honar-mehrazin.ir Open in urlscan Pro
46.102.129.189 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://honar-mehrazin.ir/wp-includes/access/wells/wells.htm
Submission: On December 21 via automatic, source openphish (December 21st 2020, 1:16:53 pm UTC)

Summary HTTP 15 Redirects Links 14 Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 15 HTTP transactions. The main IP is 46.102.129.189, located in Iran, Islamic Republic Of and belongs to AFRANET from AS58267 accept AS58267, IR. The main domain is honar-mehrazin.ir.
TLS certificate: Issued by Let's Encrypt Authority X3 on November 6th 2020. Valid for: 3 months.

This is the only time honar-mehrazin.ir was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Wells Fargo (Banking)

Domain & IP information

	IP Address	AS Autonomous System
14	46.102.129.189 46.102.129.189	25184 (AFRANET f...) (AFRANET from AS58267 accept AS58267)
1	159.45.66.156 159.45.66.156	4196 (WELLSFARG...) (WELLSFARGO-4196)
15	2

14 46.102.129.189 (Iran, Islamic Republic Of)

ASN25184 (AFRANET from AS58267 accept AS58267, IR)
PTR: cloud146.mizbanfadns.net

honar-mehrazin.ir	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 159.45.66.156 (Charlotte, United States)

ASN4196 (WELLSFARGO-4196, US)

connect.secure.wellsfargo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	honar-mehrazin.ir honar-mehrazin.ir	99 KB
1	wellsfargo.com connect.secure.wellsfargo.com	17 KB
15	2

	Domain	Requested by
14	honar-mehrazin.ir	honar-mehrazin.ir
1	connect.secure.wellsfargo.com	honar-mehrazin.ir
15	2

This site contains links to these domains. Also see Links.

Domain
www.wellsfargo.com

Subject Issuer	Validity	Valid
honar-mehrazin.ir Let's Encrypt Authority X3	`2020-11-06` - `2021-02-04`	3 months	crt.sh
connect.secure.wellsfargo.com DigiCert EV RSA CA G2	`2020-07-09` - `2022-07-14`	2 years	crt.sh

This page contains 1 frames:

Primary Page: https://honar-mehrazin.ir/wp-includes/access/wells/wells.htm
Frame ID: CB074D51D4D1674DA50A2D94A5E2F3FD
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

LiteSpeed (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /^LiteSpeed$/i

Page Statistics

15
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

115 kB
Transfer

291 kB
Size

0
Cookies

14 Outgoing links

These are links going to different origins than the main page.

URL: https://www.wellsfargo.com/
Title:

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/help/
Title: Customer Service

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/locator/
Title: Locations

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/products_services/applications_viewall.jhtml
Title: Apply

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/commitment
Title: Learn More

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/commitment/faqs/
Title: Frequently asked questions >

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/help/faqs/sign-on
Title: Email Security Help

Search URL Search Domain Scan URL

URL: http://www.wellsfargo.com/agreement
Title: www.wellsfargo.com/agreement

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/about/
Title: About Wells Fargo

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/careers/
Title: Careers

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/privacy-security/
Title: Privacy, Security & Legal

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/privacy-security/fraud/report/phish
Title: Report Email Fraud

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/sitemap
Title: Sitemap

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/privacy-security/privacy/online#adchoices
Title: Ad Choices

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request wells.htm Show response
honar-mehrazin.ir/wp-includes/access/wells/ 10 KB
3 KB 446ms
146ms Document
text/html 46.102.129.189
AFRANET from AS58...

