smm.stu.cn.ua Open in urlscan Pro
195.69.76.75 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://smm.stu.cn.ua/wp-includes/secure/WellsFargo/wells/wells.htm
Submission: On January 14 via automatic, source openphish (January 14th 2021, 1:27:21 am UTC)

Summary HTTP 14 Redirects Links 14 Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 14 HTTP transactions. The main IP is 195.69.76.75, located in Chernihiv, Ukraine and belongs to CSTU-AS, UA. The main domain is smm.stu.cn.ua.

This is the only time smm.stu.cn.ua was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Wells Fargo (Banking)

Domain & IP information

	IP Address	AS Autonomous System
13	195.69.76.75 195.69.76.75	29116 (CSTU-AS) (CSTU-AS)
1	159.45.170.156 159.45.170.156	10837 (WELLSFARG...) (WELLSFARGO-10837)
14	2

13 195.69.76.75 (Chernihiv, Ukraine)

ASN29116 (CSTU-AS, UA)

smm.stu.cn.ua	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 159.45.170.156 (United States)

ASN10837 (WELLSFARGO-10837, US)

connect.secure.wellsfargo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
13	stu.cn.ua smm.stu.cn.ua	107 KB
1	wellsfargo.com connect.secure.wellsfargo.com	17 KB
14	2

	Domain	Requested by
13	smm.stu.cn.ua	smm.stu.cn.ua
1	connect.secure.wellsfargo.com	smm.stu.cn.ua
14	2

This site contains links to these domains. Also see Links.

Domain
www.wellsfargo.com

Subject Issuer	Validity	Valid
connect.secure.wellsfargo.com DigiCert EV RSA CA G2	`2020-07-09` - `2022-07-14`	2 years	crt.sh

This page contains 1 frames:

Primary Page: http://smm.stu.cn.ua/wp-includes/secure/WellsFargo/wells/wells.htm
Frame ID: 42800684B59155B21C5F48D257E3FFB8
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Ubuntu (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Ubuntu/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

14
Requests

7 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

124 kB
Transfer

296 kB
Size

0
Cookies

14 Outgoing links

These are links going to different origins than the main page.

URL: https://www.wellsfargo.com/
Title:

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/help/
Title: Customer Service

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/locator/
Title: Locations

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/products_services/applications_viewall.jhtml
Title: Apply

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/commitment
Title: Learn More

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/commitment/faqs/
Title: Frequently asked questions >

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/help/faqs/sign-on
Title: Email Security Help

Search URL Search Domain Scan URL

URL: http://www.wellsfargo.com/agreement
Title: www.wellsfargo.com/agreement

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/about/
Title: About Wells Fargo

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/careers/
Title: Careers

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/privacy-security/
Title: Privacy, Security & Legal

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/privacy-security/fraud/report/phish
Title: Report Email Fraud

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/sitemap
Title: Sitemap

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/privacy-security/privacy/online#adchoices
Title: Ad Choices

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request wells.htm Show response
smm.stu.cn.ua/wp-includes/secure/WellsFargo/wells/ 10 KB
4 KB 132ms
111ms Document
text/html 195.69.76.75
CSTU-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://smm.stu.cn.ua/wp-includes/secure/WellsFargo/wells/wells.htm
Protocol: HTTP/1.1
Server: 195.69.76.75 Chernihiv, Ukraine, ASN29116 (CSTU-AS, UA),
Reverse DNS
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: 248d37e6d3b2ca396b630adddb3dfc9b32ed188c2cb1582ac5497cd9909cf0e0

Request headers

Host: smm.stu.cn.ua
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 14 Jan 2021 01:27:01 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Wed, 13 Jan 2021 16:11:31 GMT
ETag: "292a-5b8ca646b99a7-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 3399
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK nd Show response
smm.stu.cn.ua/wp-includes/secure/WellsFargo/wells/wells_files/ 39 KB
39 KB 115ms
94ms Script
text/plain 195.69.76.75
CSTU-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://smm.stu.cn.ua/wp-includes/secure/WellsFargo/wells/wells_files/nd
Requested by: Host: smm.stu.cn.ua
URL: http://smm.stu.cn.ua/wp-includes/secure/WellsFargo/wells/wells.htm
Protocol: HTTP/1.1
Server: 195.69.76.75 Chernihiv, Ukraine, ASN29116 (CSTU-AS, UA),
Reverse DNS
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: ffc539eb345f9466fecbe7b7ea8d2db0f56ef3857c8b26159d9a230bf9afdb4a

