www.smartregistrars.co.ke Open in urlscan Pro
104.27.137.224 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://www.smartregistrars.co.ke/wp-content/count-per-day-geoip/css/en_Wells%20_new/en_Wells%20_new/en/MEEE/long/online-account/s...
Submission: On March 25 via automatic, source openphish (March 25th 2018, 11:32:06 am UTC)

Summary HTTP 15 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 4 IPs in 1 countries across 3 domains to perform 15 HTTP transactions. The main IP is 104.27.137.224, located in San Francisco, United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is www.smartregistrars.co.ke.

This is the only time www.smartregistrars.co.ke was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Wells Fargo (Banking)

Domain & IP information

	IP Address	AS Autonomous System
2	104.27.137.224 104.27.137.224	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	104.19.196.102 104.19.196.102	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
12	159.45.66.180 159.45.66.180	4196 (WELLSFARG...) (WELLSFARGO-4196 - Wells Fargo & Company)
15	4

2 104.27.137.224 (San Francisco, United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

www.smartregistrars.co.ke	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.19.196.102 (San Francisco, United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

ajax.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 159.45.66.180 (Saint Louis, United States)

ASN4196 (WELLSFARGO-4196 - Wells Fargo & Company, US)

oam.wellsfargo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	wellsfargo.com oam.wellsfargo.com	56 KB
2	smartregistrars.co.ke www.smartregistrars.co.ke	4 KB
1	cloudflare.com ajax.cloudflare.com	32 KB
15	3

	Domain	Requested by
12	oam.wellsfargo.com	www.smartregistrars.co.ke
2	www.smartregistrars.co.ke	www.smartregistrars.co.ke
1	ajax.cloudflare.com	www.smartregistrars.co.ke
15	3

This site contains links to these domains. Also see Links.

Domain
www.wellsfargo.com

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://www.smartregistrars.co.ke/wp-content/count-per-day-geoip/css/en_Wells%20_new/en_Wells%20_new/en/MEEE/long/online-account/security/auth/1/contact.html?16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8
Frame ID: D7C860E084F6B5DF11EE5A120BDE72CA
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /cloudflare/i

Page Statistics

15
Requests

0 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

4
IPs

1
Countries

91 kB
Transfer

160 kB
Size

1
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://www.wellsfargo.com/security/security-online-banking
Title: Online Security Guarantee

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/privacy-security/
Title: | Privacy, Cookies, Security & Legal

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request Cookie set contact.html Show response
www.smartregistrars.co.ke/wp-content/count-per-day-geoip/css/en_Wells%20_new/en_Wells%20_new/en/MEEE/long/online-account/security/auth/1/ 7 KB
3 KB 33ms
27ms Document
text/html 104.27.137.224
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: http://www.smartregistrars.co.ke/wp-content/count-per-day-geoip/css/en_Wells%20_new/en_Wells%20_new/en/MEEE/long/online-account/security/auth/1/contact.html?16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8
Protocol: HTTP/1.1
Server: 104.27.137.224 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 00ba94c1b4891255b3cf894da0697ffbaf26b5ffc68b5c6cd880c502addae780

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: www.smartregistrars.co.ke
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Cache-Control: no-cache
Connection: keep-alive
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Sun, 25 Mar 2018 11:31:55 GMT
Content-Encoding: gzip
Last-Modified: Mon, 12 Feb 2018 19:49:56 GMT
Server: cloudflare
Transfer-Encoding: chunked
Content-Type: text/html
Set-Cookie: __cfduid=d1e3914b9eb2a36c0f89724b13b18f2801521977515; expires=Mon, 25-Mar-19 11:31:55 GMT; path=/; domain=.smartregistrars.co.ke; HttpOnly
Connection: keep-alive
CF-RAY: 40110dcf508c2690-FRA

GET
S 200 rocket.min.js Show response
ajax.cloudflare.com/cdn-cgi/scripts/935cb224/cloudflare-static/ 102 KB
32 KB 30ms
9ms Script
application/javascript 104.19.196.102
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.cloudflare.com/cdn-cgi/scripts/935cb224/cloudflare-static/rocket.min.js

Requested by

Host: www.smartregistrars.co.ke
URL: http://www.smartregistrars.co.ke/wp-content/count-per-day-geoip/css/en_Wells%20_new/en_Wells%20_new/en/MEEE/long/online-account/security/auth/1/contact.html?16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8

