pub-1c8ed89f0d6c419d9ec30e76f5b74e56.r2.dev Open in urlscan Pro
2606:4700::6812:223 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://t.co/uRbd9e6MRr
Effective URL:
https://pub-1c8ed89f0d6c419d9ec30e76f5b74e56.r2.dev/index.html
Submission: On August 13 via api (August 13th 2024, 11:42:47 pm UTC) from US — Scanned from GB

Summary HTTP 9 Redirects Links 12 Behaviour Indicators

Summary

This website contacted 5 IPs in 3 countries across 5 domains to perform 9 HTTP transactions. The main IP is 2606:4700::6812:223, located in United States and belongs to CLOUDFLARENET, US. The main domain is pub-1c8ed89f0d6c419d9ec30e76f5b74e56.r2.dev.
TLS certificate: Issued by E6 on August 1st 2024. Valid for: 3 months.

This is the only time pub-1c8ed89f0d6c419d9ec30e76f5b74e56.r2.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Intuit (Financial)

Domain & IP information

	IP Address	AS Autonomous System
1	93.184.221.165 93.184.221.165	15133 (EDGECAST) (EDGECAST)
2	185.138.42.191 185.138.42.191	199246 (TOPHOST) (TOPHOST)
1	2606:4700::68... 2606:4700::6812:223	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	34.75.151.117 34.75.151.117	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
9	5

1 93.184.221.165 (London, United Kingdom)

ASN15133 (EDGECAST, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.138.42.191 (Greece)

ASN199246 (TOPHOST, GR)
PTR: win67.grserver.gr

dionfelle.gr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:223 (United States)

ASN13335 (CLOUDFLARENET, US)

pub-1c8ed89f0d6c419d9ec30e76f5b74e56.r2.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 34.75.151.117 (North Charleston, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 117.151.75.34.bc.googleusercontent.com

1465ab03-9658-4034-8033-9432a0e7e953-00-1mvd01immaa1y.worf.replit.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	replit.dev 1465ab03-9658-4034-8033-9432a0e7e953-00-1mvd01immaa1y.worf.replit.dev	2 MB
2	dionfelle.gr dionfelle.gr	2 KB
1	r2.dev pub-1c8ed89f0d6c419d9ec30e76f5b74e56.r2.dev	531 KB
1	t.co t.co — Cisco Umbrella Rank: 979	555 B
0	swedbank.lt Failed www.swedbank.lt Failed
9	5

	Domain	Requested by
4	1465ab03-9658-4034-8033-9432a0e7e953-00-1mvd01immaa1y.worf.replit.dev	pub-1c8ed89f0d6c419d9ec30e76f5b74e56.r2.dev
2	dionfelle.gr	t.co
1	pub-1c8ed89f0d6c419d9ec30e76f5b74e56.r2.dev
1	t.co
0	www.swedbank.lt Failed
9	5

This site contains links to these domains. Also see Links.

Domain
quickbooks.intuit.com
mailchimp.com
turbotax.intuit.com
accounts-help.intuit.com
glam.app.intuit.com
www.intuit.com
www.google.com
security.intuit.com
help.quickbooks.intuit.com
accounts.intuit.com

Subject Issuer	Validity	Valid
t.co DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-05-08` - `2025-05-07`	a year	crt.sh
dionfelle.gr R10	`2024-08-03` - `2024-11-01`	3 months	crt.sh
*.r2.dev E6	`2024-08-01` - `2024-10-30`	3 months	crt.sh
*.worf.replit.dev R10	`2024-07-26` - `2024-10-24`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://pub-1c8ed89f0d6c419d9ec30e76f5b74e56.r2.dev/index.html
Frame ID: 0D692B1B205F20A3FEC132878D120302
Requests: 23 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

QuickBooks Online Login: Sign in to Access Your QuickBooks Account

Page URL History Show full URLs

https://t.co/uRbd9e6MRr Page URL
https://dionfelle.gr/mah/red/wx.htm Page URL
https://pub-1c8ed89f0d6c419d9ec30e76f5b74e56.r2.dev/index.html Page URL

Page Statistics

9
Requests

89 %
HTTPS

25 %
IPv6

5
Domains

5
Subdomains

5
IPs

3
Countries

2849 kB
Transfer

2891 kB
Size

1
Cookies

12 Outgoing links

These are links going to different origins than the main page.

