www.ccfairfield.org Open in urlscan Pro
50.57.249.55 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://www.ccfairfield.org/wp-content/wells/013245678/fargo/6/7/77/98765/7654/2345678/2345/questions.php
Submission: On April 12 via automatic, source openphish (April 12th 2017, 6:37:30 am UTC)

Summary HTTP 13 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 13 HTTP transactions. The main IP is 50.57.249.55, located in San Antonio, United States and belongs to RACKSPACE - Rackspace Hosting, US. The main domain is www.ccfairfield.org.

This is the only time www.ccfairfield.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Wells Fargo (Banking)

Domain & IP information

	IP Address	AS Autonomous System
3	50.57.249.55 50.57.249.55	19994 (RACKSPACE) (RACKSPACE - Rackspace Hosting)
6	159.45.2.154 159.45.2.154	10837 (WELLSFARG...) (WELLSFARGO-10837 - Wells Fargo & Company)
4	2.21.246.179 2.21.246.179	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
13	3

3 50.57.249.55 (San Antonio, United States)

ASN19994 (RACKSPACE - Rackspace Hosting, US)

www.ccfairfield.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 159.45.2.154 (United States)

ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US)
PTR: online.wellsfargo.com

online.wellsfargo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2.21.246.179 (Austria)

ASN20940 (AKAMAI-ASN1, US)

a248.e.akamai.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	wellsfargo.com online.wellsfargo.com	36 KB
4	akamai.net a248.e.akamai.net	2 KB
3	ccfairfield.org www.ccfairfield.org	17 KB
13	3

	Domain	Requested by
6	online.wellsfargo.com	www.ccfairfield.org
4	a248.e.akamai.net	www.ccfairfield.org
3	www.ccfairfield.org
13	3

This site contains links to these domains. Also see Links.

Domain
online.wellsfargo.com
www.wellsfargo.com

Subject Issuer	Validity	Valid
online.wellsfargo.com Symantec Class 3 Secure Server CA - G4	`2016-10-28` - `2018-10-29`	2 years	crt.sh
a248.e.akamai.net Symantec Class 3 ECC 256 bit SSL CA - G2	`2016-07-28` - `2017-07-28`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://www.ccfairfield.org/wp-content/wells/013245678/fargo/6/7/77/98765/7654/2345678/2345/questions.php
Frame ID: 11011.1
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

13
Requests

77 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

55 kB
Transfer

201 kB
Size

1
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://online.wellsfargo.com/das/cgi-bin/session.cgi?sessargs=enRI6y5qGOBFzIOfnu9_5nf0yzUCfCnm

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/home.jhtml

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/security/security_olb
Title: Online Security Guarantee

