xradio.ar Open in urlscan Pro
66.97.42.18 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://xradio.ar/fr/Agricol_bank/region/
Submission: On March 23 via api (March 23rd 2024, 10:59:25 pm UTC) from US — Scanned from US

Summary HTTP 20 Redirects Behaviour Indicators

Summary

This website contacted 6 IPs in 2 countries across 6 domains to perform 20 HTTP transactions. The main IP is 66.97.42.18, located in Rosario, Argentina and belongs to Dattatec.com, AR. The main domain is xradio.ar.

This is the only time xradio.ar was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Credit Agricole (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 14	66.97.42.18 66.97.42.18	27823 (Dattatec.com) (Dattatec.com)
2	2a04:4e42::485 2a04:4e42::485	54113 (FASTLY) (FASTLY)
2	2606:4700::68... 2606:4700::6812:bcf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2607:f8b0:400... 2607:f8b0:4004:c06::5f	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4004:c1b::5e	15169 (GOOGLE) (GOOGLE)
20	6

14 66.97.42.18 (Rosario, Argentina) 1 redirects

ASN27823 (Dattatec.com, AR)
PTR: vps-2320372-x.dattaweb.com

xradio.ar	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a04:4e42::485 (United States)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:bcf (United States)

ASN13335 (CLOUDFLARENET, US)

stackpath.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4004:c06::5f (Washington, United States)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4004:c1b::5e (Washington, United States)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	xradio.ar 1 redirects xradio.ar	474 KB
2	bootstrapcdn.com stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 4123	83 KB
2	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 437	98 KB
1	gstatic.com fonts.gstatic.com	46 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 110	1 KB
0	Failed function sub() { [native code] }. Failed
20	6

	Domain	Requested by
14	xradio.ar	1 redirects xradio.ar
2	stackpath.bootstrapcdn.com	xradio.ar stackpath.bootstrapcdn.com
2	cdn.jsdelivr.net	xradio.ar cdn.jsdelivr.net
1	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	xradio.ar
0	102.165.14.4 Failed	xradio.ar
20	6

This site contains no links.

Subject Issuer	Validity	Valid
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2023 Q3	`2023-09-27` - `2024-10-28`	a year	crt.sh
bootstrapcdn.com GTS CA 1P5	`2024-01-28` - `2024-04-27`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2024-02-26` - `2024-05-20`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2024-02-26` - `2024-05-20`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://xradio.ar/fr/Agricol_bank/region/
Frame ID: 776A5A7DB521C0B82217B89CB6F8551C
Requests: 21 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Accès CR - Crédit Agricole

Page URL History Show full URLs

http://xradio.ar/fr/Agricol_bank/region HTTP 301
http://xradio.ar/fr/Agricol_bank/region/ Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

<link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
//cdn\.jsdelivr\.net/

Page Statistics

20
Requests

30 %
HTTPS

80 %
IPv6

6
Domains

6
Subdomains

6
IPs

2
Countries

702 kB
Transfer

1291 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://xradio.ar/fr/Agricol_bank/region HTTP 301
http://xradio.ar/fr/Agricol_bank/region/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

20 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
xradio.ar/fr/Agricol_bank/region/
Redirect Chain

http://xradio.ar/fr/Agricol_bank/region
http://xradio.ar/fr/Agricol_bank/region/

10 KB
3 KB

578ms
578ms

Document
text/html

66.97.42.18
Dattatec.com

General

Check archive.org

Show headers Download Go to

Full URL: http://xradio.ar/fr/Agricol_bank/region/
Protocol: HTTP/1.1
Server: 66.97.42.18 Rosario, Argentina, ASN27823 (Dattatec.com, AR),
Reverse DNS: vps-2320372-x.dattaweb.com
Software: Apache / PHP/7.4.25
Resource Hash: d3eaff44881ec8b5353d3e5b7f27b60be481a245d86992edba2f9735e0e87f9a

