sit-s.ru Open in urlscan Pro
195.16.62.67 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://sit-s.ru/css/wells/wellsfresh/
Effective URL:
http://sit-s.ru/css/wells/wellsfresh/5eaf6f86aabee7ea6c6952fe9825d353/
Submission: On July 25 via automatic, source phishtank (July 25th 2017, 9:37:55 pm UTC)

Summary HTTP 12 Redirects Links 17 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 12 HTTP transactions. The main IP is 195.16.62.67, located in Moscow, Russian Federation and belongs to SOVAM-AS, RU. The main domain is sit-s.ru.

This is the only time sit-s.ru was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Wells Fargo (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1	195.16.62.67 195.16.62.67	3216 (SOVAM-AS) (SOVAM-AS)
11	159.45.2.156 159.45.2.156	10837 (WELLSFARG...) (WELLSFARGO-10837 - Wells Fargo & Company)
12	3

1 195.16.62.67 (Moscow, Russian Federation)

ASN3216 (SOVAM-AS, RU)
PTR: acchosting1.co.ru

sit-s.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 159.45.2.156 (United States)

ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US)

connect.secure.wellsfargo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	wellsfargo.com connect.secure.wellsfargo.com	114 KB
1	sit-s.ru sit-s.ru	4 KB
12	2

	Domain	Requested by
11	connect.secure.wellsfargo.com	sit-s.ru connect.secure.wellsfargo.com
1	sit-s.ru
12	2

This site contains links to these domains. Also see Links.

Domain
www.wellsfargo.com
oam.wellsfargo.com
icomplete.wellsfargo.com
www.wellsfargorewards.com

Subject Issuer	Validity	Valid
connect.secure.wellsfargo.com Symantec Class 3 Secure Server CA - G4	`2016-10-13` - `2018-10-13`	2 years	crt.sh

This page contains 1 frames:

Primary Page: http://sit-s.ru/css/wells/wellsfresh/5eaf6f86aabee7ea6c6952fe9825d353/
Frame ID: 31488.1
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

12
Requests

92 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

118 kB
Transfer

312 kB
Size

0
Cookies

17 Outgoing links

These are links going to different origins than the main page.

URL: https://www.wellsfargo.com/
Title:

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/locator/
Title:

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/help/
Title: Customer Service

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/products_services/applications_viewall.jhtml
Title: Apply

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/help/faqs/enroll
Title: Online Banking Enrollment

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/privacy-security/guarantee
Title: Online Security Guarantee

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/privacy-security/
Title: Privacy, Security and Legal

Search URL Search Domain Scan URL

URL: http://www.wellsfargo.com/agreement
Title: Online Access Agreement

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/help/faqs/privacy-security/
Title: Security Questions Overview

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/help/faqs/sign-on
Title: Username/Password Help

Search URL Search Domain Scan URL

URL: https://oam.wellsfargo.com/oamo/identity/enrollment
Title: Sign Up Now

Search URL Search Domain Scan URL

URL: https://icomplete.wellsfargo.com/oas/status/enter
Title: Applications In Progress

Search URL Search Domain Scan URL

URL: https://www.wellsfargorewards.com/
Title: Credit Card Rewards

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/about/
Title: About Wells Fargo

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/careers/
Title: Careers

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/privacy-security/fraud/report/phish
Title: Report Email Fraud

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/sitemap
Title: Sitemap

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
sit-s.ru/css/wells/wellsfresh/5eaf6f86aabee7ea6c6952fe9825d353/
Redirect Chain

http://sit-s.ru/css/wells/wellsfresh/5eaf6f86aabee7ea6c6952fe9825d353
http://sit-s.ru/css/wells/wellsfresh/5eaf6f86aabee7ea6c6952fe9825d353/