Protocol

SPDY

Server

104.19.196.102 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare-nginx /

Resource Hash

8a4a166fe00cbeae541569d1bcabe1bcbe25b55744d2004f461432c09a5921a1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://www.smartregistrars.co.ke/wp-content/count-per-day-geoip/css/en_Wells%20_new/en_Wells%20_new/en/MEEE/long/online-account/security/auth/1/contact.html?16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Sun, 25 Mar 2018 11:31:55 GMT
content-encoding: gzip
last-modified: Wed, 21 Mar 2018 11:59:47 GMT
server: cloudflare-nginx
etag: W/"5ab24933-1985d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: application/javascript
status: 200
cache-control: max-age=172800, public
strict-transport-security: max-age=15780000; includeSubDomains
cf-ray: 40110dd05973977a-FRA
expires: Tue, 27 Mar 2018 11:31:55 GMT

GET
H/1.1 200
OK theme.ssep.css
oam.wellsfargo.com/oam/static/css/ssep/ 12 KB
13 KB 628ms
245ms Stylesheet
text/css 159.45.66.180
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://oam.wellsfargo.com/oam/static/css/ssep/theme.ssep.css?v=E14F197F66

Requested by

Protocol

HTTP/1.1

Server

159.45.66.180 Saint Louis, United States, ASN4196 (WELLSFARGO-4196 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/1.1 /

Resource Hash

fd67dae89899f306faa88e597b5dea87183e55e86dc5fa7ab73aa5740ec08a1b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://www.smartregistrars.co.ke/wp-content/count-per-day-geoip/css/en_Wells%20_new/en_Wells%20_new/en/MEEE/long/online-account/security/auth/1/contact.html?16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Sun, 25 Mar 2018 11:31:56 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 06 Mar 2018 17:59:01 GMT
Server: KONICHIWA/1.1
X-Frame-Options: SAMEORIGIN
ETag: "5a9ed6e5-30b2"
Strict-Transport-Security: max-age=31536000; includeSubdomains;
Content-Type: text/css; charset=UTF-8
Cache-Control: no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 12466
X-XSS-Protection: 1; mode=block
Expires: Sat, 24 Mar 2018 11:31:56 GMT

GET
H/1.1 200
OK theme.ssep.header.css
oam.wellsfargo.com/oam/static/css/ssep/ 3 KB
3 KB 571ms
189ms Stylesheet
text/css 159.45.66.180
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://oam.wellsfargo.com/oam/static/css/ssep/theme.ssep.header.css?v=E14F197F66

Requested by

Protocol

HTTP/1.1

Server

159.45.66.180 Saint Louis, United States, ASN4196 (WELLSFARGO-4196 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/1.1 /

Resource Hash

406bc6d065147d3ea4e58097c9500ad9b4e3e294857bb141249d7a9e24f558ba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://www.smartregistrars.co.ke/wp-content/count-per-day-geoip/css/en_Wells%20_new/en_Wells%20_new/en/MEEE/long/online-account/security/auth/1/contact.html?16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Sun, 25 Mar 2018 11:31:56 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 06 Mar 2018 17:59:01 GMT
Server: KONICHIWA/1.1
X-Frame-Options: SAMEORIGIN
ETag: "5a9ed6e5-ad2"
Strict-Transport-Security: max-age=31536000; includeSubdomains;
Content-Type: text/css; charset=UTF-8
Cache-Control: no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2770
X-XSS-Protection: 1; mode=block
Expires: Sat, 24 Mar 2018 11:31:56 GMT

GET
H/1.1 200
OK theme.ssep.button.css
oam.wellsfargo.com/oam/static/css/ssep/ 2 KB
2 KB 564ms
182ms Stylesheet
text/css 159.45.66.180
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://oam.wellsfargo.com/oam/static/css/ssep/theme.ssep.button.css?v=E14F197F66

Requested by

Protocol

HTTP/1.1

Server

159.45.66.180 Saint Louis, United States, ASN4196 (WELLSFARGO-4196 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/1.1 /

