barkaseries.com Open in urlscan Pro
192.185.144.46 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://barkaseries.com/wellsfargo.verification/login.htm
Submission: On April 04 via automatic, source openphish (April 4th 2017, 6:01:04 am UTC)

Summary HTTP 16 Redirects Links 10 Behaviour Indicators

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 16 HTTP transactions. The main IP is 192.185.144.46, located in Houston, United States and belongs to CYRUSONE - CyrusOne LLC, US. The main domain is barkaseries.com.

This is the only time barkaseries.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Wells Fargo (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1	192.185.144.46 192.185.144.46	20013 (CYRUSONE) (CYRUSONE - CyrusOne LLC)
10	159.45.2.154 159.45.2.154	10837 (WELLSFARG...) (WELLSFARGO-10837 - Wells Fargo & Company)
4	2.20.189.235 2.20.189.235	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	63.215.202.68 63.215.202.68	() ()
16	4

1 192.185.144.46 (Houston, United States)

ASN20013 (CYRUSONE - CyrusOne LLC, US)
PTR: 192-185-144-46.unifiedlayer.com

barkaseries.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 159.45.2.154 (Charlotte, United States)

ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US)
PTR: online.wellsfargo.com

online.wellsfargo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2.20.189.235 (European Union)

ASN20940 (AKAMAI-ASN1, US)

a248.e.akamai.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.215.202.68 (Amsterdam, Netherlands)

ASN- ()
PTR: ad-ams5.mediaplex.com

adfarm.mediaplex.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	wellsfargo.com online.wellsfargo.com	20 KB
4	akamai.net a248.e.akamai.net	919 B
1	mediaplex.com adfarm.mediaplex.com	49 B
1	barkaseries.com barkaseries.com	5 KB
16	4

	Domain	Requested by
10	online.wellsfargo.com	barkaseries.com
4	a248.e.akamai.net	barkaseries.com
1	adfarm.mediaplex.com	barkaseries.com
1	barkaseries.com
16	4

This site contains links to these domains. Also see Links.

Domain
www.wellsfargo.com

Subject Issuer	Validity	Valid
online.wellsfargo.com Symantec Class 3 Secure Server CA - G4	`2016-10-28` - `2018-10-29`	2 years	crt.sh
a248.e.akamai.net Symantec Class 3 ECC 256 bit SSL CA - G2	`2016-07-28` - `2017-07-28`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://barkaseries.com/wellsfargo.verification/login.htm
Frame ID: 23592.1
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

16
Requests

88 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

25 kB
Transfer

92 kB
Size

0
Cookies

10 Outgoing links

These are links going to different origins than the main page.

URL: https://www.wellsfargo.com/

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/auxiliary_access/aa_talkatmloc

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/help/
Title: Customer Service

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/locator/
Title: Locations

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/products_services/applications_viewall.jhtml
Title: Apply

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/about/about
Title: About Wells Fargo

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/careers/
Title: Careers

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/privacy_security/
Title: Privacy, Security & Legal

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/privacy_security/fraud/report/fraud
Title: Report Email Fraud

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/sitemap
Title: Sitemap

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request 14

http://ams-login.dotomi.com/commonid/match?rurl=http%3A%2F%2Fadfarm.mediaplex.com%2Fad%2Fbk%2F994-1668-2054-5%3Fmpu_token%3DAAAFssH-iUtN5wAFCY46AAAAAAA%26COL01STO%3D1%26Unique_ID%3DB-20111017013111...
http://adfarm.mediaplex.com/ad/bk/994-1668-2054-5?mpu_token=AAAFssH-iUtN5wAFCY46AAAAAAA&COL01STO=1&Unique_ID=B-20111017013111521742646&status=0

