urlscan.io logo urlscan.io
SecurityTrails logo

rollcapideas.com Open in urlscan Pro
209.236.125.78  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://rollcapideas.com/.well-known/pki-validation/sym/log/
Submission: On December 09 via automatic, source openphish
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 1 countries across 2 domains to perform 18 HTTP transactions. The main IP is 209.236.125.78, located in Dallas, United States and belongs to ASN-DIS - Dallas Infrastructure Services, LLC, US. The main domain is rollcapideas.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on October 3rd 2017. Valid for: 3 months.
This is the only time rollcapideas.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Wells Fargo (Banking)

Domain & IP information

IP Address AS Autonomous System
4 17 209.236.125.78 393398 (ASN-DIS)
2 159.45.66.156 4196 (WELLSFARG...)
3 159.45.2.156 10837 (WELLSFARG...)
18 4
Apex Domain
Subdomains		 Transfer
17 rollcapideas.com
rollcapideas.com
www.rollcapideas.com
300 KB
5 wellsfargo.com
connect.secure.wellsfargo.com
38 KB
18 2
Domain Requested by
13 rollcapideas.com 4 redirects rollcapideas.com
5 connect.secure.wellsfargo.com rollcapideas.com
4 www.rollcapideas.com rollcapideas.com
18 3

This site contains links to these domains. Also see Links.

Domain
www.wellsfargo.com
oam.wellsfargo.com
icomplete.wellsfargo.com
www.wellsfargorewards.com
Subject Issuer Validity Valid
rollcapideas.com
cPanel, Inc. Certification Authority		 2017-10-03 -
2018-01-01		 3 months crt.sh
connect.secure.wellsfargo.com
Symantec Class 3 Secure Server CA - G4		 2016-10-13 -
2018-10-13		 2 years crt.sh

This page contains 1 frames:

Primary Page: https://rollcapideas.com/.well-known/pki-validation/sym/log/
Frame ID: (7E9AF7E1445E71B36A558D65C5A53D1)
Requests: 20 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Page Statistics

18
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

3
Subdomains

4
IPs

1
Countries

336 kB
Transfer

354 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 8
  • https://rollcapideas.com/auth/static/scripts/conutils-6.2.2.js HTTP 301
  • https://www.rollcapideas.com/auth/static/scripts/conutils-6.2.2.js
Request Chain 9
  • https://rollcapideas.com/auth/static/prefs/atadun.js HTTP 301
  • https://www.rollcapideas.com/auth/static/prefs/atadun.js
Request Chain 17
  • https://rollcapideas.com/.well-known/pki-validation/sym/log/Nour/index_files/images/close_popup.png HTTP 301
  • https://www.rollcapideas.com/.well-known/pki-validation/sym/log/Nour/index_files/images/close_popup.png
Request Chain 18
  • https://rollcapideas.com/.well-known/pki-validation/sym/log/Nour/index_files/images/popover-arrow-up.png HTTP 301
  • https://www.rollcapideas.com/.well-known/pki-validation/sym/log/Nour/index_files/images/popover-arrow-up.png

18 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
rollcapideas.com/.well-known/pki-validation/sym/log/ 		18 KB
0 		Document
General
Check archive.org
Download Go to
Full URL
https://rollcapideas.com/.well-known/pki-validation/sym/log/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.236.125.78 Dallas, United States, ASN393398 (ASN-DIS - Dallas Infrastructure Services, LLC, US),
Reverse DNS
clark.dnsbox51.com
Software
Apache /
Resource Hash
e1cfe0a58fe8263fd0de7be7efbd32b04ad82011081fbc010e0f56a34362a834

Request headers

Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Connection
keep-alive
Accept-Encoding
gzip, deflate
Host
rollcapideas.com
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date
Sat, 09 Dec 2017 17:37:55 GMT
Last-Modified
Sat, 09 Dec 2017 16:45:45 GMT
Server
Apache
Content-Type
text/html
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
18102
a
rollcapideas.com/.well-known/pki-validation/sym/log/Nour/index_files/ 		471 B
471 B 		Script
General
Check archive.org
Download Go to
Full URL
https://rollcapideas.com/.well-known/pki-validation/sym/log/Nour/index_files/a
Requested by
Host: rollcapideas.com
URL: https://rollcapideas.com/.well-known/pki-validation/sym/log/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.236.125.78 Dallas, United States, ASN393398 (ASN-DIS - Dallas Infrastructure Services, LLC, US),
Reverse DNS
clark.dnsbox51.com
Software
Apache /
Resource Hash
dc398794fbaff0c1cd00117b9fc91c48efe5485703f6adefed9b915bfdabb53e

