Report - www.galiciacgu.com.ar/cgu

Report Overview

Submitted URL
www.galiciacgu.com.ar/cgu
IP
54.84.203.208
ASN
#14618 AMAZON-AES
Submitted
2024-04-26 17:24:45
Access
public
Website Title
Galicia
Final URL
www.galiciacgu.com.ar/cgu
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
110

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
www.galiciacgu.com.ar	unknown	2023-10-05	2023-10-12	2024-02-18	32 kB	659 kB	54.84.203.208
www.googletagmanager.com	75	2011-11-11	2013-05-22	2024-04-26	2.2 kB	418 kB	142.250.74.168
fonts.gstatic.com	unknown	2008-02-11	2014-09-09	2024-04-26	1.1 kB	59 kB	142.250.74.99
fonts.googleapis.com	8877	2005-01-25	2013-06-10	2024-04-25	1.8 kB	9.9 kB	142.250.74.106
region1.analytics.google.com	unknown	1997-09-15	2022-03-17	2024-04-26	752 B	384 B	216.239.34.36

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2024-04-26	medium	www.galiciacgu.com.ar/	Banco Galicia
2024-04-26	medium	www.galiciacgu.com.ar/	Banco Galicia
2024-04-26	medium	www.galiciacgu.com.ar/	Banco Galicia
2024-04-26	medium	www.galiciacgu.com.ar/	Banco Galicia
2024-04-26	medium	www.galiciacgu.com.ar/	Banco Galicia
2024-04-26	medium	www.galiciacgu.com.ar/	Banco Galicia
2024-04-26	medium	www.galiciacgu.com.ar/cgu	Banco Galicia
2024-04-26	medium	www.galiciacgu.com.ar/	Banco Galicia
2024-04-26	medium	www.galiciacgu.com.ar/	Banco Galicia
2024-04-26	medium	www.galiciacgu.com.ar/	Banco Galicia
2024-04-26	medium	www.galiciacgu.com.ar/	Banco Galicia
2024-04-26	medium	www.galiciacgu.com.ar/	Banco Galicia
2024-04-26	medium	www.galiciacgu.com.ar/	Banco Galicia
2024-04-26	medium	www.galiciacgu.com.ar/	Banco Galicia
2024-04-26	medium	www.galiciacgu.com.ar/	Banco Galicia
2024-04-26	medium	www.galiciacgu.com.ar/	Banco Galicia
2024-04-26	medium	www.galiciacgu.com.ar/	Banco Galicia
2024-04-26	medium	www.galiciacgu.com.ar/	Banco Galicia
2024-04-26	medium	www.galiciacgu.com.ar/	Banco Galicia
2024-04-26	medium	www.galiciacgu.com.ar/	Banco Galicia
2024-04-26	medium	www.galiciacgu.com.ar/	Banco Galicia
2024-04-26	medium	www.galiciacgu.com.ar/	Banco Galicia
2024-04-26	medium	www.galiciacgu.com.ar/	Banco Galicia
2024-04-26	medium	www.galiciacgu.com.ar/	Banco Galicia
2024-04-26	medium	www.galiciacgu.com.ar/	Banco Galicia
2024-04-26	medium	www.galiciacgu.com.ar/	Banco Galicia
2024-04-26	medium	www.galiciacgu.com.ar/	Banco Galicia

PhishTank

Scan Date	Severity	Indicator	Alert
2023-10-30	medium	www.galiciacgu.com.ar/cgu	Banco Real

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-04-26	medium	galiciacgu.com.ar	Sinkholed
2024-04-26	medium	galiciacgu.com.ar	Sinkholed
2024-04-26	medium	galiciacgu.com.ar	Sinkholed
2024-04-26	medium	galiciacgu.com.ar	Sinkholed
2024-04-26	medium	galiciacgu.com.ar	Sinkholed
2024-04-26	medium	galiciacgu.com.ar	Sinkholed
2024-04-26	medium	galiciacgu.com.ar	Sinkholed
2024-04-26	medium	galiciacgu.com.ar	Sinkholed
2024-04-26	medium	galiciacgu.com.ar	Sinkholed
2024-04-26	medium	galiciacgu.com.ar	Sinkholed
2024-04-26	medium	galiciacgu.com.ar	Sinkholed
2024-04-26	medium	galiciacgu.com.ar	Sinkholed
2024-04-26	medium	galiciacgu.com.ar	Sinkholed
2024-04-26	medium	galiciacgu.com.ar	Sinkholed
2024-04-26	medium	galiciacgu.com.ar	Sinkholed
2024-04-26	medium	galiciacgu.com.ar	Sinkholed
2024-04-26	medium	galiciacgu.com.ar	Sinkholed
2024-04-26	medium	galiciacgu.com.ar	Sinkholed
2024-04-26	medium	galiciacgu.com.ar	Sinkholed
2024-04-26	medium	galiciacgu.com.ar	Sinkholed
2024-04-26	medium	galiciacgu.com.ar	Sinkholed
2024-04-26	medium	galiciacgu.com.ar	Sinkholed
2024-04-26	medium	galiciacgu.com.ar	Sinkholed
2024-04-26	medium	galiciacgu.com.ar	Sinkholed
2024-04-26	medium	galiciacgu.com.ar	Sinkholed
2024-04-26	medium	galiciacgu.com.ar	Sinkholed
2024-04-26	medium	galiciacgu.com.ar	Sinkholed

ThreatFox

No alerts detected

JavaScript (22)

	URL	Size	First Seen	Last Seen
	www.googletagmanager.com/gtag/js?id=UA-64187909-3	202 kB	2024-04-26	2024-04-26
Pretty URL www.googletagmanager.com/gtag/js?id=UA-64187909-3 IP 142.250.74.168 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-26 19:24:46 Last Seen2024-04-26 19:24:46 Times Seen2 Hash 84606b263a79fde9f2a94ae9a09f452d c1638d65fc01c84f1c0112e86f14946c3e07fb63 0c393cec56b4bc092de1cf44d30cf7136038d7cea552694d52c8883076971a53 Loading...

	www.galiciacgu.com.ar/cgu	354 B	2024-03-29	2024-04-26
Pretty URL www.galiciacgu.com.ar/cgu IP 54.84.203.208 ASN #14618 AMAZON-AES Introduced by scriptElement Embedded in HTML true Observations First Seen2024-03-29 07:11:34 Last Seen2024-04-26 19:24:46 Times Seen4 Hash 9d05d41ea07b672cd8ab4df4ac8072d5 81604045e66b6cbca27acfd52aeb5db6edcdb161 b3487eb5f1aed7124a2ba4d98c5a508a7836680e1f0967c7acb0ac84c08770ba Loading...

	www.galiciacgu.com.ar/sandbox%20eval%20code	147 B	2023-04-11	2024-05-07
Pretty URL www.galiciacgu.com.ar/sandbox%20eval%20code IP 0.0.0.0 ASN #0 Introduced by Embedded in HTML false Observations First Seen2023-04-11 21:07:53 Last Seen2024-05-07 10:50:28 Times Seen345357 Hash 92b651082ce234f66bb544e678befda3 14c21c55ddce43b6f677caadf51d4ab98c6a3df8 25d57d1d97abeb84531d3d3e5754dd5cb19a2c115edfa7cfc7af8247084faded Loading...

	www.galiciacgu.com.ar/js/landing/landing.js	250 kB	2023-12-29	2024-04-26
Pretty URL www.galiciacgu.com.ar/js/landing/landing.js IP 54.84.203.208 ASN #14618 AMAZON-AES Introduced by scriptElement Embedded in HTML false Observations First Seen2023-12-29 15:48:08 Last Seen2024-04-26 19:24:46 Times Seen13 Hash 4bd3c1fbe943fbb82748dbad1f25ee6b 22bf6706e9b51835c2e5c89bc2e8719ac25a47bb f92712808c7546c2c1f00abdf03c754e4366be232a3251e016c81a3e6d1e7d35 Loading...

	www.google-analytics.com/analytics.js	4.7 kB	2023-04-11	2024-05-07
Pretty URL www.google-analytics.com/analytics.js IP 0.0.0.0 ASN #0 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-11 21:07:53 Last Seen2024-05-07 10:50:28 Times Seen344848 Hash f24128d0c9cba7be2916c693427a3483 1b6397d496ea896ebc2018b01b995cee4f166029 58173de4697da1a218f04c3a783a733bab4e769ceabc37cd42da9dc3e036a7e8 Loading...

	www.galiciacgu.com.ar/js/landing/landing.js	140 B	2023-07-29	2024-04-26
Pretty URL www.galiciacgu.com.ar/js/landing/landing.js IP 54.84.203.208 ASN #14618 AMAZON-AES Introduced by AsyncFunction Embedded in HTML false Observations First Seen2023-07-29 10:18:59 Last Seen2024-04-26 19:24:46 Times Seen17 Hash e5fded0ce97b276ce21819a725a49fea 5dc4b8a4d6fa45e55bc2fe5a9cea3fe403e55db8 e1eb1ac7971adc614a68c4daa06d9350b9927493953f52fb3e178a2ce16ca3e5 Loading...

	www.googletagmanager.com/gtm.js?id=GTM-K56P7CZ&l=dataLayer	210 kB	2024-04-26	2024-04-26
Pretty URL www.googletagmanager.com/gtm.js?id=GTM-K56P7CZ&l=dataLayer IP 142.250.74.168 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-26 19:24:46 Last Seen2024-04-26 19:24:46 Times Seen2 Hash 92e17b4b5fa676a072ee6c6ee26bff9c ce308c9d18ccd093e98e78e4125e64e8e345079f 59d79cb1479e407067d4fd01271f5d240022a4d1b5281b64a0f7511b6d2e501b Loading...

	www.googletagmanager.com/gtag/destination?id=DC-9017705&l=dataLayer&cx=c	200 kB	2024-04-26	2024-04-26
Pretty URL www.googletagmanager.com/gtag/destination?id=DC-9017705&l=dataLayer&cx=c IP 142.250.74.168 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-26 19:24:46 Last Seen2024-04-26 19:24:46 Times Seen2 Hash 000fe5f889ba340910923fb14b8f9621 f976b5da7613768c4bfbd5de31db371838ed6e6f f5ff3de1cfeceb63db4e166c1d3da2bc96fe5fdb581ff35c2264bc99ef6a53d9 Loading...

	www.googletagmanager.com/gtag/js?id=G-FX0Z8DW3TM&l=dataLayer&cx=c	267 kB	2024-04-26	2024-04-26
Pretty URL www.googletagmanager.com/gtag/js?id=G-FX0Z8DW3TM&l=dataLayer&cx=c IP 142.250.74.168 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-26 19:24:46 Last Seen2024-04-26 19:24:46 Times Seen2 Hash fb3c9fd28d2630b735e71f6f9acb8a20 33ea528d85e6c21877bea7074e7df5618043ed84 46cc3482ce82337d03a641837a708a473ad3753c8534aa4722d05e4e256130b9 Loading...

	www.galiciacgu.com.ar/js/landing/landing.js	139 B	2023-07-29	2024-04-26
Pretty URL www.galiciacgu.com.ar/js/landing/landing.js IP 54.84.203.208 ASN #14618 AMAZON-AES Introduced by AsyncFunction Embedded in HTML false Observations First Seen2023-07-29 10:18:59 Last Seen2024-04-26 19:24:46 Times Seen17 Hash 1cbde83c585f0027411b707f49e9aad0 618adb549de5d3c42707ba129d0f774f6bb3ba35 8383710f43f432a771f3c7d423156865efd19594d631597076ec65df2019fc2c Loading...

	www.galiciacgu.com.ar/cgu	174 B	2023-07-29	2024-04-26
Pretty URL www.galiciacgu.com.ar/cgu IP 54.84.203.208 ASN #14618 AMAZON-AES Introduced by scriptElement Embedded in HTML true Observations First Seen2023-07-29 10:18:59 Last Seen2024-04-26 19:24:46 Times Seen17 Hash 752c4e3ad8ec9b3a9a9ddd45f5cf2ddf ce7ee41da0f48ade907848eda9806dca4fbb426e 8c84857cb9915f14be5b3427f26f3e504b2cb74df19952deb63fc62e98d13fd3 Loading...

	www.googletagmanager.com/gtm.js?id=GTM-PXC7WZ	303 kB	2024-04-26	2024-04-26
Pretty URL www.googletagmanager.com/gtm.js?id=GTM-PXC7WZ IP 142.250.74.168 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-26 19:24:46 Last Seen2024-04-26 19:24:46 Times Seen2 Hash 10a020a33daab601ee15263bbf05727a 19fc17cc11207a8a934b7ee2c59e914491e8b68d 9b739f9e5abea52441507df1ff53a7b2a02fb4ef75f24b02ccee42d63f678a50 Loading...

	www.galiciacgu.com.ar/js/landing/landing.js	592 B	2023-07-29	2024-04-26
Pretty URL www.galiciacgu.com.ar/js/landing/landing.js IP 54.84.203.208 ASN #14618 AMAZON-AES Introduced by AsyncFunction Embedded in HTML false Observations First Seen2023-07-29 10:18:59 Last Seen2024-04-26 19:24:46 Times Seen17 Hash 42369a20ff5c56a4235cd5330078194a c69cabc6a85dbedf2e2a8dca00a345924cf87696 04f82b3f5eaa727227d4e8a4c860edcabb141c121611028ca933b6c09ad649b1 Loading...

		Size	First Seen	Last Seen
	#1 Eval - bcbda7fb559c92cdff8eb46eddb1ed95	224 B	2023-12-14	2024-04-26
Pretty Observations First Seen2023-12-14 14:49:28 Last Seen2024-04-26 19:24:46 Times Seen13 Hash bcbda7fb559c92cdff8eb46eddb1ed95 e400ebb91abfaf6825e7bd3a71126e5ae6b8038b 25ed4dd9c06508f2c24b10dd20a912f3d71d360301494da32b3691d1aa34e278 Loading...

	#2 Eval - deaf127be6068d770ff419f51162ab4c	227 B	2023-07-29	2024-04-26
Pretty Observations First Seen2023-07-29 10:18:59 Last Seen2024-04-26 19:24:46 Times Seen16 Hash deaf127be6068d770ff419f51162ab4c a98a961321a5cc285acf110b964ffbf058527494 4f9b0ac720fbfaede3e83384e8de9ec3ba384d04cc576a243dbd1b82c67578c5 Loading...

	#3 Eval - ce9103ca9d7b322c21fd8ec3ab671f0a	62 B	2023-07-29	2024-04-26
Pretty Observations First Seen2023-07-29 10:18:59 Last Seen2024-04-26 19:24:46 Times Seen17 Hash ce9103ca9d7b322c21fd8ec3ab671f0a 06d8f3eae2933253ff26cda31b72fbf3a5c33b9d f21f2843816d60f1b9c14eed1874bb1cf6e2d2aa4a0a06f71c9121fd084631ed Loading...

	#4 Eval - 9ac0b4708663724dffb4c6f2b814a6df	87 B	2023-03-07	2024-05-07
Pretty Observations First Seen2023-03-07 01:03:00 Last Seen2024-05-07 02:28:51 Times Seen4664 Hash 9ac0b4708663724dffb4c6f2b814a6df 7faabe0595feb52fef2eb924693458608d16a66e aab310ed9d84ead154e032927d4a74c007f4b03655f5596b12339ea61881ba4e Loading...

	#5 Eval - 244559a1828615b6fd5e506856bfd201	227 B	2023-07-29	2024-04-26
Pretty Observations First Seen2023-07-29 10:18:59 Last Seen2024-04-26 19:24:46 Times Seen17 Hash 244559a1828615b6fd5e506856bfd201 e1d0396fd83616420446b60c1557b2f6badf9fa3 4cb4dffd88e1b195f04033992df5b3128f628f40c58be87763a1159404280298 Loading...

	#6 Eval - 4e5734e070d0cd16be431f06a737cd51	326 B	2023-03-07	2024-04-26
Pretty Observations First Seen2023-03-07 12:04:51 Last Seen2024-04-26 19:24:46 Times Seen36 Hash 4e5734e070d0cd16be431f06a737cd51 e663e5b2f4dd082874b87f93c96d764b15da70a5 aa19bdf77030bf7ef26bd86a4155f1bab9e643442f5faa7bdfd24bd07dcd9691 Loading...

	#7 Eval - 530d5f7c9746985e79bfa6da06947a4d	227 B	2023-07-29	2024-04-26
Pretty Observations First Seen2023-07-29 10:18:59 Last Seen2024-04-26 19:24:46 Times Seen16 Hash 530d5f7c9746985e79bfa6da06947a4d f62ad5b33bf821499e1f0839016c85bd6e67c8c0 342c936e043ab09651207fdd85162e3d98f0233e2cbdf1e6ec221cf6e7bf3290 Loading...

	#8 Eval - 083d5ef1c1857b700a7cbbe2531c7101	196 B	2023-07-29	2024-04-26
Pretty Observations First Seen2023-07-29 10:18:59 Last Seen2024-04-26 19:24:46 Times Seen16 Hash 083d5ef1c1857b700a7cbbe2531c7101 867f5857781b974f7eed2a714a7068796478c3ff 3f4456fbc1cbd5714b5ea0810583adbafb67110b0c067e1db2888fc31911c16c Loading...

	#9 Eval - 5773eb09c0cae44c19cd1bfe78ece210	196 B	2023-07-29	2024-04-26
Pretty Observations First Seen2023-07-29 10:18:59 Last Seen2024-04-26 19:24:46 Times Seen17 Hash 5773eb09c0cae44c19cd1bfe78ece210 ce6c5a7cdcf293f9364237c52b1f9f98dccba9b4 56a7a0aeda05540ab9ecbdb3e4371cbf722818db0a4ac2e1a0a459d9fc580c2c Loading...

