arkansasnbc.com Open in urlscan Pro
198.27.88.99 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://arkansasnbc.com/fargo/wellsFUD/
Submission: On August 23 via api (August 23rd 2017, 6:17:17 pm UTC) from CA

Summary HTTP 17 Redirects Links 13 Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 17 HTTP transactions. The main IP is 198.27.88.99, located in Newark, United States and belongs to OVH, FR. The main domain is arkansasnbc.com.

This is the only time arkansasnbc.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Wells Fargo (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1	198.27.88.99 198.27.88.99	16276 (OVH) (OVH)
16	2.21.246.147 2.21.246.147	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
17	2

1 198.27.88.99 (Newark, United States)

ASN16276 (OVH, FR)
PTR: super.ownmyserver.com

arkansasnbc.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 2.21.246.147 (Austria)

ASN20940 (AKAMAI-ASN1, US)

a248.e.akamai.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
16	akamai.net a248.e.akamai.net	42 KB
1	arkansasnbc.com arkansasnbc.com	16 KB
17	2

	Domain	Requested by
16	a248.e.akamai.net	arkansasnbc.com
1	arkansasnbc.com
17	2

This site contains links to these domains. Also see Links.

Domain
www.wellsfargo.com
adfarm.mediaplex.com
autofinance.wellsfargo.com
online.wellsfargo.com

Subject Issuer	Validity	Valid
a248.e.akamai.net Symantec Class 3 ECC 256 bit SSL CA - G2	`2017-03-07` - `2018-05-06`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://arkansasnbc.com/fargo/wellsFUD/
Frame ID: 31645.1
Requests: 17 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

17
Requests

94 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

58 kB
Transfer

58 kB
Size

0
Cookies

13 Outgoing links

These are links going to different origins than the main page.

URL: https://www.wellsfargo.com/help/faqs/signon_faqs
Title: Username / Password Help

Search URL Search Domain Scan URL

URL: https://adfarm.mediaplex.com/ad/ck/6878-38920-3408-45
Title: Sign Up Now

Search URL Search Domain Scan URL

URL: https://adfarm.mediaplex.com/ad/ck/6878-36644-3408-19
Title: Take a Tour

Search URL Search Domain Scan URL

URL: https://adfarm.mediaplex.com/ad/ck/6878-37455-3408-4
Title: Rewards

Search URL Search Domain Scan URL

URL: https://adfarm.mediaplex.com/ad/ck/6878-36390-3408-3
Title: Get Rate Alerts

Search URL Search Domain Scan URL

URL: https://adfarm.mediaplex.com/ad/ck/6878-38914-3408-32
Title: Simplify Repayment

Search URL Search Domain Scan URL

URL: https://adfarm.mediaplex.com/ad/ck/6878-45682-3408-2
Title: Commission-Free Trades

Search URL Search Domain Scan URL

URL: https://adfarm.mediaplex.com/ad/ck/6878-45483-3408-0
Title: Protect Your Identity

Search URL Search Domain Scan URL

URL: https://autofinance.wellsfargo.com/paymentCalculatorPage.jsp
Title: Auto Loans

Search URL Search Domain Scan URL

URL: https://adfarm.mediaplex.com/ad/ck/1221-4130-3408-469
Title:

Search URL Search Domain Scan URL

URL: https://adfarm.mediaplex.com/ad/ck/1221-4127-3408-193
Title:

Search URL Search Domain Scan URL

URL: https://adfarm.mediaplex.com/ad/ck/1221-8216-3408-37
Title:

Search URL Search Domain Scan URL

URL: https://online.wellsfargo.com/common/html/wibdisc.html
Title: Online Access Agreement (12/05/2006)

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
arkansasnbc.com/fargo/wellsFUD/ 16 KB
16 KB 1801ms
100ms Document
text/html 198.27.88.99
OVH

General

Check archive.org

Show headers Download Go to

Full URL: http://arkansasnbc.com/fargo/wellsFUD/
Protocol: HTTP/1.1
Server: 198.27.88.99 Newark, United States, ASN16276 (OVH, FR),
Reverse DNS: super.ownmyserver.com
Software: Apache /
Resource Hash: 7a14a00050ed9fb061f1e6dbe85b0d3340eec3efbc766098d47e6163a996b5c1