URL: https://quickbooks.intuit.com/

Search URL Search Domain Scan URL

URL: https://mailchimp.com/

Search URL Search Domain Scan URL

URL: https://turbotax.intuit.com/

Search URL Search Domain Scan URL

URL: https://accounts-help.intuit.com/app/intuit/1995107
Title: Intuit Account

Search URL Search Domain Scan URL

URL: https://glam.app.intuit.com/app/guesttos?glocale=en_us
Title: Terms

Search URL Search Domain Scan URL

URL: https://www.intuit.com/privacy/statement/
Title: Privacy Statement

Search URL Search Domain Scan URL

URL: https://www.google.com/intl/en/policies/privacy/
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://www.google.com/intl/en/policies/terms/
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://www.intuit.com/legal/
Title: Legal

Search URL Search Domain Scan URL

URL: https://security.intuit.com/
Title: Security

Search URL Search Domain Scan URL

URL: https://help.quickbooks.intuit.com/en_US/contact?pageContext=login
Title: Support

Search URL Search Domain Scan URL

URL: https://accounts.intuit.com/terms-of-service
Title: Software License Agreement

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://t.co/uRbd9e6MRr Page URL
https://dionfelle.gr/mah/red/wx.htm Page URL
https://pub-1c8ed89f0d6c419d9ec30e76f5b74e56.r2.dev/index.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 15

https://1465ab03-9658-4034-8033-9432a0e7e953-00-1mvd01immaa1y.worf.replit.dev/init.php HTTP 0
https://www.swedbank.lt/private

9 HTTP transactions
14 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 uRbd9e6MRr Show response
t.co/ 262 B
555 B 251ms
153ms Document
text/html 93.184.221.165
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://t.co/uRbd9e6MRr

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.221.165 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

tsa_f /

Resource Hash

362eaf9aeb33788f4fc4dcd5fdf9f393e17c6f6b443ff010f7663ea136f163bc

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

cache-control: private,max-age=300
content-encoding: gzip
content-length: 185
content-type: text/html; charset=utf-8
date: Tue, 13 Aug 2024 23:42:40 GMT
expires: Tue, 13 Aug 2024 23:47:40 GMT
perf: 7402827104
server: tsa_f
strict-transport-security: max-age=0
vary: Origin
x-connection-hash: 743ee11c0ca13c0ceaceecb33b580c64ce4efc8ff3462e8b27a671110e95fc57
x-response-time: 120
x-transaction-id: c09356fe40016e4f
x-xss-protection: 0

GET
H2 200 wx.htm Show response
dionfelle.gr/mah/red/ 108 B
300 B 427ms
86ms Document
text/html 185.138.42.191
TOPHOST

General

Check archive.org

Show headers Download Go to

Full URL: https://dionfelle.gr/mah/red/wx.htm
Requested by: Host: t.co
URL: https://t.co/uRbd9e6MRr
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.138.42.191 , Greece, ASN199246 (TOPHOST, GR),
Reverse DNS: win67.grserver.gr
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: efa94351804807cce32ac414d2a9a555a67c4304a887d49d0ca35514d2a0229c

Request headers

Referer: https://t.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: br
content-length: 112
content-type: text/html
date: Tue, 13 Aug 2024 23:42:40 GMT
etag: "80e9707ab3edda1:0"
last-modified: Tue, 13 Aug 2024 19:03:27 GMT
server: Microsoft-IIS/10.0
vary: Accept-Encoding
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin

GET
H/1.1 200
OK Primary Request index.html Show response
pub-1c8ed89f0d6c419d9ec30e76f5b74e56.r2.dev/ 531 KB
531 KB 282ms
207ms Document
text/html 2606:4700::6812:223
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pub-1c8ed89f0d6c419d9ec30e76f5b74e56.r2.dev/index.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2d6ee1def5db7bf17722e03e97491e57d68801bc15371ec4168ef57865d37a26