16 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request login.htm Show response barkaseries.com/wellsfargo.verification/	14 KB 5 KB	237ms 122ms	Document text/html	192.185.144.46 CyrusOne LLC
General Check archive.org Show headers Download Go to Full URL http://barkaseries.com/wellsfargo.verification/login.htm Protocol HTTP/1.1 Server 192.185.144.46 Houston, United States, ASN20013 (CYRUSONE - CyrusOne LLC, US), Reverse DNS 192-185-144-46.unifiedlayer.com Software nginx/1.10.3 / Resource Hash `182d7777ce0d491701d8bb9a1f268f0f181889399c28388391ae535a6a74a280` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host barkaseries.com Accept-Language en-US,en;q=0.8 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Cache-Control no-cache Connection keep-alive Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Tue, 04 Apr 2017 06:00:53 GMT Content-Encoding gzip Last-Modified Wed, 01 Jun 2016 18:43:12 GMT Server nginx/1.10.3 Connection keep-alive Transfer-Encoding chunked Content-Type text/html
GET H/1.1	200 OK	Cookie set publicsite.css online.wellsfargo.com/das/common/styles/	13 KB 3 KB	602ms 126ms	Stylesheet text/css	159.45.2.154 Wells Fargo & Com...
General Check archive.org Show headers Download Go to Full URL https://online.wellsfargo.com/das/common/styles/publicsite.css Requested by Host: barkaseries.com URL: http://barkaseries.com/wellsfargo.verification/login.htm Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_256_CBC Server 159.45.2.154 Charlotte, United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US), Reverse DNS online.wellsfargo.com Software KONICHIWA/2.0 / Resource Hash `1db9b43a51107c2b8ca93ae66149b2e53e0a48b6ec2c8631bdc170155c975b6c` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch, br Host online.wellsfargo.com Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept text/css,/;q=0.1 Referer http://barkaseries.com/wellsfargo.verification/login.htm Connection keep-alive Cache-Control no-cache Referer http://barkaseries.com/wellsfargo.verification/login.htm User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Tue, 04 Apr 2017 06:00:53 GMT Content-encoding gzip Vary accept-encoding Last-modified Mon, 20 Mar 2017 03:24:27 GMT Server KONICHIWA/2.0 Etag W/"327a-58cf4b6b" Transfer-encoding chunked Content-type text/css Set-Cookie ISD_WIB_COOKIE=!y1l5yP8lynlxxC10yTeKMaSxlFERkDd+d5myZASOV7VluHr3GpmFD8DOIdD2Wrhrn4HyJG82RanlvSw=; path=/
GET H/1.1	200 OK	Cookie set wfwiblib.js Show response online.wellsfargo.com/das/common/scripts/	30 KB 7 KB	600ms 123ms	Script application/x-javascript	159.45.2.154 Wells Fargo & Com...
General Check archive.org Show headers Download Go to Full URL https://online.wellsfargo.com/das/common/scripts/wfwiblib.js Requested by Host: barkaseries.com URL: http://barkaseries.com/wellsfargo.verification/login.htm Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_256_CBC Server 159.45.2.154 Charlotte, United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US), Reverse DNS online.wellsfargo.com Software KONICHIWA/2.0 / Resource Hash `6a60586980d51d5c93f661e7eaf9382ec327185fd1cc5a6722a5cd9a79d6db0e` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch, br Host online.wellsfargo.com Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept / Referer http://barkaseries.com/wellsfargo.verification/login.htm Connection keep-alive Cache-Control no-cache Referer http://barkaseries.com/wellsfargo.verification/login.htm User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Tue, 04 Apr 2017 06:00:53 GMT Content-encoding gzip Vary accept-encoding Last-modified Mon, 20 Mar 2017 03:24:31 GMT Server KONICHIWA/2.0 Etag W/"79d5-58cf4b6f" Transfer-encoding chunked Content-type application/x-javascript Set-Cookie ISD_WIB_COOKIE=!GrqzBsS4oMiR6TWUly+cCoZsX3Favj54SYBdg7Wb8PZXXzhUSYKPxruILf8AlWRE9k/DhPkEQfbC02w=; path=/
