group99.net Open in urlscan Pro
104.168.58.141 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://group99.net/k/submit_page.php
Effective URL:
http://group99.net/k/finish.html
Submission: On July 12 via automatic, source openphish (July 12th 2019, 6:03:52 pm UTC)

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 12 HTTP transactions. The main IP is 104.168.58.141, located in Buffalo, United States and belongs to AS-COLOCROSSING - ColoCrossing, US. The main domain is group99.net.

This is the only time group99.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Wells Fargo (Banking)

Domain & IP information

	IP Address		AS Autonomous System
1 12	104.168.58.141 104.168.58.141		36352 (AS-COLOCR...) (AS-COLOCROSSING - ColoCrossing)
12	2

12 104.168.58.141 (Buffalo, United States) 1 redirects

ASN36352 (AS-COLOCROSSING - ColoCrossing, US)
PTR: server.webhostingwithus.com

group99.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	group99.net 1 redirects group99.net	140 KB
0	wellsfargo.com Failed www.wellsfargo.com Failed
12	2

	Domain	Requested by
12	group99.net	1 redirects group99.net
0	www.wellsfargo.com Failed
12	2

This site contains no links.

Subject Issuer	Validity	Valid
	`1970-01-01` - `1970-01-01`	a few seconds	crt.sh

This page contains 1 frames:

Frame: https://www.wellsfargo.com/goals-credit/smarter-credit/good-credit-habits/
Frame ID: 269FCB65DABAC5A71725DA991E8AC982
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://group99.net/k/submit_page.php HTTP 302
http://group99.net/k/finish.html Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Page Statistics

