www.onliineaabaanxxia.com Open in urlscan Pro
172.67.157.91 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.onliineaabaanxxia.com/index2.php
Submission: On April 06 via api (April 6th 2024, 7:59:50 pm UTC) from HU — Scanned from JP

Summary HTTP 11 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 11 HTTP transactions. The main IP is 172.67.157.91, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.onliineaabaanxxia.com.
TLS certificate: Issued by GTS CA 1P5 on April 6th 2024. Valid for: 3 months.

This is the only time www.onliineaabaanxxia.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banco Galicia (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1	172.67.157.91 172.67.157.91	13335 (CLOUDFLAR...) (CLOUDFLARENET)
9	161.190.1.97 161.190.1.97	13474 (Banco de ...) (Banco de Galicia y Buenos Aires)
1	151.101.131.10 151.101.131.10	54113 (FASTLY) (FASTLY)
11	3

1 172.67.157.91 (United States)

ASN13335 (CLOUDFLARENET, US)

www.onliineaabaanxxia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 161.190.1.97 (Buenos Aires, Argentina)

ASN13474 (Banco de Galicia y Buenos Aires, AR)
PTR: prestamos.bancogalicia.com.ar

onlinebanking.bancogalicia.com.ar	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.131.10 (United States)

ASN54113 (FASTLY, US)

www.galicia.ar	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	bancogalicia.com.ar onlinebanking.bancogalicia.com.ar	328 KB
1	galicia.ar www.galicia.ar	406 KB
1	onliineaabaanxxia.com www.onliineaabaanxxia.com	4 KB
11	3

	Domain	Requested by
9	onlinebanking.bancogalicia.com.ar	www.onliineaabaanxxia.com onlinebanking.bancogalicia.com.ar
1	www.galicia.ar	www.onliineaabaanxxia.com
1	www.onliineaabaanxxia.com
11	3

This site contains no links.

Subject Issuer	Validity	Valid
onliineaabaanxxia.com GTS CA 1P5	`2024-04-06` - `2024-07-05`	3 months	crt.sh
onlinebanking.bancogalicia.com.ar DigiCert EV RSA CA G2	`2023-09-19` - `2024-09-18`	a year	crt.sh
www.galicia.ar DigiCert EV RSA CA G2	`2024-03-06` - `2025-03-05`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.onliineaabaanxxia.com/index2.php
Frame ID: A33BBD42C22EE244228541526F46ADAA
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

OnlineBanking-GaliciaAr

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Page Statistics

11
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

738 kB
Transfer

1933 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3 200 Primary Request index2.php Show response
www.onliineaabaanxxia.com/ 16 KB
4 KB 592ms
575ms Document
text/html 172.67.157.91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.onliineaabaanxxia.com/index2.php

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.157.91 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PHP/8.1.27

Resource Hash

6874c54984380f90054a23d521754d213d1a0af775938031c488d619aa61d1d9

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
accept-language: jp-JP,jp;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 87045c182a77b00b-NRT
content-encoding: br
content-security-policy: upgrade-insecure-requests
content-type: text/html; charset=UTF-8
date: Sat, 06 Apr 2024 19:59:41 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
platform: hostinger
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=M%2FaQJ9e22pZlu025RH3ks5o1SLwaIkDE9USfCRLARfh1TbODhxE07LbRrdInWEBWlLWusmAY6AZIXDXngTqTkKS6zC8hcD455VCLZbESpSv1wd12K2RaRETkj7a8BuN%2FihVKj%2FcdGJnc9cJI"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-powered-by: PHP/8.1.27
x-turbo-charged-by: LiteSpeed

GET
H/1.1 200
OK bootstrap.min.css
onlinebanking.bancogalicia.com.ar/Content/ 121 KB
20 KB 1986ms
572ms Stylesheet
text/css 161.190.1.97
Banco de Galicia ...