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate
Connection: Keep-Alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Sat, 23 Mar 2024 23:02:18 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive: timeout=5, max=99
Pragma: no-cache
Server: Apache
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Powered-By: PHP/7.4.25

Redirect headers

Connection: Keep-Alive
Content-Length: 248
Content-Type: text/html; charset=iso-8859-1
Date: Sat, 23 Mar 2024 23:02:17 GMT
Keep-Alive: timeout=5, max=100
Location: http://xradio.ar/fr/Agricol_bank/region/
Server: Apache

GET
H2 200 bootstrap-icons.css
cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/ 64 KB
9 KB 93ms
28ms Stylesheet
text/css 2a04:4e42::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/bootstrap-icons.css

Requested by

Host: xradio.ar
URL: http://xradio.ar/fr/Agricol_bank/region/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

3c325075337b768950583012228055ae392e384688d77ec5235e6ca88dcec6ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: http://xradio.ar/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Sat, 23 Mar 2024 22:59:19 GMT
x-content-type-options: nosniff
content-encoding: br
age: 2498828
x-jsd-version: 1.5.0
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 8770
x-served-by: cache-fra-etou8220126-FRA, cache-mia-kmia1760030-MIA
x-jsd-version-type: version
etag: W/"100a0-GGXd3Lt7Z9zvQlDlkMyalXSrpnM"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 font-awesome.min.css
stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/ 30 KB
7 KB 105ms
41ms Stylesheet
text/css 2606:4700::6812:bcf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css

Requested by

Host: xradio.ar
URL: http://xradio.ar/fr/Agricol_bank/region/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: http://xradio.ar/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Sat, 23 Mar 2024 22:59:19 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
cdn-edgestorageid: 625
age: 2178039
cdn-cachedat: 10/31/2023 18:49:18
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 25 Jan 2021 22:04:55 GMT
cdn-proxyver: 1.04
cdn-requestpullcode: 200
server: cloudflare
etag: W/"269550530cc127b6aa5a35925a7de6ce"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cache-control: public, max-age=31919000
cdn-requestid: c70fccf2ce84e90b2b55a9d813f9a920
timing-allow-origin: *
cdn-requestcountrycode: US
cdn-status: 200
cf-ray: 869207fe998121d3-MIA
cdn-requestpullsuccess: True

GET
H/1.1 200
OK bootstrap.css
xradio.ar/fr/Agricol_bank/region/css/ 188 KB
25 KB 166ms
164ms Stylesheet
text/css 66.97.42.18
Dattatec.com

General

Check archive.org

Show headers Download Go to

Full URL: http://xradio.ar/fr/Agricol_bank/region/css/bootstrap.css
Requested by: Host: xradio.ar
URL: http://xradio.ar/fr/Agricol_bank/region/
Protocol: HTTP/1.1
Server: 66.97.42.18 Rosario, Argentina, ASN27823 (Dattatec.com, AR),
Reverse DNS: vps-2320372-x.dattaweb.com
Software: Apache /
Resource Hash: 0c159070e198b7ed2a9162d6c9751f5914ff62803914d8512d60b1f5ffde4334

Request headers

accept-language: en-US,en;q=0.9
Referer: http://xradio.ar/fr/Agricol_bank/region/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Date: Sat, 23 Mar 2024 23:02:18 GMT
Content-Encoding: gzip
Last-Modified: Thu, 15 Feb 2024 13:42:18 GMT
Server: Apache
ETag: "2f1f7-6116bcbc32280-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 24828

GET
H/1.1 200
OK over.css
xradio.ar/fr/Agricol_bank/region/css/ 15 KB
3 KB 166ms
163ms Stylesheet
text/css 66.97.42.18
Dattatec.com