Resource Hash

312b4c2218ba79e5042794126f67aeb39f5ce20645dc9c6856c2b660345fb63a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://www.smartregistrars.co.ke/wp-content/count-per-day-geoip/css/en_Wells%20_new/en_Wells%20_new/en/MEEE/long/online-account/security/auth/1/contact.html?16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Sun, 25 Mar 2018 11:31:56 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 06 Mar 2018 17:59:01 GMT
Server: KONICHIWA/1.1
X-Frame-Options: SAMEORIGIN
ETag: "5a9ed6e5-67b"
Strict-Transport-Security: max-age=31536000; includeSubdomains;
Content-Type: text/css; charset=UTF-8
Cache-Control: no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1659
X-XSS-Protection: 1; mode=block
Expires: Sat, 24 Mar 2018 11:31:56 GMT

GET
H/1.1 200
OK theme.ssep.messaging.css
oam.wellsfargo.com/oam/static/css/ssep/ 3 KB
4 KB 511ms
129ms Stylesheet
text/css 159.45.66.180
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://oam.wellsfargo.com/oam/static/css/ssep/theme.ssep.messaging.css?v=E14F197F66

Requested by

Protocol

HTTP/1.1

Server

159.45.66.180 Saint Louis, United States, ASN4196 (WELLSFARGO-4196 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/1.1 /

Resource Hash

5e332825c07298ea68b554f93e7ba7d994c6f9f62228b8567e9370af9e0ef5da

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://www.smartregistrars.co.ke/wp-content/count-per-day-geoip/css/en_Wells%20_new/en_Wells%20_new/en/MEEE/long/online-account/security/auth/1/contact.html?16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Sun, 25 Mar 2018 11:31:56 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 06 Mar 2018 17:59:01 GMT
Server: KONICHIWA/1.1
X-Frame-Options: SAMEORIGIN
ETag: "5a9ed6e5-d62"
Strict-Transport-Security: max-age=31536000; includeSubdomains;
Content-Type: text/css; charset=UTF-8
Cache-Control: no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3426
X-XSS-Protection: 1; mode=block
Expires: Sat, 24 Mar 2018 11:31:56 GMT

GET
H/1.1 200
OK theme.ssep.input.css
oam.wellsfargo.com/oam/static/css/ssep/ 1 KB
2 KB 514ms
129ms Stylesheet
text/css 159.45.66.180
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://oam.wellsfargo.com/oam/static/css/ssep/theme.ssep.input.css?v=E14F197F66

Requested by

Protocol

HTTP/1.1

Server

159.45.66.180 Saint Louis, United States, ASN4196 (WELLSFARGO-4196 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/1.1 /

Resource Hash

15a1c771dbbed834f8497627b7879a2f438bd4df5d3df8852c49e1f6581c479a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://www.smartregistrars.co.ke/wp-content/count-per-day-geoip/css/en_Wells%20_new/en_Wells%20_new/en/MEEE/long/online-account/security/auth/1/contact.html?16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Sun, 25 Mar 2018 11:31:56 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 06 Mar 2018 17:59:01 GMT
Server: KONICHIWA/1.1
X-Frame-Options: SAMEORIGIN
ETag: "5a9ed6e5-517"
Strict-Transport-Security: max-age=31536000; includeSubdomains;
Content-Type: text/css; charset=UTF-8
Cache-Control: no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1303
X-XSS-Protection: 1; mode=block
Expires: Sat, 24 Mar 2018 11:31:56 GMT

GET
H/1.1 200
OK theme.ssep.dropdown.selector.css
oam.wellsfargo.com/oam/static/css/ssep/ 6 KB
7 KB 581ms
194ms Stylesheet
text/css 159.45.66.180
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://oam.wellsfargo.com/oam/static/css/ssep/theme.ssep.dropdown.selector.css?v=E14F197F66

Requested by

Protocol

HTTP/1.1

Server

159.45.66.180 Saint Louis, United States, ASN4196 (WELLSFARGO-4196 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/1.1 /