HTTP Transactions (39)

URL IP Response Size

www.galiciacgu.com.ar/css/landing/landing-galicia.css

54.84.203.208

200 OK

15 kB

URL GET HTTP/2
www.galiciacgu.com.ar/css/landing/landing-galicia.css
IP
54.84.203.208:443
ASN
#14618 AMAZON-AES

Requested by
https://www.galiciacgu.com.ar/cgu
Certificate
IssuerAmazon
Subjectwww.galiciacgu.com.ar
Fingerprint8E:38:4E:A4:4F:87:B7:53:E6:11:1B:D9:A1:DE:61:D9:D9:ED:A0:C3
ValidityThu, 12 Oct 2023 00:00:00 GMT - Sat, 09 Nov 2024 23:59:59 GMT

File type
Unicode text, UTF-8 text, with very long lines (61503)
Size
15 kB (14745 bytes)
Hash
96a929052aff9897099e00ba8c394376
d45fe0672875fc0ebb7a44648a03d7222ae87127
0a3aa4c45914358e96355bcbde1a70b168a712a5193c83bfbab5c4aab4f5fa9e

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Banco Galicia
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /css/landing/landing-galicia.css HTTP/1.1
Host: www.galiciacgu.com.ar
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.galiciacgu.com.ar/cgu
Cookie: XSRF-TOKEN=eyJpdiI6IkpaL0VoMzRoUFAxUkhxejNVcjJRdUE9PSIsInZhbHVlIjoiYVZaU2RmNWppR0VmY1MvTlEzNlcvZUlhc2N5TWYyc0U2eVl2YUoxTGd2L3FndGxzY2J2YTErQjQ5MkMzSGtYSmJQcjI0ZGtHYmdkbzh4MjVqN2FPRHVsOEhpY003ODZhRDBKRGxnai9CNnlTSk9LeCtNSGMzMjF6VUtFR0JwYnIiLCJtYWMiOiI5MGNhMmY2MjY1NDQwNWIzYWQ1MzQ1MmMxZjEwMGE1MTIzNGQ0Y2ViODkwYjgwZjFiY2EyZjIxOTgyNjliOTIwIiwidGFnIjoiIn0%3D; galiciamove_session=eyJpdiI6IlZwcW1qUm9HbWFlQXl3b0l1TUpFN2c9PSIsInZhbHVlIjoiUFJKeEFDOEhnMjkyRCtaWFRsU1hPN1RxVG1nWCtBcU04RjRMOXVxdlUvaHdKY3I1OE5ndkhyTmN6aHNPZjVTV1lwWmhsUnJqT3BvbHhkQU0xOHltWWFPWlJKL2N6K01GWDlwTmN0RkpLeEw3eVduTG9SOGM4RDZLaU1rL1J2NG0iLCJtYWMiOiI1ZDU2MjU0MThjOTBkNzk4ZmY3Mjg2NWFkYTEwOWJmZDJjM2I1MGUyMjA4MjUwYWE2ZGM0NjkzZGM5N2UxMzNiIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Fri, 26 Apr 2024 17:24:18 GMT
content-type: text/css
content-length: 14745
server: 
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
x-permitted-cross-domain-policies: all
feature-policy: fullscreen 'none'; microphone 'none'; geolocation 'self'; camera 'self'
last-modified: Mon, 04 Mar 2024 13:46:14 GMT
etag: "15b89-612d5f2fd4aa5-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-security-policy: upgrade-insecure-requests;media-src 'self' data:; default-src 'self' https://*.fls.doubleclick.net https://script.hotjar.com https://vars.hotjar.com;font-src 'self' https://script.hotjar.com fonts.gstatic.com;style-src 'unsafe-inline' 'self' fonts.googleapis.com;script-src 'unsafe-inline' 'unsafe-eval' 'self' https://api.zoomauth.com https://www.googleadservices.com https://*.twitter.com https://static.ads-twitter.com https://maps.googleapis.com https://script.hotjar.com https://static.hotjar.com https://www.facebook.com/ https://www.facebook.net/ https://connect.facebook.net https://connect.facebook.com https://www.googletagmanager.com https://www.google-analytics.com;img-src 'self' data: https://t.co https://googleads.g.doubleclick.net https://googletagmanager.com https://*.gstatic.com https://*.googleapis.com https://*.google.com.ar https://*.google.com https://www.facebook.com https://www.google-analytics.com www.google-analytics.com https://stats.g.doubleclick.net https://*.facebook.net https://www.googletagmanager.com https://script.hotjar.com ;connect-src 'self' https://galiciamove-tmp-uploads.s3.amazonaws.com https://api.zoomauth.com https://*.hotjar.com https://*.hotjar.io wss://*.hotjar.com https://www.google-analytics.com www.google-analytics.com https://stats.g.doubleclick.net, frame-ancestors 'self';
X-Firefox-Spdy: h2

www.googletagmanager.com/gtag/js?id=UA-64187909-3

142.250.74.168

200 OK

73 kB

URL GET HTTP/2
www.googletagmanager.com/gtag/js?id=UA-64187909-3
IP
142.250.74.168:443
ASN
#15169 GOOGLE

Requested by
https://www.galiciacgu.com.ar/cgu
Certificate
IssuerGoogle Trust Services LLC
Subject*.google-analytics.com
FingerprintFC:B1:16:E0:D8:F3:2B:F3:AB:33:E5:E1:23:57:F4:48:66:FD:4D:52
ValidityMon, 08 Apr 2024 06:34:55 GMT - Mon, 01 Jul 2024 06:34:54 GMT

File type
JavaScript source, ASCII text, with very long lines (4179)
Size
73 kB (73311 bytes)
Hash
84606b263a79fde9f2a94ae9a09f452d
c1638d65fc01c84f1c0112e86f14946c3e07fb63
0c393cec56b4bc092de1cf44d30cf7136038d7cea552694d52c8883076971a53

HTTP Headers

GET /gtag/js?id=UA-64187909-3 HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.galiciacgu.com.ar/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Fri, 26 Apr 2024 17:24:18 GMT
expires: Fri, 26 Apr 2024 17:24:18 GMT
cache-control: private, max-age=900
last-modified: Fri, 26 Apr 2024 15:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 73311
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

www.galiciacgu.com.ar/images/galicia/logo-galicia.svg

54.84.203.208

200 OK

12 kB

URL GET HTTP/2
www.galiciacgu.com.ar/images/galicia/logo-galicia.svg
IP
54.84.203.208:443
ASN
#14618 AMAZON-AES

Requested by
https://www.galiciacgu.com.ar/cgu
Certificate
IssuerAmazon
Subjectwww.galiciacgu.com.ar
Fingerprint8E:38:4E:A4:4F:87:B7:53:E6:11:1B:D9:A1:DE:61:D9:D9:ED:A0:C3
ValidityThu, 12 Oct 2023 00:00:00 GMT - Sat, 09 Nov 2024 23:59:59 GMT

File type
SVG Scalable Vector Graphics image
Size
12 kB (12547 bytes)
Hash
ff34f8818d46be9a803475951ff553c5
07ecee32da83a9bb4e4c51b0dfa98e8406d02e24
6ac22257f232a796c7532ed3cdc9eea5f8f9dad45d8124c591a6001b9206aad3

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Banco Galicia
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /images/galicia/logo-galicia.svg HTTP/1.1
Host: www.galiciacgu.com.ar
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.galiciacgu.com.ar/cgu
Cookie: XSRF-TOKEN=eyJpdiI6IkpaL0VoMzRoUFAxUkhxejNVcjJRdUE9PSIsInZhbHVlIjoiYVZaU2RmNWppR0VmY1MvTlEzNlcvZUlhc2N5TWYyc0U2eVl2YUoxTGd2L3FndGxzY2J2YTErQjQ5MkMzSGtYSmJQcjI0ZGtHYmdkbzh4MjVqN2FPRHVsOEhpY003ODZhRDBKRGxnai9CNnlTSk9LeCtNSGMzMjF6VUtFR0JwYnIiLCJtYWMiOiI5MGNhMmY2MjY1NDQwNWIzYWQ1MzQ1MmMxZjEwMGE1MTIzNGQ0Y2ViODkwYjgwZjFiY2EyZjIxOTgyNjliOTIwIiwidGFnIjoiIn0%3D; galiciamove_session=eyJpdiI6IlZwcW1qUm9HbWFlQXl3b0l1TUpFN2c9PSIsInZhbHVlIjoiUFJKeEFDOEhnMjkyRCtaWFRsU1hPN1RxVG1nWCtBcU04RjRMOXVxdlUvaHdKY3I1OE5ndkhyTmN6aHNPZjVTV1lwWmhsUnJqT3BvbHhkQU0xOHltWWFPWlJKL2N6K01GWDlwTmN0RkpLeEw3eVduTG9SOGM4RDZLaU1rL1J2NG0iLCJtYWMiOiI1ZDU2MjU0MThjOTBkNzk4ZmY3Mjg2NWFkYTEwOWJmZDJjM2I1MGUyMjA4MjUwYWE2ZGM0NjkzZGM5N2UxMzNiIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Fri, 26 Apr 2024 17:24:18 GMT
content-type: image/svg+xml
content-length: 12547
server: 
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
x-permitted-cross-domain-policies: all
feature-policy: fullscreen 'none'; microphone 'none'; geolocation 'self'; camera 'self'
last-modified: Fri, 06 May 2022 18:50:21 GMT
etag: "3103-5de5c549b26cf"
accept-ranges: bytes
content-security-policy: upgrade-insecure-requests;media-src 'self' data:; default-src 'self' https://*.fls.doubleclick.net https://script.hotjar.com https://vars.hotjar.com;font-src 'self' https://script.hotjar.com fonts.gstatic.com;style-src 'unsafe-inline' 'self' fonts.googleapis.com;script-src 'unsafe-inline' 'unsafe-eval' 'self' https://api.zoomauth.com https://www.googleadservices.com https://*.twitter.com https://static.ads-twitter.com https://maps.googleapis.com https://script.hotjar.com https://static.hotjar.com https://www.facebook.com/ https://www.facebook.net/ https://connect.facebook.net https://connect.facebook.com https://www.googletagmanager.com https://www.google-analytics.com;img-src 'self' data: https://t.co https://googleads.g.doubleclick.net https://googletagmanager.com https://*.gstatic.com https://*.googleapis.com https://*.google.com.ar https://*.google.com https://www.facebook.com https://www.google-analytics.com www.google-analytics.com https://stats.g.doubleclick.net https://*.facebook.net https://www.googletagmanager.com https://script.hotjar.com ;connect-src 'self' https://galiciamove-tmp-uploads.s3.amazonaws.com https://api.zoomauth.com https://*.hotjar.com https://*.hotjar.io wss://*.hotjar.com https://www.google-analytics.com www.google-analytics.com https://stats.g.doubleclick.net, frame-ancestors 'self';
X-Firefox-Spdy: h2

www.galiciacgu.com.ar/images/galicia/landing/saving-piggy-dollars.svg

54.84.203.208

200 OK

2.9 kB

URL GET HTTP/2
www.galiciacgu.com.ar/images/galicia/landing/saving-piggy-dollars.svg
IP
54.84.203.208:443
ASN
#14618 AMAZON-AES

Requested by
https://www.galiciacgu.com.ar/cgu
Certificate
IssuerAmazon
Subjectwww.galiciacgu.com.ar
Fingerprint8E:38:4E:A4:4F:87:B7:53:E6:11:1B:D9:A1:DE:61:D9:D9:ED:A0:C3
ValidityThu, 12 Oct 2023 00:00:00 GMT - Sat, 09 Nov 2024 23:59:59 GMT

File type
SVG Scalable Vector Graphics image
Size
2.9 kB (2886 bytes)
Hash
b3692760c0f69a5d93c84d88a39b1c67
04b34014b12c9e933321cb841d6b6613ac19a3a2
2cd0c5926e4ae7184b82936eba62ca4d57f7a4948ca0cb4a59ff153ec236b036

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Banco Galicia
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /images/galicia/landing/saving-piggy-dollars.svg HTTP/1.1
Host: www.galiciacgu.com.ar
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.galiciacgu.com.ar/cgu
Cookie: XSRF-TOKEN=eyJpdiI6IkpaL0VoMzRoUFAxUkhxejNVcjJRdUE9PSIsInZhbHVlIjoiYVZaU2RmNWppR0VmY1MvTlEzNlcvZUlhc2N5TWYyc0U2eVl2YUoxTGd2L3FndGxzY2J2YTErQjQ5MkMzSGtYSmJQcjI0ZGtHYmdkbzh4MjVqN2FPRHVsOEhpY003ODZhRDBKRGxnai9CNnlTSk9LeCtNSGMzMjF6VUtFR0JwYnIiLCJtYWMiOiI5MGNhMmY2MjY1NDQwNWIzYWQ1MzQ1MmMxZjEwMGE1MTIzNGQ0Y2ViODkwYjgwZjFiY2EyZjIxOTgyNjliOTIwIiwidGFnIjoiIn0%3D; galiciamove_session=eyJpdiI6IlZwcW1qUm9HbWFlQXl3b0l1TUpFN2c9PSIsInZhbHVlIjoiUFJKeEFDOEhnMjkyRCtaWFRsU1hPN1RxVG1nWCtBcU04RjRMOXVxdlUvaHdKY3I1OE5ndkhyTmN6aHNPZjVTV1lwWmhsUnJqT3BvbHhkQU0xOHltWWFPWlJKL2N6K01GWDlwTmN0RkpLeEw3eVduTG9SOGM4RDZLaU1rL1J2NG0iLCJtYWMiOiI1ZDU2MjU0MThjOTBkNzk4ZmY3Mjg2NWFkYTEwOWJmZDJjM2I1MGUyMjA4MjUwYWE2ZGM0NjkzZGM5N2UxMzNiIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Fri, 26 Apr 2024 17:24:18 GMT
content-type: image/svg+xml
content-length: 2886
server: 
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
x-permitted-cross-domain-policies: all
feature-policy: fullscreen 'none'; microphone 'none'; geolocation 'self'; camera 'self'
last-modified: Fri, 06 May 2022 18:50:21 GMT
etag: "b46-5de5c549b26cf"
accept-ranges: bytes
content-security-policy: upgrade-insecure-requests;media-src 'self' data:; default-src 'self' https://*.fls.doubleclick.net https://script.hotjar.com https://vars.hotjar.com;font-src 'self' https://script.hotjar.com fonts.gstatic.com;style-src 'unsafe-inline' 'self' fonts.googleapis.com;script-src 'unsafe-inline' 'unsafe-eval' 'self' https://api.zoomauth.com https://www.googleadservices.com https://*.twitter.com https://static.ads-twitter.com https://maps.googleapis.com https://script.hotjar.com https://static.hotjar.com https://www.facebook.com/ https://www.facebook.net/ https://connect.facebook.net https://connect.facebook.com https://www.googletagmanager.com https://www.google-analytics.com;img-src 'self' data: https://t.co https://googleads.g.doubleclick.net https://googletagmanager.com https://*.gstatic.com https://*.googleapis.com https://*.google.com.ar https://*.google.com https://www.facebook.com https://www.google-analytics.com www.google-analytics.com https://stats.g.doubleclick.net https://*.facebook.net https://www.googletagmanager.com https://script.hotjar.com ;connect-src 'self' https://galiciamove-tmp-uploads.s3.amazonaws.com https://api.zoomauth.com https://*.hotjar.com https://*.hotjar.io wss://*.hotjar.com https://www.google-analytics.com www.google-analytics.com https://stats.g.doubleclick.net, frame-ancestors 'self';
X-Firefox-Spdy: h2

www.galiciacgu.com.ar/landing/images/move-app-cgu.png

54.84.203.208

200 OK

40 kB

URL GET HTTP/2
www.galiciacgu.com.ar/landing/images/move-app-cgu.png
IP
54.84.203.208:443
ASN
#14618 AMAZON-AES

Requested by
https://www.galiciacgu.com.ar/cgu
Certificate
IssuerAmazon
Subjectwww.galiciacgu.com.ar
Fingerprint8E:38:4E:A4:4F:87:B7:53:E6:11:1B:D9:A1:DE:61:D9:D9:ED:A0:C3
ValidityThu, 12 Oct 2023 00:00:00 GMT - Sat, 09 Nov 2024 23:59:59 GMT

File type
PNG image data, 258 x 498, 8-bit/color RGBA, non-interlaced
Size
40 kB (40135 bytes)
Hash
36bc1d0741de76a14731a7a3bb347cda
7c85d7eb1e2d6c408f603e7049dfccdd653765e6
2be987531e3186de6280d70b9504c1bb8580575e0b6b337fbf95330d145f78c8

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Banco Galicia
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /landing/images/move-app-cgu.png HTTP/1.1
Host: www.galiciacgu.com.ar
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.galiciacgu.com.ar/cgu
Cookie: XSRF-TOKEN=eyJpdiI6IkpaL0VoMzRoUFAxUkhxejNVcjJRdUE9PSIsInZhbHVlIjoiYVZaU2RmNWppR0VmY1MvTlEzNlcvZUlhc2N5TWYyc0U2eVl2YUoxTGd2L3FndGxzY2J2YTErQjQ5MkMzSGtYSmJQcjI0ZGtHYmdkbzh4MjVqN2FPRHVsOEhpY003ODZhRDBKRGxnai9CNnlTSk9LeCtNSGMzMjF6VUtFR0JwYnIiLCJtYWMiOiI5MGNhMmY2MjY1NDQwNWIzYWQ1MzQ1MmMxZjEwMGE1MTIzNGQ0Y2ViODkwYjgwZjFiY2EyZjIxOTgyNjliOTIwIiwidGFnIjoiIn0%3D; galiciamove_session=eyJpdiI6IlZwcW1qUm9HbWFlQXl3b0l1TUpFN2c9PSIsInZhbHVlIjoiUFJKeEFDOEhnMjkyRCtaWFRsU1hPN1RxVG1nWCtBcU04RjRMOXVxdlUvaHdKY3I1OE5ndkhyTmN6aHNPZjVTV1lwWmhsUnJqT3BvbHhkQU0xOHltWWFPWlJKL2N6K01GWDlwTmN0RkpLeEw3eVduTG9SOGM4RDZLaU1rL1J2NG0iLCJtYWMiOiI1ZDU2MjU0MThjOTBkNzk4ZmY3Mjg2NWFkYTEwOWJmZDJjM2I1MGUyMjA4MjUwYWE2ZGM0NjkzZGM5N2UxMzNiIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Fri, 26 Apr 2024 17:24:18 GMT
content-type: image/png
content-length: 40135
server: 
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
x-permitted-cross-domain-policies: all
feature-policy: fullscreen 'none'; microphone 'none'; geolocation 'self'; camera 'self'
last-modified: Tue, 02 Mar 2021 16:05:31 GMT
etag: "9cc7-5bc8fe75a8e88"
accept-ranges: bytes
content-security-policy: upgrade-insecure-requests;media-src 'self' data:; default-src 'self' https://*.fls.doubleclick.net https://script.hotjar.com https://vars.hotjar.com;font-src 'self' https://script.hotjar.com fonts.gstatic.com;style-src 'unsafe-inline' 'self' fonts.googleapis.com;script-src 'unsafe-inline' 'unsafe-eval' 'self' https://api.zoomauth.com https://www.googleadservices.com https://*.twitter.com https://static.ads-twitter.com https://maps.googleapis.com https://script.hotjar.com https://static.hotjar.com https://www.facebook.com/ https://www.facebook.net/ https://connect.facebook.net https://connect.facebook.com https://www.googletagmanager.com https://www.google-analytics.com;img-src 'self' data: https://t.co https://googleads.g.doubleclick.net https://googletagmanager.com https://*.gstatic.com https://*.googleapis.com https://*.google.com.ar https://*.google.com https://www.facebook.com https://www.google-analytics.com www.google-analytics.com https://stats.g.doubleclick.net https://*.facebook.net https://www.googletagmanager.com https://script.hotjar.com ;connect-src 'self' https://galiciamove-tmp-uploads.s3.amazonaws.com https://api.zoomauth.com https://*.hotjar.com https://*.hotjar.io wss://*.hotjar.com https://www.google-analytics.com www.google-analytics.com https://stats.g.doubleclick.net, frame-ancestors 'self';
X-Firefox-Spdy: h2

www.galiciacgu.com.ar/images/galicia/landing/credit-card-1.svg

54.84.203.208

200 OK

1.4 kB

URL GET HTTP/2
www.galiciacgu.com.ar/images/galicia/landing/credit-card-1.svg
IP
54.84.203.208:443
ASN
#14618 AMAZON-AES

Requested by
https://www.galiciacgu.com.ar/cgu
Certificate
IssuerAmazon
Subjectwww.galiciacgu.com.ar
Fingerprint8E:38:4E:A4:4F:87:B7:53:E6:11:1B:D9:A1:DE:61:D9:D9:ED:A0:C3
ValidityThu, 12 Oct 2023 00:00:00 GMT - Sat, 09 Nov 2024 23:59:59 GMT

File type
SVG Scalable Vector Graphics image
Size
1.4 kB (1368 bytes)
Hash
e5de0a2da9f032552a5407e4d7c45db0
4559a9e5722b1f87331d39d994c4c717ae6b4b41
8d2c9cad8aaa54c706da774d88db83a477ea421c407c6d19058d0824947a70b4

