wilson-cowden.com Open in urlscan Pro
97.79.238.31  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request user.php Show response wilson-cowden.com/wp-admin/SAP/app/	3 KB 3 KB	635ms 360ms	Document text/html	97.79.238.31 TWC-11427-TEXAS
General Check archive.org Show headers Download Go to Full URL http://wilson-cowden.com/wp-admin/SAP/app/user.php Protocol HTTP/1.1 Server 97.79.238.31 Dallas, United States, ASN11427 (TWC-11427-TEXAS, US), Reverse DNS gvo23831.gvodatacenter.com Software Apache / Resource Hash b8a8edc065b41e0883a978e04e051a4d98aca9a71b28c39b74da16b11587420c Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Thu, 18 May 2023 04:57:53 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Keep-Alive timeout=5, max=100 Pragma no-cache Server Apache Transfer-Encoding chunked
GET H2	200	fonts.css www.deutsche-bank.de/cip-content/assets/pb-unity/fonts/	1 KB 862 B	87ms 18ms	Stylesheet text/css	2600:9000:2251:4400:13:46b5:7d80:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.deutsche-bank.de/cip-content/assets/pb-unity/fonts/fonts.css Requested by Host: wilson-cowden.com URL: http://wilson-cowden.com/wp-admin/SAP/app/user.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2251:4400:13:46b5:7d80:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Apache / Resource Hash adc96b6efe5919552898681732312c97108a36e5d17d1bd20044c09f31b7e43b Security Headers Name Value Content-Security-Policy frame-ancestors https://*.deutsche-bank.de Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN, allow-from https://meine.deutsche-bank.de Request headers accept-language de-DE,de;q=0.9 Referer http://wilson-cowden.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Thu, 18 May 2023 04:57:54 GMT strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff via 1.1 d63ea68c8b7458d49fe25f66ef7f0a5e.cloudfront.net (CloudFront) content-security-policy frame-ancestors https://*.deutsche-bank.de x-amz-cf-pop FRA60-P3 x-cache Miss from cloudfront content-length 226 last-modified Wed, 24 Feb 2021 08:20:14 GMT server Apache db-nickname VTJGc2RHVmtYMTgxd21ZN21sTTJOY1l0a0dPNGdqb0FoL2tJTDVXZHRCcz0= vary Accept-Encoding,Origin x-frame-options SAMEORIGIN, allow-from https://meine.deutsche-bank.de content-type text/css access-control-allow-origin * cache-control max-age=31536000, must-revalidate accept-ranges bytes x-amz-cf-id YwX7xjXwBIQfr1vxHGwTLOiJAiq5zjQhPfbJeVKGls-HPMH-HKwSSQ== expires Fri, 17 May 2024 04:57:54 GMT
GET H/1.1	200 OK	user-style.css wilson-cowden.com/wp-admin/SAP/app/res/	3 KB 3 KB	127ms 127ms	Stylesheet text/css	97.79.238.31 TWC-11427-TEXAS
General Check archive.org Show headers Download Go to Full URL http://wilson-cowden.com/wp-admin/SAP/app/res/user-style.css Requested by Host: wilson-cowden.com URL: http://wilson-cowden.com/wp-admin/SAP/app/user.php Protocol HTTP/1.1 Server 97.79.238.31 Dallas, United States, ASN11427 (TWC-11427-TEXAS, US), Reverse DNS gvo23831.gvodatacenter.com Software Apache / Resource Hash 3dc541aa9bb40fe5df53166a1ae584f2df06bc3abf2237e5a46cf77c1d15c3d6 Request headers accept-language de-DE,de;q=0.9 Referer http://wilson-cowden.com/wp-admin/SAP/app/user.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers Date Thu, 18 May 2023 04:57:54 GMT Last-Modified Sun, 07 May 2023 14:58:17 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 3133
GET H/1.1	200 OK	logo-cut.png wilson-cowden.com/wp-admin/SAP/app/res/	2 KB 2 KB	254ms 127ms	Image image/png	97.79.238.31 TWC-11427-TEXAS
General Check archive.org Show headers Download Go to Show image Full URL http://wilson-cowden.com/wp-admin/SAP/app/res/logo-cut.png Requested by Host: wilson-cowden.com URL: http://wilson-cowden.com/wp-admin/SAP/app/user.php Protocol HTTP/1.1 Server 97.79.238.31 Dallas, United States, ASN11427 (TWC-11427-TEXAS, US), Reverse DNS gvo23831.gvodatacenter.com Software Apache / Resource Hash ed3071781924562c02f648cab6d9decda453e6b57d137a4dded6f85ae7be3901 Request headers accept-language de-DE,de;q=0.9 Referer http://wilson-cowden.com/wp-admin/SAP/app/user.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers Date Thu, 18 May 2023 04:57:54 GMT Last-Modified Sun, 07 May 2023 14:58:17 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 1806
GET H/1.1	200 OK	img1.jpg wilson-cowden.com/wp-admin/SAP/app/res/	44 KB 44 KB	255ms 128ms	Image image/jpeg	97.79.238.31 TWC-11427-TEXAS
