chezyoussef.com
Open in
urlscan Pro
162.241.5.182
Malicious Activity!
Public Scan
Effective URL: http://chezyoussef.com/securelogin/wells2/74a967f540b72a4f024b567178ca52cb/login.php
Submission: On October 13 via api from US
Summary
This is the only time chezyoussef.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Wells Fargo (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 2606:4700:30:... 2606:4700:30::681b:b549 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
12 | 162.241.5.182 162.241.5.182 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1 - Unified Layer) | |
12 | 1 |
ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US)
PTR: 162-241-5-182.unifiedlayer.com
chezyoussef.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
chezyoussef.com
chezyoussef.com |
1 MB |
1 |
cli.re
1 redirects
cli.re |
442 B |
12 | 2 |
Domain | Requested by | |
---|---|---|
12 | chezyoussef.com |
chezyoussef.com
|
1 | cli.re | 1 redirects |
12 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid |
---|
This page contains 1 frames:
Primary Page:
http://chezyoussef.com/securelogin/wells2/74a967f540b72a4f024b567178ca52cb/login.php
Frame ID: 7720381D54BAF9D73772AF8A427174FD
Requests: 12 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://cli.re/mNqRrj
HTTP 301
http://chezyoussef.com/securelogin/wells2/74a967f540b72a4f024b567178ca52cb/login.php Page URL
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://cli.re/mNqRrj
HTTP 301
http://chezyoussef.com/securelogin/wells2/74a967f540b72a4f024b567178ca52cb/login.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
login.php
chezyoussef.com/securelogin/wells2/74a967f540b72a4f024b567178ca52cb/ Redirect Chain
|
2 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style.css
chezyoussef.com/securelogin/wells2/74a967f540b72a4f024b567178ca52cb/ |
3 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
img-1.png
chezyoussef.com/securelogin/wells2/74a967f540b72a4f024b567178ca52cb/images/ |
11 KB 11 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
img-2.png
chezyoussef.com/securelogin/wells2/74a967f540b72a4f024b567178ca52cb/images/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
img-3.png
chezyoussef.com/securelogin/wells2/74a967f540b72a4f024b567178ca52cb/images/ |
5 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bg-img.jpg
chezyoussef.com/securelogin/wells2/74a967f540b72a4f024b567178ca52cb/images/ |
116 KB 117 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bg-img2.png
chezyoussef.com/securelogin/wells2/74a967f540b72a4f024b567178ca52cb/images/ |
7 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bg-img-3.png
chezyoussef.com/securelogin/wells2/74a967f540b72a4f024b567178ca52cb/images/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bg-img-4.png
chezyoussef.com/securelogin/wells2/74a967f540b72a4f024b567178ca52cb/images/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
img-5.png
chezyoussef.com/securelogin/wells2/74a967f540b72a4f024b567178ca52cb/images/ |
257 KB 258 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
img-6.png
chezyoussef.com/securelogin/wells2/74a967f540b72a4f024b567178ca52cb/images/ |
581 KB 581 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
img-7.png
chezyoussef.com/securelogin/wells2/74a967f540b72a4f024b567178ca52cb/images/ |
72 KB 72 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Wells Fargo (Banking)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
chezyoussef.com
cli.re
162.241.5.182
2606:4700:30::681b:b549
328c6d9ab90bd814878072544348125e704d2fa136bc5c6e8d904f8d2458a852
4014bada6a2ce1a8dcb83082b3ef6d3522679f16e9d6609cd44a7928c9f4e0fa
4c75b0f681ad314aac6f5b318194a4a8d22e964cf163406f7ff6fee524be375f
66fecd5b4b4d662f5a29951e7bd8b4f2fbbb5330453ff362075baea939d10d9d
82e3443bd64a249685de272981f537d11920e9ef0ed67b5988f2baf996b755bf
9160b1ebedc5a53c0e2d747b7363dc05baa62e66fceccccb4470130352f68c94
9f8917b5a103efe748fd50c9d05a200bfac23169f89917c7a69a697c0f4c7adb
ae75390d46e8fc223ff816dd6d581c29908b846250f49f3f6ee1171b059fa2f2
bcebb0441bbf3c54aa3f9d0afc4dbe24ac2ce9616f82967452f4e56976307acd
c84c88d83b2609137aee9f46f7905dd42778d532a53bf1999436cbac1657a8c6
c8ee64c57e1735294f886bb2d93250459ccf8a76d89cfb2a82c46cc866697926
d3564a89fbf64bbe5ef885b0d5e1faa07fd8c33920ae5a4b9375fa588ca2314b