General

Check archive.org

Show headers Download Go to

Full URL: https://onlinebanking.bancogalicia.com.ar/Content/bootstrap.min.css?v=638403167483260000
Requested by: Host: www.onliineaabaanxxia.com
URL: https://www.onliineaabaanxxia.com/index2.php
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 161.190.1.97 Buenos Aires, Argentina, ASN13474 (Banco de Galicia y Buenos Aires, AR),
Reverse DNS: prestamos.bancogalicia.com.ar
Software: /
Resource Hash: 38c2ceafd2e0319b0249ad97ab59932dd54971afd9422bb5bbff40ab7069d763

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://www.onliineaabaanxxia.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Date: Sat, 06 Apr 2024 19:59:42 GMT
Content-Encoding: gzip
Last-Modified: Mon, 08 Jan 2024 16:19:08 GMT
ETag: "066f7674e42da1:0"
Vary: Accept-Encoding
Access-Control-Allow-Methods: POST,GET,OPTIONS,PUT,DELETE
Content-Type: text/css
Access-Control-Allow-Origin: *
Accept-Ranges: bytes
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Content-Length: 20009

GET
H/1.1 200
OK default.min.css
onlinebanking.bancogalicia.com.ar/Content/ 1 MB
137 KB 2003ms
581ms Stylesheet
text/css 161.190.1.97
Banco de Galicia ...

General

Check archive.org

Show headers Download Go to

Full URL: https://onlinebanking.bancogalicia.com.ar/Content/default.min.css?v=638403167776170000
Requested by: Host: www.onliineaabaanxxia.com
URL: https://www.onliineaabaanxxia.com/index2.php
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 161.190.1.97 Buenos Aires, Argentina, ASN13474 (Banco de Galicia y Buenos Aires, AR),
Reverse DNS: prestamos.bancogalicia.com.ar
Software: /
Resource Hash: 736aad864d65690df8844fccb3503b89d2808f370def52c92073bd040acfda2a

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://www.onliineaabaanxxia.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Date: Sat, 06 Apr 2024 19:59:42 GMT
Content-Encoding: gzip
Last-Modified: Mon, 08 Jan 2024 16:19:37 GMT
ETag: "807240794e42da1:0"
Vary: Accept-Encoding
Access-Control-Allow-Methods: POST,GET,OPTIONS,PUT,DELETE
Content-Type: text/css
Access-Control-Allow-Origin: *
Accept-Ranges: bytes
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Content-Length: 139821

GET
H/1.1 200
OK keyboard.css
onlinebanking.bancogalicia.com.ar/Content/Keyboard/ 492 B
857 B 1737ms
298ms Stylesheet
text/css 161.190.1.97
Banco de Galicia ...

General

Check archive.org

Show headers Download Go to

Full URL: https://onlinebanking.bancogalicia.com.ar/Content/Keyboard/keyboard.css?v=638403167486890000
Requested by: Host: www.onliineaabaanxxia.com
URL: https://www.onliineaabaanxxia.com/index2.php
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 161.190.1.97 Buenos Aires, Argentina, ASN13474 (Banco de Galicia y Buenos Aires, AR),
Reverse DNS: prestamos.bancogalicia.com.ar
Software: /
Resource Hash: 612a237e8ee113c28afb5b58bce39eed244dc31b6d2127b45da334edca204b85

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://www.onliineaabaanxxia.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Date: Sat, 06 Apr 2024 19:59:42 GMT
Last-Modified: Mon, 08 Jan 2024 16:19:08 GMT
ETag: "108860684e42da1:0"
Access-Control-Allow-Methods: POST,GET,OPTIONS,PUT,DELETE
Content-Type: text/css
Access-Control-Allow-Origin: *
Accept-Ranges: bytes
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Content-Length: 492

GET
H/1.1 200
OK simple-keyboard.css
onlinebanking.bancogalicia.com.ar/Content/Keyboard/ 3 KB
1 KB 1703ms
290ms Stylesheet
text/css 161.190.1.97
Banco de Galicia ...

