ksdasulsel.id Open in urlscan Pro
119.47.89.75 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://ksdasulsel.id/wp-includes/js/wellsbz/wwell/identifyuser.php
Submission: On February 17 via automatic, source openphish (February 17th 2018, 1:24:12 pm UTC)

Summary HTTP 6 Redirects Links 16 Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 6 HTTP transactions. The main IP is 119.47.89.75, located in Jakarta, Indonesia and belongs to MLINK-AS-ID JAWA POS NATIONAL NETWORK MEDIALINK, PT, ID. The main domain is ksdasulsel.id.

This is the only time ksdasulsel.id was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Wells Fargo (Banking)

Domain & IP information

	IP Address		AS Autonomous System
6	119.47.89.75 119.47.89.75		38527 (MLINK-AS-...) (MLINK-AS-ID JAWA POS NATIONAL NETWORK MEDIALINK)
6	2

6 119.47.89.75 (Jakarta, Indonesia)

ASN38527 (MLINK-AS-ID JAWA POS NATIONAL NETWORK MEDIALINK, PT, ID)

ksdasulsel.id	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	ksdasulsel.id ksdasulsel.id	425 KB
6	1

	Domain	Requested by
6	ksdasulsel.id	ksdasulsel.id
6	1

This site contains links to these domains. Also see Links.

Domain
www.wellsfargo.com
oam.wellsfargo.com
icomplete.wellsfargo.com
www.wellsfargorewards.com

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://ksdasulsel.id/wp-includes/js/wellsbz/wwell/identifyuser.php
Frame ID: (E35D1E024861F76553B94A90D87FAC80)
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Page Statistics

6
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

425 kB
Transfer

713 kB
Size

0
Cookies

16 Outgoing links

These are links going to different origins than the main page.

