login.secure.confirmation-wfbnk.xyz Open in urlscan Pro
104.131.249.228 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://login.secure.confirmation-wfbnk.xyz/auth/Login.php?sessionid=zvdB1f1M1ppdS2RLYpiHEEfArmNJhFSQa5sbltYnSnAKprwoQO5vtk5UHSEZywPICiUXLSl...
Submission: On July 21 via automatic, source openphish (July 21st 2018, 7:30:36 am UTC)

Summary HTTP 6 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 6 HTTP transactions. The main IP is 104.131.249.228, located in New York, United States and belongs to DIGITALOCEAN-ASN - DigitalOcean, LLC, US. The main domain is login.secure.confirmation-wfbnk.xyz.

This is the only time login.secure.confirmation-wfbnk.xyz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Wells Fargo (Banking) Generic Banking (Banking)

Domain & IP information

	IP Address		AS Autonomous System
2	104.131.249.228 104.131.249.228		14061 (DIGITALOC...) (DIGITALOCEAN-ASN - DigitalOcean)
4	23.45.98.109 23.45.98.109		20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
6	3

2 104.131.249.228 (New York, United States)

ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US)
PTR: server.dmxwebsolutions.com.br

login.secure.confirmation-wfbnk.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 23.45.98.109 (Amsterdam, Netherlands)

ASN20940 (AKAMAI-ASN1, US)
PTR: a23-45-98-109.deploy.static.akamaitechnologies.com

www01.wellsfargomedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	wellsfargomedia.com www01.wellsfargomedia.com	44 KB
2	confirmation-wfbnk.xyz login.secure.confirmation-wfbnk.xyz	18 KB
6	2

	Domain	Requested by
4	www01.wellsfargomedia.com	login.secure.confirmation-wfbnk.xyz
2	login.secure.confirmation-wfbnk.xyz	login.secure.confirmation-wfbnk.xyz
6	2

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://login.secure.confirmation-wfbnk.xyz/auth/Login.php?sessionid=zvdB1f1M1ppdS2RLYpiHEEfArmNJhFSQa5sbltYnSnAKprwoQO5vtk5UHSEZywPICiUXLSlDfVoFnV3dJ9JcuP7bIMbgi1YVjTT4LeI197Gw2KKLUuYoj6A1SLhbMg66a0&securessl=true
Frame ID: 81AB60201B4A68884BD5A9DAA44A5375
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i
headers server /php\/?([\d.]+)?/i

CentOS (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /CentOS/i

OpenSSL (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i

mod_ssl (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /mod_ssl(?:\/([\d.]+))?/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
headers server /mod_ssl(?:\/([\d.]+))?/i

Page Statistics

6
Requests

0 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

62 kB
Transfer

211 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request Login.php Show response
login.secure.confirmation-wfbnk.xyz/auth/ 6 KB
7 KB 173ms
87ms Document
text/html 104.131.249.228
DigitalOcean

General

Check archive.org

Show headers Download Go to

Full URL: http://login.secure.confirmation-wfbnk.xyz/auth/Login.php?sessionid=zvdB1f1M1ppdS2RLYpiHEEfArmNJhFSQa5sbltYnSnAKprwoQO5vtk5UHSEZywPICiUXLSlDfVoFnV3dJ9JcuP7bIMbgi1YVjTT4LeI197Gw2KKLUuYoj6A1SLhbMg66a0&securessl=true
Protocol: HTTP/1.1
Server: 104.131.249.228 New York, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS: server.dmxwebsolutions.com.br
Software: Apache/2.2.15 (CentOS) DAV/2 PHP/5.3.3 mod_ssl/2.2.15 OpenSSL/1.0.1e-fips / PHP/5.3.3
Resource Hash: 93d4947360128aad06e53219a9502fc1220ec137949ee30138d629879f2d0cf5

Request headers

Host: login.secure.confirmation-wfbnk.xyz
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: 81AB60201B4A68884BD5A9DAA44A5375