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
rollcapideas.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept
*/*
Referer
https://rollcapideas.com/.well-known/pki-validation/sym/log/
Connection
keep-alive
Cache-Control
no-cache
Referer
https://rollcapideas.com/.well-known/pki-validation/sym/log/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date
Sat, 09 Dec 2017 17:37:56 GMT
Last-Modified
Sat, 09 Dec 2017 16:45:45 GMT
Server
Apache
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
471
nd
rollcapideas.com/.well-known/pki-validation/sym/log/Nour/index_files/ 		36 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://rollcapideas.com/.well-known/pki-validation/sym/log/Nour/index_files/nd
Requested by
Host: rollcapideas.com
URL: https://rollcapideas.com/.well-known/pki-validation/sym/log/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.236.125.78 Dallas, United States, ASN393398 (ASN-DIS - Dallas Infrastructure Services, LLC, US),
Reverse DNS
clark.dnsbox51.com
Software
Apache /
Resource Hash
5ca88323c4910c713eaea769640d3984a073055100779fc786923a5e5cff3558

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
rollcapideas.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept
*/*
Referer
https://rollcapideas.com/.well-known/pki-validation/sym/log/
Connection
keep-alive
Cache-Control
no-cache
Referer
https://rollcapideas.com/.well-known/pki-validation/sym/log/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date
Sat, 09 Dec 2017 17:37:56 GMT
Last-Modified
Sat, 09 Dec 2017 16:45:45 GMT
Server
Apache
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
36655
signon_clean.css
rollcapideas.com/.well-known/pki-validation/sym/log/Nour/index_files/ 		8 KB
8 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://rollcapideas.com/.well-known/pki-validation/sym/log/Nour/index_files/signon_clean.css
Requested by
Host: rollcapideas.com
URL: https://rollcapideas.com/.well-known/pki-validation/sym/log/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.236.125.78 Dallas, United States, ASN393398 (ASN-DIS - Dallas Infrastructure Services, LLC, US),
Reverse DNS
clark.dnsbox51.com
Software
Apache /
Resource Hash
7c5a2d4ec9602f00b32c1a523884077c6cf6f3b8161a70edf7fbac483329a65b

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
rollcapideas.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
https://rollcapideas.com/.well-known/pki-validation/sym/log/
Connection
keep-alive
Cache-Control
no-cache
Referer
https://rollcapideas.com/.well-known/pki-validation/sym/log/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date
Sat, 09 Dec 2017 17:37:56 GMT
Last-Modified
Sat, 09 Dec 2017 16:45:45 GMT
Server
Apache
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
7893
login-userprefs.js
rollcapideas.com/.well-known/pki-validation/sym/log/Nour/index_files/ 		144 KB
144 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://rollcapideas.com/.well-known/pki-validation/sym/log/Nour/index_files/login-userprefs.js
Requested by
Host: rollcapideas.com
URL: https://rollcapideas.com/.well-known/pki-validation/sym/log/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.236.125.78 Dallas, United States, ASN393398 (ASN-DIS - Dallas Infrastructure Services, LLC, US),
Reverse DNS
clark.dnsbox51.com
Software
Apache /
Resource Hash
24363e65461028f246406750c6a2e3c0c3508319b511fba9c5ef79eff0f6c863

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
rollcapideas.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept
*/*
Referer
https://rollcapideas.com/.well-known/pki-validation/sym/log/
Connection
keep-alive
Cache-Control
no-cache
Referer
https://rollcapideas.com/.well-known/pki-validation/sym/log/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date
Sat, 09 Dec 2017 17:37:56 GMT
Last-Modified
Sat, 09 Dec 2017 16:45:45 GMT
Server
Apache
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
146994
conutils-6.js
rollcapideas.com/.well-known/pki-validation/sym/log/Nour/index_files/ 		10 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://rollcapideas.com/.well-known/pki-validation/sym/log/Nour/index_files/conutils-6.js
Requested by
Host: rollcapideas.com
URL: https://rollcapideas.com/.well-known/pki-validation/sym/log/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.236.125.78 Dallas, United States, ASN393398 (ASN-DIS - Dallas Infrastructure Services, LLC, US),
Reverse DNS
clark.dnsbox51.com
Software
Apache /
Resource Hash
198506f95f9c0cf3a670f82ea63f9a560bd6ff9a17c153ad4ac5d8777e0fda21

