files.powerdiary.com Open in urlscan Pro
13.226.39.13 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://files.powerdiary.com/175c1f1b-f218-445a-8eaf-ecd51493df02/public/WELLSFARGOSECUREDBANKING2022unlockverificationwellsf...
Submission: On June 13 via manual (June 13th 2022, 2:22:06 am UTC) from US — Scanned from US

Summary HTTP 10 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 4 IPs in 1 countries across 4 domains to perform 10 HTTP transactions. The main IP is 13.226.39.13, located in United States and belongs to AMAZON-02, US. The main domain is files.powerdiary.com.
TLS certificate: Issued by Amazon on March 23rd 2022. Valid for: a year.

This is the only time files.powerdiary.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Banking (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1	13.226.39.13 13.226.39.13	16509 (AMAZON-02) (AMAZON-02)
1	2620:0:861:ed... 2620:0:861:ed1a::2:b	14907 (WIKIMEDIA) (WIKIMEDIA)
5 5	167.181.46.220 167.181.46.220	25959 (SUNTRUST) (SUNTRUST)
5 5	167.181.46.31 167.181.46.31	25959 (SUNTRUST) (SUNTRUST)
7	23.216.132.45 23.216.132.45	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 1	167.181.46.72 167.181.46.72	25959 (SUNTRUST) (SUNTRUST)
1 1	2600:9000:21d... 2600:9000:21da:8600:5:842a:2dc0:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:21d... 2600:9000:21da:ac00:e:eafc:c400:93a1	16509 (AMAZON-02) (AMAZON-02)
10	4

1 13.226.39.13 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-39-13.ewr53.r.cloudfront.net

files.powerdiary.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:0:861:ed1a::2:b (United States)

ASN14907 (WIKIMEDIA, US)

upload.wikimedia.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 167.181.46.220 (United States) 5 redirects

ASN25959 (SUNTRUST, US)
PTR: wholesaleportal.suntrust.com

wholesaleportal.suntrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 167.181.46.31 (United States) 5 redirects

ASN25959 (SUNTRUST, US)
PTR: www1-wholesaleportal.suntrust.com

www1-wholesaleportal.suntrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 23.216.132.45 (Piscataway, United States)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-216-132-45.deploy.static.akamaitechnologies.com

treasurymanager-login.truist.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 167.181.46.72 (United States) 1 redirects

ASN25959 (SUNTRUST, US)
PTR: liveforasunnyday.com

suntrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:21da:8600:5:842a:2dc0:93a1 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

www.suntrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:21da:ac00:e:eafc:c400:93a1 (United States)

ASN16509 (AMAZON-02, US)

www.truist.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	suntrust.com 12 redirects wholesaleportal.suntrust.com — Cisco Umbrella Rank: 531726 www1-wholesaleportal.suntrust.com — Cisco Umbrella Rank: 504485 suntrust.com — Cisco Umbrella Rank: 112907 www.suntrust.com — Cisco Umbrella Rank: 241697	2 KB
8	truist.com treasurymanager-login.truist.com — Cisco Umbrella Rank: 489446 www.truist.com — Cisco Umbrella Rank: 35302	12 KB
1	wikimedia.org upload.wikimedia.org — Cisco Umbrella Rank: 2433	86 KB
1	powerdiary.com files.powerdiary.com	3 KB
10	4

	Domain	Requested by
7	treasurymanager-login.truist.com	files.powerdiary.com treasurymanager-login.truist.com
5	www1-wholesaleportal.suntrust.com	5 redirects
5	wholesaleportal.suntrust.com	5 redirects
1	www.truist.com	files.powerdiary.com
1	www.suntrust.com	1 redirects
1	suntrust.com	1 redirects
1	upload.wikimedia.org	files.powerdiary.com
1	files.powerdiary.com
10	8

This site contains links to these domains. Also see Links.

