seatonsleep.com Open in urlscan Pro
70.32.23.39 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://seatonsleep.com/bro/wells.htm
Submission: On October 18 via api (October 18th 2020, 2:37:03 am UTC) from QA

Summary HTTP 14 Redirects Links 14 Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 14 HTTP transactions. The main IP is 70.32.23.39, located in Ann Arbor, United States and belongs to A2HOSTING, US. The main domain is seatonsleep.com.

This is the only time seatonsleep.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Wells Fargo (Banking)

Domain & IP information

	IP Address	AS Autonomous System
13	70.32.23.39 70.32.23.39	55293 (A2HOSTING) (A2HOSTING)
1	159.45.66.156 159.45.66.156	4196 (WELLSFARG...) (WELLSFARGO-4196)
14	2

13 70.32.23.39 (Ann Arbor, United States)

ASN55293 (A2HOSTING, US)
PTR: mi3-sr21.supercp.com

seatonsleep.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 159.45.66.156 (Charlotte, United States)

ASN4196 (WELLSFARGO-4196, US)

connect.secure.wellsfargo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
13	seatonsleep.com seatonsleep.com	91 KB
1	wellsfargo.com connect.secure.wellsfargo.com	17 KB
14	2

	Domain	Requested by
13	seatonsleep.com	seatonsleep.com
1	connect.secure.wellsfargo.com	seatonsleep.com
14	2

This site contains links to these domains. Also see Links.

Domain
www.wellsfargo.com

Subject Issuer	Validity	Valid
connect.secure.wellsfargo.com DigiCert EV RSA CA G2	`2020-07-09` - `2022-07-14`	2 years	crt.sh

This page contains 1 frames:

Primary Page: http://seatonsleep.com/bro/wells.htm
Frame ID: 2B4860EBF4E84B39050F189EC8376071
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

14
Requests

7 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

108 kB
Transfer

286 kB
Size

0
Cookies

14 Outgoing links

These are links going to different origins than the main page.

URL: https://www.wellsfargo.com/
Title:

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/help/
Title: Customer Service

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/locator/
Title: Locations

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/products_services/applications_viewall.jhtml
Title: Apply

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/commitment
Title: Learn More

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/commitment/faqs/
Title: Frequently asked questions >

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/help/faqs/sign-on
Title: Email Security Help

Search URL Search Domain Scan URL

URL: http://www.wellsfargo.com/agreement
Title: www.wellsfargo.com/agreement

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/about/
Title: About Wells Fargo

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/careers/
Title: Careers

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/privacy-security/
Title: Privacy, Security & Legal

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/privacy-security/fraud/report/phish
Title: Report Email Fraud

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/sitemap
Title: Sitemap

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/privacy-security/privacy/online#adchoices
Title: Ad Choices

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request wells.htm Show response
seatonsleep.com/bro/ 10 KB
11 KB 359ms
217ms Document
text/html 70.32.23.39
A2HOSTING

General

Check archive.org

Show headers Download Go to

Full URL

http://seatonsleep.com/bro/wells.htm

Protocol

HTTP/1.1

Server

70.32.23.39 Ann Arbor, United States, ASN55293 (A2HOSTING, US),

Reverse DNS

mi3-sr21.supercp.com

Software

Apache /

Resource Hash

26d94edf713aafdfae27a7cab434d76fee10ba25ebaa3395b3ba3c028927493a

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Host: seatonsleep.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sun, 18 Oct 2020 02:36:46 GMT
Server: Apache
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Last-Modified: Sat, 06 Jul 2019 16:50:08 GMT
Accept-Ranges: bytes
Content-Length: 10537
Cache-Control: max-age=3600, must-revalidate
Keep-Alive: timeout=3, max=500
Connection: Keep-Alive
Content-Type: text/html

GET
H/1.1 200
OK nd Show response
seatonsleep.com/bro/wells_files/ 39 KB
39 KB 231ms
216ms Script
text/plain 70.32.23.39
A2HOSTING