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
rollcapideas.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept
*/*
Referer
https://rollcapideas.com/.well-known/pki-validation/sym/log/
Connection
keep-alive
Cache-Control
no-cache
Referer
https://rollcapideas.com/.well-known/pki-validation/sym/log/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date
Sat, 09 Dec 2017 17:37:56 GMT
Last-Modified
Sat, 09 Dec 2017 16:45:45 GMT
Server
Apache
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
9948
atadun.js
rollcapideas.com/.well-known/pki-validation/sym/log/Nour/index_files/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://rollcapideas.com/.well-known/pki-validation/sym/log/Nour/index_files/atadun.js
Requested by
Host: rollcapideas.com
URL: https://rollcapideas.com/.well-known/pki-validation/sym/log/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.236.125.78 Dallas, United States, ASN393398 (ASN-DIS - Dallas Infrastructure Services, LLC, US),
Reverse DNS
clark.dnsbox51.com
Software
Apache /
Resource Hash
5fb7b85658a6e615400e0f1f3e16fc869bbd099b3c3c181c294c05d1d7d1cfe5

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
rollcapideas.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept
*/*
Referer
https://rollcapideas.com/.well-known/pki-validation/sym/log/
Connection
keep-alive
Cache-Control
no-cache
Referer
https://rollcapideas.com/.well-known/pki-validation/sym/log/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date
Sat, 09 Dec 2017 17:37:56 GMT
Last-Modified
Sat, 09 Dec 2017 16:45:45 GMT
Server
Apache
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
1067
jquery.js
rollcapideas.com/.well-known/pki-validation/sym/log/Nour/index_files/ 		99 KB
99 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://rollcapideas.com/.well-known/pki-validation/sym/log/Nour/index_files/jquery.js
Requested by
Host: rollcapideas.com
URL: https://rollcapideas.com/.well-known/pki-validation/sym/log/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.236.125.78 Dallas, United States, ASN393398 (ASN-DIS - Dallas Infrastructure Services, LLC, US),
Reverse DNS
clark.dnsbox51.com
Software
Apache /
Resource Hash
0c646ba9e7fd0c3be4aa6992a032d438940c22373d15c3e386cbbb6a6f1d7002

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
rollcapideas.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept
*/*
Referer
https://rollcapideas.com/.well-known/pki-validation/sym/log/
Connection
keep-alive
Cache-Control
no-cache
Referer
https://rollcapideas.com/.well-known/pki-validation/sym/log/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date
Sat, 09 Dec 2017 17:37:56 GMT
Last-Modified
Sat, 09 Dec 2017 16:45:45 GMT
Server
Apache
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
101422
popover.js
rollcapideas.com/.well-known/pki-validation/sym/log/Nour/index_files/ 		769 B
769 B 		Script
General
Check archive.org
Download Go to
Full URL
https://rollcapideas.com/.well-known/pki-validation/sym/log/Nour/index_files/popover.js
Requested by
Host: rollcapideas.com
URL: https://rollcapideas.com/.well-known/pki-validation/sym/log/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.236.125.78 Dallas, United States, ASN393398 (ASN-DIS - Dallas Infrastructure Services, LLC, US),
Reverse DNS
clark.dnsbox51.com
Software
Apache /
Resource Hash
57e7fe6c51b03564f8b28e2c9cc0b9bd88ab7e73245fd4d4723dfc2fbdf60b0a

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
rollcapideas.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept
*/*
Referer
https://rollcapideas.com/.well-known/pki-validation/sym/log/
Connection
keep-alive
Cache-Control
no-cache
Referer
https://rollcapideas.com/.well-known/pki-validation/sym/log/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date
Sat, 09 Dec 2017 17:37:56 GMT
Last-Modified
Sat, 09 Dec 2017 16:45:45 GMT
Server
Apache
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=97
Content-Length
769
conutils-6.2.2.js
www.rollcapideas.com/auth/static/scripts/
Redirect Chain
  • https://rollcapideas.com/auth/static/scripts/conutils-6.2.2.js
  • https://www.rollcapideas.com/auth/static/scripts/conutils-6.2.2.js
0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://www.rollcapideas.com/auth/static/scripts/conutils-6.2.2.js
Requested by
Host: rollcapideas.com
URL: https://rollcapideas.com/.well-known/pki-validation/sym/log/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.236.125.78 Dallas, United States, ASN393398 (ASN-DIS - Dallas Infrastructure Services, LLC, US),
Reverse DNS
clark.dnsbox51.com
Software
Apache /
Resource Hash

