wsec11-bancogalicia.com Open in urlscan Pro
2a06:98c1:3121::c  Malicious Activity! Public Scan

URL: https://wsec11-bancogalicia.com/
Submission: On February 23 via manual from SG — Scanned from NL

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 8 HTTP transactions. The main IP is 2a06:98c1:3121::c, located in United States and belongs to CLOUDFLARENET, US. The main domain is wsec11-bancogalicia.com.
TLS certificate: Issued by GTS CA 1P5 on February 16th 2023. Valid for: 3 months.
This is the only time wsec11-bancogalicia.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banco Galicia (Banking)

Domain & IP information

IP Address AS Autonomous System
6 2a06:98c1:312... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 161.190.1.33 13474 (Banco de ...)
8 3
Apex Domain
Subdomains
Transfer
6 wsec11-bancogalicia.com
wsec11-bancogalicia.com
172 KB
1 bancogalicia.com.ar
wsec06.bancogalicia.com.ar
3 KB
1 jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 346
13 KB
8 3
Domain Requested by
6 wsec11-bancogalicia.com wsec11-bancogalicia.com
1 wsec06.bancogalicia.com.ar wsec11-bancogalicia.com
1 cdn.jsdelivr.net wsec11-bancogalicia.com
8 3

This site contains no links.

Subject Issuer Validity Valid
*.wsec11-bancogalicia.com
GTS CA 1P5
2023-02-16 -
2023-05-17
3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2022-06-02 -
2023-06-01
a year crt.sh
wsec06.bancogalicia.com.ar
DigiCert SHA2 Extended Validation Server CA
2022-03-15 -
2023-03-15
a year crt.sh

This page contains 1 frames:

Primary Page: https://wsec11-bancogalicia.com/
Frame ID: 3542368DC1A1CB543DE4F1A7A259DBEB
Requests: 8 HTTP requests in this frame

Screenshot

Page Title

Gaicia | login

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css

Overall confidence: 100%
Detected patterns
  • <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
  • //cdn\.jsdelivr\.net/

Page Statistics

8
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

189 kB
Transfer

360 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
wsec11-bancogalicia.com/
2 KB
1 KB
Document
General
Full URL
https://wsec11-bancogalicia.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
471ecd2326e1901ee1e7f3dac500ee67e730ddc7d2204c515d6373561baa6691

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
79ddc65968d06940-FRA
content-encoding
br
content-type
text/html; charset=UTF-8
date
Thu, 23 Feb 2023 06:06:19 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XU0%2FSL0UYrWTEPcg8D1DD3dcehYNaZUplvwGBzmyCopE9gnCS3osi9G7UzkIgvYZUE6FVEBn%2FuJU%2B9ju%2Fm4aoKu8nw8aGzW6tkeuIDrUyPkvk1oCpn0dfphEyUY5BkzvRLpu%2FsOoG%2Bu%2BZpLLayccI6d7qW9hKw%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
bootstrap-icons.css
cdn.jsdelivr.net/npm/bootstrap-icons@1.10.3/font/
93 KB
13 KB
Stylesheet
General
Full URL
https://cdn.jsdelivr.net/npm/bootstrap-icons@1.10.3/font/bootstrap-icons.css
Requested by
Host: wsec11-bancogalicia.com
URL: https://wsec11-bancogalicia.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5614 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e1172d3a0a208cf01dc066f0abeaf17f00264a966159a69f71947d6edcd4935f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://wsec11-bancogalicia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Thu, 23 Feb 2023 06:06:19 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
77554
x-jsd-version
1.10.3
content-encoding
br
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by
cache-fra-eddf8230031-FRA, cache-yyz4560-YYZ
x-jsd-version-type
version
server
cloudflare
etag
W/"17579-AwBvMnkuAzSX6cpoNztsM4YwWTM"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JlJlnyafTyUxW4V5vD5pjtU%2FtJ4pI705EwuQC23vp3GSl0S0zAuEI8SIbMSlUTCDAG55AEuGiU8reNI4UmxLbvDhpB%2BfEeH7srIn2w%2BszWhc4BKY4bej5gI%2BF3aBz6cbKG0Zqyhz%2FbGDHmLLX3U%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin
*
cf-ray
79ddc65afab49bcb-FRA
style.css
wsec11-bancogalicia.com/main/
2 KB
1 KB
Stylesheet
General
Full URL
https://wsec11-bancogalicia.com/main/style.css
Requested by
Host: wsec11-bancogalicia.com
URL: https://wsec11-bancogalicia.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
23b83af9357e3c395d99276c28aa90784241ae2ec8d02718ac191546ab921453

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://wsec11-bancogalicia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Thu, 23 Feb 2023 06:06:19 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Fri, 17 Feb 2023 13:19:07 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"6ed-5f4e5287508c0-gzip"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JX2hWFnR0oZXub2z7AA%2FX5w7sNOfNUPV9HgWcr7%2FB01XCbjHqkfHoNv%2FpFqm%2FacgLlgbMIRlugFQ5pFX4EbFWG%2B5oEhmtMhYovuyhahKyqOdNq%2BK12dvU82JWPt6twRnRf0SgdcdqiXlVojfc6YMmr5oPcKQ2w%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
79ddc65aba3a6940-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
all.min.css
wsec11-bancogalicia.com/main/
115 KB
23 KB
Stylesheet
General
Full URL
https://wsec11-bancogalicia.com/main/all.min.css
Requested by
Host: wsec11-bancogalicia.com
URL: https://wsec11-bancogalicia.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
06dafcc7c041da9c6a9465ae0481878aebd8bcbde25f1ed2ad601a14e07db4e5