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Banco Galicia
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /images/galicia/landing/credit-card-1.svg HTTP/1.1
Host: www.galiciacgu.com.ar
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.galiciacgu.com.ar/cgu
Cookie: XSRF-TOKEN=eyJpdiI6IkpaL0VoMzRoUFAxUkhxejNVcjJRdUE9PSIsInZhbHVlIjoiYVZaU2RmNWppR0VmY1MvTlEzNlcvZUlhc2N5TWYyc0U2eVl2YUoxTGd2L3FndGxzY2J2YTErQjQ5MkMzSGtYSmJQcjI0ZGtHYmdkbzh4MjVqN2FPRHVsOEhpY003ODZhRDBKRGxnai9CNnlTSk9LeCtNSGMzMjF6VUtFR0JwYnIiLCJtYWMiOiI5MGNhMmY2MjY1NDQwNWIzYWQ1MzQ1MmMxZjEwMGE1MTIzNGQ0Y2ViODkwYjgwZjFiY2EyZjIxOTgyNjliOTIwIiwidGFnIjoiIn0%3D; galiciamove_session=eyJpdiI6IlZwcW1qUm9HbWFlQXl3b0l1TUpFN2c9PSIsInZhbHVlIjoiUFJKeEFDOEhnMjkyRCtaWFRsU1hPN1RxVG1nWCtBcU04RjRMOXVxdlUvaHdKY3I1OE5ndkhyTmN6aHNPZjVTV1lwWmhsUnJqT3BvbHhkQU0xOHltWWFPWlJKL2N6K01GWDlwTmN0RkpLeEw3eVduTG9SOGM4RDZLaU1rL1J2NG0iLCJtYWMiOiI1ZDU2MjU0MThjOTBkNzk4ZmY3Mjg2NWFkYTEwOWJmZDJjM2I1MGUyMjA4MjUwYWE2ZGM0NjkzZGM5N2UxMzNiIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Fri, 26 Apr 2024 17:24:18 GMT
content-type: image/svg+xml
content-length: 1368
server: 
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
x-permitted-cross-domain-policies: all
feature-policy: fullscreen 'none'; microphone 'none'; geolocation 'self'; camera 'self'
last-modified: Wed, 13 Dec 2023 13:01:06 GMT
etag: "558-60c63c29a63ca"
accept-ranges: bytes
content-security-policy: upgrade-insecure-requests;media-src 'self' data:; default-src 'self' https://*.fls.doubleclick.net https://script.hotjar.com https://vars.hotjar.com;font-src 'self' https://script.hotjar.com fonts.gstatic.com;style-src 'unsafe-inline' 'self' fonts.googleapis.com;script-src 'unsafe-inline' 'unsafe-eval' 'self' https://api.zoomauth.com https://www.googleadservices.com https://*.twitter.com https://static.ads-twitter.com https://maps.googleapis.com https://script.hotjar.com https://static.hotjar.com https://www.facebook.com/ https://www.facebook.net/ https://connect.facebook.net https://connect.facebook.com https://www.googletagmanager.com https://www.google-analytics.com;img-src 'self' data: https://t.co https://googleads.g.doubleclick.net https://googletagmanager.com https://*.gstatic.com https://*.googleapis.com https://*.google.com.ar https://*.google.com https://www.facebook.com https://www.google-analytics.com www.google-analytics.com https://stats.g.doubleclick.net https://*.facebook.net https://www.googletagmanager.com https://script.hotjar.com ;connect-src 'self' https://galiciamove-tmp-uploads.s3.amazonaws.com https://api.zoomauth.com https://*.hotjar.com https://*.hotjar.io wss://*.hotjar.com https://www.google-analytics.com www.google-analytics.com https://stats.g.doubleclick.net, frame-ancestors 'self';
X-Firefox-Spdy: h2

www.galiciacgu.com.ar/landing/images/ordena-tus-gastos.png

54.84.203.208

200 OK

672 B

URL GET HTTP/2
www.galiciacgu.com.ar/landing/images/ordena-tus-gastos.png
IP
54.84.203.208:443
ASN
#14618 AMAZON-AES

Requested by
https://www.galiciacgu.com.ar/cgu
Certificate
IssuerAmazon
Subjectwww.galiciacgu.com.ar
Fingerprint8E:38:4E:A4:4F:87:B7:53:E6:11:1B:D9:A1:DE:61:D9:D9:ED:A0:C3
ValidityThu, 12 Oct 2023 00:00:00 GMT - Sat, 09 Nov 2024 23:59:59 GMT

File type
PNG image data, 42 x 42, 8-bit/color RGBA, non-interlaced
Size
672 B (672 bytes)
Hash
f580112f044bdd55a060d2f7572f6a13
8b2fab0198578775f03c235199bd2972c1846aac
8a5aed71db62c95fd9d4c9bc09e232a944b247425c0d471791e007e10f79d118

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Banco Galicia
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /landing/images/ordena-tus-gastos.png HTTP/1.1
Host: www.galiciacgu.com.ar
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.galiciacgu.com.ar/cgu
Cookie: XSRF-TOKEN=eyJpdiI6IkpaL0VoMzRoUFAxUkhxejNVcjJRdUE9PSIsInZhbHVlIjoiYVZaU2RmNWppR0VmY1MvTlEzNlcvZUlhc2N5TWYyc0U2eVl2YUoxTGd2L3FndGxzY2J2YTErQjQ5MkMzSGtYSmJQcjI0ZGtHYmdkbzh4MjVqN2FPRHVsOEhpY003ODZhRDBKRGxnai9CNnlTSk9LeCtNSGMzMjF6VUtFR0JwYnIiLCJtYWMiOiI5MGNhMmY2MjY1NDQwNWIzYWQ1MzQ1MmMxZjEwMGE1MTIzNGQ0Y2ViODkwYjgwZjFiY2EyZjIxOTgyNjliOTIwIiwidGFnIjoiIn0%3D; galiciamove_session=eyJpdiI6IlZwcW1qUm9HbWFlQXl3b0l1TUpFN2c9PSIsInZhbHVlIjoiUFJKeEFDOEhnMjkyRCtaWFRsU1hPN1RxVG1nWCtBcU04RjRMOXVxdlUvaHdKY3I1OE5ndkhyTmN6aHNPZjVTV1lwWmhsUnJqT3BvbHhkQU0xOHltWWFPWlJKL2N6K01GWDlwTmN0RkpLeEw3eVduTG9SOGM4RDZLaU1rL1J2NG0iLCJtYWMiOiI1ZDU2MjU0MThjOTBkNzk4ZmY3Mjg2NWFkYTEwOWJmZDJjM2I1MGUyMjA4MjUwYWE2ZGM0NjkzZGM5N2UxMzNiIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Fri, 26 Apr 2024 17:24:18 GMT
content-type: image/png
content-length: 672
server: 
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
x-permitted-cross-domain-policies: all
feature-policy: fullscreen 'none'; microphone 'none'; geolocation 'self'; camera 'self'
last-modified: Mon, 20 Apr 2020 15:07:08 GMT
etag: "2a0-5a3ba40b704c5"
accept-ranges: bytes
content-security-policy: upgrade-insecure-requests;media-src 'self' data:; default-src 'self' https://*.fls.doubleclick.net https://script.hotjar.com https://vars.hotjar.com;font-src 'self' https://script.hotjar.com fonts.gstatic.com;style-src 'unsafe-inline' 'self' fonts.googleapis.com;script-src 'unsafe-inline' 'unsafe-eval' 'self' https://api.zoomauth.com https://www.googleadservices.com https://*.twitter.com https://static.ads-twitter.com https://maps.googleapis.com https://script.hotjar.com https://static.hotjar.com https://www.facebook.com/ https://www.facebook.net/ https://connect.facebook.net https://connect.facebook.com https://www.googletagmanager.com https://www.google-analytics.com;img-src 'self' data: https://t.co https://googleads.g.doubleclick.net https://googletagmanager.com https://*.gstatic.com https://*.googleapis.com https://*.google.com.ar https://*.google.com https://www.facebook.com https://www.google-analytics.com www.google-analytics.com https://stats.g.doubleclick.net https://*.facebook.net https://www.googletagmanager.com https://script.hotjar.com ;connect-src 'self' https://galiciamove-tmp-uploads.s3.amazonaws.com https://api.zoomauth.com https://*.hotjar.com https://*.hotjar.io wss://*.hotjar.com https://www.google-analytics.com www.google-analytics.com https://stats.g.doubleclick.net, frame-ancestors 'self';
X-Firefox-Spdy: h2

www.galiciacgu.com.ar/cgu

54.84.203.208

200 OK

3.7 kB

URL User Request GET HTTP/2
www.galiciacgu.com.ar/cgu
IP
54.84.203.208:443
ASN
#14618 AMAZON-AES

Certificate
IssuerAmazon
Subjectwww.galiciacgu.com.ar
Fingerprint8E:38:4E:A4:4F:87:B7:53:E6:11:1B:D9:A1:DE:61:D9:D9:ED:A0:C3
ValidityThu, 12 Oct 2023 00:00:00 GMT - Sat, 09 Nov 2024 23:59:59 GMT

File type
gzip compressed data, from Unix
Size
3.7 kB (3669 bytes)
Hash
91130ee200d1949571700344b13c441d
e4e3258cf897d633a5f766d25e14eee3c02b7074
66e8aa5339031c23ec3b2750239748e9006e7eb27e84b72a8b67888f20bd9920

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Banco Galicia
PhishTank	phishing	Banco Real
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /cgu HTTP/1.1
Host: www.galiciacgu.com.ar
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 26 Apr 2024 17:24:18 GMT
content-type: text/html; charset=UTF-8
server: 
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
x-permitted-cross-domain-policies: all
feature-policy: fullscreen 'none'; microphone 'none'; geolocation 'self'; camera 'self'
cache-control: no-cache, private
set-cookie: XSRF-TOKEN=eyJpdiI6IkpaL0VoMzRoUFAxUkhxejNVcjJRdUE9PSIsInZhbHVlIjoiYVZaU2RmNWppR0VmY1MvTlEzNlcvZUlhc2N5TWYyc0U2eVl2YUoxTGd2L3FndGxzY2J2YTErQjQ5MkMzSGtYSmJQcjI0ZGtHYmdkbzh4MjVqN2FPRHVsOEhpY003ODZhRDBKRGxnai9CNnlTSk9LeCtNSGMzMjF6VUtFR0JwYnIiLCJtYWMiOiI5MGNhMmY2MjY1NDQwNWIzYWQ1MzQ1MmMxZjEwMGE1MTIzNGQ0Y2ViODkwYjgwZjFiY2EyZjIxOTgyNjliOTIwIiwidGFnIjoiIn0%3D; expires=Fri, 26 Apr 2024 19:24:18 GMT; Max-Age=7200; path=/; secure; samesite=lax
galiciamove_session=eyJpdiI6IlZwcW1qUm9HbWFlQXl3b0l1TUpFN2c9PSIsInZhbHVlIjoiUFJKeEFDOEhnMjkyRCtaWFRsU1hPN1RxVG1nWCtBcU04RjRMOXVxdlUvaHdKY3I1OE5ndkhyTmN6aHNPZjVTV1lwWmhsUnJqT3BvbHhkQU0xOHltWWFPWlJKL2N6K01GWDlwTmN0RkpLeEw3eVduTG9SOGM4RDZLaU1rL1J2NG0iLCJtYWMiOiI1ZDU2MjU0MThjOTBkNzk4ZmY3Mjg2NWFkYTEwOWJmZDJjM2I1MGUyMjA4MjUwYWE2ZGM0NjkzZGM5N2UxMzNiIiwidGFnIjoiIn0%3D; expires=Fri, 26 Apr 2024 19:24:18 GMT; Max-Age=7200; path=/; secure; httponly; samesite=lax
vary: Accept-Encoding
content-encoding: gzip
content-security-policy: upgrade-insecure-requests;media-src 'self' data:; default-src 'self' https://*.fls.doubleclick.net https://script.hotjar.com https://vars.hotjar.com;font-src 'self' https://script.hotjar.com fonts.gstatic.com;style-src 'unsafe-inline' 'self' fonts.googleapis.com;script-src 'unsafe-inline' 'unsafe-eval' 'self' https://api.zoomauth.com https://www.googleadservices.com https://*.twitter.com https://static.ads-twitter.com https://maps.googleapis.com https://script.hotjar.com https://static.hotjar.com https://www.facebook.com/ https://www.facebook.net/ https://connect.facebook.net https://connect.facebook.com https://www.googletagmanager.com https://www.google-analytics.com;img-src 'self' data: https://t.co https://googleads.g.doubleclick.net https://googletagmanager.com https://*.gstatic.com https://*.googleapis.com https://*.google.com.ar https://*.google.com https://www.facebook.com https://www.google-analytics.com www.google-analytics.com https://stats.g.doubleclick.net https://*.facebook.net https://www.googletagmanager.com https://script.hotjar.com ;connect-src 'self' https://galiciamove-tmp-uploads.s3.amazonaws.com https://api.zoomauth.com https://*.hotjar.com https://*.hotjar.io wss://*.hotjar.com https://www.google-analytics.com www.google-analytics.com https://stats.g.doubleclick.net, frame-ancestors 'self';
X-Firefox-Spdy: h2

www.galiciacgu.com.ar/landing/images/inverti-tus-ahorros.png

54.84.203.208

200 OK

1.1 kB

URL GET HTTP/2
www.galiciacgu.com.ar/landing/images/inverti-tus-ahorros.png
IP
54.84.203.208:443
ASN
#14618 AMAZON-AES

Requested by
https://www.galiciacgu.com.ar/cgu
Certificate
IssuerAmazon
Subjectwww.galiciacgu.com.ar
Fingerprint8E:38:4E:A4:4F:87:B7:53:E6:11:1B:D9:A1:DE:61:D9:D9:ED:A0:C3
ValidityThu, 12 Oct 2023 00:00:00 GMT - Sat, 09 Nov 2024 23:59:59 GMT

File type
PNG image data, 42 x 42, 8-bit/color RGBA, non-interlaced
Size
1.1 kB (1132 bytes)
Hash
5ac3ccbc6ea622097eb50c2486f072ea
aeda5c1149482dc3001dda688abecf27e3c19c8a
2d384cb8f2aa36779b7d653b710490916b4ab2c5e88cf296c9a4f6dce4440b25

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Banco Galicia
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /landing/images/inverti-tus-ahorros.png HTTP/1.1
Host: www.galiciacgu.com.ar
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.galiciacgu.com.ar/cgu
Cookie: XSRF-TOKEN=eyJpdiI6IkpaL0VoMzRoUFAxUkhxejNVcjJRdUE9PSIsInZhbHVlIjoiYVZaU2RmNWppR0VmY1MvTlEzNlcvZUlhc2N5TWYyc0U2eVl2YUoxTGd2L3FndGxzY2J2YTErQjQ5MkMzSGtYSmJQcjI0ZGtHYmdkbzh4MjVqN2FPRHVsOEhpY003ODZhRDBKRGxnai9CNnlTSk9LeCtNSGMzMjF6VUtFR0JwYnIiLCJtYWMiOiI5MGNhMmY2MjY1NDQwNWIzYWQ1MzQ1MmMxZjEwMGE1MTIzNGQ0Y2ViODkwYjgwZjFiY2EyZjIxOTgyNjliOTIwIiwidGFnIjoiIn0%3D; galiciamove_session=eyJpdiI6IlZwcW1qUm9HbWFlQXl3b0l1TUpFN2c9PSIsInZhbHVlIjoiUFJKeEFDOEhnMjkyRCtaWFRsU1hPN1RxVG1nWCtBcU04RjRMOXVxdlUvaHdKY3I1OE5ndkhyTmN6aHNPZjVTV1lwWmhsUnJqT3BvbHhkQU0xOHltWWFPWlJKL2N6K01GWDlwTmN0RkpLeEw3eVduTG9SOGM4RDZLaU1rL1J2NG0iLCJtYWMiOiI1ZDU2MjU0MThjOTBkNzk4ZmY3Mjg2NWFkYTEwOWJmZDJjM2I1MGUyMjA4MjUwYWE2ZGM0NjkzZGM5N2UxMzNiIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Fri, 26 Apr 2024 17:24:18 GMT
content-type: image/png
content-length: 1132
server: 
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
x-permitted-cross-domain-policies: all
feature-policy: fullscreen 'none'; microphone 'none'; geolocation 'self'; camera 'self'
last-modified: Mon, 20 Apr 2020 15:07:08 GMT
etag: "46c-5a3ba40b704c5"
accept-ranges: bytes
content-security-policy: upgrade-insecure-requests;media-src 'self' data:; default-src 'self' https://*.fls.doubleclick.net https://script.hotjar.com https://vars.hotjar.com;font-src 'self' https://script.hotjar.com fonts.gstatic.com;style-src 'unsafe-inline' 'self' fonts.googleapis.com;script-src 'unsafe-inline' 'unsafe-eval' 'self' https://api.zoomauth.com https://www.googleadservices.com https://*.twitter.com https://static.ads-twitter.com https://maps.googleapis.com https://script.hotjar.com https://static.hotjar.com https://www.facebook.com/ https://www.facebook.net/ https://connect.facebook.net https://connect.facebook.com https://www.googletagmanager.com https://www.google-analytics.com;img-src 'self' data: https://t.co https://googleads.g.doubleclick.net https://googletagmanager.com https://*.gstatic.com https://*.googleapis.com https://*.google.com.ar https://*.google.com https://www.facebook.com https://www.google-analytics.com www.google-analytics.com https://stats.g.doubleclick.net https://*.facebook.net https://www.googletagmanager.com https://script.hotjar.com ;connect-src 'self' https://galiciamove-tmp-uploads.s3.amazonaws.com https://api.zoomauth.com https://*.hotjar.com https://*.hotjar.io wss://*.hotjar.com https://www.google-analytics.com www.google-analytics.com https://stats.g.doubleclick.net, frame-ancestors 'self';
X-Firefox-Spdy: h2

www.galiciacgu.com.ar/images/galicia/landing/cell.svg

54.84.203.208

200 OK

2.3 kB

URL GET HTTP/2
www.galiciacgu.com.ar/images/galicia/landing/cell.svg
IP
54.84.203.208:443
ASN
#14618 AMAZON-AES

Requested by
https://www.galiciacgu.com.ar/cgu
Certificate
IssuerAmazon
Subjectwww.galiciacgu.com.ar
Fingerprint8E:38:4E:A4:4F:87:B7:53:E6:11:1B:D9:A1:DE:61:D9:D9:ED:A0:C3
ValidityThu, 12 Oct 2023 00:00:00 GMT - Sat, 09 Nov 2024 23:59:59 GMT

File type
SVG Scalable Vector Graphics image
Size
2.3 kB (2327 bytes)
Hash
995a32d3e7ae4fcfcca66bc1897210f6
6c23ed9b866a1987351776899b69849079f76af1
010ec2215ebce4e0dd8ed2a54637c1d52b70a023fc760461ef292dc5f23fb61e

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Banco Galicia
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /images/galicia/landing/cell.svg HTTP/1.1
Host: www.galiciacgu.com.ar
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.galiciacgu.com.ar/cgu
Cookie: XSRF-TOKEN=eyJpdiI6IkpaL0VoMzRoUFAxUkhxejNVcjJRdUE9PSIsInZhbHVlIjoiYVZaU2RmNWppR0VmY1MvTlEzNlcvZUlhc2N5TWYyc0U2eVl2YUoxTGd2L3FndGxzY2J2YTErQjQ5MkMzSGtYSmJQcjI0ZGtHYmdkbzh4MjVqN2FPRHVsOEhpY003ODZhRDBKRGxnai9CNnlTSk9LeCtNSGMzMjF6VUtFR0JwYnIiLCJtYWMiOiI5MGNhMmY2MjY1NDQwNWIzYWQ1MzQ1MmMxZjEwMGE1MTIzNGQ0Y2ViODkwYjgwZjFiY2EyZjIxOTgyNjliOTIwIiwidGFnIjoiIn0%3D; galiciamove_session=eyJpdiI6IlZwcW1qUm9HbWFlQXl3b0l1TUpFN2c9PSIsInZhbHVlIjoiUFJKeEFDOEhnMjkyRCtaWFRsU1hPN1RxVG1nWCtBcU04RjRMOXVxdlUvaHdKY3I1OE5ndkhyTmN6aHNPZjVTV1lwWmhsUnJqT3BvbHhkQU0xOHltWWFPWlJKL2N6K01GWDlwTmN0RkpLeEw3eVduTG9SOGM4RDZLaU1rL1J2NG0iLCJtYWMiOiI1ZDU2MjU0MThjOTBkNzk4ZmY3Mjg2NWFkYTEwOWJmZDJjM2I1MGUyMjA4MjUwYWE2ZGM0NjkzZGM5N2UxMzNiIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Fri, 26 Apr 2024 17:24:18 GMT
content-type: image/svg+xml
content-length: 2327
server: 
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
x-permitted-cross-domain-policies: all
feature-policy: fullscreen 'none'; microphone 'none'; geolocation 'self'; camera 'self'
last-modified: Tue, 30 Jun 2020 15:32:57 GMT
etag: "917-5a94ee3c9a914"
accept-ranges: bytes
content-security-policy: upgrade-insecure-requests;media-src 'self' data:; default-src 'self' https://*.fls.doubleclick.net https://script.hotjar.com https://vars.hotjar.com;font-src 'self' https://script.hotjar.com fonts.gstatic.com;style-src 'unsafe-inline' 'self' fonts.googleapis.com;script-src 'unsafe-inline' 'unsafe-eval' 'self' https://api.zoomauth.com https://www.googleadservices.com https://*.twitter.com https://static.ads-twitter.com https://maps.googleapis.com https://script.hotjar.com https://static.hotjar.com https://www.facebook.com/ https://www.facebook.net/ https://connect.facebook.net https://connect.facebook.com https://www.googletagmanager.com https://www.google-analytics.com;img-src 'self' data: https://t.co https://googleads.g.doubleclick.net https://googletagmanager.com https://*.gstatic.com https://*.googleapis.com https://*.google.com.ar https://*.google.com https://www.facebook.com https://www.google-analytics.com www.google-analytics.com https://stats.g.doubleclick.net https://*.facebook.net https://www.googletagmanager.com https://script.hotjar.com ;connect-src 'self' https://galiciamove-tmp-uploads.s3.amazonaws.com https://api.zoomauth.com https://*.hotjar.com https://*.hotjar.io wss://*.hotjar.com https://www.google-analytics.com www.google-analytics.com https://stats.g.doubleclick.net, frame-ancestors 'self';
X-Firefox-Spdy: h2

www.galiciacgu.com.ar/images/galicia/landing/phone-app.png

54.84.203.208

200 OK

25 kB

URL GET HTTP/2
www.galiciacgu.com.ar/images/galicia/landing/phone-app.png
IP
54.84.203.208:443
ASN
#14618 AMAZON-AES