13 KB
4 KB

51ms
51ms

Document
text/html

195.16.62.67
SOVAM-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://sit-s.ru/css/wells/wellsfresh/5eaf6f86aabee7ea6c6952fe9825d353/
Protocol: HTTP/1.1
Server: 195.16.62.67 Moscow, Russian Federation, ASN3216 (SOVAM-AS, RU),
Reverse DNS: acchosting1.co.ru
Software: nginx /
Resource Hash: 516baed0c9df1784583787298d15cbbc384e2a744389a178f5fe0cdaff9261e9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date: Tue, 25 Jul 2017 21:37:43 GMT
Content-Encoding: gzip
Last-Modified: Tue, 25 Jul 2017 21:37:41 GMT
Server: nginx
ETag: W/"1a32af-348b-5552b24209be8"
Vary: Accept-Encoding
Content-Type: text/html
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4248

Redirect headers

Date: Tue, 25 Jul 2017 21:37:43 GMT
Content-Encoding: gzip
Server: nginx
Vary: Accept-Encoding
Content-Type: text/html; charset=iso-8859-1
Location: http://sit-s.ru/css/wells/wellsfresh/5eaf6f86aabee7ea6c6952fe9825d353/
Connection: keep-alive
Content-Length: 274

GET
H/1.1 200
OK signon_clean.min.css
connect.secure.wellsfargo.com/auth/static/wfa/css/ 7 KB
2 KB 656ms
133ms Stylesheet
text/css 159.45.2.156
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.secure.wellsfargo.com/auth/static/wfa/css/signon_clean.min.css?v=9E62534143

Requested by

Host: sit-s.ru
URL: http://sit-s.ru/css/wells/wellsfresh/5eaf6f86aabee7ea6c6952fe9825d353/

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_256_CBC

Server

159.45.2.156 , United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/1.1 /

Resource Hash

2371d8b4605182fe88a2b4d762abda7cbb8bc23675ef4e9261a786bb1d8a06a4

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://sit-s.ru/css/wells/wellsfresh/5eaf6f86aabee7ea6c6952fe9825d353/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date: Tue, 25 Jul 2017 21:37:44 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Last-modified: Tue, 09 May 2017 13:57:32 GMT
Server: KONICHIWA/1.1
Etag: W/"1db3-5911cacc"
X-frame-options: SAMEORIGIN
Content-type: text/css
Connection: Keep-Alive
Content-length: 2185

GET
H/1.1 200
OK login-userprefs.min.js Show response
connect.secure.wellsfargo.com/auth/static/prefs/ 143 KB
32 KB 687ms
155ms Script
application/x-javascript 159.45.2.156
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.secure.wellsfargo.com/auth/static/prefs/login-userprefs.min.js

Requested by

Host: sit-s.ru
URL: http://sit-s.ru/css/wells/wellsfresh/5eaf6f86aabee7ea6c6952fe9825d353/

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_256_CBC

Server

159.45.2.156 , United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/1.1 /

Resource Hash

10658c4bab14a0ebf413aba1996c73b3c7d20ff360f2cbd8e4e02e12dce075c2

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://sit-s.ru/css/wells/wellsfresh/5eaf6f86aabee7ea6c6952fe9825d353/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date: Tue, 25 Jul 2017 21:37:44 GMT
Content-Encoding: gzip
Last-modified: Tue, 09 May 2017 13:57:32 GMT
Server: KONICHIWA/1.1
X-frame-options: SAMEORIGIN
Etag: W/"e4a-5911cacc"
Vary: Accept-Encoding
Content-Type: application/x-javascript; charset=UTF-8
Cache-control: max-age=1800
Connection: Keep-Alive
Content-Length: 32322
Expires: Tue, 25 Jul 2017 22:07:44 GMT

GET
H/1.1 200
OK jquery.js Show response
connect.secure.wellsfargo.com/auth/static/scripts/ 99 KB
39 KB 671ms
138ms Script
application/x-javascript 159.45.2.156
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.secure.wellsfargo.com/auth/static/scripts/jquery.js?v=9E62534143

Requested by

Host: sit-s.ru
URL: http://sit-s.ru/css/wells/wellsfresh/5eaf6f86aabee7ea6c6952fe9825d353/