Request headers

Referer
Origin
https://wsec11-bancogalicia.com
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Thu, 23 Feb 2023 06:06:19 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Fri, 17 Feb 2023 19:04:31 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"1cc12-5f4e9fbb42dc0-gzip"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=k3BKM8lRc%2BfZ2kjBYV75rJMZMXCfg0Yaw%2B6k23nC72E%2Bln6fuKUvS7nhd0mpYHdQymPdg5Xgd0ui8wyVjEl5po%2FPasIS74RNjkB9gKUVLsRXKU1QuoBQQC0AbuLeTUjjSJ2PzAIhn8YSRnYRSsmvH6f%2FwRtEEw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
79ddc65aba3e6940-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
logo-galicia-new.png
wsec11-bancogalicia.com/main/
4 KB
4 KB
Image
General
Full URL
https://wsec11-bancogalicia.com/main/logo-galicia-new.png
Requested by
Host: wsec11-bancogalicia.com
URL: https://wsec11-bancogalicia.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c1ac115788f922e9bb68fc1e4710ed077bcae6e5014bc163c434b598e1e17ec9

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://wsec11-bancogalicia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Thu, 23 Feb 2023 06:06:19 GMT
cf-cache-status
MISS
last-modified
Fri, 17 Feb 2023 13:19:07 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"e05-5f4e5287508c0"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Fw%2BrZ8nhXFHvWaboLudzEcRMiHRy4GS%2FdTsL8UQVZclRY8atRSMP3n2wafITp4SE6b9jrqCKTET7WkbxQCkYQ%2FlDpdWGoK%2Bb1%2FKjHjvV97%2FJgGZnm4ob9EsW17T1bmeopEGNfXdCrp9eRwL3Y10LdgBJ3jrXJw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
79ddc65aca516940-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
3589
logo-ob.png
wsec11-bancogalicia.com/main/
40 KB
41 KB
Image
General
Full URL
https://wsec11-bancogalicia.com/main/logo-ob.png
Requested by
Host: wsec11-bancogalicia.com
URL: https://wsec11-bancogalicia.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8ba5487a3441be54f0d77878bdde04863c7918e7551eae45e7d4d039d701d313

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://wsec11-bancogalicia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Thu, 23 Feb 2023 06:06:19 GMT
cf-cache-status
MISS
last-modified
Fri, 17 Feb 2023 13:19:07 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"a122-5f4e5287508c0"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=biIh6vHckQiamDK%2Fh7szZKdojJ8kFpfDK2ffwOta%2B62nYQYI8uAwpY9uOJMGycuGVdYLlgFWyPdy7O6WpwbDglvXw5Jfjd%2Feobh6bcFhqRaQFOtVis5Ot5LU9boj%2FFOYi20r8noRRQJDStcm8yhNJ4GGWBwe5g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
79ddc65aca526940-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
41250
login-banner-07.jpg
wsec11-bancogalicia.com/main/
101 KB
102 KB
Image
General
Full URL
https://wsec11-bancogalicia.com/main/login-banner-07.jpg
Requested by
Host: wsec11-bancogalicia.com
URL: https://wsec11-bancogalicia.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
31afa957108f620ee57fedf4b247b461f88e30f921b6a6216576b9f42d72fbad

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://wsec11-bancogalicia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Thu, 23 Feb 2023 06:06:19 GMT
cf-cache-status
MISS
last-modified
Fri, 17 Feb 2023 13:19:07 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"195ac-5f4e5287508c0"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=H62%2B6eCR%2BSyLBlnfZ9jYVbeW3CyOlAypArdVMLf3tAMth%2BqNbD9OgdJuxV5ytnQHNlHu8iElLZOKWa1EVC7PJVStQpmL3Ex9Mo1cbXkOgdaN9v5Yyfq2Bjk2bOIDgWgFCSgSytX9gtUjMxQtFnsZNTqiyzukDQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
79ddc65aca536940-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
103852
l-accesos.png
wsec06.bancogalicia.com.ar/images/commons/
3 KB
3 KB
Image
General
Full URL
https://wsec06.bancogalicia.com.ar/images/commons/l-accesos.png
Requested by
Host: wsec11-bancogalicia.com
URL: https://wsec11-bancogalicia.com/main/style.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
161.190.1.33 Buenos Aires, Argentina, ASN13474 (Banco de Galicia y Buenos Aires, AR),
Reverse DNS
wsec06.bancogalicia.com.ar
Software
/
Resource Hash
284627306a3d1ac25a21fd5fa4ef02476311552117570c23ea2437535173c01c

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://wsec11-bancogalicia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date
Thu, 23 Feb 2023 06:06:20 GMT
Last-Modified
Mon, 13 Feb 2023 17:51:32 GMT
Accept-Ranges
bytes
ETag
"50a8f4ced33fd91:0"
Content-Length
3030
Content-Type
image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banco Galicia (Banking)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| oncontentvisibilityautostatechange

0 Cookies

1 Console Messages

Source Level URL
Text
security error URL: https://wsec11-bancogalicia.com/
Message:
Failed to find a valid digest in the 'integrity' attribute for resource 'https://wsec11-bancogalicia.com/main/all.min.css' with computed SHA-512 integrity 'U8dsj5ZytX4aQc4Sd1z1re+ajPrOaBmNTqbujpQriNazQIPXy9xN9PWl2/W5scnm0ETkOQoNckcbDFEclxA3hg=='. The resource has been blocked.