www.sit-s.ru Open in urlscan Pro
195.16.62.67 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://www.sit-s.ru/css/wells/wellsfresh/5d476e9fe6ac58c416592fdc915f61c0/index2.html
Submission: On July 25 via automatic, source openphish (July 25th 2017, 11:06:07 am UTC)

Summary HTTP 25 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 25 HTTP transactions. The main IP is 195.16.62.67, located in Moscow, Russian Federation and belongs to SOVAM-AS, RU. The main domain is www.sit-s.ru.

This is the only time www.sit-s.ru was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Wells Fargo (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1	195.16.62.67 195.16.62.67	3216 (SOVAM-AS) (SOVAM-AS)
24	159.45.66.180 159.45.66.180	4196 (WELLSFARG...) (WELLSFARGO-4196 - Wells Fargo & Company)
25	3

1 195.16.62.67 (Moscow, Russian Federation)

ASN3216 (SOVAM-AS, RU)
PTR: acchosting1.co.ru

www.sit-s.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

24 159.45.66.180 (Saint Louis, United States)

ASN4196 (WELLSFARGO-4196 - Wells Fargo & Company, US)

oam.wellsfargo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
24	wellsfargo.com oam.wellsfargo.com	70 KB
1	sit-s.ru www.sit-s.ru	15 KB
25	2

	Domain	Requested by
24	oam.wellsfargo.com	www.sit-s.ru
1	www.sit-s.ru
25	2

This site contains links to these domains. Also see Links.

Domain
www.wellsfargo.com

Subject Issuer	Validity	Valid
oam.wellsfargo.com Symantec Class 3 Secure Server CA - G4	`2017-01-31` - `2019-02-01`	2 years	crt.sh

This page contains 1 frames:

Primary Page: http://www.sit-s.ru/css/wells/wellsfresh/5d476e9fe6ac58c416592fdc915f61c0/index2.html
Frame ID: 12416.1
Requests: 30 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

25
Requests

96 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

85 kB
Transfer

241 kB
Size

0
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://www.wellsfargo.com/

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/security/security-online-banking
Title: Online Security

Search URL Search Domain Scan URL

URL: http://www.wellsfargo.com/privacy-security/
Title: Privacy, Security & Legal

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

25 HTTP transactions
5 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request index2.html Show response
www.sit-s.ru/css/wells/wellsfresh/5d476e9fe6ac58c416592fdc915f61c0/ 37 KB
15 KB 98ms
51ms Document
text/html 195.16.62.67
SOVAM-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://www.sit-s.ru/css/wells/wellsfresh/5d476e9fe6ac58c416592fdc915f61c0/index2.html
Protocol: HTTP/1.1
Server: 195.16.62.67 Moscow, Russian Federation, ASN3216 (SOVAM-AS, RU),
Reverse DNS: acchosting1.co.ru
Software: nginx /
Resource Hash: e4c2757174f9804040c389165a8d5ae942b00bc66fdda71770674fece81400ed

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date: Tue, 25 Jul 2017 11:05:55 GMT
Content-Encoding: gzip
Last-Modified: Tue, 25 Jul 2017 10:45:27 GMT
Server: nginx
ETag: "704d49-9454-55522078b01e8"
Vary: Accept-Encoding
Content-Type: text/html
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 15192

GET
H/1.1 200
OK credentials.css
oam.wellsfargo.com/oamo/static/css/credentials/ 245 B
174 B 613ms
121ms Stylesheet
text/css 159.45.66.180
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://oam.wellsfargo.com/oamo/static/css/credentials/credentials.css?v=03C234801C

Requested by

Host: www.sit-s.ru
URL: http://www.sit-s.ru/css/wells/wellsfresh/5d476e9fe6ac58c416592fdc915f61c0/index2.html

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_256_CBC

Server

159.45.66.180 Saint Louis, United States, ASN4196 (WELLSFARGO-4196 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/1.1 /

Resource Hash

5c38b99055f7da6824bb50339b4ea10065344a781a03a43ab0f0fe43f22b02fa

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://www.sit-s.ru/css/wells/wellsfresh/5d476e9fe6ac58c416592fdc915f61c0/index2.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date: Tue, 25 Jul 2017 11:05:56 GMT
Content-encoding: gzip
Vary: accept-encoding
Last-modified: Thu, 22 Jun 2017 02:54:13 GMT
Server: KONICHIWA/1.1
Etag: W/"f5-594b3155"
X-frame-options: SAMEORIGIN
Content-type: text/css
Transfer-encoding: chunked

GET
H/1.1 200
OK theme.osmp.css
oam.wellsfargo.com/oamo/static/css/osmp/ 13 KB
2 KB 614ms
122ms Stylesheet
text/css 159.45.66.180
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://oam.wellsfargo.com/oamo/static/css/osmp/theme.osmp.css?v=03C234801C