General

Check archive.org

Show headers Download Go to

Full URL: https://honar-mehrazin.ir/wp-includes/access/wells/wells.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 46.102.129.189 , Iran, Islamic Republic Of, ASN25184 (AFRANET from AS58267 accept AS58267, IR),
Reverse DNS: cloud146.mizbanfadns.net
Software: LiteSpeed / WP Rocket/3.3.5.2
Resource Hash: 248d37e6d3b2ca396b630adddb3dfc9b32ed188c2cb1582ac5497cd9909cf0e0

Request headers

:method: GET
:authority: honar-mehrazin.ir
:scheme: https
:path: /wp-includes/access/wells/wells.htm
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

cache-control: public, max-age=0,public
expires: Mon, 21 Dec 2020 13:16:18 GMT
content-type: text/html; charset=UTF-8
accept-ranges: bytes
content-encoding: br
vary: Accept-Encoding,Accept-Encoding
content-length: 3001
date: Mon, 21 Dec 2020 13:16:18 GMT
server: LiteSpeed
x-powered-by: WP Rocket/3.3.5.2
alt-svc: quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-25=":443"; ma=2592000, h3-27=":443"; ma=2592000

GET
H2 200 nd Show response
honar-mehrazin.ir/wp-includes/access/wells/wells_files/ 39 KB
39 KB 576ms
272ms Script
text/plain 46.102.129.189
AFRANET from AS58...

General

Check archive.org

Show headers Download Go to

Full URL: https://honar-mehrazin.ir/wp-includes/access/wells/wells_files/nd
Requested by: Host: honar-mehrazin.ir
URL: https://honar-mehrazin.ir/wp-includes/access/wells/wells.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 46.102.129.189 , Iran, Islamic Republic Of, ASN25184 (AFRANET from AS58267 accept AS58267, IR),
Reverse DNS: cloud146.mizbanfadns.net
Software: LiteSpeed /
Resource Hash: ffc539eb345f9466fecbe7b7ea8d2db0f56ef3857c8b26159d9a230bf9afdb4a

Request headers

Referer: https://honar-mehrazin.ir/wp-includes/access/wells/wells.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 21 Dec 2020 13:16:18 GMT
last-modified: Fri, 18 Dec 2020 20:52:43 GMT
server: LiteSpeed
vary: Accept-Encoding
cache-control: public, max-age=2592000
accept-ranges: bytes
content-length: 39657
expires: Wed, 20 Jan 2021 13:16:18 GMT

GET
H2 200 signonCommitment.css
honar-mehrazin.ir/wp-includes/access/wells/wells_files/ 6 KB
2 KB 452ms
148ms Stylesheet
text/css 46.102.129.189
AFRANET from AS58...

General

Check archive.org

Show headers Download Go to

Full URL: https://honar-mehrazin.ir/wp-includes/access/wells/wells_files/signonCommitment.css
Requested by: Host: honar-mehrazin.ir
URL: https://honar-mehrazin.ir/wp-includes/access/wells/wells.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 46.102.129.189 , Iran, Islamic Republic Of, ASN25184 (AFRANET from AS58267 accept AS58267, IR),
Reverse DNS: cloud146.mizbanfadns.net
Software: LiteSpeed /
Resource Hash: 7c21a45f9e10b50948faf43421ae13f1a49c75c9e44604c63b9bd1c34075d474

Request headers

Referer: https://honar-mehrazin.ir/wp-includes/access/wells/wells.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 21 Dec 2020 13:16:18 GMT
content-encoding: br
last-modified: Fri, 18 Dec 2020 20:52:43 GMT
server: LiteSpeed
vary: Accept-Encoding,Accept-Encoding
content-type: text/css; charset=UTF-8
cache-control: public, max-age=31536000,public
accept-ranges: bytes
content-length: 1422
expires: Tue, 21 Dec 2021 13:16:18 GMT

GET
H2 200 theme.css
honar-mehrazin.ir/wp-includes/access/wells/wells_files/ 8 KB
1 KB 575ms
272ms Stylesheet
text/css 46.102.129.189
AFRANET from AS58...

