www.agbuyer.com Open in urlscan Pro
98.142.221.58 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://www.agbuyer.com/fonts/shape/wellsfargo/index_login.htm
Submission: On February 16 via automatic, source openphish (February 16th 2017, 3:20:19 pm UTC)

Summary HTTP 12 Redirects Links 19 Behaviour Indicators

Summary

This website contacted 4 IPs in 1 countries across 3 domains to perform 12 HTTP transactions. The main IP is 98.142.221.58, located in Atlanta, United States and belongs to TOTAL-SERVER-SOLUTIONS - Total Server Solutions L.L.C., US. The main domain is www.agbuyer.com.

This is the only time www.agbuyer.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Wells Fargo (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1	98.142.221.58 98.142.221.58	46562 (TOTAL-SER...) (TOTAL-SERVER-SOLUTIONS - Total Server Solutions L.L.C.)
8	159.45.2.154 159.45.2.154	10837 (WELLSFARG...) (WELLSFARGO-10837 - Wells Fargo & Company)
2	23.10.249.8 23.10.249.8	20940 (AKAMAI-ASN1 ) (AKAMAI-ASN1 )
1	23.10.249.11 23.10.249.11	20940 (AKAMAI-ASN1 ) (AKAMAI-ASN1 )
12	4

1 98.142.221.58 (Atlanta, United States)

ASN46562 (TOTAL-SERVER-SOLUTIONS - Total Server Solutions L.L.C., US)
PTR: mail58.unlimihost.net

www.agbuyer.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 159.45.2.154 (Charlotte, United States)

ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US)
PTR: online.wellsfargo.com

online.wellsfargo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.10.249.8 (Cambridge, United States)

ASN20940 (AKAMAI-ASN1 , US)
PTR: a23-10-249-8.deploy.static.akamaitechnologies.com

a248.e.akamai.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.10.249.11 (Cambridge, United States)

ASN20940 (AKAMAI-ASN1 , US)
PTR: a23-10-249-11.deploy.static.akamaitechnologies.com

a248.e.akamai.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	wellsfargo.com online.wellsfargo.com	17 KB
3	akamai.net a248.e.akamai.net	767 B
1	agbuyer.com www.agbuyer.com	10 KB
12	3

	Domain	Requested by
8	online.wellsfargo.com	www.agbuyer.com
3	a248.e.akamai.net	www.agbuyer.com
1	www.agbuyer.com
12	3

This site contains links to these domains. Also see Links.

Domain
www.wellsfargo.com
online.wellsfargo.com

Subject Issuer	Validity	Valid
online.wellsfargo.com Symantec Class 3 Secure Server CA - G4	`2016-10-28` - `2018-10-29`	2 years	crt.sh
a248.e.akamai.net Symantec Class 3 ECC 256 bit SSL CA - G2	`2016-07-28` - `2017-07-28`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://www.agbuyer.com/fonts/shape/wellsfargo/index_login.htm
Frame ID: 15940.1
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

12
Requests

92 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

4
IPs

1
Countries

28 kB
Transfer

68 kB
Size

0
Cookies

19 Outgoing links

These are links going to different origins than the main page.

URL: https://www.wellsfargo.com/

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/auxiliary_access/aa_talkatmloc

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/help/
Title: Customer Service

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/locator/
Title: Locations

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/products_services/applications_viewall.jhtml
Title: Apply

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/per/more/banking
Title: Banking

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/per/more/loans_credit
Title: Loans & Credit

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/insurance/
Title: Insurance

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/investing/more
Title: Investing

Search URL Search Domain Scan URL

URL: https://online.wellsfargo.com/das/cgi-bin/session.cgi?screenid=SIGNON_OTHER&services=myApplications
Title: Applications In Progress

Search URL Search Domain Scan URL

URL: https://online.wellsfargo.com/das/cgi-bin/session.cgi?screenid=SIGNON_OTHER&services=ccRewards
Title: Credit Card Rewards

Search URL Search Domain Scan URL

URL: https://online.wellsfargo.com/das/cgi-bin/session.cgi?screenid=SIGNON_OTHER&services=smBiz401k
Title: Small Business 401(k)