Resource Hash

d97bba3cd654c4c2df13c0abc219e99691aad0276a6fd2287ca835f2f7b0214e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://www.smartregistrars.co.ke/wp-content/count-per-day-geoip/css/en_Wells%20_new/en_Wells%20_new/en/MEEE/long/online-account/security/auth/1/contact.html?16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Sun, 25 Mar 2018 11:31:56 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 06 Mar 2018 17:59:01 GMT
Server: KONICHIWA/1.1
X-Frame-Options: SAMEORIGIN
ETag: "5a9ed6e5-19e5"
Strict-Transport-Security: max-age=31536000; includeSubdomains;
Content-Type: text/css; charset=UTF-8
Cache-Control: no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 6629
X-XSS-Protection: 1; mode=block
Expires: Sat, 24 Mar 2018 11:31:56 GMT

GET
H/1.1 200
OK theme.ssep.popover.css
oam.wellsfargo.com/oam/static/css/ssep/ 6 KB
7 KB 643ms
132ms Stylesheet
text/css 159.45.66.180
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://oam.wellsfargo.com/oam/static/css/ssep/theme.ssep.popover.css?v=E14F197F66

Requested by

Protocol

HTTP/1.1

Server

159.45.66.180 Saint Louis, United States, ASN4196 (WELLSFARGO-4196 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/1.1 /

Resource Hash

115811d8a155b0f3166458ae733badcc826560e9d654e23c59c42565294ba04d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://www.smartregistrars.co.ke/wp-content/count-per-day-geoip/css/en_Wells%20_new/en_Wells%20_new/en/MEEE/long/online-account/security/auth/1/contact.html?16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Sun, 25 Mar 2018 11:31:56 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 06 Mar 2018 17:59:01 GMT
Server: KONICHIWA/1.1
X-Frame-Options: SAMEORIGIN
ETag: "5a9ed6e5-19c4"
Strict-Transport-Security: max-age=31536000; includeSubdomains;
Content-Type: text/css; charset=UTF-8
Cache-Control: no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 6596
X-XSS-Protection: 1; mode=block
Expires: Sat, 24 Mar 2018 11:31:56 GMT

GET
H/1.1 200
OK theme.ssep.tabs.css
oam.wellsfargo.com/oam/static/css/ssep/ 8 KB
8 KB 647ms
132ms Stylesheet
text/css 159.45.66.180
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://oam.wellsfargo.com/oam/static/css/ssep/theme.ssep.tabs.css?v=E14F197F66

Requested by

Protocol

HTTP/1.1

Server

159.45.66.180 Saint Louis, United States, ASN4196 (WELLSFARGO-4196 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/1.1 /

Resource Hash

a0686edbc495d60b175d648c206ff79ebc360b5173c139937eb3ae9c54adba71

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://www.smartregistrars.co.ke/wp-content/count-per-day-geoip/css/en_Wells%20_new/en_Wells%20_new/en/MEEE/long/online-account/security/auth/1/contact.html?16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Sun, 25 Mar 2018 11:31:56 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 06 Mar 2018 17:59:01 GMT
Server: KONICHIWA/1.1
X-Frame-Options: SAMEORIGIN
ETag: "5a9ed6e5-1e24"
Strict-Transport-Security: max-age=31536000; includeSubdomains;
Content-Type: text/css; charset=UTF-8
Cache-Control: no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 7716
X-XSS-Protection: 1; mode=block
Expires: Sat, 24 Mar 2018 11:31:56 GMT

GET
H/1.1 200
OK theme.ssep.timeout.css
oam.wellsfargo.com/oam/static/css/ssep/ 1 KB
2 KB 691ms
127ms Stylesheet
text/css 159.45.66.180
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://oam.wellsfargo.com/oam/static/css/ssep/theme.ssep.timeout.css?v=E14F197F66

Requested by

Protocol

HTTP/1.1

Server

159.45.66.180 Saint Louis, United States, ASN4196 (WELLSFARGO-4196 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/1.1 /

Resource Hash

9fd6c5aa6c7585c1e5e3f3a08b673813b06220d94d8b6da24b491fc03e5f968c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://www.smartregistrars.co.ke/wp-content/count-per-day-geoip/css/en_Wells%20_new/en_Wells%20_new/en/MEEE/long/online-account/security/auth/1/contact.html?16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Sun, 25 Mar 2018 11:31:56 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 06 Mar 2018 17:59:01 GMT
Server: KONICHIWA/1.1
X-Frame-Options: SAMEORIGIN
ETag: "5a9ed6e5-5d9"
Strict-Transport-Security: max-age=31536000; includeSubdomains;
Content-Type: text/css; charset=UTF-8
Cache-Control: no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1497
X-XSS-Protection: 1; mode=block
Expires: Sat, 24 Mar 2018 11:31:56 GMT