General

Check archive.org

Show headers Download Go to

Full URL: https://onlinebanking.bancogalicia.com.ar/Content/Keyboard/simple-keyboard.css?v=638403167486930000
Requested by: Host: www.onliineaabaanxxia.com
URL: https://www.onliineaabaanxxia.com/index2.php
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 161.190.1.97 Buenos Aires, Argentina, ASN13474 (Banco de Galicia y Buenos Aires, AR),
Reverse DNS: prestamos.bancogalicia.com.ar
Software: /
Resource Hash: c46e9d5b86e7a9c0405f4edb56d1f7f8a4a463dca80ff9b99b916da39064a233

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://www.onliineaabaanxxia.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Date: Sat, 06 Apr 2024 19:59:42 GMT
Content-Encoding: gzip
Last-Modified: Mon, 08 Jan 2024 16:19:08 GMT
ETag: "066f7674e42da1:0"
Vary: Accept-Encoding
Access-Control-Allow-Methods: POST,GET,OPTIONS,PUT,DELETE
Content-Type: text/css
Access-Control-Allow-Origin: *
Accept-Ranges: bytes
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Content-Length: 872

GET
H/1.1 200
OK customcarousel.min.css
onlinebanking.bancogalicia.com.ar/Content/ 2 KB
2 KB 1704ms
290ms Stylesheet
text/css 161.190.1.97
Banco de Galicia ...

General

Check archive.org

Show headers Download Go to

Full URL: https://onlinebanking.bancogalicia.com.ar/Content/customcarousel.min.css?v=638403167483540000
Requested by: Host: www.onliineaabaanxxia.com
URL: https://www.onliineaabaanxxia.com/index2.php
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 161.190.1.97 Buenos Aires, Argentina, ASN13474 (Banco de Galicia y Buenos Aires, AR),
Reverse DNS: prestamos.bancogalicia.com.ar
Software: /
Resource Hash: f397778bb003ff2d647f5d7d90050f9b50f43622fb02637c8537f159f460bbad

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://www.onliineaabaanxxia.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Date: Sat, 06 Apr 2024 19:59:42 GMT
Last-Modified: Mon, 08 Jan 2024 16:19:08 GMT
ETag: "206a2d684e42da1:0"
Access-Control-Allow-Methods: POST,GET,OPTIONS,PUT,DELETE
Content-Type: text/css
Access-Control-Allow-Origin: *
Accept-Ranges: bytes
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Content-Length: 1949

GET
H/1.1 200
OK logo.svg
onlinebanking.bancogalicia.com.ar/images/default/ 5 KB
2 KB 291ms
290ms Image
image/svg+xml 161.190.1.97
Banco de Galicia ...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://onlinebanking.bancogalicia.com.ar/images/default/logo.svg
Requested by: Host: onlinebanking.bancogalicia.com.ar
URL: https://onlinebanking.bancogalicia.com.ar/Content/default.min.css?v=638403167776170000
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 161.190.1.97 Buenos Aires, Argentina, ASN13474 (Banco de Galicia y Buenos Aires, AR),
Reverse DNS: prestamos.bancogalicia.com.ar
Software: /
Resource Hash: b4ff0e55e735bcecbe65b3d851306ed458d3ef865d108b74dbc107ead609a17a

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://onlinebanking.bancogalicia.com.ar/Content/default.min.css?v=638403167776170000
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Date: Sat, 06 Apr 2024 19:59:44 GMT
Content-Encoding: gzip
Last-Modified: Mon, 08 Jan 2024 16:19:09 GMT
ETag: "80fc8f684e42da1:0"
Vary: Accept-Encoding
Content-Type: image/svg+xml
Accept-Ranges: bytes
Content-Length: 1801

GET
H/1.1 200
OK Inter-Regular.woff2
onlinebanking.bancogalicia.com.ar/Content/fonts/ 87 KB
87 KB 1432ms
574ms Font
application/font-woff2 161.190.1.97
Banco de Galicia ...