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Cookie set questions.php Show response www.ccfairfield.org/wp-content/wells/013245678/fargo/6/7/77/98765/7654/2345678/2345/	12 KB 12 KB	469ms 264ms	Document text/html	50.57.249.55 Rackspace Hosting
General Check archive.org Show headers Download Go to Full URL http://www.ccfairfield.org/wp-content/wells/013245678/fargo/6/7/77/98765/7654/2345678/2345/questions.php Protocol HTTP/1.1 Server 50.57.249.55 San Antonio, United States, ASN19994 (RACKSPACE - Rackspace Hosting, US), Reverse DNS Software Apache/2.4 / Resource Hash `7033a79e0c9982dba663e9cc3d2e93c3fc79aba7b84da931bd8979b865120874` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host www.ccfairfield.org Accept-Language en-US,en;q=0.8 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Cache-Control no-cache Connection keep-alive Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Wed, 12 Apr 2017 06:37:19 GMT Connection Keep-Alive Server Apache/2.4 Set-Cookie X-Mapping-dihafnmm=A7F494677F83AC85D04BA5DE22F4C54B; path=/ Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	Cookie set wfwiblib.js Show response online.wellsfargo.com/common/scripts/	30 KB 7 KB	601ms 126ms	Script application/x-javascript	159.45.2.154 Wells Fargo & Com...
General Check archive.org Show headers Download Go to Full URL https://online.wellsfargo.com/common/scripts/wfwiblib.js Requested by Host: www.ccfairfield.org URL: http://www.ccfairfield.org/wp-content/wells/013245678/fargo/6/7/77/98765/7654/2345678/2345/questions.php Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_256_CBC Server 159.45.2.154 , United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US), Reverse DNS online.wellsfargo.com Software KONICHIWA/2.0 / Resource Hash `6a60586980d51d5c93f661e7eaf9382ec327185fd1cc5a6722a5cd9a79d6db0e` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch, br Host online.wellsfargo.com Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept / Referer http://www.ccfairfield.org/wp-content/wells/013245678/fargo/6/7/77/98765/7654/2345678/2345/questions.php Connection keep-alive Cache-Control no-cache Referer http://www.ccfairfield.org/wp-content/wells/013245678/fargo/6/7/77/98765/7654/2345678/2345/questions.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Wed, 12 Apr 2017 06:37:20 GMT Content-encoding gzip Vary accept-encoding Last-modified Mon, 20 Mar 2017 03:24:31 GMT Server KONICHIWA/2.0 Etag W/"79d5-58cf4b6f" Transfer-encoding chunked Content-type application/x-javascript Set-Cookie ISD_WIB_COOKIE=!1YaaFmoS63dEba10yTeKMaSxlFERkLKGdPBfGCVEaCV8z0Otqc9y5NwfSM+a/3oVZQ7GDkr0RPbdRxw=; path=/
GET H/1.1	200 OK	Cookie set vudu.css online.wellsfargo.com/common/styles/	26 KB 5 KB	589ms 127ms	Stylesheet text/css	159.45.2.154 Wells Fargo & Com...
General Check archive.org Show headers Download Go to Full URL https://online.wellsfargo.com/common/styles/vudu.css Requested by Host: www.ccfairfield.org URL: http://www.ccfairfield.org/wp-content/wells/013245678/fargo/6/7/77/98765/7654/2345678/2345/questions.php Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_256_CBC Server 159.45.2.154 , United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US), Reverse DNS online.wellsfargo.com Software KONICHIWA/2.0 / Resource Hash `3f32fabf32147846d06d0d451ac9a41dcef278f09683a7b05c95e04f9a055a2e` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch, br Host online.wellsfargo.com Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept text/css,/;q=0.1 Referer http://www.ccfairfield.org/wp-content/wells/013245678/fargo/6/7/77/98765/7654/2345678/2345/questions.php Connection keep-alive Cache-Control no-cache Referer http://www.ccfairfield.org/wp-content/wells/013245678/fargo/6/7/77/98765/7654/2345678/2345/questions.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Wed, 12 Apr 2017 06:37:20 GMT Content-encoding gzip Vary accept-encoding Last-modified Mon, 20 Mar 2017 03:24:27 GMT Server KONICHIWA/2.0 Etag W/"67ce-58cf4b6b" Transfer-encoding chunked Content-type text/css Set-Cookie ISD_WIB_COOKIE=!RzF+Kr29+2sgpPZ0yTeKMaSxlFERkBc9I2JQENhd7jQKa+jDK54R/O/iP0X9m7A9iAPMsJ33HQlSx8c=; path=/
GET H/1.1	200 OK	Cookie set wibscreen.css online.wellsfargo.com/common/styles/	105 KB 21 KB	602ms 140ms	Stylesheet text/css	159.45.2.154 Wells Fargo & Com...
