urlscan.io logo urlscan.io
SecurityTrails logo

www.wnsom.com Open in urlscan Pro
74.114.251.40  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://www.wnsom.com/pendingIRS_payment/Huntingtonbank/newso/
Effective URL: https://www.wnsom.com/pendingIRS_payment/Huntingtonbank/newso/indexa.php?P=AAMkADcyMWNlOGU4LTA1MTctNGU5NC04NmVhLTM2ZjY...
Submission: On July 06 via automatic, source openphish — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 5 HTTP transactions. The main IP is 74.114.251.40, located in United States and belongs to SPIRITTEL-AS, US. The main domain is www.wnsom.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on May 3rd 2022. Valid for: 3 months.
This is the only time www.wnsom.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Huntington Bank (Banking)

Domain & IP information

IP Address AS Autonomous System
1 2 74.114.251.40 2711 (SPIRITTEL-AS)
3 95.101.77.178 20940 (AKAMAI-ASN1)
1 95.101.77.161 20940 (AKAMAI-ASN1)
5 3
Apex Domain
Subdomains		 Transfer
4 huntington.com
onlinebanking.huntington.com — Cisco Umbrella Rank: 96055
www.huntington.com — Cisco Umbrella Rank: 53877
5 KB
2 wnsom.com
www.wnsom.com
13 KB
5 2
Domain Requested by
3 onlinebanking.huntington.com www.wnsom.com
2 www.wnsom.com 1 redirects
1 www.huntington.com www.wnsom.com
5 3

This site contains links to these domains. Also see Links.

Domain
www.huntington.com
selfservice.huntington.com
onlinebanking.huntington.com
Subject Issuer Validity Valid
wnsom.com
cPanel, Inc. Certification Authority		 2022-05-03 -
2022-08-01		 3 months crt.sh
huntington.com
DigiCert SHA2 Extended Validation Server CA		 2022-05-10 -
2023-05-12		 a year crt.sh

This page contains 1 frames:

Primary Page: https://www.wnsom.com/pendingIRS_payment/Huntingtonbank/newso/indexa.php?P=AAMkADcyMWNlOGU4LTA1MTctNGU5NC04NmVhLTM2ZjY2MWQ1ODUyZQAuAAAAAACPL3Vd8cnLS4%2FrNHDvh%2BurAQDLxtTRqKyYQrNPEBhBv0F3AAAMdHa7AAA_93894574342hdfjsixaoweue5_j1489738549283781331983743fncn_Product-UserID&___=
Frame ID: 3B6069790155B6DB51ED6190831FCD44
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://www.wnsom.com/pendingIRS_payment/Huntingtonbank/newso/ HTTP 302
    https://www.wnsom.com/pendingIRS_payment/Huntingtonbank/newso/indexa.php?P=AAMkADcyMWNlOGU4LTA1MTc... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

5
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

3
Subdomains

3
IPs

2
Countries

18 kB
Transfer

17 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://www.wnsom.com/pendingIRS_payment/Huntingtonbank/newso/ HTTP 302
    https://www.wnsom.com/pendingIRS_payment/Huntingtonbank/newso/indexa.php?P=AAMkADcyMWNlOGU4LTA1MTctNGU5NC04NmVhLTM2ZjY2MWQ1ODUyZQAuAAAAAACPL3Vd8cnLS4%2FrNHDvh%2BurAQDLxtTRqKyYQrNPEBhBv0F3AAAMdHa7AAA_93894574342hdfjsixaoweue5_j1489738549283781331983743fncn_Product-UserID&___= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request indexa.php
www.wnsom.com/pendingIRS_payment/Huntingtonbank/newso/
Redirect Chain
  • https://www.wnsom.com/pendingIRS_payment/Huntingtonbank/newso/
  • https://www.wnsom.com/pendingIRS_payment/Huntingtonbank/newso/indexa.php?P=AAMkADcyMWNlOGU4LTA1MTctNGU5NC04NmVhLTM2ZjY2MWQ1ODUyZQAuAAAAAACPL3Vd8cnLS4%2FrNHDvh%2BurAQDLxtTRqKyYQrNPEBhBv0F3AAAMdHa7AA...
13 KB
13 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.wnsom.com/pendingIRS_payment/Huntingtonbank/newso/indexa.php?P=AAMkADcyMWNlOGU4LTA1MTctNGU5NC04NmVhLTM2ZjY2MWQ1ODUyZQAuAAAAAACPL3Vd8cnLS4%2FrNHDvh%2BurAQDLxtTRqKyYQrNPEBhBv0F3AAAMdHa7AAA_93894574342hdfjsixaoweue5_j1489738549283781331983743fncn_Product-UserID&___=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
74.114.251.40 , United States, ASN2711 (SPIRITTEL-AS, US),
Reverse DNS
castlecreekadventureland.com
Software
Apache /
Resource Hash
80f491abd8e87acd7134525e4289d24fd34aefb52ae36e495ee1678a149c7834