12
Requests

0 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

139 kB
Transfer

138 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://group99.net/k/submit_page.php HTTP 302
http://group99.net/k/finish.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request finish.html Show response group99.net/k/ Redirect Chain http://group99.net/k/submit_page.php http://group99.net/k/finish.html	4 KB 4 KB	117ms 111ms	Document text/html	104.168.58.141 ColoCrossing
General Check archive.org Show headers Download Go to Full URL http://group99.net/k/finish.html Protocol HTTP/1.1 Server 104.168.58.141 Buffalo, United States, ASN36352 (AS-COLOCROSSING - ColoCrossing, US), Reverse DNS server.webhostingwithus.com Software Apache / Resource Hash `dcd3ee5e1441dddc80287f758068aee7c31471170744000d1b60799ff5f909cd` Request headers Host group99.net Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3 Accept-Encoding gzip, deflate Cookie PHPSESSID=njihvr4vrqp4iau8f6oglcde40 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 12 Jul 2019 18:03:15 GMT Server Apache Last-Modified Thu, 11 Jul 2019 13:42:28 GMT Accept-Ranges bytes Content-Length 4270 Keep-Alive timeout=5, max=99 Connection Keep-Alive Content-Type text/html Redirect headers Date Fri, 12 Jul 2019 18:03:15 GMT Server Apache Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma no-cache Set-Cookie PHPSESSID=njihvr4vrqp4iau8f6oglcde40; path=/ Location finish.html Keep-Alive timeout=5, max=100 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	vudu.css group99.net/k/css/	26 KB 26 KB	110ms 109ms	Stylesheet text/css	104.168.58.141 ColoCrossing
General Check archive.org Show headers Download Go to Full URL http://group99.net/k/css/vudu.css Requested by Host: group99.net URL: http://group99.net/k/finish.html Protocol HTTP/1.1 Security , , Server 104.168.58.141 Buffalo, United States, ASN36352 (AS-COLOCROSSING - ColoCrossing, US), Reverse DNS server.webhostingwithus.com Software Apache / Resource Hash `3f32fabf32147846d06d0d451ac9a41dcef278f09683a7b05c95e04f9a055a2e` Request headers Referer http://group99.net/k/finish.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 12 Jul 2019 18:03:15 GMT Last-Modified Thu, 09 Jul 2015 21:25:10 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 26574
GET H/1.1	200 OK	wibscreen.css group99.net/k/css/	105 KB 105 KB	326ms 108ms	Stylesheet text/css	104.168.58.141 ColoCrossing
General Check archive.org Show headers Download Go to Full URL http://group99.net/k/css/wibscreen.css Requested by Host: group99.net URL: http://group99.net/k/finish.html Protocol HTTP/1.1 Security , , Server 104.168.58.141 Buffalo, United States, ASN36352 (AS-COLOCROSSING - ColoCrossing, US), Reverse DNS server.webhostingwithus.com Software Apache / Resource Hash `2900cd456f4ce61ba29f48fc7086a271d946077efa26c7927c65c19e293120ec` Request headers Referer http://group99.net/k/finish.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 12 Jul 2019 18:03:15 GMT Last-Modified Thu, 09 Jul 2015 21:25:22 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 107454
GET H/1.1	404 Not Found	mm.css group99.net/k/css/	0 0	760ms 109ms	Stylesheet text/html	104.168.58.141 ColoCrossing
General Check archive.org Show headers Download Go to Full URL http://group99.net/k/css/mm.css Requested by Host: group99.net URL: http://group99.net/k/finish.html Protocol HTTP/1.1 Security , , Server 104.168.58.141 Buffalo, United States, ASN36352 (AS-COLOCROSSING - ColoCrossing, US), Reverse DNS server.webhostingwithus.com Software Apache / Resource Hash Request headers Referer http://group99.net/k/finish.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 12 Jul 2019 18:03:16 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=96 Content-Length 329 Content-Type text/html; charset=iso-8859-1
GET H/1.1	404 Not Found	shim.gif group99.net/k/img/	331 B 331 B	869ms 109ms	Image text/html	104.168.58.141 ColoCrossing
General Check archive.org Show headers Download Go to Show image Full URL http://group99.net/k/img/shim.gif Requested by Host: group99.net URL: http://group99.net/k/finish.html Protocol HTTP/1.1 Security , , Server 104.168.58.141 Buffalo, United States, ASN36352 (AS-COLOCROSSING - ColoCrossing, US), Reverse DNS server.webhostingwithus.com Software Apache / Resource Hash `c757116f421565c1ea86e8934fc85e5625dec837dc312dd998b35c1598e2d36d` Request headers Referer http://group99.net/k/finish.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 12 Jul 2019 18:03:16 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=95 Content-Length 331 Content-Type text/html; charset=iso-8859-1
GET H/1.1	200 OK	logo_62sq.gif group99.net/k/img/	616 B 857 B	978ms 108ms	Image image/gif	104.168.58.141 ColoCrossing
General Check archive.org Show headers Download Go to Show image Full URL http://group99.net/k/img/logo_62sq.gif Requested by Host: group99.net URL: http://group99.net/k/finish.html Protocol HTTP/1.1 Security , , Server 104.168.58.141 Buffalo, United States, ASN36352 (AS-COLOCROSSING - ColoCrossing, US), Reverse DNS server.webhostingwithus.com Software Apache / Resource Hash `ebf4a535fa6a88962621940e780ca0cd6707b6cdaed59f469f0aeada311d09d1` Request headers Referer http://group99.net/k/finish.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 12 Jul 2019 18:03:16 GMT Last-Modified Thu, 09 Jul 2015 21:32:02 GMT Server Apache Content-Type image/gif Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=94 Content-Length 616
GET H/1.1	404 Not Found	btn_search_white.gif group99.net/k/img/	343 B 343 B	1087ms 108ms	Image text/html	104.168.58.141 ColoCrossing
General Check archive.org Show headers Download Go to Show image Full URL http://group99.net/k/img/btn_search_white.gif Requested by Host: group99.net URL: http://group99.net/k/finish.html Protocol HTTP/1.1 Security , , Server 104.168.58.141 Buffalo, United States, ASN36352 (AS-COLOCROSSING - ColoCrossing, US), Reverse DNS server.webhostingwithus.com Software Apache / Resource Hash `ef81d6e26982cfcdc8ee80a7b7d3553e57b8ddc5d9f92962b115029afc157e71` Request headers Referer http://group99.net/k/finish.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 12 Jul 2019 18:03:16 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=93 Content-Length 343 Content-Type text/html; charset=iso-8859-1
GET H/1.1	200 OK	tagline_consumer.gif group99.net/k/img/	937 B 1 KB	870ms 104ms	Image image/gif	104.168.58.141 ColoCrossing
General Check archive.org Show headers Download Go to Show image Full URL http://group99.net/k/img/tagline_consumer.gif Requested by Host: group99.net URL: http://group99.net/k/finish.html Protocol HTTP/1.1 Security , , Server 104.168.58.141 Buffalo, United States, ASN36352 (AS-COLOCROSSING - ColoCrossing, US), Reverse DNS server.webhostingwithus.com Software Apache / Resource Hash `5dd26d926dda54524ab6d5696e30fa8ae26e5b54895d20a4781d54f4ed5cbf78` Request headers Referer http://group99.net/k/finish.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 12 Jul 2019 18:03:16 GMT Last-Modified Tue, 14 Jul 2015 16:11:20 GMT Server Apache Content-Type image/gif Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 937
GET H/1.1	404 Not Found	wibprint.css group99.net/k/css/	0 0	544ms 107ms	Stylesheet text/html	104.168.58.141 ColoCrossing
General Check archive.org Show headers Download Go to Full URL http://group99.net/k/css/wibprint.css Requested by Host: group99.net URL: http://group99.net/k/finish.html Protocol HTTP/1.1 Security , , Server 104.168.58.141 Buffalo, United States, ASN36352 (AS-COLOCROSSING - ColoCrossing, US), Reverse DNS server.webhostingwithus.com Software Apache / Resource Hash Request headers Referer http://group99.net/k/finish.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 12 Jul 2019 18:03:16 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=99 Content-Length 335 Content-Type text/html; charset=iso-8859-1
GET H/1.1	404 Not Found	search_corner.gif group99.net/k/css/images/	347 B 347 B	435ms 113ms	Image text/html	104.168.58.141 ColoCrossing
General Check archive.org Show headers Download Go to Show image Full URL http://group99.net/k/css/images/search_corner.gif Requested by Host: group99.net URL: http://group99.net/k/finish.html Protocol HTTP/1.1 Security , , Server 104.168.58.141 Buffalo, United States, ASN36352 (AS-COLOCROSSING - ColoCrossing, US), Reverse DNS server.webhostingwithus.com Software Apache / Resource Hash `ab910b7a15461ccee4ae8a0b83cc6732254f6c69459fd478fa7ad113b0795615` Request headers Referer http://group99.net/k/css/vudu.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 12 Jul 2019 18:03:16 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=92 Content-Length 347 Content-Type text/html; charset=iso-8859-1
GET H/1.1	404 Not Found	btn_search_white.gif group99.net/k/img/	343 B 343 B	213ms 104ms	Image text/html	104.168.58.141 ColoCrossing
General Check archive.org Show headers Download Go to Show image Full URL http://group99.net/k/img/btn_search_white.gif Requested by Host: group99.net URL: http://group99.net/k/finish.html Protocol HTTP/1.1 Security , , Server 104.168.58.141 Buffalo, United States, ASN36352 (AS-COLOCROSSING - ColoCrossing, US), Reverse DNS server.webhostingwithus.com Software Apache / Resource Hash `ef81d6e26982cfcdc8ee80a7b7d3553e57b8ddc5d9f92962b115029afc157e71` Request headers Referer http://group99.net/k/finish.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 12 Jul 2019 18:03:16 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=98 Content-Length 343 Content-Type text/html; charset=iso-8859-1
GET		/ www.wellsfargo.com/goals-credit/smarter-credit/good-credit-habits/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.wellsfargo.com
URL: https://www.wellsfargo.com/goals-credit/smarter-credit/good-credit-habits/