GET H/1.1	200 OK	logo_62sq.gif a248.e.akamai.net/7/248/3608/bb61162e7a787f/online.wellsfargo.com/das/common/images/	616 B 616 B	28ms 7ms	Image image/gif	2.20.189.235 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://a248.e.akamai.net/7/248/3608/bb61162e7a787f/online.wellsfargo.com/das/common/images/logo_62sq.gif Requested by Host: barkaseries.com URL: http://barkaseries.com/wellsfargo.verification/login.htm Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 2.20.189.235 , European Union, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software KONICHIWA/2.0 / Resource Hash `ebf4a535fa6a88962621940e780ca0cd6707b6cdaed59f469f0aeada311d09d1` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch, br Host a248.e.akamai.net Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://barkaseries.com/wellsfargo.verification/login.htm Connection keep-alive Cache-Control no-cache Referer http://barkaseries.com/wellsfargo.verification/login.htm User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Tue, 04 Apr 2017 06:00:54 GMT Last-Modified Mon, 19 Dec 2016 07:01:09 GMT Server KONICHIWA/2.0 ETag "268-585785b5" Content-Type image/gif Connection keep-alive Accept-Ranges bytes Content-Length 616
GET H/1.1	200 OK	shim.gif a248.e.akamai.net/7/248/3608/1d8352905f2c38/online.wellsfargo.com/das/common/images/	43 B 43 B	28ms 7ms	Image image/gif	2.20.189.235 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://a248.e.akamai.net/7/248/3608/1d8352905f2c38/online.wellsfargo.com/das/common/images/shim.gif Requested by Host: barkaseries.com URL: http://barkaseries.com/wellsfargo.verification/login.htm Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 2.20.189.235 , European Union, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software KONICHIWA/2.0 / Resource Hash `89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch, br Host a248.e.akamai.net Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://barkaseries.com/wellsfargo.verification/login.htm Connection keep-alive Cache-Control no-cache Referer http://barkaseries.com/wellsfargo.verification/login.htm User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Tue, 04 Apr 2017 06:00:54 GMT Last-Modified Sat, 13 Feb 2016 23:12:08 GMT Server KONICHIWA/2.0 ETag "2b-56bfb848" Content-Type image/gif Connection keep-alive Accept-Ranges bytes Content-Length 43
GET H/1.1	404 Not found	jquery-1.4.2.min.js online.wellsfargo.com/common/scripts/	0 0	118ms 118ms	Script text/html	159.45.2.154 Wells Fargo & Com...
General Check archive.org Show headers Download Go to Full URL https://online.wellsfargo.com/common/scripts/jquery-1.4.2.min.js Requested by Host: barkaseries.com URL: http://barkaseries.com/wellsfargo.verification/login.htm Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_256_CBC Server 159.45.2.154 Charlotte, United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US), Reverse DNS online.wellsfargo.com Software KONICHIWA/2.0 / Resource Hash Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch, br Host online.wellsfargo.com Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept / Referer http://barkaseries.com/wellsfargo.verification/login.htm Cookie ISD_WIB_COOKIE=!GrqzBsS4oMiR6TWUly+cCoZsX3Favj54SYBdg7Wb8PZXXzhUSYKPxruILf8AlWRE9k/DhPkEQfbC02w= Connection keep-alive Cache-Control no-cache Referer http://barkaseries.com/wellsfargo.verification/login.htm User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Tue, 04 Apr 2017 06:00:54 GMT Content-encoding gzip Vary accept-encoding Server KONICHIWA/2.0 Transfer-encoding chunked Content-type text/html
GET H/1.1	200 OK	jquery-ui.js Show response online.wellsfargo.com/common/scripts/	32 KB 9 KB	121ms 120ms	Script application/x-javascript	159.45.2.154 Wells Fargo & Com...
