aec88.bet Open in urlscan Pro
2606:4700:3034::681b:86e6 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://aec88.bet/wells_f/Wfargo/wells.htm
Submission Tags: @ipnigh
Submission: On April 06 via api (April 6th 2020, 6:14:27 am UTC) from GB

Summary HTTP 15 Redirects Links 14 Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 15 HTTP transactions. The main IP is 2606:4700:3034::681b:86e6, located in United States and belongs to CLOUDFLARENET, US. The main domain is aec88.bet.
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on November 4th 2019. Valid for: a year.

This is the only time aec88.bet was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Wells Fargo (Banking)

Domain & IP information

	IP Address	AS Autonomous System
14	2606:4700:303... 2606:4700:3034::681b:86e6	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	159.45.66.156 159.45.66.156	4196 (WELLSFARG...) (WELLSFARGO-4196)
15	2

14 2606:4700:3034::681b:86e6 (United States)

ASN13335 (CLOUDFLARENET, US)

aec88.bet	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 159.45.66.156 (Charlotte, United States)

ASN4196 (WELLSFARGO-4196, US)

connect.secure.wellsfargo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	aec88.bet aec88.bet	143 KB
1	wellsfargo.com connect.secure.wellsfargo.com	16 KB
15	2

	Domain	Requested by
14	aec88.bet	aec88.bet
1	connect.secure.wellsfargo.com	aec88.bet
15	2

This site contains links to these domains. Also see Links.

Domain
www.wellsfargo.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com CloudFlare Inc ECC CA-2	`2019-11-04` - `2020-10-09`	a year	crt.sh
connect.secure.wellsfargo.com DigiCert Global CA G2	`2019-02-07` - `2021-02-07`	2 years	crt.sh

This page contains 1 frames:

Primary Page: https://aec88.bet/wells_f/Wfargo/wells.htm
Frame ID: 3B98E764931CFC57AFA25814D7EEDED9
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Page Statistics

15
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

159 kB
Transfer

334 kB
Size

0
Cookies

14 Outgoing links

These are links going to different origins than the main page.

URL: https://www.wellsfargo.com/
Title:

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/help/
Title: Customer Service

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/locator/
Title: Locations

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/products_services/applications_viewall.jhtml
Title: Apply

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/commitment
Title: Learn More

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/commitment/faqs/
Title: Frequently asked questions >

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/help/faqs/sign-on
Title: Email Security Help

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/agreement
Title: www.wellsfargo.com/agreement

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/about/
Title: About Wells Fargo

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/careers/
Title: Careers

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/privacy-security/
Title: Privacy, Security & Legal

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/privacy-security/fraud/report/phish
Title: Report Email Fraud

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/sitemap
Title: Sitemap

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/privacy-security/privacy/online#adchoices
Title: Ad Choices

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request wells.htm Show response
aec88.bet/wells_f/Wfargo/ 10 KB
3 KB 575ms
557ms Document
text/html 2606:4700:3034::681b:86e6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://aec88.bet/wells_f/Wfargo/wells.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::681b:86e6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 74d5a8da285ab22328918013fab0c07781b12fa4d7ab05ea5e817874f31dace4

Request headers

:method: GET
:authority: aec88.bet
:scheme: https
:path: /wells_f/Wfargo/wells.htm
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: document
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: document

Response headers

status: 200
date: Mon, 06 Apr 2020 06:14:05 GMT
content-type: text/html
set-cookie: __cfduid=d88f9d84faf1f54774baabc33aa9766b91586153645; expires=Wed, 06-May-20 06:14:05 GMT; path=/; domain=.aec88.bet; HttpOnly; SameSite=Lax
last-modified: Sat, 06 Jul 2019 05:50:08 GMT
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 57f95ddafc99d6dd-FRA
content-encoding: br

GET
H2 200 nd Show response
aec88.bet/wells_f/Wfargo/wells_files/ 39 KB
39 KB 278ms
277ms Script
text/plain 2606:4700:3034::681b:86e6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://aec88.bet/wells_f/Wfargo/wells_files/nd
Requested by: Host: aec88.bet
URL: https://aec88.bet/wells_f/Wfargo/wells.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::681b:86e6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ffc539eb345f9466fecbe7b7ea8d2db0f56ef3857c8b26159d9a230bf9afdb4a

Request headers

Referer: https://aec88.bet/wells_f/Wfargo/wells.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 06 Apr 2020 06:14:06 GMT
cf-cache-status: DYNAMIC
last-modified: Tue, 06 Feb 2018 09:42:16 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
status: 200
accept-ranges: bytes
cf-ray: 57f95dde7cc6d6dd-FRA
content-length: 39657