Request headers

Referer: https://dionfelle.gr/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Accept-Ranges: bytes
CF-RAY: 8b2c90227b4e950b-LHR
Connection: keep-alive
Content-Length: 543797
Content-Type: text/html
Date: Tue, 13 Aug 2024 23:42:41 GMT
ETag: "42a3d57434f01ef2bd6d9ea41010e4bc"
Last-Modified: Tue, 13 Aug 2024 18:43:22 GMT
Server: cloudflare
Vary: Accept-Encoding

GET
H2 200 favicon.ico
dionfelle.gr/ 1 KB
1 KB 86ms
85ms Other
image/x-icon 185.138.42.191
TOPHOST

General

Check archive.org

Show headers Download Go to

Full URL: https://dionfelle.gr/favicon.ico
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.138.42.191 , Greece, ASN199246 (TOPHOST, GR),
Reverse DNS: win67.grserver.gr
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash

Request headers

Referer: https://dionfelle.gr/mah/red/wx.htm
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

x-powered-by-plesk: PleskWin
date: Tue, 13 Aug 2024 23:42:40 GMT
last-modified: Sat, 03 Aug 2024 12:15:36 GMT
server: Microsoft-IIS/10.0
etag: "109e77d89ee5da1:0"
x-powered-by: ASP.NET
content-type: image/x-icon
accept-ranges: bytes
content-length: 1150

GET
DATA 200
OK truncated
/ 527 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d2914873b554e478c32de29a12419313e80b29095402bf03a0193af382e1542e

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 82ca8cd60e5ecda336a08c16ac17d81962736bb628814f35c10cb8c15aaab448

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d3bd22b6db2516bc94148940e76db7ffe7a6cf3c4f3da9fe6526e72a38c36d26

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 4 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a425f6304622d3a56fa1a47c518f9c421e4b6ca071acb6e4c26cd48a9b4f9d72

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 390 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9e0407667016e9ef2ce75f20e0fdca6a4896f8b3dadb04bf0e4439c1a75de98d

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 33 KB
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9ffa0a23d6d5606bdc5a8f99ebb867c2e3c2f58c3d7db895c6c92f145353dfd7

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: image/gif

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d1e4205c798359f751354ef999d11fda4113e4a8d1f8180c8e399f38387b7348

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 044541c8fb1fa2e3cff245f4c2ea764cd3afc339753914d4ea358b4db29e4efc

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H/1.1 200
OK serveCSS.php Show response
1465ab03-9658-4034-8033-9432a0e7e953-00-1mvd01immaa1y.worf.replit.dev/styles/ 882 KB
883 KB 484ms
125ms Fetch
text/css 34.75.151.117
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://1465ab03-9658-4034-8033-9432a0e7e953-00-1mvd01immaa1y.worf.replit.dev/styles/serveCSS.php?file=style2.css
Requested by: Host: pub-1c8ed89f0d6c419d9ec30e76f5b74e56.r2.dev
URL: https://pub-1c8ed89f0d6c419d9ec30e76f5b74e56.r2.dev/index.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.75.151.117 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 117.151.75.34.bc.googleusercontent.com
Software: / PHP/8.2.0RC7
Resource Hash: b116d95914c7935b7a4dfbdff2ed9068518250229ab8413f381a37edf2e95706

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date: Tue, 13 Aug 2024 23:42:41 GMT
Host: 1465ab03-9658-4034-8033-9432a0e7e953-00-1mvd01immaa1y.worf.replit.dev
X-Powered-By: PHP/8.2.0RC7
Transfer-Encoding: chunked
Access-Control-Allow-Methods: GET
Content-Type: text/css;charset=UTF-8
Access-Control-Allow-Origin: *
Replit-Cluster: worf
Access-Control-Allow-Headers: Content-Type
X-Robots-Tag: none, noindex, noarchive, nofollow, nositelinkssearchbox, noimageindex, none, noindex, noarchive, nofollow, nositelinkssearchbox, noimageindex