General

Check archive.org

Show headers Download Go to

Full URL

http://seatonsleep.com/bro/wells_files/nd

Requested by

Host: seatonsleep.com
URL: http://seatonsleep.com/bro/wells.htm

Protocol

HTTP/1.1

Server

70.32.23.39 Ann Arbor, United States, ASN55293 (A2HOSTING, US),

Reverse DNS

mi3-sr21.supercp.com

Software

Apache /

Resource Hash

ffc539eb345f9466fecbe7b7ea8d2db0f56ef3857c8b26159d9a230bf9afdb4a

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://seatonsleep.com/bro/wells.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sun, 18 Oct 2020 02:36:46 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 06 Feb 2018 21:42:16 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
Connection: Keep-Alive
Strict-Transport-Security: max-age=63072000; includeSubDomains
Accept-Ranges: bytes
Keep-Alive: timeout=3, max=500
Content-Length: 39657

GET
H/1.1 200
OK signonCommitment.css
seatonsleep.com/bro/wells_files/ 6 KB
2 KB 118ms
117ms Stylesheet
text/css 70.32.23.39
A2HOSTING

General

Check archive.org

Show headers Download Go to

Full URL

http://seatonsleep.com/bro/wells_files/signonCommitment.css

Requested by

Host: seatonsleep.com
URL: http://seatonsleep.com/bro/wells.htm

Protocol

HTTP/1.1

Server

70.32.23.39 Ann Arbor, United States, ASN55293 (A2HOSTING, US),

Reverse DNS

mi3-sr21.supercp.com

Software

Apache /

Resource Hash

7c21a45f9e10b50948faf43421ae13f1a49c75c9e44604c63b9bd1c34075d474

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://seatonsleep.com/bro/wells.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sun, 18 Oct 2020 02:36:46 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Tue, 06 Feb 2018 21:42:16 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
Connection: Keep-Alive
Content-Type: text/css
Cache-Control: max-age=604800, public
Strict-Transport-Security: max-age=63072000; includeSubDomains
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Length: 1582
Keep-Alive: timeout=3, max=499

GET
H/1.1 200
OK theme.css
seatonsleep.com/bro/wells_files/ 8 KB
2 KB 232ms
218ms Stylesheet
text/css 70.32.23.39
A2HOSTING

General

Check archive.org

Show headers Download Go to

Full URL

http://seatonsleep.com/bro/wells_files/theme.css

Requested by

Host: seatonsleep.com
URL: http://seatonsleep.com/bro/wells.htm

Protocol

HTTP/1.1

Server

70.32.23.39 Ann Arbor, United States, ASN55293 (A2HOSTING, US),

Reverse DNS

mi3-sr21.supercp.com

Software

Apache /

Resource Hash

f82a7a512d314b7ce4c4bbab30c4528e0c3136514b694ca53213f06b246b273c

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://seatonsleep.com/bro/wells.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sun, 18 Oct 2020 02:36:46 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Tue, 06 Feb 2018 21:42:16 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
Connection: Keep-Alive
Content-Type: text/css
Cache-Control: max-age=604800, public
Strict-Transport-Security: max-age=63072000; includeSubDomains
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Length: 1605
Keep-Alive: timeout=3, max=500

GET
H/1.1 200
OK login-userprefs.js Show response
seatonsleep.com/bro/wells_files/ 144 KB
24 KB 239ms
224ms Script
application/javascript 70.32.23.39
A2HOSTING

General

Check archive.org

Show headers Download Go to

Full URL

http://seatonsleep.com/bro/wells_files/login-userprefs.js

Requested by

Host: seatonsleep.com
URL: http://seatonsleep.com/bro/wells.htm

Protocol

HTTP/1.1

Server

70.32.23.39 Ann Arbor, United States, ASN55293 (A2HOSTING, US),

Reverse DNS

mi3-sr21.supercp.com

Software

Apache /

Resource Hash

1b1b1c060912cb94b0db47fb6740b14ca96f731b0f1125bae5130a83e92d5f07

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://seatonsleep.com/bro/wells.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sun, 18 Oct 2020 02:36:46 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Tue, 06 Feb 2018 21:42:16 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
Connection: Keep-Alive
Content-Type: application/javascript
Cache-Control: max-age=604800, public
Strict-Transport-Security: max-age=63072000; includeSubDomains
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Length: 24572
Keep-Alive: timeout=3, max=500

