thicong.com Open in urlscan Pro
123.30.135.239  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
4 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request update.html Show response thicong.com/wellsfargo/wellsfargo/	30 KB 31 KB	613ms 220ms	Document text/html	123.30.135.239 VNPT-AS-VN VNPT Corp
General Check archive.org Show headers Download Go to Full URL http://thicong.com/wellsfargo/wellsfargo/update.html?request_type=LogLogonHandler&location=us_logon1 Protocol HTTP/1.1 Server 123.30.135.239 Ho Chi Minh City, Viet Nam, ASN45899 (VNPT-AS-VN VNPT Corp, VN), Reverse DNS sv135d239.static.dc.ngoinhamang.com Software Apache / Resource Hash 5f3e1ba177c652254f4b10a121d6890c52deab722a9c4adc9e7929416ff3a922 Request headers Host thicong.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 X-DevTools-Emulate-Network-Conditions-Client-Id 65B2841EE6E5E4C7EEF8643093A5DA01 Response headers Date Sat, 14 Jul 2018 02:03:28 GMT Server Apache Last-Modified Sun, 01 Jul 2018 06:24:24 GMT Accept-Ranges bytes Content-Length 31223 Keep-Alive timeout=5, max=100 Connection Keep-Alive Content-Type text/html
GET H/1.1	200 OK	jquery.mobileec92.css thicong.com/wellsfargo/wellsfargo/css/	78 KB 78 KB	218ms 217ms	Stylesheet text/css	123.30.135.239 VNPT-AS-VN VNPT Corp
General Check archive.org Show headers Download Go to Full URL http://thicong.com/wellsfargo/wellsfargo/css/jquery.mobileec92.css?v= Requested by Host: thicong.com URL: http://thicong.com/wellsfargo/wellsfargo/update.html?request_type=LogLogonHandler&location=us_logon1 Protocol HTTP/1.1 Server 123.30.135.239 Ho Chi Minh City, Viet Nam, ASN45899 (VNPT-AS-VN VNPT Corp, VN), Reverse DNS sv135d239.static.dc.ngoinhamang.com Software Apache / Resource Hash 41f65e2f54a0cdf9aae7a8504590ef6acb2c16ad62f441355d44be2f5ae2f803 Request headers Pragma no-cache Accept-Encoding gzip, deflate Host thicong.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/css,*/*;q=0.1 Referer http://thicong.com/wellsfargo/wellsfargo/update.html?request_type=LogLogonHandler&location=us_logon1 Connection keep-alive Cache-Control no-cache Referer http://thicong.com/wellsfargo/wellsfargo/update.html?request_type=LogLogonHandler&location=us_logon1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Sat, 14 Jul 2018 02:03:28 GMT Last-Modified Mon, 23 May 2016 01:48:12 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 80109
GET H/1.1	200 OK	desktop-tablet.combinedec92.css thicong.com/wellsfargo/wellsfargo/css/	129 KB 129 KB	412ms 219ms	Stylesheet text/css	123.30.135.239 VNPT-AS-VN VNPT Corp
General Check archive.org Show headers Download Go to Full URL http://thicong.com/wellsfargo/wellsfargo/css/desktop-tablet.combinedec92.css?v= Requested by Host: thicong.com URL: http://thicong.com/wellsfargo/wellsfargo/update.html?request_type=LogLogonHandler&location=us_logon1 Protocol HTTP/1.1 Server 123.30.135.239 Ho Chi Minh City, Viet Nam, ASN45899 (VNPT-AS-VN VNPT Corp, VN), Reverse DNS sv135d239.static.dc.ngoinhamang.com Software Apache / Resource Hash e5e35268c6ace67d34dcb88594fa3fc43ed095b9f1a7560de8967a2039f39fc4 Request headers Pragma no-cache Accept-Encoding gzip, deflate Host thicong.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/css,*/*;q=0.1 Referer http://thicong.com/wellsfargo/wellsfargo/update.html?request_type=LogLogonHandler&location=us_logon1 Connection keep-alive Cache-Control no-cache Referer http://thicong.com/wellsfargo/wellsfargo/update.html?request_type=LogLogonHandler&location=us_logon1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Sat, 14 Jul 2018 02:03:28 GMT Last-Modified Mon, 23 May 2016 01:48:12 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 131694