GET
H/1.1 200
OK serveCSS.php Show response
1465ab03-9658-4034-8033-9432a0e7e953-00-1mvd01immaa1y.worf.replit.dev/styles/ 99 KB
99 KB 487ms
128ms Fetch
text/css 34.75.151.117
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://1465ab03-9658-4034-8033-9432a0e7e953-00-1mvd01immaa1y.worf.replit.dev/styles/serveCSS.php?file=style3.css
Requested by: Host: pub-1c8ed89f0d6c419d9ec30e76f5b74e56.r2.dev
URL: https://pub-1c8ed89f0d6c419d9ec30e76f5b74e56.r2.dev/index.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.75.151.117 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 117.151.75.34.bc.googleusercontent.com
Software: / PHP/8.2.0RC7
Resource Hash: c4e5897973c043950a1c4638faf22ce4e0ba877df4047996bdd92a6f2024c20b

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date: Tue, 13 Aug 2024 23:42:41 GMT
Host: 1465ab03-9658-4034-8033-9432a0e7e953-00-1mvd01immaa1y.worf.replit.dev
X-Powered-By: PHP/8.2.0RC7
Transfer-Encoding: chunked
Access-Control-Allow-Methods: GET
Content-Type: text/css;charset=UTF-8
Access-Control-Allow-Origin: *
Replit-Cluster: worf
Access-Control-Allow-Headers: Content-Type
X-Robots-Tag: none, noindex, noarchive, nofollow, nositelinkssearchbox, noimageindex, none, noindex, noarchive, nofollow, nositelinkssearchbox, noimageindex

GET
H/1.1 200
OK serveCSS.php Show response
1465ab03-9658-4034-8033-9432a0e7e953-00-1mvd01immaa1y.worf.replit.dev/styles/ 540 KB
541 KB 627ms
266ms Fetch
text/css 34.75.151.117
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://1465ab03-9658-4034-8033-9432a0e7e953-00-1mvd01immaa1y.worf.replit.dev/styles/serveCSS.php?file=style1.css
Requested by: Host: pub-1c8ed89f0d6c419d9ec30e76f5b74e56.r2.dev
URL: https://pub-1c8ed89f0d6c419d9ec30e76f5b74e56.r2.dev/index.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.75.151.117 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 117.151.75.34.bc.googleusercontent.com
Software: / PHP/8.2.0RC7
Resource Hash: 78a3ddbbbb78d5880d6df5cf9c19939d398187e62850d5ba174701dbcb5ab20f

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date: Tue, 13 Aug 2024 23:42:41 GMT
Host: 1465ab03-9658-4034-8033-9432a0e7e953-00-1mvd01immaa1y.worf.replit.dev
X-Powered-By: PHP/8.2.0RC7
Transfer-Encoding: chunked
Access-Control-Allow-Methods: GET
Content-Type: text/css;charset=UTF-8
Access-Control-Allow-Origin: *
Replit-Cluster: worf
Access-Control-Allow-Headers: Content-Type
X-Robots-Tag: none, noindex, noarchive, nofollow, nositelinkssearchbox, noimageindex, none, noindex, noarchive, nofollow, nositelinkssearchbox, noimageindex

GET
H/1.1 200
OK serveCSS.php Show response
1465ab03-9658-4034-8033-9432a0e7e953-00-1mvd01immaa1y.worf.replit.dev/styles/ 677 KB
678 KB 627ms
261ms Fetch
text/css 34.75.151.117
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://1465ab03-9658-4034-8033-9432a0e7e953-00-1mvd01immaa1y.worf.replit.dev/styles/serveCSS.php?file=style4.css
Requested by: Host: pub-1c8ed89f0d6c419d9ec30e76f5b74e56.r2.dev
URL: https://pub-1c8ed89f0d6c419d9ec30e76f5b74e56.r2.dev/index.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.75.151.117 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 117.151.75.34.bc.googleusercontent.com
Software: / PHP/8.2.0RC7
Resource Hash: 893b42db1bf7cf90bf8c6b4a073d2b8cb4981c067a0ef72512b1e43b5cc5062b