Request headers

Referer: http://smm.stu.cn.ua/wp-includes/secure/WellsFargo/wells/wells.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 14 Jan 2021 01:27:01 GMT
Last-Modified: Wed, 13 Jan 2021 16:11:31 GMT
Server: Apache/2.4.41 (Ubuntu)
ETag: "9ae9-5b8ca646b99a7"
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 39657

GET
H/1.1 200
OK signonCommitment.css
smm.stu.cn.ua/wp-includes/secure/WellsFargo/wells/wells_files/ 6 KB
2 KB 66ms
65ms Stylesheet
text/css 195.69.76.75
CSTU-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://smm.stu.cn.ua/wp-includes/secure/WellsFargo/wells/wells_files/signonCommitment.css
Requested by: Host: smm.stu.cn.ua
URL: http://smm.stu.cn.ua/wp-includes/secure/WellsFargo/wells/wells.htm
Protocol: HTTP/1.1
Server: 195.69.76.75 Chernihiv, Ukraine, ASN29116 (CSTU-AS, UA),
Reverse DNS
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: 7c21a45f9e10b50948faf43421ae13f1a49c75c9e44604c63b9bd1c34075d474

Request headers

Referer: http://smm.stu.cn.ua/wp-includes/secure/WellsFargo/wells/wells.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 14 Jan 2021 01:27:01 GMT
Content-Encoding: gzip
Last-Modified: Wed, 13 Jan 2021 16:11:31 GMT
Server: Apache/2.4.41 (Ubuntu)
ETag: "1786-5b8ca646b99a7-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 1582

GET
H/1.1 200
OK theme.css
smm.stu.cn.ua/wp-includes/secure/WellsFargo/wells/wells_files/ 8 KB
2 KB 114ms
93ms Stylesheet
text/css 195.69.76.75
CSTU-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://smm.stu.cn.ua/wp-includes/secure/WellsFargo/wells/wells_files/theme.css
Requested by: Host: smm.stu.cn.ua
URL: http://smm.stu.cn.ua/wp-includes/secure/WellsFargo/wells/wells.htm
Protocol: HTTP/1.1
Server: 195.69.76.75 Chernihiv, Ukraine, ASN29116 (CSTU-AS, UA),
Reverse DNS
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: f82a7a512d314b7ce4c4bbab30c4528e0c3136514b694ca53213f06b246b273c

Request headers

Referer: http://smm.stu.cn.ua/wp-includes/secure/WellsFargo/wells/wells.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 14 Jan 2021 01:27:01 GMT
Content-Encoding: gzip
Last-Modified: Wed, 13 Jan 2021 16:11:31 GMT
Server: Apache/2.4.41 (Ubuntu)
ETag: "2161-5b8ca646b99a7-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 1605

GET
H/1.1 200
OK login-userprefs.js Show response
smm.stu.cn.ua/wp-includes/secure/WellsFargo/wells/wells_files/ 144 KB
24 KB 118ms
97ms Script
application/javascript 195.69.76.75
CSTU-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://smm.stu.cn.ua/wp-includes/secure/WellsFargo/wells/wells_files/login-userprefs.js
Requested by: Host: smm.stu.cn.ua
URL: http://smm.stu.cn.ua/wp-includes/secure/WellsFargo/wells/wells.htm
Protocol: HTTP/1.1
Server: 195.69.76.75 Chernihiv, Ukraine, ASN29116 (CSTU-AS, UA),
Reverse DNS
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: 1b1b1c060912cb94b0db47fb6740b14ca96f731b0f1125bae5130a83e92d5f07

Request headers

Referer: http://smm.stu.cn.ua/wp-includes/secure/WellsFargo/wells/wells.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 14 Jan 2021 01:27:01 GMT
Content-Encoding: gzip
Last-Modified: Wed, 13 Jan 2021 16:11:31 GMT
Server: Apache/2.4.41 (Ubuntu)
ETag: "23f2b-5b8ca646b99a7-gzip"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 24572