General Check archive.org Show headers Download Go to Full URL https://online.wellsfargo.com/common/scripts/jquery-ui.js Requested by Host: barkaseries.com URL: http://barkaseries.com/wellsfargo.verification/login.htm Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_256_CBC Server 159.45.2.154 Charlotte, United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US), Reverse DNS online.wellsfargo.com Software KONICHIWA/2.0 / Resource Hash `a40c9a1e4e2bd4e907fcfc905ac1c73ef453ab82a7e3eeb8bd4546ca5821dbed` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch, br Host online.wellsfargo.com Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept / Referer http://barkaseries.com/wellsfargo.verification/login.htm Cookie ISD_WIB_COOKIE=!y1l5yP8lynlxxC10yTeKMaSxlFERkDd+d5myZASOV7VluHr3GpmFD8DOIdD2Wrhrn4HyJG82RanlvSw= Connection keep-alive Cache-Control no-cache Referer http://barkaseries.com/wellsfargo.verification/login.htm User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Tue, 04 Apr 2017 06:00:54 GMT Content-encoding gzip Vary accept-encoding Last-modified Mon, 20 Mar 2017 03:24:31 GMT Server KONICHIWA/2.0 Etag W/"7f1d-58cf4b6f" Transfer-encoding chunked Content-type application/x-javascript
GET H/1.1	404 Not found	enrollLightbox.js online.wellsfargo.com/common/scripts/	0 0	354ms 117ms	Script text/html	159.45.2.154 Wells Fargo & Com...
General Check archive.org Show headers Download Go to Full URL https://online.wellsfargo.com/common/scripts/enrollLightbox.js?p=2014.03.0.18 Requested by Host: barkaseries.com URL: http://barkaseries.com/wellsfargo.verification/login.htm Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_256_CBC Server 159.45.2.154 Charlotte, United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US), Reverse DNS online.wellsfargo.com Software KONICHIWA/2.0 / Resource Hash Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch, br Host online.wellsfargo.com Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept / Referer http://barkaseries.com/wellsfargo.verification/login.htm Cookie ISD_WIB_COOKIE=!y1l5yP8lynlxxC10yTeKMaSxlFERkDd+d5myZASOV7VluHr3GpmFD8DOIdD2Wrhrn4HyJG82RanlvSw= Connection keep-alive Cache-Control no-cache Referer http://barkaseries.com/wellsfargo.verification/login.htm User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Tue, 04 Apr 2017 06:00:54 GMT Content-encoding gzip Vary accept-encoding Server KONICHIWA/2.0 Transfer-encoding chunked Content-type text/html
GET H/1.1	200 OK	ico_alertInput.gif a248.e.akamai.net/7/248/3608/1f8b6f7a060359/online.wellsfargo.com/das/common/images/	108 B 108 B	142ms 121ms	Image image/gif	2.20.189.235 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://a248.e.akamai.net/7/248/3608/1f8b6f7a060359/online.wellsfargo.com/das/common/images/ico_alertInput.gif Requested by Host: barkaseries.com URL: http://barkaseries.com/wellsfargo.verification/login.htm Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 2.20.189.235 , European Union, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software KONICHIWA/2.0 / Resource Hash `91dda610fed408946cf668d9db82d5159f07f3ed7f4a30c1f73148b77e9617f1` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch, br Host a248.e.akamai.net Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://barkaseries.com/wellsfargo.verification/login.htm Connection keep-alive Cache-Control no-cache Referer http://barkaseries.com/wellsfargo.verification/login.htm User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Tue, 04 Apr 2017 06:00:54 GMT Last-Modified Mon, 19 Dec 2016 07:01:52 GMT Server KONICHIWA/2.0 ETag "6c-585785e0" Content-Type image/gif Connection keep-alive Accept-Ranges bytes Content-Length 108