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date: Wed, 23 Aug 2017 18:17:05 GMT
Last-Modified: Sun, 06 Jul 2014 22:56:40 GMT
Server: Apache
Content-Type: text/html
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 16314

GET
H/1.0 404
Not Found public_common.js
a248.e.akamai.net/7/248/1856/90m/www.wellsfargo.com/javascript/ 0
0 575ms
560ms Script
text/html 2.21.246.147
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://a248.e.akamai.net/7/248/1856/90m/www.wellsfargo.com/javascript/public_common.js

Requested by

Host: arkansasnbc.com
URL: http://arkansasnbc.com/fargo/wellsFUD/

Protocol

HTTP/1.0

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2.21.246.147 , Austria, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

KONICHIWA/2.0 /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://arkansasnbc.com/fargo/wellsFUD/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date: Wed, 23 Aug 2017 18:17:06 GMT
Server: KONICHIWA/2.0
X-frame-options: SAMEORIGIN
Content-Type: text/html;charset=UTF-8
Cache-Control: max-age=0
Connection: keep-alive
Content-Length: 4859
X-xss-protection: 1; mode=block
X-ua-compatible: IE=edge

GET
H/1.0 200
OK home.css
a248.e.akamai.net/7/248/1856/90m/www.wellsfargo.com/ 11 KB
11 KB 558ms
543ms Stylesheet
text/css 2.21.246.147
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://a248.e.akamai.net/7/248/1856/90m/www.wellsfargo.com/home.css

Requested by

Host: arkansasnbc.com
URL: http://arkansasnbc.com/fargo/wellsFUD/

Protocol

HTTP/1.0

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2.21.246.147 , Austria, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

KONICHIWA/2.0 /

Resource Hash

bb80d455ae5f5a619bdb473545a688c63eafea47b98baa76502d619d9bad60e7

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://arkansasnbc.com/fargo/wellsFUD/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date: Wed, 23 Aug 2017 18:17:06 GMT
Last-Modified: Fri, 28 Jul 2017 20:19:42 GMT
Server: KONICHIWA/2.0
ETag: W/"2a53-597b9c5e"
X-frame-options: SAMEORIGIN
Content-Type: text/css; charset=UTF-8
Cache-Control: max-age=0
X-ua-compatible: IE=edge
Connection: keep-alive
Content-Length: 10835
X-xss-protection: 1; mode=block
Expires: Wed, 23 Aug 2017 18:17:06 GMT

GET
H/1.0 200
OK logo_62sq.gif
a248.e.akamai.net/7/248/1856/90m/www.wellsfargo.com/img/hp/ 2 KB
2 KB 154ms
154ms Image
image/gif 2.21.246.147
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://a248.e.akamai.net/7/248/1856/90m/www.wellsfargo.com/img/hp/logo_62sq.gif

Requested by

Host: arkansasnbc.com
URL: http://arkansasnbc.com/fargo/wellsFUD/

Protocol

HTTP/1.0

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2.21.246.147 , Austria, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

KONICHIWA/2.0 /

Resource Hash

1d75c1532073401f90f2c4a3135126be6b2cfcd7d24af3da75e393a3c2269a81

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://arkansasnbc.com/fargo/wellsFUD/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date: Wed, 23 Aug 2017 18:17:06 GMT
Last-Modified: Tue, 27 Oct 2015 05:19:32 GMT
Server: KONICHIWA/2.0
ETag: "720-562f0964"
X-frame-options: SAMEORIGIN
Content-Type: image/gif;charset=UTF-8
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1824
X-xss-protection: 1; mode=block
X-ua-compatible: IE=edge

GET
H/1.0 200
OK btn_search_white.gif
a248.e.akamai.net/7/248/1856/90m/www.wellsfargo.com/img/hp/ 599 B
599 B 146ms
146ms Image
image/gif 2.21.246.147
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://a248.e.akamai.net/7/248/1856/90m/www.wellsfargo.com/img/hp/btn_search_white.gif

Requested by

Host: arkansasnbc.com
URL: http://arkansasnbc.com/fargo/wellsFUD/

Protocol

HTTP/1.0

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2.21.246.147 , Austria, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

KONICHIWA/2.0 /

Resource Hash

46a5f26a8e0b84231217fe8cbb8b81d6f3c43c4a3c45e45c7c28faa3eee30a02

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://arkansasnbc.com/fargo/wellsFUD/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date: Wed, 23 Aug 2017 18:17:06 GMT
Last-Modified: Tue, 27 Oct 2015 05:19:32 GMT
Server: KONICHIWA/2.0
ETag: "257-562f0964"
X-frame-options: SAMEORIGIN
Content-Type: image/gif;charset=UTF-8
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 599
X-xss-protection: 1; mode=block
X-ua-compatible: IE=edge

GET
H/1.0 200
OK btn_go_white.gif
a248.e.akamai.net/7/248/1856/90m/www.wellsfargo.com/img/hp/ 436 B
436 B 452ms
147ms Image
image/gif 2.21.246.147
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://a248.e.akamai.net/7/248/1856/90m/www.wellsfargo.com/img/hp/btn_go_white.gif

Requested by

Host: arkansasnbc.com
URL: http://arkansasnbc.com/fargo/wellsFUD/

Protocol

HTTP/1.0

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2.21.246.147 , Austria, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

KONICHIWA/2.0 /

Resource Hash

1c26f30b87d4500885fad41e67f6dcd952b55cf4be3e727f56a7dd0a01507ab3

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://arkansasnbc.com/fargo/wellsFUD/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date: Wed, 23 Aug 2017 18:17:06 GMT
Last-Modified: Fri, 30 Oct 2015 08:33:47 GMT
Server: KONICHIWA/2.0
ETag: "1b4-56332b6b"
X-frame-options: SAMEORIGIN
Content-Type: image/gif;charset=UTF-8
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 436
X-xss-protection: 1; mode=block
X-ua-compatible: IE=edge

GET
H/1.0 200
OK stagecoach.jpg
a248.e.akamai.net/7/248/1856/90m/www.wellsfargo.com/img/hp/ 8 KB
8 KB 544ms
147ms Image
image/jpeg 2.21.246.147
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://a248.e.akamai.net/7/248/1856/90m/www.wellsfargo.com/img/hp/stagecoach.jpg

Requested by

Host: arkansasnbc.com
URL: http://arkansasnbc.com/fargo/wellsFUD/

Protocol

HTTP/1.0

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2.21.246.147 , Austria, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

KONICHIWA/2.0 /

Resource Hash

04fb1d8cf7a7057bf702801e28815422e87c2a99c55ce5202760b1e6be63672b

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://arkansasnbc.com/fargo/wellsFUD/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date: Wed, 23 Aug 2017 18:17:06 GMT
Last-Modified: Fri, 30 Oct 2015 08:33:49 GMT
Server: KONICHIWA/2.0
ETag: "1eb3-56332b6d"
X-frame-options: SAMEORIGIN
Content-Type: image/jpeg;charset=UTF-8
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 7859
X-xss-protection: 1; mode=block
X-ua-compatible: IE=edge

GET
H/1.0 200
OK btn_go.gif
a248.e.akamai.net/7/248/1856/90m/www.wellsfargo.com/img/hp/ 287 B
287 B 594ms
151ms Image
image/gif 2.21.246.147
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://a248.e.akamai.net/7/248/1856/90m/www.wellsfargo.com/img/hp/btn_go.gif

Requested by

Host: arkansasnbc.com
URL: http://arkansasnbc.com/fargo/wellsFUD/

Protocol

HTTP/1.0

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2.21.246.147 , Austria, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

KONICHIWA/2.0 /

Resource Hash

e691bfd287aae2aed429f44d3ab1a9895fac5d9eebea295a42b6873575790bc2

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://arkansasnbc.com/fargo/wellsFUD/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date: Wed, 23 Aug 2017 18:17:06 GMT
Last-Modified: Fri, 30 Oct 2015 08:33:51 GMT
Server: KONICHIWA/2.0
ETag: "11f-56332b6f"
X-frame-options: SAMEORIGIN
Content-Type: image/gif;charset=UTF-8
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 287
X-xss-protection: 1; mode=block
X-ua-compatible: IE=edge

GET
H/1.0 200
OK olb_MonitorFreev1s_234x84.jpg
a248.e.akamai.net/7/248/1856/90m/www.wellsfargo.com/img/ads/consumer/secondary/234x84/ 5 KB
5 KB 616ms
164ms Image
image/jpeg 2.21.246.147
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://a248.e.akamai.net/7/248/1856/90m/www.wellsfargo.com/img/ads/consumer/secondary/234x84/olb_MonitorFreev1s_234x84.jpg

Requested by

Host: arkansasnbc.com
URL: http://arkansasnbc.com/fargo/wellsFUD/

Protocol

HTTP/1.0

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2.21.246.147 , Austria, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

KONICHIWA/2.0 /

Resource Hash

b0698850affaa2a2ecd6b217755890fa97ffda7a164670e6e430d33cd259ff15

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://arkansasnbc.com/fargo/wellsFUD/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date: Wed, 23 Aug 2017 18:17:06 GMT
Last-Modified: Mon, 02 Nov 2015 19:14:34 GMT
Server: KONICHIWA/2.0
ETag: "13c6-5637b61a"
X-frame-options: SAMEORIGIN
Content-Type: image/jpeg;charset=UTF-8
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 5062
X-xss-protection: 1; mode=block
X-ua-compatible: IE=edge

GET
H/1.0 200
OK ccd_wellsfargovisa0apr_234x84.jpg
a248.e.akamai.net/7/248/1856/90m/www.wellsfargo.com/img/ads/consumer/secondary/234x84/ 5 KB
5 KB 283ms
158ms Image
image/jpeg 2.21.246.147
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://a248.e.akamai.net/7/248/1856/90m/www.wellsfargo.com/img/ads/consumer/secondary/234x84/ccd_wellsfargovisa0apr_234x84.jpg

Requested by

Host: arkansasnbc.com
URL: http://arkansasnbc.com/fargo/wellsFUD/

Protocol

HTTP/1.0

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2.21.246.147 , Austria, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

KONICHIWA/2.0 /

Resource Hash

46ee7a25e9ef747646fc9a511b59fcc3e7abcb97ac0fd4cde49cf36a3f475ec5

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://arkansasnbc.com/fargo/wellsFUD/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date: Wed, 23 Aug 2017 18:17:06 GMT
Last-Modified: Mon, 02 Nov 2015 08:31:44 GMT
Server: KONICHIWA/2.0
ETag: "13ef-56371f70"
X-frame-options: SAMEORIGIN
Content-Type: image/jpeg;charset=UTF-8
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 5103
X-xss-protection: 1; mode=block
X-ua-compatible: IE=edge

GET
H/1.0 200
OK cdd_cdfeature1_234x84.gif
a248.e.akamai.net/7/248/1856/90m/www.wellsfargo.com/img/ads/consumer/secondary/234x84/ 7 KB
7 KB 266ms
150ms Image
image/gif 2.21.246.147
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://a248.e.akamai.net/7/248/1856/90m/www.wellsfargo.com/img/ads/consumer/secondary/234x84/cdd_cdfeature1_234x84.gif

Requested by

Host: arkansasnbc.com
URL: http://arkansasnbc.com/fargo/wellsFUD/

Protocol

HTTP/1.0

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2.21.246.147 , Austria, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

KONICHIWA/2.0 /

Resource Hash

ba7c059780a0b19e9619d30085be6472e1db4a5b3f3870c9d8bf42988c09629b

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://arkansasnbc.com/fargo/wellsFUD/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date: Wed, 23 Aug 2017 18:17:06 GMT
Last-Modified: Mon, 02 Nov 2015 19:14:34 GMT
Server: KONICHIWA/2.0
ETag: "1caa-5637b61a"
X-frame-options: SAMEORIGIN
Content-Type: image/gif;charset=UTF-8
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 7338
X-xss-protection: 1; mode=block
X-ua-compatible: IE=edge

GET
H/1.0 200
OK al_ehl_house_gen.gif
a248.e.akamai.net/7/248/1856/90m/www.wellsfargo.com/img/hp/ 111 B
111 B 421ms
154ms Image
image/gif 2.21.246.147
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://a248.e.akamai.net/7/248/1856/90m/www.wellsfargo.com/img/hp/al_ehl_house_gen.gif

Requested by

Host: arkansasnbc.com
URL: http://arkansasnbc.com/fargo/wellsFUD/

Protocol

HTTP/1.0

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2.21.246.147 , Austria, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

KONICHIWA/2.0 /

Resource Hash

c607565db4706ba321b498fe0d030c5ea56d10db184e40ffcb6092fad8ed6569

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://arkansasnbc.com/fargo/wellsFUD/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date: Wed, 23 Aug 2017 18:17:06 GMT
Last-Modified: Tue, 27 Oct 2015 05:19:32 GMT
Server: KONICHIWA/2.0
ETag: "6f-562f0964"
X-frame-options: SAMEORIGIN
Content-Type: image/gif;charset=UTF-8
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 111
X-xss-protection: 1; mode=block
X-ua-compatible: IE=edge

GET
H/1.0 200
OK sprite.gif
a248.e.akamai.net/7/248/1856/90m/www.wellsfargo.com/img/global/ 1 KB
1 KB 727ms
722ms Image
image/gif 2.21.246.147
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://a248.e.akamai.net/7/248/1856/90m/www.wellsfargo.com/img/global/sprite.gif

Requested by

Host: arkansasnbc.com
URL: http://arkansasnbc.com/fargo/wellsFUD/

Protocol

HTTP/1.0

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2.21.246.147 , Austria, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

KONICHIWA/2.0 /

Resource Hash

d2e307d89698604a3e98e33ba1af49d62f4d079255a8c8f00567842f0ed74cb1

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://a248.e.akamai.net/7/248/1856/90m/www.wellsfargo.com/home.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date: Wed, 23 Aug 2017 18:17:07 GMT
Last-Modified: Tue, 27 Oct 2015 05:16:44 GMT
Server: KONICHIWA/2.0
ETag: "54e-562f08bc"
X-frame-options: SAMEORIGIN
Content-Type: image/gif;charset=UTF-8
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1358
X-xss-protection: 1; mode=block
X-ua-compatible: IE=edge

GET
H/1.0 403
Forbidden btn-icon-search.png
a248.e.akamai.net/7/248/1856/assets/images/css/template/ 322 B
0 11ms
6ms Image
text/html 2.21.246.147
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a248.e.akamai.net/7/248/1856/assets/images/css/template/btn-icon-search.png
Requested by: Host: arkansasnbc.com
URL: http://arkansasnbc.com/fargo/wellsFUD/
Protocol: HTTP/1.0
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.21.246.147 , Austria, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: AkamaiGHost /
Resource Hash: 7880a7a0ffab68826849c491892b851d7f6db7908e7063ec9f42ab682f8bb5d7

Request headers

Referer: https://a248.e.akamai.net/7/248/1856/90m/www.wellsfargo.com/home.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date: Wed, 23 Aug 2017 18:17:06 GMT
Server: AkamaiGHost
Connection: close
Content-Length: 322
Content-Type: text/html
Mime-Version: 1.0
Expires: Wed, 23 Aug 2017 18:17:06 GMT

GET
H/1.0 200
OK tab_bottom.gif
a248.e.akamai.net/7/248/1856/90m/www.wellsfargo.com/img/ 43 B
43 B 562ms
556ms Image
image/gif 2.21.246.147
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://a248.e.akamai.net/7/248/1856/90m/www.wellsfargo.com/img/tab_bottom.gif

Requested by

Host: arkansasnbc.com
URL: http://arkansasnbc.com/fargo/wellsFUD/

Protocol

HTTP/1.0

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2.21.246.147 , Austria, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

KONICHIWA/2.0 /

Resource Hash

94bf27c86dff6f26021e00eeaeff8149de4acdbd60c2b9dd63d0dfb709855a56

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://a248.e.akamai.net/7/248/1856/90m/www.wellsfargo.com/home.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date: Wed, 23 Aug 2017 18:17:06 GMT
Last-Modified: Tue, 27 Oct 2015 05:22:55 GMT
Server: KONICHIWA/2.0
ETag: "2b-562f0a2f"
X-frame-options: SAMEORIGIN
Content-Type: image/gif;charset=UTF-8
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
X-xss-protection: 1; mode=block
X-ua-compatible: IE=edge

GET
H/1.0 200
OK selected_tab.gif
a248.e.akamai.net/7/248/1856/90m/www.wellsfargo.com/img/hp/ 462 B
462 B 388ms
383ms Image
image/gif 2.21.246.147
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://a248.e.akamai.net/7/248/1856/90m/www.wellsfargo.com/img/hp/selected_tab.gif

Requested by

Host: arkansasnbc.com
URL: http://arkansasnbc.com/fargo/wellsFUD/

Protocol

HTTP/1.0

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2.21.246.147 , Austria, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

KONICHIWA/2.0 /

Resource Hash

b73a2e2123b60703b83815724b2c76c7165b7bb8f51dee49f732d35cfcef4dc8

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://a248.e.akamai.net/7/248/1856/90m/www.wellsfargo.com/home.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date: Wed, 23 Aug 2017 18:17:06 GMT
Last-Modified: Tue, 27 Oct 2015 05:19:34 GMT
Server: KONICHIWA/2.0
ETag: "1ce-562f0966"
X-frame-options: SAMEORIGIN
Content-Type: image/gif;charset=UTF-8
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 462
X-xss-protection: 1; mode=block
X-ua-compatible: IE=edge

GET
H/1.0 200
OK unselected_tab.jpg
a248.e.akamai.net/7/248/1856/90m/www.wellsfargo.com/img/hp/ 1 KB
1 KB 575ms
551ms Image
image/jpeg 2.21.246.147
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://a248.e.akamai.net/7/248/1856/90m/www.wellsfargo.com/img/hp/unselected_tab.jpg

Requested by

Host: arkansasnbc.com
URL: http://arkansasnbc.com/fargo/wellsFUD/

Protocol

HTTP/1.0

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2.21.246.147 , Austria, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

KONICHIWA/2.0 /

Resource Hash

d36fa2bc1f382dced31e931e3ccda676ae87c58f2b5a2f27df533106ef8812b9

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://a248.e.akamai.net/7/248/1856/90m/www.wellsfargo.com/home.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date: Wed, 23 Aug 2017 18:17:06 GMT
Last-Modified: Tue, 27 Oct 2015 05:19:34 GMT
Server: KONICHIWA/2.0
ETag: "59e-562f0966"
X-frame-options: SAMEORIGIN
Content-Type: image/jpeg;charset=UTF-8
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1438
X-xss-protection: 1; mode=block
X-ua-compatible: IE=edge

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Wells Fargo (Banking)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a248.e.akamai.net
arkansasnbc.com
198.27.88.99
2.21.246.147
04fb1d8cf7a7057bf702801e28815422e87c2a99c55ce5202760b1e6be63672b
1c26f30b87d4500885fad41e67f6dcd952b55cf4be3e727f56a7dd0a01507ab3
1d75c1532073401f90f2c4a3135126be6b2cfcd7d24af3da75e393a3c2269a81
46a5f26a8e0b84231217fe8cbb8b81d6f3c43c4a3c45e45c7c28faa3eee30a02
46ee7a25e9ef747646fc9a511b59fcc3e7abcb97ac0fd4cde49cf36a3f475ec5
7880a7a0ffab68826849c491892b851d7f6db7908e7063ec9f42ab682f8bb5d7
7a14a00050ed9fb061f1e6dbe85b0d3340eec3efbc766098d47e6163a996b5c1
94bf27c86dff6f26021e00eeaeff8149de4acdbd60c2b9dd63d0dfb709855a56
b0698850affaa2a2ecd6b217755890fa97ffda7a164670e6e430d33cd259ff15
b73a2e2123b60703b83815724b2c76c7165b7bb8f51dee49f732d35cfcef4dc8
ba7c059780a0b19e9619d30085be6472e1db4a5b3f3870c9d8bf42988c09629b
bb80d455ae5f5a619bdb473545a688c63eafea47b98baa76502d619d9bad60e7
c607565db4706ba321b498fe0d030c5ea56d10db184e40ffcb6092fad8ed6569
d2e307d89698604a3e98e33ba1af49d62f4d079255a8c8f00567842f0ed74cb1
d36fa2bc1f382dced31e931e3ccda676ae87c58f2b5a2f27df533106ef8812b9
e691bfd287aae2aed429f44d3ab1a9895fac5d9eebea295a42b6873575790bc2

arkansasnbc.com Open in urlscan Pro 198.27.88.99 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

17 Requests

94 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

58 kBTransfer

58 kBSize

0 Cookies

13 Outgoing links

Redirected requests

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

Indicators

arkansasnbc.com Open in urlscan Pro
198.27.88.99 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

17
Requests

94 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

58 kB
Transfer

58 kB
Size

0
Cookies

17 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!