homebangalcia.com - urlscan.io

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 6 HTTP transactions. The main IP is 149.100.155.183, located in São Paulo, Brazil and belongs to AS-HOSTINGER, CY. The main domain is homebangalcia.com.
TLS certificate: Issued by R3 on July 5th 2023. Valid for: 3 months.

This is the only time homebangalcia.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banco Galicia (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1	149.100.155.183 149.100.155.183	47583 (AS-HOSTINGER) (AS-HOSTINGER)
5	161.190.1.97 161.190.1.97	13474 (Banco de ...) (Banco de Galicia y Buenos Aires)
6	2

1 149.100.155.183 (São Paulo, Brazil)

ASN47583 (AS-HOSTINGER, CY)

homebangalcia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 161.190.1.97 (Buenos Aires, Argentina)

ASN13474 (Banco de Galicia y Buenos Aires, AR)
PTR: prestamos.bancogalicia.com.ar

onlinebanking.bancogalicia.com.ar	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	bancogalicia.com.ar onlinebanking.bancogalicia.com.ar — Cisco Umbrella Rank: 599298	246 KB
1	homebangalcia.com homebangalcia.com	1 KB
6	2

	Domain	Requested by
5	onlinebanking.bancogalicia.com.ar	homebangalcia.com onlinebanking.bancogalicia.com.ar
1	homebangalcia.com
6	2

This site contains no links.

Subject Issuer	Validity	Valid
homebangalcia.com R3	`2023-07-05` - `2023-10-03`	3 months	crt.sh
onlinebanking.bancogalicia.com.ar DigiCert SHA2 Extended Validation Server CA	`2022-09-27` - `2023-09-27`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://homebangalcia.com/
Frame ID: DD8EE4680D352CA6DC652DA5DC94CF11
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Online Home

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css

Page Statistics

6
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

247 kB
Transfer

1431 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
homebangalcia.com/ 3 KB
1 KB 1170ms
282ms Document
text/html 149.100.155.183
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to

Full URL

https://homebangalcia.com/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

149.100.155.183 São Paulo, Brazil, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

LiteSpeed /

Resource Hash

d8937dfc718d136d48a92486cf0f3e0c569e29cd90af7da6d33ef707e57f8690

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: jp-jp,jp;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-encoding: br
content-length: 846
content-security-policy: upgrade-insecure-requests
content-type: text/html
date: Fri, 07 Jul 2023 16:03:09 GMT
etag: "cac-64a606b0-2ff7f867d32b4bf4;br"
last-modified: Thu, 06 Jul 2023 00:11:28 GMT
platform: hostinger
server: LiteSpeed
vary: Accept-Encoding

GET
H/1.1 200
OK bootstrap.min.css
onlinebanking.bancogalicia.com.ar/Content/ 121 KB
20 KB 2182ms
588ms Stylesheet
text/css 161.190.1.97
Banco de Galicia ...

General

Check archive.org

Show headers Download Go to

Full URL: https://onlinebanking.bancogalicia.com.ar/Content/bootstrap.min.css?v=638144005967340000
Requested by: Host: homebangalcia.com
URL: https://homebangalcia.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 161.190.1.97 Buenos Aires, Argentina, ASN13474 (Banco de Galicia y Buenos Aires, AR),
Reverse DNS: prestamos.bancogalicia.com.ar
Software: /
Resource Hash: 38c2ceafd2e0319b0249ad97ab59932dd54971afd9422bb5bbff40ab7069d763

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://homebangalcia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Fri, 07 Jul 2023 16:03:12 GMT
Content-Encoding: gzip
Last-Modified: Tue, 14 Mar 2023 17:23:16 GMT
ETag: "09aa0a99956d91:0"
Vary: Accept-Encoding
Access-Control-Allow-Methods: POST,GET,OPTIONS,PUT,DELETE
Content-Type: text/css
Access-Control-Allow-Origin: *
Accept-Ranges: bytes
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Content-Length: 20009

GET
H/1.1 200
OK default.min.css
onlinebanking.bancogalicia.com.ar/Content/ 1 MB
136 KB 2171ms
575ms Stylesheet
text/css 161.190.1.97
Banco de Galicia ...

General

Check archive.org

Show headers Download Go to

Full URL: https://onlinebanking.bancogalicia.com.ar/Content/default.min.css?v=638144006175890000
Requested by: Host: homebangalcia.com
URL: https://homebangalcia.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 161.190.1.97 Buenos Aires, Argentina, ASN13474 (Banco de Galicia y Buenos Aires, AR),
Reverse DNS: prestamos.bancogalicia.com.ar
Software: /
Resource Hash: 61dd9856f81d75f7a4cc058bd94c2db3134747fcb6a72bb9ba8f49a8e1c9fe84

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://homebangalcia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Fri, 07 Jul 2023 16:03:12 GMT
Content-Encoding: gzip
Last-Modified: Tue, 14 Mar 2023 17:23:37 GMT
ETag: "80f224b69956d91:0"
Vary: Accept-Encoding
Access-Control-Allow-Methods: POST,GET,OPTIONS,PUT,DELETE
Content-Type: text/css
Access-Control-Allow-Origin: *
Accept-Ranges: bytes
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Content-Length: 138827

GET
H/1.1 200
OK keyboard.css
onlinebanking.bancogalicia.com.ar/Content/Keyboard/ 492 B
857 B 1921ms
307ms Stylesheet
text/css 161.190.1.97
Banco de Galicia ...

