rancaguaclub.com.ar Open in urlscan Pro
167.250.5.70 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://rancaguaclub.com.ar/firstxTechx/
Submission: On October 23 via manual (October 23rd 2023, 3:33:34 pm UTC) from US — Scanned from DE

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 9 HTTP transactions. The main IP is 167.250.5.70, located in Argentina and belongs to NUT HOST SRL, AR. The main domain is rancaguaclub.com.ar.
TLS certificate: Issued by R3 on October 18th 2023. Valid for: 3 months.

This is the only time rancaguaclub.com.ar was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: First Tech Federal Credit Union (Banking)

Domain & IP information

	IP Address		AS Autonomous System
1 10	167.250.5.70 167.250.5.70		264649 (NUT HOST SRL) (NUT HOST SRL)
9	1

10 167.250.5.70 (Argentina) 1 redirects

ASN264649 (NUT HOST SRL, AR)
PTR: nb70.servidoraweb.net

rancaguaclub.com.ar	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	rancaguaclub.com.ar 1 redirects rancaguaclub.com.ar	63 KB
9	1

	Domain	Requested by
10	rancaguaclub.com.ar	1 redirects rancaguaclub.com.ar
9	1

This site contains no links.

Subject Issuer	Validity	Valid
*.rancaguaclub.com.ar R3	`2023-10-18` - `2024-01-16`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://rancaguaclub.com.ar/firstxTechx/
Frame ID: DBFE5A8D4CB970821BACB669A0BB0334
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

First Tech Federal Credit

Page Statistics

9
Requests

89 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

63 kB
Transfer

63 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 6

https://rancaguaclub.com.ar/firstxTechx/asset/image/app-store-badge.svg HTTP 301
https://rancaguaclub.com.ar/firstxTechx/asset/image/app-store-badge.svg/