General

Check archive.org

Show headers Download Go to

Full URL: http://xradio.ar/fr/Agricol_bank/region/css/over.css
Requested by: Host: xradio.ar
URL: http://xradio.ar/fr/Agricol_bank/region/
Protocol: HTTP/1.1
Server: 66.97.42.18 Rosario, Argentina, ASN27823 (Dattatec.com, AR),
Reverse DNS: vps-2320372-x.dattaweb.com
Software: Apache /
Resource Hash: 576dbb9ac470cc8ba17f6df967ccc1913bb6b82132d7b41105f505e932346a85

Request headers

accept-language: en-US,en;q=0.9
Referer: http://xradio.ar/fr/Agricol_bank/region/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Date: Sat, 23 Mar 2024 23:02:18 GMT
Content-Encoding: gzip
Last-Modified: Thu, 15 Feb 2024 13:42:18 GMT
Server: Apache
ETag: "3d37-6116bcbc32280-gzip"
Vary: Accept-Encoding
Upgrade: h2,h2c
Content-Type: text/css
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 2740

GET
H/1.1 200
OK big.svg
xradio.ar/fr/Agricol_bank/region/image/ 22 KB
22 KB 316ms
158ms Image
image/svg+xml 66.97.42.18
Dattatec.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://xradio.ar/fr/Agricol_bank/region/image/big.svg
Requested by: Host: xradio.ar
URL: http://xradio.ar/fr/Agricol_bank/region/
Protocol: HTTP/1.1
Server: 66.97.42.18 Rosario, Argentina, ASN27823 (Dattatec.com, AR),
Reverse DNS: vps-2320372-x.dattaweb.com
Software: Apache /
Resource Hash: 5c44321c0ba44a1fa665ba4c928fbebd869a3082c458bd2d20a0d07a4e5fcc24

Request headers

accept-language: en-US,en;q=0.9
Referer: http://xradio.ar/fr/Agricol_bank/region/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Date: Sat, 23 Mar 2024 23:02:18 GMT
Last-Modified: Thu, 15 Feb 2024 13:42:18 GMT
Server: Apache
ETag: "580d-6116bcbc32280"
Upgrade: h2,h2c
Content-Type: image/svg+xml
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 22541

GET
H/1.1 200
OK web_1.png
xradio.ar/fr/Agricol_bank/region/image/ 2 KB
2 KB 318ms
158ms Image
image/png 66.97.42.18
Dattatec.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://xradio.ar/fr/Agricol_bank/region/image/web_1.png
Requested by: Host: xradio.ar
URL: http://xradio.ar/fr/Agricol_bank/region/
Protocol: HTTP/1.1
Server: 66.97.42.18 Rosario, Argentina, ASN27823 (Dattatec.com, AR),
Reverse DNS: vps-2320372-x.dattaweb.com
Software: Apache /
Resource Hash: 5db63f3ba53740ed463cc68dbf63e1412944ed6f647aaab85c7507abfaacf6f1

Request headers

accept-language: en-US,en;q=0.9
Referer: http://xradio.ar/fr/Agricol_bank/region/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Date: Sat, 23 Mar 2024 23:02:18 GMT
Last-Modified: Thu, 15 Feb 2024 13:42:18 GMT
Server: Apache
ETag: "86d-6116bcbc32280"
Upgrade: h2,h2c
Content-Type: image/png
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 2157

GET
H/1.1 200
OK web_2.png
xradio.ar/fr/Agricol_bank/region/image/ 2 KB
2 KB 325ms
163ms Image
image/png 66.97.42.18
Dattatec.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://xradio.ar/fr/Agricol_bank/region/image/web_2.png
Requested by: Host: xradio.ar
URL: http://xradio.ar/fr/Agricol_bank/region/
Protocol: HTTP/1.1
Server: 66.97.42.18 Rosario, Argentina, ASN27823 (Dattatec.com, AR),
Reverse DNS: vps-2320372-x.dattaweb.com
Software: Apache /
Resource Hash: 4976f0796d8f82ad9766b9ef9e270e5e082ee57a79f6fbb121e9f3279e4cb4dd