Search URL Search Domain Scan URL

URL: https://online.wellsfargo.com/das/cgi-bin/session.cgi?screenid=SIGNON_OTHER&services=smartDataOnline
Title: Smart Data OnLine

Search URL Search Domain Scan URL

URL: https://online.wellsfargo.com/das/cgi-bin/session.cgi?screenid=SIGNON_OTHER&services=clientLine
Title: ClientLine

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/about/about
Title: About Wells Fargo

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/careers/
Title: Careers

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/privacy_security/
Title: Privacy, Security & Legal

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/privacy_security/fraud/report/fraud
Title: Report Email Fraud

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/sitemap
Title: Sitemap

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request index_login.htm Show response www.agbuyer.com/fonts/shape/wellsfargo/	10 KB 10 KB	462ms 107ms	Document text/html	98.142.221.58 Total Server Solu...
General Check archive.org Show headers Download Go to Full URL http://www.agbuyer.com/fonts/shape/wellsfargo/index_login.htm Protocol HTTP/1.1 Server 98.142.221.58 Atlanta, United States, ASN46562 (TOTAL-SERVER-SOLUTIONS - Total Server Solutions L.L.C., US), Reverse DNS mail58.unlimihost.net Software Apache / Resource Hash `59d648551d217a1e8c3731180f03d77c524c23905765df73b6cc3f37e6c53ec7` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host www.agbuyer.com Accept-Language en-US,en;q=0.8 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Cache-Control no-cache Connection keep-alive Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Response headers Date Thu, 16 Feb 2017 15:20:08 GMT Last-Modified Tue, 21 Apr 2015 00:48:20 GMT Server Apache Connection close Accept-Ranges bytes Content-Length 10549 Content-Type text/html
GET H/1.1	200 OK	Cookie set publicsite.css online.wellsfargo.com/das/common/styles/	13 KB 3 KB	1281ms 132ms	Stylesheet text/css	159.45.2.154 Wells Fargo & Com...
General Check archive.org Show headers Download Go to Full URL https://online.wellsfargo.com/das/common/styles/publicsite.css Requested by Host: www.agbuyer.com URL: http://www.agbuyer.com/fonts/shape/wellsfargo/index_login.htm Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_256_CBC Server 159.45.2.154 Charlotte, United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US), Reverse DNS online.wellsfargo.com Software KONICHIWA/2.0 / Resource Hash `1db9b43a51107c2b8ca93ae66149b2e53e0a48b6ec2c8631bdc170155c975b6c` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch, br Host online.wellsfargo.com Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Accept text/css,/;q=0.1 Referer http://www.agbuyer.com/fonts/shape/wellsfargo/index_login.htm Connection keep-alive Cache-Control no-cache Referer http://www.agbuyer.com/fonts/shape/wellsfargo/index_login.htm User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Response headers Date Thu, 16 Feb 2017 15:20:11 GMT Content-encoding gzip Vary accept-encoding Last-modified Mon, 16 Jan 2017 08:32:10 GMT Server KONICHIWA/2.0 Etag W/"327a-587c850a" Transfer-encoding chunked Content-type text/css Set-Cookie ISD_WIB_COOKIE=!BvUBR/104b3kISHR7F9yMVsyM0EXYVDtR1QU5a6mub8yW6kn/ND1cdgGvGofeYCm/cU1lWEH2rkUyZw=; path=/
GET H/1.1	200 OK	Cookie set wfwiblib.js Show response online.wellsfargo.com/das/common/scripts/	30 KB 7 KB	1415ms 266ms	Script application/x-javascript	159.45.2.154 Wells Fargo & Com...
General Check archive.org Show headers Download Go to Full URL https://online.wellsfargo.com/das/common/scripts/wfwiblib.js Requested by Host: www.agbuyer.com URL: http://www.agbuyer.com/fonts/shape/wellsfargo/index_login.htm Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_256_CBC Server 159.45.2.154 Charlotte, United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US), Reverse DNS online.wellsfargo.com Software KONICHIWA/2.0 / Resource Hash `6a60586980d51d5c93f661e7eaf9382ec327185fd1cc5a6722a5cd9a79d6db0e` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch, br Host online.wellsfargo.com Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Accept / Referer http://www.agbuyer.com/fonts/shape/wellsfargo/index_login.htm Connection keep-alive Cache-Control no-cache Referer http://www.agbuyer.com/fonts/shape/wellsfargo/index_login.htm User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Response headers Date Thu, 16 Feb 2017 15:20:11 GMT Content-encoding gzip Vary accept-encoding Last-modified Mon, 16 Jan 2017 08:32:29 GMT Server KONICHIWA/2.0 Etag W/"79d5-587c851d" Transfer-encoding chunked Content-type application/x-javascript Set-Cookie ISD_WIB_COOKIE=!zn1VmlcS35k9kAcqdZQ0+LfvvFvwLWwl2SFUWYflT+bNPjgJ9NVcaMduokpxZZrg6gtX6a4PXvv9uVA=; path=/