General

Check archive.org

Show headers Download Go to

Full URL: https://honar-mehrazin.ir/wp-includes/access/wells/wells_files/theme.css
Requested by: Host: honar-mehrazin.ir
URL: https://honar-mehrazin.ir/wp-includes/access/wells/wells.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 46.102.129.189 , Iran, Islamic Republic Of, ASN25184 (AFRANET from AS58267 accept AS58267, IR),
Reverse DNS: cloud146.mizbanfadns.net
Software: LiteSpeed /
Resource Hash: f82a7a512d314b7ce4c4bbab30c4528e0c3136514b694ca53213f06b246b273c

Request headers

Referer: https://honar-mehrazin.ir/wp-includes/access/wells/wells.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 21 Dec 2020 13:16:18 GMT
content-encoding: br
last-modified: Fri, 18 Dec 2020 20:52:43 GMT
server: LiteSpeed
vary: Accept-Encoding,Accept-Encoding
content-type: text/css; charset=UTF-8
cache-control: public, max-age=31536000,public
accept-ranges: bytes
content-length: 1455
expires: Tue, 21 Dec 2021 13:16:18 GMT

GET
H2 200 login-userprefs.js Show response
honar-mehrazin.ir/wp-includes/access/wells/wells_files/ 144 KB
23 KB 586ms
283ms Script
application/javascript 46.102.129.189
AFRANET from AS58...

General

Check archive.org

Show headers Download Go to

Full URL: https://honar-mehrazin.ir/wp-includes/access/wells/wells_files/login-userprefs.js
Requested by: Host: honar-mehrazin.ir
URL: https://honar-mehrazin.ir/wp-includes/access/wells/wells.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 46.102.129.189 , Iran, Islamic Republic Of, ASN25184 (AFRANET from AS58267 accept AS58267, IR),
Reverse DNS: cloud146.mizbanfadns.net
Software: LiteSpeed /
Resource Hash: 1b1b1c060912cb94b0db47fb6740b14ca96f731b0f1125bae5130a83e92d5f07

Request headers

Referer: https://honar-mehrazin.ir/wp-includes/access/wells/wells.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 21 Dec 2020 13:16:18 GMT
content-encoding: br
last-modified: Fri, 18 Dec 2020 20:52:43 GMT
server: LiteSpeed
vary: Accept-Encoding,Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000,public
accept-ranges: bytes
content-length: 23477
expires: Tue, 21 Dec 2021 13:16:18 GMT

GET
H2 200 conutils-6.js Show response
honar-mehrazin.ir/wp-includes/access/wells/wells_files/ 10 KB
4 KB 586ms
283ms Script
application/javascript 46.102.129.189
AFRANET from AS58...

General

Check archive.org

Show headers Download Go to

Full URL: https://honar-mehrazin.ir/wp-includes/access/wells/wells_files/conutils-6.js
Requested by: Host: honar-mehrazin.ir
URL: https://honar-mehrazin.ir/wp-includes/access/wells/wells.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 46.102.129.189 , Iran, Islamic Republic Of, ASN25184 (AFRANET from AS58267 accept AS58267, IR),
Reverse DNS: cloud146.mizbanfadns.net
Software: LiteSpeed /
Resource Hash: 3313ac9f2c148df9dc8581ae4d7bb9023c3ef933d1152db47de29e32ec5f67b0

Request headers

Referer: https://honar-mehrazin.ir/wp-includes/access/wells/wells.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 21 Dec 2020 13:16:18 GMT
content-encoding: br
last-modified: Fri, 18 Dec 2020 20:52:43 GMT
server: LiteSpeed
vary: Accept-Encoding,Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000,public
accept-ranges: bytes
content-length: 3686
expires: Tue, 21 Dec 2021 13:16:18 GMT

GET
H2 200 atadun.js Show response
honar-mehrazin.ir/wp-includes/access/wells/wells_files/ 1 KB
454 B 586ms
283ms Script
application/javascript 46.102.129.189
AFRANET from AS58...