Request headers

accept-language: en-US,en;q=0.9
Referer: http://xradio.ar/fr/Agricol_bank/region/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Date: Sat, 23 Mar 2024 23:02:18 GMT
Last-Modified: Thu, 15 Feb 2024 13:42:18 GMT
Server: Apache
ETag: "7b2-6116bcbc32280"
Upgrade: h2,h2c
Content-Type: image/png
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 1970

GET
H/1.1 200
OK web_3.png
xradio.ar/fr/Agricol_bank/region/image/ 2 KB
2 KB 326ms
164ms Image
image/png 66.97.42.18
Dattatec.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://xradio.ar/fr/Agricol_bank/region/image/web_3.png
Requested by: Host: xradio.ar
URL: http://xradio.ar/fr/Agricol_bank/region/
Protocol: HTTP/1.1
Server: 66.97.42.18 Rosario, Argentina, ASN27823 (Dattatec.com, AR),
Reverse DNS: vps-2320372-x.dattaweb.com
Software: Apache /
Resource Hash: 8c40de2f4f4739d1fe369662082fa9f14338c79f8f8e68d1d7fbc38bc97c6797

Request headers

accept-language: en-US,en;q=0.9
Referer: http://xradio.ar/fr/Agricol_bank/region/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Date: Sat, 23 Mar 2024 23:02:18 GMT
Last-Modified: Thu, 15 Feb 2024 13:42:18 GMT
Server: Apache
ETag: "774-6116bcbc32280"
Upgrade: h2,h2c
Content-Type: image/png
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 1908

GET
H/1.1 200
OK soon.svg
xradio.ar/fr/Agricol_bank/region/image/ 16 KB
16 KB 162ms
162ms Image
image/svg+xml 66.97.42.18
Dattatec.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://xradio.ar/fr/Agricol_bank/region/image/soon.svg
Requested by: Host: xradio.ar
URL: http://xradio.ar/fr/Agricol_bank/region/
Protocol: HTTP/1.1
Server: 66.97.42.18 Rosario, Argentina, ASN27823 (Dattatec.com, AR),
Reverse DNS: vps-2320372-x.dattaweb.com
Software: Apache /
Resource Hash: 4a3b0d2a941677f6fb37a438d20deacc3cea1d6fdc728f72cf3d7ca099cc0ca9

Request headers

accept-language: en-US,en;q=0.9
Referer: http://xradio.ar/fr/Agricol_bank/region/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Date: Sat, 23 Mar 2024 23:02:18 GMT
Last-Modified: Thu, 15 Feb 2024 13:42:18 GMT
Server: Apache
ETag: "3f78-6116bcbc32280"
Content-Type: image/svg+xml
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 16248

GET
H/1.1 200
OK look.png
xradio.ar/fr/Agricol_bank/region/image/ 581 B
849 B 164ms
163ms Image
image/png 66.97.42.18
Dattatec.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://xradio.ar/fr/Agricol_bank/region/image/look.png
Requested by: Host: xradio.ar
URL: http://xradio.ar/fr/Agricol_bank/region/
Protocol: HTTP/1.1
Server: 66.97.42.18 Rosario, Argentina, ASN27823 (Dattatec.com, AR),
Reverse DNS: vps-2320372-x.dattaweb.com
Software: Apache /
Resource Hash: 17ec4a572a7e747f47a755bf0f22b0a8150d0ece6ac760cd46b4826d13cf6256

Request headers

accept-language: en-US,en;q=0.9
Referer: http://xradio.ar/fr/Agricol_bank/region/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Date: Sat, 23 Mar 2024 23:02:19 GMT
Last-Modified: Thu, 15 Feb 2024 13:42:18 GMT
Server: Apache
ETag: "245-6116bcbc32280"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 581

GET
H/1.1 200
OK jquery-3.5.1.min.js Show response
xradio.ar/fr/Agricol_bank/region/js/ 87 KB
31 KB 162ms
162ms Script
application/javascript 66.97.42.18
Dattatec.com