Requested by
https://www.galiciacgu.com.ar/cgu
Certificate
IssuerAmazon
Subjectwww.galiciacgu.com.ar
Fingerprint8E:38:4E:A4:4F:87:B7:53:E6:11:1B:D9:A1:DE:61:D9:D9:ED:A0:C3
ValidityThu, 12 Oct 2023 00:00:00 GMT - Sat, 09 Nov 2024 23:59:59 GMT

File type
PNG image data, 192 x 341, 8-bit/color RGBA, non-interlaced
Size
25 kB (24601 bytes)
Hash
46a9ca4c609739cbfbfe476e3c68c874
9a5a74bd6d0f739b650698a0be8962ff1d15c2c3
53cba88cae85d2a11fc3693a15a10c1a9d5d2677b25f6f087a6b8ac2b29c1a2e

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Banco Galicia
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /images/galicia/landing/phone-app.png HTTP/1.1
Host: www.galiciacgu.com.ar
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.galiciacgu.com.ar/cgu
Cookie: XSRF-TOKEN=eyJpdiI6IkpaL0VoMzRoUFAxUkhxejNVcjJRdUE9PSIsInZhbHVlIjoiYVZaU2RmNWppR0VmY1MvTlEzNlcvZUlhc2N5TWYyc0U2eVl2YUoxTGd2L3FndGxzY2J2YTErQjQ5MkMzSGtYSmJQcjI0ZGtHYmdkbzh4MjVqN2FPRHVsOEhpY003ODZhRDBKRGxnai9CNnlTSk9LeCtNSGMzMjF6VUtFR0JwYnIiLCJtYWMiOiI5MGNhMmY2MjY1NDQwNWIzYWQ1MzQ1MmMxZjEwMGE1MTIzNGQ0Y2ViODkwYjgwZjFiY2EyZjIxOTgyNjliOTIwIiwidGFnIjoiIn0%3D; galiciamove_session=eyJpdiI6IlZwcW1qUm9HbWFlQXl3b0l1TUpFN2c9PSIsInZhbHVlIjoiUFJKeEFDOEhnMjkyRCtaWFRsU1hPN1RxVG1nWCtBcU04RjRMOXVxdlUvaHdKY3I1OE5ndkhyTmN6aHNPZjVTV1lwWmhsUnJqT3BvbHhkQU0xOHltWWFPWlJKL2N6K01GWDlwTmN0RkpLeEw3eVduTG9SOGM4RDZLaU1rL1J2NG0iLCJtYWMiOiI1ZDU2MjU0MThjOTBkNzk4ZmY3Mjg2NWFkYTEwOWJmZDJjM2I1MGUyMjA4MjUwYWE2ZGM0NjkzZGM5N2UxMzNiIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Fri, 26 Apr 2024 17:24:18 GMT
content-type: image/png
content-length: 24601
server: 
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
x-permitted-cross-domain-policies: all
feature-policy: fullscreen 'none'; microphone 'none'; geolocation 'self'; camera 'self'
last-modified: Tue, 30 Jun 2020 15:32:57 GMT
etag: "6019-5a94ee3ca2614"
accept-ranges: bytes
content-security-policy: upgrade-insecure-requests;media-src 'self' data:; default-src 'self' https://*.fls.doubleclick.net https://script.hotjar.com https://vars.hotjar.com;font-src 'self' https://script.hotjar.com fonts.gstatic.com;style-src 'unsafe-inline' 'self' fonts.googleapis.com;script-src 'unsafe-inline' 'unsafe-eval' 'self' https://api.zoomauth.com https://www.googleadservices.com https://*.twitter.com https://static.ads-twitter.com https://maps.googleapis.com https://script.hotjar.com https://static.hotjar.com https://www.facebook.com/ https://www.facebook.net/ https://connect.facebook.net https://connect.facebook.com https://www.googletagmanager.com https://www.google-analytics.com;img-src 'self' data: https://t.co https://googleads.g.doubleclick.net https://googletagmanager.com https://*.gstatic.com https://*.googleapis.com https://*.google.com.ar https://*.google.com https://www.facebook.com https://www.google-analytics.com www.google-analytics.com https://stats.g.doubleclick.net https://*.facebook.net https://www.googletagmanager.com https://script.hotjar.com ;connect-src 'self' https://galiciamove-tmp-uploads.s3.amazonaws.com https://api.zoomauth.com https://*.hotjar.com https://*.hotjar.io wss://*.hotjar.com https://www.google-analytics.com www.google-analytics.com https://stats.g.doubleclick.net, frame-ancestors 'self';
X-Firefox-Spdy: h2

www.galiciacgu.com.ar/images/galicia/landing/galicia-visa-debito.jpg

54.84.203.208

200 OK

21 kB

URL GET HTTP/2
www.galiciacgu.com.ar/images/galicia/landing/galicia-visa-debito.jpg
IP
54.84.203.208:443
ASN
#14618 AMAZON-AES

Requested by
https://www.galiciacgu.com.ar/cgu
Certificate
IssuerAmazon
Subjectwww.galiciacgu.com.ar
Fingerprint8E:38:4E:A4:4F:87:B7:53:E6:11:1B:D9:A1:DE:61:D9:D9:ED:A0:C3
ValidityThu, 12 Oct 2023 00:00:00 GMT - Sat, 09 Nov 2024 23:59:59 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=1], baseline, precision 8, 270x170, components 3
Size
21 kB (21044 bytes)
Hash
fb233fd714aed8fce24dbfe3b719d934
cb906a371bb2d1341bf367d41db2c11983a421b3
ca2f36c04d50457bb38a7ef445c87ef13f545f27d3c896b500b465b7c570975e

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Banco Galicia
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /images/galicia/landing/galicia-visa-debito.jpg HTTP/1.1
Host: www.galiciacgu.com.ar
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.galiciacgu.com.ar/cgu
Cookie: XSRF-TOKEN=eyJpdiI6IkpaL0VoMzRoUFAxUkhxejNVcjJRdUE9PSIsInZhbHVlIjoiYVZaU2RmNWppR0VmY1MvTlEzNlcvZUlhc2N5TWYyc0U2eVl2YUoxTGd2L3FndGxzY2J2YTErQjQ5MkMzSGtYSmJQcjI0ZGtHYmdkbzh4MjVqN2FPRHVsOEhpY003ODZhRDBKRGxnai9CNnlTSk9LeCtNSGMzMjF6VUtFR0JwYnIiLCJtYWMiOiI5MGNhMmY2MjY1NDQwNWIzYWQ1MzQ1MmMxZjEwMGE1MTIzNGQ0Y2ViODkwYjgwZjFiY2EyZjIxOTgyNjliOTIwIiwidGFnIjoiIn0%3D; galiciamove_session=eyJpdiI6IlZwcW1qUm9HbWFlQXl3b0l1TUpFN2c9PSIsInZhbHVlIjoiUFJKeEFDOEhnMjkyRCtaWFRsU1hPN1RxVG1nWCtBcU04RjRMOXVxdlUvaHdKY3I1OE5ndkhyTmN6aHNPZjVTV1lwWmhsUnJqT3BvbHhkQU0xOHltWWFPWlJKL2N6K01GWDlwTmN0RkpLeEw3eVduTG9SOGM4RDZLaU1rL1J2NG0iLCJtYWMiOiI1ZDU2MjU0MThjOTBkNzk4ZmY3Mjg2NWFkYTEwOWJmZDJjM2I1MGUyMjA4MjUwYWE2ZGM0NjkzZGM5N2UxMzNiIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Fri, 26 Apr 2024 17:24:18 GMT
content-type: image/jpeg
content-length: 21044
server: 
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
x-permitted-cross-domain-policies: all
feature-policy: fullscreen 'none'; microphone 'none'; geolocation 'self'; camera 'self'
last-modified: Tue, 30 Jun 2020 15:32:57 GMT
etag: "5234-5a94ee3c9a914"
accept-ranges: bytes
content-security-policy: upgrade-insecure-requests;media-src 'self' data:; default-src 'self' https://*.fls.doubleclick.net https://script.hotjar.com https://vars.hotjar.com;font-src 'self' https://script.hotjar.com fonts.gstatic.com;style-src 'unsafe-inline' 'self' fonts.googleapis.com;script-src 'unsafe-inline' 'unsafe-eval' 'self' https://api.zoomauth.com https://www.googleadservices.com https://*.twitter.com https://static.ads-twitter.com https://maps.googleapis.com https://script.hotjar.com https://static.hotjar.com https://www.facebook.com/ https://www.facebook.net/ https://connect.facebook.net https://connect.facebook.com https://www.googletagmanager.com https://www.google-analytics.com;img-src 'self' data: https://t.co https://googleads.g.doubleclick.net https://googletagmanager.com https://*.gstatic.com https://*.googleapis.com https://*.google.com.ar https://*.google.com https://www.facebook.com https://www.google-analytics.com www.google-analytics.com https://stats.g.doubleclick.net https://*.facebook.net https://www.googletagmanager.com https://script.hotjar.com ;connect-src 'self' https://galiciamove-tmp-uploads.s3.amazonaws.com https://api.zoomauth.com https://*.hotjar.com https://*.hotjar.io wss://*.hotjar.com https://www.google-analytics.com www.google-analytics.com https://stats.g.doubleclick.net, frame-ancestors 'self';
X-Firefox-Spdy: h2

www.galiciacgu.com.ar/landing/images/atencion-digital.png

54.84.203.208

200 OK

934 B

URL GET HTTP/2
www.galiciacgu.com.ar/landing/images/atencion-digital.png
IP
54.84.203.208:443
ASN
#14618 AMAZON-AES

Requested by
https://www.galiciacgu.com.ar/cgu
Certificate
IssuerAmazon
Subjectwww.galiciacgu.com.ar
Fingerprint8E:38:4E:A4:4F:87:B7:53:E6:11:1B:D9:A1:DE:61:D9:D9:ED:A0:C3
ValidityThu, 12 Oct 2023 00:00:00 GMT - Sat, 09 Nov 2024 23:59:59 GMT

File type
PNG image data, 42 x 42, 8-bit/color RGBA, non-interlaced
Size
934 B (934 bytes)
Hash
fb76a8f496cd2acbb2bf04947568f2c1
31110fcf19b023ed14f76e8b3d3f0c3fcbaabe91
c5adbd67b274d543dd28f62116802080cf12dd9151bb122ff1bda1ad77976ec9

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Banco Galicia
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /landing/images/atencion-digital.png HTTP/1.1
Host: www.galiciacgu.com.ar
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.galiciacgu.com.ar/cgu
Cookie: XSRF-TOKEN=eyJpdiI6IkpaL0VoMzRoUFAxUkhxejNVcjJRdUE9PSIsInZhbHVlIjoiYVZaU2RmNWppR0VmY1MvTlEzNlcvZUlhc2N5TWYyc0U2eVl2YUoxTGd2L3FndGxzY2J2YTErQjQ5MkMzSGtYSmJQcjI0ZGtHYmdkbzh4MjVqN2FPRHVsOEhpY003ODZhRDBKRGxnai9CNnlTSk9LeCtNSGMzMjF6VUtFR0JwYnIiLCJtYWMiOiI5MGNhMmY2MjY1NDQwNWIzYWQ1MzQ1MmMxZjEwMGE1MTIzNGQ0Y2ViODkwYjgwZjFiY2EyZjIxOTgyNjliOTIwIiwidGFnIjoiIn0%3D; galiciamove_session=eyJpdiI6IlZwcW1qUm9HbWFlQXl3b0l1TUpFN2c9PSIsInZhbHVlIjoiUFJKeEFDOEhnMjkyRCtaWFRsU1hPN1RxVG1nWCtBcU04RjRMOXVxdlUvaHdKY3I1OE5ndkhyTmN6aHNPZjVTV1lwWmhsUnJqT3BvbHhkQU0xOHltWWFPWlJKL2N6K01GWDlwTmN0RkpLeEw3eVduTG9SOGM4RDZLaU1rL1J2NG0iLCJtYWMiOiI1ZDU2MjU0MThjOTBkNzk4ZmY3Mjg2NWFkYTEwOWJmZDJjM2I1MGUyMjA4MjUwYWE2ZGM0NjkzZGM5N2UxMzNiIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Fri, 26 Apr 2024 17:24:18 GMT
content-type: image/png
content-length: 934
server: 
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
x-permitted-cross-domain-policies: all
feature-policy: fullscreen 'none'; microphone 'none'; geolocation 'self'; camera 'self'
last-modified: Mon, 20 Apr 2020 15:07:08 GMT
etag: "3a6-5a3ba40b60ac5"
accept-ranges: bytes
content-security-policy: upgrade-insecure-requests;media-src 'self' data:; default-src 'self' https://*.fls.doubleclick.net https://script.hotjar.com https://vars.hotjar.com;font-src 'self' https://script.hotjar.com fonts.gstatic.com;style-src 'unsafe-inline' 'self' fonts.googleapis.com;script-src 'unsafe-inline' 'unsafe-eval' 'self' https://api.zoomauth.com https://www.googleadservices.com https://*.twitter.com https://static.ads-twitter.com https://maps.googleapis.com https://script.hotjar.com https://static.hotjar.com https://www.facebook.com/ https://www.facebook.net/ https://connect.facebook.net https://connect.facebook.com https://www.googletagmanager.com https://www.google-analytics.com;img-src 'self' data: https://t.co https://googleads.g.doubleclick.net https://googletagmanager.com https://*.gstatic.com https://*.googleapis.com https://*.google.com.ar https://*.google.com https://www.facebook.com https://www.google-analytics.com www.google-analytics.com https://stats.g.doubleclick.net https://*.facebook.net https://www.googletagmanager.com https://script.hotjar.com ;connect-src 'self' https://galiciamove-tmp-uploads.s3.amazonaws.com https://api.zoomauth.com https://*.hotjar.com https://*.hotjar.io wss://*.hotjar.com https://www.google-analytics.com www.google-analytics.com https://stats.g.doubleclick.net, frame-ancestors 'self';
X-Firefox-Spdy: h2

www.galiciacgu.com.ar/landing/images/hace-todo-sin-pisar-una-sucursal.png

54.84.203.208

200 OK

895 B

URL GET HTTP/2
www.galiciacgu.com.ar/landing/images/hace-todo-sin-pisar-una-sucursal.png
IP
54.84.203.208:443
ASN
#14618 AMAZON-AES

Requested by
https://www.galiciacgu.com.ar/cgu
Certificate
IssuerAmazon
Subjectwww.galiciacgu.com.ar
Fingerprint8E:38:4E:A4:4F:87:B7:53:E6:11:1B:D9:A1:DE:61:D9:D9:ED:A0:C3
ValidityThu, 12 Oct 2023 00:00:00 GMT - Sat, 09 Nov 2024 23:59:59 GMT

File type
PNG image data, 42 x 42, 8-bit/color RGBA, non-interlaced
Size
895 B (895 bytes)
Hash
d0acc5b0bbdc43dd50dd2d0b2eb32576
1aa9e187b2b7b1557d4cfa5bcc3285c650a66ab7
d141b66bbaef43dff727297077b14a27847ea55d76a109fc86f8898933f84b02

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Banco Galicia
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /landing/images/hace-todo-sin-pisar-una-sucursal.png HTTP/1.1
Host: www.galiciacgu.com.ar
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.galiciacgu.com.ar/cgu
Cookie: XSRF-TOKEN=eyJpdiI6IkpaL0VoMzRoUFAxUkhxejNVcjJRdUE9PSIsInZhbHVlIjoiYVZaU2RmNWppR0VmY1MvTlEzNlcvZUlhc2N5TWYyc0U2eVl2YUoxTGd2L3FndGxzY2J2YTErQjQ5MkMzSGtYSmJQcjI0ZGtHYmdkbzh4MjVqN2FPRHVsOEhpY003ODZhRDBKRGxnai9CNnlTSk9LeCtNSGMzMjF6VUtFR0JwYnIiLCJtYWMiOiI5MGNhMmY2MjY1NDQwNWIzYWQ1MzQ1MmMxZjEwMGE1MTIzNGQ0Y2ViODkwYjgwZjFiY2EyZjIxOTgyNjliOTIwIiwidGFnIjoiIn0%3D; galiciamove_session=eyJpdiI6IlZwcW1qUm9HbWFlQXl3b0l1TUpFN2c9PSIsInZhbHVlIjoiUFJKeEFDOEhnMjkyRCtaWFRsU1hPN1RxVG1nWCtBcU04RjRMOXVxdlUvaHdKY3I1OE5ndkhyTmN6aHNPZjVTV1lwWmhsUnJqT3BvbHhkQU0xOHltWWFPWlJKL2N6K01GWDlwTmN0RkpLeEw3eVduTG9SOGM4RDZLaU1rL1J2NG0iLCJtYWMiOiI1ZDU2MjU0MThjOTBkNzk4ZmY3Mjg2NWFkYTEwOWJmZDJjM2I1MGUyMjA4MjUwYWE2ZGM0NjkzZGM5N2UxMzNiIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Fri, 26 Apr 2024 17:24:18 GMT
content-type: image/png
content-length: 895
server: 
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
x-permitted-cross-domain-policies: all
feature-policy: fullscreen 'none'; microphone 'none'; geolocation 'self'; camera 'self'
last-modified: Mon, 20 Apr 2020 15:07:08 GMT
etag: "37f-5a3ba40b60ac5"
accept-ranges: bytes
content-security-policy: upgrade-insecure-requests;media-src 'self' data:; default-src 'self' https://*.fls.doubleclick.net https://script.hotjar.com https://vars.hotjar.com;font-src 'self' https://script.hotjar.com fonts.gstatic.com;style-src 'unsafe-inline' 'self' fonts.googleapis.com;script-src 'unsafe-inline' 'unsafe-eval' 'self' https://api.zoomauth.com https://www.googleadservices.com https://*.twitter.com https://static.ads-twitter.com https://maps.googleapis.com https://script.hotjar.com https://static.hotjar.com https://www.facebook.com/ https://www.facebook.net/ https://connect.facebook.net https://connect.facebook.com https://www.googletagmanager.com https://www.google-analytics.com;img-src 'self' data: https://t.co https://googleads.g.doubleclick.net https://googletagmanager.com https://*.gstatic.com https://*.googleapis.com https://*.google.com.ar https://*.google.com https://www.facebook.com https://www.google-analytics.com www.google-analytics.com https://stats.g.doubleclick.net https://*.facebook.net https://www.googletagmanager.com https://script.hotjar.com ;connect-src 'self' https://galiciamove-tmp-uploads.s3.amazonaws.com https://api.zoomauth.com https://*.hotjar.com https://*.hotjar.io wss://*.hotjar.com https://www.google-analytics.com www.google-analytics.com https://stats.g.doubleclick.net, frame-ancestors 'self';
X-Firefox-Spdy: h2

www.galiciacgu.com.ar/landing/images/tu-dinero-en-todos-los-cajeros.png

54.84.203.208

200 OK

738 B

URL GET HTTP/2
www.galiciacgu.com.ar/landing/images/tu-dinero-en-todos-los-cajeros.png
IP
54.84.203.208:443
ASN
#14618 AMAZON-AES

Requested by
https://www.galiciacgu.com.ar/cgu
Certificate
IssuerAmazon
Subjectwww.galiciacgu.com.ar
Fingerprint8E:38:4E:A4:4F:87:B7:53:E6:11:1B:D9:A1:DE:61:D9:D9:ED:A0:C3
ValidityThu, 12 Oct 2023 00:00:00 GMT - Sat, 09 Nov 2024 23:59:59 GMT