General

Check archive.org

Show headers Download Go to

Full URL: https://honar-mehrazin.ir/wp-includes/access/wells/wells_files/atadun.js
Requested by: Host: honar-mehrazin.ir
URL: https://honar-mehrazin.ir/wp-includes/access/wells/wells.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 46.102.129.189 , Iran, Islamic Republic Of, ASN25184 (AFRANET from AS58267 accept AS58267, IR),
Reverse DNS: cloud146.mizbanfadns.net
Software: LiteSpeed /
Resource Hash: 5fb7b85658a6e615400e0f1f3e16fc869bbd099b3c3c181c294c05d1d7d1cfe5

Request headers

Referer: https://honar-mehrazin.ir/wp-includes/access/wells/wells.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 21 Dec 2020 13:16:18 GMT
content-encoding: br
last-modified: Fri, 18 Dec 2020 20:52:43 GMT
server: LiteSpeed
vary: Accept-Encoding,Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000,public
accept-ranges: bytes
content-length: 421
expires: Tue, 21 Dec 2021 13:16:18 GMT

GET
H2 200 wflogo-gfrewards.png
honar-mehrazin.ir/wp-includes/access/wells/wells_files/ 20 KB
20 KB 448ms
147ms Image
image/png 46.102.129.189
AFRANET from AS58...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://honar-mehrazin.ir/wp-includes/access/wells/wells_files/wflogo-gfrewards.png
Requested by: Host: honar-mehrazin.ir
URL: https://honar-mehrazin.ir/wp-includes/access/wells/wells.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 46.102.129.189 , Iran, Islamic Republic Of, ASN25184 (AFRANET from AS58267 accept AS58267, IR),
Reverse DNS: cloud146.mizbanfadns.net
Software: LiteSpeed /
Resource Hash: 8acab8f477754cb0846b2eca8bfea7c4e5a0e3a5348a3ff69fe67bfaef42b8ab

Request headers

Referer: https://honar-mehrazin.ir/wp-includes/access/wells/wells.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 21 Dec 2020 13:16:19 GMT
last-modified: Fri, 18 Dec 2020 20:52:43 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=10368000,public
accept-ranges: bytes
content-length: 20681
expires: Tue, 20 Apr 2021 13:16:19 GMT

GET
H2 404 conutils-6.2.2.js
honar-mehrazin.ir/auth/static/scripts/ 0
0 12419ms
12118ms Script
text/html 46.102.129.189
AFRANET from AS58...

General

Check archive.org

Show headers Download Go to

Full URL: https://honar-mehrazin.ir/auth/static/scripts/conutils-6.2.2.js
Requested by: Host: honar-mehrazin.ir
URL: https://honar-mehrazin.ir/wp-includes/access/wells/wells_files/login-userprefs.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 46.102.129.189 , Iran, Islamic Republic Of, ASN25184 (AFRANET from AS58267 accept AS58267, IR),
Reverse DNS: cloud146.mizbanfadns.net
Software: LiteSpeed /
Resource Hash

Request headers

Referer: https://honar-mehrazin.ir/wp-includes/access/wells/wells.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 21 Dec 2020 13:16:31 GMT
content-encoding: br
server: LiteSpeed
vary: Accept-Encoding,Accept-Encoding
content-type: text/html; charset=UTF-8
cache-control: no-store, no-cache, must-revalidate
link: <https://mehrazinshop.ir/wp-json/>; rel="https://api.w.org/"
expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H2 404 atadun.js
honar-mehrazin.ir/auth/static/prefs/ 0
0 12290ms
11989ms Script
text/html 46.102.129.189
AFRANET from AS58...

General

Check archive.org

Show headers Download Go to

Full URL: https://honar-mehrazin.ir/auth/static/prefs/atadun.js
Requested by: Host: honar-mehrazin.ir
URL: https://honar-mehrazin.ir/wp-includes/access/wells/wells_files/login-userprefs.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 46.102.129.189 , Iran, Islamic Republic Of, ASN25184 (AFRANET from AS58267 accept AS58267, IR),
Reverse DNS: cloud146.mizbanfadns.net
Software: LiteSpeed /
Resource Hash

Request headers

Referer: https://honar-mehrazin.ir/wp-includes/access/wells/wells.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 21 Dec 2020 13:16:31 GMT
content-encoding: br
server: LiteSpeed
vary: Accept-Encoding,Accept-Encoding
content-type: text/html; charset=UTF-8
cache-control: no-store, no-cache, must-revalidate
link: <https://mehrazinshop.ir/wp-json/>; rel="https://api.w.org/"
expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H2 404 atadun.js
honar-mehrazin.ir/auth/static/prefs/ 0
0 2216ms
2216ms Script
text/html 46.102.129.189
AFRANET from AS58...