Requested by

Host: www.sit-s.ru
URL: http://www.sit-s.ru/css/wells/wellsfresh/5d476e9fe6ac58c416592fdc915f61c0/index2.html

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_256_CBC

Server

159.45.66.180 Saint Louis, United States, ASN4196 (WELLSFARGO-4196 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/1.1 /

Resource Hash

d501bb99d93ad74a0a50fff37b814cf409cb108b57bd6d487e9147aee0da1af5

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://www.sit-s.ru/css/wells/wellsfresh/5d476e9fe6ac58c416592fdc915f61c0/index2.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date: Tue, 25 Jul 2017 11:05:56 GMT
Content-encoding: gzip
Vary: accept-encoding
Last-modified: Thu, 22 Jun 2017 02:54:08 GMT
Server: KONICHIWA/1.1
Etag: W/"3498-594b3150"
X-frame-options: SAMEORIGIN
Content-type: text/css
Transfer-encoding: chunked

GET
H/1.1 200
OK theme.osmp.header.css
oam.wellsfargo.com/oamo/static/css/osmp/ 2 KB
558 B 614ms
122ms Stylesheet
text/css 159.45.66.180
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://oam.wellsfargo.com/oamo/static/css/osmp/theme.osmp.header.css?v=03C234801C

Requested by

Host: www.sit-s.ru
URL: http://www.sit-s.ru/css/wells/wellsfresh/5d476e9fe6ac58c416592fdc915f61c0/index2.html

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_256_CBC

Server

159.45.66.180 Saint Louis, United States, ASN4196 (WELLSFARGO-4196 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/1.1 /

Resource Hash

f20007e3c12b9e4da4216a6b87b5af8044d65c9180d4250df3250fc5b30d2c05

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://www.sit-s.ru/css/wells/wellsfresh/5d476e9fe6ac58c416592fdc915f61c0/index2.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date: Tue, 25 Jul 2017 11:05:56 GMT
Content-encoding: gzip
Vary: accept-encoding
Last-modified: Thu, 22 Jun 2017 02:54:08 GMT
Server: KONICHIWA/1.1
Etag: W/"7fa-594b3150"
X-frame-options: SAMEORIGIN
Content-type: text/css
Transfer-encoding: chunked

GET
H/1.1 200
OK theme.osmp.footer.css
oam.wellsfargo.com/oamo/static/css/osmp/ 1 KB
407 B 625ms
124ms Stylesheet
text/css 159.45.66.180
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://oam.wellsfargo.com/oamo/static/css/osmp/theme.osmp.footer.css?v=03C234801C

Requested by

Host: www.sit-s.ru
URL: http://www.sit-s.ru/css/wells/wellsfresh/5d476e9fe6ac58c416592fdc915f61c0/index2.html

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_256_CBC

Server

159.45.66.180 Saint Louis, United States, ASN4196 (WELLSFARGO-4196 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/1.1 /

Resource Hash

5f0744f9c0bcf55875dea07a7c6735e8fa73dca86dd3f8301c4dc1ca85433039

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://www.sit-s.ru/css/wells/wellsfresh/5d476e9fe6ac58c416592fdc915f61c0/index2.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date: Tue, 25 Jul 2017 11:05:56 GMT
Content-encoding: gzip
Vary: accept-encoding
Last-modified: Thu, 22 Jun 2017 02:54:08 GMT
Server: KONICHIWA/1.1
Etag: W/"547-594b3150"
X-frame-options: SAMEORIGIN
Content-type: text/css
Transfer-encoding: chunked

GET
H/1.1 200
OK theme.osmp.input.css
oam.wellsfargo.com/oamo/static/css/osmp/ 1 KB
413 B 626ms
124ms Stylesheet
text/css 159.45.66.180
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://oam.wellsfargo.com/oamo/static/css/osmp/theme.osmp.input.css?v=03C234801C

Requested by

Host: www.sit-s.ru
URL: http://www.sit-s.ru/css/wells/wellsfresh/5d476e9fe6ac58c416592fdc915f61c0/index2.html

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_256_CBC

Server

159.45.66.180 Saint Louis, United States, ASN4196 (WELLSFARGO-4196 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/1.1 /

Resource Hash

784bf4aa7c36d37d2b84163901bbf5148b14f3e69bd6357d39c46860c2806543

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://www.sit-s.ru/css/wells/wellsfresh/5d476e9fe6ac58c416592fdc915f61c0/index2.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date: Tue, 25 Jul 2017 11:05:56 GMT
Content-encoding: gzip
Vary: accept-encoding
Last-modified: Thu, 22 Jun 2017 02:54:08 GMT
Server: KONICHIWA/1.1
Etag: W/"503-594b3150"
X-frame-options: SAMEORIGIN
Content-type: text/css
Transfer-encoding: chunked

