wsec19-bancogalicia.com Open in urlscan Pro
2606:4700:3034::ac43:b40b  Malicious Activity! Public Scan

URL: https://wsec19-bancogalicia.com/
Submission: On February 19 via api from US — Scanned from US

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 8 HTTP transactions. The main IP is 2606:4700:3034::ac43:b40b, located in United States and belongs to CLOUDFLARENET, US. The main domain is wsec19-bancogalicia.com.
TLS certificate: Issued by GTS CA 1P5 on February 16th 2023. Valid for: 3 months.
This is the only time wsec19-bancogalicia.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banco Galicia (Banking)

Domain & IP information

IP Address AS Autonomous System
6 2606:4700:303... 13335 (CLOUDFLAR...)
1 2a04:4e42:200... 54113 (FASTLY)
1 161.190.1.33 13474 (Banco de ...)
8 3
Apex Domain
Subdomains
Transfer
6 wsec19-bancogalicia.com
wsec19-bancogalicia.com
171 KB
1 bancogalicia.com.ar
wsec06.bancogalicia.com.ar
3 KB
1 jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 346
14 KB
8 3
Domain Requested by
6 wsec19-bancogalicia.com wsec19-bancogalicia.com
1 wsec06.bancogalicia.com.ar wsec19-bancogalicia.com
1 cdn.jsdelivr.net wsec19-bancogalicia.com
8 3

This site contains no links.

Subject Issuer Validity Valid
*.wsec19-bancogalicia.com
GTS CA 1P5
2023-02-16 -
2023-05-17
3 months crt.sh
jsdelivr.net
GlobalSign Atlas R3 DV TLS CA 2022 Q4
2022-12-23 -
2024-01-24
a year crt.sh
wsec06.bancogalicia.com.ar
DigiCert SHA2 Extended Validation Server CA
2022-03-15 -
2023-03-15
a year crt.sh

This page contains 1 frames:

Primary Page: https://wsec19-bancogalicia.com/
Frame ID: 51452B06BA9D04952DE4FACC9ACC46A3
Requests: 8 HTTP requests in this frame

Screenshot

Page Title

Gaicia | login

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css

Overall confidence: 100%
Detected patterns
  • <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
  • //cdn\.jsdelivr\.net/

Page Statistics

8
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

188 kB
Transfer

360 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
wsec19-bancogalicia.com/
2 KB
1 KB
Document
General
Full URL
https://wsec19-bancogalicia.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::ac43:b40b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cc844372a954fade66a2e83cffafce2cf4d4e5cb82b7f17e279dc88017c77088

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
79be035dde0422c8-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Sun, 19 Feb 2023 09:35:34 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FuIdUNpfCKyh%2B0ZXPJNkjWpbm3OaaiXTXKEeV5tNKzMF0KVgF8tlBLwUZBSZnLTsFYh3k%2FqWVFGns6fJc9RWTpK3jTANOMG8lQv3OTZ1qGvUnNkV59%2B6RN2brs46HmYAmVVNIDisHoZHcSdXtw87ZkBlW4tdxw%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
bootstrap-icons.css
cdn.jsdelivr.net/npm/bootstrap-icons@1.10.3/font/
93 KB
14 KB
Stylesheet
General
Full URL
https://cdn.jsdelivr.net/npm/bootstrap-icons@1.10.3/font/bootstrap-icons.css
Requested by
Host: wsec19-bancogalicia.com
URL: https://wsec19-bancogalicia.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:200::485 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
e1172d3a0a208cf01dc066f0abeaf17f00264a966159a69f71947d6edcd4935f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
en-US,en;q=0.9
Referer
https://wsec19-bancogalicia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Sun, 19 Feb 2023 09:35:34 GMT
x-content-type-options
nosniff
content-encoding
gzip
age
4679019
x-jsd-version
1.10.3
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
13444
x-served-by
cache-fra-eddf8230054-FRA, cache-chi-klot8100107-CHI
x-jsd-version-type
version
etag
W/"17579-AwBvMnkuAzSX6cpoNztsM4YwWTM"
vary
Accept-Encoding
content-type
text/css; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges
bytes
timing-allow-origin
*
style.css
wsec19-bancogalicia.com/main/
2 KB
1 KB
Stylesheet
General
Full URL
https://wsec19-bancogalicia.com/main/style.css
Requested by
Host: wsec19-bancogalicia.com
URL: https://wsec19-bancogalicia.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::ac43:b40b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
23b83af9357e3c395d99276c28aa90784241ae2ec8d02718ac191546ab921453

