*.repl.co

Phishing C&C Exfiltration Download

Attackers can use *.repl.co to host their phishing websites.

Attackers can use a customized subdomain of repl.co as their C&C server.

Attackers can add upload functionalities hosted on *.repl.co and exfiltrate data on there.

Attackers can host their malicious tools on an external provider and then use *.repl.co to fetch the files.

https://www.joesandbox.com/analysis/487279/0/html