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
www.rollcapideas.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept
*/*
Referer
https://rollcapideas.com/.well-known/pki-validation/sym/log/
Connection
keep-alive
Cache-Control
no-cache
Referer
https://rollcapideas.com/.well-known/pki-validation/sym/log/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date
Sat, 09 Dec 2017 17:37:58 GMT
Server
Apache
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
Cache-Control
no-cache, must-revalidate, max-age=0
Connection
Keep-Alive
Link
<https://www.rollcapideas.com/wp-json/>; rel="https://api.w.org/"
Keep-Alive
timeout=5, max=100
Expires
Wed, 11 Jan 1984 05:00:00 GMT

Redirect headers

Date
Sat, 09 Dec 2017 17:37:57 GMT
Server
Apache
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
Location
https://www.rollcapideas.com/auth/static/scripts/conutils-6.2.2.js
Cache-Control
no-cache, must-revalidate, max-age=0
Connection
Keep-Alive
Keep-Alive
timeout=5, max=99
Expires
Wed, 11 Jan 1984 05:00:00 GMT
atadun.js
www.rollcapideas.com/auth/static/prefs/
Redirect Chain
  • https://rollcapideas.com/auth/static/prefs/atadun.js
  • https://www.rollcapideas.com/auth/static/prefs/atadun.js
0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://www.rollcapideas.com/auth/static/prefs/atadun.js
Requested by
Host: rollcapideas.com
URL: https://rollcapideas.com/.well-known/pki-validation/sym/log/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.236.125.78 Dallas, United States, ASN393398 (ASN-DIS - Dallas Infrastructure Services, LLC, US),
Reverse DNS
clark.dnsbox51.com
Software
Apache /
Resource Hash

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
www.rollcapideas.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept
*/*
Referer
https://rollcapideas.com/.well-known/pki-validation/sym/log/
Connection
keep-alive
Cache-Control
no-cache
Referer
https://rollcapideas.com/.well-known/pki-validation/sym/log/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date
Sat, 09 Dec 2017 17:37:58 GMT
Server
Apache
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
Cache-Control
no-cache, must-revalidate, max-age=0
Connection
Keep-Alive
Link
<https://www.rollcapideas.com/wp-json/>; rel="https://api.w.org/"
Keep-Alive
timeout=5, max=100
Expires
Wed, 11 Jan 1984 05:00:00 GMT

Redirect headers

Date
Sat, 09 Dec 2017 17:37:57 GMT
Server
Apache
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
Location
https://www.rollcapideas.com/auth/static/prefs/atadun.js
Cache-Control
no-cache, must-revalidate, max-age=0
Connection
Keep-Alive
Keep-Alive
timeout=5, max=99
Expires
Wed, 11 Jan 1984 05:00:00 GMT
nd
connect.secure.wellsfargo.com/jenny/ 		37 KB
37 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.secure.wellsfargo.com/jenny/nd
Requested by
Host: rollcapideas.com
URL: https://rollcapideas.com/.well-known/pki-validation/sym/log/Nour/index_files/atadun.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
159.45.66.156 Saint Louis, United States, ASN4196 (WELLSFARGO-4196 - Wells Fargo & Company, US),
Reverse DNS
Software
KONICHIWA/1.1 /
Resource Hash
51bec1c47841a371c496f8c9ac6118947707527d4e59466014ee473802140519

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
connect.secure.wellsfargo.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept
*/*
Referer
https://rollcapideas.com/.well-known/pki-validation/sym/log/
Connection
keep-alive
Cache-Control
no-cache
Referer
https://rollcapideas.com/.well-known/pki-validation/sym/log/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date
Sat, 09 Dec 2017 17:37:59 GMT
Server
KONICHIWA/1.1
Transfer-Encoding
chunked
Content-Type
application/javascript;charset=ISO-8859-1
truncated
/ 		37 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Response headers