GET
H/1.1 200
OK conutils-6.js Show response
smm.stu.cn.ua/wp-includes/secure/WellsFargo/wells/wells_files/ 10 KB
4 KB 132ms
112ms Script
application/javascript 195.69.76.75
CSTU-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://smm.stu.cn.ua/wp-includes/secure/WellsFargo/wells/wells_files/conutils-6.js
Requested by: Host: smm.stu.cn.ua
URL: http://smm.stu.cn.ua/wp-includes/secure/WellsFargo/wells/wells.htm
Protocol: HTTP/1.1
Server: 195.69.76.75 Chernihiv, Ukraine, ASN29116 (CSTU-AS, UA),
Reverse DNS
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: 3313ac9f2c148df9dc8581ae4d7bb9023c3ef933d1152db47de29e32ec5f67b0

Request headers

Referer: http://smm.stu.cn.ua/wp-includes/secure/WellsFargo/wells/wells.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 14 Jan 2021 01:27:01 GMT
Content-Encoding: gzip
Last-Modified: Wed, 13 Jan 2021 16:11:31 GMT
Server: Apache/2.4.41 (Ubuntu)
ETag: "26c4-5b8ca646b99a7-gzip"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 3897

GET
H/1.1 200
OK atadun.js Show response
smm.stu.cn.ua/wp-includes/secure/WellsFargo/wells/wells_files/ 1 KB
853 B 132ms
112ms Script
application/javascript 195.69.76.75
CSTU-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://smm.stu.cn.ua/wp-includes/secure/WellsFargo/wells/wells_files/atadun.js
Requested by: Host: smm.stu.cn.ua
URL: http://smm.stu.cn.ua/wp-includes/secure/WellsFargo/wells/wells.htm
Protocol: HTTP/1.1
Server: 195.69.76.75 Chernihiv, Ukraine, ASN29116 (CSTU-AS, UA),
Reverse DNS
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: 5fb7b85658a6e615400e0f1f3e16fc869bbd099b3c3c181c294c05d1d7d1cfe5

Request headers

Referer: http://smm.stu.cn.ua/wp-includes/secure/WellsFargo/wells/wells.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 14 Jan 2021 01:27:01 GMT
Content-Encoding: gzip
Last-Modified: Wed, 13 Jan 2021 16:11:31 GMT
Server: Apache/2.4.41 (Ubuntu)
ETag: "42b-5b8ca646b99a7-gzip"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 503

GET
H/1.1 200
OK wflogo-gfrewards.png
smm.stu.cn.ua/wp-includes/secure/WellsFargo/wells/wells_files/ 20 KB
20 KB 56ms
55ms Image
image/png 195.69.76.75
CSTU-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://smm.stu.cn.ua/wp-includes/secure/WellsFargo/wells/wells_files/wflogo-gfrewards.png
Requested by: Host: smm.stu.cn.ua
URL: http://smm.stu.cn.ua/wp-includes/secure/WellsFargo/wells/wells.htm
Protocol: HTTP/1.1
Server: 195.69.76.75 Chernihiv, Ukraine, ASN29116 (CSTU-AS, UA),
Reverse DNS
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: 8acab8f477754cb0846b2eca8bfea7c4e5a0e3a5348a3ff69fe67bfaef42b8ab

Request headers

Referer: http://smm.stu.cn.ua/wp-includes/secure/WellsFargo/wells/wells.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 14 Jan 2021 01:27:01 GMT
Last-Modified: Wed, 13 Jan 2021 16:11:31 GMT
Server: Apache/2.4.41 (Ubuntu)
ETag: "50c9-5b8ca646b99a7"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 20681

GET
H/1.1 404
Not Found conutils-6.2.2.js
smm.stu.cn.ua/auth/static/scripts/ 0
0 603ms
602ms Script
text/html 195.69.76.75
CSTU-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://smm.stu.cn.ua/auth/static/scripts/conutils-6.2.2.js
Requested by: Host: smm.stu.cn.ua
URL: http://smm.stu.cn.ua/wp-includes/secure/WellsFargo/wells/wells_files/login-userprefs.js
Protocol: HTTP/1.1
Server: 195.69.76.75 Chernihiv, Ukraine, ASN29116 (CSTU-AS, UA),
Reverse DNS
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash

Request headers

Referer: http://smm.stu.cn.ua/wp-includes/secure/WellsFargo/wells/wells.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 14 Jan 2021 01:27:01 GMT
Server: Apache/2.4.41 (Ubuntu)
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
Cache-Control: no-cache, must-revalidate, max-age=0
Connection: Keep-Alive
Link: <http://smm.stu.cn.ua/wp-json/>; rel="https://api.w.org/"
Keep-Alive: timeout=5, max=99
Expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H/1.1 404
Not Found atadun.js
smm.stu.cn.ua/auth/static/prefs/ 0
0 679ms
679ms Script
text/html 195.69.76.75
CSTU-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://smm.stu.cn.ua/auth/static/prefs/atadun.js
Requested by: Host: smm.stu.cn.ua
URL: http://smm.stu.cn.ua/wp-includes/secure/WellsFargo/wells/wells_files/login-userprefs.js
Protocol: HTTP/1.1
Server: 195.69.76.75 Chernihiv, Ukraine, ASN29116 (CSTU-AS, UA),
Reverse DNS
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash

Request headers

Referer: http://smm.stu.cn.ua/wp-includes/secure/WellsFargo/wells/wells.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 14 Jan 2021 01:27:01 GMT
Server: Apache/2.4.41 (Ubuntu)
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
Cache-Control: no-cache, must-revalidate, max-age=0
Connection: Keep-Alive
Link: <http://smm.stu.cn.ua/wp-json/>; rel="https://api.w.org/"
Keep-Alive: timeout=5, max=99
Expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H/1.1 200 nd Show response
connect.secure.wellsfargo.com/jenny/ 47 KB
17 KB 958ms
196ms Script
application/javascript 159.45.170.156
WELLSFARGO-10837

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.secure.wellsfargo.com/jenny/nd

Requested by

Host: smm.stu.cn.ua
URL: http://smm.stu.cn.ua/wp-includes/secure/WellsFargo/wells/wells_files/atadun.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

159.45.170.156 , United States, ASN10837 (WELLSFARGO-10837, US),

Reverse DNS

Software

KONICHIWA/1.1 /

Resource Hash

f1bfed5b5b4de8594bbd51256a5dadb47b7802c92ef413c1fe9e49fa8eecf387

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: http://smm.stu.cn.ua/wp-includes/secure/WellsFargo/wells/wells.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: KONICHIWA/1.1
Date: Thu, 14 Jan 2021 01:27:02 GMT
X-Frame-Options: DENY
Content-Type: application/javascript;charset=ISO-8859-1
Transfer-Encoding: chunked
Connection: keep-alive
vary: accept-encoding
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=600

GET
H/1.1 404
Not Found search_corner.gif
smm.stu.cn.ua/wp-includes/secure/WellsFargo/wells/wells_files/images/ 3 KB
3 KB 585ms
585ms Image
text/html 195.69.76.75
CSTU-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://smm.stu.cn.ua/wp-includes/secure/WellsFargo/wells/wells_files/images/search_corner.gif
Requested by: Host: smm.stu.cn.ua
URL: http://smm.stu.cn.ua/wp-includes/secure/WellsFargo/wells/wells_files/signonCommitment.css
Protocol: HTTP/1.1
Server: 195.69.76.75 Chernihiv, Ukraine, ASN29116 (CSTU-AS, UA),
Reverse DNS
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: 151fc20b49bf22cfdc68892e6cf048959750e58cb41ee2524faa5ecdbd5f47f5

Request headers

Referer: http://smm.stu.cn.ua/wp-includes/secure/WellsFargo/wells/wells_files/signonCommitment.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 14 Jan 2021 01:27:02 GMT
Server: Apache/2.4.41 (Ubuntu)
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
Cache-Control: no-cache, must-revalidate, max-age=0
Connection: Keep-Alive
Link: <http://smm.stu.cn.ua/wp-json/>; rel="https://api.w.org/"
Keep-Alive: timeout=5, max=98
Expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H/1.1 404
Not Found btn_blueslice.gif
smm.stu.cn.ua/wp-includes/secure/WellsFargo/wells/wells_files/images/ 4 KB
4 KB 623ms
623ms Image
text/html 195.69.76.75
CSTU-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://smm.stu.cn.ua/wp-includes/secure/WellsFargo/wells/wells_files/images/btn_blueslice.gif
Requested by: Host: smm.stu.cn.ua
URL: http://smm.stu.cn.ua/wp-includes/secure/WellsFargo/wells/wells_files/signonCommitment.css
Protocol: HTTP/1.1
Server: 195.69.76.75 Chernihiv, Ukraine, ASN29116 (CSTU-AS, UA),
Reverse DNS
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: f7d13f5ad719a338eeb6dae44a6544acf885a57ff055d3a831a1a2ce43a4711f