Response headers

Date: Sat, 21 Jul 2018 07:32:14 GMT
Server: Apache/2.2.15 (CentOS) DAV/2 PHP/5.3.3 mod_ssl/2.2.15 OpenSSL/1.0.1e-fips
X-Powered-By: PHP/5.3.3
Content-Length: 6578
Connection: close
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK framework.css
www01.wellsfargomedia.com/css/mobile/ 123 KB
21 KB 7ms
7ms Stylesheet
text/css 23.45.98.109
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www01.wellsfargomedia.com/css/mobile/framework.css

Requested by

Host: login.secure.confirmation-wfbnk.xyz
URL: http://login.secure.confirmation-wfbnk.xyz/auth/Login.php?sessionid=zvdB1f1M1ppdS2RLYpiHEEfArmNJhFSQa5sbltYnSnAKprwoQO5vtk5UHSEZywPICiUXLSlDfVoFnV3dJ9JcuP7bIMbgi1YVjTT4LeI197Gw2KKLUuYoj6A1SLhbMg66a0&securessl=true

Protocol

HTTP/1.1

Server

23.45.98.109 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a23-45-98-109.deploy.static.akamaitechnologies.com

Software

KONICHIWA/2.0 /

Resource Hash

76e03b9e0190d502eadeb4bcc2f90b36ad5539b24750a5edb17d7b8970b19651

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://login.secure.confirmation-wfbnk.xyz/auth/Login.php?sessionid=zvdB1f1M1ppdS2RLYpiHEEfArmNJhFSQa5sbltYnSnAKprwoQO5vtk5UHSEZywPICiUXLSlDfVoFnV3dJ9JcuP7bIMbgi1YVjTT4LeI197Gw2KKLUuYoj6A1SLhbMg66a0&securessl=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000; includeSubdomains;
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 20570
X-XSS-Protection: 1; mode=block
Last-Modified: Wed, 18 Jul 2018 11:36:45 GMT
Server: KONICHIWA/2.0
Date: Sat, 21 Jul 2018 07:30:26 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
Cache-Control: max-age=1164
ETag: "1ed38-571447a31a600-gzip"
Accept-Ranges: bytes
Expires: Sat, 21 Jul 2018 07:49:50 GMT

GET
H/1.1 200
OK smartphone-home.css
www01.wellsfargomedia.com/css/mobile/ 57 KB
15 KB 7ms
6ms Stylesheet
text/css 23.45.98.109
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www01.wellsfargomedia.com/css/mobile/smartphone-home.css

Requested by

Host: login.secure.confirmation-wfbnk.xyz
URL: http://login.secure.confirmation-wfbnk.xyz/auth/Login.php?sessionid=zvdB1f1M1ppdS2RLYpiHEEfArmNJhFSQa5sbltYnSnAKprwoQO5vtk5UHSEZywPICiUXLSlDfVoFnV3dJ9JcuP7bIMbgi1YVjTT4LeI197Gw2KKLUuYoj6A1SLhbMg66a0&securessl=true

Protocol

HTTP/1.1

Server

23.45.98.109 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a23-45-98-109.deploy.static.akamaitechnologies.com

Software

KONICHIWA/2.0 /

Resource Hash

1801bd7e8b9b750086fac30054f5a242901a4e76e873fa80dcf2efdfc24bd085

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://login.secure.confirmation-wfbnk.xyz/auth/Login.php?sessionid=zvdB1f1M1ppdS2RLYpiHEEfArmNJhFSQa5sbltYnSnAKprwoQO5vtk5UHSEZywPICiUXLSlDfVoFnV3dJ9JcuP7bIMbgi1YVjTT4LeI197Gw2KKLUuYoj6A1SLhbMg66a0&securessl=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000; includeSubdomains;
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 14681
X-XSS-Protection: 1; mode=block
Last-Modified: Wed, 18 Jul 2018 11:36:45 GMT
Server: KONICHIWA/2.0
Date: Sat, 21 Jul 2018 07:30:26 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
Cache-Control: max-age=1511
ETag: "e52c-571447a31c928-gzip"
Accept-Ranges: bytes
Expires: Sat, 21 Jul 2018 07:55:37 GMT