GET H/1.1	200 OK	logo_62sq.gif a248.e.akamai.net/7/248/3608/bb61162e7a787f/online.wellsfargo.com/das/common/images/	616 B 616 B	47ms 13ms	Image image/gif	23.10.249.8 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://a248.e.akamai.net/7/248/3608/bb61162e7a787f/online.wellsfargo.com/das/common/images/logo_62sq.gif Requested by Host: www.agbuyer.com URL: http://www.agbuyer.com/fonts/shape/wellsfargo/index_login.htm Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 23.10.249.8 Cambridge, United States, ASN20940 (AKAMAI-ASN1 , US), Reverse DNS a23-10-249-8.deploy.static.akamaitechnologies.com Software KONICHIWA/2.0 / Resource Hash `ebf4a535fa6a88962621940e780ca0cd6707b6cdaed59f469f0aeada311d09d1` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch, br Host a248.e.akamai.net Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://www.agbuyer.com/fonts/shape/wellsfargo/index_login.htm Connection keep-alive Cache-Control no-cache Referer http://www.agbuyer.com/fonts/shape/wellsfargo/index_login.htm User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Response headers Date Thu, 16 Feb 2017 15:20:11 GMT Last-Modified Mon, 19 Dec 2016 07:01:09 GMT Server KONICHIWA/2.0 ETag "268-585785b5" Content-Type image/gif Connection keep-alive Accept-Ranges bytes Content-Length 616
GET H/1.1	200 OK	shim.gif a248.e.akamai.net/7/248/3608/1d8352905f2c38/online.wellsfargo.com/das/common/images/	43 B 43 B	54ms 13ms	Image image/gif	23.10.249.8 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://a248.e.akamai.net/7/248/3608/1d8352905f2c38/online.wellsfargo.com/das/common/images/shim.gif Requested by Host: www.agbuyer.com URL: http://www.agbuyer.com/fonts/shape/wellsfargo/index_login.htm Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 23.10.249.8 Cambridge, United States, ASN20940 (AKAMAI-ASN1 , US), Reverse DNS a23-10-249-8.deploy.static.akamaitechnologies.com Software KONICHIWA/2.0 / Resource Hash `89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch, br Host a248.e.akamai.net Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://www.agbuyer.com/fonts/shape/wellsfargo/index_login.htm Connection keep-alive Cache-Control no-cache Referer http://www.agbuyer.com/fonts/shape/wellsfargo/index_login.htm User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Response headers Date Thu, 16 Feb 2017 15:20:11 GMT Last-Modified Mon, 19 Dec 2016 07:01:47 GMT Server KONICHIWA/2.0 ETag "2b-585785db" Content-Type image/gif Connection keep-alive Accept-Ranges bytes Content-Length 43
GET H/1.1	200 OK	ico_alertInput.gif a248.e.akamai.net/7/248/3608/1f8b6f7a060359/online.wellsfargo.com/das/common/images/	108 B 108 B	859ms 817ms	Image image/gif	23.10.249.11 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://a248.e.akamai.net/7/248/3608/1f8b6f7a060359/online.wellsfargo.com/das/common/images/ico_alertInput.gif Requested by Host: www.agbuyer.com URL: http://www.agbuyer.com/fonts/shape/wellsfargo/index_login.htm Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.10.249.11 Cambridge, United States, ASN20940 (AKAMAI-ASN1 , US), Reverse DNS a23-10-249-11.deploy.static.akamaitechnologies.com Software KONICHIWA/2.0 / Resource Hash `91dda610fed408946cf668d9db82d5159f07f3ed7f4a30c1f73148b77e9617f1` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch, br Host a248.e.akamai.net Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://www.agbuyer.com/fonts/shape/wellsfargo/index_login.htm Connection keep-alive Cache-Control no-cache Referer http://www.agbuyer.com/fonts/shape/wellsfargo/index_login.htm User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Response headers Date Thu, 16 Feb 2017 15:20:12 GMT Last-Modified Mon, 19 Dec 2016 07:01:52 GMT Server KONICHIWA/2.0 ETag "6c-585785e0" Content-Type image/gif Connection keep-alive Accept-Ranges bytes Content-Length 108
