www.sambalpurnursingcollege.org
Open in
urlscan Pro
98.143.145.130
Malicious Activity!
Public Scan
URL:
https://www.sambalpurnursingcollege.org/admin/images/inc/wellsfargo/wellsfargo/wellsfargo.com/wellsfargo.com/step2.php
Submission: On June 21 via automatic, source openphish
Submission: On June 21 via automatic, source openphish
Summary
This website contacted 3 IPs
in 1 countries
across 3 domains to perform 20 HTTP transactions.
The main IP is 98.143.145.130, located in
Los Angeles, United States and
belongs to ASN-QUADRANET-GLOBAL - QuadraNet, Inc, US.
The main domain is www.sambalpurnursingcollege.org.
TLS certificate: Issued by cPanel, Inc. Certification Authority on April 15th 2018. Valid for: 3 months.
This is the only time www.sambalpurnursingcollege.org was scanned on urlscan.io!
TLS certificate: Issued by cPanel, Inc. Certification Authority on April 15th 2018. Valid for: 3 months.
This is the only time www.sambalpurnursingcollege.org was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic (Online) Wells Fargo (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 14 | 98.143.145.130 98.143.145.130 | 8100 (ASN-QUADR...) (ASN-QUADRANET-GLOBAL - QuadraNet) | |
| 1 | 54.148.84.95 54.148.84.95 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
| 5 | 2400:cb00:204... 2400:cb00:2048:1::6813:c597 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
| 20 | 3 |
14
98.143.145.130
(Los Angeles, United States)
ASN8100 (ASN-QUADRANET-GLOBAL - QuadraNet, Inc, US)
PTR: 98.143.145.130.static.quadranet.com
ASN8100 (ASN-QUADRANET-GLOBAL - QuadraNet, Inc, US)
PTR: 98.143.145.130.static.quadranet.com
| www.sambalpurnursingcollege.org |
1
54.148.84.95
(Boardman, United States)
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-148-84-95.us-west-2.compute.amazonaws.com
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-148-84-95.us-west-2.compute.amazonaws.com
| www.sitepoint.com |
5
2400:cb00:2048:1::6813:c597
(United States)
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
| cdnjs.cloudflare.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 14 |
sambalpurnursingcollege.org
www.sambalpurnursingcollege.org |
38 KB |
| 5 |
cloudflare.com
cdnjs.cloudflare.com |
107 KB |
| 1 |
sitepoint.com
www.sitepoint.com |
6 KB |
| 20 | 3 |
| Domain | Requested by | |
|---|---|---|
| 14 | www.sambalpurnursingcollege.org |
www.sambalpurnursingcollege.org
|
| 5 | cdnjs.cloudflare.com |
www.sambalpurnursingcollege.org
|
| 1 | www.sitepoint.com |
www.sambalpurnursingcollege.org
|
| 20 | 3 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| sambalpurnursingcollege.org cPanel, Inc. Certification Authority |
2018-04-15 - 2018-07-14 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.sambalpurnursingcollege.org/admin/images/inc/wellsfargo/wellsfargo/wellsfargo.com/wellsfargo.com/step2.php
Frame ID: 01D0DFAFB34566C2BB27A8D1CB9331DC
Requests: 20 HTTP requests in this frame
Screenshot
Detected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- url /\.php(?:$|\?)/i
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- script /jquery.*\.js/i
- env /^jQuery$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
20 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
step2.php
www.sambalpurnursingcollege.org/admin/images/inc/wellsfargo/wellsfargo/wellsfargo.com/wellsfargo.com/ |
7 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
MaskedPassword.js
www.sitepoint.com/examples/password/MaskedPassword/ |
17 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
jquery.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.0.0-beta1/ |
256 KB 78 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
jquery.validate.js
cdnjs.cloudflare.com/ajax/libs/jquery-validate/1.15.0/ |
45 KB 12 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
additional-methods.js
cdnjs.cloudflare.com/ajax/libs/jquery-validate/1.15.0/ |
38 KB 11 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
jquery.maskedinput.js
cdnjs.cloudflare.com/ajax/libs/jquery.maskedinput/1.4.1/ |
10 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