GET
H/1.1 200
OK 50_opacity_stagecoach.png
www01.wellsfargomedia.com/assets/_mobile/images/global/ 7 KB
8 KB 7ms
6ms Image
image/png 23.45.98.109
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www01.wellsfargomedia.com/assets/_mobile/images/global/50_opacity_stagecoach.png

Requested by

Host: login.secure.confirmation-wfbnk.xyz
URL: http://login.secure.confirmation-wfbnk.xyz/auth/Login.php?sessionid=zvdB1f1M1ppdS2RLYpiHEEfArmNJhFSQa5sbltYnSnAKprwoQO5vtk5UHSEZywPICiUXLSlDfVoFnV3dJ9JcuP7bIMbgi1YVjTT4LeI197Gw2KKLUuYoj6A1SLhbMg66a0&securessl=true

Protocol

HTTP/1.1

Server

23.45.98.109 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a23-45-98-109.deploy.static.akamaitechnologies.com

Software

KONICHIWA/2.0 /

Resource Hash

ccbaf49b577d1ce462ae61b5498f6e20a105a9cf799d32914885e6974db80e78

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://login.secure.confirmation-wfbnk.xyz/auth/Login.php?sessionid=zvdB1f1M1ppdS2RLYpiHEEfArmNJhFSQa5sbltYnSnAKprwoQO5vtk5UHSEZywPICiUXLSlDfVoFnV3dJ9JcuP7bIMbgi1YVjTT4LeI197Gw2KKLUuYoj6A1SLhbMg66a0&securessl=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sat, 21 Jul 2018 07:30:26 GMT
Last-Modified: Wed, 27 Jan 2016 00:19:10 GMT
Server: KONICHIWA/2.0
ETag: "1c88-56a80cfe"
X-frame-options: SAMEORIGIN
Content-Type: image/png;charset=UTF-8
Cache-Control: max-age=845
X-ua-compatible: IE=edge
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 7304
X-xss-protection: 1; mode=block
Expires: Sat, 21 Jul 2018 07:44:31 GMT

GET
H/1.1 200
OK hh.jpg
login.secure.confirmation-wfbnk.xyz/auth/assets/img/ 11 KB
11 KB 170ms
85ms Image
image/jpeg 104.131.249.228
DigitalOcean

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://login.secure.confirmation-wfbnk.xyz/auth/assets/img/hh.jpg
Requested by: Host: login.secure.confirmation-wfbnk.xyz
URL: http://login.secure.confirmation-wfbnk.xyz/auth/Login.php?sessionid=zvdB1f1M1ppdS2RLYpiHEEfArmNJhFSQa5sbltYnSnAKprwoQO5vtk5UHSEZywPICiUXLSlDfVoFnV3dJ9JcuP7bIMbgi1YVjTT4LeI197Gw2KKLUuYoj6A1SLhbMg66a0&securessl=true
Protocol: HTTP/1.1
Server: 104.131.249.228 New York, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS: server.dmxwebsolutions.com.br
Software: Apache/2.2.15 (CentOS) DAV/2 PHP/5.3.3 mod_ssl/2.2.15 OpenSSL/1.0.1e-fips /
Resource Hash: b73a9893ac5b85851b7ce7f7e4ab0515b3da747eeb069915ec419b5dc9ebb2d1

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: login.secure.confirmation-wfbnk.xyz
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://login.secure.confirmation-wfbnk.xyz/auth/Login.php?sessionid=zvdB1f1M1ppdS2RLYpiHEEfArmNJhFSQa5sbltYnSnAKprwoQO5vtk5UHSEZywPICiUXLSlDfVoFnV3dJ9JcuP7bIMbgi1YVjTT4LeI197Gw2KKLUuYoj6A1SLhbMg66a0&securessl=true
Connection: keep-alive
Cache-Control: no-cache
Referer: http://login.secure.confirmation-wfbnk.xyz/auth/Login.php?sessionid=zvdB1f1M1ppdS2RLYpiHEEfArmNJhFSQa5sbltYnSnAKprwoQO5vtk5UHSEZywPICiUXLSlDfVoFnV3dJ9JcuP7bIMbgi1YVjTT4LeI197Gw2KKLUuYoj6A1SLhbMg66a0&securessl=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sat, 21 Jul 2018 07:32:14 GMT
Last-Modified: Tue, 02 Jan 2018 18:27:08 GMT
Server: Apache/2.2.15 (CentOS) DAV/2 PHP/5.3.3 mod_ssl/2.2.15 OpenSSL/1.0.1e-fips
ETag: "101233-2bc3-561cf3f14b700"
Content-Type: image/jpeg
Connection: close
Accept-Ranges: bytes
Content-Length: 11203