GET H/1.1	200 OK	close_lb_weak.gif a248.e.akamai.net/7/248/3608/aa8e316279cd89/online.wellsfargo.com/das/common/images/	152 B 152 B	29ms 7ms	Image image/gif	2.20.189.235 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://a248.e.akamai.net/7/248/3608/aa8e316279cd89/online.wellsfargo.com/das/common/images/close_lb_weak.gif Requested by Host: barkaseries.com URL: http://barkaseries.com/wellsfargo.verification/login.htm Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 2.20.189.235 , European Union, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software KONICHIWA/2.0 / Resource Hash `6e1fbacc5af53bf9b483f27525bba242dfdee626dbe4ac25f2ea1af4a130b1ea` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch, br Host a248.e.akamai.net Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://barkaseries.com/wellsfargo.verification/login.htm Connection keep-alive Cache-Control no-cache Referer http://barkaseries.com/wellsfargo.verification/login.htm User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Tue, 04 Apr 2017 06:00:54 GMT Last-Modified Mon, 19 Dec 2016 07:01:06 GMT Server KONICHIWA/2.0 ETag "98-585785b2" Content-Type image/gif Connection keep-alive Accept-Ranges bytes Content-Length 152
GET H/1.1	200 OK	mediaplexROI.js Show response online.wellsfargo.com/common/scripts/	695 B 388 B	355ms 117ms	Script application/x-javascript	159.45.2.154 Wells Fargo & Com...
General Check archive.org Show headers Download Go to Full URL https://online.wellsfargo.com/common/scripts/mediaplexROI.js Requested by Host: barkaseries.com URL: http://barkaseries.com/wellsfargo.verification/login.htm Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_256_CBC Server 159.45.2.154 Charlotte, United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US), Reverse DNS online.wellsfargo.com Software KONICHIWA/2.0 / Resource Hash `ed4df624fab7fcc7f6a125df65b9effd932df3f5c3c0f731947e80bcefae93ce` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch, br Host online.wellsfargo.com Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept / Referer http://barkaseries.com/wellsfargo.verification/login.htm Cookie ISD_WIB_COOKIE=!y1l5yP8lynlxxC10yTeKMaSxlFERkDd+d5myZASOV7VluHr3GpmFD8DOIdD2Wrhrn4HyJG82RanlvSw= Connection keep-alive Cache-Control no-cache Referer http://barkaseries.com/wellsfargo.verification/login.htm User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Tue, 04 Apr 2017 06:00:54 GMT Content-encoding gzip Vary accept-encoding Last-modified Mon, 20 Mar 2017 03:24:31 GMT Server KONICHIWA/2.0 Etag W/"2b7-58cf4b6f" Transfer-encoding chunked Content-type application/x-javascript
GET H/1.1	200 OK	new_search_corner.gif online.wellsfargo.com/das/common/styles/images/	49 B 49 B	469ms 115ms	Image image/gif	159.45.2.154 Wells Fargo & Com...
General Check archive.org Show headers Download Go to Show image Full URL https://online.wellsfargo.com/das/common/styles/images/new_search_corner.gif Requested by Host: barkaseries.com URL: http://barkaseries.com/wellsfargo.verification/login.htm Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_256_CBC Server 159.45.2.154 Charlotte, United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US), Reverse DNS online.wellsfargo.com Software KONICHIWA/2.0 / Resource Hash `1e776523ad4b7aabbafe543437026068fa33850abd9fdc8c482c22b9357f5ba2` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch, br Host online.wellsfargo.com Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* https://online.wellsfargo.com/das/common/styles/publicsite.css Cookie ISD_WIB_COOKIE=!y1l5yP8lynlxxC10yTeKMaSxlFERkDd+d5myZASOV7VluHr3GpmFD8DOIdD2Wrhrn4HyJG82RanlvSw= Connection keep-alive Cache-Control no-cache Referer https://online.wellsfargo.com/das/common/styles/publicsite.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Tue, 04 Apr 2017 06:00:54 GMT Last-modified Mon, 19 Dec 2016 06:59:34 GMT Server KONICHIWA/2.0 Accept-ranges bytes Etag "31-58578556" Content-length 49 Content-type image/gif
GET H/1.1	200 OK	btn_blueslice.gif online.wellsfargo.com/das/common/styles/images/	152 B 152 B	469ms 116ms	Image image/gif	159.45.2.154 Wells Fargo & Com...