File type
PNG image data, 42 x 42, 8-bit/color RGBA, non-interlaced
Size
738 B (738 bytes)
Hash
37ef7ecb588112b2d168d93c2b5154ab
da44a7fba3b8cac5ffffaf8c0e25a502ac4c7011
8d3da633c04f44cb49d2dfc0057c220a77e08acad89d4f9d47bf1b3a8ec328b2

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Banco Galicia
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /landing/images/tu-dinero-en-todos-los-cajeros.png HTTP/1.1
Host: www.galiciacgu.com.ar
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.galiciacgu.com.ar/cgu
Cookie: XSRF-TOKEN=eyJpdiI6IkpaL0VoMzRoUFAxUkhxejNVcjJRdUE9PSIsInZhbHVlIjoiYVZaU2RmNWppR0VmY1MvTlEzNlcvZUlhc2N5TWYyc0U2eVl2YUoxTGd2L3FndGxzY2J2YTErQjQ5MkMzSGtYSmJQcjI0ZGtHYmdkbzh4MjVqN2FPRHVsOEhpY003ODZhRDBKRGxnai9CNnlTSk9LeCtNSGMzMjF6VUtFR0JwYnIiLCJtYWMiOiI5MGNhMmY2MjY1NDQwNWIzYWQ1MzQ1MmMxZjEwMGE1MTIzNGQ0Y2ViODkwYjgwZjFiY2EyZjIxOTgyNjliOTIwIiwidGFnIjoiIn0%3D; galiciamove_session=eyJpdiI6IlZwcW1qUm9HbWFlQXl3b0l1TUpFN2c9PSIsInZhbHVlIjoiUFJKeEFDOEhnMjkyRCtaWFRsU1hPN1RxVG1nWCtBcU04RjRMOXVxdlUvaHdKY3I1OE5ndkhyTmN6aHNPZjVTV1lwWmhsUnJqT3BvbHhkQU0xOHltWWFPWlJKL2N6K01GWDlwTmN0RkpLeEw3eVduTG9SOGM4RDZLaU1rL1J2NG0iLCJtYWMiOiI1ZDU2MjU0MThjOTBkNzk4ZmY3Mjg2NWFkYTEwOWJmZDJjM2I1MGUyMjA4MjUwYWE2ZGM0NjkzZGM5N2UxMzNiIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Fri, 26 Apr 2024 17:24:18 GMT
content-type: image/png
content-length: 738
server: 
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
x-permitted-cross-domain-policies: all
feature-policy: fullscreen 'none'; microphone 'none'; geolocation 'self'; camera 'self'
last-modified: Mon, 20 Apr 2020 15:07:08 GMT
etag: "2e2-5a3ba40b84ce5"
accept-ranges: bytes
content-security-policy: upgrade-insecure-requests;media-src 'self' data:; default-src 'self' https://*.fls.doubleclick.net https://script.hotjar.com https://vars.hotjar.com;font-src 'self' https://script.hotjar.com fonts.gstatic.com;style-src 'unsafe-inline' 'self' fonts.googleapis.com;script-src 'unsafe-inline' 'unsafe-eval' 'self' https://api.zoomauth.com https://www.googleadservices.com https://*.twitter.com https://static.ads-twitter.com https://maps.googleapis.com https://script.hotjar.com https://static.hotjar.com https://www.facebook.com/ https://www.facebook.net/ https://connect.facebook.net https://connect.facebook.com https://www.googletagmanager.com https://www.google-analytics.com;img-src 'self' data: https://t.co https://googleads.g.doubleclick.net https://googletagmanager.com https://*.gstatic.com https://*.googleapis.com https://*.google.com.ar https://*.google.com https://www.facebook.com https://www.google-analytics.com www.google-analytics.com https://stats.g.doubleclick.net https://*.facebook.net https://www.googletagmanager.com https://script.hotjar.com ;connect-src 'self' https://galiciamove-tmp-uploads.s3.amazonaws.com https://api.zoomauth.com https://*.hotjar.com https://*.hotjar.io wss://*.hotjar.com https://www.google-analytics.com www.google-analytics.com https://stats.g.doubleclick.net, frame-ancestors 'self';
X-Firefox-Spdy: h2

www.googletagmanager.com/gtm.js?id=GTM-PXC7WZ

142.250.74.168

200 OK

101 kB

URL GET HTTP/3
www.googletagmanager.com/gtm.js?id=GTM-PXC7WZ
IP
142.250.74.168:443
ASN
#15169 GOOGLE

Requested by
https://www.galiciacgu.com.ar/cgu
Certificate
IssuerGoogle Trust Services LLC
Subject*.google-analytics.com
FingerprintFC:B1:16:E0:D8:F3:2B:F3:AB:33:E5:E1:23:57:F4:48:66:FD:4D:52
ValidityMon, 08 Apr 2024 06:34:55 GMT - Mon, 01 Jul 2024 06:34:54 GMT

File type
JavaScript source, Unicode text, UTF-8 text, with very long lines (29208)
Size
101 kB (101388 bytes)
Hash
10a020a33daab601ee15263bbf05727a
19fc17cc11207a8a934b7ee2c59e914491e8b68d
9b739f9e5abea52441507df1ff53a7b2a02fb4ef75f24b02ccee42d63f678a50

HTTP Headers

GET /gtm.js?id=GTM-PXC7WZ HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.galiciacgu.com.ar/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Fri, 26 Apr 2024 17:24:19 GMT
expires: Fri, 26 Apr 2024 17:24:19 GMT
cache-control: private, max-age=900
last-modified: Fri, 26 Apr 2024 15:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 101388
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

fonts.gstatic.com/s/inter/v13/UcCO3FwrK3iLTeHuS_fvQtMwCp50KnMw2boKoduKmMEVuLyfAZ9hiA.woff2

142.250.74.99

200 OK

22 kB

URL GET HTTP/2
fonts.gstatic.com/s/inter/v13/UcCO3FwrK3iLTeHuS_fvQtMwCp50KnMw2boKoduKmMEVuLyfAZ9hiA.woff2
IP
142.250.74.99:443
ASN
#15169 GOOGLE

Requested by
https://www.galiciacgu.com.ar/cgu
Certificate
IssuerGoogle Trust Services LLC
Subject*.gstatic.com
Fingerprint93:EC:35:60:8A:5B:23:EA:C0:36:D7:AE:03:0C:C3:77:17:5A:20:33
ValidityMon, 08 Apr 2024 07:31:57 GMT - Mon, 01 Jul 2024 07:31:56 GMT

File type
Web Open Font Format (Version 2), TrueType, length 21564, version 1.0
Size
22 kB (21564 bytes)
Hash
73aaa95eab3115ea5a1e5c1cf16ea645
2f00c608a688cd2b2e6ad37637726b0e081da1c7
2301bb030a2bcaa9c763cc4771bd717aac16709c29eaba00673fcbe7cdf99a59

HTTP Headers

GET /s/inter/v13/UcCO3FwrK3iLTeHuS_fvQtMwCp50KnMw2boKoduKmMEVuLyfAZ9hiA.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www.galiciacgu.com.ar
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 21564
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Mon, 22 Apr 2024 17:55:10 GMT
expires: Tue, 22 Apr 2025 17:55:10 GMT
cache-control: public, max-age=31536000
age: 343749
last-modified: Wed, 13 Sep 2023 23:49:07 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

fonts.gstatic.com/s/rubik/v28/iJWKBXyIfDnIV7nBrXw.woff2

142.250.74.99

200 OK

35 kB

URL GET HTTP/2
fonts.gstatic.com/s/rubik/v28/iJWKBXyIfDnIV7nBrXw.woff2
IP
142.250.74.99:443
ASN
#15169 GOOGLE

Requested by
https://www.galiciacgu.com.ar/cgu
Certificate
IssuerGoogle Trust Services LLC
Subject*.gstatic.com
Fingerprint93:EC:35:60:8A:5B:23:EA:C0:36:D7:AE:03:0C:C3:77:17:5A:20:33
ValidityMon, 08 Apr 2024 07:31:57 GMT - Mon, 01 Jul 2024 07:31:56 GMT

File type
Web Open Font Format (Version 2), TrueType, length 35448, version 1.0
Size
35 kB (35448 bytes)
Hash
5c138044f30b8c78119264cd744e686a
7605e014180d49087785350bd1906c16c389690d
47374cb7d373f9a8450e1237c80bc5fe68c61fbf0cdf958df7a298143b7dd445

HTTP Headers

GET /s/rubik/v28/iJWKBXyIfDnIV7nBrXw.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www.galiciacgu.com.ar
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 35448
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 25 Apr 2024 17:38:23 GMT
expires: Fri, 25 Apr 2025 17:38:23 GMT
cache-control: public, max-age=31536000
age: 85556
last-modified: Thu, 29 Jun 2023 16:14:39 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

www.galiciacgu.com.ar/images/galicia/landing/img-top.jpg

54.84.203.208

200 OK

202 kB

URL GET HTTP/2
www.galiciacgu.com.ar/images/galicia/landing/img-top.jpg
IP
54.84.203.208:443
ASN
#14618 AMAZON-AES

Requested by
https://www.galiciacgu.com.ar/cgu
Certificate
IssuerAmazon
Subjectwww.galiciacgu.com.ar
Fingerprint8E:38:4E:A4:4F:87:B7:53:E6:11:1B:D9:A1:DE:61:D9:D9:ED:A0:C3
ValidityThu, 12 Oct 2023 00:00:00 GMT - Sat, 09 Nov 2024 23:59:59 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=1], baseline, precision 8, 1441x726, components 3
Size
202 kB (202259 bytes)
Hash
1bb3acd88c03ee2e23a75d2c8b049a15
28177d238fb1313f98158ac974c4085aba715eac
dc316347050e65f842e21ec73c7b0c7a62a2696c60c7966b2e912f82f55a31e7

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Banco Galicia
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /images/galicia/landing/img-top.jpg HTTP/1.1
Host: www.galiciacgu.com.ar
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.galiciacgu.com.ar/css/landing/landing-galicia.css
Cookie: XSRF-TOKEN=eyJpdiI6IkpaL0VoMzRoUFAxUkhxejNVcjJRdUE9PSIsInZhbHVlIjoiYVZaU2RmNWppR0VmY1MvTlEzNlcvZUlhc2N5TWYyc0U2eVl2YUoxTGd2L3FndGxzY2J2YTErQjQ5MkMzSGtYSmJQcjI0ZGtHYmdkbzh4MjVqN2FPRHVsOEhpY003ODZhRDBKRGxnai9CNnlTSk9LeCtNSGMzMjF6VUtFR0JwYnIiLCJtYWMiOiI5MGNhMmY2MjY1NDQwNWIzYWQ1MzQ1MmMxZjEwMGE1MTIzNGQ0Y2ViODkwYjgwZjFiY2EyZjIxOTgyNjliOTIwIiwidGFnIjoiIn0%3D; galiciamove_session=eyJpdiI6IlZwcW1qUm9HbWFlQXl3b0l1TUpFN2c9PSIsInZhbHVlIjoiUFJKeEFDOEhnMjkyRCtaWFRsU1hPN1RxVG1nWCtBcU04RjRMOXVxdlUvaHdKY3I1OE5ndkhyTmN6aHNPZjVTV1lwWmhsUnJqT3BvbHhkQU0xOHltWWFPWlJKL2N6K01GWDlwTmN0RkpLeEw3eVduTG9SOGM4RDZLaU1rL1J2NG0iLCJtYWMiOiI1ZDU2MjU0MThjOTBkNzk4ZmY3Mjg2NWFkYTEwOWJmZDJjM2I1MGUyMjA4MjUwYWE2ZGM0NjkzZGM5N2UxMzNiIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Fri, 26 Apr 2024 17:24:19 GMT
content-type: image/jpeg
content-length: 202259
server: 
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
x-permitted-cross-domain-policies: all
feature-policy: fullscreen 'none'; microphone 'none'; geolocation 'self'; camera 'self'
last-modified: Tue, 30 Jun 2020 15:32:57 GMT
etag: "31613-5a94ee3c9b8b4"
accept-ranges: bytes
content-security-policy: upgrade-insecure-requests;media-src 'self' data:; default-src 'self' https://*.fls.doubleclick.net https://script.hotjar.com https://vars.hotjar.com;font-src 'self' https://script.hotjar.com fonts.gstatic.com;style-src 'unsafe-inline' 'self' fonts.googleapis.com;script-src 'unsafe-inline' 'unsafe-eval' 'self' https://api.zoomauth.com https://www.googleadservices.com https://*.twitter.com https://static.ads-twitter.com https://maps.googleapis.com https://script.hotjar.com https://static.hotjar.com https://www.facebook.com/ https://www.facebook.net/ https://connect.facebook.net https://connect.facebook.com https://www.googletagmanager.com https://www.google-analytics.com;img-src 'self' data: https://t.co https://googleads.g.doubleclick.net https://googletagmanager.com https://*.gstatic.com https://*.googleapis.com https://*.google.com.ar https://*.google.com https://www.facebook.com https://www.google-analytics.com www.google-analytics.com https://stats.g.doubleclick.net https://*.facebook.net https://www.googletagmanager.com https://script.hotjar.com ;connect-src 'self' https://galiciamove-tmp-uploads.s3.amazonaws.com https://api.zoomauth.com https://*.hotjar.com https://*.hotjar.io wss://*.hotjar.com https://www.google-analytics.com www.google-analytics.com https://stats.g.doubleclick.net, frame-ancestors 'self';
X-Firefox-Spdy: h2

fonts.googleapis.com/css?family=Rubik:300,400,500,700

142.250.74.106

200 OK

1.3 kB

URL GET HTTP/2
fonts.googleapis.com/css?family=Rubik:300,400,500,700
IP
142.250.74.106:443
ASN
#15169 GOOGLE

Requested by
https://www.galiciacgu.com.ar/cgu
Certificate
IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
Fingerprint5F:6D:48:87:16:89:1E:A5:57:29:92:8B:34:BD:F2:92:0C:7F:F2:50
ValidityMon, 08 Apr 2024 07:32:03 GMT - Mon, 01 Jul 2024 07:32:02 GMT

File type
gzip compressed data, max compression
Size
1.3 kB (1276 bytes)
Hash
490440c1bb98e7adde3a8ba880e22dbc
20fad9f5b806c7a87f2007a53e658187cbcf5401
e4ea5e58d9bedf74536b8e4866baf8e04d841c7de0911411a4e61bb62a73abeb

HTTP Headers

GET /css?family=Rubik:300,400,500,700 HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.galiciacgu.com.ar/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Fri, 26 Apr 2024 17:24:18 GMT
date: Fri, 26 Apr 2024 17:24:18 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

www.galiciacgu.com.ar/landing/images/arrow-right.svg

54.84.203.208

200 OK

488 B

URL GET HTTP/2
www.galiciacgu.com.ar/landing/images/arrow-right.svg
IP
54.84.203.208:443
ASN
#14618 AMAZON-AES

Requested by
https://www.galiciacgu.com.ar/cgu
Certificate
IssuerAmazon
Subjectwww.galiciacgu.com.ar
Fingerprint8E:38:4E:A4:4F:87:B7:53:E6:11:1B:D9:A1:DE:61:D9:D9:ED:A0:C3
ValidityThu, 12 Oct 2023 00:00:00 GMT - Sat, 09 Nov 2024 23:59:59 GMT

File type
SVG Scalable Vector Graphics image
Size
488 B (488 bytes)
Hash
49ddb210a9a44896f8286dfa5a049157
a9e25e4066d77d44d8886f4039d8a346afe8c73f
f1e2c27dcc925155adcaefa56b11b3b583c2c35ba76f48c46cad0edf5c5aaec4

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Banco Galicia
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /landing/images/arrow-right.svg HTTP/1.1
Host: www.galiciacgu.com.ar
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.galiciacgu.com.ar/css/landing/landing-galicia.css
Cookie: XSRF-TOKEN=eyJpdiI6IkpaL0VoMzRoUFAxUkhxejNVcjJRdUE9PSIsInZhbHVlIjoiYVZaU2RmNWppR0VmY1MvTlEzNlcvZUlhc2N5TWYyc0U2eVl2YUoxTGd2L3FndGxzY2J2YTErQjQ5MkMzSGtYSmJQcjI0ZGtHYmdkbzh4MjVqN2FPRHVsOEhpY003ODZhRDBKRGxnai9CNnlTSk9LeCtNSGMzMjF6VUtFR0JwYnIiLCJtYWMiOiI5MGNhMmY2MjY1NDQwNWIzYWQ1MzQ1MmMxZjEwMGE1MTIzNGQ0Y2ViODkwYjgwZjFiY2EyZjIxOTgyNjliOTIwIiwidGFnIjoiIn0%3D; galiciamove_session=eyJpdiI6IlZwcW1qUm9HbWFlQXl3b0l1TUpFN2c9PSIsInZhbHVlIjoiUFJKeEFDOEhnMjkyRCtaWFRsU1hPN1RxVG1nWCtBcU04RjRMOXVxdlUvaHdKY3I1OE5ndkhyTmN6aHNPZjVTV1lwWmhsUnJqT3BvbHhkQU0xOHltWWFPWlJKL2N6K01GWDlwTmN0RkpLeEw3eVduTG9SOGM4RDZLaU1rL1J2NG0iLCJtYWMiOiI1ZDU2MjU0MThjOTBkNzk4ZmY3Mjg2NWFkYTEwOWJmZDJjM2I1MGUyMjA4MjUwYWE2ZGM0NjkzZGM5N2UxMzNiIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Fri, 26 Apr 2024 17:24:19 GMT
content-type: image/svg+xml
content-length: 488
server: 
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
x-permitted-cross-domain-policies: all
feature-policy: fullscreen 'none'; microphone 'none'; geolocation 'self'; camera 'self'
last-modified: Fri, 06 May 2022 18:50:21 GMT
etag: "1e8-5de5c549b55af"
accept-ranges: bytes
content-security-policy: upgrade-insecure-requests;media-src 'self' data:; default-src 'self' https://*.fls.doubleclick.net https://script.hotjar.com https://vars.hotjar.com;font-src 'self' https://script.hotjar.com fonts.gstatic.com;style-src 'unsafe-inline' 'self' fonts.googleapis.com;script-src 'unsafe-inline' 'unsafe-eval' 'self' https://api.zoomauth.com https://www.googleadservices.com https://*.twitter.com https://static.ads-twitter.com https://maps.googleapis.com https://script.hotjar.com https://static.hotjar.com https://www.facebook.com/ https://www.facebook.net/ https://connect.facebook.net https://connect.facebook.com https://www.googletagmanager.com https://www.google-analytics.com;img-src 'self' data: https://t.co https://googleads.g.doubleclick.net https://googletagmanager.com https://*.gstatic.com https://*.googleapis.com https://*.google.com.ar https://*.google.com https://www.facebook.com https://www.google-analytics.com www.google-analytics.com https://stats.g.doubleclick.net https://*.facebook.net https://www.googletagmanager.com https://script.hotjar.com ;connect-src 'self' https://galiciamove-tmp-uploads.s3.amazonaws.com https://api.zoomauth.com https://*.hotjar.com https://*.hotjar.io wss://*.hotjar.com https://www.google-analytics.com www.google-analytics.com https://stats.g.doubleclick.net, frame-ancestors 'self';
X-Firefox-Spdy: h2

www.googletagmanager.com/gtag/js?id=G-FX0Z8DW3TM&l=dataLayer&cx=c

142.250.74.168

200 OK

92 kB

URL GET HTTP/3
www.googletagmanager.com/gtag/js?id=G-FX0Z8DW3TM&l=dataLayer&cx=c
IP
142.250.74.168:443
ASN
#15169 GOOGLE

Requested by
https://www.galiciacgu.com.ar/cgu
Certificate
IssuerGoogle Trust Services LLC
Subject*.google-analytics.com
FingerprintFC:B1:16:E0:D8:F3:2B:F3:AB:33:E5:E1:23:57:F4:48:66:FD:4D:52
ValidityMon, 08 Apr 2024 06:34:55 GMT - Mon, 01 Jul 2024 06:34:54 GMT