GET
DATA 200
OK truncated
/ 547 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d6fdc2a50eee49cc342d47bdbfc6d5fd3bdd21df565c6df6f14cd370871f515b

Request headers

Response headers

Access-Control-Allow-Origin: *
Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 758 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9476d2ec1a38d5fab5cb783028444dbb9ebbe9241de0959f167f8e01b4c1f971

Request headers

Response headers

Access-Control-Allow-Origin: *
Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 4 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7a76adde96864e6b1b3f7061240da895c98e1927c0185a2bbd21a20377c1799f

Request headers

Response headers

Access-Control-Allow-Origin: *
Content-Type: image/svg+xml

GET
H/1.1 200
OK icn-nav-arrow-back-mob-28x28-v1_00.svg
www01.wellsfargomedia.com/assets/_mobile/images/global/ 897 B
1 KB 7ms
6ms Image
image/svg+xml 23.45.98.109
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www01.wellsfargomedia.com/assets/_mobile/images/global/icn-nav-arrow-back-mob-28x28-v1_00.svg

Requested by

Host: login.secure.confirmation-wfbnk.xyz
URL: http://login.secure.confirmation-wfbnk.xyz/auth/Login.php?sessionid=zvdB1f1M1ppdS2RLYpiHEEfArmNJhFSQa5sbltYnSnAKprwoQO5vtk5UHSEZywPICiUXLSlDfVoFnV3dJ9JcuP7bIMbgi1YVjTT4LeI197Gw2KKLUuYoj6A1SLhbMg66a0&securessl=true

Protocol

HTTP/1.1

Server

23.45.98.109 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a23-45-98-109.deploy.static.akamaitechnologies.com

Software

KONICHIWA/2.0 /

Resource Hash

d4064f419090460be6eed2641bdfd52e10d557bdfb481c1aac16a089be1df371

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www01.wellsfargomedia.com/css/mobile/smartphone-home.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sat, 21 Jul 2018 07:30:26 GMT
Last-Modified: Wed, 27 Jan 2016 00:19:10 GMT
Server: KONICHIWA/2.0
ETag: "381-56a80cfe"
X-frame-options: SAMEORIGIN
Content-Type: image/svg+xml;charset=UTF-8
Cache-Control: max-age=1800
X-ua-compatible: IE=edge
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 897
X-xss-protection: 1; mode=block
Expires: Sat, 21 Jul 2018 08:00:26 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Wells Fargo (Banking) Generic Banking (Banking)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| IsEmpty

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

login.secure.confirmation-wfbnk.xyz
www01.wellsfargomedia.com
104.131.249.228
23.45.98.109
1801bd7e8b9b750086fac30054f5a242901a4e76e873fa80dcf2efdfc24bd085
76e03b9e0190d502eadeb4bcc2f90b36ad5539b24750a5edb17d7b8970b19651
7a76adde96864e6b1b3f7061240da895c98e1927c0185a2bbd21a20377c1799f
93d4947360128aad06e53219a9502fc1220ec137949ee30138d629879f2d0cf5
9476d2ec1a38d5fab5cb783028444dbb9ebbe9241de0959f167f8e01b4c1f971
b73a9893ac5b85851b7ce7f7e4ab0515b3da747eeb069915ec419b5dc9ebb2d1
ccbaf49b577d1ce462ae61b5498f6e20a105a9cf799d32914885e6974db80e78
d4064f419090460be6eed2641bdfd52e10d557bdfb481c1aac16a089be1df371
d6fdc2a50eee49cc342d47bdbfc6d5fd3bdd21df565c6df6f14cd370871f515b