General

Check archive.org

Show headers Download Go to

Full URL: https://honar-mehrazin.ir/auth/static/prefs/atadun.js
Requested by: Host: honar-mehrazin.ir
URL: https://honar-mehrazin.ir/wp-includes/access/wells/wells.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 46.102.129.189 , Iran, Islamic Republic Of, ASN25184 (AFRANET from AS58267 accept AS58267, IR),
Reverse DNS: cloud146.mizbanfadns.net
Software: LiteSpeed /
Resource Hash

Request headers

Referer: https://honar-mehrazin.ir/wp-includes/access/wells/wells.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 21 Dec 2020 13:16:33 GMT
content-encoding: br
server: LiteSpeed
vary: Accept-Encoding,Accept-Encoding
content-type: text/html; charset=UTF-8
cache-control: no-store, no-cache, must-revalidate
link: <https://mehrazinshop.ir/wp-json/>; rel="https://api.w.org/"
expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H/1.1 200 nd Show response
connect.secure.wellsfargo.com/jenny/ 47 KB
17 KB 653ms
147ms Script
application/javascript 159.45.66.156
WELLSFARGO-4196

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.secure.wellsfargo.com/jenny/nd

Requested by

Host: honar-mehrazin.ir
URL: https://honar-mehrazin.ir/wp-includes/access/wells/wells_files/atadun.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

159.45.66.156 Charlotte, United States, ASN4196 (WELLSFARGO-4196, US),

Reverse DNS

Software

KONICHIWA/1.1 /

Resource Hash

7ce7faeba2781ad66c054f80e54cb4f0460f080abdaf8df051117eccc2489cb5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://honar-mehrazin.ir/wp-includes/access/wells/wells.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: KONICHIWA/1.1
Date: Mon, 21 Dec 2020 13:16:34 GMT
X-Frame-Options: DENY
Content-Type: application/javascript;charset=ISO-8859-1
Transfer-Encoding: chunked
Connection: keep-alive
vary: accept-encoding
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=600

GET
H2 404 search_corner.gif
honar-mehrazin.ir/wp-includes/access/wells/wells_files/images/ 2 KB
2 KB 3378ms
3377ms Image
text/html 46.102.129.189
AFRANET from AS58...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://honar-mehrazin.ir/wp-includes/access/wells/wells_files/images/search_corner.gif
Requested by: Host: honar-mehrazin.ir
URL: https://honar-mehrazin.ir/wp-includes/access/wells/wells_files/signonCommitment.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 46.102.129.189 , Iran, Islamic Republic Of, ASN25184 (AFRANET from AS58267 accept AS58267, IR),
Reverse DNS: cloud146.mizbanfadns.net
Software: LiteSpeed /
Resource Hash: b0db455311c87241d0ac2f0da340898acb0596b239cbc889468ec84e74fcd6f9

Request headers

Referer: https://honar-mehrazin.ir/wp-includes/access/wells/wells_files/signonCommitment.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 21 Dec 2020 13:16:36 GMT
content-encoding: br
server: LiteSpeed
vary: Accept-Encoding,Accept-Encoding
content-type: text/html; charset=UTF-8
cache-control: no-store, no-cache, must-revalidate
link: <https://mehrazinshop.ir/wp-json/>; rel="https://api.w.org/"
expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H2 404 btn_blueslice.gif
honar-mehrazin.ir/wp-includes/access/wells/wells_files/images/ 2 KB
2 KB 3992ms
3992ms Image
text/html 46.102.129.189
AFRANET from AS58...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://honar-mehrazin.ir/wp-includes/access/wells/wells_files/images/btn_blueslice.gif
Requested by: Host: honar-mehrazin.ir
URL: https://honar-mehrazin.ir/wp-includes/access/wells/wells_files/signonCommitment.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 46.102.129.189 , Iran, Islamic Republic Of, ASN25184 (AFRANET from AS58267 accept AS58267, IR),
Reverse DNS: cloud146.mizbanfadns.net
Software: LiteSpeed /
Resource Hash: 251f78e37605de9f122b87a3190caa280fcdaeb9a207d9179249ecc8a31fc8df