File type
JavaScript source, Unicode text, UTF-8 text, with very long lines (7853)
Size
92 kB (91696 bytes)
Hash
fb3c9fd28d2630b735e71f6f9acb8a20
33ea528d85e6c21877bea7074e7df5618043ed84
46cc3482ce82337d03a641837a708a473ad3753c8534aa4722d05e4e256130b9

HTTP Headers

GET /gtag/js?id=G-FX0Z8DW3TM&l=dataLayer&cx=c HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.galiciacgu.com.ar/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Fri, 26 Apr 2024 17:24:19 GMT
expires: Fri, 26 Apr 2024 17:24:19 GMT
cache-control: private, max-age=900
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 91696
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

www.googletagmanager.com/gtm.js?id=GTM-K56P7CZ&l=dataLayer

142.250.74.168

200 OK

76 kB

URL GET HTTP/3
www.googletagmanager.com/gtm.js?id=GTM-K56P7CZ&l=dataLayer
IP
142.250.74.168:443
ASN
#15169 GOOGLE

Requested by
https://www.galiciacgu.com.ar/cgu
Certificate
IssuerGoogle Trust Services LLC
Subject*.google-analytics.com
FingerprintFC:B1:16:E0:D8:F3:2B:F3:AB:33:E5:E1:23:57:F4:48:66:FD:4D:52
ValidityMon, 08 Apr 2024 06:34:55 GMT - Mon, 01 Jul 2024 06:34:54 GMT

File type
JavaScript source, ASCII text, with very long lines (3020)
Size
76 kB (75827 bytes)
Hash
92e17b4b5fa676a072ee6c6ee26bff9c
ce308c9d18ccd093e98e78e4125e64e8e345079f
59d79cb1479e407067d4fd01271f5d240022a4d1b5281b64a0f7511b6d2e501b

HTTP Headers

GET /gtm.js?id=GTM-K56P7CZ&l=dataLayer HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.galiciacgu.com.ar/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Fri, 26 Apr 2024 17:24:19 GMT
expires: Fri, 26 Apr 2024 17:24:19 GMT
cache-control: private, max-age=900
last-modified: Fri, 26 Apr 2024 15:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 75827
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

www.googletagmanager.com/gtag/destination?id=DC-9017705&l=dataLayer&cx=c

142.250.74.168

200 OK

73 kB

URL GET HTTP/3
www.googletagmanager.com/gtag/destination?id=DC-9017705&l=dataLayer&cx=c
IP
142.250.74.168:443
ASN
#15169 GOOGLE

Requested by
https://www.galiciacgu.com.ar/cgu
Certificate
IssuerGoogle Trust Services LLC
Subject*.google-analytics.com
FingerprintFC:B1:16:E0:D8:F3:2B:F3:AB:33:E5:E1:23:57:F4:48:66:FD:4D:52
ValidityMon, 08 Apr 2024 06:34:55 GMT - Mon, 01 Jul 2024 06:34:54 GMT

File type
JavaScript source, ASCII text, with very long lines (1763)
Size
73 kB (72872 bytes)
Hash
000fe5f889ba340910923fb14b8f9621
f976b5da7613768c4bfbd5de31db371838ed6e6f
f5ff3de1cfeceb63db4e166c1d3da2bc96fe5fdb581ff35c2264bc99ef6a53d9

HTTP Headers

GET /gtag/destination?id=DC-9017705&l=dataLayer&cx=c HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.galiciacgu.com.ar/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Fri, 26 Apr 2024 17:24:19 GMT
expires: Fri, 26 Apr 2024 17:24:19 GMT
cache-control: private, max-age=900
last-modified: Fri, 26 Apr 2024 15:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 72872
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

www.galiciacgu.com.ar/images/galicia/landing/formulario.png

54.84.203.208

200 OK

5.1 kB

URL GET HTTP/2
www.galiciacgu.com.ar/images/galicia/landing/formulario.png
IP
54.84.203.208:443
ASN
#14618 AMAZON-AES

Requested by
https://www.galiciacgu.com.ar/cgu
Certificate
IssuerAmazon
Subjectwww.galiciacgu.com.ar
Fingerprint8E:38:4E:A4:4F:87:B7:53:E6:11:1B:D9:A1:DE:61:D9:D9:ED:A0:C3
ValidityThu, 12 Oct 2023 00:00:00 GMT - Sat, 09 Nov 2024 23:59:59 GMT

File type
PNG image data, 102 x 100, 8-bit/color RGBA, non-interlaced
Size
5.1 kB (5130 bytes)
Hash
72132733d0c28d23878a2284942111f1
84079069c8961c8312a4defc3dc624a8f899a803
ca9ad07fd6681ad311946634716f0ed45d7761cc56b78a6645dbb9039585a346

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Banco Galicia
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /images/galicia/landing/formulario.png HTTP/1.1
Host: www.galiciacgu.com.ar
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.galiciacgu.com.ar/cgu
Cookie: XSRF-TOKEN=eyJpdiI6IkpaL0VoMzRoUFAxUkhxejNVcjJRdUE9PSIsInZhbHVlIjoiYVZaU2RmNWppR0VmY1MvTlEzNlcvZUlhc2N5TWYyc0U2eVl2YUoxTGd2L3FndGxzY2J2YTErQjQ5MkMzSGtYSmJQcjI0ZGtHYmdkbzh4MjVqN2FPRHVsOEhpY003ODZhRDBKRGxnai9CNnlTSk9LeCtNSGMzMjF6VUtFR0JwYnIiLCJtYWMiOiI5MGNhMmY2MjY1NDQwNWIzYWQ1MzQ1MmMxZjEwMGE1MTIzNGQ0Y2ViODkwYjgwZjFiY2EyZjIxOTgyNjliOTIwIiwidGFnIjoiIn0%3D; galiciamove_session=eyJpdiI6IlZwcW1qUm9HbWFlQXl3b0l1TUpFN2c9PSIsInZhbHVlIjoiUFJKeEFDOEhnMjkyRCtaWFRsU1hPN1RxVG1nWCtBcU04RjRMOXVxdlUvaHdKY3I1OE5ndkhyTmN6aHNPZjVTV1lwWmhsUnJqT3BvbHhkQU0xOHltWWFPWlJKL2N6K01GWDlwTmN0RkpLeEw3eVduTG9SOGM4RDZLaU1rL1J2NG0iLCJtYWMiOiI1ZDU2MjU0MThjOTBkNzk4ZmY3Mjg2NWFkYTEwOWJmZDJjM2I1MGUyMjA4MjUwYWE2ZGM0NjkzZGM5N2UxMzNiIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Fri, 26 Apr 2024 17:24:19 GMT
content-type: image/png
content-length: 5130
server: 
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
x-permitted-cross-domain-policies: all
feature-policy: fullscreen 'none'; microphone 'none'; geolocation 'self'; camera 'self'
last-modified: Tue, 30 Jun 2020 15:32:57 GMT
etag: "140a-5a94ee3c9a914"
accept-ranges: bytes
content-security-policy: upgrade-insecure-requests;media-src 'self' data:; default-src 'self' https://*.fls.doubleclick.net https://script.hotjar.com https://vars.hotjar.com;font-src 'self' https://script.hotjar.com fonts.gstatic.com;style-src 'unsafe-inline' 'self' fonts.googleapis.com;script-src 'unsafe-inline' 'unsafe-eval' 'self' https://api.zoomauth.com https://www.googleadservices.com https://*.twitter.com https://static.ads-twitter.com https://maps.googleapis.com https://script.hotjar.com https://static.hotjar.com https://www.facebook.com/ https://www.facebook.net/ https://connect.facebook.net https://connect.facebook.com https://www.googletagmanager.com https://www.google-analytics.com;img-src 'self' data: https://t.co https://googleads.g.doubleclick.net https://googletagmanager.com https://*.gstatic.com https://*.googleapis.com https://*.google.com.ar https://*.google.com https://www.facebook.com https://www.google-analytics.com www.google-analytics.com https://stats.g.doubleclick.net https://*.facebook.net https://www.googletagmanager.com https://script.hotjar.com ;connect-src 'self' https://galiciamove-tmp-uploads.s3.amazonaws.com https://api.zoomauth.com https://*.hotjar.com https://*.hotjar.io wss://*.hotjar.com https://www.google-analytics.com www.google-analytics.com https://stats.g.doubleclick.net, frame-ancestors 'self';
X-Firefox-Spdy: h2

www.galiciacgu.com.ar/landing/images/ahorros-en-tus-compras.png

54.84.203.208

200 OK

1.1 kB

URL GET HTTP/2
www.galiciacgu.com.ar/landing/images/ahorros-en-tus-compras.png
IP
54.84.203.208:443
ASN
#14618 AMAZON-AES

Requested by
https://www.galiciacgu.com.ar/cgu
Certificate
IssuerAmazon
Subjectwww.galiciacgu.com.ar
Fingerprint8E:38:4E:A4:4F:87:B7:53:E6:11:1B:D9:A1:DE:61:D9:D9:ED:A0:C3
ValidityThu, 12 Oct 2023 00:00:00 GMT - Sat, 09 Nov 2024 23:59:59 GMT

File type
PNG image data, 42 x 42, 8-bit/color RGBA, non-interlaced
Size
1.1 kB (1077 bytes)
Hash
c9a0e05726cf3d0156c1de4cb4d34d9b
c12b219279ef1815c4abb8d97c9af032ed4ec2e7
e9f11131ee8e8d2fe74520e48fd0b122dd79c658102cd50bd891d916553270df

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Banco Galicia
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /landing/images/ahorros-en-tus-compras.png HTTP/1.1
Host: www.galiciacgu.com.ar
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.galiciacgu.com.ar/cgu
Cookie: XSRF-TOKEN=eyJpdiI6IkpaL0VoMzRoUFAxUkhxejNVcjJRdUE9PSIsInZhbHVlIjoiYVZaU2RmNWppR0VmY1MvTlEzNlcvZUlhc2N5TWYyc0U2eVl2YUoxTGd2L3FndGxzY2J2YTErQjQ5MkMzSGtYSmJQcjI0ZGtHYmdkbzh4MjVqN2FPRHVsOEhpY003ODZhRDBKRGxnai9CNnlTSk9LeCtNSGMzMjF6VUtFR0JwYnIiLCJtYWMiOiI5MGNhMmY2MjY1NDQwNWIzYWQ1MzQ1MmMxZjEwMGE1MTIzNGQ0Y2ViODkwYjgwZjFiY2EyZjIxOTgyNjliOTIwIiwidGFnIjoiIn0%3D; galiciamove_session=eyJpdiI6IlZwcW1qUm9HbWFlQXl3b0l1TUpFN2c9PSIsInZhbHVlIjoiUFJKeEFDOEhnMjkyRCtaWFRsU1hPN1RxVG1nWCtBcU04RjRMOXVxdlUvaHdKY3I1OE5ndkhyTmN6aHNPZjVTV1lwWmhsUnJqT3BvbHhkQU0xOHltWWFPWlJKL2N6K01GWDlwTmN0RkpLeEw3eVduTG9SOGM4RDZLaU1rL1J2NG0iLCJtYWMiOiI1ZDU2MjU0MThjOTBkNzk4ZmY3Mjg2NWFkYTEwOWJmZDJjM2I1MGUyMjA4MjUwYWE2ZGM0NjkzZGM5N2UxMzNiIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Fri, 26 Apr 2024 17:24:19 GMT
content-type: image/png
content-length: 1077
server: 
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
x-permitted-cross-domain-policies: all
feature-policy: fullscreen 'none'; microphone 'none'; geolocation 'self'; camera 'self'
last-modified: Mon, 20 Apr 2020 15:07:08 GMT
etag: "435-5a3ba40b60ac5"
accept-ranges: bytes
content-security-policy: upgrade-insecure-requests;media-src 'self' data:; default-src 'self' https://*.fls.doubleclick.net https://script.hotjar.com https://vars.hotjar.com;font-src 'self' https://script.hotjar.com fonts.gstatic.com;style-src 'unsafe-inline' 'self' fonts.googleapis.com;script-src 'unsafe-inline' 'unsafe-eval' 'self' https://api.zoomauth.com https://www.googleadservices.com https://*.twitter.com https://static.ads-twitter.com https://maps.googleapis.com https://script.hotjar.com https://static.hotjar.com https://www.facebook.com/ https://www.facebook.net/ https://connect.facebook.net https://connect.facebook.com https://www.googletagmanager.com https://www.google-analytics.com;img-src 'self' data: https://t.co https://googleads.g.doubleclick.net https://googletagmanager.com https://*.gstatic.com https://*.googleapis.com https://*.google.com.ar https://*.google.com https://www.facebook.com https://www.google-analytics.com www.google-analytics.com https://stats.g.doubleclick.net https://*.facebook.net https://www.googletagmanager.com https://script.hotjar.com ;connect-src 'self' https://galiciamove-tmp-uploads.s3.amazonaws.com https://api.zoomauth.com https://*.hotjar.com https://*.hotjar.io wss://*.hotjar.com https://www.google-analytics.com www.google-analytics.com https://stats.g.doubleclick.net, frame-ancestors 'self';
X-Firefox-Spdy: h2

www.galiciacgu.com.ar/images/galicia/landing/selfie.png

54.84.203.208

200 OK

5.8 kB

URL GET HTTP/2
www.galiciacgu.com.ar/images/galicia/landing/selfie.png
IP
54.84.203.208:443
ASN
#14618 AMAZON-AES

Requested by
https://www.galiciacgu.com.ar/cgu
Certificate
IssuerAmazon
Subjectwww.galiciacgu.com.ar
Fingerprint8E:38:4E:A4:4F:87:B7:53:E6:11:1B:D9:A1:DE:61:D9:D9:ED:A0:C3
ValidityThu, 12 Oct 2023 00:00:00 GMT - Sat, 09 Nov 2024 23:59:59 GMT

File type
PNG image data, 101 x 109, 8-bit/color RGBA, non-interlaced
Size
5.8 kB (5764 bytes)
Hash
24ea8c02d7877e59adf1f7be4d4170e0
3050df0eea4740f64cd83a5f31fc6618eb0d5daa
bbf29a2416b0152e6d76dff5d9c09d1bf203d6a60fe0b921c47ad28564de7681

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Banco Galicia
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /images/galicia/landing/selfie.png HTTP/1.1
Host: www.galiciacgu.com.ar
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.galiciacgu.com.ar/cgu
Cookie: XSRF-TOKEN=eyJpdiI6IkpaL0VoMzRoUFAxUkhxejNVcjJRdUE9PSIsInZhbHVlIjoiYVZaU2RmNWppR0VmY1MvTlEzNlcvZUlhc2N5TWYyc0U2eVl2YUoxTGd2L3FndGxzY2J2YTErQjQ5MkMzSGtYSmJQcjI0ZGtHYmdkbzh4MjVqN2FPRHVsOEhpY003ODZhRDBKRGxnai9CNnlTSk9LeCtNSGMzMjF6VUtFR0JwYnIiLCJtYWMiOiI5MGNhMmY2MjY1NDQwNWIzYWQ1MzQ1MmMxZjEwMGE1MTIzNGQ0Y2ViODkwYjgwZjFiY2EyZjIxOTgyNjliOTIwIiwidGFnIjoiIn0%3D; galiciamove_session=eyJpdiI6IlZwcW1qUm9HbWFlQXl3b0l1TUpFN2c9PSIsInZhbHVlIjoiUFJKeEFDOEhnMjkyRCtaWFRsU1hPN1RxVG1nWCtBcU04RjRMOXVxdlUvaHdKY3I1OE5ndkhyTmN6aHNPZjVTV1lwWmhsUnJqT3BvbHhkQU0xOHltWWFPWlJKL2N6K01GWDlwTmN0RkpLeEw3eVduTG9SOGM4RDZLaU1rL1J2NG0iLCJtYWMiOiI1ZDU2MjU0MThjOTBkNzk4ZmY3Mjg2NWFkYTEwOWJmZDJjM2I1MGUyMjA4MjUwYWE2ZGM0NjkzZGM5N2UxMzNiIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Fri, 26 Apr 2024 17:24:20 GMT
content-type: image/png
content-length: 5764
server: 
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
x-permitted-cross-domain-policies: all
feature-policy: fullscreen 'none'; microphone 'none'; geolocation 'self'; camera 'self'
last-modified: Tue, 30 Jun 2020 15:32:57 GMT
etag: "1684-5a94ee3ca35b4"
accept-ranges: bytes
content-security-policy: upgrade-insecure-requests;media-src 'self' data:; default-src 'self' https://*.fls.doubleclick.net https://script.hotjar.com https://vars.hotjar.com;font-src 'self' https://script.hotjar.com fonts.gstatic.com;style-src 'unsafe-inline' 'self' fonts.googleapis.com;script-src 'unsafe-inline' 'unsafe-eval' 'self' https://api.zoomauth.com https://www.googleadservices.com https://*.twitter.com https://static.ads-twitter.com https://maps.googleapis.com https://script.hotjar.com https://static.hotjar.com https://www.facebook.com/ https://www.facebook.net/ https://connect.facebook.net https://connect.facebook.com https://www.googletagmanager.com https://www.google-analytics.com;img-src 'self' data: https://t.co https://googleads.g.doubleclick.net https://googletagmanager.com https://*.gstatic.com https://*.googleapis.com https://*.google.com.ar https://*.google.com https://www.facebook.com https://www.google-analytics.com www.google-analytics.com https://stats.g.doubleclick.net https://*.facebook.net https://www.googletagmanager.com https://script.hotjar.com ;connect-src 'self' https://galiciamove-tmp-uploads.s3.amazonaws.com https://api.zoomauth.com https://*.hotjar.com https://*.hotjar.io wss://*.hotjar.com https://www.google-analytics.com www.google-analytics.com https://stats.g.doubleclick.net, frame-ancestors 'self';
X-Firefox-Spdy: h2

www.galiciacgu.com.ar/landing/images/instagram-icon.svg

54.84.203.208

200 OK

1.5 kB

URL GET HTTP/2
www.galiciacgu.com.ar/landing/images/instagram-icon.svg
IP
54.84.203.208:443
ASN
#14618 AMAZON-AES

Requested by
https://www.galiciacgu.com.ar/cgu
Certificate
IssuerAmazon
Subjectwww.galiciacgu.com.ar
Fingerprint8E:38:4E:A4:4F:87:B7:53:E6:11:1B:D9:A1:DE:61:D9:D9:ED:A0:C3
ValidityThu, 12 Oct 2023 00:00:00 GMT - Sat, 09 Nov 2024 23:59:59 GMT

File type
SVG Scalable Vector Graphics image
Size
1.5 kB (1503 bytes)
Hash
91fb25c88daf08ea717c914847eb21da
96572fb6797f358637369b59e1673d092a33474b
32a75ee067f6cd74a341d9b6b93259307909fb5f8de22bbeffa2345b0e1285ca