General Check archive.org Show headers Download Go to Full URL https://online.wellsfargo.com/common/styles/wibscreen.css Requested by Host: www.ccfairfield.org URL: http://www.ccfairfield.org/wp-content/wells/013245678/fargo/6/7/77/98765/7654/2345678/2345/questions.php Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_256_CBC Server 159.45.2.154 , United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US), Reverse DNS online.wellsfargo.com Software KONICHIWA/2.0 / Resource Hash `037e631526f82d2a7cb240cdac80c6dd9a226f3f8b6e563b8881220dd0e9a25c` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch, br Host online.wellsfargo.com Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept text/css,/;q=0.1 Referer http://www.ccfairfield.org/wp-content/wells/013245678/fargo/6/7/77/98765/7654/2345678/2345/questions.php Connection keep-alive Cache-Control no-cache Referer http://www.ccfairfield.org/wp-content/wells/013245678/fargo/6/7/77/98765/7654/2345678/2345/questions.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Wed, 12 Apr 2017 06:37:20 GMT Content-encoding gzip Vary accept-encoding Last-modified Mon, 20 Mar 2017 03:24:27 GMT Server KONICHIWA/2.0 Etag W/"1a3ea-58cf4b6b" Transfer-encoding chunked Content-type text/css Set-Cookie ISD_WIB_COOKIE=!LqdKyk8WKE+VDY+Uly+cCoZsX3FavsjdwTW90Jl0prEZOp+Fk8gqVnYIrBbwvie30ruRG7qHUmK8sPA=; path=/
GET H/1.1	200 OK	Cookie set mm.css online.wellsfargo.com/common/styles/	19 KB 3 KB	594ms 132ms	Stylesheet text/css	159.45.2.154 Wells Fargo & Com...
General Check archive.org Show headers Download Go to Full URL https://online.wellsfargo.com/common/styles/mm.css Requested by Host: www.ccfairfield.org URL: http://www.ccfairfield.org/wp-content/wells/013245678/fargo/6/7/77/98765/7654/2345678/2345/questions.php Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_256_CBC Server 159.45.2.154 , United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US), Reverse DNS online.wellsfargo.com Software KONICHIWA/2.0 / Resource Hash `c3f74c081422cc48c92a6e1512cc760c5b6e3fd42a9dc3d41a7c47986b5fb042` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch, br Host online.wellsfargo.com Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept text/css,/;q=0.1 Referer http://www.ccfairfield.org/wp-content/wells/013245678/fargo/6/7/77/98765/7654/2345678/2345/questions.php Connection keep-alive Cache-Control no-cache Referer http://www.ccfairfield.org/wp-content/wells/013245678/fargo/6/7/77/98765/7654/2345678/2345/questions.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Wed, 12 Apr 2017 06:37:20 GMT Content-encoding gzip Vary accept-encoding Last-modified Mon, 20 Mar 2017 03:24:27 GMT Server KONICHIWA/2.0 Etag W/"4be9-58cf4b6b" Transfer-encoding chunked Content-type text/css Set-Cookie ISD_WIB_COOKIE=!m/4rEOwsRSm+i2OUly+cCoZsX3FavmQmkJlK+DBlYovLVkUx3lLt2n1o7NDidJyLn8O4XjHtSrJBjdA=; path=/
GET H/1.1	200 OK	shim.gif a248.e.akamai.net/7/248/3608/1d8352905f2c38/online.wellsfargo.com/common/images/	43 B 43 B	37ms 16ms	Image image/gif	2.21.246.179 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://a248.e.akamai.net/7/248/3608/1d8352905f2c38/online.wellsfargo.com/common/images/shim.gif Requested by Host: www.ccfairfield.org URL: http://www.ccfairfield.org/wp-content/wells/013245678/fargo/6/7/77/98765/7654/2345678/2345/questions.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 2.21.246.179 , Austria, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software KONICHIWA/2.0 / Resource Hash `89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch, br Host a248.e.akamai.net Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://www.ccfairfield.org/wp-content/wells/013245678/fargo/6/7/77/98765/7654/2345678/2345/questions.php Connection keep-alive Cache-Control no-cache Referer http://www.ccfairfield.org/wp-content/wells/013245678/fargo/6/7/77/98765/7654/2345678/2345/questions.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Wed, 12 Apr 2017 06:37:20 GMT Last-Modified Fri, 24 Jun 2016 05:47:51 GMT Server KONICHIWA/2.0 ETag "2b-576cc987" Content-Type image/gif Connection keep-alive Accept-Ranges bytes Content-Length 43
GET H/1.1	200 OK	logo_62sq.gif a248.e.akamai.net/7/248/3608/bb61162e7a787f/online.wellsfargo.com/common/images/	616 B 616 B	6ms 6ms	Image image/gif	2.21.246.179 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://a248.e.akamai.net/7/248/3608/bb61162e7a787f/online.wellsfargo.com/common/images/logo_62sq.gif Requested by Host: www.ccfairfield.org URL: http://www.ccfairfield.org/wp-content/wells/013245678/fargo/6/7/77/98765/7654/2345678/2345/questions.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 2.21.246.179 , Austria, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software KONICHIWA/2.0 / Resource Hash `ebf4a535fa6a88962621940e780ca0cd6707b6cdaed59f469f0aeada311d09d1` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch, br Host a248.e.akamai.net Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://www.ccfairfield.org/wp-content/wells/013245678/fargo/6/7/77/98765/7654/2345678/2345/questions.php Connection keep-alive Cache-Control no-cache Referer http://www.ccfairfield.org/wp-content/wells/013245678/fargo/6/7/77/98765/7654/2345678/2345/questions.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Wed, 12 Apr 2017 06:37:20 GMT Last-Modified Mon, 19 Dec 2016 07:01:09 GMT Server KONICHIWA/2.0 ETag "268-585785b5" Content-Type image/gif Connection keep-alive Accept-Ranges bytes Content-Length 616