Access-Control-Allow-Origin
*
Content-Type
image/gif
truncated
/ 		616 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ebf4a535fa6a88962621940e780ca0cd6707b6cdaed59f469f0aeada311d09d1

Request headers

Response headers

Access-Control-Allow-Origin
*
Content-Type
image/gif
new_search_corner.gif
connect.secure.wellsfargo.com/auth/static/wfa/css/images/ 		49 B
49 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://connect.secure.wellsfargo.com/auth/static/wfa/css/images/new_search_corner.gif
Requested by
Host: rollcapideas.com
URL: https://rollcapideas.com/.well-known/pki-validation/sym/log/
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
159.45.66.156 Saint Louis, United States, ASN4196 (WELLSFARGO-4196 - Wells Fargo & Company, US),
Reverse DNS
Software
KONICHIWA/1.1 /
Resource Hash
1e776523ad4b7aabbafe543437026068fa33850abd9fdc8c482c22b9357f5ba2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
connect.secure.wellsfargo.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://rollcapideas.com/.well-known/pki-validation/sym/log/Nour/index_files/signon_clean.css
Connection
keep-alive
Cache-Control
no-cache
Referer
https://rollcapideas.com/.well-known/pki-validation/sym/log/Nour/index_files/signon_clean.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date
Sat, 09 Dec 2017 17:37:59 GMT
X-content-type-options
nosniff
Last-modified
Fri, 17 Nov 2017 21:39:31 GMT
Server
KONICHIWA/1.1
Etag
"31-5a0f5713"
X-frame-options
SAMEORIGIN
Content-type
image/gif
Accept-ranges
bytes
Content-length
49
X-xss-protection
1; mode=block
X-ua-compatible
IE=edge
btn_blueslice.gif
connect.secure.wellsfargo.com/auth/static/wfa/css/images/ 		152 B
152 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://connect.secure.wellsfargo.com/auth/static/wfa/css/images/btn_blueslice.gif
Requested by
Host: rollcapideas.com
URL: https://rollcapideas.com/.well-known/pki-validation/sym/log/
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
159.45.2.156 , United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US),
Reverse DNS
Software
KONICHIWA/1.1 /
Resource Hash
dd77bede93256e88a4f6b6b05bca756126011650ce56a2a5e7ea6ecf44941fe2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
connect.secure.wellsfargo.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://rollcapideas.com/.well-known/pki-validation/sym/log/Nour/index_files/signon_clean.css
Connection
keep-alive
Cache-Control
no-cache
Referer
https://rollcapideas.com/.well-known/pki-validation/sym/log/Nour/index_files/signon_clean.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date
Sat, 09 Dec 2017 17:37:59 GMT
X-content-type-options
nosniff
Last-modified
Fri, 17 Nov 2017 21:39:32 GMT
Server
KONICHIWA/1.1
Etag
"98-5a0f5714"
X-frame-options
SAMEORIGIN
Content-type
image/gif
Accept-ranges
bytes
Content-length
152
X-xss-protection
1; mode=block
X-ua-compatible
IE=edge
caret_header_left.gif
connect.secure.wellsfargo.com/auth/static/wfa/css/images/ 		55 B
55 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://connect.secure.wellsfargo.com/auth/static/wfa/css/images/caret_header_left.gif
Requested by
Host: rollcapideas.com
URL: https://rollcapideas.com/.well-known/pki-validation/sym/log/
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
159.45.2.156 , United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US),
Reverse DNS
Software
KONICHIWA/1.1 /
Resource Hash
db53c3c794890dacc6969a17d1c28c1645007870e20e1fdfcff7b84324100301
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
connect.secure.wellsfargo.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://rollcapideas.com/.well-known/pki-validation/sym/log/Nour/index_files/signon_clean.css
Connection
keep-alive
Cache-Control
no-cache
Referer
https://rollcapideas.com/.well-known/pki-validation/sym/log/Nour/index_files/signon_clean.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date
Sat, 09 Dec 2017 17:38:00 GMT
X-content-type-options
nosniff
Last-modified
Fri, 17 Nov 2017 21:39:32 GMT
Server
KONICHIWA/1.1
Etag
"37-5a0f5714"
X-frame-options
SAMEORIGIN
Content-type
image/gif
Accept-ranges
bytes
Content-length
55
X-xss-protection
1; mode=block
X-ua-compatible
IE=edge
left_nav_dot.gif
connect.secure.wellsfargo.com/auth/static/wfa/css/images/ 		43 B
43 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://connect.secure.wellsfargo.com/auth/static/wfa/css/images/left_nav_dot.gif
Requested by
Host: rollcapideas.com
URL: https://rollcapideas.com/.well-known/pki-validation/sym/log/
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
159.45.2.156 , United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US),
Reverse DNS
Software
KONICHIWA/1.1 /
Resource Hash
04ebbc8b6a0071e1d78440d674dad23569fd0f33217cfb13c57fe0cf07b14547
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
connect.secure.wellsfargo.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://rollcapideas.com/.well-known/pki-validation/sym/log/Nour/index_files/signon_clean.css
Connection
keep-alive
Cache-Control
no-cache
Referer
https://rollcapideas.com/.well-known/pki-validation/sym/log/Nour/index_files/signon_clean.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date
Sat, 09 Dec 2017 17:38:00 GMT
X-content-type-options
nosniff
Last-modified
Fri, 17 Nov 2017 21:39:32 GMT
Server
KONICHIWA/1.1
Etag
"2b-5a0f5714"
X-frame-options
SAMEORIGIN
Content-type
image/gif
Accept-ranges
bytes
Content-length
43
X-xss-protection
1; mode=block
X-ua-compatible
IE=edge
close_popup.png
www.rollcapideas.com/.well-known/pki-validation/sym/log/Nour/index_files/images/
Redirect Chain
  • https://rollcapideas.com/.well-known/pki-validation/sym/log/Nour/index_files/images/close_popup.png
  • https://www.rollcapideas.com/.well-known/pki-validation/sym/log/Nour/index_files/images/close_popup.png
79 B
45 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.rollcapideas.com/.well-known/pki-validation/sym/log/Nour/index_files/images/close_popup.png
Requested by
Host: rollcapideas.com
URL: https://rollcapideas.com/.well-known/pki-validation/sym/log/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.236.125.78 Dallas, United States, ASN393398 (ASN-DIS - Dallas Infrastructure Services, LLC, US),
Reverse DNS
clark.dnsbox51.com
Software
Apache /
Resource Hash
a5b0ee414ebaa1f4d8a68c6f3afee0a3ccba6851c47c1a215c21fb3fbffc1a99