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Banco Galicia
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /landing/images/instagram-icon.svg HTTP/1.1
Host: www.galiciacgu.com.ar
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.galiciacgu.com.ar/cgu
Cookie: XSRF-TOKEN=eyJpdiI6IkpaL0VoMzRoUFAxUkhxejNVcjJRdUE9PSIsInZhbHVlIjoiYVZaU2RmNWppR0VmY1MvTlEzNlcvZUlhc2N5TWYyc0U2eVl2YUoxTGd2L3FndGxzY2J2YTErQjQ5MkMzSGtYSmJQcjI0ZGtHYmdkbzh4MjVqN2FPRHVsOEhpY003ODZhRDBKRGxnai9CNnlTSk9LeCtNSGMzMjF6VUtFR0JwYnIiLCJtYWMiOiI5MGNhMmY2MjY1NDQwNWIzYWQ1MzQ1MmMxZjEwMGE1MTIzNGQ0Y2ViODkwYjgwZjFiY2EyZjIxOTgyNjliOTIwIiwidGFnIjoiIn0%3D; galiciamove_session=eyJpdiI6IlZwcW1qUm9HbWFlQXl3b0l1TUpFN2c9PSIsInZhbHVlIjoiUFJKeEFDOEhnMjkyRCtaWFRsU1hPN1RxVG1nWCtBcU04RjRMOXVxdlUvaHdKY3I1OE5ndkhyTmN6aHNPZjVTV1lwWmhsUnJqT3BvbHhkQU0xOHltWWFPWlJKL2N6K01GWDlwTmN0RkpLeEw3eVduTG9SOGM4RDZLaU1rL1J2NG0iLCJtYWMiOiI1ZDU2MjU0MThjOTBkNzk4ZmY3Mjg2NWFkYTEwOWJmZDJjM2I1MGUyMjA4MjUwYWE2ZGM0NjkzZGM5N2UxMzNiIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Fri, 26 Apr 2024 17:24:20 GMT
content-type: image/svg+xml
content-length: 1503
server: 
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
x-permitted-cross-domain-policies: all
feature-policy: fullscreen 'none'; microphone 'none'; geolocation 'self'; camera 'self'
last-modified: Mon, 20 Apr 2020 15:07:08 GMT
etag: "5df-5a3ba40b704c5"
accept-ranges: bytes
content-security-policy: upgrade-insecure-requests;media-src 'self' data:; default-src 'self' https://*.fls.doubleclick.net https://script.hotjar.com https://vars.hotjar.com;font-src 'self' https://script.hotjar.com fonts.gstatic.com;style-src 'unsafe-inline' 'self' fonts.googleapis.com;script-src 'unsafe-inline' 'unsafe-eval' 'self' https://api.zoomauth.com https://www.googleadservices.com https://*.twitter.com https://static.ads-twitter.com https://maps.googleapis.com https://script.hotjar.com https://static.hotjar.com https://www.facebook.com/ https://www.facebook.net/ https://connect.facebook.net https://connect.facebook.com https://www.googletagmanager.com https://www.google-analytics.com;img-src 'self' data: https://t.co https://googleads.g.doubleclick.net https://googletagmanager.com https://*.gstatic.com https://*.googleapis.com https://*.google.com.ar https://*.google.com https://www.facebook.com https://www.google-analytics.com www.google-analytics.com https://stats.g.doubleclick.net https://*.facebook.net https://www.googletagmanager.com https://script.hotjar.com ;connect-src 'self' https://galiciamove-tmp-uploads.s3.amazonaws.com https://api.zoomauth.com https://*.hotjar.com https://*.hotjar.io wss://*.hotjar.com https://www.google-analytics.com www.google-analytics.com https://stats.g.doubleclick.net, frame-ancestors 'self';
X-Firefox-Spdy: h2

www.galiciacgu.com.ar/images/galicia/landing/mail-icon.svg

54.84.203.208

200 OK

381 B

URL GET HTTP/2
www.galiciacgu.com.ar/images/galicia/landing/mail-icon.svg
IP
54.84.203.208:443
ASN
#14618 AMAZON-AES

Requested by
https://www.galiciacgu.com.ar/cgu
Certificate
IssuerAmazon
Subjectwww.galiciacgu.com.ar
Fingerprint8E:38:4E:A4:4F:87:B7:53:E6:11:1B:D9:A1:DE:61:D9:D9:ED:A0:C3
ValidityThu, 12 Oct 2023 00:00:00 GMT - Sat, 09 Nov 2024 23:59:59 GMT

File type
SVG Scalable Vector Graphics image
Size
381 B (381 bytes)
Hash
2b2a0b4775d353e8215c008f7339b33c
03cd47b51ae4e0480934b2886b7674ce5e5dd637
8c27c66a166fe876ac24ba61980a2b779a8d95e0e1cab9ea4c1971495f515fbd

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Banco Galicia
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /images/galicia/landing/mail-icon.svg HTTP/1.1
Host: www.galiciacgu.com.ar
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.galiciacgu.com.ar/cgu
Cookie: XSRF-TOKEN=eyJpdiI6IkpaL0VoMzRoUFAxUkhxejNVcjJRdUE9PSIsInZhbHVlIjoiYVZaU2RmNWppR0VmY1MvTlEzNlcvZUlhc2N5TWYyc0U2eVl2YUoxTGd2L3FndGxzY2J2YTErQjQ5MkMzSGtYSmJQcjI0ZGtHYmdkbzh4MjVqN2FPRHVsOEhpY003ODZhRDBKRGxnai9CNnlTSk9LeCtNSGMzMjF6VUtFR0JwYnIiLCJtYWMiOiI5MGNhMmY2MjY1NDQwNWIzYWQ1MzQ1MmMxZjEwMGE1MTIzNGQ0Y2ViODkwYjgwZjFiY2EyZjIxOTgyNjliOTIwIiwidGFnIjoiIn0%3D; galiciamove_session=eyJpdiI6IlZwcW1qUm9HbWFlQXl3b0l1TUpFN2c9PSIsInZhbHVlIjoiUFJKeEFDOEhnMjkyRCtaWFRsU1hPN1RxVG1nWCtBcU04RjRMOXVxdlUvaHdKY3I1OE5ndkhyTmN6aHNPZjVTV1lwWmhsUnJqT3BvbHhkQU0xOHltWWFPWlJKL2N6K01GWDlwTmN0RkpLeEw3eVduTG9SOGM4RDZLaU1rL1J2NG0iLCJtYWMiOiI1ZDU2MjU0MThjOTBkNzk4ZmY3Mjg2NWFkYTEwOWJmZDJjM2I1MGUyMjA4MjUwYWE2ZGM0NjkzZGM5N2UxMzNiIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Fri, 26 Apr 2024 17:24:20 GMT
content-type: image/svg+xml
content-length: 381
server: 
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
x-permitted-cross-domain-policies: all
feature-policy: fullscreen 'none'; microphone 'none'; geolocation 'self'; camera 'self'
last-modified: Tue, 30 Jun 2020 15:32:57 GMT
etag: "17d-5a94ee3ca2614"
accept-ranges: bytes
content-security-policy: upgrade-insecure-requests;media-src 'self' data:; default-src 'self' https://*.fls.doubleclick.net https://script.hotjar.com https://vars.hotjar.com;font-src 'self' https://script.hotjar.com fonts.gstatic.com;style-src 'unsafe-inline' 'self' fonts.googleapis.com;script-src 'unsafe-inline' 'unsafe-eval' 'self' https://api.zoomauth.com https://www.googleadservices.com https://*.twitter.com https://static.ads-twitter.com https://maps.googleapis.com https://script.hotjar.com https://static.hotjar.com https://www.facebook.com/ https://www.facebook.net/ https://connect.facebook.net https://connect.facebook.com https://www.googletagmanager.com https://www.google-analytics.com;img-src 'self' data: https://t.co https://googleads.g.doubleclick.net https://googletagmanager.com https://*.gstatic.com https://*.googleapis.com https://*.google.com.ar https://*.google.com https://www.facebook.com https://www.google-analytics.com www.google-analytics.com https://stats.g.doubleclick.net https://*.facebook.net https://www.googletagmanager.com https://script.hotjar.com ;connect-src 'self' https://galiciamove-tmp-uploads.s3.amazonaws.com https://api.zoomauth.com https://*.hotjar.com https://*.hotjar.io wss://*.hotjar.com https://www.google-analytics.com www.google-analytics.com https://stats.g.doubleclick.net, frame-ancestors 'self';
X-Firefox-Spdy: h2

www.galiciacgu.com.ar/images/galicia/landing/tarjeta.png

54.84.203.208

200 OK

7.4 kB

URL GET HTTP/2
www.galiciacgu.com.ar/images/galicia/landing/tarjeta.png
IP
54.84.203.208:443
ASN
#14618 AMAZON-AES

Requested by
https://www.galiciacgu.com.ar/cgu
Certificate
IssuerAmazon
Subjectwww.galiciacgu.com.ar
Fingerprint8E:38:4E:A4:4F:87:B7:53:E6:11:1B:D9:A1:DE:61:D9:D9:ED:A0:C3
ValidityThu, 12 Oct 2023 00:00:00 GMT - Sat, 09 Nov 2024 23:59:59 GMT

File type
PNG image data, 102 x 121, 8-bit/color RGBA, non-interlaced
Size
7.4 kB (7383 bytes)
Hash
6929733eed2407ffaaab5b867c72ac05
535dd308b45858c182763e9fbdeb7da07c7a5ddd
70066ecd234880122706633877af842e79601e48ed87b90e553cd1612d5a4838

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Banco Galicia
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /images/galicia/landing/tarjeta.png HTTP/1.1
Host: www.galiciacgu.com.ar
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.galiciacgu.com.ar/cgu
Cookie: XSRF-TOKEN=eyJpdiI6IkpaL0VoMzRoUFAxUkhxejNVcjJRdUE9PSIsInZhbHVlIjoiYVZaU2RmNWppR0VmY1MvTlEzNlcvZUlhc2N5TWYyc0U2eVl2YUoxTGd2L3FndGxzY2J2YTErQjQ5MkMzSGtYSmJQcjI0ZGtHYmdkbzh4MjVqN2FPRHVsOEhpY003ODZhRDBKRGxnai9CNnlTSk9LeCtNSGMzMjF6VUtFR0JwYnIiLCJtYWMiOiI5MGNhMmY2MjY1NDQwNWIzYWQ1MzQ1MmMxZjEwMGE1MTIzNGQ0Y2ViODkwYjgwZjFiY2EyZjIxOTgyNjliOTIwIiwidGFnIjoiIn0%3D; galiciamove_session=eyJpdiI6IlZwcW1qUm9HbWFlQXl3b0l1TUpFN2c9PSIsInZhbHVlIjoiUFJKeEFDOEhnMjkyRCtaWFRsU1hPN1RxVG1nWCtBcU04RjRMOXVxdlUvaHdKY3I1OE5ndkhyTmN6aHNPZjVTV1lwWmhsUnJqT3BvbHhkQU0xOHltWWFPWlJKL2N6K01GWDlwTmN0RkpLeEw3eVduTG9SOGM4RDZLaU1rL1J2NG0iLCJtYWMiOiI1ZDU2MjU0MThjOTBkNzk4ZmY3Mjg2NWFkYTEwOWJmZDJjM2I1MGUyMjA4MjUwYWE2ZGM0NjkzZGM5N2UxMzNiIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Fri, 26 Apr 2024 17:24:20 GMT
content-type: image/png
content-length: 7383
server: 
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
x-permitted-cross-domain-policies: all
feature-policy: fullscreen 'none'; microphone 'none'; geolocation 'self'; camera 'self'
last-modified: Tue, 30 Jun 2020 15:32:57 GMT
etag: "1cd7-5a94ee3ca4554"
accept-ranges: bytes
content-security-policy: upgrade-insecure-requests;media-src 'self' data:; default-src 'self' https://*.fls.doubleclick.net https://script.hotjar.com https://vars.hotjar.com;font-src 'self' https://script.hotjar.com fonts.gstatic.com;style-src 'unsafe-inline' 'self' fonts.googleapis.com;script-src 'unsafe-inline' 'unsafe-eval' 'self' https://api.zoomauth.com https://www.googleadservices.com https://*.twitter.com https://static.ads-twitter.com https://maps.googleapis.com https://script.hotjar.com https://static.hotjar.com https://www.facebook.com/ https://www.facebook.net/ https://connect.facebook.net https://connect.facebook.com https://www.googletagmanager.com https://www.google-analytics.com;img-src 'self' data: https://t.co https://googleads.g.doubleclick.net https://googletagmanager.com https://*.gstatic.com https://*.googleapis.com https://*.google.com.ar https://*.google.com https://www.facebook.com https://www.google-analytics.com www.google-analytics.com https://stats.g.doubleclick.net https://*.facebook.net https://www.googletagmanager.com https://script.hotjar.com ;connect-src 'self' https://galiciamove-tmp-uploads.s3.amazonaws.com https://api.zoomauth.com https://*.hotjar.com https://*.hotjar.io wss://*.hotjar.com https://www.google-analytics.com www.google-analytics.com https://stats.g.doubleclick.net, frame-ancestors 'self';
X-Firefox-Spdy: h2

region1.analytics.google.com/g/collect?v=2&tid=G-FX0Z8DW3TM&gtm=45je44o0v9122498733za200&_p=1714152258948&_gaz=1&gcd=13l3l3l2l1&npa=1&dma_cps=sypham&dma=1&cid=969319524.1714152259&ul=en-us&sr=1280x1024&pscdl=noapi&_eu=AAAI&_s=1&sid=1714152259&sct=1&seg=0&dl=https%3A%2F%2Fwww.galiciacgu.com.ar%2Fcgu&dt=Galicia&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=1640

216.239.34.36

204 No Content

0 B

URL GET HTTP/2
region1.analytics.google.com/g/collect?v=2&tid=G-FX0Z8DW3TM&gtm=45je44o0v9122498733za200&_p=1714152258948&_gaz=1&gcd=13l3l3l2l1&npa=1&dma_cps=sypham&dma=1&cid=969319524.1714152259&ul=en-us&sr=1280x1024&pscdl=noapi&_eu=AAAI&_s=1&sid=1714152259&sct=1&seg=0&dl=https%3A%2F%2Fwww.galiciacgu.com.ar%2Fcgu&dt=Galicia&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=1640
IP
216.239.34.36:443
ASN
#15169 GOOGLE

Requested by
https://www.galiciacgu.com.ar/cgu
Certificate
IssuerGoogle Trust Services LLC
Subject*.google-analytics.com
FingerprintFC:B1:16:E0:D8:F3:2B:F3:AB:33:E5:E1:23:57:F4:48:66:FD:4D:52
ValidityMon, 08 Apr 2024 06:34:55 GMT - Mon, 01 Jul 2024 06:34:54 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /g/collect?v=2&tid=G-FX0Z8DW3TM&gtm=45je44o0v9122498733za200&_p=1714152258948&_gaz=1&gcd=13l3l3l2l1&npa=1&dma_cps=sypham&dma=1&cid=969319524.1714152259&ul=en-us&sr=1280x1024&pscdl=noapi&_eu=AAAI&_s=1&sid=1714152259&sct=1&seg=0&dl=https%3A%2F%2Fwww.galiciacgu.com.ar%2Fcgu&dt=Galicia&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=1640 HTTP/1.1
Host: region1.analytics.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.galiciacgu.com.ar/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 204 No Content
access-control-allow-origin: *
date: Fri, 26 Apr 2024 17:24:22 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: text/plain
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

www.galiciacgu.com.ar/css/landing/ajax-loader.gif

54.84.203.208

404 Not Found

4.6 kB

URL GET HTTP/2
www.galiciacgu.com.ar/css/landing/ajax-loader.gif
IP
54.84.203.208:443
ASN
#14618 AMAZON-AES

Requested by
https://www.galiciacgu.com.ar/cgu
Certificate
IssuerAmazon
Subjectwww.galiciacgu.com.ar
Fingerprint8E:38:4E:A4:4F:87:B7:53:E6:11:1B:D9:A1:DE:61:D9:D9:ED:A0:C3
ValidityThu, 12 Oct 2023 00:00:00 GMT - Sat, 09 Nov 2024 23:59:59 GMT

File type
data
Size
4.6 kB (4645 bytes)
Hash
c9a1bfffe798a80dbda06317fbb706a2
205dfec7e53e0aaf0f44f3dfce66983d4a7f16ee
da7bdb821cf472c69002b00a614a2db1ba0066dfd18d6a03d41aab0395020b4e

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Banco Galicia
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /css/landing/ajax-loader.gif HTTP/1.1
Host: www.galiciacgu.com.ar
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.galiciacgu.com.ar/css/landing/landing-galicia.css
Cookie: XSRF-TOKEN=eyJpdiI6IkpaL0VoMzRoUFAxUkhxejNVcjJRdUE9PSIsInZhbHVlIjoiYVZaU2RmNWppR0VmY1MvTlEzNlcvZUlhc2N5TWYyc0U2eVl2YUoxTGd2L3FndGxzY2J2YTErQjQ5MkMzSGtYSmJQcjI0ZGtHYmdkbzh4MjVqN2FPRHVsOEhpY003ODZhRDBKRGxnai9CNnlTSk9LeCtNSGMzMjF6VUtFR0JwYnIiLCJtYWMiOiI5MGNhMmY2MjY1NDQwNWIzYWQ1MzQ1MmMxZjEwMGE1MTIzNGQ0Y2ViODkwYjgwZjFiY2EyZjIxOTgyNjliOTIwIiwidGFnIjoiIn0%3D; galiciamove_session=eyJpdiI6IlZwcW1qUm9HbWFlQXl3b0l1TUpFN2c9PSIsInZhbHVlIjoiUFJKeEFDOEhnMjkyRCtaWFRsU1hPN1RxVG1nWCtBcU04RjRMOXVxdlUvaHdKY3I1OE5ndkhyTmN6aHNPZjVTV1lwWmhsUnJqT3BvbHhkQU0xOHltWWFPWlJKL2N6K01GWDlwTmN0RkpLeEw3eVduTG9SOGM4RDZLaU1rL1J2NG0iLCJtYWMiOiI1ZDU2MjU0MThjOTBkNzk4ZmY3Mjg2NWFkYTEwOWJmZDJjM2I1MGUyMjA4MjUwYWE2ZGM0NjkzZGM5N2UxMzNiIiwidGFnIjoiIn0%3D; _gcl_au=1.1.1160193326.1714152259; _ga_FX0Z8DW3TM=GS1.1.1714152259.1.0.1714152259.60.0.0; _ga=GA1.1.969319524.1714152259
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 404 Not Found
date: Fri, 26 Apr 2024 17:24:22 GMT
content-type: text/html; charset=UTF-8
server: 
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
x-permitted-cross-domain-policies: all
feature-policy: fullscreen 'none'; microphone 'none'; geolocation 'self'; camera 'self'
cache-control: no-cache, private
content-security-policy: upgrade-insecure-requests;media-src 'self' data:; default-src 'self' https://*.fls.doubleclick.net https://script.hotjar.com https://vars.hotjar.com;font-src 'self' https://script.hotjar.com fonts.gstatic.com;style-src 'unsafe-inline' 'self' fonts.googleapis.com;script-src 'unsafe-inline' 'unsafe-eval' 'self' https://api.zoomauth.com https://www.googleadservices.com https://*.twitter.com https://static.ads-twitter.com https://maps.googleapis.com https://script.hotjar.com https://static.hotjar.com https://www.facebook.com/ https://www.facebook.net/ https://connect.facebook.net https://connect.facebook.com https://www.googletagmanager.com https://www.google-analytics.com;img-src 'self' data: https://t.co https://googleads.g.doubleclick.net https://googletagmanager.com https://*.gstatic.com https://*.googleapis.com https://*.google.com.ar https://*.google.com https://www.facebook.com https://www.google-analytics.com www.google-analytics.com https://stats.g.doubleclick.net https://*.facebook.net https://www.googletagmanager.com https://script.hotjar.com ;connect-src 'self' https://galiciamove-tmp-uploads.s3.amazonaws.com https://api.zoomauth.com https://*.hotjar.com https://*.hotjar.io wss://*.hotjar.com https://www.google-analytics.com www.google-analytics.com https://stats.g.doubleclick.net, frame-ancestors 'self';
X-Firefox-Spdy: h2

fonts.googleapis.com/css?family=Inter:Regular

142.250.74.106

200 OK

2.4 kB

URL GET HTTP/2
fonts.googleapis.com/css?family=Inter:Regular
IP
142.250.74.106:443
ASN
#15169 GOOGLE

Requested by
https://www.galiciacgu.com.ar/cgu
Certificate
IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
Fingerprint5F:6D:48:87:16:89:1E:A5:57:29:92:8B:34:BD:F2:92:0C:7F:F2:50
ValidityMon, 08 Apr 2024 07:32:03 GMT - Mon, 01 Jul 2024 07:32:02 GMT

File type
ASCII text, with very long lines (2436), with no line terminators
Size
2.4 kB (2380 bytes)
Hash
65362f802af56b92e51b2874e0d2c139
c6232bdf3efea218a2a404695044ae0cd735fec0
130efe18bbe5d7c483d0439f41f5906ed13765837c8f41777ef79bad13be42c4

HTTP Headers

GET /css?family=Inter:Regular HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.galiciacgu.com.ar/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Fri, 26 Apr 2024 17:24:18 GMT
date: Fri, 26 Apr 2024 17:24:18 GMT
cache-control: private, max-age=86400
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

fonts.googleapis.com/css2?family=Inter&display=swap

142.250.74.106

200 OK

2.5 kB

URL GET HTTP/2
fonts.googleapis.com/css2?family=Inter&display=swap
IP
142.250.74.106:443
ASN
#15169 GOOGLE

Requested by
https://www.galiciacgu.com.ar/cgu
Certificate
IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
Fingerprint5F:6D:48:87:16:89:1E:A5:57:29:92:8B:34:BD:F2:92:0C:7F:F2:50
ValidityMon, 08 Apr 2024 07:32:03 GMT - Mon, 01 Jul 2024 07:32:02 GMT