General

Check archive.org

Show headers Download Go to

Full URL: http://xradio.ar/fr/Agricol_bank/region/js/jquery-3.5.1.min.js
Requested by: Host: xradio.ar
URL: http://xradio.ar/fr/Agricol_bank/region/
Protocol: HTTP/1.1
Server: 66.97.42.18 Rosario, Argentina, ASN27823 (Dattatec.com, AR),
Reverse DNS: vps-2320372-x.dattaweb.com
Software: Apache /
Resource Hash: f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

accept-language: en-US,en;q=0.9
Referer: http://xradio.ar/fr/Agricol_bank/region/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Date: Sat, 23 Mar 2024 23:02:19 GMT
Content-Encoding: gzip
Last-Modified: Thu, 15 Feb 2024 13:42:18 GMT
Server: Apache
ETag: "15d84-6116bcbc32280-gzip"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 30910

GET
H/1.1 200
OK jquery.mask.js Show response
xradio.ar/fr/Agricol_bank/region/js/ 23 KB
6 KB 162ms
161ms Script
application/javascript 66.97.42.18
Dattatec.com

General

Check archive.org

Show headers Download Go to

Full URL: http://xradio.ar/fr/Agricol_bank/region/js/jquery.mask.js
Requested by: Host: xradio.ar
URL: http://xradio.ar/fr/Agricol_bank/region/
Protocol: HTTP/1.1
Server: 66.97.42.18 Rosario, Argentina, ASN27823 (Dattatec.com, AR),
Reverse DNS: vps-2320372-x.dattaweb.com
Software: Apache /
Resource Hash: a199620fe981df00a825f78761d3f7c8870f8117daa4a890e08018dec386dae8

Request headers

accept-language: en-US,en;q=0.9
Referer: http://xradio.ar/fr/Agricol_bank/region/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Date: Sat, 23 Mar 2024 23:02:19 GMT
Content-Encoding: gzip
Last-Modified: Thu, 15 Feb 2024 13:42:18 GMT
Server: Apache
ETag: "5a88-6116bcbc32280-gzip"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 5877

GET
H/1.1 200
OK jq.js Show response
xradio.ar/fr/Agricol_bank/region/js/ 360 KB
122 KB 168ms
167ms Script
application/javascript 66.97.42.18
Dattatec.com

General

Check archive.org

Show headers Download Go to

Full URL: http://xradio.ar/fr/Agricol_bank/region/js/jq.js
Requested by: Host: xradio.ar
URL: http://xradio.ar/fr/Agricol_bank/region/
Protocol: HTTP/1.1
Server: 66.97.42.18 Rosario, Argentina, ASN27823 (Dattatec.com, AR),
Reverse DNS: vps-2320372-x.dattaweb.com
Software: Apache /
Resource Hash: 15c179af6a66be10fa288925824cbf9fea1e277066233e55425c119dd01db43e

Request headers

accept-language: en-US,en;q=0.9
Referer: http://xradio.ar/fr/Agricol_bank/region/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Date: Sat, 23 Mar 2024 23:02:19 GMT
Content-Encoding: gzip
Last-Modified: Thu, 15 Feb 2024 13:42:18 GMT
Server: Apache
ETag: "5a16d-6116bcbc32280-gzip"
Vary: Accept-Encoding
Transfer-Encoding: chunked
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99

GET
H2 200 css2
fonts.googleapis.com/ 21 KB
1 KB 176ms
68ms Stylesheet
text/css 2607:f8b0:4004:c06::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Inter:wght@100;200;300;400;500;600;700;800;900&display=swap

Requested by

Host: xradio.ar
URL: http://xradio.ar/fr/Agricol_bank/region/css/over.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c06::5f Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

90c4f0951056e5a82b2150c8b3fe6d011a08ea2abc957453d080b8179504e2d7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: http://xradio.ar/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 23 Mar 2024 22:59:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sat, 23 Mar 2024 22:35:30 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 23 Mar 2024 22:59:19 GMT