General

Check archive.org

Show headers Download Go to

Full URL: https://onlinebanking.bancogalicia.com.ar/Content/fonts/Inter-Regular.woff2
Requested by: Host: onlinebanking.bancogalicia.com.ar
URL: https://onlinebanking.bancogalicia.com.ar/Content/default.min.css?v=638403167776170000
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 161.190.1.97 Buenos Aires, Argentina, ASN13474 (Banco de Galicia y Buenos Aires, AR),
Reverse DNS: prestamos.bancogalicia.com.ar
Software: /
Resource Hash: 77ca56870309a85759fb7116aef2119a26e358145e808868543ca1fe16c27720

Request headers

Referer: https://onlinebanking.bancogalicia.com.ar/Content/default.min.css?v=638403167776170000
Origin: https://www.onliineaabaanxxia.com
accept-language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Date: Sat, 06 Apr 2024 19:59:45 GMT
Last-Modified: Mon, 08 Jan 2024 16:19:08 GMT
ETag: "60da5e684e42da1:0"
Access-Control-Allow-Methods: POST,GET,OPTIONS,PUT,DELETE
Content-Type: application/font-woff2
Access-Control-Allow-Origin: *
Accept-Ranges: bytes
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Content-Length: 89212

GET
H2 200 QR-2-LuciaPerini.jpg
www.galicia.ar/content/dam/galicia/banco-galicia/personas/canales/onb/ONBGallery/ilustraciones/2023/ 403 KB
406 KB 3610ms
1926ms Image
image/jpeg 151.101.131.10
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.galicia.ar/content/dam/galicia/banco-galicia/personas/canales/onb/ONBGallery/ilustraciones/2023/QR-2-LuciaPerini.jpg

Requested by

Host: www.onliineaabaanxxia.com
URL: https://www.onliineaabaanxxia.com/index2.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.131.10 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

d5d2569bc8b437cd384efdd9e1ec0c579793a8786c5bee86f2ef38d20585b20c

Security Headers

Name	Value
Content-Security-Policy	object-src 'none' ;style-src 'self' 'unsafe-inline' https://.bancogalicia.com.ar https://.hotjar.com https://.galicia.ar https://maps.googleapis.com https://.nera-agro.com https://fonts.googleapis.com https://maps.gstatic.com https://fonts.googleapis.com ;connect-src 'self' 'unsafe-inline' 'unsafe-eval' https://cm.everesttech.net https://assets.adobedtm.com https://.demdex.net https://.omtrdc.net https://.bancogalicia.com.ar https://.galicia.ar https://www.googleapis.com https://.hotjar.com https://.hotjar.io wss://.hotjar.com https://maps.googleapis.com https://.nera-agro.com https://maps.gstatic.com ;script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cm.everesttech.net https://assets.adobedtm.com https://.2o7.net https://.demdex.net https://.omtrdc.net https://.sc.omtrdc.net https://.tt.omtrdc.net https://.adobedtm.com https://.adobeaemcloud.com https://.bancogalicia.com.ar https://.galicia.ar https://.adobeaemcloud.com https://www.google.com/recaptcha/ https://maps.googleapis.com https://www.googletagmanager.com https://www.googleadservices.com https://www.gstatic.com/recaptcha/ https://maps.gstatic.com https://.hotjar.com https://.nera-agro.com https://www.facebook.com https://.facebook.net ;img-src 'self' data: https://cm.everesttech.net https://assets.adobedtm.com https://.demdex.net https://.bancogalicia.com.ar https://.galicia.ar https://i.ytimg.com https://.bancogalicia.com https://.hotjar.com https://maps.googleapis.com https://.nera-agro.com https://maps.gstatic.com https://www.facebook.com https://.facebook.net https://googleads.g.doubleclick.net https://www.google.com https://www.google.com.br ;frame-src 'self' https://.demdex.net https://www.google.com/recaptcha/ https://recaptcha.google.com/recaptcha/ https://www.youtube.com/ https://.bancogalicia.com.ar/ https://.galicia.ar https://.hotjar.com https://maps.googleapis.com https://.nera-agro.com https://maps.gstatic.com ;frame-ancestors 'self' https://.bancogalicia.com.ar ;font-src 'self' data: https://.bancogalicia.com.ar https://.galicia.ar https://.hotjar.com https://maps.googleapis.com https://.nera-agro.com https://maps.gstatic.com https://fonts.gstatic.com https://fonts.googleapis.com
Strict-Transport-Security	max-age=31557600
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://www.onliineaabaanxxia.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