General

Check archive.org

Show headers Download Go to

Full URL: https://onlinebanking.bancogalicia.com.ar/Content/Keyboard/keyboard.css?v=638144005969550000
Requested by: Host: homebangalcia.com
URL: https://homebangalcia.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 161.190.1.97 Buenos Aires, Argentina, ASN13474 (Banco de Galicia y Buenos Aires, AR),
Reverse DNS: prestamos.bancogalicia.com.ar
Software: /
Resource Hash: 612a237e8ee113c28afb5b58bce39eed244dc31b6d2127b45da334edca204b85

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://homebangalcia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Fri, 07 Jul 2023 16:03:12 GMT
Last-Modified: Tue, 14 Mar 2023 17:23:16 GMT
ETag: "b05232aa9956d91:0"
Access-Control-Allow-Methods: POST,GET,OPTIONS,PUT,DELETE
Content-Type: text/css
Access-Control-Allow-Origin: *
Accept-Ranges: bytes
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Content-Length: 492

GET
H/1.1 200
OK logo.svg
onlinebanking.bancogalicia.com.ar/images/default/ 5 KB
2 KB 304ms
304ms Image
image/svg+xml 161.190.1.97
Banco de Galicia ...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://onlinebanking.bancogalicia.com.ar/images/default/logo.svg
Requested by: Host: onlinebanking.bancogalicia.com.ar
URL: https://onlinebanking.bancogalicia.com.ar/Content/default.min.css?v=638144006175890000
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 161.190.1.97 Buenos Aires, Argentina, ASN13474 (Banco de Galicia y Buenos Aires, AR),
Reverse DNS: prestamos.bancogalicia.com.ar
Software: /
Resource Hash: b4ff0e55e735bcecbe65b3d851306ed458d3ef865d108b74dbc107ead609a17a

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://onlinebanking.bancogalicia.com.ar/Content/default.min.css?v=638144006175890000
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Fri, 07 Jul 2023 16:03:14 GMT
Content-Encoding: gzip
Last-Modified: Tue, 14 Mar 2023 17:23:17 GMT
ETag: "803039aa9956d91:0"
Vary: Accept-Encoding
Content-Type: image/svg+xml
Accept-Ranges: bytes
Content-Length: 1801

GET
H/1.1 200
OK Inter-Regular.woff2
onlinebanking.bancogalicia.com.ar/Content/fonts/ 87 KB
87 KB 1482ms
584ms Font
application/font-woff2 161.190.1.97
Banco de Galicia ...

General

Check archive.org

Show headers Download Go to

Full URL: https://onlinebanking.bancogalicia.com.ar/Content/fonts/Inter-Regular.woff2
Requested by: Host: onlinebanking.bancogalicia.com.ar
URL: https://onlinebanking.bancogalicia.com.ar/Content/default.min.css?v=638144006175890000
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 161.190.1.97 Buenos Aires, Argentina, ASN13474 (Banco de Galicia y Buenos Aires, AR),
Reverse DNS: prestamos.bancogalicia.com.ar
Software: /
Resource Hash: 77ca56870309a85759fb7116aef2119a26e358145e808868543ca1fe16c27720

Request headers

Referer: https://onlinebanking.bancogalicia.com.ar/Content/default.min.css?v=638144006175890000
Origin: https://homebangalcia.com
accept-language: jp-jp,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Fri, 07 Jul 2023 16:03:14 GMT
Last-Modified: Tue, 14 Mar 2023 17:23:16 GMT
ETag: "608f31aa9956d91:0"
Access-Control-Allow-Methods: POST,GET,OPTIONS,PUT,DELETE
Content-Type: application/font-woff2
Access-Control-Allow-Origin: *
Accept-Ranges: bytes
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Content-Length: 89212

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banco Galicia (Banking)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| onbeforetoggle object| onscrollend

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

homebangalcia.com
onlinebanking.bancogalicia.com.ar
149.100.155.183
161.190.1.97
38c2ceafd2e0319b0249ad97ab59932dd54971afd9422bb5bbff40ab7069d763
612a237e8ee113c28afb5b58bce39eed244dc31b6d2127b45da334edca204b85
61dd9856f81d75f7a4cc058bd94c2db3134747fcb6a72bb9ba8f49a8e1c9fe84
77ca56870309a85759fb7116aef2119a26e358145e808868543ca1fe16c27720
b4ff0e55e735bcecbe65b3d851306ed458d3ef865d108b74dbc107ead609a17a
d8937dfc718d136d48a92486cf0f3e0c569e29cd90af7da6d33ef707e57f8690

homebangalcia.com Open in urlscan Pro 149.100.155.183 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

6 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

247 kBTransfer

1431 kBSize

0 Cookies

0 Outgoing links

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

0 Cookies

Security Headers

Indicators

homebangalcia.com Open in urlscan Pro
149.100.155.183 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

247 kB
Transfer

1431 kB
Size

0
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!