GET
H2 200 signonCommitment.css
aec88.bet/wells_f/Wfargo/wells_files/ 6 KB
1 KB 612ms
611ms Stylesheet
text/css 2606:4700:3034::681b:86e6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://aec88.bet/wells_f/Wfargo/wells_files/signonCommitment.css
Requested by: Host: aec88.bet
URL: https://aec88.bet/wells_f/Wfargo/wells.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::681b:86e6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7c21a45f9e10b50948faf43421ae13f1a49c75c9e44604c63b9bd1c34075d474

Request headers

Referer: https://aec88.bet/wells_f/Wfargo/wells.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

date: Mon, 06 Apr 2020 06:14:06 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Tue, 06 Feb 2018 09:42:16 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=14400
cf-ray: 57f95dde7cc5d6dd-FRA

GET
H2 200 theme.css
aec88.bet/wells_f/Wfargo/wells_files/ 8 KB
2 KB 534ms
534ms Stylesheet
text/css 2606:4700:3034::681b:86e6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://aec88.bet/wells_f/Wfargo/wells_files/theme.css
Requested by: Host: aec88.bet
URL: https://aec88.bet/wells_f/Wfargo/wells.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::681b:86e6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f82a7a512d314b7ce4c4bbab30c4528e0c3136514b694ca53213f06b246b273c

Request headers

Referer: https://aec88.bet/wells_f/Wfargo/wells.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

date: Mon, 06 Apr 2020 06:14:06 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Tue, 06 Feb 2018 09:42:16 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=14400
cf-ray: 57f95dde7cc7d6dd-FRA

GET
H2 200 login-userprefs.js Show response
aec88.bet/wells_f/Wfargo/wells_files/ 144 KB
23 KB 538ms
537ms Script
application/javascript 2606:4700:3034::681b:86e6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://aec88.bet/wells_f/Wfargo/wells_files/login-userprefs.js
Requested by: Host: aec88.bet
URL: https://aec88.bet/wells_f/Wfargo/wells.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::681b:86e6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1b1b1c060912cb94b0db47fb6740b14ca96f731b0f1125bae5130a83e92d5f07

Request headers

Referer: https://aec88.bet/wells_f/Wfargo/wells.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 06 Apr 2020 06:14:06 GMT
content-encoding: br
cf-cache-status: REVALIDATED
last-modified: Tue, 06 Feb 2018 09:42:16 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=14400
cf-ray: 57f95dde7cc9d6dd-FRA

GET
H2 200 conutils-6.js Show response
aec88.bet/wells_f/Wfargo/wells_files/ 10 KB
4 KB 537ms
536ms Script
application/javascript 2606:4700:3034::681b:86e6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://aec88.bet/wells_f/Wfargo/wells_files/conutils-6.js
Requested by: Host: aec88.bet
URL: https://aec88.bet/wells_f/Wfargo/wells.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::681b:86e6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3313ac9f2c148df9dc8581ae4d7bb9023c3ef933d1152db47de29e32ec5f67b0

Request headers

Referer: https://aec88.bet/wells_f/Wfargo/wells.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 06 Apr 2020 06:14:06 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Tue, 06 Feb 2018 09:42:16 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=14400
cf-ray: 57f95dde7ccad6dd-FRA

GET
H2 200 atadun.js Show response
aec88.bet/wells_f/Wfargo/wells_files/ 1 KB
477 B 611ms
610ms Script
application/javascript 2606:4700:3034::681b:86e6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://aec88.bet/wells_f/Wfargo/wells_files/atadun.js
Requested by: Host: aec88.bet
URL: https://aec88.bet/wells_f/Wfargo/wells.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::681b:86e6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5fb7b85658a6e615400e0f1f3e16fc869bbd099b3c3c181c294c05d1d7d1cfe5

Request headers

Referer: https://aec88.bet/wells_f/Wfargo/wells.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 06 Apr 2020 06:14:06 GMT
content-encoding: br
cf-cache-status: REVALIDATED
last-modified: Tue, 06 Feb 2018 09:42:16 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=14400
cf-ray: 57f95dde7cccd6dd-FRA

GET
H2 200 wflogo-gfrewards.png
aec88.bet/wells_f/Wfargo/wells_files/ 20 KB
20 KB 612ms
611ms Image
image/png 2606:4700:3034::681b:86e6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aec88.bet/wells_f/Wfargo/wells_files/wflogo-gfrewards.png
Requested by: Host: aec88.bet
URL: https://aec88.bet/wells_f/Wfargo/wells.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::681b:86e6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8acab8f477754cb0846b2eca8bfea7c4e5a0e3a5348a3ff69fe67bfaef42b8ab