content-security-policy: object-src 'none' ;style-src 'self' 'unsafe-inline' https://*.bancogalicia.com.ar https://*.hotjar.com https://*.galicia.ar https://maps.googleapis.com https://*.nera-agro.com https://fonts.googleapis.com https://maps.gstatic.com https://fonts.googleapis.com ;connect-src 'self' 'unsafe-inline' 'unsafe-eval' https://cm.everesttech.net https://assets.adobedtm.com https://*.demdex.net https://*.omtrdc.net https://*.bancogalicia.com.ar https://*.galicia.ar https://www.googleapis.com https://*.hotjar.com https://*.hotjar.io wss://*.hotjar.com https://maps.googleapis.com https://*.nera-agro.com https://maps.gstatic.com ;script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cm.everesttech.net https://assets.adobedtm.com https://*.2o7.net https://*.demdex.net https://*.omtrdc.net https://*.sc.omtrdc.net https://*.tt.omtrdc.net https://*.adobedtm.com https://*.adobeaemcloud.com https://*.bancogalicia.com.ar https://*.galicia.ar https://*.adobeaemcloud.com https://www.google.com/recaptcha/ https://maps.googleapis.com https://www.googletagmanager.com https://www.googleadservices.com https://www.gstatic.com/recaptcha/ https://maps.gstatic.com https://*.hotjar.com https://*.nera-agro.com https://www.facebook.com https://*.facebook.net ;img-src 'self' data: https://cm.everesttech.net https://assets.adobedtm.com https://*.demdex.net https://*.bancogalicia.com.ar https://*.galicia.ar https://i.ytimg.com https://*.bancogalicia.com https://*.hotjar.com https://maps.googleapis.com https://*.nera-agro.com https://maps.gstatic.com https://www.facebook.com https://*.facebook.net https://googleads.g.doubleclick.net https://www.google.com https://www.google.com.br ;frame-src 'self' https://*.demdex.net https://www.google.com/recaptcha/ https://recaptcha.google.com/recaptcha/ https://www.youtube.com/ https://*.bancogalicia.com.ar/ https://*.galicia.ar https://*.hotjar.com https://maps.googleapis.com https://*.nera-agro.com https://maps.gstatic.com ;frame-ancestors 'self' https://*.bancogalicia.com.ar ;font-src 'self' data: https://*.bancogalicia.com.ar https://*.galicia.ar https://*.hotjar.com https://maps.googleapis.com https://*.nera-agro.com https://maps.gstatic.com https://fonts.gstatic.com https://fonts.googleapis.com
date: Sat, 06 Apr 2024 19:59:47 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31557600
age: 0
x-vhost: galiciapublish
x-cache: MISS
content-disposition: inline
content-length: 412413
x-served-by: cache-nrt-rjtf7700033-NRT
referrer-policy: strict-origin-when-cross-origin
last-modified: Wed, 31 May 2023 20:49:29 GMT
x-timer: S1712433586.069216,VS0,VS0,VE1923
etag: "0x8DB6218879D74F9"
x-frame-options: SAMEORIGIN
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=7200,s-maxage=86400,stale-while-revalidate=43200,stale-if-error=43200
permissions-policy: geolocation=(self "https://*.adobeaemcloud.com\ https://*.bancogalicia.com.ar\ https://*.galicia.ar")
accept-ranges: bytes

GET
H/1.1 200
OK fontawesome-webfont.woff2
onlinebanking.bancogalicia.com.ar/Content/fonts/ 75 KB
76 KB 1422ms
571ms Font
application/font-woff2 161.190.1.97
Banco de Galicia ...