Domain
www.100forms.com
www.suntrust.com

Subject Issuer	Validity	Valid
*.powerdiary.com Amazon	`2022-03-23` - `2023-04-21`	a year	crt.sh
*.wikipedia.org R3	`2022-05-11` - `2022-08-09`	3 months	crt.sh
w3.truist.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2022-06-01` - `2023-05-09`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://files.powerdiary.com/175c1f1b-f218-445a-8eaf-ecd51493df02/public/WELLSFARGOSECUREDBANKING2022unlockverificationwellsfargologinuservalidationwellsfargobanking-3e899579.html
Frame ID: 717C48E8E3459083BF3F97A22AC014AE
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Wells FargoWells Fargo

Page Statistics

10
Requests

40 %
HTTPS

38 %
IPv6

4
Domains

8
Subdomains

4
IPs

1
Countries

101 kB
Transfer

138 kB
Size

1
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://www.100forms.com/

Search URL Search Domain Scan URL

URL: https://www.suntrust.com/personal-banking
Title: Wells Fargo Security

Search URL Search Domain Scan URL

URL: https://www.suntrust.com/Privacy
Title: Privacy,

Search URL Search Domain Scan URL

URL: https://www.suntrust.com/FraudAndSecurity
Title: Security & Fraud

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1

https://wholesaleportal.suntrust.com/OCM/user/assets/css/basic.css HTTP 302
https://www1-wholesaleportal.suntrust.com/OCM/user/assets/css/basic.css HTTP 302
https://treasurymanager-login.truist.com/OCM/user/assets/css/basic.css

Request Chain 2

https://wholesaleportal.suntrust.com/OCM/user/assets/css/unauth_edits.css HTTP 302
https://www1-wholesaleportal.suntrust.com/OCM/user/assets/css/unauth_edits.css HTTP 302
https://treasurymanager-login.truist.com/OCM/user/assets/css/unauth_edits.css

Request Chain 3

https://wholesaleportal.suntrust.com/OCM/user/assets/libs/js/validate.js HTTP 302
https://www1-wholesaleportal.suntrust.com/OCM/user/assets/libs/js/validate.js HTTP 302
https://treasurymanager-login.truist.com/OCM/user/assets/libs/js/validate.js

Request Chain 4

https://wholesaleportal.suntrust.com/OCM/user/assets/libs/js/new.js HTTP 302
https://www1-wholesaleportal.suntrust.com/OCM/user/assets/libs/js/new.js HTTP 302
https://treasurymanager-login.truist.com/OCM/user/assets/libs/js/new.js

Request Chain 5

https://suntrust.com/ HTTP 302
https://www.suntrust.com/ HTTP 301
https://www.truist.com/

Request Chain 6

https://wholesaleportal.suntrust.com/OCM/user/assets/images/icon_lock.gif HTTP 302
https://www1-wholesaleportal.suntrust.com/OCM/user/assets/images/icon_lock.gif HTTP 302
https://treasurymanager-login.truist.com/OCM/user/assets/images/icon_lock.gif

10 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request WELLSFARGOSECUREDBANKING2022unlockverificationwellsfargologinuservalidationwellsfargobanking-3e899579.html Show response
files.powerdiary.com/175c1f1b-f218-445a-8eaf-ecd51493df02/public/ 8 KB
3 KB 244ms
95ms Document
text/html 13.226.39.13
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://files.powerdiary.com/175c1f1b-f218-445a-8eaf-ecd51493df02/public/WELLSFARGOSECUREDBANKING2022unlockverificationwellsfargologinuservalidationwellsfargobanking-3e899579.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.226.39.13 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-39-13.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 3723a4c4278e0ffda64939c4acce70fac81362af01f02e3b981bb5b51c4222ed

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 54702
content-encoding: gzip
content-type: text/html
date: Sun, 12 Jun 2022 11:10:19 GMT
etag: W/"2ff10837b8b4263ba46fcc7a7d8a1305"
last-modified: Sun, 12 Jun 2022 11:10:03 GMT
server: AmazonS3
vary: Accept-Encoding
via: 1.1 8f53b5d73ff2f5f8cae7b49606b79bd4.cloudfront.net (CloudFront)
x-amz-cf-id: mefV_iE1VgFpTqUw5kJVPB2cHLhAeduFSIivWHkkBiWB5oiZh0OGsQ==
x-amz-cf-pop: EWR53-C2
x-amz-server-side-encryption: AES256
x-amz-version-id: hJ9aGIt4pKmzvnX095k5td23mA4C3gcO
x-cache: Hit from cloudfront