GET
H/1.1 200
OK theme.osmp.button.css
oam.wellsfargo.com/oamo/static/css/osmp/ 4 KB
887 B 626ms
125ms Stylesheet
text/css 159.45.66.180
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://oam.wellsfargo.com/oamo/static/css/osmp/theme.osmp.button.css?v=03C234801C

Requested by

Host: www.sit-s.ru
URL: http://www.sit-s.ru/css/wells/wellsfresh/5d476e9fe6ac58c416592fdc915f61c0/index2.html

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_256_CBC

Server

159.45.66.180 Saint Louis, United States, ASN4196 (WELLSFARGO-4196 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/1.1 /

Resource Hash

8bd6dfbd3189012715af6d73dfdbb0956536221d5cc0c5bd04a49216a2448845

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://www.sit-s.ru/css/wells/wellsfresh/5d476e9fe6ac58c416592fdc915f61c0/index2.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date: Tue, 25 Jul 2017 11:05:56 GMT
Content-encoding: gzip
Vary: accept-encoding
Last-modified: Thu, 22 Jun 2017 02:54:08 GMT
Server: KONICHIWA/1.1
Etag: W/"1063-594b3150"
X-frame-options: SAMEORIGIN
Content-type: text/css
Transfer-encoding: chunked

GET
H/1.1 200
OK theme.osmp.loadingaction.css
oam.wellsfargo.com/oamo/static/css/osmp/ 991 B
336 B 734ms
121ms Stylesheet
text/css 159.45.66.180
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://oam.wellsfargo.com/oamo/static/css/osmp/theme.osmp.loadingaction.css?v=03C234801C

Requested by

Host: www.sit-s.ru
URL: http://www.sit-s.ru/css/wells/wellsfresh/5d476e9fe6ac58c416592fdc915f61c0/index2.html

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_256_CBC

Server

159.45.66.180 Saint Louis, United States, ASN4196 (WELLSFARGO-4196 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/1.1 /

Resource Hash

61a7ed250cf75e92062fc589fc424c9cf5bd857ef37bbc8b36aaa54cd2de700b

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://www.sit-s.ru/css/wells/wellsfresh/5d476e9fe6ac58c416592fdc915f61c0/index2.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date: Tue, 25 Jul 2017 11:05:56 GMT
Content-encoding: gzip
Vary: accept-encoding
Last-modified: Thu, 22 Jun 2017 02:54:08 GMT
Server: KONICHIWA/1.1
Etag: W/"3df-594b3150"
X-frame-options: SAMEORIGIN
Content-type: text/css
Transfer-encoding: chunked

GET
H/1.1 200
OK theme.osmp.balloon.css
oam.wellsfargo.com/oamo/static/css/osmp/ 3 KB
687 B 735ms
121ms Stylesheet
text/css 159.45.66.180
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://oam.wellsfargo.com/oamo/static/css/osmp/theme.osmp.balloon.css?v=03C234801C

Requested by

Host: www.sit-s.ru
URL: http://www.sit-s.ru/css/wells/wellsfresh/5d476e9fe6ac58c416592fdc915f61c0/index2.html

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_256_CBC

Server

159.45.66.180 Saint Louis, United States, ASN4196 (WELLSFARGO-4196 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/1.1 /

Resource Hash

b504e0022bc90bc8e77af06a4ff8b079369b3edbc2ba9643b361365c76fcd30f

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://www.sit-s.ru/css/wells/wellsfresh/5d476e9fe6ac58c416592fdc915f61c0/index2.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date: Tue, 25 Jul 2017 11:05:56 GMT
Content-encoding: gzip
Vary: accept-encoding
Last-modified: Thu, 22 Jun 2017 02:54:08 GMT
Server: KONICHIWA/1.1
Etag: W/"bf1-594b3150"
X-frame-options: SAMEORIGIN
Content-type: text/css
Transfer-encoding: chunked

GET
H/1.1 200
OK theme.osmp.lightbox.css
oam.wellsfargo.com/oamo/static/css/osmp/ 1 KB
491 B 735ms
121ms Stylesheet
text/css 159.45.66.180
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://oam.wellsfargo.com/oamo/static/css/osmp/theme.osmp.lightbox.css?v=03C234801C

Requested by

Host: www.sit-s.ru
URL: http://www.sit-s.ru/css/wells/wellsfresh/5d476e9fe6ac58c416592fdc915f61c0/index2.html

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_256_CBC

Server

159.45.66.180 Saint Louis, United States, ASN4196 (WELLSFARGO-4196 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/1.1 /