GET H/1.1	200 OK	user-prefs.js Show response online.wellsfargo.com/das/common/scripts/	12 KB 5 KB	130ms 129ms	Script application/x-javascript	159.45.2.154 Wells Fargo & Com...
General Check archive.org Show headers Download Go to Full URL https://online.wellsfargo.com/das/common/scripts/user-prefs.js Requested by Host: www.agbuyer.com URL: http://www.agbuyer.com/fonts/shape/wellsfargo/index_login.htm Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_256_CBC Server 159.45.2.154 Charlotte, United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US), Reverse DNS online.wellsfargo.com Software KONICHIWA/2.0 / Resource Hash `fd2f857bfeacf8456f517823f550c33db9a3c9ff5c3840f0684c04fccf6a574c` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch, br Host online.wellsfargo.com Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Accept / Referer http://www.agbuyer.com/fonts/shape/wellsfargo/index_login.htm Cookie ISD_WIB_COOKIE=!BvUBR/104b3kISHR7F9yMVsyM0EXYVDtR1QU5a6mub8yW6kn/ND1cdgGvGofeYCm/cU1lWEH2rkUyZw= Connection keep-alive Cache-Control no-cache Referer http://www.agbuyer.com/fonts/shape/wellsfargo/index_login.htm User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Response headers Date Thu, 16 Feb 2017 15:20:11 GMT Content-encoding gzip Vary accept-encoding Last-modified Mon, 19 Dec 2016 07:02:09 GMT Server KONICHIWA/2.0 Etag W/"30a6-585785f1" Transfer-encoding chunked Content-type application/x-javascript
GET H/1.1	200 OK	new_search_corner.gif online.wellsfargo.com/das/common/styles/images/	49 B 49 B	126ms 126ms	Image image/gif	159.45.2.154 Wells Fargo & Com...
General Check archive.org Show headers Download Go to Show image Full URL https://online.wellsfargo.com/das/common/styles/images/new_search_corner.gif Requested by Host: www.agbuyer.com URL: http://www.agbuyer.com/fonts/shape/wellsfargo/index_login.htm Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_256_CBC Server 159.45.2.154 Charlotte, United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US), Reverse DNS online.wellsfargo.com Software KONICHIWA/2.0 / Resource Hash `1e776523ad4b7aabbafe543437026068fa33850abd9fdc8c482c22b9357f5ba2` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch, br Host online.wellsfargo.com Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* https://online.wellsfargo.com/das/common/styles/publicsite.css Cookie ISD_WIB_COOKIE=!zn1VmlcS35k9kAcqdZQ0+LfvvFvwLWwl2SFUWYflT+bNPjgJ9NVcaMduokpxZZrg6gtX6a4PXvv9uVA= Connection keep-alive Cache-Control no-cache Referer https://online.wellsfargo.com/das/common/styles/publicsite.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Response headers Date Thu, 16 Feb 2017 15:20:11 GMT Last-modified Mon, 19 Dec 2016 06:59:34 GMT Server KONICHIWA/2.0 Accept-ranges bytes Etag "31-58578556" Content-length 49 Content-type image/gif
GET H/1.1	200 OK	btn_blueslice.gif online.wellsfargo.com/das/common/styles/images/	152 B 152 B	129ms 128ms	Image image/gif	159.45.2.154 Wells Fargo & Com...
General Check archive.org Show headers Download Go to Show image Full URL https://online.wellsfargo.com/das/common/styles/images/btn_blueslice.gif Requested by Host: www.agbuyer.com URL: http://www.agbuyer.com/fonts/shape/wellsfargo/index_login.htm Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_256_CBC Server 159.45.2.154 Charlotte, United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US), Reverse DNS online.wellsfargo.com Software KONICHIWA/2.0 / Resource Hash `dd77bede93256e88a4f6b6b05bca756126011650ce56a2a5e7ea6ecf44941fe2` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch, br Host online.wellsfargo.com Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* https://online.wellsfargo.com/das/common/styles/publicsite.css Cookie ISD_WIB_COOKIE=!zn1VmlcS35k9kAcqdZQ0+LfvvFvwLWwl2SFUWYflT+bNPjgJ9NVcaMduokpxZZrg6gtX6a4PXvv9uVA= Connection keep-alive Cache-Control no-cache Referer https://online.wellsfargo.com/das/common/styles/publicsite.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Response headers Date Thu, 16 Feb 2017 15:20:11 GMT Last-modified Mon, 19 Dec 2016 06:59:33 GMT Server KONICHIWA/2.0 Accept-ranges bytes Etag "98-58578555" Content-length 152 Content-type image/gif
