78.138.105.194 Open in urlscan Pro
78.138.105.194  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request validar-datos.html Show response 78.138.105.194/bgeneralinforma/	15 KB 16 KB	19ms 10ms	Document text/html	78.138.105.194 VELIANET-AS velia...
General Check archive.org Show headers Download Go to Full URL http://78.138.105.194/bgeneralinforma/validar-datos.html Protocol HTTP/1.1 Server 78.138.105.194 Strasbourg, France, ASN29066 (VELIANET-AS velia.net Internetdienste GmbH, DE), Reverse DNS Software Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/7.4.27 / Resource Hash 4ab4a4fc2c04a05cf873f5efb18f4e49ce81495bb33f353776ebffd8b337ccdc Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Accept-Ranges bytes Connection Keep-Alive Content-Length 15783 Content-Type text/html Date Wed, 27 Apr 2022 01:16:30 GMT ETag "3da7-5da48fa93ed26" Keep-Alive timeout=5, max=100 Last-Modified Tue, 15 Mar 2022 22:04:20 GMT Server Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/7.4.27
GET H/1.1	200 OK	aui.css 78.138.105.194/bgeneralinforma/validar-datos_files/	403 KB 403 KB	11ms 10ms	Stylesheet text/css	78.138.105.194 VELIANET-AS velia...
General Check archive.org Show headers Download Go to Full URL http://78.138.105.194/bgeneralinforma/validar-datos_files/aui.css Requested by Host: 78.138.105.194 URL: http://78.138.105.194/bgeneralinforma/validar-datos.html Protocol HTTP/1.1 Server 78.138.105.194 Strasbourg, France, ASN29066 (VELIANET-AS velia.net Internetdienste GmbH, DE), Reverse DNS Software Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/7.4.27 / Resource Hash 334b78e03d7a14c01c4fd359ccb58af76cfd87790619a59fcf523daaf8725fcd Request headers accept-language de-DE,de;q=0.9 Referer http://78.138.105.194/bgeneralinforma/validar-datos.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers Date Wed, 27 Apr 2022 01:16:30 GMT Last-Modified Mon, 31 Jan 2022 04:32:11 GMT Server Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/7.4.27 ETag "64ac7-5d6d9449de8c0" Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 412359
GET H/1.1	404 Not Found	text-security.min.css 78.138.105.194/bgeneralinforma/index3_files/	0 0	19ms 10ms	Stylesheet text/html	78.138.105.194 VELIANET-AS velia...
General Check archive.org Show headers Download Go to Full URL http://78.138.105.194/bgeneralinforma/index3_files/text-security.min.css Requested by Host: 78.138.105.194 URL: http://78.138.105.194/bgeneralinforma/validar-datos.html Protocol HTTP/1.1 Server 78.138.105.194 Strasbourg, France, ASN29066 (VELIANET-AS velia.net Internetdienste GmbH, DE), Reverse DNS Software Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/7.4.27 / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer http://78.138.105.194/bgeneralinforma/validar-datos.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers Date Wed, 27 Apr 2022 01:16:30 GMT Server Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/7.4.27 Connection Keep-Alive Keep-Alive timeout=5, max=100 Content-Length 301 Content-Type text/html; charset=iso-8859-1
GET H/1.1	200 OK	style.css 78.138.105.194/bgeneralinforma/validar-datos_files/	563 KB 563 KB	21ms 12ms	Stylesheet text/css	78.138.105.194 VELIANET-AS velia...
General Check archive.org Show headers Download Go to Full URL http://78.138.105.194/bgeneralinforma/validar-datos_files/style.css Requested by Host: 78.138.105.194 URL: http://78.138.105.194/bgeneralinforma/validar-datos.html Protocol HTTP/1.1 Server 78.138.105.194 Strasbourg, France, ASN29066 (VELIANET-AS velia.net Internetdienste GmbH, DE), Reverse DNS Software Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/7.4.27 / Resource Hash b4bee41db2466dcb5295743cd76ab6cdb499e86346fb7a27f4577d7552e4a582 Request headers accept-language de-DE,de;q=0.9 Referer http://78.138.105.194/bgeneralinforma/validar-datos.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers Date Wed, 27 Apr 2022 01:16:30 GMT Last-Modified Mon, 31 Jan 2022 04:32:11 GMT Server Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/7.4.27 ETag "8cc4b-5d6d9449de8c0" Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 576587
GET H/1.1	200 OK	bgp-logo.png 78.138.105.194/bgeneralinforma/validar-datos_files/	8 KB 8 KB	21ms 12ms	Image image/png	78.138.105.194 VELIANET-AS velia...