Request headers

Referer: https://aec88.bet/wells_f/Wfargo/wells.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 06 Apr 2020 06:14:06 GMT
cf-cache-status: REVALIDATED
last-modified: Tue, 06 Feb 2018 09:42:16 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 57f95dde7cced6dd-FRA
content-length: 20681

GET
H2 404 conutils-6.2.2.js
aec88.bet/auth/static/scripts/ 0
0 1671ms
1671ms Script
text/html 2606:4700:3034::681b:86e6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://aec88.bet/auth/static/scripts/conutils-6.2.2.js
Requested by: Host: aec88.bet
URL: https://aec88.bet/wells_f/Wfargo/wells_files/login-userprefs.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::681b:86e6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: https://aec88.bet/wells_f/Wfargo/wells.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 06 Apr 2020 06:14:08 GMT
content-encoding: br
cf-cache-status: MISS
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,Cookie
content-type: text/html; charset=UTF-8
status: 404
cache-control: max-age=14400, must-revalidate
cf-ray: 57f95de26cd9d6dd-FRA
link: <https://aec88.bet/wp-json/>; rel="https://api.w.org/"
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H2 404 atadun.js
aec88.bet/auth/static/prefs/ 0
0 1643ms
1643ms Script
text/html 2606:4700:3034::681b:86e6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://aec88.bet/auth/static/prefs/atadun.js
Requested by: Host: aec88.bet
URL: https://aec88.bet/wells_f/Wfargo/wells_files/login-userprefs.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::681b:86e6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: https://aec88.bet/wells_f/Wfargo/wells.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 06 Apr 2020 06:14:08 GMT
content-encoding: br
cf-cache-status: EXPIRED
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,Cookie
content-type: text/html; charset=UTF-8
status: 404
cache-control: max-age=14400, must-revalidate
cf-ray: 57f95de26cdad6dd-FRA
link: <https://aec88.bet/wp-json/>; rel="https://api.w.org/"
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H2 404 atadun.js
aec88.bet/auth/static/prefs/ 0
0 1634ms
1633ms Script
text/html 2606:4700:3034::681b:86e6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://aec88.bet/auth/static/prefs/atadun.js
Requested by: Host: aec88.bet
URL: https://aec88.bet/wells_f/Wfargo/wells.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::681b:86e6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: https://aec88.bet/wells_f/Wfargo/wells.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 06 Apr 2020 06:14:09 GMT
content-encoding: br
cf-cache-status: EXPIRED
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,Cookie
content-type: text/html; charset=UTF-8
status: 404
cache-control: max-age=14400, must-revalidate
cf-ray: 57f95deceb22d6dd-FRA
link: <https://aec88.bet/wp-json/>; rel="https://api.w.org/"
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H/1.1 200 nd Show response
connect.secure.wellsfargo.com/jenny/ 46 KB
16 KB 583ms
140ms Script
application/javascript 159.45.66.156
WELLSFARGO-4196

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.secure.wellsfargo.com/jenny/nd

Requested by

Host: aec88.bet
URL: https://aec88.bet/wells_f/Wfargo/wells_files/atadun.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

159.45.66.156 Charlotte, United States, ASN4196 (WELLSFARGO-4196, US),

Reverse DNS

Software

KONICHIWA/1.1 /

Resource Hash

184ff6f077e64237565a4847d1a2bff9bddf0efb38969a03793ee4ca9bc9616c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://aec88.bet/wells_f/Wfargo/wells.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Strict-Transport-Security: max-age=31536000
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: KONICHIWA/1.1
Date: Mon, 06 Apr 2020 06:14:09 GMT
X-Frame-Options: DENY
Content-Type: application/javascript;charset=ISO-8859-1
X-Cnection: close
Transfer-Encoding: chunked
vary: accept-encoding
X-XSS-Protection: 1; mode=block

GET
H2 404 search_corner.gif
aec88.bet/wells_f/Wfargo/wells_files/images/ 2 KB
2 KB 1658ms
1658ms Image
text/html 2606:4700:3034::681b:86e6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aec88.bet/wells_f/Wfargo/wells_files/images/search_corner.gif
Requested by: Host: aec88.bet
URL: https://aec88.bet/wells_f/Wfargo/wells.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::681b:86e6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 73e1a3d64a332211d72992a03cffd934eda18609ec21196b09605ce8afa48e2e