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
Date
Wed, 06 Jul 2022 13:13:06 GMT
Keep-Alive
timeout=5, max=100
Server
Apache
Transfer-Encoding
chunked

Redirect headers

Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
Date
Wed, 06 Jul 2022 13:13:06 GMT
Keep-Alive
timeout=5, max=100
Location
indexa.php?P=AAMkADcyMWNlOGU4LTA1MTctNGU5NC04NmVhLTM2ZjY2MWQ1ODUyZQAuAAAAAACPL3Vd8cnLS4%2FrNHDvh%2BurAQDLxtTRqKyYQrNPEBhBv0F3AAAMdHa7AAA_93894574342hdfjsixaoweue5_j1489738549283781331983743fncn_Product-UserID&___=
Server
Apache
Transfer-Encoding
chunked
logo-lg.png
onlinebanking.huntington.com/rol/Images/UI/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://onlinebanking.huntington.com/rol/Images/UI/logo-lg.png
Requested by
Host: www.wnsom.com
URL: https://www.wnsom.com/pendingIRS_payment/Huntingtonbank/newso/indexa.php?P=AAMkADcyMWNlOGU4LTA1MTctNGU5NC04NmVhLTM2ZjY2MWQ1ODUyZQAuAAAAAACPL3Vd8cnLS4%2FrNHDvh%2BurAQDLxtTRqKyYQrNPEBhBv0F3AAAMdHa7AAA_93894574342hdfjsixaoweue5_j1489738549283781331983743fncn_Product-UserID&___=
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.77.178 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a95-101-77-178.deploy.static.akamaitechnologies.com
Software
Microsoft-IIS/10.0 /
Resource Hash
4183be66219d8fcbeefc40c65029ae45cd6c27e3fb469cf85633af1876b8bebf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff, nosniff;

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.wnsom.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff, nosniff;
p3p
CP="NON CUR OTPi OUR NOR UNI"
server-timing
dtSInfo;desc="0", dtRpid;desc="405584214"
content-length
2560
format-detection
telephone=no
x-ua-compatible
IE=edge
pragma
no-cache
last-modified
Thu, 09 Jun 2022 16:09:23 GMT
server
Microsoft-IIS/10.0
date
Wed, 06 Jul 2022 13:13:06 GMT
content-type
image/png
cache-control
max-age=0, no-cache, no-store
etag
"80fb83481b7cd81:0"
accept-ranges
bytes
expires
Wed, 06 Jul 2022 13:13:06 GMT
lock.gif
onlinebanking.huntington.com/rol/images/ 		870 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://onlinebanking.huntington.com/rol/images/lock.gif
Requested by
Host: www.wnsom.com
URL: https://www.wnsom.com/pendingIRS_payment/Huntingtonbank/newso/indexa.php?P=AAMkADcyMWNlOGU4LTA1MTctNGU5NC04NmVhLTM2ZjY2MWQ1ODUyZQAuAAAAAACPL3Vd8cnLS4%2FrNHDvh%2BurAQDLxtTRqKyYQrNPEBhBv0F3AAAMdHa7AAA_93894574342hdfjsixaoweue5_j1489738549283781331983743fncn_Product-UserID&___=
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.77.178 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a95-101-77-178.deploy.static.akamaitechnologies.com
Software
Microsoft-IIS/10.0 /
Resource Hash
5651db6cf27864f6a9fc7b44bce870b799057c58d7fc0e32f5a640172a88a7e3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff, nosniff;