GET H/1.1	200 OK	tab_bottom.gif online.wellsfargo.com/das/common/styles/images/	43 B 43 B	251ms 125ms	Image image/gif	159.45.2.154 Wells Fargo & Com...
General Check archive.org Show headers Download Go to Show image Full URL https://online.wellsfargo.com/das/common/styles/images/tab_bottom.gif Requested by Host: www.agbuyer.com URL: http://www.agbuyer.com/fonts/shape/wellsfargo/index_login.htm Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_256_CBC Server 159.45.2.154 Charlotte, United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US), Reverse DNS online.wellsfargo.com Software KONICHIWA/2.0 / Resource Hash `94bf27c86dff6f26021e00eeaeff8149de4acdbd60c2b9dd63d0dfb709855a56` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch, br Host online.wellsfargo.com Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* https://online.wellsfargo.com/das/common/styles/publicsite.css Cookie ISD_WIB_COOKIE=!zn1VmlcS35k9kAcqdZQ0+LfvvFvwLWwl2SFUWYflT+bNPjgJ9NVcaMduokpxZZrg6gtX6a4PXvv9uVA= Connection keep-alive Cache-Control no-cache Referer https://online.wellsfargo.com/das/common/styles/publicsite.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Response headers Date Thu, 16 Feb 2017 15:20:11 GMT Last-modified Mon, 19 Dec 2016 06:59:41 GMT Server KONICHIWA/2.0 Accept-ranges bytes Etag "2b-5857855d" Content-length 43 Content-type image/gif
GET H/1.1	200 OK	unselected_tab.jpg online.wellsfargo.com/das/common/styles/images/	1 KB 1 KB	254ms 124ms	Image image/jpeg	159.45.2.154 Wells Fargo & Com...
General Check archive.org Show headers Download Go to Show image Full URL https://online.wellsfargo.com/das/common/styles/images/unselected_tab.jpg Requested by Host: www.agbuyer.com URL: http://www.agbuyer.com/fonts/shape/wellsfargo/index_login.htm Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_256_CBC Server 159.45.2.154 Charlotte, United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US), Reverse DNS online.wellsfargo.com Software KONICHIWA/2.0 / Resource Hash `d36fa2bc1f382dced31e931e3ccda676ae87c58f2b5a2f27df533106ef8812b9` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch, br Host online.wellsfargo.com Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* https://online.wellsfargo.com/das/common/styles/publicsite.css Cookie ISD_WIB_COOKIE=!zn1VmlcS35k9kAcqdZQ0+LfvvFvwLWwl2SFUWYflT+bNPjgJ9NVcaMduokpxZZrg6gtX6a4PXvv9uVA= Connection keep-alive Cache-Control no-cache Referer https://online.wellsfargo.com/das/common/styles/publicsite.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Response headers Date Thu, 16 Feb 2017 15:20:11 GMT Last-modified Mon, 19 Dec 2016 06:59:34 GMT Server KONICHIWA/2.0 Accept-ranges bytes Etag "59e-58578556" Content-length 1438 Content-type image/jpeg
GET H/1.1	200 OK	selected_tab.gif online.wellsfargo.com/das/common/styles/images/	462 B 462 B	376ms 124ms	Image image/gif	159.45.2.154 Wells Fargo & Com...
General Check archive.org Show headers Download Go to Show image Full URL https://online.wellsfargo.com/das/common/styles/images/selected_tab.gif Requested by Host: www.agbuyer.com URL: http://www.agbuyer.com/fonts/shape/wellsfargo/index_login.htm Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_256_CBC Server 159.45.2.154 Charlotte, United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US), Reverse DNS online.wellsfargo.com Software KONICHIWA/2.0 / Resource Hash `b73a2e2123b60703b83815724b2c76c7165b7bb8f51dee49f732d35cfcef4dc8` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch, br Host online.wellsfargo.com Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* https://online.wellsfargo.com/das/common/styles/publicsite.css Cookie ISD_WIB_COOKIE=!zn1VmlcS35k9kAcqdZQ0+LfvvFvwLWwl2SFUWYflT+bNPjgJ9NVcaMduokpxZZrg6gtX6a4PXvv9uVA= Connection keep-alive Cache-Control no-cache Referer https://online.wellsfargo.com/das/common/styles/publicsite.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Response headers Date Thu, 16 Feb 2017 15:20:11 GMT Last-modified Mon, 19 Dec 2016 06:59:33 GMT Server KONICHIWA/2.0 Accept-ranges bytes Etag "1ce-58578555" Content-length 462 Content-type image/gif

