mail.multiseca.com
Open in
urlscan Pro
162.240.8.184
Malicious Activity!
Public Scan
Submission: On October 27 via automatic, source openphish — Scanned from DE
Summary
This is the only time mail.multiseca.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Wells Fargo (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
9 | 162.240.8.184 162.240.8.184 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
9 | 2 |
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 5320120.l2ndm.host
mail.multiseca.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
multiseca.com
mail.multiseca.com |
241 KB |
9 | 1 |
Domain | Requested by | |
---|---|---|
9 | mail.multiseca.com |
mail.multiseca.com
|
9 | 1 |
This site contains no links.
Subject Issuer | Validity | Valid |
---|
This page contains 1 frames:
Primary Page:
http://mail.multiseca.com/ef214092c5de0fe03ec204075209328b/confirm.php?country.x=-&ReasonCode=04188.166.98.249=codes_list=OAM-2=5285a1384d388abe1f76f5a613352765S=$1$b8Jt3mLD$Zh49QagKWKYivZ.7.QTzg01
Frame ID: 9B9180BE88C8C61422B4C58E097383C8
Requests: 16 HTTP requests in this frame
Screenshot
Page Title
Wells Fargo Account Verification - IdentificationDetected technologies
PHP (Programming Languages) ExpandDetected patterns
- \.php(?:$|\?)
Lightbox (JavaScript Libraries) Expand
Detected patterns
- lightbox(?:-plus-jquery)?.{0,32}\.js
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
9 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
Cookie set
confirm.php
mail.multiseca.com/ef214092c5de0fe03ec204075209328b/ |
61 KB 62 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
passwordReset.css
mail.multiseca.com/ef214092c5de0fe03ec204075209328b/imgs/ |
33 KB 33 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icn-ind-loading-page-glob-70x70-000720-v01_00@1x.gif
mail.multiseca.com/ef214092c5de0fe03ec204075209328b/imgs/ |
19 KB 19 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
theme.osmp.timeout.css
mail.multiseca.com/ef214092c5de0fe03ec204075209328b/imgs/ |
2 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.min.js
mail.multiseca.com/ef214092c5de0fe03ec204075209328b/imgs/ |
94 KB 95 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
validation.js
mail.multiseca.com/ef214092c5de0fe03ec204075209328b/imgs/ |
6 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
timeout.js
mail.multiseca.com/ef214092c5de0fe03ec204075209328b/imgs/ |
9 KB 10 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
theme.osmp.balloon.js
mail.multiseca.com/ef214092c5de0fe03ec204075209328b/imgs/ |
7 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
theme.osmp.lightbox.js
mail.multiseca.com/ef214092c5de0fe03ec204075209328b/imgs/ |
7 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
6 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
4 KB 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
212 B 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
395 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
309 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Wells Fargo (Banking)10 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect boolean| originAgentCluster object| errorMessages function| $ function| jQuery object| Validation object| TimerModal object| obj object| OSMPBalloon object| OSMPLightbox1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
mail.multiseca.com/ | Name: PHPSESSID Value: b96816b466ac50b3ec69100a53b40b0c |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
mail.multiseca.com
162.240.8.184
00b2519c3ecb866ffc2be3565c3c5199ce0b8f07c7e627404a0253e73f00c83e
0a646e5aa2bffaf7fe24e63ed8b5b736264707497f2724c53c27995448ead57b
111293483bce043cdb7773fef81c2118cfbf3664646133d0137a1f7d87c488e5
1e6897f16252610e8ef3db2e7e6e2ad93679362bc33adbb0ea7f4512427b4bf6
27a727d53de0aa575319e751a3f1e2db9273ae99275057735a6cff88112783c9
3694cd7cb557bfe349169c797b35a48d9503ab8c03f746843a440e3d906df735
3cfe502469eef218de7117a10c28faef7aa0a964f94d3a92920a395162c885f7
409bb0fda65031ecb46a7c70e6e1e9cdec272980903bde0e95861c69676f07bb
66045233d2ee1cee32d15db765bf0128a7e1668f893d3b22a52ba501420ebf3b
7507dd5ac80ce12666fa39b0e7d7d571b4f40b0ae47c9b58b243fedb771dc550
8a46f7e1801bbc650201f5fd410d1854ff5e62c284414de48d418bed2f33fc8a
91a6ed18ee4ce6197e3bb7b79cba2ad9808fa26e069cfe4e8958725ba4753e71
a05c326b16b3173fbf8e999d38e907d35bb00c0cb245fa675776c9a2fd788e17
d37bd2b0d972b4d93225150196da6b4b0ba8d1daf224b54ccec32ad5632f5a3f
edc5ee3b590dae17b0eb19063c34680c15ee144d13583d006e6a7976b69cd2db
ffa2a92da68614927e93057d1f7116b42ba0734a58f7cae12265c8a27ae8ba0f