7alameh.biz Open in urlscan Pro
111.90.140.19 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://7alameh.biz/wells.htm
Submission Tags: @ipnigh
Submission: On April 16 via api (April 16th 2020, 2:22:54 am UTC) from GB

Summary HTTP 15 Redirects Links 14 Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 15 HTTP transactions. The main IP is 111.90.140.19, located in Malaysia and belongs to SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY. The main domain is 7alameh.biz.
TLS certificate: Issued by Let's Encrypt Authority X3 on April 14th 2020. Valid for: 3 months.

This is the only time 7alameh.biz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Wells Fargo (Banking)

Domain & IP information

	IP Address	AS Autonomous System
14	111.90.140.19 111.90.140.19	45839 (SHINJIRU-...) (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd)
1	159.45.2.156 159.45.2.156	10837 (WELLSFARG...) (WELLSFARGO-10837)
15	2

14 111.90.140.19 (Malaysia)

ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY)
PTR: mail1.kanueamt.website

7alameh.biz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 159.45.2.156 (Charlotte, United States)

ASN10837 (WELLSFARGO-10837, US)

connect.secure.wellsfargo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	7alameh.biz 7alameh.biz	241 KB
1	wellsfargo.com connect.secure.wellsfargo.com	16 KB
15	2

	Domain	Requested by
14	7alameh.biz	7alameh.biz
1	connect.secure.wellsfargo.com	7alameh.biz
15	2

This site contains links to these domains. Also see Links.

Domain
www.wellsfargo.com

Subject Issuer	Validity	Valid
7alameh.biz Let's Encrypt Authority X3	`2020-04-14` - `2020-07-13`	3 months	crt.sh
connect.secure.wellsfargo.com DigiCert Global CA G2	`2019-02-07` - `2021-02-07`	2 years	crt.sh

This page contains 1 frames:

Primary Page: https://7alameh.biz/wells.htm
Frame ID: F016B8E0C3BB7196DB258AECF0E47F0C
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

15
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

257 kB
Transfer

285 kB
Size

1
Cookies

14 Outgoing links

These are links going to different origins than the main page.

URL: https://www.wellsfargo.com/
Title:

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/help/
Title: Customer Service

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/locator/
Title: Locations

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/products_services/applications_viewall.jhtml
Title: Apply

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/commitment
Title: Learn More

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/commitment/faqs/
Title: Frequently asked questions >

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/help/faqs/sign-on
Title: Email Security Help

Search URL Search Domain Scan URL

URL: http://www.wellsfargo.com/agreement
Title: www.wellsfargo.com/agreement

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/about/
Title: About Wells Fargo

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/careers/
Title: Careers

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/privacy-security/
Title: Privacy, Security & Legal

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/privacy-security/fraud/report/phish
Title: Report Email Fraud

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/sitemap
Title: Sitemap

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/privacy-security/privacy/online#adchoices
Title: Ad Choices

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request wells.htm Show response
7alameh.biz/ 10 KB
11 KB 1294ms
216ms Document
text/html 111.90.140.19
SHINJIRU-MY-AS-AP...

General

Check archive.org

Show headers Download Go to

Full URL: https://7alameh.biz/wells.htm
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 111.90.140.19 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS: mail1.kanueamt.website
Software: Apache /
Resource Hash: 930e23aab6e72ed98e430a83b13884ec57f284f7e067f6a5de70a9130e7676a5

Request headers

Host: 7alameh.biz
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 16 Apr 2020 02:22:24 GMT
Server: Apache
Last-Modified: Tue, 06 Feb 2018 13:28:22 GMT
Accept-Ranges: bytes
Content-Length: 10536
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html

GET
H/1.1 200
OK nd Show response
7alameh.biz/wells_files/ 39 KB
39 KB 634ms
211ms Script
text/plain 111.90.140.19
SHINJIRU-MY-AS-AP...