General

Check archive.org

Show headers Download Go to

Full URL: https://onlinebanking.bancogalicia.com.ar/Content/fonts/fontawesome-webfont.woff2
Requested by: Host: onlinebanking.bancogalicia.com.ar
URL: https://onlinebanking.bancogalicia.com.ar/Content/default.min.css?v=638403167776170000
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 161.190.1.97 Buenos Aires, Argentina, ASN13474 (Banco de Galicia y Buenos Aires, AR),
Reverse DNS: prestamos.bancogalicia.com.ar
Software: /
Resource Hash: 2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Request headers

Referer: https://onlinebanking.bancogalicia.com.ar/Content/default.min.css?v=638403167776170000
Origin: https://www.onliineaabaanxxia.com
accept-language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Date: Sat, 06 Apr 2024 19:59:45 GMT
Last-Modified: Mon, 08 Jan 2024 16:19:08 GMT
ETag: "303052684e42da1:0"
Access-Control-Allow-Methods: POST,GET,OPTIONS,PUT,DELETE
Content-Type: application/font-woff2
Access-Control-Allow-Origin: *
Accept-Ranges: bytes
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Content-Length: 77160

GET
H/1.1 200
OK favicon.ico
onlinebanking.bancogalicia.com.ar/Images/ 2 KB
2 KB 292ms
291ms Other
image/x-icon 161.190.1.97
Banco de Galicia ...

General

Check archive.org

Show headers Download Go to

Full URL: https://onlinebanking.bancogalicia.com.ar/Images/favicon.ico
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 161.190.1.97 Buenos Aires, Argentina, ASN13474 (Banco de Galicia y Buenos Aires, AR),
Reverse DNS: prestamos.bancogalicia.com.ar
Software: /
Resource Hash: f20a33fd40173f122bec15a105374059fb3ec612d51146485ed84ef0001f2f03

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://www.onliineaabaanxxia.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Date: Sat, 06 Apr 2024 19:59:48 GMT
Last-Modified: Mon, 08 Jan 2024 16:19:08 GMT
Accept-Ranges: bytes
ETag: "709e30684e42da1:0"
Content-Length: 1559
Content-Type: image/x-icon

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banco Galicia (Banking)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| validateNumber function| checkPasswordCombination function| validateNumericInput object| imagenes

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

onlinebanking.bancogalicia.com.ar
www.galicia.ar
www.onliineaabaanxxia.com
151.101.131.10
161.190.1.97
172.67.157.91
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
38c2ceafd2e0319b0249ad97ab59932dd54971afd9422bb5bbff40ab7069d763
612a237e8ee113c28afb5b58bce39eed244dc31b6d2127b45da334edca204b85
6874c54984380f90054a23d521754d213d1a0af775938031c488d619aa61d1d9
736aad864d65690df8844fccb3503b89d2808f370def52c92073bd040acfda2a
77ca56870309a85759fb7116aef2119a26e358145e808868543ca1fe16c27720
b4ff0e55e735bcecbe65b3d851306ed458d3ef865d108b74dbc107ead609a17a
c46e9d5b86e7a9c0405f4edb56d1f7f8a4a463dca80ff9b99b916da39064a233
d5d2569bc8b437cd384efdd9e1ec0c579793a8786c5bee86f2ef38d20585b20c
f20a33fd40173f122bec15a105374059fb3ec612d51146485ed84ef0001f2f03
f397778bb003ff2d647f5d7d90050f9b50f43622fb02637c8537f159f460bbad

www.onliineaabaanxxia.com Open in urlscan Pro 172.67.157.91 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

11 Requests

100 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

738 kBTransfer

1933 kBSize

0 Cookies

0 Outgoing links

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

0 Cookies

Security Headers

Indicators

www.onliineaabaanxxia.com Open in urlscan Pro
172.67.157.91 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

738 kB
Transfer

1933 kB
Size

0
Cookies

11 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!