General Check archive.org Show headers Download Go to Show image Full URL https://online.wellsfargo.com/das/common/styles/images/btn_blueslice.gif Requested by Host: barkaseries.com URL: http://barkaseries.com/wellsfargo.verification/login.htm Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_256_CBC Server 159.45.2.154 Charlotte, United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US), Reverse DNS online.wellsfargo.com Software KONICHIWA/2.0 / Resource Hash `dd77bede93256e88a4f6b6b05bca756126011650ce56a2a5e7ea6ecf44941fe2` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch, br Host online.wellsfargo.com Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* https://online.wellsfargo.com/das/common/styles/publicsite.css Cookie ISD_WIB_COOKIE=!y1l5yP8lynlxxC10yTeKMaSxlFERkDd+d5myZASOV7VluHr3GpmFD8DOIdD2Wrhrn4HyJG82RanlvSw= Connection keep-alive Cache-Control no-cache Referer https://online.wellsfargo.com/das/common/styles/publicsite.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Tue, 04 Apr 2017 06:00:54 GMT Last-modified Mon, 19 Dec 2016 06:59:33 GMT Server KONICHIWA/2.0 Accept-ranges bytes Etag "98-58578555" Content-length 152 Content-type image/gif
GET H/1.1	200 OK	tab_bottom.gif online.wellsfargo.com/das/common/styles/images/	43 B 43 B	230ms 116ms	Image image/gif	159.45.2.154 Wells Fargo & Com...
General Check archive.org Show headers Download Go to Show image Full URL https://online.wellsfargo.com/das/common/styles/images/tab_bottom.gif Requested by Host: barkaseries.com URL: http://barkaseries.com/wellsfargo.verification/login.htm Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_256_CBC Server 159.45.2.154 Charlotte, United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US), Reverse DNS online.wellsfargo.com Software KONICHIWA/2.0 / Resource Hash `94bf27c86dff6f26021e00eeaeff8149de4acdbd60c2b9dd63d0dfb709855a56` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch, br Host online.wellsfargo.com Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* https://online.wellsfargo.com/das/common/styles/publicsite.css Cookie ISD_WIB_COOKIE=!y1l5yP8lynlxxC10yTeKMaSxlFERkDd+d5myZASOV7VluHr3GpmFD8DOIdD2Wrhrn4HyJG82RanlvSw= Connection keep-alive Cache-Control no-cache Referer https://online.wellsfargo.com/das/common/styles/publicsite.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Tue, 04 Apr 2017 06:00:54 GMT Last-modified Mon, 19 Dec 2016 06:59:41 GMT Server KONICHIWA/2.0 Accept-ranges bytes Etag "2b-5857855d" Content-length 43 Content-type image/gif
GET H/1.1	200 OK	selected_tab.gif online.wellsfargo.com/das/common/styles/images/	462 B 462 B	229ms 120ms	Image image/gif	159.45.2.154 Wells Fargo & Com...
General Check archive.org Show headers Download Go to Show image Full URL https://online.wellsfargo.com/das/common/styles/images/selected_tab.gif Requested by Host: barkaseries.com URL: http://barkaseries.com/wellsfargo.verification/login.htm Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_256_CBC Server 159.45.2.154 Charlotte, United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US), Reverse DNS online.wellsfargo.com Software KONICHIWA/2.0 / Resource Hash `b73a2e2123b60703b83815724b2c76c7165b7bb8f51dee49f732d35cfcef4dc8` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch, br Host online.wellsfargo.com Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* https://online.wellsfargo.com/das/common/styles/publicsite.css Cookie ISD_WIB_COOKIE=!y1l5yP8lynlxxC10yTeKMaSxlFERkDd+d5myZASOV7VluHr3GpmFD8DOIdD2Wrhrn4HyJG82RanlvSw= Connection keep-alive Cache-Control no-cache Referer https://online.wellsfargo.com/das/common/styles/publicsite.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Tue, 04 Apr 2017 06:00:54 GMT Last-modified Mon, 19 Dec 2016 06:59:33 GMT Server KONICHIWA/2.0 Accept-ranges bytes Etag "1ce-58578555" Content-length 462 Content-type image/gif