General Check archive.org Show headers Download Go to Show image Full URL http://78.138.105.194/bgeneralinforma/validar-datos_files/bgp-logo.png Requested by Host: 78.138.105.194 URL: http://78.138.105.194/bgeneralinforma/validar-datos.html Protocol HTTP/1.1 Server 78.138.105.194 Strasbourg, France, ASN29066 (VELIANET-AS velia.net Internetdienste GmbH, DE), Reverse DNS Software Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/7.4.27 / Resource Hash 50d4f2ea4b1e40df7806056d1e53197fb6a72395602bdc0e9c6a5bcb18ed80d9 Request headers accept-language de-DE,de;q=0.9 Referer http://78.138.105.194/bgeneralinforma/validar-datos.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers Date Wed, 27 Apr 2022 01:16:30 GMT Last-Modified Mon, 31 Jan 2022 04:32:11 GMT Server Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/7.4.27 ETag "2043-5d6d9449de8c0" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 8259
GET H/1.1	200 OK	bg-logo-stars-white.png 78.138.105.194/bgeneralinforma/validar-datos_files/	1 KB 1 KB	21ms 12ms	Image image/png	78.138.105.194 VELIANET-AS velia...
General Check archive.org Show headers Download Go to Show image Full URL http://78.138.105.194/bgeneralinforma/validar-datos_files/bg-logo-stars-white.png Requested by Host: 78.138.105.194 URL: http://78.138.105.194/bgeneralinforma/validar-datos.html Protocol HTTP/1.1 Server 78.138.105.194 Strasbourg, France, ASN29066 (VELIANET-AS velia.net Internetdienste GmbH, DE), Reverse DNS Software Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/7.4.27 / Resource Hash e4fff41e351265a02dfd7ae981d014af9d34e087eb63783d27512129feb4ec6c Request headers accept-language de-DE,de;q=0.9 Referer http://78.138.105.194/bgeneralinforma/validar-datos.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers Date Wed, 27 Apr 2022 01:16:30 GMT Last-Modified Mon, 31 Jan 2022 04:32:11 GMT Server Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/7.4.27 ETag "481-5d6d9449de8c0" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 1153
GET H2	200	css fonts.googleapis.com/	17 KB 1 KB	58ms 22ms	Stylesheet text/css	2a00:1450:4001:828::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,600,700,800&display=swap Requested by Host: 78.138.105.194 URL: http://78.138.105.194/bgeneralinforma/validar-datos_files/style.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 1269c6b5d07aea4a03deeb08ebd40084551bcddd81e5ac3bb63e7b89497683f1 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer http://78.138.105.194/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Wed, 27 Apr 2022 01:16:29 GMT server ESF cross-origin-opener-policy same-origin-allow-popups date Wed, 27 Apr 2022 01:16:29 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Wed, 27 Apr 2022 01:16:29 GMT
GET H2	200	memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 fonts.gstatic.com/s/opensans/v28/	44 KB 44 KB	50ms 15ms	Font font/woff2	2a00:1450:4001:803::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/opensans/v28/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,600,700,800&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 88915cdc03fc5b9a20aec966fe93ee38aa3fd76bfef296e41d305271b3541c96 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin http://78.138.105.194 accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers date Tue, 26 Apr 2022 22:45:07 GMT x-content-type-options nosniff age 9082 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 44656 x-xss-protection 0 last-modified Tue, 01 Mar 2022 22:03:03 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Wed, 26 Apr 2023 22:45:07 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banco General (Banking)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone object| oncontextlost object| oncontextrestored

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: http://78.138.105.194/bgeneralinforma/index3_files/text-security.min.css Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
fonts.gstatic.com
2a00:1450:4001:803::2003
2a00:1450:4001:828::200a
78.138.105.194
1269c6b5d07aea4a03deeb08ebd40084551bcddd81e5ac3bb63e7b89497683f1
334b78e03d7a14c01c4fd359ccb58af76cfd87790619a59fcf523daaf8725fcd
4ab4a4fc2c04a05cf873f5efb18f4e49ce81495bb33f353776ebffd8b337ccdc
50d4f2ea4b1e40df7806056d1e53197fb6a72395602bdc0e9c6a5bcb18ed80d9
88915cdc03fc5b9a20aec966fe93ee38aa3fd76bfef296e41d305271b3541c96
b4bee41db2466dcb5295743cd76ab6cdb499e86346fb7a27f4577d7552e4a582
e4fff41e351265a02dfd7ae981d014af9d34e087eb63783d27512129feb4ec6c