gal-ficce.com
Open in
urlscan Pro
2800:6c0:2::5
Malicious Activity!
Public Scan
URL:
http://gal-ficce.com/
Submission Tags: tweet @atomspam #phishing #bancogalicia #bank #infosec #cybersecurity #atomspam Search All
Submission: On February 16 via api from FI — Scanned from FI
Submission Tags: tweet @atomspam #phishing #bancogalicia #bank #infosec #cybersecurity #atomspam Search All
Submission: On February 16 via api from FI — Scanned from FI
Summary
This website contacted 2 IPs
in 2 countries
across 2 domains to perform 9 HTTP transactions.
The main IP is 2800:6c0:2::5, located in
Rosario, Argentina and
belongs to Dattatec.com, AR.
The main domain is gal-ficce.com.
This is the only time gal-ficce.com was scanned on urlscan.io!
This is the only time gal-ficce.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Banco Galicia (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 7 | 2800:6c0:2::5 2800:6c0:2::5 | 27823 (Dattatec.com) (Dattatec.com) | |
| 2 | 2a04:4e42::485 2a04:4e42::485 | 54113 (FASTLY) (FASTLY) | |
| 9 | 2 |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 7 |
gal-ficce.com
gal-ficce.com |
205 KB |
| 2 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 346 |
132 KB |
| 9 | 2 |
| Domain | Requested by | |
|---|---|---|
| 7 | gal-ficce.com |
gal-ficce.com
|
| 2 | cdn.jsdelivr.net |
gal-ficce.com
cdn.jsdelivr.net |
| 9 | 2 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2022 Q4 |
2022-12-23 - 2024-01-24 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
http://gal-ficce.com/
Frame ID: C16FEDFB92D12C6FB6923FFAEC632C3C
Requests: 9 HTTP requests in this frame
Screenshot
Detected technologies
Bootstrap
(Web Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
jsDelivr
(CDN)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
- //cdn\.jsdelivr\.net/
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
9 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
/
gal-ficce.com/ |
2 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bootstrap-icons.css
cdn.jsdelivr.net/npm/bootstrap-icons@1.10.3/font/ |
93 KB 14 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
style.css
gal-ficce.com/assets/ |
3 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
logo-galicia-new.png
gal-ficce.com/assets/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
logo-ob.png
gal-ficce.com/assets/ |
40 KB 41 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
login-banner-07.jpg
gal-ficce.com/assets/ |
101 KB 102 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
logo-norton-secured.png
gal-ficce.com/assets/ |
53 KB 54 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
l-accesos.png
gal-ficce.com/assets/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
bootstrap-icons.woff2
cdn.jsdelivr.net/npm/bootstrap-icons@1.10.3/font/fonts/ |
118 KB 119 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Banco Galicia (Banking)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| oncontentvisibilityautostatechange0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.jsdelivr.net
gal-ficce.com
2800:6c0:2::5
2a04:4e42::485
284627306a3d1ac25a21fd5fa4ef02476311552117570c23ea2437535173c01c
31afa957108f620ee57fedf4b247b461f88e30f921b6a6216576b9f42d72fbad
35cb5eab45d68fb30d35b279656e72d0d55c16a133b194aaa0282b9ee053a8a6
51a63a7fb8dc541f902634f27163c30b58619a40fd1deea5afbae67dba54d486
8ba5487a3441be54f0d77878bdde04863c7918e7551eae45e7d4d039d701d313
966620f9e3bec428663687f9e8d67a6b8e35d79adebf6fb204e9b139eada7599
b84a5f002e3d24b8a7475ec6dc516bbc63ca08071ba1167b136bc99be0abca6d
c1ac115788f922e9bb68fc1e4710ed077bcae6e5014bc163c434b598e1e17ec9
e1172d3a0a208cf01dc066f0abeaf17f00264a966159a69f71947d6edcd4935f