GET
H/1.1 200
OK conutils-6.js Show response
seatonsleep.com/bro/wells_files/ 10 KB
4 KB 231ms
217ms Script
application/javascript 70.32.23.39
A2HOSTING

General

Check archive.org

Show headers Download Go to

Full URL

http://seatonsleep.com/bro/wells_files/conutils-6.js

Requested by

Host: seatonsleep.com
URL: http://seatonsleep.com/bro/wells.htm

Protocol

HTTP/1.1

Server

70.32.23.39 Ann Arbor, United States, ASN55293 (A2HOSTING, US),

Reverse DNS

mi3-sr21.supercp.com

Software

Apache /

Resource Hash

3313ac9f2c148df9dc8581ae4d7bb9023c3ef933d1152db47de29e32ec5f67b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://seatonsleep.com/bro/wells.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sun, 18 Oct 2020 02:36:46 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Tue, 06 Feb 2018 21:42:16 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
Connection: Keep-Alive
Content-Type: application/javascript
Cache-Control: max-age=604800, public
Strict-Transport-Security: max-age=63072000; includeSubDomains
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Length: 3897
Keep-Alive: timeout=3, max=500

GET
H/1.1 200
OK atadun.js Show response
seatonsleep.com/bro/wells_files/ 1 KB
970 B 231ms
217ms Script
application/javascript 70.32.23.39
A2HOSTING

General

Check archive.org

Show headers Download Go to

Full URL

http://seatonsleep.com/bro/wells_files/atadun.js

Requested by

Host: seatonsleep.com
URL: http://seatonsleep.com/bro/wells.htm

Protocol

HTTP/1.1

Server

70.32.23.39 Ann Arbor, United States, ASN55293 (A2HOSTING, US),

Reverse DNS

mi3-sr21.supercp.com

Software

Apache /

Resource Hash

5fb7b85658a6e615400e0f1f3e16fc869bbd099b3c3c181c294c05d1d7d1cfe5

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://seatonsleep.com/bro/wells.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sun, 18 Oct 2020 02:36:46 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Tue, 06 Feb 2018 21:42:16 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
Connection: Keep-Alive
Content-Type: application/javascript
Cache-Control: max-age=604800, public
Strict-Transport-Security: max-age=63072000; includeSubDomains
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Length: 503
Keep-Alive: timeout=3, max=500

GET
H/1.1 200
OK wflogo-gfrewards.png
seatonsleep.com/bro/wells_files/ 20 KB
7 KB 117ms
116ms Image
image/png 70.32.23.39
A2HOSTING

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://seatonsleep.com/bro/wells_files/wflogo-gfrewards.png

Requested by

Host: seatonsleep.com
URL: http://seatonsleep.com/bro/wells.htm

Protocol

HTTP/1.1

Server

70.32.23.39 Ann Arbor, United States, ASN55293 (A2HOSTING, US),

Reverse DNS

mi3-sr21.supercp.com

Software

Apache /

Resource Hash

8acab8f477754cb0846b2eca8bfea7c4e5a0e3a5348a3ff69fe67bfaef42b8ab

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://seatonsleep.com/bro/wells.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sun, 18 Oct 2020 02:36:46 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Tue, 06 Feb 2018 21:42:16 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
Connection: Keep-Alive
Content-Type: image/png
Cache-Control: max-age=604800, public
Strict-Transport-Security: max-age=63072000; includeSubDomains
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Length: 6835
Keep-Alive: timeout=3, max=499

GET
H/1.1 404
Not Found conutils-6.2.2.js
seatonsleep.com/auth/static/scripts/ 0
0 116ms
115ms Script
text/html 70.32.23.39
A2HOSTING