jquery.payment.js
cdnjs.cloudflare.com/ajax/libs/jquery.payment/1.3.2/ |
17 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
logo.png
www.sambalpurnursingcollege.org/admin/images/inc/wellsfargo/wellsfargo/wellsfargo.com/wellsfargo.com/images/ |
2 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
secu.png
www.sambalpurnursingcollege.org/admin/images/inc/wellsfargo/wellsfargo/wellsfargo.com/wellsfargo.com/images/ |
907 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
wf17.png
www.sambalpurnursingcollege.org/admin/images/inc/wellsfargo/wellsfargo/wellsfargo.com/wellsfargo.com/images/ |
265 B 470 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
wf20.png
www.sambalpurnursingcollege.org/admin/images/inc/wellsfargo/wellsfargo/wellsfargo.com/wellsfargo.com/images/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
wf21.png
www.sambalpurnursingcollege.org/admin/images/inc/wellsfargo/wellsfargo/wellsfargo.com/wellsfargo.com/images/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
wf22.png
www.sambalpurnursingcollege.org/admin/images/inc/wellsfargo/wellsfargo/wellsfargo.com/wellsfargo.com/images/ |
274 B 479 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
wf18.png
www.sambalpurnursingcollege.org/admin/images/inc/wellsfargo/wellsfargo/wellsfargo.com/wellsfargo.com/images/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
z5.png
www.sambalpurnursingcollege.org/admin/images/inc/wellsfargo/wellsfargo/wellsfargo.com/wellsfargo.com/images/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
wf19.png
www.sambalpurnursingcollege.org/admin/images/inc/wellsfargo/wellsfargo/wellsfargo.com/wellsfargo.com/images/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ws2.png
www.sambalpurnursingcollege.org/admin/images/inc/wellsfargo/wellsfargo/wellsfargo.com/wellsfargo.com/images/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ws3.png
www.sambalpurnursingcollege.org/admin/images/inc/wellsfargo/wellsfargo/wellsfargo.com/wellsfargo.com/images/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ws7.png
www.sambalpurnursingcollege.org/admin/images/inc/wellsfargo/wellsfargo/wellsfargo.com/wellsfargo.com/images/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
confirm.png
www.sambalpurnursingcollege.org/admin/images/inc/wellsfargo/wellsfargo/wellsfargo.com/wellsfargo.com/images/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic (Online) Wells Fargo (Banking)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| MaskedPassword function| $ function| jQuery function| unhideBody0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdnjs.cloudflare.com
www.sambalpurnursingcollege.org
www.sitepoint.com
2400:cb00:2048:1::6813:c597
54.148.84.95
98.143.145.130
1a93301260b9caf184badb78bde86c2b9c149226757082f20632b4d97e22108a
30c71ce57687cb04f333ebce07c6098bd1a0ce6556e52f73dbf853dc5d56dd2a
593011e4c5e2416a84cc50d01760a22c0667cd65fdbb8924b69417fa9206c628
5ea300fe42055ada46470525c1a89801811ffd2a99506e224ade747dae87c06c
60499c4335239d51fa6ef40bd909ba8e62a2a468b16b74f0fd9fadac1eee4bbf
7742fb83d98648f94727a40d5c3381b3245805e62b6f998002d933715ac84b6a
78f27c3d7cb5d766466703adc7f7ad7706b7fb05514eec39be0aa253449bd0f8
799d66f9d6cd6cd336a5c39fb7d7208c5e8eac8b4818fb22715d991a91657896
79a3b908565aac75c2c635ed9a03ac88effed84dc4467317b324573a1cbb0a46
7ef14a1e070a6a2ec9ff44ccf5e923cb2a460c5861a3db8a9ae1e21557d27020
accf2ac7a8cdd42af0374fd634ee14bedcffbb3338c4ae571545f7c61706a4bc
ae61eb886ea85df9cbe65fbc56c154f5871347cc405c65a907db8d2cd085c579
b5f4d5474c478f1d0aac62c4f09aabc5987753f7768a5f5d6ee4790e8fab8deb
cf8369003c926d4192195b84f30574f9847a2363ce12a487c8373cbef6858361
d030f6633a5d0efd3f76fcf5ec98a0468c76770e618a401ffe5ddc7f6ccc844b
df3526375b4f6b40cca058a7ade8e5fd543db18416756da10843fb58eabf74b9
df3a7ee8540e38673cda39fbf657861a90157e6b2fc6abd9b04df6c3fd7ccd88
ea9f9e865ee6e566bb3d96cddb44b6b6603d845e728399a209423d2688e07d8b
ef279d8ddd59ca93db7ae7f87a584b66f0624f2e0ce12e2f0473c15d93db123d
ffbb4b951f2a769fa461c96def503f4a208f25e12e9eabd8a765f641f0a8ea58