GET
H/1.1 200
OK theme.ssep.twofa.css
oam.wellsfargo.com/oam/static/css/twofa/ 5 KB
5 KB 701ms
129ms Stylesheet
text/css 159.45.66.180
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://oam.wellsfargo.com/oam/static/css/twofa/theme.ssep.twofa.css?v=E14F197F66

Requested by

Protocol

HTTP/1.1

Server

159.45.66.180 Saint Louis, United States, ASN4196 (WELLSFARGO-4196 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/1.1 /

Resource Hash

88308e57087c81e0b0a5f02c3d9c33a06ce0d2154cdedf8ae075944de10e4aff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://www.smartregistrars.co.ke/wp-content/count-per-day-geoip/css/en_Wells%20_new/en_Wells%20_new/en/MEEE/long/online-account/security/auth/1/contact.html?16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Sun, 25 Mar 2018 11:31:56 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 06 Mar 2018 17:59:01 GMT
Server: KONICHIWA/1.1
X-Frame-Options: SAMEORIGIN
ETag: "5a9ed6e5-1413"
Strict-Transport-Security: max-age=31536000; includeSubdomains;
Content-Type: text/css; charset=UTF-8
Cache-Control: no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 5139
X-XSS-Protection: 1; mode=block
Expires: Sat, 24 Mar 2018 11:31:56 GMT

GET
H/1.1 200
OK shim.gif
oam.wellsfargo.com/oam/static/images/ 43 B
505 B 460ms
460ms Image
image/gif 159.45.66.180
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://oam.wellsfargo.com/oam/static/images/shim.gif

Requested by

Protocol

HTTP/1.1

Server

159.45.66.180 Saint Louis, United States, ASN4196 (WELLSFARGO-4196 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/1.1 /

Resource Hash

89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://www.smartregistrars.co.ke/wp-content/count-per-day-geoip/css/en_Wells%20_new/en_Wells%20_new/en/MEEE/long/online-account/security/auth/1/contact.html?16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Sun, 25 Mar 2018 11:31:56 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 06 Mar 2018 17:59:02 GMT
Server: KONICHIWA/1.1
X-Frame-Options: SAMEORIGIN
ETag: "5a9ed6e6-2b"
Strict-Transport-Security: max-age=31536000; includeSubdomains;
Content-Type: image/gif
Cache-Control: no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
X-XSS-Protection: 1; mode=block
Expires: Sat, 24 Mar 2018 11:31:56 GMT

GET
H/1.1 404
Not Found icn-ind-lock.png
www.smartregistrars.co.ke/oam/static/images/ 649 B
649 B 20ms
20ms Image
text/html 104.27.137.224
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.smartregistrars.co.ke/oam/static/images/icn-ind-lock.png
Requested by: Host: www.smartregistrars.co.ke
URL: http://www.smartregistrars.co.ke/wp-content/count-per-day-geoip/css/en_Wells%20_new/en_Wells%20_new/en/MEEE/long/online-account/security/auth/1/contact.html?16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8
Protocol: HTTP/1.1
Server: 104.27.137.224 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: c8ecef16600766b7e0eafce8791e4c3fa0d8e0a85301f32e99bd00c0e327ea0c

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: www.smartregistrars.co.ke
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://www.smartregistrars.co.ke/wp-content/count-per-day-geoip/css/en_Wells%20_new/en_Wells%20_new/en/MEEE/long/online-account/security/auth/1/contact.html?16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8
Cookie: __cfduid=d1e3914b9eb2a36c0f89724b13b18f2801521977515
Connection: keep-alive
Cache-Control: no-cache
Referer: http://www.smartregistrars.co.ke/wp-content/count-per-day-geoip/css/en_Wells%20_new/en_Wells%20_new/en/MEEE/long/online-account/security/auth/1/contact.html?16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8-16eee28915e2455fe7c0412b96359fe8
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Sun, 25 Mar 2018 11:31:56 GMT
Content-Encoding: gzip
CF-Cache-Status: EXPIRED
Server: cloudflare
Vary: Accept-Encoding
Content-Type: text/html; charset=iso-8859-1
Cache-Control: public, max-age=86400
Transfer-Encoding: chunked
Connection: keep-alive
CF-RAY: 40110dd491ba2690-FRA
Expires: Mon, 26 Mar 2018 11:31:56 GMT