General

Check archive.org

Show headers Download Go to

Full URL

http://seatonsleep.com/auth/static/scripts/conutils-6.2.2.js

Requested by

Host: seatonsleep.com
URL: http://seatonsleep.com/bro/wells_files/login-userprefs.js

Protocol

HTTP/1.1

Server

70.32.23.39 Ann Arbor, United States, ASN55293 (A2HOSTING, US),

Reverse DNS

mi3-sr21.supercp.com

Software

Apache /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://seatonsleep.com/bro/wells.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sun, 18 Oct 2020 02:36:46 GMT
X-Content-Type-Options: nosniff
Server: Apache
X-Frame-Options: SAMEORIGIN
Content-Type: text/html; charset=iso-8859-1
Connection: Keep-Alive
Strict-Transport-Security: max-age=63072000; includeSubDomains
Keep-Alive: timeout=3, max=499
Content-Length: 315

GET
H/1.1 404
Not Found atadun.js
seatonsleep.com/auth/static/prefs/ 0
0 116ms
116ms Script
text/html 70.32.23.39
A2HOSTING

General

Check archive.org

Show headers Download Go to

Full URL

http://seatonsleep.com/auth/static/prefs/atadun.js

Requested by

Host: seatonsleep.com
URL: http://seatonsleep.com/bro/wells_files/login-userprefs.js

Protocol

HTTP/1.1

Server

70.32.23.39 Ann Arbor, United States, ASN55293 (A2HOSTING, US),

Reverse DNS

mi3-sr21.supercp.com

Software

Apache /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://seatonsleep.com/bro/wells.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sun, 18 Oct 2020 02:36:46 GMT
X-Content-Type-Options: nosniff
Server: Apache
X-Frame-Options: SAMEORIGIN
Content-Type: text/html; charset=iso-8859-1
Connection: Keep-Alive
Strict-Transport-Security: max-age=63072000; includeSubDomains
Keep-Alive: timeout=3, max=499
Content-Length: 315

GET
H/1.1 200 nd Show response
connect.secure.wellsfargo.com/jenny/ 47 KB
17 KB 565ms
131ms Script
application/javascript 159.45.66.156
WELLSFARGO-4196

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.secure.wellsfargo.com/jenny/nd

Requested by

Host: seatonsleep.com
URL: http://seatonsleep.com/bro/wells_files/atadun.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

159.45.66.156 Charlotte, United States, ASN4196 (WELLSFARGO-4196, US),

Reverse DNS

Software

KONICHIWA/1.1 /

Resource Hash

a1b9634a012197019babd09ff2e1c0d42eb609cb7dfa6b9f62b43af60162f4d3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: http://seatonsleep.com/bro/wells.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: KONICHIWA/1.1
Date: Sun, 18 Oct 2020 02:36:46 GMT
X-Frame-Options: DENY
Content-Type: application/javascript;charset=ISO-8859-1
Transfer-Encoding: chunked
Connection: keep-alive
vary: accept-encoding
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=600

GET
H/1.1 404
Not Found search_corner.gif
seatonsleep.com/bro/wells_files/images/ 315 B
315 B 116ms
116ms Image
text/html 70.32.23.39
A2HOSTING

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://seatonsleep.com/bro/wells_files/images/search_corner.gif

Requested by

Host: seatonsleep.com
URL: http://seatonsleep.com/bro/wells_files/signonCommitment.css

Protocol

HTTP/1.1

Server

70.32.23.39 Ann Arbor, United States, ASN55293 (A2HOSTING, US),

Reverse DNS

mi3-sr21.supercp.com

Software

Apache /

Resource Hash

d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://seatonsleep.com/bro/wells_files/signonCommitment.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sun, 18 Oct 2020 02:36:46 GMT
X-Content-Type-Options: nosniff
Server: Apache
X-Frame-Options: SAMEORIGIN
Content-Type: text/html; charset=iso-8859-1
Connection: Keep-Alive
Strict-Transport-Security: max-age=63072000; includeSubDomains
Keep-Alive: timeout=3, max=498
Content-Length: 315