GET H/1.1	200 OK	tagline_consumer.gif a248.e.akamai.net/7/248/3608/b7f14699958abc/online.wellsfargo.com/common/images/	937 B 937 B	6ms 6ms	Image image/gif	2.21.246.179 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://a248.e.akamai.net/7/248/3608/b7f14699958abc/online.wellsfargo.com/common/images/tagline_consumer.gif Requested by Host: www.ccfairfield.org URL: http://www.ccfairfield.org/wp-content/wells/013245678/fargo/6/7/77/98765/7654/2345678/2345/questions.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 2.21.246.179 , Austria, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software KONICHIWA/2.0 / Resource Hash `5dd26d926dda54524ab6d5696e30fa8ae26e5b54895d20a4781d54f4ed5cbf78` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch, br Host a248.e.akamai.net Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://www.ccfairfield.org/wp-content/wells/013245678/fargo/6/7/77/98765/7654/2345678/2345/questions.php Connection keep-alive Cache-Control no-cache Referer http://www.ccfairfield.org/wp-content/wells/013245678/fargo/6/7/77/98765/7654/2345678/2345/questions.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Wed, 12 Apr 2017 06:37:20 GMT Last-Modified Mon, 19 Dec 2016 07:01:52 GMT Server KONICHIWA/2.0 ETag "3a9-585785e0" Content-Type image/gif Connection keep-alive Accept-Ranges bytes Content-Length 937
GET H/1.1	200 OK	al_ehl_house_gen.gif a248.e.akamai.net/7/248/3608/9dc0d2cce8830d/online.wellsfargo.com/common/images/	111 B 111 B	6ms 6ms	Image image/gif	2.21.246.179 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://a248.e.akamai.net/7/248/3608/9dc0d2cce8830d/online.wellsfargo.com/common/images/al_ehl_house_gen.gif Requested by Host: www.ccfairfield.org URL: http://www.ccfairfield.org/wp-content/wells/013245678/fargo/6/7/77/98765/7654/2345678/2345/questions.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 2.21.246.179 , Austria, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software KONICHIWA/2.0 / Resource Hash `c607565db4706ba321b498fe0d030c5ea56d10db184e40ffcb6092fad8ed6569` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch, br Host a248.e.akamai.net Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://www.ccfairfield.org/wp-content/wells/013245678/fargo/6/7/77/98765/7654/2345678/2345/questions.php Connection keep-alive Cache-Control no-cache Referer http://www.ccfairfield.org/wp-content/wells/013245678/fargo/6/7/77/98765/7654/2345678/2345/questions.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Wed, 12 Apr 2017 06:37:20 GMT Last-Modified Mon, 19 Dec 2016 07:01:57 GMT Server KONICHIWA/2.0 ETag "6f-585785e5" Content-Type image/gif Connection keep-alive Accept-Ranges bytes Content-Length 111
GET H/1.1	200 OK	wibprint.css online.wellsfargo.com/common/styles/	2 KB 973 B	126ms 126ms	Stylesheet text/css	159.45.2.154 Wells Fargo & Com...
General Check archive.org Show headers Download Go to Full URL https://online.wellsfargo.com/common/styles/wibprint.css Requested by Host: www.ccfairfield.org URL: http://www.ccfairfield.org/wp-content/wells/013245678/fargo/6/7/77/98765/7654/2345678/2345/questions.php Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_256_CBC Server 159.45.2.154 , United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US), Reverse DNS online.wellsfargo.com Software KONICHIWA/2.0 / Resource Hash `c34c8c1b9c0bae3b56078584400cae3da8740ab8854b703265e8e989db6a4ec2` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch, br Host online.wellsfargo.com Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept text/css,/;q=0.1 Referer http://www.ccfairfield.org/wp-content/wells/013245678/fargo/6/7/77/98765/7654/2345678/2345/questions.php Cookie ISD_WIB_COOKIE=!LqdKyk8WKE+VDY+Uly+cCoZsX3FavsjdwTW90Jl0prEZOp+Fk8gqVnYIrBbwvie30ruRG7qHUmK8sPA= Connection keep-alive Cache-Control no-cache Referer http://www.ccfairfield.org/wp-content/wells/013245678/fargo/6/7/77/98765/7654/2345678/2345/questions.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Wed, 12 Apr 2017 06:37:20 GMT Content-encoding gzip Vary accept-encoding Last-modified Mon, 20 Mar 2017 03:24:27 GMT Server KONICHIWA/2.0 Etag W/"9ea-58cf4b6b" Transfer-encoding chunked Content-type text/css