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Wells Fargo (Banking)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a248.e.akamai.net
online.wellsfargo.com
www.agbuyer.com
159.45.2.154
23.10.249.11
23.10.249.8
98.142.221.58
1db9b43a51107c2b8ca93ae66149b2e53e0a48b6ec2c8631bdc170155c975b6c
1e776523ad4b7aabbafe543437026068fa33850abd9fdc8c482c22b9357f5ba2
59d648551d217a1e8c3731180f03d77c524c23905765df73b6cc3f37e6c53ec7
6a60586980d51d5c93f661e7eaf9382ec327185fd1cc5a6722a5cd9a79d6db0e
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
91dda610fed408946cf668d9db82d5159f07f3ed7f4a30c1f73148b77e9617f1
94bf27c86dff6f26021e00eeaeff8149de4acdbd60c2b9dd63d0dfb709855a56
b73a2e2123b60703b83815724b2c76c7165b7bb8f51dee49f732d35cfcef4dc8
d36fa2bc1f382dced31e931e3ccda676ae87c58f2b5a2f27df533106ef8812b9
dd77bede93256e88a4f6b6b05bca756126011650ce56a2a5e7ea6ecf44941fe2
ebf4a535fa6a88962621940e780ca0cd6707b6cdaed59f469f0aeada311d09d1
fd2f857bfeacf8456f517823f550c33db9a3c9ff5c3840f0684c04fccf6a574c

www.agbuyer.com Open in urlscan Pro 98.142.221.58 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

12 Requests

92 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

4 IPs

1 Countries

28 kBTransfer

68 kBSize

0 Cookies

19 Outgoing links

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

Indicators

www.agbuyer.com Open in urlscan Pro
98.142.221.58 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

92 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

4
IPs

1
Countries

28 kB
Transfer

68 kB
Size

0
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!