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_256_CBC

Server

159.45.2.156 , United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/1.1 /

Resource Hash

0c646ba9e7fd0c3be4aa6992a032d438940c22373d15c3e386cbbb6a6f1d7002

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://sit-s.ru/css/wells/wellsfresh/5eaf6f86aabee7ea6c6952fe9825d353/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date: Tue, 25 Jul 2017 21:37:44 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Last-modified: Tue, 09 May 2017 13:57:32 GMT
Server: KONICHIWA/1.1
Etag: W/"18c2e-5911cacc"
X-frame-options: SAMEORIGIN
Content-type: application/x-javascript
Connection: Keep-Alive
Content-length: 39830

GET
H/1.1 200
OK popover.js Show response
connect.secure.wellsfargo.com/auth/static/scripts/ 769 B
769 B 667ms
134ms Script
application/x-javascript 159.45.2.156
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.secure.wellsfargo.com/auth/static/scripts/popover.js?v=9E62534143

Requested by

Host: sit-s.ru
URL: http://sit-s.ru/css/wells/wellsfresh/5eaf6f86aabee7ea6c6952fe9825d353/

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_256_CBC

Server

159.45.2.156 , United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/1.1 /

Resource Hash

57e7fe6c51b03564f8b28e2c9cc0b9bd88ab7e73245fd4d4723dfc2fbdf60b0a

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://sit-s.ru/css/wells/wellsfresh/5eaf6f86aabee7ea6c6952fe9825d353/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date: Tue, 25 Jul 2017 21:37:44 GMT
Last-modified: Tue, 09 May 2017 13:57:32 GMT
Server: KONICHIWA/1.1
Etag: W/"301-5911cacc"
Content-length: 769
X-frame-options: SAMEORIGIN
Content-type: application/x-javascript

GET
H/1.1 200
OK conutils-6.2.2.js Show response
connect.secure.wellsfargo.com/auth/static/scripts/ 10 KB
4 KB 134ms
134ms Script
application/x-javascript 159.45.2.156
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.secure.wellsfargo.com/auth/static/scripts/conutils-6.2.2.js

Requested by

Host: connect.secure.wellsfargo.com
URL: https://connect.secure.wellsfargo.com/auth/static/prefs/login-userprefs.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_256_CBC

Server

159.45.2.156 , United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/1.1 /

Resource Hash

198506f95f9c0cf3a670f82ea63f9a560bd6ff9a17c153ad4ac5d8777e0fda21

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://sit-s.ru/css/wells/wellsfresh/5eaf6f86aabee7ea6c6952fe9825d353/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Date: Tue, 25 Jul 2017 21:37:44 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Last-modified: Tue, 09 May 2017 13:57:32 GMT
Server: KONICHIWA/1.1
Etag: W/"26dc-5911cacc"
X-frame-options: SAMEORIGIN
Content-type: application/x-javascript
Connection: Keep-Alive
Content-length: 4109

GET
H/1.1 200
OK atadun.js Show response
connect.secure.wellsfargo.com/auth/static/prefs/ 1 KB
543 B 128ms
128ms Script
application/x-javascript 159.45.2.156
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.secure.wellsfargo.com/auth/static/prefs/atadun.js

Requested by

Host: connect.secure.wellsfargo.com
URL: https://connect.secure.wellsfargo.com/auth/static/prefs/login-userprefs.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_256_CBC

Server

159.45.2.156 , United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/1.1 /

Resource Hash

5fb7b85658a6e615400e0f1f3e16fc869bbd099b3c3c181c294c05d1d7d1cfe5

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://sit-s.ru/css/wells/wellsfresh/5eaf6f86aabee7ea6c6952fe9825d353/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Date: Tue, 25 Jul 2017 21:37:44 GMT
Content-Encoding: gzip
Last-modified: Tue, 09 May 2017 13:57:32 GMT
Server: KONICHIWA/1.1
X-frame-options: SAMEORIGIN
Etag: W/"42b-5911cacc"
Vary: Accept-Encoding
Content-type: application/x-javascript
Cache-control: max-age=1800
Connection: Keep-Alive
Content-length: 543
Expires: Tue, 25 Jul 2017 22:07:44 GMT