Request headers

accept-language
en-US,en;q=0.9
Referer
https://wsec19-bancogalicia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Sun, 19 Feb 2023 09:35:34 GMT
content-encoding
gzip
cf-cache-status
MISS
last-modified
Fri, 17 Feb 2023 13:19:07 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"6ed-5f4e5287508c0-gzip"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BuKXvh9CzgVEjJtSGmxx0Tq77%2BocbYSzZrjYt2%2BYDzfA8%2FByF9YFylT2K9iMplTvg8nKpz1acu1cywIZZMfAiuV28Y2lKJeVRS56262nT3oyb8L%2FFZ8cVErKjMc2zIw6GpKq2QNLDMB1oRKGEFGztLRt1H6%2FYg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
79be035e5e5622c8-ORD
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
700
all.min.css
wsec19-bancogalicia.com/main/
115 KB
23 KB
Stylesheet
General
Full URL
https://wsec19-bancogalicia.com/main/all.min.css
Requested by
Host: wsec19-bancogalicia.com
URL: https://wsec19-bancogalicia.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::ac43:b40b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
06dafcc7c041da9c6a9465ae0481878aebd8bcbde25f1ed2ad601a14e07db4e5

Request headers

Referer
Origin
https://wsec19-bancogalicia.com
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Sun, 19 Feb 2023 09:35:34 GMT
content-encoding
gzip
cf-cache-status
MISS
last-modified
Fri, 17 Feb 2023 19:04:31 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"1cc12-5f4e9fbb42dc0-gzip"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Xgo%2FRl334FfDEmCu0rUMnyYYV7sBCoJu0kgzfCDIeeRGRTRF%2Frkc0S4z%2BeEFz889Bq6L0C72sg7bbVYSbsGsh99UmnkMoCsxSGN2pk4LUkWVnTimottaSyARcG0740x4Mf4LoX10JgSkyWii1%2B6SsyFzZV17pw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
79be035e5e5722c8-ORD
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
22897
logo-galicia-new.png
wsec19-bancogalicia.com/main/
4 KB
4 KB
Image
General
Full URL
https://wsec19-bancogalicia.com/main/logo-galicia-new.png
Requested by
Host: wsec19-bancogalicia.com
URL: https://wsec19-bancogalicia.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::ac43:b40b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c1ac115788f922e9bb68fc1e4710ed077bcae6e5014bc163c434b598e1e17ec9

Request headers

accept-language
en-US,en;q=0.9
Referer
https://wsec19-bancogalicia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Sun, 19 Feb 2023 09:35:34 GMT
cf-cache-status
MISS
last-modified
Fri, 17 Feb 2023 13:19:07 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"e05-5f4e5287508c0"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Cn6dF7GvlWezY8MHDuq3fQM7rB8qwOhWHUeETmvWfjgB%2FRs9JFbuUxdPO6QX4s2aY%2BzLNsFEKLfo2TJIJelC76MbtNQqXpH%2FIOBM6WS0Miu2FCiJn2DjRs95xqm3JDVtuivk%2FBHOfYRg9%2BlRVNuN5gXtDCW%2BMA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
79be035e9ea822c8-ORD
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
3589
logo-ob.png
wsec19-bancogalicia.com/main/
40 KB
41 KB
Image
General
Full URL
https://wsec19-bancogalicia.com/main/logo-ob.png
Requested by
Host: wsec19-bancogalicia.com
URL: https://wsec19-bancogalicia.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::ac43:b40b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8ba5487a3441be54f0d77878bdde04863c7918e7551eae45e7d4d039d701d313