Request headers

Referer: https://aec88.bet/wells_f/Wfargo/wells_files/signonCommitment.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 06 Apr 2020 06:14:11 GMT
content-encoding: br
cf-cache-status: MISS
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,Cookie
content-type: text/html; charset=UTF-8
status: 404
cache-control: max-age=14400, must-revalidate
cf-ray: 57f95df72fded6dd-FRA
link: <https://aec88.bet/wp-json/>; rel="https://api.w.org/"
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H2 404 btn_blueslice.gif
aec88.bet/wells_f/Wfargo/wells_files/images/ 30 KB
30 KB 1668ms
1668ms Image
text/html 2606:4700:3034::681b:86e6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aec88.bet/wells_f/Wfargo/wells_files/images/btn_blueslice.gif
Requested by: Host: aec88.bet
URL: https://aec88.bet/wells_f/Wfargo/wells.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::681b:86e6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 667000a48cca5328cb4ed54418c367f1aaa5f9b574f9eb3bd3552155fb604cb9

Request headers

Referer: https://aec88.bet/wells_f/Wfargo/wells_files/signonCommitment.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 06 Apr 2020 06:14:11 GMT
content-encoding: br
cf-cache-status: MISS
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,Cookie
content-type: text/html; charset=UTF-8
status: 404
cache-control: max-age=14400, must-revalidate
cf-ray: 57f95df72fe3d6dd-FRA
link: <https://aec88.bet/wp-json/>; rel="https://api.w.org/"
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H2 404 wellsfargo-storefront_outdoors-street_cars-and-people-crossing_722x185.png
aec88.bet/wells_f/images/ 18 KB
18 KB 1664ms
1664ms Image
text/html 2606:4700:3034::681b:86e6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aec88.bet/wells_f/images/wellsfargo-storefront_outdoors-street_cars-and-people-crossing_722x185.png
Requested by: Host: aec88.bet
URL: https://aec88.bet/wells_f/Wfargo/wells.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::681b:86e6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5c25a4496c80a7fefb45cf7b71b4423dfa7c41ce6b9b86600b2a2b5af6a5cee5

Request headers

Referer: https://aec88.bet/wells_f/Wfargo/wells_files/theme.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 06 Apr 2020 06:14:11 GMT
content-encoding: br
cf-cache-status: MISS
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,Cookie
content-type: text/html; charset=UTF-8
status: 404
cache-control: max-age=14400, must-revalidate
cf-ray: 57f95df72febd6dd-FRA
link: <https://aec88.bet/wp-json/>; rel="https://api.w.org/"
expires: Wed, 11 Jan 1984 05:00:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Wells Fargo (Banking)

165 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aec88.bet
connect.secure.wellsfargo.com
159.45.66.156
2606:4700:3034::681b:86e6
184ff6f077e64237565a4847d1a2bff9bddf0efb38969a03793ee4ca9bc9616c
1b1b1c060912cb94b0db47fb6740b14ca96f731b0f1125bae5130a83e92d5f07
3313ac9f2c148df9dc8581ae4d7bb9023c3ef933d1152db47de29e32ec5f67b0
5c25a4496c80a7fefb45cf7b71b4423dfa7c41ce6b9b86600b2a2b5af6a5cee5
5fb7b85658a6e615400e0f1f3e16fc869bbd099b3c3c181c294c05d1d7d1cfe5
667000a48cca5328cb4ed54418c367f1aaa5f9b574f9eb3bd3552155fb604cb9
73e1a3d64a332211d72992a03cffd934eda18609ec21196b09605ce8afa48e2e
74d5a8da285ab22328918013fab0c07781b12fa4d7ab05ea5e817874f31dace4
7c21a45f9e10b50948faf43421ae13f1a49c75c9e44604c63b9bd1c34075d474
8acab8f477754cb0846b2eca8bfea7c4e5a0e3a5348a3ff69fe67bfaef42b8ab
f82a7a512d314b7ce4c4bbab30c4528e0c3136514b694ca53213f06b246b273c
ffc539eb345f9466fecbe7b7ea8d2db0f56ef3857c8b26159d9a230bf9afdb4a

aec88.bet Open in urlscan Pro 2606:4700:3034::681b:86e6 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

15 Requests

100 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

2 IPs

1 Countries

159 kBTransfer

334 kBSize

0 Cookies

14 Outgoing links

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

165 JavaScript Global Variables

0 Cookies

Indicators

aec88.bet Open in urlscan Pro
2606:4700:3034::681b:86e6 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

159 kB
Transfer

334 kB
Size

0
Cookies

15 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!