General Check archive.org Show headers Download Go to Show image Full URL http://wilson-cowden.com/wp-admin/SAP/app/res/img1.jpg Requested by Host: wilson-cowden.com URL: http://wilson-cowden.com/wp-admin/SAP/app/user.php Protocol HTTP/1.1 Server 97.79.238.31 Dallas, United States, ASN11427 (TWC-11427-TEXAS, US), Reverse DNS gvo23831.gvodatacenter.com Software Apache / Resource Hash 97fe447ddc107dc8b5f84af5b559f36c71eb2da143a98ef3080014d1f17c994a Request headers accept-language de-DE,de;q=0.9 Referer http://wilson-cowden.com/wp-admin/SAP/app/user.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers Date Thu, 18 May 2023 04:57:54 GMT Last-Modified Sun, 07 May 2023 14:58:17 GMT Server Apache Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 45295
GET H/1.1	200 OK	jq.js Show response wilson-cowden.com/wp-admin/SAP/app/res/	287 KB 287 KB	128ms 127ms	Script application/javascript	97.79.238.31 TWC-11427-TEXAS
General Check archive.org Show headers Download Go to Full URL http://wilson-cowden.com/wp-admin/SAP/app/res/jq.js Requested by Host: wilson-cowden.com URL: http://wilson-cowden.com/wp-admin/SAP/app/user.php Protocol HTTP/1.1 Server 97.79.238.31 Dallas, United States, ASN11427 (TWC-11427-TEXAS, US), Reverse DNS gvo23831.gvodatacenter.com Software Apache / Resource Hash 9d02ee01919145c20b03ee9d3013af7118793dedf5d2c0696a773af90066c953 Request headers accept-language de-DE,de;q=0.9 Referer http://wilson-cowden.com/wp-admin/SAP/app/user.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers Date Thu, 18 May 2023 04:57:54 GMT Last-Modified Sun, 07 May 2023 14:58:17 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 293671
GET H/1.1	200 OK	back.jpg wilson-cowden.com/wp-admin/SAP/app/res/	243 KB 243 KB	129ms 129ms	Image image/jpeg	97.79.238.31 TWC-11427-TEXAS
General Check archive.org Show headers Download Go to Show image Full URL http://wilson-cowden.com/wp-admin/SAP/app/res/back.jpg Requested by Host: wilson-cowden.com URL: http://wilson-cowden.com/wp-admin/SAP/app/res/user-style.css Protocol HTTP/1.1 Server 97.79.238.31 Dallas, United States, ASN11427 (TWC-11427-TEXAS, US), Reverse DNS gvo23831.gvodatacenter.com Software Apache / Resource Hash 8c477933a91763dd80d66840a72f9b25bee4250bc4adb2ec15932d5f6a473ecf Request headers accept-language de-DE,de;q=0.9 Referer http://wilson-cowden.com/wp-admin/SAP/app/res/user-style.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers Date Thu, 18 May 2023 04:57:54 GMT Last-Modified Sun, 07 May 2023 14:58:17 GMT Server Apache Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 248757
GET H2	200	FrutigerLTW05-55Roman.woff2 www.deutsche-bank.de/cip-content/assets/pb-unity/fonts/	25 KB 26 KB	31ms 17ms	Font font/woff2	2600:9000:2251:4400:13:46b5:7d80:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.deutsche-bank.de/cip-content/assets/pb-unity/fonts/FrutigerLTW05-55Roman.woff2 Requested by Host: www.deutsche-bank.de URL: https://www.deutsche-bank.de/cip-content/assets/pb-unity/fonts/fonts.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2251:4400:13:46b5:7d80:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Apache / Resource Hash 55cb206a77ff71092c309352fcb5927a389382ae678bab55f85ab13ed6239d31 Security Headers Name Value Content-Security-Policy frame-ancestors https://*.deutsche-bank.de Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN, allow-from https://meine.deutsche-bank.de Request headers Referer https://www.deutsche-bank.de/cip-content/assets/pb-unity/fonts/fonts.css Origin http://wilson-cowden.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Thu, 18 May 2023 04:57:54 GMT strict-transport-security max-age=31536000 x-content-type-options nosniff content-security-policy frame-ancestors https://*.deutsche-bank.de via 1.1 68b2682a924ac399aa2724b5b439e75c.cloudfront.net (CloudFront) x-amz-cf-pop FRA60-P3 x-cache Miss from cloudfront content-length 25764 last-modified Wed, 24 Feb 2021 08:20:14 GMT server Apache db-nickname VTJGc2RHVmtYMTgxd21ZN21sTTJOY1l0a0dPNGdqb0FoL2tJTDVXZHRCcz0= vary Origin x-frame-options SAMEORIGIN, allow-from https://meine.deutsche-bank.de content-type font/woff2 access-control-allow-origin * cache-control max-age=31536000, must-revalidate accept-ranges bytes x-amz-cf-id Xcz3rWcryglbLQR7dJQvw2g1QfHsjMlOZNILtV_sr20MSRu-pZbV-A== expires Fri, 17 May 2024 04:57:54 GMT