General

Check archive.org

Show headers Download Go to

Full URL: https://7alameh.biz/wells_files/nd
Requested by: Host: 7alameh.biz
URL: https://7alameh.biz/wells.htm
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 111.90.140.19 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS: mail1.kanueamt.website
Software: Apache /
Resource Hash: ffc539eb345f9466fecbe7b7ea8d2db0f56ef3857c8b26159d9a230bf9afdb4a

Request headers

Referer: https://7alameh.biz/wells.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 16 Apr 2020 02:22:24 GMT
Last-Modified: Tue, 06 Feb 2018 08:42:16 GMT
Server: Apache
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 39657

GET
H/1.1 200
OK signonCommitment.css
7alameh.biz/wells_files/ 6 KB
6 KB 216ms
215ms Stylesheet
text/css 111.90.140.19
SHINJIRU-MY-AS-AP...

General

Check archive.org

Show headers Download Go to

Full URL: https://7alameh.biz/wells_files/signonCommitment.css
Requested by: Host: 7alameh.biz
URL: https://7alameh.biz/wells.htm
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 111.90.140.19 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS: mail1.kanueamt.website
Software: Apache /
Resource Hash: 7c21a45f9e10b50948faf43421ae13f1a49c75c9e44604c63b9bd1c34075d474

Request headers

Referer: https://7alameh.biz/wells.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 16 Apr 2020 02:22:24 GMT
Last-Modified: Tue, 06 Feb 2018 08:42:16 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 6022

GET
H/1.1 200
OK theme.css
7alameh.biz/wells_files/ 8 KB
9 KB 432ms
215ms Stylesheet
text/css 111.90.140.19
SHINJIRU-MY-AS-AP...

General

Check archive.org

Show headers Download Go to

Full URL: https://7alameh.biz/wells_files/theme.css
Requested by: Host: 7alameh.biz
URL: https://7alameh.biz/wells.htm
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 111.90.140.19 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS: mail1.kanueamt.website
Software: Apache /
Resource Hash: f82a7a512d314b7ce4c4bbab30c4528e0c3136514b694ca53213f06b246b273c

Request headers

Referer: https://7alameh.biz/wells.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 16 Apr 2020 02:22:24 GMT
Last-Modified: Tue, 06 Feb 2018 08:42:16 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 8545

GET
H/1.1 200
OK login-userprefs.js Show response
7alameh.biz/wells_files/ 144 KB
144 KB 637ms
213ms Script
application/javascript 111.90.140.19
SHINJIRU-MY-AS-AP...

General

Check archive.org

Show headers Download Go to

Full URL: https://7alameh.biz/wells_files/login-userprefs.js
Requested by: Host: 7alameh.biz
URL: https://7alameh.biz/wells.htm
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 111.90.140.19 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS: mail1.kanueamt.website
Software: Apache /
Resource Hash: 1b1b1c060912cb94b0db47fb6740b14ca96f731b0f1125bae5130a83e92d5f07

Request headers

Referer: https://7alameh.biz/wells.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 16 Apr 2020 02:22:24 GMT
Last-Modified: Tue, 06 Feb 2018 08:42:16 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 147243

GET
H/1.1 200
OK conutils-6.js Show response
7alameh.biz/wells_files/ 10 KB
10 KB 650ms
217ms Script
application/javascript 111.90.140.19
SHINJIRU-MY-AS-AP...

General

Check archive.org

Show headers Download Go to

Full URL: https://7alameh.biz/wells_files/conutils-6.js
Requested by: Host: 7alameh.biz
URL: https://7alameh.biz/wells.htm
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 111.90.140.19 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS: mail1.kanueamt.website
Software: Apache /
Resource Hash: 3313ac9f2c148df9dc8581ae4d7bb9023c3ef933d1152db47de29e32ec5f67b0

Request headers

Referer: https://7alameh.biz/wells.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 16 Apr 2020 02:22:24 GMT
Last-Modified: Tue, 06 Feb 2018 08:42:16 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 9924

GET
H/1.1 200
OK atadun.js Show response
7alameh.biz/wells_files/ 1 KB
1 KB 653ms
220ms Script
application/javascript 111.90.140.19
SHINJIRU-MY-AS-AP...