GET
DATA 200
OK truncated
/ 270 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e2f1104899a430463d7632028c7b5cd2716148d65e7be31302449540190cce84

Request headers

Response headers

Access-Control-Allow-Origin: *
Content-Type: image/png

GET
H/1.1 200
OK icn-img-wf-logo-large-glob-232x20-096741-v01_01@1x.png
oam.wellsfargo.com/oam/static/images/ 2 KB
3 KB 126ms
126ms Image
image/png 159.45.66.180
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://oam.wellsfargo.com/oam/static/images/icn-img-wf-logo-large-glob-232x20-096741-v01_01@1x.png

Requested by

Protocol

HTTP/1.1

Server

159.45.66.180 Saint Louis, United States, ASN4196 (WELLSFARGO-4196 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/1.1 /

Resource Hash

1905884317b7966c4f1751ee4cb9b3b1475e09dec8ffab9e6f5cc0a007c68d36

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://oam.wellsfargo.com/oam/static/css/ssep/theme.ssep.header.css?v=E14F197F66
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Sun, 25 Mar 2018 11:31:56 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 06 Mar 2018 17:59:02 GMT
Server: KONICHIWA/1.1
X-Frame-Options: SAMEORIGIN
ETag: "5a9ed6e6-870"
Strict-Transport-Security: max-age=31536000; includeSubdomains;
Content-Type: image/png
Cache-Control: no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2160
X-XSS-Protection: 1; mode=block
Expires: Sat, 24 Mar 2018 11:31:56 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Wells Fargo (Banking)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| __cfRocketOptions object| __cfRl

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.smartregistrars.co.ke/	1970-01-18 23:31:53	Name: __cfduid Value: d1e3914b9eb2a36c0f89724b13b18f2801521977515

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.cloudflare.com
oam.wellsfargo.com
www.smartregistrars.co.ke
104.19.196.102
104.27.137.224
159.45.66.180
00ba94c1b4891255b3cf894da0697ffbaf26b5ffc68b5c6cd880c502addae780
115811d8a155b0f3166458ae733badcc826560e9d654e23c59c42565294ba04d
15a1c771dbbed834f8497627b7879a2f438bd4df5d3df8852c49e1f6581c479a
1905884317b7966c4f1751ee4cb9b3b1475e09dec8ffab9e6f5cc0a007c68d36
312b4c2218ba79e5042794126f67aeb39f5ce20645dc9c6856c2b660345fb63a
406bc6d065147d3ea4e58097c9500ad9b4e3e294857bb141249d7a9e24f558ba
5e332825c07298ea68b554f93e7ba7d994c6f9f62228b8567e9370af9e0ef5da
88308e57087c81e0b0a5f02c3d9c33a06ce0d2154cdedf8ae075944de10e4aff
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
8a4a166fe00cbeae541569d1bcabe1bcbe25b55744d2004f461432c09a5921a1
9fd6c5aa6c7585c1e5e3f3a08b673813b06220d94d8b6da24b491fc03e5f968c
a0686edbc495d60b175d648c206ff79ebc360b5173c139937eb3ae9c54adba71
c8ecef16600766b7e0eafce8791e4c3fa0d8e0a85301f32e99bd00c0e327ea0c
d97bba3cd654c4c2df13c0abc219e99691aad0276a6fd2287ca835f2f7b0214e
e2f1104899a430463d7632028c7b5cd2716148d65e7be31302449540190cce84
fd67dae89899f306faa88e597b5dea87183e55e86dc5fa7ab73aa5740ec08a1b

www.smartregistrars.co.ke Open in urlscan Pro 104.27.137.224 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

15 Requests

0 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

4 IPs

1 Countries

91 kBTransfer

160 kBSize

1 Cookies

2 Outgoing links

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

1 Cookies

Indicators

www.smartregistrars.co.ke Open in urlscan Pro
104.27.137.224 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

0 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

4
IPs

1
Countries

91 kB
Transfer

160 kB
Size

1
Cookies

15 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!