Request headers

Referer: http://smm.stu.cn.ua/wp-includes/secure/WellsFargo/wells/wells_files/signonCommitment.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 14 Jan 2021 01:27:02 GMT
Server: Apache/2.4.41 (Ubuntu)
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
Cache-Control: no-cache, must-revalidate, max-age=0
Connection: Keep-Alive
Link: <http://smm.stu.cn.ua/wp-json/>; rel="https://api.w.org/"
Keep-Alive: timeout=5, max=99
Expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H/1.1 404
Not Found wellsfargo-storefront_outdoors-street_cars-and-people-crossing_722x185.png
smm.stu.cn.ua/wp-includes/secure/WellsFargo/images/ 4 KB
4 KB 622ms
622ms Image
text/html 195.69.76.75
CSTU-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://smm.stu.cn.ua/wp-includes/secure/WellsFargo/images/wellsfargo-storefront_outdoors-street_cars-and-people-crossing_722x185.png
Requested by: Host: smm.stu.cn.ua
URL: http://smm.stu.cn.ua/wp-includes/secure/WellsFargo/wells/wells_files/theme.css
Protocol: HTTP/1.1
Server: 195.69.76.75 Chernihiv, Ukraine, ASN29116 (CSTU-AS, UA),
Reverse DNS
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: f7d13f5ad719a338eeb6dae44a6544acf885a57ff055d3a831a1a2ce43a4711f

Request headers

Referer: http://smm.stu.cn.ua/wp-includes/secure/WellsFargo/wells/wells_files/theme.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 14 Jan 2021 01:27:02 GMT
Server: Apache/2.4.41 (Ubuntu)
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
Cache-Control: no-cache, must-revalidate, max-age=0
Connection: Keep-Alive
Link: <http://smm.stu.cn.ua/wp-json/>; rel="https://api.w.org/"
Keep-Alive: timeout=5, max=99
Expires: Wed, 11 Jan 1984 05:00:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Wells Fargo (Banking)

171 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

connect.secure.wellsfargo.com
smm.stu.cn.ua
159.45.170.156
195.69.76.75
151fc20b49bf22cfdc68892e6cf048959750e58cb41ee2524faa5ecdbd5f47f5
1b1b1c060912cb94b0db47fb6740b14ca96f731b0f1125bae5130a83e92d5f07
248d37e6d3b2ca396b630adddb3dfc9b32ed188c2cb1582ac5497cd9909cf0e0
3313ac9f2c148df9dc8581ae4d7bb9023c3ef933d1152db47de29e32ec5f67b0
5fb7b85658a6e615400e0f1f3e16fc869bbd099b3c3c181c294c05d1d7d1cfe5
7c21a45f9e10b50948faf43421ae13f1a49c75c9e44604c63b9bd1c34075d474
8acab8f477754cb0846b2eca8bfea7c4e5a0e3a5348a3ff69fe67bfaef42b8ab
f1bfed5b5b4de8594bbd51256a5dadb47b7802c92ef413c1fe9e49fa8eecf387
f7d13f5ad719a338eeb6dae44a6544acf885a57ff055d3a831a1a2ce43a4711f
f82a7a512d314b7ce4c4bbab30c4528e0c3136514b694ca53213f06b246b273c
ffc539eb345f9466fecbe7b7ea8d2db0f56ef3857c8b26159d9a230bf9afdb4a

smm.stu.cn.ua Open in urlscan Pro 195.69.76.75 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

14 Requests

7 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

124 kBTransfer

296 kBSize

0 Cookies

14 Outgoing links

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

171 JavaScript Global Variables

0 Cookies

Indicators

smm.stu.cn.ua Open in urlscan Pro
195.69.76.75 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

7 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

124 kB
Transfer

296 kB
Size

0
Cookies

14 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!