ft9r3d-5000.csb.app Open in urlscan Pro
2606:4700::6812:7b8  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response ft9r3d-5000.csb.app/	7 KB 3 KB	1696ms 1679ms	Document text/html	2606:4700::6812:7b8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ft9r3d-5000.csb.app/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:7b8 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c8877645f636a48d37f4d4d5c3609eaae715090d772c0ab0a3070618f7c72988 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Response headers alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 8acf2c53ec46afff-NRT content-disposition inline; filename="index.html" content-encoding br content-type text/html; charset=utf-8 date Fri, 02 Aug 2024 15:41:38 GMT server cloudflare strict-transport-security max-age=31536000; includeSubDomains vary Accept-Encoding, Accept-Encoding
GET H/1.1	200 OK	logo.svg onlinebanking.bancogalicia.com.ar/images/default/	5 KB 2 KB	1648ms 307ms	Image image/svg+xml	161.190.1.97 Banco de Galicia ...
General Check archive.org Show headers Download Go to Show image Full URL https://onlinebanking.bancogalicia.com.ar/images/default/logo.svg Requested by Host: ft9r3d-5000.csb.app URL: https://ft9r3d-5000.csb.app/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 161.190.1.97 Buenos Aires, Argentina, ASN13474 (Banco de Galicia y Buenos Aires, AR), Reverse DNS inversiones.bancogalicia.com.ar Software / Resource Hash fad6369e7b4e8af718c87cf1d5e13e9f3c3e831725a388ad52a971ee70c1abe8 Request headers Referer https://ft9r3d-5000.csb.app/ User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Response headers Date Fri, 02 Aug 2024 15:41:10 GMT Content-Encoding gzip Last-Modified Wed, 29 May 2024 13:17:59 GMT ETag "801d32a0cab1da1:0" Vary Accept-Encoding Content-Type image/svg+xml Accept-Ranges bytes Content-Length 1806
GET H3	200	preview-protocol.js Show response codesandbox.io/p/	176 KB 56 KB	78ms 64ms	Script application/javascript	104.18.29.19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://codesandbox.io/p/preview-protocol.js Requested by Host: ft9r3d-5000.csb.app URL: https://ft9r3d-5000.csb.app/ Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.29.19 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash e5816a040f78bd21a0a149637977c04c952c491111c5dcbec993fa91b4cb566c Request headers Referer https://ft9r3d-5000.csb.app/ User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Response headers date Fri, 02 Aug 2024 15:41:39 GMT via 1.1 google content-encoding br cf-cache-status HIT last-modified Thu, 25 Jul 2024 15:21:44 GMT server cloudflare age 86404 x-powered-by Express vary Accept-Encoding content-type application/javascript cache-control public, max-age=604800, immutable cf-ray 8acf2c5e9fdef5bb-NRT alt-svc h3=":443"; ma=86400
GET H3	200	bg.png ft9r3d-5000.csb.app/	530 KB 531 KB	371ms 371ms	Image image/png	104.18.6.184 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://ft9r3d-5000.csb.app/bg.png Requested by Host: ft9r3d-5000.csb.app URL: https://ft9r3d-5000.csb.app/ Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.6.184 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 718ec31f3494fe5bab5de074f5d282f758a07c029d22982d42f5c5fcb06a47f1 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://ft9r3d-5000.csb.app/ User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Response headers date Fri, 02 Aug 2024 15:41:39 GMT strict-transport-security max-age=31536000; includeSubDomains cf-cache-status DYNAMIC server cloudflare etag "adbe85358537467d72ea810889a6f7ce52beff80" vary Accept-Encoding content-type image/png content-disposition inline; filename="bg.png" accept-ranges bytes cf-ray 8acf2c5e8d98737c-NRT alt-svc h3=":443"; ma=86400 content-length 543123
GET H3	200	ft9r3d-5000 codesandbox.io/p/devtool/inline-preview/ Frame 794C	0 0	298ms 286ms	Document text/html	104.18.28.19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://codesandbox.io/p/devtool/inline-preview/ft9r3d-5000 Requested by Host: codesandbox.io URL: https://codesandbox.io/p/preview-protocol.js Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.28.19 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash Request headers Referer https://ft9r3d-5000.csb.app/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Response headers alt-svc h3=":443"; ma=86400 cache-control no-cache, no-store, must-revalidate cf-cache-status DYNAMIC cf-ray 8acf2c5f5fcc6874-NRT content-encoding br content-type text/html; charset=utf-8 date Fri, 02 Aug 2024 15:41:39 GMT frame-ancestors 'self' https://ft9r3d-5000.csb.app server cloudflare via 1.1 google x-powered-by Express
GET H3	404	favicon.ico ft9r3d-5000.csb.app/	2 KB 854 B	386ms 386ms	Other text/html	104.18.6.184 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ft9r3d-5000.csb.app/favicon.ico Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.6.184 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8c45c679f40c3f81c111fbf2398d568189c3ab34d8a9704ad225cd8efe1b819f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://ft9r3d-5000.csb.app/ User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Response headers date Fri, 02 Aug 2024 15:41:41 GMT strict-transport-security max-age=31536000; includeSubDomains content-encoding br cf-cache-status DYNAMIC server cloudflare vary Accept-Encoding content-type text/html; charset=utf-8 cf-ray 8acf2c6bbe05737c-NRT alt-svc h3=":443"; ma=86400

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banco Galicia (Banking)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| __REACT_DEVTOOLS_GLOBAL_HOOK__ object| CODESANDBOX_PREVIEW object| __CSB_PREVIEW_PROTOCOL function| enableLocalhostProxy

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.codesandbox.io/	1969-12-31 23:59:59	Name: _cfuvid Value: VRzQEuWQqivwhS_asnCFxySTV4idl8KOVP6BENrKao8-1722613299466-0.0.1.1-604800000
			.codesandbox.io/	1970-01-21 07:15:49	Name: cf_clearance Value: KP74xNes9K8YHCDDrXjPJS9i1ss__Ay.QZpwab5iNcI-1722613301-1.0.1.1-OJAPM3GA_vkhkvEPOt5ORmOJSwhkEP4IQZMV4dlbxr77Sb_IiWNpxENsrPs3NSrpGmM2PjgjC4RpqPZ12kimqg

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://ft9r3d-5000.csb.app/ Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o
network	error	URL: https://ft9r3d-5000.csb.app/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

codesandbox.io
ft9r3d-5000.csb.app
onlinebanking.bancogalicia.com.ar
104.18.28.19
104.18.29.19
104.18.6.184
161.190.1.97
2606:4700::6812:7b8
718ec31f3494fe5bab5de074f5d282f758a07c029d22982d42f5c5fcb06a47f1
8c45c679f40c3f81c111fbf2398d568189c3ab34d8a9704ad225cd8efe1b819f
c8877645f636a48d37f4d4d5c3609eaae715090d772c0ab0a3070618f7c72988
e5816a040f78bd21a0a149637977c04c952c491111c5dcbec993fa91b4cb566c
fad6369e7b4e8af718c87cf1d5e13e9f3c3e831725a388ad52a971ee70c1abe8