URL: https://www.wellsfargo.com/

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request identifyuser.php Show response ksdasulsel.id/wp-includes/js/wellsbz/wwell/	425 KB 425 KB	421ms 211ms	Document text/html	119.47.89.75 MLINK-AS-ID JAWA ...
General Check archive.org Show headers Download Go to Full URL http://ksdasulsel.id/wp-includes/js/wellsbz/wwell/identifyuser.php Protocol HTTP/1.1 Server 119.47.89.75 Jakarta, Indonesia, ASN38527 (MLINK-AS-ID JAWA POS NATIONAL NETWORK MEDIALINK, PT, ID), Reverse DNS Software Apache / PHP/5.6.33 Resource Hash `fd74d818bbf356326c691a0a0430197d121a1ffb605d4ebd3062068404355381` Request headers Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Connection keep-alive Accept-Encoding gzip, deflate Host ksdasulsel.id Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sat, 17 Feb 2018 13:23:35 GMT Server Apache Connection Keep-Alive X-Powered-By PHP/5.6.33 Transfer-Encoding chunked Keep-Alive timeout=5, max=100 Content-Type text/html; charset=UTF-8
GET H/1.1	404 Not Found	nd ksdasulsel.id/wp-includes/js/wellsbz/wwell/Wells%20Fargo%20Sign%20On%20to%20View%20Your%20Accounts_files/	0 0	819ms 610ms	Script text/html	119.47.89.75 MLINK-AS-ID JAWA ...
General Check archive.org Show headers Download Go to Full URL http://ksdasulsel.id/wp-includes/js/wellsbz/wwell/Wells%20Fargo%20Sign%20On%20to%20View%20Your%20Accounts_files/nd Requested by Host: ksdasulsel.id URL: http://ksdasulsel.id/wp-includes/js/wellsbz/wwell/identifyuser.php Protocol HTTP/1.1 Server 119.47.89.75 Jakarta, Indonesia, ASN38527 (MLINK-AS-ID JAWA POS NATIONAL NETWORK MEDIALINK, PT, ID), Reverse DNS Software Apache / PHP/5.6.33 Resource Hash Request headers Pragma no-cache Accept-Encoding gzip, deflate Host ksdasulsel.id User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept / Referer http://ksdasulsel.id/wp-includes/js/wellsbz/wwell/identifyuser.php Connection keep-alive Cache-Control no-cache Referer http://ksdasulsel.id/wp-includes/js/wellsbz/wwell/identifyuser.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sat, 17 Feb 2018 13:23:36 GMT Server Apache X-Powered-By PHP/5.6.33 Transfer-Encoding chunked Content-Type text/html; charset=UTF-8 Cache-Control no-cache, must-revalidate, max-age=0 Connection Keep-Alive Link <http://ksdasulsel.id/wp-json/>; rel="https://api.w.org/" Keep-Alive timeout=5, max=100 Expires Wed, 11 Jan 1984 05:00:00 GMT
GET DATA	200 OK	truncated /	12 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `f809fa596dc2e66029e195d0aef2d6d7b077ea1f7d145455441ba893875aec41` Request headers Response headers Access-Control-Allow-Origin * Content-Type image/png
GET DATA	200 OK	truncated /	1 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `17f3818bba16137fba7657230309043ae41cd08a5df25a7c61cd9583291c1354` Request headers Response headers Access-Control-Allow-Origin * Content-Type image/png
GET DATA	200 OK	truncated /	270 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `2910f07eb1efbf99cb485fe848fd1aaa251bcd9c6cb3276426492daa45651be3` Request headers Response headers Access-Control-Allow-Origin * Content-Type image/png
GET DATA	200 OK	truncated /	467 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `5145f5faf6c1269bdd974357ed344b9cd5f4e4cea424c14dd302a9c11a206741` Request headers Response headers Access-Control-Allow-Origin * Content-Type image/png
GET DATA	200 OK	truncated /	2 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `b319b049366dde73690990738ac5af4fb9937d18abac85b01aaff185b5262868` Request headers Response headers Access-Control-Allow-Origin * Content-Type image/png
GET DATA	200 OK	truncated /	889 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `f7899cfdbc342decc4aeb0bae9ada39bfaa8ae3c687fc72119fca2efdf77dff2` Request headers Response headers Access-Control-Allow-Origin * Content-Type image/png
GET DATA	200 OK	truncated /	1 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `df500743bbedcef7623fdf2ef0c05ca411437c6216674271f4cc8b32f910f96d` Request headers Response headers Access-Control-Allow-Origin * Content-Type image/png
GET H/1.1	404 Not Found	login-userprefs.js ksdasulsel.id/wp-includes/js/wellsbz/wwell/Wells%20Fargo%20Sign%20On%20to%20View%20Your%20Accounts_files/	0 0	832ms 832ms	Script text/html	119.47.89.75 MLINK-AS-ID JAWA ...
General Check archive.org Show headers Download Go to Full URL http://ksdasulsel.id/wp-includes/js/wellsbz/wwell/Wells%20Fargo%20Sign%20On%20to%20View%20Your%20Accounts_files/login-userprefs.js Requested by Host: ksdasulsel.id URL: http://ksdasulsel.id/wp-includes/js/wellsbz/wwell/identifyuser.php Protocol HTTP/1.1 Server 119.47.89.75 Jakarta, Indonesia, ASN38527 (MLINK-AS-ID JAWA POS NATIONAL NETWORK MEDIALINK, PT, ID), Reverse DNS Software Apache / PHP/5.6.33 Resource Hash Request headers Pragma no-cache Accept-Encoding gzip, deflate Host ksdasulsel.id User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept / Referer http://ksdasulsel.id/wp-includes/js/wellsbz/wwell/identifyuser.php Connection keep-alive Cache-Control no-cache Referer http://ksdasulsel.id/wp-includes/js/wellsbz/wwell/identifyuser.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sat, 17 Feb 2018 13:23:38 GMT Server Apache X-Powered-By PHP/5.6.33 Transfer-Encoding chunked Content-Type text/html; charset=UTF-8 Cache-Control no-cache, must-revalidate, max-age=0 Connection Keep-Alive Link <http://ksdasulsel.id/wp-json/>; rel="https://api.w.org/" Keep-Alive timeout=5, max=99 Expires Wed, 11 Jan 1984 05:00:00 GMT