GET
H2 200 UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2
fonts.gstatic.com/s/inter/v13/ 46 KB
46 KB 161ms
54ms Font
font/woff2 2607:f8b0:4004:c1b::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/inter/v13/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Inter:wght@100;200;300;400;500;600;700;800;900&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1b::5e Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

88df0b5a7bc397dbc13a26bb8b3742cc62cd1c9b0dded57da7832416d6f52f42

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: http://xradio.ar
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Fri, 22 Mar 2024 16:22:24 GMT
x-content-type-options: nosniff
age: 110215
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 46704
x-xss-protection: 0
last-modified: Wed, 13 Sep 2023 23:49:07 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 22 Mar 2025 16:22:24 GMT

GET
H3 200 bootstrap-icons.woff2
cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/fonts/ 88 KB
89 KB 57ms
27ms Font
font/woff2 2a04:4e42::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/fonts/bootstrap-icons.woff2?856008caa5eb66df68595e734e59580d

Requested by

Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/bootstrap-icons.css

Protocol

Security

QUIC, , AES_256_GCM

Server

2a04:4e42::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

76506e128f2b47b7179f5037bd885a1674455ffeb6b5093cdb4c7eefbf436ce8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/bootstrap-icons.css
Origin: http://xradio.ar
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Sat, 23 Mar 2024 22:59:19 GMT
x-content-type-options: nosniff
age: 2648265
x-jsd-version: 1.5.0
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 90528
x-served-by: cache-fra-eddf8230031-FRA, cache-mia-kmia1760031-MIA
x-jsd-version-type: version
etag: W/"161a0-RkmHeGigBozlCxBdDSojXoAQyY8"
vary: Accept-Encoding
content-type: font/woff2
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 fontawesome-webfont.woff2
stackpath.bootstrapcdn.com/font-awesome/4.7.0/fonts/ 75 KB
76 KB 107ms
48ms Font
font/woff2 2606:4700::6812:bcf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://stackpath.bootstrapcdn.com/font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0

Requested by

Host: stackpath.bootstrapcdn.com
URL: https://stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css
Origin: http://xradio.ar
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Sat, 23 Mar 2024 22:59:19 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
cdn-edgestorageid: 975
cdn-cachedat: 10/31/2023 18:55:41
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 77160
last-modified: Mon, 25 Jan 2021 22:04:55 GMT
cdn-proxyver: 1.04
cdn-requestpullcode: 200
server: cloudflare
etag: "af7ae505a9eed503f8b8e6982036873e"
vary: Accept-Encoding
content-type: font/woff2
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cache-control: public, max-age=31919000
cdn-requestid: 8f2efcd73cc2a6f068be15fb13631f12
accept-ranges: bytes
timing-allow-origin: *
cdn-requestcountrycode: US
cdn-status: 200
cf-ray: 86920800bcdd743c-MIA
cdn-requestpullsuccess: True

GET
H/1.1 200
OK background_cc.jpg
xradio.ar/fr/Agricol_bank/region/image/ 238 KB
238 KB 262ms
158ms Image
image/jpeg 66.97.42.18
Dattatec.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://xradio.ar/fr/Agricol_bank/region/image/background_cc.jpg
Requested by: Host: xradio.ar
URL: http://xradio.ar/fr/Agricol_bank/region/css/over.css
Protocol: HTTP/1.1
Server: 66.97.42.18 Rosario, Argentina, ASN27823 (Dattatec.com, AR),
Reverse DNS: vps-2320372-x.dattaweb.com
Software: Apache /
Resource Hash: c4966ab5e78e2270952b89576c4a0a386e8a7ea673c56f0f396d620abf4f81b8

Request headers

accept-language: en-US,en;q=0.9
Referer: http://xradio.ar/fr/Agricol_bank/region/css/over.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Date: Sat, 23 Mar 2024 23:02:19 GMT
Last-Modified: Thu, 15 Feb 2024 13:42:18 GMT
Server: Apache
ETag: "3b8cf-6116bcbc32280"
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 243919