GET H/1.1	200 OK	securityguarantee.gif online.wellsfargo.com/common/styles/images/	67 B 67 B	116ms 115ms	Image image/gif	159.45.2.154 Wells Fargo & Com...
General Check archive.org Show headers Download Go to Show image Full URL https://online.wellsfargo.com/common/styles/images/securityguarantee.gif Requested by Host: www.ccfairfield.org URL: http://www.ccfairfield.org/wp-content/wells/013245678/fargo/6/7/77/98765/7654/2345678/2345/questions.php Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_256_CBC Server 159.45.2.154 , United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US), Reverse DNS online.wellsfargo.com Software KONICHIWA/2.0 / Resource Hash `efe958151f0837002965e098124bf7c159236a74d0e9dbd0015ecbcf461f0810` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch, br Host online.wellsfargo.com Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* https://online.wellsfargo.com/common/styles/vudu.css Cookie ISD_WIB_COOKIE=!LqdKyk8WKE+VDY+Uly+cCoZsX3FavsjdwTW90Jl0prEZOp+Fk8gqVnYIrBbwvie30ruRG7qHUmK8sPA= Connection keep-alive Cache-Control no-cache Referer https://online.wellsfargo.com/common/styles/vudu.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Wed, 12 Apr 2017 06:37:20 GMT Last-modified Mon, 19 Dec 2016 06:59:41 GMT Server KONICHIWA/2.0 Accept-ranges bytes Etag "43-5857855d" Content-length 67 Content-type image/gif
GET H/1.1	503 Service Unavailable	favicon.ico www.ccfairfield.org/wp-content/wells/013245678/fargo/6/7/77/98765/7654/2345678/common/images/	3 KB 3 KB	219ms 219ms	Other text/html	50.57.249.55 Rackspace Hosting
General Check archive.org Show headers Download Go to Full URL http://www.ccfairfield.org/wp-content/wells/013245678/fargo/6/7/77/98765/7654/2345678/common/images/favicon.ico Protocol HTTP/1.1 Server 50.57.249.55 San Antonio, United States, ASN19994 (RACKSPACE - Rackspace Hosting, US), Reverse DNS Software Apache/2.4 / Resource Hash `3f5da14e816cd9263c8a1aa8ed47ab5ba0ecbbb2c30f2d8c26f34b57cd54559d` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host www.ccfairfield.org Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://www.ccfairfield.org/wp-content/wells/013245678/fargo/6/7/77/98765/7654/2345678/2345/questions.php Cookie X-Mapping-dihafnmm=A7F494677F83AC85D04BA5DE22F4C54B Connection keep-alive Cache-Control no-cache Referer http://www.ccfairfield.org/wp-content/wells/013245678/fargo/6/7/77/98765/7654/2345678/2345/questions.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Pragma no-cache Date Wed, 12 Apr 2017 06:37:20 GMT Server Apache/2.4 Content-Type text/html; charset=UTF-8 Cache-Control no-cache, must-revalidate, private X-Cache-Info not cacheable; response code not cacheable Connection close Content-Length 2629 Retry-After 3600 Expires Sat, 26 Jul 1997 05:00:00 GMT
GET H/1.1	503 Service Unavailable	favicon.ico www.ccfairfield.org/wp-content/wells/013245678/fargo/6/7/77/98765/7654/2345678/common/images/	3 KB 3 KB	324ms 218ms	Other text/html	50.57.249.55 Rackspace Hosting
General Check archive.org Show headers Download Go to Full URL http://www.ccfairfield.org/wp-content/wells/013245678/fargo/6/7/77/98765/7654/2345678/common/images/favicon.ico Protocol HTTP/1.1 Server 50.57.249.55 San Antonio, United States, ASN19994 (RACKSPACE - Rackspace Hosting, US), Reverse DNS Software Apache/2.4 / Resource Hash `4dce168d79221780545cfd297dfa176e304aabfc82a4b5524f416c55f95de48c` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host www.ccfairfield.org Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://www.ccfairfield.org/wp-content/wells/013245678/fargo/6/7/77/98765/7654/2345678/2345/questions.php Cookie X-Mapping-dihafnmm=A7F494677F83AC85D04BA5DE22F4C54B Connection keep-alive Cache-Control no-cache Referer http://www.ccfairfield.org/wp-content/wells/013245678/fargo/6/7/77/98765/7654/2345678/2345/questions.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Pragma no-cache Date Wed, 12 Apr 2017 06:37:20 GMT Server Apache/2.4 Content-Type text/html; charset=UTF-8 Cache-Control no-cache, must-revalidate, private X-Cache-Info not cacheable; response code not cacheable Connection close Content-Length 2629 Retry-After 3600 Expires Sat, 26 Jul 1997 05:00:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Wells Fargo (Banking)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.ccfairfield.org/	1970-01-01 00:00:00	Name: X-Mapping-dihafnmm Value: A7F494677F83AC85D04BA5DE22F4C54B