GET H/1.1	200 OK	Cookie set 994-1668-2054-5 adfarm.mediaplex.com/ad/bk/ Redirect Chain http://ams-login.dotomi.com/commonid/match?rurl=http%3A%2F%2Fadfarm.mediaplex.com%2Fad%2Fbk%2F994-1668-2054-5%3Fmpu_token%3DAAAFssH-iUtN5wAFCY46AAAAAAA%26COL01STO%3D1%26Unique_ID%3DB-20111017013111... http://adfarm.mediaplex.com/ad/bk/994-1668-2054-5?mpu_token=AAAFssH-iUtN5wAFCY46AAAAAAA&COL01STO=1&Unique_ID=B-20111017013111521742646&status=0	49 B 49 B	15ms 14ms	Image image/gif	63.215.202.68
General Check archive.org Show headers Download Go to Show image Full URL http://adfarm.mediaplex.com/ad/bk/994-1668-2054-5?mpu_token=AAAFssH-iUtN5wAFCY46AAAAAAA&COL01STO=1&Unique_ID=B-20111017013111521742646&status=0 Requested by Host: barkaseries.com URL: http://barkaseries.com/wellsfargo.verification/login.htm Protocol HTTP/1.1 Server 63.215.202.68 Amsterdam, Netherlands, ASN (), Reverse DNS ad-ams5.mediaplex.com Software Apache-Coyote/1.1 / Resource Hash `2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host adfarm.mediaplex.com Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://barkaseries.com/wellsfargo.verification/login.htm Cookie cttutcid="" Connection keep-alive Cache-Control no-cache Referer http://barkaseries.com/wellsfargo.verification/login.htm User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Pragma no-cache Date Tue, 04 Apr 2017 06:00:54 GMT Server Apache-Coyote/1.1 P3P policyref="/w3c/p3p.xml", CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV" Content-Type image/gif Cache-Control no-store Set-Cookie cttutcid=""; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ svid=410603815013404135; expires=Thu, 3-May-2018 15:17:32 GMT; path=/; domain=.mediaplex.com; rts=1491285654445; expires=Thu, 3-May-2018 15:17:32 GMT; path=/; domain=.mediaplex.com; Content-Length 49 Expires 0 Redirect headers Location http://adfarm.mediaplex.com/ad/bk/994-1668-2054-5?mpu_token=AAAFssH-iUtN5wAFCY46AAAAAAA&COL01STO=1&Unique_ID=B-20111017013111521742646&status=0 Date Tue, 04 Apr 2017 06:00:54 GMT Connection close Server nginx Set-Cookie DotomiUser=410603815013404135$0$84512314; Expires=Wed, 02 May 2018 06:00:54 GMT; Path=/; Domain=.dotomi.com Content-Length 0 P3P policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Wells Fargo (Banking)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a248.e.akamai.net
adfarm.mediaplex.com
barkaseries.com
online.wellsfargo.com
159.45.2.154
192.185.144.46
2.20.189.235
63.215.202.68
182d7777ce0d491701d8bb9a1f268f0f181889399c28388391ae535a6a74a280
1db9b43a51107c2b8ca93ae66149b2e53e0a48b6ec2c8631bdc170155c975b6c
1e776523ad4b7aabbafe543437026068fa33850abd9fdc8c482c22b9357f5ba2
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef
6a60586980d51d5c93f661e7eaf9382ec327185fd1cc5a6722a5cd9a79d6db0e
6e1fbacc5af53bf9b483f27525bba242dfdee626dbe4ac25f2ea1af4a130b1ea
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
91dda610fed408946cf668d9db82d5159f07f3ed7f4a30c1f73148b77e9617f1
94bf27c86dff6f26021e00eeaeff8149de4acdbd60c2b9dd63d0dfb709855a56
a40c9a1e4e2bd4e907fcfc905ac1c73ef453ab82a7e3eeb8bd4546ca5821dbed
b73a2e2123b60703b83815724b2c76c7165b7bb8f51dee49f732d35cfcef4dc8
dd77bede93256e88a4f6b6b05bca756126011650ce56a2a5e7ea6ecf44941fe2
ebf4a535fa6a88962621940e780ca0cd6707b6cdaed59f469f0aeada311d09d1
ed4df624fab7fcc7f6a125df65b9effd932df3f5c3c0f731947e80bcefae93ce

barkaseries.com Open in urlscan Pro 192.185.144.46 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

16 Requests

88 %HTTPS

0 %IPv6

4 Domains

4 Subdomains

4 IPs

3 Countries

25 kBTransfer

92 kBSize

0 Cookies

10 Outgoing links

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

Indicators

barkaseries.com Open in urlscan Pro
192.185.144.46 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

88 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

25 kB
Transfer

92 kB
Size

0
Cookies

16 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!