GET H/1.1	404 Not Found	conutils-6.js ksdasulsel.id/wp-includes/js/wellsbz/wwell/Wells%20Fargo%20Sign%20On%20to%20View%20Your%20Accounts_files/	0 0	1279ms 1071ms	Script text/html	119.47.89.75 MLINK-AS-ID JAWA ...
General Check archive.org Show headers Download Go to Full URL http://ksdasulsel.id/wp-includes/js/wellsbz/wwell/Wells%20Fargo%20Sign%20On%20to%20View%20Your%20Accounts_files/conutils-6.js Requested by Host: ksdasulsel.id URL: http://ksdasulsel.id/wp-includes/js/wellsbz/wwell/identifyuser.php Protocol HTTP/1.1 Server 119.47.89.75 Jakarta, Indonesia, ASN38527 (MLINK-AS-ID JAWA POS NATIONAL NETWORK MEDIALINK, PT, ID), Reverse DNS Software Apache / PHP/5.6.33 Resource Hash Request headers Pragma no-cache Accept-Encoding gzip, deflate Host ksdasulsel.id User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept / Referer http://ksdasulsel.id/wp-includes/js/wellsbz/wwell/identifyuser.php Connection keep-alive Cache-Control no-cache Referer http://ksdasulsel.id/wp-includes/js/wellsbz/wwell/identifyuser.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sat, 17 Feb 2018 13:23:38 GMT Server Apache X-Powered-By PHP/5.6.33 Transfer-Encoding chunked Content-Type text/html; charset=UTF-8 Cache-Control no-cache, must-revalidate, max-age=0 Connection Keep-Alive Link <http://ksdasulsel.id/wp-json/>; rel="https://api.w.org/" Keep-Alive timeout=5, max=100 Expires Wed, 11 Jan 1984 05:00:00 GMT
GET H/1.1	404 Not Found	atadun.js ksdasulsel.id/wp-includes/js/wellsbz/wwell/Wells%20Fargo%20Sign%20On%20to%20View%20Your%20Accounts_files/	0 0	1162ms 954ms	Script text/html	119.47.89.75 MLINK-AS-ID JAWA ...
General Check archive.org Show headers Download Go to Full URL http://ksdasulsel.id/wp-includes/js/wellsbz/wwell/Wells%20Fargo%20Sign%20On%20to%20View%20Your%20Accounts_files/atadun.js Requested by Host: ksdasulsel.id URL: http://ksdasulsel.id/wp-includes/js/wellsbz/wwell/identifyuser.php Protocol HTTP/1.1 Server 119.47.89.75 Jakarta, Indonesia, ASN38527 (MLINK-AS-ID JAWA POS NATIONAL NETWORK MEDIALINK, PT, ID), Reverse DNS Software Apache / PHP/5.6.33 Resource Hash Request headers Pragma no-cache Accept-Encoding gzip, deflate Host ksdasulsel.id User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept / Referer http://ksdasulsel.id/wp-includes/js/wellsbz/wwell/identifyuser.php Connection keep-alive Cache-Control no-cache Referer http://ksdasulsel.id/wp-includes/js/wellsbz/wwell/identifyuser.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sat, 17 Feb 2018 13:23:38 GMT Server Apache X-Powered-By PHP/5.6.33 Transfer-Encoding chunked Content-Type text/html; charset=UTF-8 Cache-Control no-cache, must-revalidate, max-age=0 Connection Keep-Alive Link <http://ksdasulsel.id/wp-json/>; rel="https://api.w.org/" Keep-Alive timeout=5, max=100 Expires Wed, 11 Jan 1984 05:00:00 GMT
GET DATA	200 OK	truncated /	1 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `1ed889a15705bc76729d29d715c64f3d7f35de2ea519e1d2704924cf40d9e30d` Request headers Response headers Access-Control-Allow-Origin * Content-Type image/jpeg
GET H/1.1	404 Not Found	atadun.js ksdasulsel.id/wp-includes/js/wellsbz/wwell/Wells%20Fargo%20Sign%20On%20to%20View%20Your%20Accounts_files/	0 0	823ms 614ms	Script text/html	119.47.89.75 MLINK-AS-ID JAWA ...
General Check archive.org Show headers Download Go to Full URL http://ksdasulsel.id/wp-includes/js/wellsbz/wwell/Wells%20Fargo%20Sign%20On%20to%20View%20Your%20Accounts_files/atadun.js Requested by Host: ksdasulsel.id URL: http://ksdasulsel.id/wp-includes/js/wellsbz/wwell/identifyuser.php Protocol HTTP/1.1 Server 119.47.89.75 Jakarta, Indonesia, ASN38527 (MLINK-AS-ID JAWA POS NATIONAL NETWORK MEDIALINK, PT, ID), Reverse DNS Software Apache / PHP/5.6.33 Resource Hash Request headers Pragma no-cache Accept-Encoding gzip, deflate Host ksdasulsel.id User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept / Referer http://ksdasulsel.id/wp-includes/js/wellsbz/wwell/identifyuser.php Connection keep-alive Cache-Control no-cache Referer http://ksdasulsel.id/wp-includes/js/wellsbz/wwell/identifyuser.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sat, 17 Feb 2018 13:23:39 GMT Server Apache X-Powered-By PHP/5.6.33 Transfer-Encoding chunked Content-Type text/html; charset=UTF-8 Cache-Control no-cache, must-revalidate, max-age=0 Connection Keep-Alive Link <http://ksdasulsel.id/wp-json/>; rel="https://api.w.org/" Keep-Alive timeout=5, max=100 Expires Wed, 11 Jan 1984 05:00:00 GMT

ksdasulsel.id Open in urlscan Pro 119.47.89.75 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

6 Requests

0 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

425 kBTransfer

713 kBSize

0 Cookies

16 Outgoing links

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 8 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

0 Cookies

Indicators

ksdasulsel.id Open in urlscan Pro
119.47.89.75 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

425 kB
Transfer

713 kB
Size

0
Cookies

6 HTTP transactions
8 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!