General

Check archive.org

Show headers Download Go to

Full URL: https://7alameh.biz/wells_files/atadun.js
Requested by: Host: 7alameh.biz
URL: https://7alameh.biz/wells.htm
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 111.90.140.19 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS: mail1.kanueamt.website
Software: Apache /
Resource Hash: 5fb7b85658a6e615400e0f1f3e16fc869bbd099b3c3c181c294c05d1d7d1cfe5

Request headers

Referer: https://7alameh.biz/wells.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 16 Apr 2020 02:22:24 GMT
Last-Modified: Tue, 06 Feb 2018 08:42:16 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 1067

GET
H/1.1 200
OK wflogo-gfrewards.png
7alameh.biz/wells_files/ 20 KB
20 KB 213ms
211ms Image
image/png 111.90.140.19
SHINJIRU-MY-AS-AP...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://7alameh.biz/wells_files/wflogo-gfrewards.png
Requested by: Host: 7alameh.biz
URL: https://7alameh.biz/wells.htm
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 111.90.140.19 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS: mail1.kanueamt.website
Software: Apache /
Resource Hash: 8acab8f477754cb0846b2eca8bfea7c4e5a0e3a5348a3ff69fe67bfaef42b8ab

Request headers

Referer: https://7alameh.biz/wells.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 16 Apr 2020 02:22:25 GMT
Last-Modified: Tue, 06 Feb 2018 08:42:16 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 20681

GET
H/1.1 404
Not Found conutils-6.2.2.js
7alameh.biz/auth/static/scripts/ 0
0 212ms
212ms Script
text/html 111.90.140.19
SHINJIRU-MY-AS-AP...

General

Check archive.org

Show headers Download Go to

Full URL: https://7alameh.biz/auth/static/scripts/conutils-6.2.2.js
Requested by: Host: 7alameh.biz
URL: https://7alameh.biz/wells_files/login-userprefs.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 111.90.140.19 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS: mail1.kanueamt.website
Software: Apache /
Resource Hash

Request headers

Referer: https://7alameh.biz/wells.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 16 Apr 2020 02:22:25 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=99
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 404
Not Found atadun.js
7alameh.biz/auth/static/prefs/ 0
0 211ms
211ms Script
text/html 111.90.140.19
SHINJIRU-MY-AS-AP...

General

Check archive.org

Show headers Download Go to

Full URL: https://7alameh.biz/auth/static/prefs/atadun.js
Requested by: Host: 7alameh.biz
URL: https://7alameh.biz/wells_files/login-userprefs.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 111.90.140.19 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS: mail1.kanueamt.website
Software: Apache /
Resource Hash

Request headers

Referer: https://7alameh.biz/wells.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 16 Apr 2020 02:22:25 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=98
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 404
Not Found atadun.js
7alameh.biz/auth/static/prefs/ 0
0 212ms
212ms Script
text/html 111.90.140.19
SHINJIRU-MY-AS-AP...

General

Check archive.org

Show headers Download Go to

Full URL: https://7alameh.biz/auth/static/prefs/atadun.js
Requested by: Host: 7alameh.biz
URL: https://7alameh.biz/wells.htm
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 111.90.140.19 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS: mail1.kanueamt.website
Software: Apache /
Resource Hash

Request headers

Referer: https://7alameh.biz/wells.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 16 Apr 2020 02:22:25 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=98
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 200 nd Show response
connect.secure.wellsfargo.com/jenny/ 46 KB
16 KB 794ms
182ms Script
application/javascript 159.45.2.156
WELLSFARGO-10837

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.secure.wellsfargo.com/jenny/nd

Requested by

Host: 7alameh.biz
URL: https://7alameh.biz/wells_files/atadun.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