GET
H/1.1 404
Not Found btn_blueslice.gif
seatonsleep.com/bro/wells_files/images/ 315 B
315 B 116ms
116ms Image
text/html 70.32.23.39
A2HOSTING

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://seatonsleep.com/bro/wells_files/images/btn_blueslice.gif

Requested by

Host: seatonsleep.com
URL: http://seatonsleep.com/bro/wells_files/signonCommitment.css

Protocol

HTTP/1.1

Server

70.32.23.39 Ann Arbor, United States, ASN55293 (A2HOSTING, US),

Reverse DNS

mi3-sr21.supercp.com

Software

Apache /

Resource Hash

d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://seatonsleep.com/bro/wells_files/signonCommitment.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sun, 18 Oct 2020 02:36:46 GMT
X-Content-Type-Options: nosniff
Server: Apache
X-Frame-Options: SAMEORIGIN
Content-Type: text/html; charset=iso-8859-1
Connection: Keep-Alive
Strict-Transport-Security: max-age=63072000; includeSubDomains
Keep-Alive: timeout=3, max=498
Content-Length: 315

GET
H/1.1 404
Not Found wellsfargo-storefront_outdoors-street_cars-and-people-crossing_722x185.png
seatonsleep.com/images/ 315 B
315 B 116ms
115ms Image
text/html 70.32.23.39
A2HOSTING

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://seatonsleep.com/images/wellsfargo-storefront_outdoors-street_cars-and-people-crossing_722x185.png

Requested by

Host: seatonsleep.com
URL: http://seatonsleep.com/bro/wells_files/theme.css

Protocol

HTTP/1.1

Server

70.32.23.39 Ann Arbor, United States, ASN55293 (A2HOSTING, US),

Reverse DNS

mi3-sr21.supercp.com

Software

Apache /

Resource Hash

d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://seatonsleep.com/bro/wells_files/theme.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sun, 18 Oct 2020 02:36:46 GMT
X-Content-Type-Options: nosniff
Server: Apache
X-Frame-Options: SAMEORIGIN
Content-Type: text/html; charset=iso-8859-1
Connection: Keep-Alive
Strict-Transport-Security: max-age=63072000; includeSubDomains
Keep-Alive: timeout=3, max=498
Content-Length: 315

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Wells Fargo (Banking)

108 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

connect.secure.wellsfargo.com
seatonsleep.com
159.45.66.156
70.32.23.39
1b1b1c060912cb94b0db47fb6740b14ca96f731b0f1125bae5130a83e92d5f07
26d94edf713aafdfae27a7cab434d76fee10ba25ebaa3395b3ba3c028927493a
3313ac9f2c148df9dc8581ae4d7bb9023c3ef933d1152db47de29e32ec5f67b0
5fb7b85658a6e615400e0f1f3e16fc869bbd099b3c3c181c294c05d1d7d1cfe5
7c21a45f9e10b50948faf43421ae13f1a49c75c9e44604c63b9bd1c34075d474
8acab8f477754cb0846b2eca8bfea7c4e5a0e3a5348a3ff69fe67bfaef42b8ab
a1b9634a012197019babd09ff2e1c0d42eb609cb7dfa6b9f62b43af60162f4d3
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
f82a7a512d314b7ce4c4bbab30c4528e0c3136514b694ca53213f06b246b273c
ffc539eb345f9466fecbe7b7ea8d2db0f56ef3857c8b26159d9a230bf9afdb4a

seatonsleep.com Open in urlscan Pro 70.32.23.39 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

14 Requests

7 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

1 Countries

108 kBTransfer

286 kBSize

0 Cookies

14 Outgoing links

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

108 JavaScript Global Variables

0 Cookies

Security Headers

Indicators

seatonsleep.com Open in urlscan Pro
70.32.23.39 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

7 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

108 kB
Transfer

286 kB
Size

0
Cookies

14 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!