1e85c297-b172-4dd9-b7e4-2cbfb7492bb4-00-6sjqxc7ckyb9.spock.replit.dev
Open in
urlscan Pro
34.82.58.13
Malicious Activity!
Public Scan
URL:
https://1e85c297-b172-4dd9-b7e4-2cbfb7492bb4-00-6sjqxc7ckyb9.spock.replit.dev/
Submission: On October 03 via automatic, source openphish — Scanned from IT
Submission: On October 03 via automatic, source openphish — Scanned from IT
Summary
This website contacted 5 IPs
in 2 countries
across 5 domains to perform 12 HTTP transactions.
The main IP is 34.82.58.13, located in
The Dalles, United States and
belongs to GOOGLE-CLOUD-PLATFORM, US.
The main domain is 1e85c297-b172-4dd9-b7e4-2cbfb7492bb4-00-6sjqxc7ckyb9.spock.replit.dev.
TLS certificate: Issued by R10 on September 24th 2024. Valid for: 3 months.
This is the only time 1e85c297-b172-4dd9-b7e4-2cbfb7492bb4-00-6sjqxc7ckyb9.spock.replit.dev was scanned on urlscan.io!
TLS certificate: Issued by R10 on September 24th 2024. Valid for: 3 months.
This is the only time 1e85c297-b172-4dd9-b7e4-2cbfb7492bb4-00-6sjqxc7ckyb9.spock.replit.dev was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Banco de Venezuela (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 6 | 34.82.58.13 34.82.58.13 | 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM) | |
| 2 | 104.18.11.207 104.18.11.207 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
| 1 | 151.101.130.137 151.101.130.137 | 54113 (FASTLY) (FASTLY) | |
| 1 | 151.101.129.229 151.101.129.229 | 54113 (FASTLY) (FASTLY) | |
| 2 | 66.22.114.4 66.22.114.4 | 198949 (RADWARE) (RADWARE) | |
| 12 | 5 |
6
34.82.58.13
(The Dalles, United States)
ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 13.58.82.34.bc.googleusercontent.com
ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 13.58.82.34.bc.googleusercontent.com
| 1e85c297-b172-4dd9-b7e4-2cbfb7492bb4-00-6sjqxc7ckyb9.spock.replit.dev |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 6 |
replit.dev
1e85c297-b172-4dd9-b7e4-2cbfb7492bb4-00-6sjqxc7ckyb9.spock.replit.dev |
451 KB |
| 2 |
banvenez.com
bdvenlinea.banvenez.com — Cisco Umbrella Rank: 121699 |
4 KB |
| 2 |
bootstrapcdn.com
stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 3270 |
45 KB |
| 1 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 311 |
8 KB |
| 1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 791 |
24 KB |
| 12 | 5 |
| Domain | Requested by | |
|---|---|---|
| 6 | 1e85c297-b172-4dd9-b7e4-2cbfb7492bb4-00-6sjqxc7ckyb9.spock.replit.dev |
1e85c297-b172-4dd9-b7e4-2cbfb7492bb4-00-6sjqxc7ckyb9.spock.replit.dev
|
| 2 | bdvenlinea.banvenez.com | |
| 2 | stackpath.bootstrapcdn.com |
1e85c297-b172-4dd9-b7e4-2cbfb7492bb4-00-6sjqxc7ckyb9.spock.replit.dev
|
| 1 | cdn.jsdelivr.net |
1e85c297-b172-4dd9-b7e4-2cbfb7492bb4-00-6sjqxc7ckyb9.spock.replit.dev
|
| 1 | code.jquery.com |
1e85c297-b172-4dd9-b7e4-2cbfb7492bb4-00-6sjqxc7ckyb9.spock.replit.dev
|
| 12 | 5 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| *.spock.replit.dev R10 |
2024-09-24 - 2024-12-23 |
3 months | crt.sh |
| bootstrapcdn.com WE1 |
2024-09-20 - 2024-12-19 |
3 months | crt.sh |
| *.jquery.com Sectigo ECC Domain Validation Secure Server CA |
2024-06-25 - 2025-06-25 |
a year | crt.sh |
| jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2024 Q3 |
2024-07-30 - 2025-08-31 |
a year | crt.sh |
| bdvenlinea.banvenez.com Sectigo RSA Domain Validation Secure Server CA |
2024-03-20 - 2025-03-16 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://1e85c297-b172-4dd9-b7e4-2cbfb7492bb4-00-6sjqxc7ckyb9.spock.replit.dev/