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Wells Fargo (Banking)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			group99.net/	1969-12-31 23:59:59	Name: PHPSESSID Value: njihvr4vrqp4iau8f6oglcde40

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

group99.net
www.wellsfargo.com
www.wellsfargo.com
104.168.58.141
2900cd456f4ce61ba29f48fc7086a271d946077efa26c7927c65c19e293120ec
3f32fabf32147846d06d0d451ac9a41dcef278f09683a7b05c95e04f9a055a2e
5dd26d926dda54524ab6d5696e30fa8ae26e5b54895d20a4781d54f4ed5cbf78
ab910b7a15461ccee4ae8a0b83cc6732254f6c69459fd478fa7ad113b0795615
c757116f421565c1ea86e8934fc85e5625dec837dc312dd998b35c1598e2d36d
dcd3ee5e1441dddc80287f758068aee7c31471170744000d1b60799ff5f909cd
ebf4a535fa6a88962621940e780ca0cd6707b6cdaed59f469f0aeada311d09d1
ef81d6e26982cfcdc8ee80a7b7d3553e57b8ddc5d9f92962b115029afc157e71

group99.net Open in urlscan Pro 104.168.58.141 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

12 Requests

0 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

1 Countries

139 kBTransfer

138 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

1 Cookies

Indicators

group99.net Open in urlscan Pro
104.168.58.141 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

0 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

139 kB
Transfer

138 kB
Size

1
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!