GET
H/1.1 200
OK nd Show response
connect.secure.wellsfargo.com/jenny/ 36 KB
36 KB 131ms
130ms Script
application/javascript 159.45.2.156
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.secure.wellsfargo.com/jenny/nd

Requested by

Host: connect.secure.wellsfargo.com
URL: https://connect.secure.wellsfargo.com/auth/static/prefs/atadun.js

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_256_CBC

Server

159.45.2.156 , United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/1.1 /

Resource Hash

b22e8ad816ff46b96637ef0c4dcc10d456fde002aad2c080380e3a63273b9a63

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://sit-s.ru/css/wells/wellsfresh/5eaf6f86aabee7ea6c6952fe9825d353/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date: Tue, 25 Jul 2017 21:37:44 GMT
Content-type: application/javascript;charset=ISO-8859-1
Server: KONICHIWA/1.1
X-frame-options: SAMEORIGIN
X-xss-protection: 1; mode=block
Transfer-encoding: chunked
X-ua-compatible: IE=edge

GET
DATA 200
OK truncated
/ 37 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Response headers

Access-Control-Allow-Origin: *
Content-Type: image/gif

GET
DATA 200
OK truncated
/ 37 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Response headers

Access-Control-Allow-Origin: *
Content-Type: image/gif

GET
DATA 200
OK truncated
/ 37 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Response headers

Access-Control-Allow-Origin: *
Content-Type: image/gif

GET
DATA 200
OK truncated
/ 616 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ebf4a535fa6a88962621940e780ca0cd6707b6cdaed59f469f0aeada311d09d1

Request headers

Response headers

Access-Control-Allow-Origin: *
Content-Type: image/gif

GET
H/1.1 200
OK new_search_corner.gif
connect.secure.wellsfargo.com/auth/static/wfa/css/images/ 49 B
49 B 128ms
128ms Image
image/gif 159.45.2.156
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://connect.secure.wellsfargo.com/auth/static/wfa/css/images/new_search_corner.gif

Requested by

Host: sit-s.ru
URL: http://sit-s.ru/css/wells/wellsfresh/5eaf6f86aabee7ea6c6952fe9825d353/

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_256_CBC

Server

159.45.2.156 , United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/1.1 /

Resource Hash

1e776523ad4b7aabbafe543437026068fa33850abd9fdc8c482c22b9357f5ba2

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://connect.secure.wellsfargo.com/auth/static/wfa/css/signon_clean.min.css?v=9E62534143
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date: Tue, 25 Jul 2017 21:37:44 GMT
Last-modified: Tue, 09 May 2017 13:57:32 GMT
Server: KONICHIWA/1.1
Etag: "31-5911cacc"
X-frame-options: SAMEORIGIN
Content-type: image/gif
Accept-ranges: bytes
Content-length: 49

GET
H/1.1 200
OK btn_blueslice.gif
connect.secure.wellsfargo.com/auth/static/wfa/css/images/ 152 B
152 B 127ms
127ms Image
image/gif 159.45.2.156
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://connect.secure.wellsfargo.com/auth/static/wfa/css/images/btn_blueslice.gif

Requested by

Host: sit-s.ru
URL: http://sit-s.ru/css/wells/wellsfresh/5eaf6f86aabee7ea6c6952fe9825d353/

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_256_CBC

Server

159.45.2.156 , United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/1.1 /

Resource Hash

dd77bede93256e88a4f6b6b05bca756126011650ce56a2a5e7ea6ecf44941fe2

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://connect.secure.wellsfargo.com/auth/static/wfa/css/signon_clean.min.css?v=9E62534143
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date: Tue, 25 Jul 2017 21:37:44 GMT
Last-modified: Tue, 09 May 2017 13:57:32 GMT
Server: KONICHIWA/1.1
Etag: "98-5911cacc"
X-frame-options: SAMEORIGIN
Content-type: image/gif
Accept-ranges: bytes
Content-length: 152

GET
H/1.1 200
OK caret_header_left.gif
connect.secure.wellsfargo.com/auth/static/wfa/css/images/ 55 B
55 B 125ms
125ms Image
image/gif 159.45.2.156
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://connect.secure.wellsfargo.com/auth/static/wfa/css/images/caret_header_left.gif