Resource Hash

a193797b0993aa5f32fad12b74d85b45dd4475e44b7f9c4767edbf8636d9ed02

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://www.sit-s.ru/css/wells/wellsfresh/5d476e9fe6ac58c416592fdc915f61c0/index2.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date: Tue, 25 Jul 2017 11:05:56 GMT
Content-encoding: gzip
Vary: accept-encoding
Last-modified: Thu, 22 Jun 2017 02:54:08 GMT
Server: KONICHIWA/1.1
Etag: W/"5ae-594b3150"
X-frame-options: SAMEORIGIN
Content-type: text/css
Transfer-encoding: chunked

GET
H/1.1 200
OK theme.osmp.pwreset.css
oam.wellsfargo.com/oamo/static/css/osmp/ 1 KB
422 B 750ms
125ms Stylesheet
text/css 159.45.66.180
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://oam.wellsfargo.com/oamo/static/css/osmp/theme.osmp.pwreset.css?v=03C234801C

Requested by

Host: www.sit-s.ru
URL: http://www.sit-s.ru/css/wells/wellsfresh/5d476e9fe6ac58c416592fdc915f61c0/index2.html

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_256_CBC

Server

159.45.66.180 Saint Louis, United States, ASN4196 (WELLSFARGO-4196 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/1.1 /

Resource Hash

285ee606694bd0772bf2a45e7427d52b8d42f71888633ecf9f3a7b9e8dc35b12

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://www.sit-s.ru/css/wells/wellsfresh/5d476e9fe6ac58c416592fdc915f61c0/index2.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date: Tue, 25 Jul 2017 11:05:56 GMT
Content-encoding: gzip
Vary: accept-encoding
Last-modified: Thu, 22 Jun 2017 02:54:13 GMT
Server: KONICHIWA/1.1
Etag: W/"53c-594b3155"
X-frame-options: SAMEORIGIN
Content-type: text/css
Transfer-encoding: chunked

GET
H/1.1 200
OK crosspFindUsername.css
oam.wellsfargo.com/oamo/static/css/credentials/ 107 B
83 B 750ms
125ms Stylesheet
text/css 159.45.66.180
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://oam.wellsfargo.com/oamo/static/css/credentials/crosspFindUsername.css?v=03C234801C

Requested by

Host: www.sit-s.ru
URL: http://www.sit-s.ru/css/wells/wellsfresh/5d476e9fe6ac58c416592fdc915f61c0/index2.html

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_256_CBC

Server

159.45.66.180 Saint Louis, United States, ASN4196 (WELLSFARGO-4196 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/1.1 /

Resource Hash

a8490259a313230faf6d7a6810532fb2805bec925d60b8aaea5c89501d2e8a6d

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://www.sit-s.ru/css/wells/wellsfresh/5d476e9fe6ac58c416592fdc915f61c0/index2.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date: Tue, 25 Jul 2017 11:05:56 GMT
Content-encoding: gzip
Vary: accept-encoding
Last-modified: Thu, 22 Jun 2017 02:54:13 GMT
Server: KONICHIWA/1.1
Etag: W/"6b-594b3155"
X-frame-options: SAMEORIGIN
Content-type: text/css
Transfer-encoding: chunked

GET
H/1.1 200
OK icn-ind-loading-page-glob-70x70-000720-v01_00@1x.gif
oam.wellsfargo.com/oamo/static/images/ 19 KB
19 KB 122ms
122ms Image
image/gif 159.45.66.180
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://oam.wellsfargo.com/oamo/static/images/icn-ind-loading-page-glob-70x70-000720-v01_00@1x.gif

Requested by

Host: www.sit-s.ru
URL: http://www.sit-s.ru/css/wells/wellsfresh/5d476e9fe6ac58c416592fdc915f61c0/index2.html

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_256_CBC

Server

159.45.66.180 Saint Louis, United States, ASN4196 (WELLSFARGO-4196 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/1.1 /

Resource Hash

0a646e5aa2bffaf7fe24e63ed8b5b736264707497f2724c53c27995448ead57b

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://www.sit-s.ru/css/wells/wellsfresh/5d476e9fe6ac58c416592fdc915f61c0/index2.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date: Tue, 25 Jul 2017 11:05:56 GMT
Last-modified: Thu, 22 Jun 2017 02:54:08 GMT
Server: KONICHIWA/1.1
Etag: "4a15-594b3150"
X-frame-options: SAMEORIGIN
Content-type: image/gif
Accept-ranges: bytes
Content-length: 18965

GET
H/1.1 200
OK theme.osmp.timeout.css
oam.wellsfargo.com/oamo/static/css/osmp/ 2 KB
628 B 751ms
125ms Stylesheet
text/css 159.45.66.180
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://oam.wellsfargo.com/oamo/static/css/osmp/theme.osmp.timeout.css?v=03C234801C

Requested by

Host: www.sit-s.ru
URL: http://www.sit-s.ru/css/wells/wellsfresh/5d476e9fe6ac58c416592fdc915f61c0/index2.html