159.45.2.156 Charlotte, United States, ASN10837 (WELLSFARGO-10837, US),

Reverse DNS

Software

KONICHIWA/1.1 /

Resource Hash

742c3e64d7a71833496a79a821a160dbaf30d9051f91361c23369569d6feca30

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://7alameh.biz/wells.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: KONICHIWA/1.1
Date: Thu, 16 Apr 2020 02:22:27 GMT
X-Frame-Options: DENY
Content-Type: application/javascript;charset=ISO-8859-1
Transfer-Encoding: chunked
Connection: keep-alive
vary: accept-encoding
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=600

GET
H/1.1 404
Not Found search_corner.gif
7alameh.biz/wells_files/images/ 315 B
315 B 214ms
214ms Image
text/html 111.90.140.19
SHINJIRU-MY-AS-AP...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://7alameh.biz/wells_files/images/search_corner.gif
Requested by: Host: 7alameh.biz
URL: https://7alameh.biz/wells.htm
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 111.90.140.19 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS: mail1.kanueamt.website
Software: Apache /
Resource Hash: d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Request headers

Referer: https://7alameh.biz/wells_files/signonCommitment.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 16 Apr 2020 02:22:25 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=97
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 404
Not Found btn_blueslice.gif
7alameh.biz/wells_files/images/ 315 B
315 B 212ms
211ms Image
text/html 111.90.140.19
SHINJIRU-MY-AS-AP...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://7alameh.biz/wells_files/images/btn_blueslice.gif
Requested by: Host: 7alameh.biz
URL: https://7alameh.biz/wells.htm
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 111.90.140.19 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS: mail1.kanueamt.website
Software: Apache /
Resource Hash: d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Request headers

Referer: https://7alameh.biz/wells_files/signonCommitment.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 16 Apr 2020 02:22:25 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=97
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 404
Not Found wellsfargo-storefront_outdoors-street_cars-and-people-crossing_722x185.png
7alameh.biz/images/ 315 B
315 B 218ms
218ms Image
text/html 111.90.140.19
SHINJIRU-MY-AS-AP...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://7alameh.biz/images/wellsfargo-storefront_outdoors-street_cars-and-people-crossing_722x185.png
Requested by: Host: 7alameh.biz
URL: https://7alameh.biz/wells.htm
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 111.90.140.19 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS: mail1.kanueamt.website
Software: Apache /
Resource Hash: d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Request headers

Referer: https://7alameh.biz/wells_files/theme.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 16 Apr 2020 02:22:25 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=99
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Wells Fargo (Banking)

173 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.7alameh.biz/	1970-01-19 08:50:07	Name: ndsid Value: ndsay9clsplewblk92520tj

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

7alameh.biz
connect.secure.wellsfargo.com
111.90.140.19
159.45.2.156
1b1b1c060912cb94b0db47fb6740b14ca96f731b0f1125bae5130a83e92d5f07
3313ac9f2c148df9dc8581ae4d7bb9023c3ef933d1152db47de29e32ec5f67b0
5fb7b85658a6e615400e0f1f3e16fc869bbd099b3c3c181c294c05d1d7d1cfe5
742c3e64d7a71833496a79a821a160dbaf30d9051f91361c23369569d6feca30
7c21a45f9e10b50948faf43421ae13f1a49c75c9e44604c63b9bd1c34075d474
8acab8f477754cb0846b2eca8bfea7c4e5a0e3a5348a3ff69fe67bfaef42b8ab
930e23aab6e72ed98e430a83b13884ec57f284f7e067f6a5de70a9130e7676a5
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
f82a7a512d314b7ce4c4bbab30c4528e0c3136514b694ca53213f06b246b273c
ffc539eb345f9466fecbe7b7ea8d2db0f56ef3857c8b26159d9a230bf9afdb4a

7alameh.biz Open in urlscan Pro 111.90.140.19 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

15 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

257 kBTransfer

285 kBSize

1 Cookies

14 Outgoing links

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

173 JavaScript Global Variables

1 Cookies

Indicators

7alameh.biz Open in urlscan Pro
111.90.140.19 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

257 kB
Transfer

285 kB
Size

1
Cookies

15 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!