GET H2	200	FrutigerLTW05-65Bold.woff2 www.deutsche-bank.de/cip-content/assets/pb-unity/fonts/	25 KB 26 KB	36ms 23ms	Font font/woff2	2600:9000:2251:4400:13:46b5:7d80:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.deutsche-bank.de/cip-content/assets/pb-unity/fonts/FrutigerLTW05-65Bold.woff2 Requested by Host: www.deutsche-bank.de URL: https://www.deutsche-bank.de/cip-content/assets/pb-unity/fonts/fonts.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2251:4400:13:46b5:7d80:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Apache / Resource Hash be4beee7d867a4c4702b8ab281d1d11884a6b7ae9a5e74aac6b141000cb248de Security Headers Name Value Content-Security-Policy frame-ancestors https://*.deutsche-bank.de Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN, allow-from https://meine.deutsche-bank.de Request headers Referer https://www.deutsche-bank.de/cip-content/assets/pb-unity/fonts/fonts.css Origin http://wilson-cowden.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Thu, 18 May 2023 04:57:54 GMT strict-transport-security max-age=31536000 x-content-type-options nosniff content-security-policy frame-ancestors https://*.deutsche-bank.de via 1.1 68b2682a924ac399aa2724b5b439e75c.cloudfront.net (CloudFront) x-amz-cf-pop FRA60-P3 x-cache Miss from cloudfront content-length 26008 last-modified Wed, 24 Feb 2021 08:20:14 GMT server Apache db-nickname VTJGc2RHVmtYMStEZS9tYnQrRm53d0duOFVPSE9hb2JtcUNjSDZhRTNEYz0= vary Origin x-frame-options SAMEORIGIN, allow-from https://meine.deutsche-bank.de content-type font/woff2 access-control-allow-origin * cache-control max-age=31536000, must-revalidate accept-ranges bytes x-amz-cf-id EWAeYEDaE9FLSUbAvVGnO9x_PmNcxLHx0XN_6V2pCv3d97BzPwEKtA== expires Fri, 17 May 2024 04:57:54 GMT
POST H/1.1	200 OK	fetch.php Show response wilson-cowden.com/wp-admin/SAP/panel/	1 B 206 B	129ms 128ms	XHR text/html	97.79.238.31 TWC-11427-TEXAS
General Check archive.org Show headers Download Go to Full URL http://wilson-cowden.com/wp-admin/SAP/panel/fetch.php Requested by Host: wilson-cowden.com URL: http://wilson-cowden.com/wp-admin/SAP/app/res/jq.js Protocol HTTP/1.1 Server 97.79.238.31 Dallas, United States, ASN11427 (TWC-11427-TEXAS, US), Reverse DNS gvo23831.gvodatacenter.com Software Apache / Resource Hash 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9 Request headers Accept */* Referer http://wilson-cowden.com/wp-admin/SAP/app/user.php X-Requested-With XMLHttpRequest accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers Date Thu, 18 May 2023 04:57:56 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=97 Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
POST H/1.1	200 OK	fetch.php Show response wilson-cowden.com/wp-admin/SAP/panel/	1 B 206 B	128ms 128ms	XHR text/html	97.79.238.31 TWC-11427-TEXAS
General Check archive.org Show headers Download Go to Full URL http://wilson-cowden.com/wp-admin/SAP/panel/fetch.php Requested by Host: wilson-cowden.com URL: http://wilson-cowden.com/wp-admin/SAP/app/res/jq.js Protocol HTTP/1.1 Server 97.79.238.31 Dallas, United States, ASN11427 (TWC-11427-TEXAS, US), Reverse DNS gvo23831.gvodatacenter.com Software Apache / Resource Hash 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9 Request headers Accept */* Referer http://wilson-cowden.com/wp-admin/SAP/app/user.php X-Requested-With XMLHttpRequest accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers Date Thu, 18 May 2023 04:57:58 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=96 Transfer-Encoding chunked Content-Type text/html; charset=UTF-8

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Postbank (Banking)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless function| $ function| jQuery string| cd

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			wilson-cowden.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: b3f82e0580e350f02c6aa2833f37a95d

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

wilson-cowden.com
www.deutsche-bank.de
2600:9000:2251:4400:13:46b5:7d80:93a1
97.79.238.31
3dc541aa9bb40fe5df53166a1ae584f2df06bc3abf2237e5a46cf77c1d15c3d6
55cb206a77ff71092c309352fcb5927a389382ae678bab55f85ab13ed6239d31
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
8c477933a91763dd80d66840a72f9b25bee4250bc4adb2ec15932d5f6a473ecf
97fe447ddc107dc8b5f84af5b559f36c71eb2da143a98ef3080014d1f17c994a
9d02ee01919145c20b03ee9d3013af7118793dedf5d2c0696a773af90066c953
adc96b6efe5919552898681732312c97108a36e5d17d1bd20044c09f31b7e43b
b8a8edc065b41e0883a978e04e051a4d98aca9a71b28c39b74da16b11587420c
be4beee7d867a4c4702b8ab281d1d11884a6b7ae9a5e74aac6b141000cb248de
ed3071781924562c02f648cab6d9decda453e6b57d137a4dded6f85ae7be3901