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_256_CBC

Server

159.45.66.180 Saint Louis, United States, ASN4196 (WELLSFARGO-4196 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/1.1 /

Resource Hash

409bb0fda65031ecb46a7c70e6e1e9cdec272980903bde0e95861c69676f07bb

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://www.sit-s.ru/css/wells/wellsfresh/5d476e9fe6ac58c416592fdc915f61c0/index2.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date: Tue, 25 Jul 2017 11:05:56 GMT
Content-encoding: gzip
Vary: accept-encoding
Last-modified: Thu, 22 Jun 2017 02:54:13 GMT
Server: KONICHIWA/1.1
Etag: W/"702-594b3155"
X-frame-options: SAMEORIGIN
Content-type: text/css
Transfer-encoding: chunked

GET
H/1.1 200
OK x-button.png
oam.wellsfargo.com/oamo/static/images/ 2 KB
2 KB 121ms
121ms Image
image/png 159.45.66.180
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://oam.wellsfargo.com/oamo/static/images/x-button.png

Requested by

Host: www.sit-s.ru
URL: http://www.sit-s.ru/css/wells/wellsfresh/5d476e9fe6ac58c416592fdc915f61c0/index2.html

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_256_CBC

Server

159.45.66.180 Saint Louis, United States, ASN4196 (WELLSFARGO-4196 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/1.1 /

Resource Hash

1e6897f16252610e8ef3db2e7e6e2ad93679362bc33adbb0ea7f4512427b4bf6

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://www.sit-s.ru/css/wells/wellsfresh/5d476e9fe6ac58c416592fdc915f61c0/index2.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date: Tue, 25 Jul 2017 11:05:56 GMT
Last-modified: Thu, 22 Jun 2017 02:54:08 GMT
Server: KONICHIWA/1.1
Etag: "7b7-594b3150"
X-frame-options: SAMEORIGIN
Content-type: image/png
Accept-ranges: bytes
Content-length: 1975

GET
H/1.1 200
OK hook.down.png
oam.wellsfargo.com/oamo/static/images/ 1 KB
1 KB 125ms
125ms Image
image/png 159.45.66.180
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://oam.wellsfargo.com/oamo/static/images/hook.down.png

Requested by

Host: www.sit-s.ru
URL: http://www.sit-s.ru/css/wells/wellsfresh/5d476e9fe6ac58c416592fdc915f61c0/index2.html

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_256_CBC

Server

159.45.66.180 Saint Louis, United States, ASN4196 (WELLSFARGO-4196 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/1.1 /

Resource Hash

a05c326b16b3173fbf8e999d38e907d35bb00c0cb245fa675776c9a2fd788e17

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://www.sit-s.ru/css/wells/wellsfresh/5d476e9fe6ac58c416592fdc915f61c0/index2.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date: Tue, 25 Jul 2017 11:05:56 GMT
Last-modified: Thu, 22 Jun 2017 02:54:08 GMT
Server: KONICHIWA/1.1
Etag: "499-594b3150"
X-frame-options: SAMEORIGIN
Content-type: image/png
Accept-ranges: bytes
Content-length: 1177

GET
H/1.1 200
OK icon_error.png
oam.wellsfargo.com/oamo/static/images/ 395 B
395 B 124ms
124ms Image
image/png 159.45.66.180
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://oam.wellsfargo.com/oamo/static/images/icon_error.png

Requested by

Host: www.sit-s.ru
URL: http://www.sit-s.ru/css/wells/wellsfresh/5d476e9fe6ac58c416592fdc915f61c0/index2.html

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_256_CBC

Server

159.45.66.180 Saint Louis, United States, ASN4196 (WELLSFARGO-4196 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/1.1 /

Resource Hash

00b2519c3ecb866ffc2be3565c3c5199ce0b8f07c7e627404a0253e73f00c83e

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://www.sit-s.ru/css/wells/wellsfresh/5d476e9fe6ac58c416592fdc915f61c0/index2.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date: Tue, 25 Jul 2017 11:05:56 GMT
Last-modified: Thu, 22 Jun 2017 02:54:08 GMT
Server: KONICHIWA/1.1
Etag: "18b-594b3150"
X-frame-options: SAMEORIGIN
Content-type: image/png
Accept-ranges: bytes
Content-length: 395

GET
H/1.1 200
OK icon_error_12x12.png
oam.wellsfargo.com/oamo/static/images/ 459 B
459 B 120ms
120ms Image
image/png 159.45.66.180
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://oam.wellsfargo.com/oamo/static/images/icon_error_12x12.png

Requested by

Host: www.sit-s.ru
URL: http://www.sit-s.ru/css/wells/wellsfresh/5d476e9fe6ac58c416592fdc915f61c0/index2.html

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_256_CBC

Server

159.45.66.180 Saint Louis, United States, ASN4196 (WELLSFARGO-4196 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/1.1 /