9 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response rancaguaclub.com.ar/firstxTechx/	6 KB 6 KB	1343ms 244ms	Document text/html	167.250.5.70 NUT HOST SRL
General Check archive.org Show headers Download Go to Full URL https://rancaguaclub.com.ar/firstxTechx/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 167.250.5.70 , Argentina, ASN264649 (NUT HOST SRL, AR), Reverse DNS nb70.servidoraweb.net Software Apache / Resource Hash `19ba0e83a600062ca7bbe04e345ac3fb635c507bef2c67d6eb177443b88e42b1` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers accept-ranges bytes content-length 6298 content-type text/html date Mon, 23 Oct 2023 15:33:29 GMT last-modified Sat, 21 Oct 2023 15:09:06 GMT server Apache
GET H2	200	style.css rancaguaclub.com.ar/firstxTechx/	4 KB 4 KB	247ms 243ms	Stylesheet text/css	167.250.5.70 NUT HOST SRL
General Check archive.org Show headers Download Go to Full URL https://rancaguaclub.com.ar/firstxTechx/style.css Requested by Host: rancaguaclub.com.ar URL: https://rancaguaclub.com.ar/firstxTechx/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 167.250.5.70 , Argentina, ASN264649 (NUT HOST SRL, AR), Reverse DNS nb70.servidoraweb.net Software Apache / Resource Hash `6a4d793cbce2e7d9b283ae45edca0d140b54a2798d429ea0b8ccc08de0cae42b` Request headers accept-language de-DE,de;q=0.9 Referer https://rancaguaclub.com.ar/firstxTechx/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers date Mon, 23 Oct 2023 15:33:30 GMT last-modified Tue, 04 Jul 2023 13:05:48 GMT server Apache accept-ranges bytes content-length 4038 content-type text/css
GET H2	200	responsive.css rancaguaclub.com.ar/firstxTechx/	3 KB 3 KB	248ms 245ms	Stylesheet text/css	167.250.5.70 NUT HOST SRL
General Check archive.org Show headers Download Go to Full URL https://rancaguaclub.com.ar/firstxTechx/responsive.css Requested by Host: rancaguaclub.com.ar URL: https://rancaguaclub.com.ar/firstxTechx/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 167.250.5.70 , Argentina, ASN264649 (NUT HOST SRL, AR), Reverse DNS nb70.servidoraweb.net Software Apache / Resource Hash `0def5fb8862f6fe90562892e06e0cda73fc5f7925e91acd8454ae5fac68b3f69` Request headers accept-language de-DE,de;q=0.9 Referer https://rancaguaclub.com.ar/firstxTechx/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers date Mon, 23 Oct 2023 15:33:30 GMT last-modified Wed, 18 Oct 2023 17:13:32 GMT server Apache accept-ranges bytes content-length 3329 content-type text/css
GET H2	200	Logo.png rancaguaclub.com.ar/firstxTechx/asset/image/	19 KB 19 KB	247ms 244ms	Image image/png	167.250.5.70 NUT HOST SRL
General Check archive.org Show headers Download Go to Show image Full URL https://rancaguaclub.com.ar/firstxTechx/asset/image/Logo.png Requested by Host: rancaguaclub.com.ar URL: https://rancaguaclub.com.ar/firstxTechx/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 167.250.5.70 , Argentina, ASN264649 (NUT HOST SRL, AR), Reverse DNS nb70.servidoraweb.net Software Apache / Resource Hash `e3760298dfe86fec826e4ee7df5d7508c64e5c7d37034ec2f571cd3ea6f63daa` Request headers accept-language de-DE,de;q=0.9 Referer https://rancaguaclub.com.ar/firstxTechx/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers date Mon, 23 Oct 2023 15:33:30 GMT last-modified Tue, 04 Jul 2023 13:05:50 GMT server Apache accept-ranges bytes content-length 19597 content-type image/png
GET H2	200	fingerprint_white_24dp.svg rancaguaclub.com.ar/firstxTechx/asset/image/	2 KB 2 KB	247ms 244ms	Image image/svg+xml	167.250.5.70 NUT HOST SRL
General Check archive.org Show headers Download Go to Show image Full URL https://rancaguaclub.com.ar/firstxTechx/asset/image/fingerprint_white_24dp.svg Requested by Host: rancaguaclub.com.ar URL: https://rancaguaclub.com.ar/firstxTechx/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 167.250.5.70 , Argentina, ASN264649 (NUT HOST SRL, AR), Reverse DNS nb70.servidoraweb.net Software Apache / Resource Hash `f765a490485533899939e02bcdc5b7c68fa6e1401190bcf234407fd4defbb2c3` Request headers accept-language de-DE,de;q=0.9 Referer https://rancaguaclub.com.ar/firstxTechx/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers date Mon, 23 Oct 2023 15:33:30 GMT last-modified Wed, 18 Oct 2023 17:13:28 GMT server Apache accept-ranges bytes content-length 1788 content-type image/svg+xml
GET H2	200	atm_white_24dp.svg rancaguaclub.com.ar/firstxTechx/asset/image/	353 B 383 B	246ms 244ms	Image image/svg+xml	167.250.5.70 NUT HOST SRL
General Check archive.org Show headers Download Go to Show image Full URL https://rancaguaclub.com.ar/firstxTechx/asset/image/atm_white_24dp.svg Requested by Host: rancaguaclub.com.ar URL: https://rancaguaclub.com.ar/firstxTechx/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 167.250.5.70 , Argentina, ASN264649 (NUT HOST SRL, AR), Reverse DNS nb70.servidoraweb.net Software Apache / Resource Hash `e8d89b78acb56d224e80668866b59a59b7ad1b0f5cead536d2fe2941cac46306` Request headers accept-language de-DE,de;q=0.9 Referer https://rancaguaclub.com.ar/firstxTechx/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers date Mon, 23 Oct 2023 15:33:30 GMT last-modified Wed, 18 Oct 2023 17:13:28 GMT server Apache accept-ranges bytes content-length 353 content-type image/svg+xml
GET H2	200	phone_iphone_white_24dp.svg rancaguaclub.com.ar/firstxTechx/asset/image/	362 B 427 B	245ms 244ms	Image image/svg+xml	167.250.5.70 NUT HOST SRL
General Check archive.org Show headers Download Go to Show image Full URL https://rancaguaclub.com.ar/firstxTechx/asset/image/phone_iphone_white_24dp.svg Requested by Host: rancaguaclub.com.ar URL: https://rancaguaclub.com.ar/firstxTechx/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 167.250.5.70 , Argentina, ASN264649 (NUT HOST SRL, AR), Reverse DNS nb70.servidoraweb.net Software Apache / Resource Hash `fb10c4e04f5ebef8d51bd2d78f3ad7e69fd8111a1c3f7d8503632c14bb301e42` Request headers accept-language de-DE,de;q=0.9 Referer https://rancaguaclub.com.ar/firstxTechx/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers date Mon, 23 Oct 2023 15:33:30 GMT last-modified Wed, 18 Oct 2023 17:13:28 GMT server Apache accept-ranges bytes content-length 362 content-type image/svg+xml
GET H2	200	/ rancaguaclub.com.ar/firstxTechx/asset/image/app-store-badge.svg/ Redirect Chain https://rancaguaclub.com.ar/firstxTechx/asset/image/app-store-badge.svg https://rancaguaclub.com.ar/firstxTechx/asset/image/app-store-badge.svg/	19 KB 19 KB	502ms 502ms	Image text/html	167.250.5.70 NUT HOST SRL
General Check archive.org Show headers Download Go to Show image Full URL https://rancaguaclub.com.ar/firstxTechx/asset/image/app-store-badge.svg/ Requested by Host: rancaguaclub.com.ar URL: https://rancaguaclub.com.ar/firstxTechx/ Protocol H2 Server 167.250.5.70 , Argentina, ASN264649 (NUT HOST SRL, AR), Reverse DNS nb70.servidoraweb.net Software Apache / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers accept-language de-DE,de;q=0.9 Referer https://rancaguaclub.com.ar/firstxTechx/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers content-type text/html; charset=UTF-8 date Mon, 23 Oct 2023 15:33:30 GMT server Apache link <https://rancaguaclub.com.ar/index.php?rest_route=/>; rel="https://api.w.org/", <https://rancaguaclub.com.ar/index.php?rest_route=/wp/v2/pages/19>; rel="alternate"; type="application/json", <https://rancaguaclub.com.ar/>; rel=shortlink p3p CP="ALL DSP NID CURa ADMa DEVa HISa OTPa OUR NOR NAV DEM" Redirect headers location https://rancaguaclub.com.ar/firstxTechx/asset/image/app-store-badge.svg/ date Mon, 23 Oct 2023 15:33:30 GMT p3p CP="ALL DSP NID CURa ADMa DEVa HISa OTPa OUR NOR NAV DEM" server Apache x-redirect-by WordPress content-length 0 content-type text/html; charset=UTF-8
GET H2	200	google-play-badge.svg rancaguaclub.com.ar/firstxTechx/asset/image/	9 KB 9 KB	246ms 245ms	Image image/svg+xml	167.250.5.70 NUT HOST SRL
General Check archive.org Show headers Download Go to Show image Full URL https://rancaguaclub.com.ar/firstxTechx/asset/image/google-play-badge.svg Requested by Host: rancaguaclub.com.ar URL: https://rancaguaclub.com.ar/firstxTechx/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 167.250.5.70 , Argentina, ASN264649 (NUT HOST SRL, AR), Reverse DNS nb70.servidoraweb.net Software Apache / Resource Hash `2dcf765854f1fe869b1674016feb1638870c1066f156f8d7dfd47b53d0dc093f` Request headers accept-language de-DE,de;q=0.9 Referer https://rancaguaclub.com.ar/firstxTechx/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers date Mon, 23 Oct 2023 15:33:30 GMT last-modified Wed, 18 Oct 2023 17:13:28 GMT server Apache accept-ranges bytes content-length 9332 content-type image/svg+xml