GET
H2 200 1200px-Wells_Fargo_Logo_%282020%29.svg.png
upload.wikimedia.org/wikipedia/commons/thumb/e/e2/Wells_Fargo_Logo_%282020%29.svg/ 85 KB
86 KB 204ms
67ms Image
image/png 2620:0:861:ed1a::2:b
WIKIMEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://upload.wikimedia.org/wikipedia/commons/thumb/e/e2/Wells_Fargo_Logo_%282020%29.svg/1200px-Wells_Fargo_Logo_%282020%29.svg.png

Requested by

Host: files.powerdiary.com
URL: https://files.powerdiary.com/175c1f1b-f218-445a-8eaf-ecd51493df02/public/WELLSFARGOSECUREDBANKING2022unlockverificationwellsfargologinuservalidationwellsfargobanking-3e899579.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:0:861:ed1a::2:b , United States, ASN14907 (WIKIMEDIA, US),

Reverse DNS

Software

ATS/8.0.8 /

Resource Hash

d809f114396675aa43250c1e26e1384edf73ad8dfdfb042f13f200b066b4ae0c

Security Headers

Name	Value
Strict-Transport-Security	max-age=106384710; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://files.powerdiary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Sun, 12 Jun 2022 14:22:01 GMT
nel: { "report_to": "wm_nel", "max_age": 86400, "failure_fraction": 0.05, "success_fraction": 0.0}
age: 43199
x-cache-status: hit-front
x-cache: cp1080 hit, cp1086 hit/68
content-disposition: inline;filename*=UTF-8''Wells_Fargo_Logo_%282020%29.svg.png
server-timing: cache;desc="hit-front", host;desc="cp1086"
content-length: 87202
x-client-ip: 2001:550:1d05:1::6
accept-ranges: bytes
last-modified: Sun, 20 Feb 2022 06:44:19 GMT
server: ATS/8.0.8
etag: 0cd582dda1dc3a4ee144e32ef48e8cb1
strict-transport-security: max-age=106384710; includeSubDomains; preload
report-to: { "group": "wm_nel", "max_age": 86400, "endpoints": [{ "url": "https://intake-logging.wikimedia.org/v1/events?stream=w3c.reportingapi.network_error&schema_uri=/w3c/reportingapi/network_error/1.0.0" }] }
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Age, Date, Content-Length, Content-Range, X-Content-Duration, X-Cache
permissions-policy: interest-cohort=(),ch-ua-arch=(self "intake-analytics.wikimedia.org"),ch-ua-bitness=(self "intake-analytics.wikimedia.org"),ch-ua-full-version-list=(self "intake-analytics.wikimedia.org"),ch-ua-model=(self "intake-analytics.wikimedia.org"),ch-ua-platform-version=(self "intake-analytics.wikimedia.org")
accept-ch: Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version
timing-allow-origin: *

GET
H2

200

basic.css
treasurymanager-login.truist.com/OCM/user/assets/css/
Redirect Chain

https://wholesaleportal.suntrust.com/OCM/user/assets/css/basic.css
https://www1-wholesaleportal.suntrust.com/OCM/user/assets/css/basic.css
https://treasurymanager-login.truist.com/OCM/user/assets/css/basic.css

41 KB
9 KB

555ms
178ms

Stylesheet
text/css

23.216.132.45
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://treasurymanager-login.truist.com/OCM/user/assets/css/basic.css
Requested by: Host: files.powerdiary.com
URL: https://files.powerdiary.com/175c1f1b-f218-445a-8eaf-ecd51493df02/public/WELLSFARGOSECUREDBANKING2022unlockverificationwellsfargologinuservalidationwellsfargobanking-3e899579.html
Protocol: H2
Server: 23.216.132.45 Piscataway, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-216-132-45.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e1d50eb40884ce799304e6fc43edc3888200403816fef35e72c46a2ccdc56751

Request headers

accept-language: en-US,en;q=0.9
Referer: https://files.powerdiary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 13 Jun 2022 02:22:02 GMT
content-encoding: gzip
last-modified: Sun, 08 Jul 2018 04:02:41 GMT
etag: "436d60847016d41:0"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=310243
server-timing: cdn-cache; desc=HIT, edge; dur=31
accept-ranges: bytes
content-length: 8542

