
frame-ancestors 'self' http://localhost https://localhost https://*.bancoprovincia.bancainternet.com.ar bipmovil://*.bancoprovincia.bancainternet.com.ar
Last-Modified
Thu, 15 Feb 2024 22:13:16 GMT
Content-Type
image/png
Cache-Control
max-age=2592000
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=15, max=10000
Content-Length
72066
Expires
Thu, 21 Mar 2024 14:29:52 GMT
truncated
/ 		14 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
78a42f1f11ae671f704b937fd7ae1d5fc6e0fa27d3dab1efa1c4f10f42418135

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Content-Type
image/png
axios.min.js
cdn.jsdelivr.net/npm/axios@1.1.2/dist/ 		26 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/axios@1.1.2/dist/axios.min.js
Requested by
Host: 15590f63-0bb5-4e64-b550-f42bb2c2516c-00-1agpqj3bdmahm.worf.replit.dev
URL: https://15590f63-0bb5-4e64-b550-f42bb2c2516c-00-1agpqj3bdmahm.worf.replit.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42::485 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
ffb6e270a7bbb1ea1b797965ae85e35760b38b98744478a4151ddee79a31d215
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://15590f63-0bb5-4e64-b550-f42bb2c2516c-00-1agpqj3bdmahm.worf.replit.dev/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Tue, 20 Feb 2024 14:29:50 GMT
x-content-type-options
nosniff
content-encoding
br
age
2453273
x-jsd-version
1.1.2
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
10349
x-served-by
cache-fra-eddf8230112-FRA, cache-nrt-rjtf7700043-NRT
x-jsd-version-type
version
etag
W/"67d4-ae22gWc+WteU0z+fBbiwjqlAwTs"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges
bytes
timing-allow-origin
*

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banco de la Provincia de Buenos Aires (Banking)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| axios

0 Cookies