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: First Tech Federal Credit Union (Banking)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

rancaguaclub.com.ar
167.250.5.70
0def5fb8862f6fe90562892e06e0cda73fc5f7925e91acd8454ae5fac68b3f69
19ba0e83a600062ca7bbe04e345ac3fb635c507bef2c67d6eb177443b88e42b1
2dcf765854f1fe869b1674016feb1638870c1066f156f8d7dfd47b53d0dc093f
6a4d793cbce2e7d9b283ae45edca0d140b54a2798d429ea0b8ccc08de0cae42b
e3760298dfe86fec826e4ee7df5d7508c64e5c7d37034ec2f571cd3ea6f63daa
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e8d89b78acb56d224e80668866b59a59b7ad1b0f5cead536d2fe2941cac46306
f765a490485533899939e02bcdc5b7c68fa6e1401190bcf234407fd4defbb2c3
fb10c4e04f5ebef8d51bd2d78f3ad7e69fd8111a1c3f7d8503632c14bb301e42

rancaguaclub.com.ar Open in urlscan Pro 167.250.5.70 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

9 Requests

89 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

63 kBTransfer

63 kBSize

0 Cookies

0 Outgoing links

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

Indicators

rancaguaclub.com.ar Open in urlscan Pro
167.250.5.70 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

89 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

63 kB
Transfer

63 kB
Size

0
Cookies

9 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!