Resource Hash

16ac51ca358205cc31371ba5b7d118808effba8849a09a2473c3528edb6c72d9

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://www.sit-s.ru/css/wells/wellsfresh/5d476e9fe6ac58c416592fdc915f61c0/index2.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date: Tue, 25 Jul 2017 11:05:56 GMT
Last-modified: Thu, 22 Jun 2017 02:54:08 GMT
Server: KONICHIWA/1.1
Etag: "1cb-594b3150"
X-frame-options: SAMEORIGIN
Content-type: image/png
Accept-ranges: bytes
Content-length: 459

GET
H/1.1 200
OK icn-ind-help-form-darkteal-glob-16x16-000750-v01_00@1x.png
oam.wellsfargo.com/oamo/static/images/ 309 B
309 B 235ms
121ms Image
image/png 159.45.66.180
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://oam.wellsfargo.com/oamo/static/images/icn-ind-help-form-darkteal-glob-16x16-000750-v01_00@1x.png

Requested by

Host: www.sit-s.ru
URL: http://www.sit-s.ru/css/wells/wellsfresh/5d476e9fe6ac58c416592fdc915f61c0/index2.html

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_256_CBC

Server

159.45.66.180 Saint Louis, United States, ASN4196 (WELLSFARGO-4196 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/1.1 /

Resource Hash

66045233d2ee1cee32d15db765bf0128a7e1668f893d3b22a52ba501420ebf3b

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://www.sit-s.ru/css/wells/wellsfresh/5d476e9fe6ac58c416592fdc915f61c0/index2.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date: Tue, 25 Jul 2017 11:05:56 GMT
Last-modified: Thu, 22 Jun 2017 02:54:08 GMT
Server: KONICHIWA/1.1
Etag: "135-594b3150"
X-frame-options: SAMEORIGIN
Content-type: image/png
Accept-ranges: bytes
Content-length: 309

GET
DATA 200
OK truncated
/ 6 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d37bd2b0d972b4d93225150196da6b4b0ba8d1daf224b54ccec32ad5632f5a3f

Request headers

Response headers

Access-Control-Allow-Origin: *
Content-Type: image/png

GET
DATA 200
OK truncated
/ 4 KB
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: edc5ee3b590dae17b0eb19063c34680c15ee144d13583d006e6a7976b69cd2db

Request headers

Response headers

Access-Control-Allow-Origin: *
Content-Type: image/gif

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1e6897f16252610e8ef3db2e7e6e2ad93679362bc33adbb0ea7f4512427b4bf6

Request headers

Response headers

Access-Control-Allow-Origin: *
Content-Type: image/png

GET
DATA 200
OK truncated
/ 212 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8a46f7e1801bbc650201f5fd410d1854ff5e62c284414de48d418bed2f33fc8a

Request headers

Response headers

Access-Control-Allow-Origin: *
Content-Type: image/gif

GET
DATA 200
OK truncated
/ 6 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d37bd2b0d972b4d93225150196da6b4b0ba8d1daf224b54ccec32ad5632f5a3f

Request headers

Response headers

Access-Control-Allow-Origin: *
Content-Type: image/png

GET
H/1.1 200
OK jquery.min.js Show response
oam.wellsfargo.com/oamo/static/js/ 94 KB
33 KB 134ms
134ms Script
application/x-javascript 159.45.66.180
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://oam.wellsfargo.com/oamo/static/js/jquery.min.js?v=03C234801C

Requested by

Host: www.sit-s.ru
URL: http://www.sit-s.ru/css/wells/wellsfresh/5d476e9fe6ac58c416592fdc915f61c0/index2.html

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_256_CBC

Server

159.45.66.180 Saint Louis, United States, ASN4196 (WELLSFARGO-4196 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/1.1 /

Resource Hash

111293483bce043cdb7773fef81c2118cfbf3664646133d0137a1f7d87c488e5

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://www.sit-s.ru/css/wells/wellsfresh/5d476e9fe6ac58c416592fdc915f61c0/index2.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date: Tue, 25 Jul 2017 11:05:56 GMT
Content-encoding: gzip
Vary: accept-encoding
Last-modified: Thu, 22 Jun 2017 02:54:13 GMT
Server: KONICHIWA/1.1
Etag: W/"1795d-594b3155"
X-frame-options: SAMEORIGIN
Content-type: application/x-javascript
Transfer-encoding: chunked

GET
H/1.1 200
OK validation.js Show response
oam.wellsfargo.com/oamo/static/js/ 6 KB
1 KB 126ms
126ms Script
application/x-javascript 159.45.66.180
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://oam.wellsfargo.com/oamo/static/js/validation.js?v=03C234801C

Requested by

Host: www.sit-s.ru
URL: http://www.sit-s.ru/css/wells/wellsfresh/5d476e9fe6ac58c416592fdc915f61c0/index2.html