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date: Tue, 13 Aug 2024 23:42:41 GMT
Host: 1465ab03-9658-4034-8033-9432a0e7e953-00-1mvd01immaa1y.worf.replit.dev
X-Powered-By: PHP/8.2.0RC7
Transfer-Encoding: chunked
Access-Control-Allow-Methods: GET
Content-Type: text/css;charset=UTF-8
Access-Control-Allow-Origin: *
Replit-Cluster: worf
Access-Control-Allow-Headers: Content-Type
X-Robots-Tag: none, noindex, noarchive, nofollow, nositelinkssearchbox, noimageindex, none, noindex, noarchive, nofollow, nositelinkssearchbox, noimageindex

GET

private
www.swedbank.lt/
Redirect Chain

https://1465ab03-9658-4034-8033-9432a0e7e953-00-1mvd01immaa1y.worf.replit.dev/init.php
https://www.swedbank.lt/private

0
0

GET
DATA 200
OK truncated
/ 475 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e7f8cdeb6987f67c9c1d77af30a70856813c61b4e9b3043f0e57b5b9325d7a39

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 9 KB
9 KB Font
font/woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d565ece548de79abdcab7ec7b6f87742353ab6f26debdbb8567d8461b32d338e

Request headers

Referer
Origin: https://pub-1c8ed89f0d6c419d9ec30e76f5b74e56.r2.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: font/woff2

GET
DATA 200
OK truncated
/ 9 KB
9 KB Font
font/woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c8278b56794c389919d388951c5fa4dc07a388e16eb7055d675b0b916acc70e5

Request headers

Referer
Origin: https://pub-1c8ed89f0d6c419d9ec30e76f5b74e56.r2.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: font/woff2

GET
DATA 200
OK truncated
/ 32 KB
32 KB Font
font/woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b406c35a6d317b896aef159ce69f94480e3e690a9e5f2bfab4fb8311b767a9b0

Request headers

Referer
Origin: https://pub-1c8ed89f0d6c419d9ec30e76f5b74e56.r2.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: font/woff2

GET
DATA 200
OK truncated
/ 32 KB
32 KB Font
font/woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a496f0a5fc51aac0cac43be7e4c6a81425194480f138a7a97e895071fd628260

Request headers

Referer
Origin: https://pub-1c8ed89f0d6c419d9ec30e76f5b74e56.r2.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: font/woff2

GET
DATA 200
OK truncated
/ 32 KB
32 KB Font
font/woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6b59034d520321abc96ed69ffbe45f00feade7c66ac3bcf99e3ba51059f2a2a2

Request headers

Referer
Origin: https://pub-1c8ed89f0d6c419d9ec30e76f5b74e56.r2.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: font/woff2

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.swedbank.lt
URL: https://www.swedbank.lt/private

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Intuit (Financial)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.t.co/	1970-01-21 08:16:46	Name: muc Value: eb1819e4-e845-4603-9717-7caa082dd2db

6 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	warning	URL: https://pub-1c8ed89f0d6c419d9ec30e76f5b74e56.r2.dev/index.html Message: [DOM] Found 7 elements with non-unique id #idsTab-EMAIL_USER_ID: (More info: https://goo.gl/9p2vKq) %o %o %o %o %o %o %o
recommendation	warning	URL: https://pub-1c8ed89f0d6c419d9ec30e76f5b74e56.r2.dev/index.html Message: [DOM] Found 8 elements with non-unique id #iux-identifier-first-international-email-user-id-input: (More info: https://goo.gl/9p2vKq) %o %o %o %o %o %o %o %o
recommendation	verbose	URL: https://pub-1c8ed89f0d6c419d9ec30e76f5b74e56.r2.dev/index.html Message: [DOM] Password field is not contained in a form: (More info: https://goo.gl/9p2vKq) %o
recommendation	verbose	URL: https://pub-1c8ed89f0d6c419d9ec30e76f5b74e56.r2.dev/index.html Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o
recommendation	verbose	URL: https://pub-1c8ed89f0d6c419d9ec30e76f5b74e56.r2.dev/index.html Message: [DOM] Input elements should have autocomplete attributes (suggested: "new-password"): (More info: https://goo.gl/9p2vKq) %o
security	error	URL: https://pub-1c8ed89f0d6c419d9ec30e76f5b74e56.r2.dev/index.html Message: Refused to connect to 'https://www.swedbank.lt/private' because it violates the following Content Security Policy directive: "connect-src 'self' data: https://1465ab03-9658-4034-8033-9432a0e7e953-00-1mvd01immaa1y.worf.replit.dev".