GET
DATA 200
OK truncated
/ 183 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 829ad3ed0c2f892e7df84989078dd4246fc0a5f1a179439e6314462465dbb2f6

Request headers

accept-language: en-US,en;q=0.9
Referer: http://xradio.ar/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Content-Type: image/svg+xml

POST receive_token
102.165.14.4/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: 102.165.14.4
URL: http://102.165.14.4:5000/receive_token?referrer=loco

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Credit Agricole (Banking)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			xradio.ar/	1969-12-31 23:59:59	Name: PHPSESSID Value: 9f4e327df972eaf595672380adb3c9cf

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	error	URL: http://xradio.ar/fr/Agricol_bank/region/ Message: Access to fetch at 'http://102.165.14.4:5000/receive_token?referrer=loco' from origin 'http://xradio.ar' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.
network	error	URL: http://102.165.14.4:5000/receive_token?referrer=loco Message: Failed to load resource: net::ERR_FAILED

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

102.165.14.4
cdn.jsdelivr.net
fonts.googleapis.com
fonts.gstatic.com
stackpath.bootstrapcdn.com
xradio.ar
102.165.14.4
2606:4700::6812:bcf
2607:f8b0:4004:c06::5f
2607:f8b0:4004:c1b::5e
2a04:4e42::485
66.97.42.18
0c159070e198b7ed2a9162d6c9751f5914ff62803914d8512d60b1f5ffde4334
15c179af6a66be10fa288925824cbf9fea1e277066233e55425c119dd01db43e
17ec4a572a7e747f47a755bf0f22b0a8150d0ece6ac760cd46b4826d13cf6256
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
3c325075337b768950583012228055ae392e384688d77ec5235e6ca88dcec6ef
4976f0796d8f82ad9766b9ef9e270e5e082ee57a79f6fbb121e9f3279e4cb4dd
4a3b0d2a941677f6fb37a438d20deacc3cea1d6fdc728f72cf3d7ca099cc0ca9
576dbb9ac470cc8ba17f6df967ccc1913bb6b82132d7b41105f505e932346a85
5c44321c0ba44a1fa665ba4c928fbebd869a3082c458bd2d20a0d07a4e5fcc24
5db63f3ba53740ed463cc68dbf63e1412944ed6f647aaab85c7507abfaacf6f1
76506e128f2b47b7179f5037bd885a1674455ffeb6b5093cdb4c7eefbf436ce8
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
829ad3ed0c2f892e7df84989078dd4246fc0a5f1a179439e6314462465dbb2f6
88df0b5a7bc397dbc13a26bb8b3742cc62cd1c9b0dded57da7832416d6f52f42
8c40de2f4f4739d1fe369662082fa9f14338c79f8f8e68d1d7fbc38bc97c6797
90c4f0951056e5a82b2150c8b3fe6d011a08ea2abc957453d080b8179504e2d7
a199620fe981df00a825f78761d3f7c8870f8117daa4a890e08018dec386dae8
c4966ab5e78e2270952b89576c4a0a386e8a7ea673c56f0f396d620abf4f81b8
d3eaff44881ec8b5353d3e5b7f27b60be481a245d86992edba2f9735e0e87f9a
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

xradio.ar Open in urlscan Pro 66.97.42.18 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

20 Requests

30 %HTTPS

80 %IPv6

6 Domains

6 Subdomains

6 IPs

2 Countries

702 kBTransfer

1291 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

20 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

6 JavaScript Global Variables

1 Cookies

2 Console Messages

Indicators

xradio.ar Open in urlscan Pro
66.97.42.18 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

20
Requests

30 %
HTTPS

80 %
IPv6

6
Domains

6
Subdomains

6
IPs

2
Countries

702 kB
Transfer

1291 kB
Size

1
Cookies

20 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!