Request headers

Referer: https://honar-mehrazin.ir/wp-includes/access/wells/wells_files/signonCommitment.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 21 Dec 2020 13:16:37 GMT
content-encoding: br
server: LiteSpeed
vary: Accept-Encoding,Accept-Encoding
content-type: text/html; charset=UTF-8
cache-control: no-store, no-cache, must-revalidate
link: <https://mehrazinshop.ir/wp-json/>; rel="https://api.w.org/"
expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H2 404 wellsfargo-storefront_outdoors-street_cars-and-people-crossing_722x185.png
honar-mehrazin.ir/wp-includes/access/images/ 2 KB
2 KB 4796ms
4796ms Image
text/html 46.102.129.189
AFRANET from AS58...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://honar-mehrazin.ir/wp-includes/access/images/wellsfargo-storefront_outdoors-street_cars-and-people-crossing_722x185.png
Requested by: Host: honar-mehrazin.ir
URL: https://honar-mehrazin.ir/wp-includes/access/wells/wells_files/theme.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 46.102.129.189 , Iran, Islamic Republic Of, ASN25184 (AFRANET from AS58267 accept AS58267, IR),
Reverse DNS: cloud146.mizbanfadns.net
Software: LiteSpeed /
Resource Hash: 87e93bb27fcb0954236d7371b77c24eb57ea99b32550fd5a656200cbd626bf58

Request headers

Referer: https://honar-mehrazin.ir/wp-includes/access/wells/wells_files/theme.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 21 Dec 2020 13:16:38 GMT
content-encoding: br
server: LiteSpeed
vary: Accept-Encoding,Accept-Encoding
content-type: text/html; charset=UTF-8
cache-control: no-store, no-cache, must-revalidate
link: <https://mehrazinshop.ir/wp-json/>; rel="https://api.w.org/"
expires: Thu, 19 Nov 1981 08:52:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Wells Fargo (Banking)

176 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

connect.secure.wellsfargo.com
honar-mehrazin.ir
159.45.66.156
46.102.129.189
1b1b1c060912cb94b0db47fb6740b14ca96f731b0f1125bae5130a83e92d5f07
248d37e6d3b2ca396b630adddb3dfc9b32ed188c2cb1582ac5497cd9909cf0e0
251f78e37605de9f122b87a3190caa280fcdaeb9a207d9179249ecc8a31fc8df
3313ac9f2c148df9dc8581ae4d7bb9023c3ef933d1152db47de29e32ec5f67b0
5fb7b85658a6e615400e0f1f3e16fc869bbd099b3c3c181c294c05d1d7d1cfe5
7c21a45f9e10b50948faf43421ae13f1a49c75c9e44604c63b9bd1c34075d474
7ce7faeba2781ad66c054f80e54cb4f0460f080abdaf8df051117eccc2489cb5
87e93bb27fcb0954236d7371b77c24eb57ea99b32550fd5a656200cbd626bf58
8acab8f477754cb0846b2eca8bfea7c4e5a0e3a5348a3ff69fe67bfaef42b8ab
b0db455311c87241d0ac2f0da340898acb0596b239cbc889468ec84e74fcd6f9
f82a7a512d314b7ce4c4bbab30c4528e0c3136514b694ca53213f06b246b273c
ffc539eb345f9466fecbe7b7ea8d2db0f56ef3857c8b26159d9a230bf9afdb4a

honar-mehrazin.ir Open in urlscan Pro 46.102.129.189 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

15 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

115 kBTransfer

291 kBSize

0 Cookies

14 Outgoing links

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

176 JavaScript Global Variables

0 Cookies

Indicators

honar-mehrazin.ir Open in urlscan Pro
46.102.129.189 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

115 kB
Transfer

291 kB
Size

0
Cookies

15 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!