Requested by

Host: sit-s.ru
URL: http://sit-s.ru/css/wells/wellsfresh/5eaf6f86aabee7ea6c6952fe9825d353/

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_256_CBC

Server

159.45.2.156 , United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/1.1 /

Resource Hash

db53c3c794890dacc6969a17d1c28c1645007870e20e1fdfcff7b84324100301

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://connect.secure.wellsfargo.com/auth/static/wfa/css/signon_clean.min.css?v=9E62534143
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date: Tue, 25 Jul 2017 21:37:44 GMT
Last-modified: Tue, 09 May 2017 13:57:32 GMT
Server: KONICHIWA/1.1
Etag: "37-5911cacc"
X-frame-options: SAMEORIGIN
Content-type: image/gif
Accept-ranges: bytes
Content-length: 55

GET
H/1.1 200
OK left_nav_dot.gif
connect.secure.wellsfargo.com/auth/static/wfa/css/images/ 43 B
43 B 250ms
125ms Image
image/gif 159.45.2.156
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://connect.secure.wellsfargo.com/auth/static/wfa/css/images/left_nav_dot.gif

Requested by

Host: sit-s.ru
URL: http://sit-s.ru/css/wells/wellsfresh/5eaf6f86aabee7ea6c6952fe9825d353/

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_256_CBC

Server

159.45.2.156 , United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/1.1 /

Resource Hash

04ebbc8b6a0071e1d78440d674dad23569fd0f33217cfb13c57fe0cf07b14547

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://connect.secure.wellsfargo.com/auth/static/wfa/css/signon_clean.min.css?v=9E62534143
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date: Tue, 25 Jul 2017 21:37:44 GMT
Last-modified: Tue, 09 May 2017 13:57:32 GMT
Server: KONICHIWA/1.1
Etag: "2b-5911cacc"
X-frame-options: SAMEORIGIN
Content-type: image/gif
Accept-ranges: bytes
Content-length: 43

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Wells Fargo (Banking)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

connect.secure.wellsfargo.com
sit-s.ru
159.45.2.156
195.16.62.67
04ebbc8b6a0071e1d78440d674dad23569fd0f33217cfb13c57fe0cf07b14547
0c646ba9e7fd0c3be4aa6992a032d438940c22373d15c3e386cbbb6a6f1d7002
10658c4bab14a0ebf413aba1996c73b3c7d20ff360f2cbd8e4e02e12dce075c2
198506f95f9c0cf3a670f82ea63f9a560bd6ff9a17c153ad4ac5d8777e0fda21
1e776523ad4b7aabbafe543437026068fa33850abd9fdc8c482c22b9357f5ba2
2371d8b4605182fe88a2b4d762abda7cbb8bc23675ef4e9261a786bb1d8a06a4
516baed0c9df1784583787298d15cbbc384e2a744389a178f5fe0cdaff9261e9
57e7fe6c51b03564f8b28e2c9cc0b9bd88ab7e73245fd4d4723dfc2fbdf60b0a
5fb7b85658a6e615400e0f1f3e16fc869bbd099b3c3c181c294c05d1d7d1cfe5
b22e8ad816ff46b96637ef0c4dcc10d456fde002aad2c080380e3a63273b9a63
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
db53c3c794890dacc6969a17d1c28c1645007870e20e1fdfcff7b84324100301
dd77bede93256e88a4f6b6b05bca756126011650ce56a2a5e7ea6ecf44941fe2
ebf4a535fa6a88962621940e780ca0cd6707b6cdaed59f469f0aeada311d09d1

sit-s.ru Open in urlscan Pro 195.16.62.67 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

12 Requests

92 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

3 IPs

2 Countries

118 kBTransfer

312 kBSize

0 Cookies

17 Outgoing links

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

Indicators

sit-s.ru Open in urlscan Pro
195.16.62.67 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

92 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

118 kB
Transfer

312 kB
Size

0
Cookies

12 HTTP transactions
4 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!