Request headers

accept-language
en-US,en;q=0.9
Referer
https://wsec19-bancogalicia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Sun, 19 Feb 2023 09:35:34 GMT
cf-cache-status
MISS
last-modified
Fri, 17 Feb 2023 13:19:07 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"a122-5f4e5287508c0"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zQGFGgDcDPf%2B5UQXJeMe19tzuOdlj2hCxgT3gVLCwARjTXvBjIbemYKuBOSXkLbKA3v5%2Fn0dvRu3QjArorl1JVkx%2B5FoULdtFKCY%2FDC%2FlnE2tNOjQhBO%2Fkr4glHyfVh6nReg6JO%2Bs0higKvj%2FtOnfwJmj830mw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
79be035e9ea922c8-ORD
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
41250
login-banner-07.jpg
wsec19-bancogalicia.com/main/
101 KB
102 KB
Image
General
Full URL
https://wsec19-bancogalicia.com/main/login-banner-07.jpg
Requested by
Host: wsec19-bancogalicia.com
URL: https://wsec19-bancogalicia.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::ac43:b40b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
31afa957108f620ee57fedf4b247b461f88e30f921b6a6216576b9f42d72fbad

Request headers

accept-language
en-US,en;q=0.9
Referer
https://wsec19-bancogalicia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Sun, 19 Feb 2023 09:35:34 GMT
cf-cache-status
MISS
last-modified
Fri, 17 Feb 2023 13:19:07 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"195ac-5f4e5287508c0"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JDk9Ez36zyYjsSUQYyIjRZ8oi98%2Boi9lFbxfSkR%2BXdQ%2BDNI7pjUAwuXUNdBIw04Ij2qNMfm4Mok5DJGxvuKAVyPslPorsbynr1sW6YJkn9rhmVrN7QhPhAO2inWNRr59kn6q1ilKtQNBmEADxmTEC%2BqgDF1bAA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
79be035e9eaa22c8-ORD
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
103852
l-accesos.png
wsec06.bancogalicia.com.ar/images/commons/
3 KB
3 KB
Image
General
Full URL
https://wsec06.bancogalicia.com.ar/images/commons/l-accesos.png
Requested by
Host: wsec19-bancogalicia.com
URL: https://wsec19-bancogalicia.com/main/style.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
161.190.1.33 Buenos Aires, Argentina, ASN13474 (Banco de Galicia y Buenos Aires, AR),
Reverse DNS
wsec06.bancogalicia.com.ar
Software
/
Resource Hash
284627306a3d1ac25a21fd5fa4ef02476311552117570c23ea2437535173c01c

Request headers

accept-language
en-US,en;q=0.9
Referer
https://wsec19-bancogalicia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date
Sun, 19 Feb 2023 09:35:35 GMT
Last-Modified
Mon, 13 Feb 2023 17:51:32 GMT
Accept-Ranges
bytes
ETag
"50a8f4ced33fd91:0"
Content-Length
3030
Content-Type
image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banco Galicia (Banking)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| oncontentvisibilityautostatechange

0 Cookies

1 Console Messages

Source Level URL
Text
security error URL: https://wsec19-bancogalicia.com/
Message:
Failed to find a valid digest in the 'integrity' attribute for resource 'https://wsec19-bancogalicia.com/main/all.min.css' with computed SHA-512 integrity 'U8dsj5ZytX4aQc4Sd1z1re+ajPrOaBmNTqbujpQriNazQIPXy9xN9PWl2/W5scnm0ETkOQoNckcbDFEclxA3hg=='. The resource has been blocked.