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a248.e.akamai.net
online.wellsfargo.com
www.ccfairfield.org
159.45.2.154
2.21.246.179
50.57.249.55
037e631526f82d2a7cb240cdac80c6dd9a226f3f8b6e563b8881220dd0e9a25c
3f32fabf32147846d06d0d451ac9a41dcef278f09683a7b05c95e04f9a055a2e
3f5da14e816cd9263c8a1aa8ed47ab5ba0ecbbb2c30f2d8c26f34b57cd54559d
4dce168d79221780545cfd297dfa176e304aabfc82a4b5524f416c55f95de48c
5dd26d926dda54524ab6d5696e30fa8ae26e5b54895d20a4781d54f4ed5cbf78
6a60586980d51d5c93f661e7eaf9382ec327185fd1cc5a6722a5cd9a79d6db0e
7033a79e0c9982dba663e9cc3d2e93c3fc79aba7b84da931bd8979b865120874
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
c34c8c1b9c0bae3b56078584400cae3da8740ab8854b703265e8e989db6a4ec2
c3f74c081422cc48c92a6e1512cc760c5b6e3fd42a9dc3d41a7c47986b5fb042
c607565db4706ba321b498fe0d030c5ea56d10db184e40ffcb6092fad8ed6569
ebf4a535fa6a88962621940e780ca0cd6707b6cdaed59f469f0aeada311d09d1
efe958151f0837002965e098124bf7c159236a74d0e9dbd0015ecbcf461f0810

www.ccfairfield.org Open in urlscan Pro 50.57.249.55 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

13 Requests

77 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

55 kBTransfer

201 kBSize

1 Cookies

3 Outgoing links

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

1 Cookies

Indicators

www.ccfairfield.org Open in urlscan Pro
50.57.249.55 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

77 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

55 kB
Transfer

201 kB
Size

1
Cookies

13 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!