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_256_CBC

Server

159.45.66.180 Saint Louis, United States, ASN4196 (WELLSFARGO-4196 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/1.1 /

Resource Hash

3cfe502469eef218de7117a10c28faef7aa0a964f94d3a92920a395162c885f7

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://www.sit-s.ru/css/wells/wellsfresh/5d476e9fe6ac58c416592fdc915f61c0/index2.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date: Tue, 25 Jul 2017 11:05:56 GMT
Content-encoding: gzip
Vary: accept-encoding
Last-modified: Thu, 22 Jun 2017 02:54:13 GMT
Server: KONICHIWA/1.1
Etag: W/"194d-594b3155"
X-frame-options: SAMEORIGIN
Content-type: application/x-javascript
Transfer-encoding: chunked

GET
H/1.1 200
OK timeout.js Show response
oam.wellsfargo.com/oamo/static/js/ 9 KB
2 KB 126ms
126ms Script
application/x-javascript 159.45.66.180
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://oam.wellsfargo.com/oamo/static/js/timeout.js?v=03C234801C

Requested by

Host: www.sit-s.ru
URL: http://www.sit-s.ru/css/wells/wellsfresh/5d476e9fe6ac58c416592fdc915f61c0/index2.html

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_256_CBC

Server

159.45.66.180 Saint Louis, United States, ASN4196 (WELLSFARGO-4196 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/1.1 /

Resource Hash

ffa2a92da68614927e93057d1f7116b42ba0734a58f7cae12265c8a27ae8ba0f

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://www.sit-s.ru/css/wells/wellsfresh/5d476e9fe6ac58c416592fdc915f61c0/index2.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date: Tue, 25 Jul 2017 11:05:56 GMT
Content-encoding: gzip
Vary: accept-encoding
Last-modified: Thu, 22 Jun 2017 02:54:08 GMT
Server: KONICHIWA/1.1
Etag: W/"25fc-594b3150"
X-frame-options: SAMEORIGIN
Content-type: application/x-javascript
Transfer-encoding: chunked

GET
H/1.1 200
OK theme.osmp.balloon.js Show response
oam.wellsfargo.com/oamo/static/js/osmp/ 7 KB
1 KB 121ms
121ms Script
application/x-javascript 159.45.66.180
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://oam.wellsfargo.com/oamo/static/js/osmp/theme.osmp.balloon.js?v=03C234801C

Requested by

Host: www.sit-s.ru
URL: http://www.sit-s.ru/css/wells/wellsfresh/5d476e9fe6ac58c416592fdc915f61c0/index2.html

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_256_CBC

Server

159.45.66.180 Saint Louis, United States, ASN4196 (WELLSFARGO-4196 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/1.1 /

Resource Hash

7507dd5ac80ce12666fa39b0e7d7d571b4f40b0ae47c9b58b243fedb771dc550

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://www.sit-s.ru/css/wells/wellsfresh/5d476e9fe6ac58c416592fdc915f61c0/index2.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date: Tue, 25 Jul 2017 11:05:56 GMT
Content-encoding: gzip
Vary: accept-encoding
Last-modified: Thu, 22 Jun 2017 02:54:13 GMT
Server: KONICHIWA/1.1
Etag: W/"1c2b-594b3155"
X-frame-options: SAMEORIGIN
Content-type: application/x-javascript
Transfer-encoding: chunked

GET
H/1.1 200
OK theme.osmp.lightbox.js Show response
oam.wellsfargo.com/oamo/static/js/osmp/ 7 KB
1 KB 123ms
122ms Script
application/x-javascript 159.45.66.180
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://oam.wellsfargo.com/oamo/static/js/osmp/theme.osmp.lightbox.js?v=03C234801C

Requested by

Host: www.sit-s.ru
URL: http://www.sit-s.ru/css/wells/wellsfresh/5d476e9fe6ac58c416592fdc915f61c0/index2.html

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_256_CBC

Server

159.45.66.180 Saint Louis, United States, ASN4196 (WELLSFARGO-4196 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/1.1 /

Resource Hash

91a6ed18ee4ce6197e3bb7b79cba2ad9808fa26e069cfe4e8958725ba4753e71

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://www.sit-s.ru/css/wells/wellsfresh/5d476e9fe6ac58c416592fdc915f61c0/index2.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date: Tue, 25 Jul 2017 11:05:56 GMT
Content-encoding: gzip
Vary: accept-encoding
Last-modified: Thu, 22 Jun 2017 02:54:13 GMT
Server: KONICHIWA/1.1
Etag: W/"1b90-594b3155"
X-frame-options: SAMEORIGIN
Content-type: application/x-javascript
Transfer-encoding: chunked