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
www.rollcapideas.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://rollcapideas.com/.well-known/pki-validation/sym/log/Nour/index_files/signon_clean.css
Connection
keep-alive
Cache-Control
no-cache
Referer
https://rollcapideas.com/.well-known/pki-validation/sym/log/Nour/index_files/signon_clean.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date
Sat, 09 Dec 2017 17:38:00 GMT
Server
Apache
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
Cache-Control
no-cache, must-revalidate, max-age=0
Connection
Keep-Alive
Link
<https://www.rollcapideas.com/wp-json/>; rel="https://api.w.org/"
Keep-Alive
timeout=5, max=100
Expires
Wed, 11 Jan 1984 05:00:00 GMT

Redirect headers

Date
Sat, 09 Dec 2017 17:37:59 GMT
Server
Apache
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
Location
https://www.rollcapideas.com/.well-known/pki-validation/sym/log/Nour/index_files/images/close_popup.png
Cache-Control
no-cache, must-revalidate, max-age=0
Connection
Keep-Alive
Keep-Alive
timeout=5, max=98
Expires
Wed, 11 Jan 1984 05:00:00 GMT
popover-arrow-up.png
www.rollcapideas.com/.well-known/pki-validation/sym/log/Nour/index_files/images/
Redirect Chain
  • https://rollcapideas.com/.well-known/pki-validation/sym/log/Nour/index_files/images/popover-arrow-up.png
  • https://www.rollcapideas.com/.well-known/pki-validation/sym/log/Nour/index_files/images/popover-arrow-up.png
79 B
28 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.rollcapideas.com/.well-known/pki-validation/sym/log/Nour/index_files/images/popover-arrow-up.png
Requested by
Host: rollcapideas.com
URL: https://rollcapideas.com/.well-known/pki-validation/sym/log/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.236.125.78 Dallas, United States, ASN393398 (ASN-DIS - Dallas Infrastructure Services, LLC, US),
Reverse DNS
clark.dnsbox51.com
Software
Apache /
Resource Hash
a5b0ee414ebaa1f4d8a68c6f3afee0a3ccba6851c47c1a215c21fb3fbffc1a99

