galiciaonline.galiciaalert.repl.co
34.149.204.188
Malicious Activity!
URL:
https://galiciaonline.galiciaalert.repl.co/
Submission: On October 21 via automatic, source phishtank — Scanned from DE
Submission: On October 21 via automatic, source phishtank — Scanned from DE
Summary
This website contacted 3 IPs
in 3 countries
across 3 domains to perform 9 HTTP transactions.
The main IP is 34.149.204.188, located in
Kansas City, United States and
belongs to GOOGLE, US.
The main domain is galiciaonline.galiciaalert.repl.co.
TLS certificate: Issued by R3 on October 21st 2022. Valid for: 3 months.
This is the only time galiciaonline.galiciaalert.repl.co was scanned on urlscan.io!
TLS certificate: Issued by R3 on October 21st 2022. Valid for: 3 months.
This is the only time galiciaonline.galiciaalert.repl.co was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Banco Galicia (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 7 | 34.149.204.188 34.149.204.188 | 15169 (GOOGLE) (GOOGLE) | |
| 1 | 2001:4de0:ac1... 2001:4de0:ac18::1:a:1b | 20446 (STACKPATH...) (STACKPATH-CDN) | |
| 1 | 2a00:1450:400... 2a00:1450:4001:808::200a | 15169 (GOOGLE) (GOOGLE) | |
| 9 | 3 |
7
34.149.204.188
(Kansas City, United States)
ASN15169 (GOOGLE, US)
PTR: 188.204.149.34.bc.googleusercontent.com
ASN15169 (GOOGLE, US)
PTR: 188.204.149.34.bc.googleusercontent.com
| galiciaonline.galiciaalert.repl.co |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 7 |
repl.co
galiciaonline.galiciaalert.repl.co |
807 KB |
| 1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 44 |
1 KB |
| 1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 677 |
30 KB |
| 9 | 3 |
| Domain | Requested by | |
|---|---|---|
| 7 | galiciaonline.galiciaalert.repl.co |
galiciaonline.galiciaalert.repl.co
|
| 1 | fonts.googleapis.com |
galiciaonline.galiciaalert.repl.co
|
| 1 | code.jquery.com |
galiciaonline.galiciaalert.repl.co
|
| 9 | 3 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| galiciaalert.repl.co R3 |
2022-10-21 - 2023-01-19 |
3 months | crt.sh |
| *.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2022-08-03 - 2023-07-14 |
a year | crt.sh |
| upload.video.google.com GTS CA 1C3 |
2022-09-12 - 2022-12-05 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://galiciaonline.galiciaalert.repl.co/
Frame ID: 806FA5F76B2975F3B3B1DD5DF96E62AD
Requests: 9 HTTP requests in this frame
Screenshot
Detected technologies
Google Font API
(Font Scripts)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
9
Requests
100
%
HTTPS
67
%
IPv6
3
Domains
3
Subdomains
3
IPs
3
Countries
839
kB
Transfer
895
kB
Size
0
Cookies
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
9 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
/
galiciaonline.galiciaalert.repl.co/ |
1 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
main.css
galiciaonline.galiciaalert.repl.co/st/ |
6 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery-3.6.0.min.js
code.jquery.com/ |
87 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
css2
fonts.googleapis.com/ |
2 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
lg-gal.svg
galiciaonline.galiciaalert.repl.co/im/ |
5 KB 5 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
on-bn.svg
galiciaonline.galiciaalert.repl.co/im/ |
5 KB 5 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
scrp.js
galiciaonline.galiciaalert.repl.co/js/ |
1003 B 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
frm-1.svg
galiciaonline.galiciaalert.repl.co/im/ |
110 KB 110 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
pnl-img.jpg
galiciaonline.galiciaalert.repl.co/im/ |
677 KB 678 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Banco Galicia (Banking)14 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| $ function| jQuery function| loadDoc function| loadDoc2 function| loadDoc30 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
| Header | Value |
|---|---|
| Strict-Transport-Security | max-age=7755512; includeSubDomains |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
code.jquery.com
fonts.googleapis.com
galiciaonline.galiciaalert.repl.co
2001:4de0:ac18::1:a:1b
2a00:1450:4001:808::200a
34.149.204.188
01ff410f5fb85b606ae2311c145047e1f40cffc13a7d5c118395f394ca16c67a
0370a4223069208a01c9a4c3f1ba1da1954f4bbad2ab3ec4467d29f7ff77a7b0
1dfc5d6886da8c3bf7af8e7a751c9424d381e1373c709b1342f99501964a1191
9983d3ae405b251b4ab6077cabd1e5d6a5f9e84eff85756da7c502763d47f017
9e87fdc7b8386cb786e3cf277239b44f2cd6538af6beda97e282c4851420188d
a8f3588de2b236f29077f1ae7e87619bcbe4f0fe3a657d6794fb331e09fd2ac0
bac754b72350122de47365bff13baa9359e1715715e71d1afcb1b6442341c8f8
fad6369e7b4e8af718c87cf1d5e13e9f3c3e831725a388ad52a971ee70c1abe8
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e