Redirect headers

Location: https://treasurymanager-login.truist.com/OCM/user/assets/css/basic.css
Server: BigIP
Connection: Keep-Alive
Content-Length: 0

GET
H2

200

unauth_edits.css
treasurymanager-login.truist.com/OCM/user/assets/css/
Redirect Chain

https://wholesaleportal.suntrust.com/OCM/user/assets/css/unauth_edits.css
https://www1-wholesaleportal.suntrust.com/OCM/user/assets/css/unauth_edits.css
https://treasurymanager-login.truist.com/OCM/user/assets/css/unauth_edits.css

594 B
561 B

533ms
163ms

Stylesheet
text/css

23.216.132.45
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://treasurymanager-login.truist.com/OCM/user/assets/css/unauth_edits.css
Requested by: Host: files.powerdiary.com
URL: https://files.powerdiary.com/175c1f1b-f218-445a-8eaf-ecd51493df02/public/WELLSFARGOSECUREDBANKING2022unlockverificationwellsfargologinuservalidationwellsfargobanking-3e899579.html
Protocol: H2
Server: 23.216.132.45 Piscataway, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-216-132-45.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 9f8564b4eb2e46fbe614cd33fdb5fa56465ae4065c18fa8799397f7767e60153

Request headers

accept-language: en-US,en;q=0.9
Referer: https://files.powerdiary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 13 Jun 2022 02:22:01 GMT
content-encoding: gzip
last-modified: Sun, 08 Jul 2018 04:02:41 GMT
etag: "a4ce62847016d41:0"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=312839
server-timing: cdn-cache; desc=HIT, edge; dur=20
accept-ranges: bytes
content-length: 358

Redirect headers

Location: https://treasurymanager-login.truist.com/OCM/user/assets/css/unauth_edits.css
Server: BigIP
Connection: Keep-Alive
Content-Length: 0

GET
H2

200

validate.js Show response
treasurymanager-login.truist.com/OCM/user/assets/libs/js/
Redirect Chain

https://wholesaleportal.suntrust.com/OCM/user/assets/libs/js/validate.js
https://www1-wholesaleportal.suntrust.com/OCM/user/assets/libs/js/validate.js
https://treasurymanager-login.truist.com/OCM/user/assets/libs/js/validate.js

3 KB
808 B

546ms
177ms

Script
application/javascript

23.216.132.45
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://treasurymanager-login.truist.com/OCM/user/assets/libs/js/validate.js
Requested by: Host: files.powerdiary.com
URL: https://files.powerdiary.com/175c1f1b-f218-445a-8eaf-ecd51493df02/public/WELLSFARGOSECUREDBANKING2022unlockverificationwellsfargologinuservalidationwellsfargobanking-3e899579.html
Protocol: H2
Server: 23.216.132.45 Piscataway, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-216-132-45.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 11d24620975d0cba30b205f6561681eb0defb0ffea5e53e541eb4f653476708e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://files.powerdiary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 13 Jun 2022 02:22:02 GMT
content-encoding: gzip
last-modified: Sun, 08 Jul 2018 04:02:41 GMT
etag: "6e9c7a847016d41:0"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=312907
server-timing: cdn-cache; desc=HIT, edge; dur=15
accept-ranges: bytes
content-length: 595

Redirect headers

Location: https://treasurymanager-login.truist.com/OCM/user/assets/libs/js/validate.js
Server: BigIP
Connection: Keep-Alive
Content-Length: 0

GET
H2

200

new.js Show response
treasurymanager-login.truist.com/OCM/user/assets/libs/js/
Redirect Chain

https://wholesaleportal.suntrust.com/OCM/user/assets/libs/js/new.js
https://www1-wholesaleportal.suntrust.com/OCM/user/assets/libs/js/new.js
https://treasurymanager-login.truist.com/OCM/user/assets/libs/js/new.js