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
www.rollcapideas.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://rollcapideas.com/.well-known/pki-validation/sym/log/Nour/index_files/signon_clean.css
Connection
keep-alive
Cache-Control
no-cache
Referer
https://rollcapideas.com/.well-known/pki-validation/sym/log/Nour/index_files/signon_clean.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date
Sat, 09 Dec 2017 17:38:00 GMT
Server
Apache
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
Cache-Control
no-cache, must-revalidate, max-age=0
Connection
Keep-Alive
Link
<https://www.rollcapideas.com/wp-json/>; rel="https://api.w.org/"
Keep-Alive
timeout=5, max=100
Expires
Wed, 11 Jan 1984 05:00:00 GMT

Redirect headers

Date
Sat, 09 Dec 2017 17:37:59 GMT
Server
Apache
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
Location
https://www.rollcapideas.com/.well-known/pki-validation/sym/log/Nour/index_files/images/popover-arrow-up.png
Cache-Control
no-cache, must-revalidate, max-age=0
Connection
Keep-Alive
Keep-Alive
timeout=5, max=98
Expires
Wed, 11 Jan 1984 05:00:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Wells Fargo (Banking)

156 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onafterprint object| onbeforeprint function| ndoGetObjectKeys string| ndjsStaticVersion object| nsrye object| nsvcyt boolean| nsvcy number| nsfuixvxvi number| nssgwd object| nsryexp object| nsfuixvxv object| nsshq object| nsvcyto object| nsmehlof object| nsazdhmnk number| nsrail string| nsryexpgj object| nds object| nsrailer number| numQueries object| returned string| version undefined| nsazd string| nsmehlofzl string| nsmehlo string| nsfui string| nsmeh string| nsazdhmn function| nsshqe function| nsmehl function| nsshqexgfn boolean| nsraile object| nsryex function| nsshqexgf function| nsmehlofz function| nsshqex function| nssgw function| nsazdhmnkp function| nssgwdlep function| ndwts function| nsvcytoli function| nsrai function| nsazdh function| nsvcytoliv function| nssgwdl function| nsrailersk function| nsryexpg function| nsazdhm function| nsryexpgjx function| nssgwdle function| nsfuixvx function| nsfuix function| ndwti function| nssgwdlepf function| nsrailers function| nsvcytol function| rot13 function| nsshqexg function| nsfuixv function| nslxbrhz function| nsblq function| nsjqs function| nsjqsvbe function| nscqjzxy function| nscqjz function| nslqn function| HashUtil object| ndsapi object| antiClickjack string| webId string| ndURI object| bundle function| disableSubmitsCollectUserPrefs function| addLoginFormFieldsAndSubmit function| jsEnabled function| addEvent object| UserPrefsHelper object| collector function| loadUserPrefs function| submitUserPrefs function| getUserPrefsOnPageLoad function| undoSaveUsername function| maskedUsernameChanged boolean| m object| q object| options object| lun3 boolean| isNative object| js object| fjs function| $ function| jQuery object| $popover object| $arrow object| $closeIcon object| nsmmx object| nshvk boolean| nscdsdya number| nsazqktcj number| nsiavh object| nssjihxkab object| nsmmxmkix object| nsmmxmkixy object| nsazqktc object| nsazqktcjb object| nshvkut number| nssjih string| nsiavhwwz string| nsbjlf string| nslala string| nssjihxka string| nssjihx string| nshvku string| nsmmxmk string| nslalamg object| nsazqk function| nscdsdy function| nsiavhww function| nslalamggl boolean| nsiav object| nslalam function| nscdsd function| nsbjlfv function| nsbjlfve function| nslal function| nssji function| nsiavhwwzn function| nslalamgg function| nshvkutgi function| nscdsdyaur function| nsbjlfveat function| nscdsdyau function| nsmmxm function| nsazqkt function| nshvkutgiy function| nscds function| nshvkutg function| nsazq function| nsbjlfvea function| nsbjl function| nsiavhw function| nsmmxmki function| nssjihxk function| nsyxmfj function| nsphe function| nsyxmf function| nsdytyec function| nsxkh function| nskqik function| nsirxusc function| nsyxm function| nsxkhcjwwt function| nsypnq function| nsxkhcjww function| nsgkw function| nsyxmfjnnd

0 Cookies