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=0
X-Xss-Protection	0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

1465ab03-9658-4034-8033-9432a0e7e953-00-1mvd01immaa1y.worf.replit.dev
dionfelle.gr
pub-1c8ed89f0d6c419d9ec30e76f5b74e56.r2.dev
t.co
www.swedbank.lt
www.swedbank.lt
185.138.42.191
2606:4700::6812:223
34.75.151.117
93.184.221.165
044541c8fb1fa2e3cff245f4c2ea764cd3afc339753914d4ea358b4db29e4efc
2d6ee1def5db7bf17722e03e97491e57d68801bc15371ec4168ef57865d37a26
362eaf9aeb33788f4fc4dcd5fdf9f393e17c6f6b443ff010f7663ea136f163bc
6b59034d520321abc96ed69ffbe45f00feade7c66ac3bcf99e3ba51059f2a2a2
78a3ddbbbb78d5880d6df5cf9c19939d398187e62850d5ba174701dbcb5ab20f
82ca8cd60e5ecda336a08c16ac17d81962736bb628814f35c10cb8c15aaab448
893b42db1bf7cf90bf8c6b4a073d2b8cb4981c067a0ef72512b1e43b5cc5062b
9e0407667016e9ef2ce75f20e0fdca6a4896f8b3dadb04bf0e4439c1a75de98d
9ffa0a23d6d5606bdc5a8f99ebb867c2e3c2f58c3d7db895c6c92f145353dfd7
a425f6304622d3a56fa1a47c518f9c421e4b6ca071acb6e4c26cd48a9b4f9d72
a496f0a5fc51aac0cac43be7e4c6a81425194480f138a7a97e895071fd628260
b116d95914c7935b7a4dfbdff2ed9068518250229ab8413f381a37edf2e95706
b406c35a6d317b896aef159ce69f94480e3e690a9e5f2bfab4fb8311b767a9b0
c4e5897973c043950a1c4638faf22ce4e0ba877df4047996bdd92a6f2024c20b
c8278b56794c389919d388951c5fa4dc07a388e16eb7055d675b0b916acc70e5
d1e4205c798359f751354ef999d11fda4113e4a8d1f8180c8e399f38387b7348
d2914873b554e478c32de29a12419313e80b29095402bf03a0193af382e1542e
d3bd22b6db2516bc94148940e76db7ffe7a6cf3c4f3da9fe6526e72a38c36d26
d565ece548de79abdcab7ec7b6f87742353ab6f26debdbb8567d8461b32d338e
e7f8cdeb6987f67c9c1d77af30a70856813c61b4e9b3043f0e57b5b9325d7a39
efa94351804807cce32ac414d2a9a555a67c4304a887d49d0ca35514d2a0229c

pub-1c8ed89f0d6c419d9ec30e76f5b74e56.r2.dev Open in urlscan Pro 2606:4700::6812:223 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

9 Requests

89 %HTTPS

25 %IPv6

5 Domains

5 Subdomains

5 IPs

3 Countries

2849 kBTransfer

2891 kBSize

1 Cookies

12 Outgoing links

Page URL History

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 14 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

10 JavaScript Global Variables

1 Cookies

6 Console Messages

Security Headers

Indicators

pub-1c8ed89f0d6c419d9ec30e76f5b74e56.r2.dev Open in urlscan Pro
2606:4700::6812:223 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

89 %
HTTPS

25 %
IPv6

5
Domains

5
Subdomains

5
IPs

3
Countries

2849 kB
Transfer

2891 kB
Size

1
Cookies

9 HTTP transactions
14 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!