File type
ASCII text, with very long lines (2597), with no line terminators
Size
2.5 kB (2534 bytes)
Hash
ac63b64ec7437b1c3d021cd9bc74409a
a4ed901cfda1a43f675d2e91e45b213033db8f7f
97ef63fd7e749e589c410943a72dce0b87d04223b3cf7196809b9edae28f16c6

HTTP Headers

GET /css2?family=Inter&display=swap HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.galiciacgu.com.ar/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Fri, 26 Apr 2024 17:24:18 GMT
date: Fri, 26 Apr 2024 17:24:18 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

www.galiciacgu.com.ar/landing/images/arrow-left.svg

54.84.203.208

200 OK

454 B

URL GET HTTP/2
www.galiciacgu.com.ar/landing/images/arrow-left.svg
IP
54.84.203.208:443
ASN
#14618 AMAZON-AES

Requested by
https://www.galiciacgu.com.ar/cgu
Certificate
IssuerAmazon
Subjectwww.galiciacgu.com.ar
Fingerprint8E:38:4E:A4:4F:87:B7:53:E6:11:1B:D9:A1:DE:61:D9:D9:ED:A0:C3
ValidityThu, 12 Oct 2023 00:00:00 GMT - Sat, 09 Nov 2024 23:59:59 GMT

File type
SVG Scalable Vector Graphics image
Size
454 B (454 bytes)
Hash
5a28cb365a071eeea16816846cebf9cf
4c51bf274e247a5541dc436773ac756f4665ec26
47718b9dfbf6f96770b8d96dc41b104568402fbd24ae27246804c1d2aea2fe26

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Banco Galicia
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /landing/images/arrow-left.svg HTTP/1.1
Host: www.galiciacgu.com.ar
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.galiciacgu.com.ar/css/landing/landing-galicia.css
Cookie: XSRF-TOKEN=eyJpdiI6IkpaL0VoMzRoUFAxUkhxejNVcjJRdUE9PSIsInZhbHVlIjoiYVZaU2RmNWppR0VmY1MvTlEzNlcvZUlhc2N5TWYyc0U2eVl2YUoxTGd2L3FndGxzY2J2YTErQjQ5MkMzSGtYSmJQcjI0ZGtHYmdkbzh4MjVqN2FPRHVsOEhpY003ODZhRDBKRGxnai9CNnlTSk9LeCtNSGMzMjF6VUtFR0JwYnIiLCJtYWMiOiI5MGNhMmY2MjY1NDQwNWIzYWQ1MzQ1MmMxZjEwMGE1MTIzNGQ0Y2ViODkwYjgwZjFiY2EyZjIxOTgyNjliOTIwIiwidGFnIjoiIn0%3D; galiciamove_session=eyJpdiI6IlZwcW1qUm9HbWFlQXl3b0l1TUpFN2c9PSIsInZhbHVlIjoiUFJKeEFDOEhnMjkyRCtaWFRsU1hPN1RxVG1nWCtBcU04RjRMOXVxdlUvaHdKY3I1OE5ndkhyTmN6aHNPZjVTV1lwWmhsUnJqT3BvbHhkQU0xOHltWWFPWlJKL2N6K01GWDlwTmN0RkpLeEw3eVduTG9SOGM4RDZLaU1rL1J2NG0iLCJtYWMiOiI1ZDU2MjU0MThjOTBkNzk4ZmY3Mjg2NWFkYTEwOWJmZDJjM2I1MGUyMjA4MjUwYWE2ZGM0NjkzZGM5N2UxMzNiIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 26 Apr 2024 17:24:19 GMT
content-type: image/svg+xml
content-length: 454
server: 
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
x-permitted-cross-domain-policies: all
feature-policy: fullscreen 'none'; microphone 'none'; geolocation 'self'; camera 'self'
last-modified: Fri, 06 May 2022 18:50:21 GMT
etag: "1c6-5de5c549b55af"
accept-ranges: bytes
content-security-policy: upgrade-insecure-requests;media-src 'self' data:; default-src 'self' https://*.fls.doubleclick.net https://script.hotjar.com https://vars.hotjar.com;font-src 'self' https://script.hotjar.com fonts.gstatic.com;style-src 'unsafe-inline' 'self' fonts.googleapis.com;script-src 'unsafe-inline' 'unsafe-eval' 'self' https://api.zoomauth.com https://www.googleadservices.com https://*.twitter.com https://static.ads-twitter.com https://maps.googleapis.com https://script.hotjar.com https://static.hotjar.com https://www.facebook.com/ https://www.facebook.net/ https://connect.facebook.net https://connect.facebook.com https://www.googletagmanager.com https://www.google-analytics.com;img-src 'self' data: https://t.co https://googleads.g.doubleclick.net https://googletagmanager.com https://*.gstatic.com https://*.googleapis.com https://*.google.com.ar https://*.google.com https://www.facebook.com https://www.google-analytics.com www.google-analytics.com https://stats.g.doubleclick.net https://*.facebook.net https://www.googletagmanager.com https://script.hotjar.com ;connect-src 'self' https://galiciamove-tmp-uploads.s3.amazonaws.com https://api.zoomauth.com https://*.hotjar.com https://*.hotjar.io wss://*.hotjar.com https://www.google-analytics.com www.google-analytics.com https://stats.g.doubleclick.net, frame-ancestors 'self';
X-Firefox-Spdy: h2

www.galiciacgu.com.ar/js/landing/landing.js

54.84.203.208

200 OK

250 kB

URL GET HTTP/2
www.galiciacgu.com.ar/js/landing/landing.js
IP
54.84.203.208:443
ASN
#14618 AMAZON-AES

Requested by
https://www.galiciacgu.com.ar/cgu
Certificate
IssuerAmazon
Subjectwww.galiciacgu.com.ar
Fingerprint8E:38:4E:A4:4F:87:B7:53:E6:11:1B:D9:A1:DE:61:D9:D9:ED:A0:C3
ValidityThu, 12 Oct 2023 00:00:00 GMT - Sat, 09 Nov 2024 23:59:59 GMT

File type

Size
250 kB (249874 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Banco Galicia
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /js/landing/landing.js HTTP/1.1
Host: www.galiciacgu.com.ar
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.galiciacgu.com.ar/cgu
Cookie: XSRF-TOKEN=eyJpdiI6IkpaL0VoMzRoUFAxUkhxejNVcjJRdUE9PSIsInZhbHVlIjoiYVZaU2RmNWppR0VmY1MvTlEzNlcvZUlhc2N5TWYyc0U2eVl2YUoxTGd2L3FndGxzY2J2YTErQjQ5MkMzSGtYSmJQcjI0ZGtHYmdkbzh4MjVqN2FPRHVsOEhpY003ODZhRDBKRGxnai9CNnlTSk9LeCtNSGMzMjF6VUtFR0JwYnIiLCJtYWMiOiI5MGNhMmY2MjY1NDQwNWIzYWQ1MzQ1MmMxZjEwMGE1MTIzNGQ0Y2ViODkwYjgwZjFiY2EyZjIxOTgyNjliOTIwIiwidGFnIjoiIn0%3D; galiciamove_session=eyJpdiI6IlZwcW1qUm9HbWFlQXl3b0l1TUpFN2c9PSIsInZhbHVlIjoiUFJKeEFDOEhnMjkyRCtaWFRsU1hPN1RxVG1nWCtBcU04RjRMOXVxdlUvaHdKY3I1OE5ndkhyTmN6aHNPZjVTV1lwWmhsUnJqT3BvbHhkQU0xOHltWWFPWlJKL2N6K01GWDlwTmN0RkpLeEw3eVduTG9SOGM4RDZLaU1rL1J2NG0iLCJtYWMiOiI1ZDU2MjU0MThjOTBkNzk4ZmY3Mjg2NWFkYTEwOWJmZDJjM2I1MGUyMjA4MjUwYWE2ZGM0NjkzZGM5N2UxMzNiIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 26 Apr 2024 17:24:21 GMT
content-type: text/javascript
server: 
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
x-permitted-cross-domain-policies: all
feature-policy: fullscreen 'none'; microphone 'none'; geolocation 'self'; camera 'self'
last-modified: Mon, 04 Mar 2024 13:46:15 GMT
etag: "3d012-612d5f30f1d1f-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-security-policy: upgrade-insecure-requests;media-src 'self' data:; default-src 'self' https://*.fls.doubleclick.net https://script.hotjar.com https://vars.hotjar.com;font-src 'self' https://script.hotjar.com fonts.gstatic.com;style-src 'unsafe-inline' 'self' fonts.googleapis.com;script-src 'unsafe-inline' 'unsafe-eval' 'self' https://api.zoomauth.com https://www.googleadservices.com https://*.twitter.com https://static.ads-twitter.com https://maps.googleapis.com https://script.hotjar.com https://static.hotjar.com https://www.facebook.com/ https://www.facebook.net/ https://connect.facebook.net https://connect.facebook.com https://www.googletagmanager.com https://www.google-analytics.com;img-src 'self' data: https://t.co https://googleads.g.doubleclick.net https://googletagmanager.com https://*.gstatic.com https://*.googleapis.com https://*.google.com.ar https://*.google.com https://www.facebook.com https://www.google-analytics.com www.google-analytics.com https://stats.g.doubleclick.net https://*.facebook.net https://www.googletagmanager.com https://script.hotjar.com ;connect-src 'self' https://galiciamove-tmp-uploads.s3.amazonaws.com https://api.zoomauth.com https://*.hotjar.com https://*.hotjar.io wss://*.hotjar.com https://www.google-analytics.com www.google-analytics.com https://stats.g.doubleclick.net, frame-ancestors 'self';
X-Firefox-Spdy: h2

fonts.googleapis.com/css?family=Quicksand:500

142.250.74.106

200 OK

1.2 kB

URL GET HTTP/2
fonts.googleapis.com/css?family=Quicksand:500
IP
142.250.74.106:443
ASN
#15169 GOOGLE

Requested by
https://www.galiciacgu.com.ar/cgu
Certificate
IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
Fingerprint5F:6D:48:87:16:89:1E:A5:57:29:92:8B:34:BD:F2:92:0C:7F:F2:50
ValidityMon, 08 Apr 2024 07:32:03 GMT - Mon, 01 Jul 2024 07:32:02 GMT

File type
ASCII text, with very long lines (1204), with no line terminators
Size
1.2 kB (1180 bytes)
Hash
6b0415056b0650f599655a3d1087a478
20d581987558e6b5f8e69442b650a2bf1ee4eeac
de1a8d21706e7bd57df47ae357f786db0db87896a25186e13bba8615482cb34b

HTTP Headers

GET /css?family=Quicksand:500 HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.galiciacgu.com.ar/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Fri, 26 Apr 2024 17:24:18 GMT
date: Fri, 26 Apr 2024 17:24:18 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

www.galiciacgu.com.ar/images/galicia/favicon.png

54.84.203.208

200 OK

1.6 kB

URL GET HTTP/2
www.galiciacgu.com.ar/images/galicia/favicon.png
IP
54.84.203.208:443
ASN
#14618 AMAZON-AES

Requested by
https://www.galiciacgu.com.ar/cgu
Certificate
IssuerAmazon
Subjectwww.galiciacgu.com.ar
Fingerprint8E:38:4E:A4:4F:87:B7:53:E6:11:1B:D9:A1:DE:61:D9:D9:ED:A0:C3
ValidityThu, 12 Oct 2023 00:00:00 GMT - Sat, 09 Nov 2024 23:59:59 GMT

File type
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Size
1.6 kB (1559 bytes)
Hash
b700b544f2fa87e37e6b728fef00fcb0
c0735fa743392c2f3032c22d241854b88832cdb7
f20a33fd40173f122bec15a105374059fb3ec612d51146485ed84ef0001f2f03

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Banco Galicia
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /images/galicia/favicon.png HTTP/1.1
Host: www.galiciacgu.com.ar
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.galiciacgu.com.ar/cgu
Cookie: XSRF-TOKEN=eyJpdiI6IkpaL0VoMzRoUFAxUkhxejNVcjJRdUE9PSIsInZhbHVlIjoiYVZaU2RmNWppR0VmY1MvTlEzNlcvZUlhc2N5TWYyc0U2eVl2YUoxTGd2L3FndGxzY2J2YTErQjQ5MkMzSGtYSmJQcjI0ZGtHYmdkbzh4MjVqN2FPRHVsOEhpY003ODZhRDBKRGxnai9CNnlTSk9LeCtNSGMzMjF6VUtFR0JwYnIiLCJtYWMiOiI5MGNhMmY2MjY1NDQwNWIzYWQ1MzQ1MmMxZjEwMGE1MTIzNGQ0Y2ViODkwYjgwZjFiY2EyZjIxOTgyNjliOTIwIiwidGFnIjoiIn0%3D; galiciamove_session=eyJpdiI6IlZwcW1qUm9HbWFlQXl3b0l1TUpFN2c9PSIsInZhbHVlIjoiUFJKeEFDOEhnMjkyRCtaWFRsU1hPN1RxVG1nWCtBcU04RjRMOXVxdlUvaHdKY3I1OE5ndkhyTmN6aHNPZjVTV1lwWmhsUnJqT3BvbHhkQU0xOHltWWFPWlJKL2N6K01GWDlwTmN0RkpLeEw3eVduTG9SOGM4RDZLaU1rL1J2NG0iLCJtYWMiOiI1ZDU2MjU0MThjOTBkNzk4ZmY3Mjg2NWFkYTEwOWJmZDJjM2I1MGUyMjA4MjUwYWE2ZGM0NjkzZGM5N2UxMzNiIiwidGFnIjoiIn0%3D; _gcl_au=1.1.1160193326.1714152259; _ga_FX0Z8DW3TM=GS1.1.1714152259.1.0.1714152259.60.0.0; _ga=GA1.1.969319524.1714152259
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 26 Apr 2024 17:24:22 GMT
content-type: image/png
content-length: 1559
server: 
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
x-permitted-cross-domain-policies: all
feature-policy: fullscreen 'none'; microphone 'none'; geolocation 'self'; camera 'self'
last-modified: Fri, 06 May 2022 18:50:21 GMT
etag: "617-5de5c549b26cf"
accept-ranges: bytes
content-security-policy: upgrade-insecure-requests;media-src 'self' data:; default-src 'self' https://*.fls.doubleclick.net https://script.hotjar.com https://vars.hotjar.com;font-src 'self' https://script.hotjar.com fonts.gstatic.com;style-src 'unsafe-inline' 'self' fonts.googleapis.com;script-src 'unsafe-inline' 'unsafe-eval' 'self' https://api.zoomauth.com https://www.googleadservices.com https://*.twitter.com https://static.ads-twitter.com https://maps.googleapis.com https://script.hotjar.com https://static.hotjar.com https://www.facebook.com/ https://www.facebook.net/ https://connect.facebook.net https://connect.facebook.com https://www.googletagmanager.com https://www.google-analytics.com;img-src 'self' data: https://t.co https://googleads.g.doubleclick.net https://googletagmanager.com https://*.gstatic.com https://*.googleapis.com https://*.google.com.ar https://*.google.com https://www.facebook.com https://www.google-analytics.com www.google-analytics.com https://stats.g.doubleclick.net https://*.facebook.net https://www.googletagmanager.com https://script.hotjar.com ;connect-src 'self' https://galiciamove-tmp-uploads.s3.amazonaws.com https://api.zoomauth.com https://*.hotjar.com https://*.hotjar.io wss://*.hotjar.com https://www.google-analytics.com www.google-analytics.com https://stats.g.doubleclick.net, frame-ancestors 'self';
X-Firefox-Spdy: h2

www.galiciacgu.com.ar/landing/images/hace-todo-online.png

54.84.203.208

200 OK

474 B

URL GET HTTP/2
www.galiciacgu.com.ar/landing/images/hace-todo-online.png
IP
54.84.203.208:443
ASN
#14618 AMAZON-AES

Requested by
https://www.galiciacgu.com.ar/cgu
Certificate
IssuerAmazon
Subjectwww.galiciacgu.com.ar
Fingerprint8E:38:4E:A4:4F:87:B7:53:E6:11:1B:D9:A1:DE:61:D9:D9:ED:A0:C3
ValidityThu, 12 Oct 2023 00:00:00 GMT - Sat, 09 Nov 2024 23:59:59 GMT

File type
PNG image data, 42 x 42, 8-bit/color RGBA, non-interlaced
Size
474 B (474 bytes)
Hash
a3209b555015855444e13c19f0e4e451
833e060b06b85e84845132d4c1a3e9bd23639858
901b8df1c8efd9646a2ece1ff7157c27646e2ce9530d4f1f879530872f78b0e1

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Banco Galicia
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /landing/images/hace-todo-online.png HTTP/1.1
Host: www.galiciacgu.com.ar
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.galiciacgu.com.ar/cgu
Cookie: XSRF-TOKEN=eyJpdiI6IkpaL0VoMzRoUFAxUkhxejNVcjJRdUE9PSIsInZhbHVlIjoiYVZaU2RmNWppR0VmY1MvTlEzNlcvZUlhc2N5TWYyc0U2eVl2YUoxTGd2L3FndGxzY2J2YTErQjQ5MkMzSGtYSmJQcjI0ZGtHYmdkbzh4MjVqN2FPRHVsOEhpY003ODZhRDBKRGxnai9CNnlTSk9LeCtNSGMzMjF6VUtFR0JwYnIiLCJtYWMiOiI5MGNhMmY2MjY1NDQwNWIzYWQ1MzQ1MmMxZjEwMGE1MTIzNGQ0Y2ViODkwYjgwZjFiY2EyZjIxOTgyNjliOTIwIiwidGFnIjoiIn0%3D; galiciamove_session=eyJpdiI6IlZwcW1qUm9HbWFlQXl3b0l1TUpFN2c9PSIsInZhbHVlIjoiUFJKeEFDOEhnMjkyRCtaWFRsU1hPN1RxVG1nWCtBcU04RjRMOXVxdlUvaHdKY3I1OE5ndkhyTmN6aHNPZjVTV1lwWmhsUnJqT3BvbHhkQU0xOHltWWFPWlJKL2N6K01GWDlwTmN0RkpLeEw3eVduTG9SOGM4RDZLaU1rL1J2NG0iLCJtYWMiOiI1ZDU2MjU0MThjOTBkNzk4ZmY3Mjg2NWFkYTEwOWJmZDJjM2I1MGUyMjA4MjUwYWE2ZGM0NjkzZGM5N2UxMzNiIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 26 Apr 2024 17:24:18 GMT
content-type: image/png
content-length: 474
server: 
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
x-permitted-cross-domain-policies: all
feature-policy: fullscreen 'none'; microphone 'none'; geolocation 'self'; camera 'self'
last-modified: Mon, 20 Apr 2020 15:07:08 GMT
etag: "1da-5a3ba40b60ac5"
accept-ranges: bytes
content-security-policy: upgrade-insecure-requests;media-src 'self' data:; default-src 'self' https://*.fls.doubleclick.net https://script.hotjar.com https://vars.hotjar.com;font-src 'self' https://script.hotjar.com fonts.gstatic.com;style-src 'unsafe-inline' 'self' fonts.googleapis.com;script-src 'unsafe-inline' 'unsafe-eval' 'self' https://api.zoomauth.com https://www.googleadservices.com https://*.twitter.com https://static.ads-twitter.com https://maps.googleapis.com https://script.hotjar.com https://static.hotjar.com https://www.facebook.com/ https://www.facebook.net/ https://connect.facebook.net https://connect.facebook.com https://www.googletagmanager.com https://www.google-analytics.com;img-src 'self' data: https://t.co https://googleads.g.doubleclick.net https://googletagmanager.com https://*.gstatic.com https://*.googleapis.com https://*.google.com.ar https://*.google.com https://www.facebook.com https://www.google-analytics.com www.google-analytics.com https://stats.g.doubleclick.net https://*.facebook.net https://www.googletagmanager.com https://script.hotjar.com ;connect-src 'self' https://galiciamove-tmp-uploads.s3.amazonaws.com https://api.zoomauth.com https://*.hotjar.com https://*.hotjar.io wss://*.hotjar.com https://www.google-analytics.com www.google-analytics.com https://stats.g.doubleclick.net, frame-ancestors 'self';
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (22)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML