injeteck.com.br Open in urlscan Pro
108.167.168.86 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://injeteck.com.br/wellsvfargo/usersreactivation/accountofficerandmanagement/socket/lines/index2.php
Submission: On October 26 via api (October 26th 2017, 10:45:56 pm UTC) from CA

Summary HTTP 14 Redirects Links 14 Behaviour Indicators

Summary

This website contacted 5 IPs in 2 countries across 4 domains to perform 14 HTTP transactions. The main IP is 108.167.168.86, located in Houston, United States and belongs to CYRUSONE - CyrusOne LLC, US. The main domain is injeteck.com.br.

This is the only time injeteck.com.br was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Wells Fargo (Banking)

Domain & IP information

	IP Address	AS Autonomous System
2	108.167.168.86 108.167.168.86	20013 (CYRUSONE) (CYRUSONE - CyrusOne LLC)
10	159.45.2.156 159.45.2.156	10837 (WELLSFARG...) (WELLSFARGO-10837 - Wells Fargo & Company)
1 2	2a00:1450:400... 2a00:1450:4001:816::200e	15169 (GOOGLE) (GOOGLE - Google Inc.)
1	2a00:1450:400... 2a00:1450:400c:c04::9d	15169 (GOOGLE) (GOOGLE - Google Inc.)
14	5

2 108.167.168.86 (Houston, United States)

ASN20013 (CYRUSONE - CyrusOne LLC, US)

injeteck.com.br	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 159.45.2.156 (New York, United States)

ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US)

connect.secure.wellsfargo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:816::200e (Ireland) 1 redirects

ASN15169 (GOOGLE - Google Inc., US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c04::9d (Ireland)

ASN15169 (GOOGLE - Google Inc., US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	wellsfargo.com connect.secure.wellsfargo.com	116 KB
2	google-analytics.com 1 redirects www.google-analytics.com	16 KB
2	injeteck.com.br injeteck.com.br	4 KB
1	doubleclick.net stats.g.doubleclick.net	53 B
14	4

	Domain	Requested by
10	connect.secure.wellsfargo.com	injeteck.com.br connect.secure.wellsfargo.com
2	www.google-analytics.com	1 redirects injeteck.com.br
2	injeteck.com.br	injeteck.com.br
1	stats.g.doubleclick.net	injeteck.com.br
14	4

This site contains links to these domains. Also see Links.

Domain
www.wellsfargo.com

Subject Issuer	Validity	Valid
connect.secure.wellsfargo.com Symantec Class 3 Secure Server CA - G4	`2016-10-13` - `2018-10-13`	2 years	crt.sh
*.google-analytics.com Google Internet Authority G3	`2017-10-17` - `2018-01-09`	3 months	crt.sh
*.g.doubleclick.net Google Internet Authority G3	`2017-10-17` - `2018-01-09`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://injeteck.com.br/wellsvfargo/usersreactivation/accountofficerandmanagement/socket/lines/index2.php
Frame ID: 8252.1
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|(analytics))\.js/i

Page Statistics

14
Requests

86 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

5
IPs

2
Countries

136 kB
Transfer

355 kB
Size

5
Cookies

14 Outgoing links

These are links going to different origins than the main page.

URL: https://www.wellsfargo.com/
Title:

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/locator/
Title:

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/help/
Title: Customer Service

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/products_services/applications_viewall.jhtml
Title: Apply

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/help/faqs/enroll
Title: Online Banking Enrollment

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/privacy-security/guarantee
Title: Online Security Guarantee

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/privacy-security/
Title: Privacy, Security and Legal

Search URL Search Domain Scan URL

URL: http://www.wellsfargo.com/agreement
Title: Online Access Agreement

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/help/faqs/privacy-security/
Title: Security Questions Overview

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/about/
Title: About Wells Fargo

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/careers/
Title: Careers

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/privacy-security/fraud/report/phish
Title: Report Email Fraud

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/sitemap
Title: Sitemap

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/privacy-security/privacy/online#adchoices
Title: Ad Choices

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 8

http://www.google-analytics.com/ga.js HTTP 307
https://www.google-analytics.com/ga.js

Request Chain 14

http://www.google-analytics.com/r/__utm.gif?utmwv=5.7.0&utms=1&utmn=2044053742&utmhn=injeteck.com.br&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Wells%20Fargo%C2%A0Sign%20On%20to%20View%20Your%20Accounts&utmhid=989670853&utmr=-&utmp=%2Fwellsvfargo%2Fusersreactivation%2Faccountofficerandmanagement%2Fsocket%2Flines%2Findex2.php&utmht=1509057946280&utmac=UA-84156312-1&utmcc=__utma%3D107320666.1331599684.1509057946.1509057946.1509057946.1%3B%2B__utmz%3D107320666.1509057946.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=787719831&utmredir=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~ HTTP 307
https://www.google-analytics.com/r/__utm.gif?utmwv=5.7.0&utms=1&utmn=2044053742&utmhn=injeteck.com.br&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Wells%20Fargo%C2%A0Sign%20On%20to%20View%20Your%20Accounts&utmhid=989670853&utmr=-&utmp=%2Fwellsvfargo%2Fusersreactivation%2Faccountofficerandmanagement%2Fsocket%2Flines%2Findex2.php&utmht=1509057946280&utmac=UA-84156312-1&utmcc=__utma%3D107320666.1331599684.1509057946.1509057946.1509057946.1%3B%2B__utmz%3D107320666.1509057946.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=787719831&utmredir=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~ HTTP 302
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-84156312-1&cid=1331599684.1509057946&jid=787719831&_v=5.7.0&z=2044053742

14 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request index2.php Show response
injeteck.com.br/wellsvfargo/usersreactivation/accountofficerandmanagement/socket/lines/ 11 KB
4 KB 321ms
204ms Document
text/html 108.167.168.86
CyrusOne LLC

General

Check archive.org

Show headers Download Go to

Full URL: http://injeteck.com.br/wellsvfargo/usersreactivation/accountofficerandmanagement/socket/lines/index2.php
Protocol: HTTP/1.1
Server: 108.167.168.86 Houston, United States, ASN20013 (CYRUSONE - CyrusOne LLC, US),
Reverse DNS
Software: nginx/1.12.2 /
Resource Hash: 2336b0d676c6d8a65da4983f4da000128c11d897714ee57d4bba70e80a55bc94

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: injeteck.com.br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/62.0.3202.62 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Cache-Control: no-cache
Connection: keep-alive
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/62.0.3202.62 Safari/537.36

Response headers

Date: Thu, 26 Oct 2017 22:45:45 GMT
Content-Encoding: gzip
Server: nginx/1.12.2
Connection: keep-alive
Transfer-Encoding: chunked
Content-Type: text/html

GET
H/1.1 200
OK signon_clean.min.css
connect.secure.wellsfargo.com/auth/static/wfa/css/ 7 KB
2 KB 638ms
128ms Stylesheet
text/css 159.45.2.156
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.secure.wellsfargo.com/auth/static/wfa/css/signon_clean.min.css?v=F0C8CBAA07

Requested by

Host: injeteck.com.br
URL: http://injeteck.com.br/wellsvfargo/usersreactivation/accountofficerandmanagement/socket/lines/index2.php

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_256_CBC

Server

159.45.2.156 New York, United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/1.1 /

Resource Hash

2371d8b4605182fe88a2b4d762abda7cbb8bc23675ef4e9261a786bb1d8a06a4

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: connect.secure.wellsfargo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/62.0.3202.62 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://injeteck.com.br/wellsvfargo/usersreactivation/accountofficerandmanagement/socket/lines/index2.php
Connection: keep-alive
Cache-Control: no-cache
Referer: http://injeteck.com.br/wellsvfargo/usersreactivation/accountofficerandmanagement/socket/lines/index2.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/62.0.3202.62 Safari/537.36

Response headers

Date: Thu, 26 Oct 2017 22:45:45 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Last-modified: Thu, 17 Aug 2017 19:15:21 GMT
Server: KONICHIWA/1.1
Etag: W/"1db3-5995eb49"
X-frame-options: SAMEORIGIN
Content-type: text/css
Connection: Keep-Alive
Content-length: 2185

GET
H/1.1 200
OK login-userprefs.min.js Show response
connect.secure.wellsfargo.com/auth/static/prefs/ 144 KB
32 KB 655ms
145ms Script
application/x-javascript 159.45.2.156
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.secure.wellsfargo.com/auth/static/prefs/login-userprefs.min.js

Requested by

Host: injeteck.com.br
URL: http://injeteck.com.br/wellsvfargo/usersreactivation/accountofficerandmanagement/socket/lines/index2.php

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_256_CBC

Server

159.45.2.156 New York, United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/1.1 /

Resource Hash

627da6a4a21d690f6e9573e1e8917ef797787b80cfc61c044191bf727bba14ed

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: connect.secure.wellsfargo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/62.0.3202.62 Safari/537.36
Accept: */*
Referer: http://injeteck.com.br/wellsvfargo/usersreactivation/accountofficerandmanagement/socket/lines/index2.php
Connection: keep-alive
Cache-Control: no-cache
Referer: http://injeteck.com.br/wellsvfargo/usersreactivation/accountofficerandmanagement/socket/lines/index2.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/62.0.3202.62 Safari/537.36

Response headers

Date: Thu, 26 Oct 2017 22:45:45 GMT
Content-Encoding: gzip
Last-modified: Thu, 17 Aug 2017 19:15:20 GMT
Server: KONICHIWA/1.1
X-frame-options: SAMEORIGIN
Etag: W/"e4a-5995eb48"
Vary: Accept-Encoding
Content-Type: application/x-javascript; charset=UTF-8
Cache-control: max-age=1800
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Thu, 26 Oct 2017 23:15:45 GMT

GET
H/1.1 200
OK google_analytics_auto.js Show response
injeteck.com.br/ 430 B
306 B 129ms
123ms Script
application/javascript 108.167.168.86
CyrusOne LLC

General

Check archive.org

Show headers Download Go to

Full URL: http://injeteck.com.br/google_analytics_auto.js
Requested by: Host: injeteck.com.br
URL: http://injeteck.com.br/wellsvfargo/usersreactivation/accountofficerandmanagement/socket/lines/index2.php
Protocol: HTTP/1.1
Server: 108.167.168.86 Houston, United States, ASN20013 (CYRUSONE - CyrusOne LLC, US),
Reverse DNS
Software: nginx/1.12.2 /
Resource Hash: 8b7cafedb16608f4fc31cafd8ed3c7e6c97c0a0e530540dbbc266fc5f3db57d5

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: injeteck.com.br
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/62.0.3202.62 Safari/537.36
Accept: */*
Referer: http://injeteck.com.br/wellsvfargo/usersreactivation/accountofficerandmanagement/socket/lines/index2.php
Connection: keep-alive
Cache-Control: no-cache
Referer: http://injeteck.com.br/wellsvfargo/usersreactivation/accountofficerandmanagement/socket/lines/index2.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/62.0.3202.62 Safari/537.36

Response headers

Date: Thu, 26 Oct 2017 22:45:45 GMT
Content-Encoding: gzip
Last-Modified: Tue, 13 Sep 2016 21:48:10 GMT
Server: nginx/1.12.2
Connection: keep-alive
Transfer-Encoding: chunked
Content-Type: application/javascript

GET
H/1.1 200
OK jquery.js Show response
connect.secure.wellsfargo.com/auth/static/scripts/ 99 KB
39 KB 659ms
141ms Script
application/x-javascript 159.45.2.156
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.secure.wellsfargo.com/auth/static/scripts/jquery.js?v=F0C8CBAA07

Requested by

Host: injeteck.com.br
URL: http://injeteck.com.br/wellsvfargo/usersreactivation/accountofficerandmanagement/socket/lines/index2.php

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_256_CBC

Server

159.45.2.156 New York, United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/1.1 /

Resource Hash

0c646ba9e7fd0c3be4aa6992a032d438940c22373d15c3e386cbbb6a6f1d7002

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: connect.secure.wellsfargo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/62.0.3202.62 Safari/537.36
Accept: */*
Referer: http://injeteck.com.br/wellsvfargo/usersreactivation/accountofficerandmanagement/socket/lines/index2.php
Connection: keep-alive
Cache-Control: no-cache
Referer: http://injeteck.com.br/wellsvfargo/usersreactivation/accountofficerandmanagement/socket/lines/index2.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/62.0.3202.62 Safari/537.36

Response headers

Date: Thu, 26 Oct 2017 22:45:45 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Last-modified: Thu, 17 Aug 2017 19:15:20 GMT
Server: KONICHIWA/1.1
Etag: W/"18c2e-5995eb48"
X-frame-options: SAMEORIGIN
Content-type: application/x-javascript
Connection: Keep-Alive
Content-length: 39785

GET
H/1.1 200
OK popover.js Show response
connect.secure.wellsfargo.com/auth/static/scripts/ 769 B
769 B 656ms
138ms Script
application/x-javascript 159.45.2.156
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.secure.wellsfargo.com/auth/static/scripts/popover.js?v=F0C8CBAA07

Requested by

Host: injeteck.com.br
URL: http://injeteck.com.br/wellsvfargo/usersreactivation/accountofficerandmanagement/socket/lines/index2.php

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_256_CBC

Server

159.45.2.156 New York, United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/1.1 /

Resource Hash

57e7fe6c51b03564f8b28e2c9cc0b9bd88ab7e73245fd4d4723dfc2fbdf60b0a

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: connect.secure.wellsfargo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/62.0.3202.62 Safari/537.36
Accept: */*
Referer: http://injeteck.com.br/wellsvfargo/usersreactivation/accountofficerandmanagement/socket/lines/index2.php
Connection: keep-alive
Cache-Control: no-cache
Referer: http://injeteck.com.br/wellsvfargo/usersreactivation/accountofficerandmanagement/socket/lines/index2.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/62.0.3202.62 Safari/537.36

Response headers

Date: Thu, 26 Oct 2017 22:45:45 GMT
Last-modified: Thu, 17 Aug 2017 19:15:20 GMT
Server: KONICHIWA/1.1
Etag: W/"301-5995eb48"
Content-length: 769
X-frame-options: SAMEORIGIN
Content-type: application/x-javascript

GET
H/1.1 200
OK conutils-6.2.2.js Show response
connect.secure.wellsfargo.com/auth/static/scripts/ 10 KB
4 KB 129ms
129ms Script
application/x-javascript 159.45.2.156
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.secure.wellsfargo.com/auth/static/scripts/conutils-6.2.2.js

Requested by

Host: connect.secure.wellsfargo.com
URL: https://connect.secure.wellsfargo.com/auth/static/prefs/login-userprefs.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_256_CBC

Server

159.45.2.156 New York, United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/1.1 /

Resource Hash

198506f95f9c0cf3a670f82ea63f9a560bd6ff9a17c153ad4ac5d8777e0fda21

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: connect.secure.wellsfargo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/62.0.3202.62 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"
Accept: */*
Referer: http://injeteck.com.br/wellsvfargo/usersreactivation/accountofficerandmanagement/socket/lines/index2.php
Connection: keep-alive
Cache-Control: no-cache
Referer: http://injeteck.com.br/wellsvfargo/usersreactivation/accountofficerandmanagement/socket/lines/index2.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/62.0.3202.62 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Date: Thu, 26 Oct 2017 22:45:46 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Last-modified: Thu, 17 Aug 2017 19:15:20 GMT
Server: KONICHIWA/1.1
Etag: W/"26dc-5995eb48"
X-frame-options: SAMEORIGIN
Content-type: application/x-javascript
Connection: Keep-Alive
Content-length: 4109

GET
H/1.1 200
OK atadun.js Show response
connect.secure.wellsfargo.com/auth/static/prefs/ 1 KB
543 B 133ms
133ms Script
application/x-javascript 159.45.2.156
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.secure.wellsfargo.com/auth/static/prefs/atadun.js

Requested by

Host: connect.secure.wellsfargo.com
URL: https://connect.secure.wellsfargo.com/auth/static/prefs/login-userprefs.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_256_CBC

Server

159.45.2.156 New York, United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/1.1 /

Resource Hash

5fb7b85658a6e615400e0f1f3e16fc869bbd099b3c3c181c294c05d1d7d1cfe5

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: connect.secure.wellsfargo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/62.0.3202.62 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"
Accept: */*
Referer: http://injeteck.com.br/wellsvfargo/usersreactivation/accountofficerandmanagement/socket/lines/index2.php
Connection: keep-alive
Cache-Control: no-cache
Referer: http://injeteck.com.br/wellsvfargo/usersreactivation/accountofficerandmanagement/socket/lines/index2.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/62.0.3202.62 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Date: Thu, 26 Oct 2017 22:45:46 GMT
Content-Encoding: gzip
Last-modified: Thu, 17 Aug 2017 19:15:20 GMT
Server: KONICHIWA/1.1
X-frame-options: SAMEORIGIN
Etag: W/"42b-5995eb48"
Vary: Accept-Encoding
Content-type: application/x-javascript
Cache-control: max-age=1800
Connection: Keep-Alive
Content-length: 543
Expires: Thu, 26 Oct 2017 23:15:46 GMT

GET
H/1.1 200
OK nd Show response
connect.secure.wellsfargo.com/jenny/ 37 KB
37 KB 135ms
135ms Script
application/javascript 159.45.2.156
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.secure.wellsfargo.com/jenny/nd

Requested by

Host: connect.secure.wellsfargo.com
URL: https://connect.secure.wellsfargo.com/auth/static/prefs/atadun.js

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_256_CBC

Server

159.45.2.156 New York, United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/1.1 /

Resource Hash

87b7bcd8b2dfceb8082cd591a031a697d94cf0a4431592184a5a3f838d5bb979

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: connect.secure.wellsfargo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/62.0.3202.62 Safari/537.36
Accept: */*
Referer: http://injeteck.com.br/wellsvfargo/usersreactivation/accountofficerandmanagement/socket/lines/index2.php
Connection: keep-alive
Cache-Control: no-cache
Referer: http://injeteck.com.br/wellsvfargo/usersreactivation/accountofficerandmanagement/socket/lines/index2.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/62.0.3202.62 Safari/537.36

Response headers

Date: Thu, 26 Oct 2017 22:45:46 GMT
Content-type: application/javascript;charset=ISO-8859-1
Server: KONICHIWA/1.1
X-frame-options: SAMEORIGIN
X-xss-protection: 1; mode=block
Transfer-encoding: chunked
X-ua-compatible: IE=edge

GET
H2

200

ga.js Show response
www.google-analytics.com/
Redirect Chain

http://www.google-analytics.com/ga.js
https://www.google-analytics.com/ga.js

44 KB
16 KB

6ms
5ms

Script
text/javascript

2a00:1450:4001:816::200e
Google Inc.

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/ga.js

Requested by

Host: injeteck.com.br
URL: http://injeteck.com.br/wellsvfargo/usersreactivation/accountofficerandmanagement/socket/lines/index2.php

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:816::200e , Ireland, ASN15169 (GOOGLE - Google Inc., US),

Reverse DNS

Software

Golfe2 /

Resource Hash

c8e3699362d1d2ffc0c97b36e93b1e793034ca7b98896ca2260c2c1dcd973d59

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

:path: /ga.js
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/62.0.3202.62 Safari/537.36
accept: */*
cache-control: no-cache
:authority: www.google-analytics.com
referer: http://injeteck.com.br/wellsvfargo/usersreactivation/accountofficerandmanagement/socket/lines/index2.php
:scheme: https
:method: GET
Referer: http://injeteck.com.br/wellsvfargo/usersreactivation/accountofficerandmanagement/socket/lines/index2.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/62.0.3202.62 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 28 Sep 2017 22:31:34 GMT
server: Golfe2
age: 6350
date: Thu, 26 Oct 2017 20:59:56 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 16615
expires: Thu, 26 Oct 2017 22:59:56 GMT

Redirect headers

Location: https://www.google-analytics.com/ga.js
Non-Authoritative-Reason: HSTS

GET
DATA 200
OK truncated
/ 37 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Response headers

Access-Control-Allow-Origin: *
Content-Type: image/gif

GET
DATA 200
OK truncated
/ 616 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ebf4a535fa6a88962621940e780ca0cd6707b6cdaed59f469f0aeada311d09d1

Request headers

Response headers

Access-Control-Allow-Origin: *
Content-Type: image/gif

GET
H/1.1 200
OK new_search_corner.gif
connect.secure.wellsfargo.com/auth/static/wfa/css/images/ 49 B
49 B 128ms
128ms Image
image/gif 159.45.2.156
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://connect.secure.wellsfargo.com/auth/static/wfa/css/images/new_search_corner.gif

Requested by

Host: injeteck.com.br
URL: http://injeteck.com.br/wellsvfargo/usersreactivation/accountofficerandmanagement/socket/lines/index2.php

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_256_CBC

Server

159.45.2.156 New York, United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/1.1 /

Resource Hash

1e776523ad4b7aabbafe543437026068fa33850abd9fdc8c482c22b9357f5ba2

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: connect.secure.wellsfargo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/62.0.3202.62 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: https://connect.secure.wellsfargo.com/auth/static/wfa/css/signon_clean.min.css?v=F0C8CBAA07
Connection: keep-alive
Cache-Control: no-cache
Referer: https://connect.secure.wellsfargo.com/auth/static/wfa/css/signon_clean.min.css?v=F0C8CBAA07
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/62.0.3202.62 Safari/537.36

Response headers

Date: Thu, 26 Oct 2017 22:45:46 GMT
Last-modified: Thu, 17 Aug 2017 19:15:20 GMT
Server: KONICHIWA/1.1
Etag: "31-5995eb48"
X-frame-options: SAMEORIGIN
Content-type: image/gif
Accept-ranges: bytes
Content-length: 49

GET
H/1.1 200
OK btn_blueslice.gif
connect.secure.wellsfargo.com/auth/static/wfa/css/images/ 152 B
152 B 132ms
132ms Image
image/gif 159.45.2.156
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://connect.secure.wellsfargo.com/auth/static/wfa/css/images/btn_blueslice.gif

Requested by

Host: injeteck.com.br
URL: http://injeteck.com.br/wellsvfargo/usersreactivation/accountofficerandmanagement/socket/lines/index2.php

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_256_CBC

Server

159.45.2.156 New York, United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/1.1 /

Resource Hash

dd77bede93256e88a4f6b6b05bca756126011650ce56a2a5e7ea6ecf44941fe2

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: connect.secure.wellsfargo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/62.0.3202.62 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: https://connect.secure.wellsfargo.com/auth/static/wfa/css/signon_clean.min.css?v=F0C8CBAA07
Connection: keep-alive
Cache-Control: no-cache
Referer: https://connect.secure.wellsfargo.com/auth/static/wfa/css/signon_clean.min.css?v=F0C8CBAA07
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/62.0.3202.62 Safari/537.36

Response headers

Date: Thu, 26 Oct 2017 22:45:46 GMT
Last-modified: Thu, 17 Aug 2017 19:15:20 GMT
Server: KONICHIWA/1.1
Etag: "98-5995eb48"
X-frame-options: SAMEORIGIN
Content-type: image/gif
Accept-ranges: bytes
Content-length: 152

GET
H/1.1 200
OK left_nav_dot.gif
connect.secure.wellsfargo.com/auth/static/wfa/css/images/ 43 B
43 B 127ms
127ms Image
image/gif 159.45.2.156
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://connect.secure.wellsfargo.com/auth/static/wfa/css/images/left_nav_dot.gif

Requested by

Host: injeteck.com.br
URL: http://injeteck.com.br/wellsvfargo/usersreactivation/accountofficerandmanagement/socket/lines/index2.php

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_256_CBC

Server

159.45.2.156 New York, United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/1.1 /

Resource Hash

04ebbc8b6a0071e1d78440d674dad23569fd0f33217cfb13c57fe0cf07b14547

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: connect.secure.wellsfargo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/62.0.3202.62 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: https://connect.secure.wellsfargo.com/auth/static/wfa/css/signon_clean.min.css?v=F0C8CBAA07
Connection: keep-alive
Cache-Control: no-cache
Referer: https://connect.secure.wellsfargo.com/auth/static/wfa/css/signon_clean.min.css?v=F0C8CBAA07
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/62.0.3202.62 Safari/537.36

Response headers

Date: Thu, 26 Oct 2017 22:45:46 GMT
Last-modified: Thu, 17 Aug 2017 19:15:20 GMT
Server: KONICHIWA/1.1
Etag: "2b-5995eb48"
X-frame-options: SAMEORIGIN
Content-type: image/gif
Accept-ranges: bytes
Content-length: 43

GET
H2

200

collect
stats.g.doubleclick.net/r/
Redirect Chain

http://www.google-analytics.com/r/__utm.gif?utmwv=5.7.0&utms=1&utmn=2044053742&utmhn=injeteck.com.br&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Wells...
https://www.google-analytics.com/r/__utm.gif?utmwv=5.7.0&utms=1&utmn=2044053742&utmhn=injeteck.com.br&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Well...
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-84156312-1&cid=1331599684.1509057946&jid=787719831&_v=5.7.0&z=2044053742

35 B
53 B

44ms
15ms

Image
image/gif

2a00:1450:400c:c04::9d
Google Inc.

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-84156312-1&cid=1331599684.1509057946&jid=787719831&_v=5.7.0&z=2044053742

Requested by

Host: injeteck.com.br
URL: http://injeteck.com.br/wellsvfargo/usersreactivation/accountofficerandmanagement/socket/lines/index2.php

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:400c:c04::9d , Ireland, ASN15169 (GOOGLE - Google Inc., US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

:path: /r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-84156312-1&cid=1331599684.1509057946&jid=787719831&_v=5.7.0&z=2044053742
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/62.0.3202.62 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: stats.g.doubleclick.net
referer: http://injeteck.com.br/wellsvfargo/usersreactivation/accountofficerandmanagement/socket/lines/index2.php
:scheme: https
:method: GET
Referer: http://injeteck.com.br/wellsvfargo/usersreactivation/accountofficerandmanagement/socket/lines/index2.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/62.0.3202.62 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Thu, 26 Oct 2017 22:45:46 GMT
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 26 Oct 2017 22:45:46 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
status: 302
location: https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-84156312-1&cid=1331599684.1509057946&jid=787719831&_v=5.7.0&z=2044053742
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 370
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Wells Fargo (Banking)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

5 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.injeteck.com.br/	1970-01-18 15:33:45	Name: __utmz Value: 107320666.1509057946.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none)
.injeteck.com.br/	1970-01-01 00:00:00	Name: __utmc Value: 107320666
.injeteck.com.br/	1970-01-18 11:10:59	Name: __utmb Value: 107320666.1.10.1509057946
.injeteck.com.br/	1970-01-19 04:42:09	Name: __utma Value: 107320666.1331599684.1509057946.1509057946.1509057946.1
.injeteck.com.br/	1970-01-18 11:10:58	Name: __utmt Value: 1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

connect.secure.wellsfargo.com
injeteck.com.br
stats.g.doubleclick.net
www.google-analytics.com
108.167.168.86
159.45.2.156
2a00:1450:4001:816::200e
2a00:1450:400c:c04::9d
04ebbc8b6a0071e1d78440d674dad23569fd0f33217cfb13c57fe0cf07b14547
0c646ba9e7fd0c3be4aa6992a032d438940c22373d15c3e386cbbb6a6f1d7002
198506f95f9c0cf3a670f82ea63f9a560bd6ff9a17c153ad4ac5d8777e0fda21
1e776523ad4b7aabbafe543437026068fa33850abd9fdc8c482c22b9357f5ba2
2336b0d676c6d8a65da4983f4da000128c11d897714ee57d4bba70e80a55bc94
2371d8b4605182fe88a2b4d762abda7cbb8bc23675ef4e9261a786bb1d8a06a4
57e7fe6c51b03564f8b28e2c9cc0b9bd88ab7e73245fd4d4723dfc2fbdf60b0a
5fb7b85658a6e615400e0f1f3e16fc869bbd099b3c3c181c294c05d1d7d1cfe5
627da6a4a21d690f6e9573e1e8917ef797787b80cfc61c044191bf727bba14ed
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
87b7bcd8b2dfceb8082cd591a031a697d94cf0a4431592184a5a3f838d5bb979
8b7cafedb16608f4fc31cafd8ed3c7e6c97c0a0e530540dbbc266fc5f3db57d5
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
c8e3699362d1d2ffc0c97b36e93b1e793034ca7b98896ca2260c2c1dcd973d59
dd77bede93256e88a4f6b6b05bca756126011650ce56a2a5e7ea6ecf44941fe2
ebf4a535fa6a88962621940e780ca0cd6707b6cdaed59f469f0aeada311d09d1

injeteck.com.br Open in urlscan Pro 108.167.168.86 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

14 Requests

86 %HTTPS

50 %IPv6

4 Domains

4 Subdomains

5 IPs

2 Countries

136 kBTransfer

355 kBSize

5 Cookies

14 Outgoing links

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

5 Cookies

Indicators

injeteck.com.br Open in urlscan Pro
108.167.168.86 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

86 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

5
IPs

2
Countries

136 kB
Transfer

355 kB
Size

5
Cookies

14 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!