GET
H/1.1 200
OK crosspFindUsername.js Show response
oam.wellsfargo.com/oamo/static/js/ 9 KB
2 KB 123ms
122ms Script
application/x-javascript 159.45.66.180
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://oam.wellsfargo.com/oamo/static/js/crosspFindUsername.js?v=03C234801C

Requested by

Host: www.sit-s.ru
URL: http://www.sit-s.ru/css/wells/wellsfresh/5d476e9fe6ac58c416592fdc915f61c0/index2.html

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_256_CBC

Server

159.45.66.180 Saint Louis, United States, ASN4196 (WELLSFARGO-4196 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/1.1 /

Resource Hash

0c52f344b3d16f151fe0489365de80c093f99490405523e312ea5b9923aeb615

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://www.sit-s.ru/css/wells/wellsfresh/5d476e9fe6ac58c416592fdc915f61c0/index2.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date: Tue, 25 Jul 2017 11:05:56 GMT
Content-encoding: gzip
Vary: accept-encoding
Last-modified: Thu, 22 Jun 2017 02:54:13 GMT
Server: KONICHIWA/1.1
Etag: W/"24c4-594b3155"
X-frame-options: SAMEORIGIN
Content-type: application/x-javascript
Transfer-encoding: chunked

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Wells Fargo (Banking)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

oam.wellsfargo.com
www.sit-s.ru
159.45.66.180
195.16.62.67
00b2519c3ecb866ffc2be3565c3c5199ce0b8f07c7e627404a0253e73f00c83e
0a646e5aa2bffaf7fe24e63ed8b5b736264707497f2724c53c27995448ead57b
0c52f344b3d16f151fe0489365de80c093f99490405523e312ea5b9923aeb615
111293483bce043cdb7773fef81c2118cfbf3664646133d0137a1f7d87c488e5
16ac51ca358205cc31371ba5b7d118808effba8849a09a2473c3528edb6c72d9
1e6897f16252610e8ef3db2e7e6e2ad93679362bc33adbb0ea7f4512427b4bf6
285ee606694bd0772bf2a45e7427d52b8d42f71888633ecf9f3a7b9e8dc35b12
3cfe502469eef218de7117a10c28faef7aa0a964f94d3a92920a395162c885f7
409bb0fda65031ecb46a7c70e6e1e9cdec272980903bde0e95861c69676f07bb
5c38b99055f7da6824bb50339b4ea10065344a781a03a43ab0f0fe43f22b02fa
5f0744f9c0bcf55875dea07a7c6735e8fa73dca86dd3f8301c4dc1ca85433039
61a7ed250cf75e92062fc589fc424c9cf5bd857ef37bbc8b36aaa54cd2de700b
66045233d2ee1cee32d15db765bf0128a7e1668f893d3b22a52ba501420ebf3b
7507dd5ac80ce12666fa39b0e7d7d571b4f40b0ae47c9b58b243fedb771dc550
784bf4aa7c36d37d2b84163901bbf5148b14f3e69bd6357d39c46860c2806543
8a46f7e1801bbc650201f5fd410d1854ff5e62c284414de48d418bed2f33fc8a
8bd6dfbd3189012715af6d73dfdbb0956536221d5cc0c5bd04a49216a2448845
91a6ed18ee4ce6197e3bb7b79cba2ad9808fa26e069cfe4e8958725ba4753e71
a05c326b16b3173fbf8e999d38e907d35bb00c0cb245fa675776c9a2fd788e17
a193797b0993aa5f32fad12b74d85b45dd4475e44b7f9c4767edbf8636d9ed02
a8490259a313230faf6d7a6810532fb2805bec925d60b8aaea5c89501d2e8a6d
b504e0022bc90bc8e77af06a4ff8b079369b3edbc2ba9643b361365c76fcd30f
d37bd2b0d972b4d93225150196da6b4b0ba8d1daf224b54ccec32ad5632f5a3f
d501bb99d93ad74a0a50fff37b814cf409cb108b57bd6d487e9147aee0da1af5
e4c2757174f9804040c389165a8d5ae942b00bc66fdda71770674fece81400ed
edc5ee3b590dae17b0eb19063c34680c15ee144d13583d006e6a7976b69cd2db
f20007e3c12b9e4da4216a6b87b5af8044d65c9180d4250df3250fc5b30d2c05
ffa2a92da68614927e93057d1f7116b42ba0734a58f7cae12265c8a27ae8ba0f

www.sit-s.ru Open in urlscan Pro 195.16.62.67 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

25 Requests

96 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

3 IPs

2 Countries

85 kBTransfer

241 kBSize

0 Cookies

3 Outgoing links

Redirected requests

25 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 5 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

www.sit-s.ru Open in urlscan Pro
195.16.62.67 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

25
Requests

96 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

85 kB
Transfer

241 kB
Size

0
Cookies

25 HTTP transactions
5 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!