Frame ID: E7011D8A0FE5C2AB67AE06AE17B4FD3E
Requests: 12 HTTP requests in this frame
Screenshot
Page Title
BDVenlínea personasDetected technologies
Bootstrap
(Web Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Google Font API
(Font Scripts)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
jsDelivr
(CDN)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- //cdn\.jsdelivr\.net/
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
/
1e85c297-b172-4dd9-b7e4-2cbfb7492bb4-00-6sjqxc7ckyb9.spock.replit.dev/ |
34 KB 34 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
css
1e85c297-b172-4dd9-b7e4-2cbfb7492bb4-00-6sjqxc7ckyb9.spock.replit.dev/index_files/ |
5 KB 5 KB |
Stylesheet
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bootstrap.min.css
stackpath.bootstrapcdn.com/bootstrap/4.4.1/css/ |
156 KB 27 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery-3.4.1.slim.min.js
code.jquery.com/ |
69 KB 24 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
popper.min.js
cdn.jsdelivr.net/npm/popper.js@1.16.0/dist/umd/ |
21 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bootstrap.min.js
stackpath.bootstrapcdn.com/bootstrap/4.4.1/js/ |
59 KB 18 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
styles.0170017f8b642b1668e6.css
1e85c297-b172-4dd9-b7e4-2cbfb7492bb4-00-6sjqxc7ckyb9.spock.replit.dev/index_files/ |
229 KB 229 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
61.45c700290e7f1ffd2936.js.descarga
1e85c297-b172-4dd9-b7e4-2cbfb7492bb4-00-6sjqxc7ckyb9.spock.replit.dev/index_files/ |
39 KB 39 KB |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
logo.png
1e85c297-b172-4dd9-b7e4-2cbfb7492bb4-00-6sjqxc7ckyb9.spock.replit.dev/index_files/ |
31 KB 32 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
background.jpg
1e85c297-b172-4dd9-b7e4-2cbfb7492bb4-00-6sjqxc7ckyb9.spock.replit.dev/assets/login/ |
111 KB 111 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
favicon-16x16.png
bdvenlinea.banvenez.com/assets/favicon/ |
677 B 2 KB |
Other
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
favicon-32x32.png
bdvenlinea.banvenez.com/assets/favicon/ |
1 KB 3 KB |
Other
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Banco de Venezuela (Banking)5 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery function| Popper object| bootstrap function| getIP0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
1e85c297-b172-4dd9-b7e4-2cbfb7492bb4-00-6sjqxc7ckyb9.spock.replit.dev
bdvenlinea.banvenez.com
cdn.jsdelivr.net
code.jquery.com
stackpath.bootstrapcdn.com
104.18.11.207
151.101.129.229
151.101.130.137
34.82.58.13
66.22.114.4
2504cdef62de2d64b21cb493d92260a40aae71c8c69eea7fc991f248f1133e41
2db48f3bb76be4f40a324525d4e872882f59208122f0ea552759eb76beb97d3a
2ff5b959fa9f6b4b1d04d20a37d706e90039176ab1e2a202994d9580baeebfd6
43d18e4fa9e275916b672a6c3118bcbd2824f944236dcc70a80ba4a705f1fa76
5aa53525abc5c5200c70b3f6588388f86076cd699284c23cda64e92c372a1548
a5ab2a00a0439854f8787a0dda775dea5377ef4905886505c938941d6854ee4f
acc00e65ce4998d1acc423b24a5098c770a4684859fa6af4b8d34d420fb0d20c
bc88981ffd1c2c5dca3d3ccd164e8dfc7701d27f101326f6930beb0fa6a95659
c776195ad46333c6c9a9fe3c74502ffea9a02faf122388ea3567922cc65a3060
caf9dc5a0ca32e0badc578b29175b67447cdbde638bb379c840bedd802c80710
dd2622b926546a377cd109701734fc6a9524ee3c7db1f2409cd57b893b7520de
f9bcc55b790b84873ed399aa0fa604cf9b9bec3b5a94b6869e6d00bb29ff72c3