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.wnsom.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff, nosniff;
p3p
CP="NON CUR OTPi OUR NOR UNI"
server-timing
dtSInfo;desc="1"
content-length
870
format-detection
telephone=no
x-ua-compatible
IE=edge
pragma
no-cache
last-modified
Thu, 09 Jun 2022 16:09:23 GMT
server
Microsoft-IIS/10.0
date
Wed, 06 Jul 2022 13:13:06 GMT
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
etag
"80fb83481b7cd81:0"
accept-ranges
bytes
expires
Wed, 06 Jul 2022 13:13:06 GMT
oo_icon_retina_black.gif
www.huntington.com/Presentation/onlineopinionV5/ 		217 B
403 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.huntington.com/Presentation/onlineopinionV5/oo_icon_retina_black.gif
Requested by
Host: www.wnsom.com
URL: https://www.wnsom.com/pendingIRS_payment/Huntingtonbank/newso/indexa.php?P=AAMkADcyMWNlOGU4LTA1MTctNGU5NC04NmVhLTM2ZjY2MWQ1ODUyZQAuAAAAAACPL3Vd8cnLS4%2FrNHDvh%2BurAQDLxtTRqKyYQrNPEBhBv0F3AAAMdHa7AAA_93894574342hdfjsixaoweue5_j1489738549283781331983743fncn_Product-UserID&___=
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.77.161 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a95-101-77-161.deploy.static.akamaitechnologies.com
Software
Akamai Image Manager /
Resource Hash
6d8a2316b98743b83355626f124d5c4299b1eba9c478aa94df90960437de5d7e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.wnsom.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Wed, 06 Jul 2022 13:13:06 GMT
last-modified
Wed, 08 Jun 2022 20:12:36 GMT
server
Akamai Image Manager
etag
"0cfb1168860d81:0"
content-type
image/png
cache-control
private, no-transform, max-age=388645
content-length
217
expires
Mon, 11 Jul 2022 01:10:31 GMT
hexlogo-footer-icon.png
onlinebanking.huntington.com/rol/Images/ 		333 B
696 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://onlinebanking.huntington.com/rol/Images/hexlogo-footer-icon.png
Requested by
Host: www.wnsom.com
URL: https://www.wnsom.com/pendingIRS_payment/Huntingtonbank/newso/indexa.php?P=AAMkADcyMWNlOGU4LTA1MTctNGU5NC04NmVhLTM2ZjY2MWQ1ODUyZQAuAAAAAACPL3Vd8cnLS4%2FrNHDvh%2BurAQDLxtTRqKyYQrNPEBhBv0F3AAAMdHa7AAA_93894574342hdfjsixaoweue5_j1489738549283781331983743fncn_Product-UserID&___=
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.77.178 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a95-101-77-178.deploy.static.akamaitechnologies.com
Software
Microsoft-IIS/10.0 /
Resource Hash
deb61527bc56e95dddf597d429991ca5a6002890ab8990b3c268926e6920b505
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff, nosniff;

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.wnsom.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff, nosniff;
p3p
CP="NON CUR OTPi OUR NOR UNI"
server-timing
dtSInfo;desc="1"
content-length
333
format-detection
telephone=no
x-ua-compatible
IE=edge
pragma
no-cache
last-modified
Thu, 09 Jun 2022 16:09:23 GMT
server
Microsoft-IIS/10.0
date
Wed, 06 Jul 2022 13:13:06 GMT
content-type
image/png
cache-control
max-age=0, no-cache, no-store
etag
"80fb83481b7cd81:0"
accept-ranges
bytes
expires
Wed, 06 Jul 2022 13:13:06 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Huntington Bank (Banking)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation

0 Cookies