530 B
723 B

534ms
164ms

Script
application/javascript

23.216.132.45
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://treasurymanager-login.truist.com/OCM/user/assets/libs/js/new.js
Requested by: Host: files.powerdiary.com
URL: https://files.powerdiary.com/175c1f1b-f218-445a-8eaf-ecd51493df02/public/WELLSFARGOSECUREDBANKING2022unlockverificationwellsfargologinuservalidationwellsfargobanking-3e899579.html
Protocol: H2
Server: 23.216.132.45 Piscataway, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-216-132-45.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 4a2dbed8e1a0521c53d60f577259bec7c09812ba4558f9da4ca55e4d629925d7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://files.powerdiary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 13 Jun 2022 02:22:01 GMT
last-modified: Sun, 08 Jul 2018 04:02:41 GMT
etag: "6e9c7a847016d41:0"
content-type: application/javascript
cache-control: max-age=351801
server-timing: cdn-cache; desc=HIT, edge; dur=10
accept-ranges: bytes
content-length: 530

Redirect headers

Location: https://treasurymanager-login.truist.com/OCM/user/assets/libs/js/new.js
Server: BigIP
Connection: Keep-Alive
Content-Length: 0

GET
H2

200

/ Show response
www.truist.com/
Redirect Chain

https://suntrust.com/
https://www.suntrust.com/
https://www.truist.com/

0
0

294ms
114ms

Script
text/html

2600:9000:21da:ac00:e:eafc:c400:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.truist.com/
Requested by: Host: files.powerdiary.com
URL: https://files.powerdiary.com/175c1f1b-f218-445a-8eaf-ecd51493df02/public/WELLSFARGOSECUREDBANKING2022unlockverificationwellsfargologinuservalidationwellsfargobanking-3e899579.html
Protocol: H2
Server: 2600:9000:21da:ac00:e:eafc:c400:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://files.powerdiary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Redirect headers

date: Mon, 13 Jun 2022 02:22:01 GMT
via: 1.1 dff867205390cf91b170b9bf1251e39a.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: EWR53-C1
x-cache: LambdaGeneratedResponse from cloudfront
location: https://www.truist.com
cache-control: max-age=864000
content-length: 0
x-amz-cf-id: jbD0RV_2hKCAejmvwZPV8RsU7rHPwK6s3WDa94GjuyLIPTj45q57ig==

GET
H2

200

icon_lock.gif
treasurymanager-login.truist.com/OCM/user/assets/images/
Redirect Chain

https://wholesaleportal.suntrust.com/OCM/user/assets/images/icon_lock.gif
https://www1-wholesaleportal.suntrust.com/OCM/user/assets/images/icon_lock.gif
https://treasurymanager-login.truist.com/OCM/user/assets/images/icon_lock.gif

101 B
285 B

522ms
165ms

Image
image/gif

23.216.132.45
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://treasurymanager-login.truist.com/OCM/user/assets/images/icon_lock.gif
Requested by: Host: files.powerdiary.com
URL: https://files.powerdiary.com/175c1f1b-f218-445a-8eaf-ecd51493df02/public/WELLSFARGOSECUREDBANKING2022unlockverificationwellsfargologinuservalidationwellsfargobanking-3e899579.html
Protocol: H2
Server: 23.216.132.45 Piscataway, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-216-132-45.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 13aed0678e68491c663cdee589510d2b2c085497c2cde81d50d13c148bb5b853

Request headers

accept-language: en-US,en;q=0.9
Referer: https://files.powerdiary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 13 Jun 2022 02:22:01 GMT
last-modified: Sun, 08 Jul 2018 04:02:41 GMT
etag: "669167847016d41:0"
content-type: image/gif
cache-control: max-age=1735251
server-timing: cdn-cache; desc=HIT, edge; dur=19
accept-ranges: bytes
content-length: 101

Redirect headers

Location: https://treasurymanager-login.truist.com/OCM/user/assets/images/icon_lock.gif
Server: BigIP
Connection: Keep-Alive
Content-Length: 0

GET
H2 200 pageBG_770.gif
treasurymanager-login.truist.com/OCM/user/assets/images/ 129 B
313 B 86ms
86ms Image
image/gif 23.216.132.45
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://treasurymanager-login.truist.com/OCM/user/assets/images/pageBG_770.gif
Requested by: Host: treasurymanager-login.truist.com
URL: https://treasurymanager-login.truist.com/OCM/user/assets/css/unauth_edits.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.216.132.45 Piscataway, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-216-132-45.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 7363a406eda361fe2751f45bbab1761e76940914b202ec3d45090ed556c8cf89

Request headers

accept-language: en-US,en;q=0.9
Referer: https://treasurymanager-login.truist.com/OCM/user/assets/css/unauth_edits.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 13 Jun 2022 02:22:02 GMT
last-modified: Sun, 08 Jul 2018 04:02:41 GMT
etag: "89b56e847016d41:0"
content-type: image/gif
cache-control: max-age=1746017
server-timing: cdn-cache; desc=HIT, edge; dur=6
accept-ranges: bytes
content-length: 129

GET
H2 200 bg_info.gif
treasurymanager-login.truist.com/OCM/user/assets/images/ 949 B
1 KB 87ms
87ms Image
image/gif 23.216.132.45
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://treasurymanager-login.truist.com/OCM/user/assets/images/bg_info.gif
Requested by: Host: treasurymanager-login.truist.com
URL: https://treasurymanager-login.truist.com/OCM/user/assets/css/basic.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.216.132.45 Piscataway, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-216-132-45.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 45680f8f4aaac4e1b2cdbf49411f28ecc30374ef3e5954b12453a87da8f6d031

Request headers

accept-language: en-US,en;q=0.9
Referer: https://treasurymanager-login.truist.com/OCM/user/assets/css/basic.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 13 Jun 2022 02:22:02 GMT
last-modified: Sun, 08 Jul 2018 04:02:41 GMT
etag: "a4ce62847016d41:0"
content-type: image/gif
cache-control: max-age=1746271
server-timing: cdn-cache; desc=HIT, edge; dur=3
accept-ranges: bytes
content-length: 949

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Banking (Banking)

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.truist.com/	1970-01-20 03:54:51	Name: AWSALBCORS Value: fogoLfDuOwTJhTWiJbn9uFxkrFAGhcS7Xat6zObpq/b/hgPQQssK2EQP2HISaQ+RiV3artnUoseFr8n/5H2PazseR63Hd+UYi6Tle9ka2Zi30knS5+FG67e+g1TV

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

files.powerdiary.com
suntrust.com
treasurymanager-login.truist.com
upload.wikimedia.org
wholesaleportal.suntrust.com
www.suntrust.com
www.truist.com
www1-wholesaleportal.suntrust.com
13.226.39.13
167.181.46.220
167.181.46.31
167.181.46.72
23.216.132.45
2600:9000:21da:8600:5:842a:2dc0:93a1
2600:9000:21da:ac00:e:eafc:c400:93a1
2620:0:861:ed1a::2:b
11d24620975d0cba30b205f6561681eb0defb0ffea5e53e541eb4f653476708e
13aed0678e68491c663cdee589510d2b2c085497c2cde81d50d13c148bb5b853
3723a4c4278e0ffda64939c4acce70fac81362af01f02e3b981bb5b51c4222ed
45680f8f4aaac4e1b2cdbf49411f28ecc30374ef3e5954b12453a87da8f6d031
4a2dbed8e1a0521c53d60f577259bec7c09812ba4558f9da4ca55e4d629925d7
7363a406eda361fe2751f45bbab1761e76940914b202ec3d45090ed556c8cf89
9f8564b4eb2e46fbe614cd33fdb5fa56465ae4065c18fa8799397f7767e60153
d809f114396675aa43250c1e26e1384edf73ad8dfdfb042f13f200b066b4ae0c
e1d50eb40884ce799304e6fc43edc3888200403816fef35e72c46a2ccdc56751
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

files.powerdiary.com Open in urlscan Pro 13.226.39.13 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

10 Requests

40 %HTTPS

38 %IPv6

4 Domains

8 Subdomains

4 IPs

1 Countries

101 kBTransfer

138 kBSize

1 Cookies

4 Outgoing links

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

15 JavaScript Global Variables

1 Cookies

Indicators

files.powerdiary.com Open in urlscan Pro
13.226.39.13 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

40 %
HTTPS

38 %
IPv6

4
Domains

8
Subdomains

4
IPs

1
Countries

101 kB
Transfer

138 kB
Size

1
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!