GET H/1.1	200 OK	wf-logo.gif thicong.com/wellsfargo/wellsfargo/assets/images/global/	4 KB 4 KB	217ms 217ms	Image image/gif	123.30.135.239 VNPT-AS-VN VNPT Corp
General Check archive.org Show headers Download Go to Show image Full URL http://thicong.com/wellsfargo/wellsfargo/assets/images/global/wf-logo.gif Requested by Host: thicong.com URL: http://thicong.com/wellsfargo/wellsfargo/update.html?request_type=LogLogonHandler&location=us_logon1 Protocol HTTP/1.1 Server 123.30.135.239 Ho Chi Minh City, Viet Nam, ASN45899 (VNPT-AS-VN VNPT Corp, VN), Reverse DNS sv135d239.static.dc.ngoinhamang.com Software Apache / Resource Hash edc5ee3b590dae17b0eb19063c34680c15ee144d13583d006e6a7976b69cd2db Request headers Pragma no-cache Accept-Encoding gzip, deflate Host thicong.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept image/webp,image/apng,image/*,*/*;q=0.8 Referer http://thicong.com/wellsfargo/wellsfargo/update.html?request_type=LogLogonHandler&location=us_logon1 Connection keep-alive Cache-Control no-cache Referer http://thicong.com/wellsfargo/wellsfargo/update.html?request_type=LogLogonHandler&location=us_logon1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Sat, 14 Jul 2018 02:03:29 GMT Last-Modified Mon, 23 May 2016 01:48:12 GMT Server Apache Content-Type image/gif Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 3718
GET H/1.1	200 OK	jquery.combinedec92.js Show response thicong.com/wellsfargo/wellsfargo/javascript/	309 KB 309 KB	216ms 216ms	Script application/javascript	123.30.135.239 VNPT-AS-VN VNPT Corp
General Check archive.org Show headers Download Go to Full URL http://thicong.com/wellsfargo/wellsfargo/javascript/jquery.combinedec92.js?v= Requested by Host: thicong.com URL: http://thicong.com/wellsfargo/wellsfargo/update.html?request_type=LogLogonHandler&location=us_logon1 Protocol HTTP/1.1 Server 123.30.135.239 Ho Chi Minh City, Viet Nam, ASN45899 (VNPT-AS-VN VNPT Corp, VN), Reverse DNS sv135d239.static.dc.ngoinhamang.com Software Apache / Resource Hash 9e4d152536a44a33931cdb8b08a6f085aa55632959eb4912ac22d78545969a27 Request headers Pragma no-cache Accept-Encoding gzip, deflate Host thicong.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept */* Referer http://thicong.com/wellsfargo/wellsfargo/update.html?request_type=LogLogonHandler&location=us_logon1 Connection keep-alive Cache-Control no-cache Referer http://thicong.com/wellsfargo/wellsfargo/update.html?request_type=LogLogonHandler&location=us_logon1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Sat, 14 Jul 2018 02:03:28 GMT Last-Modified Mon, 23 May 2016 01:48:12 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 316630
GET H/1.1	200 OK	desktop-tablet.combinedec92.js Show response thicong.com/wellsfargo/wellsfargo/javascript/	58 KB 58 KB	220ms 220ms	Script application/javascript	123.30.135.239 VNPT-AS-VN VNPT Corp
General Check archive.org Show headers Download Go to Full URL http://thicong.com/wellsfargo/wellsfargo/javascript/desktop-tablet.combinedec92.js?v= Requested by Host: thicong.com URL: http://thicong.com/wellsfargo/wellsfargo/update.html?request_type=LogLogonHandler&location=us_logon1 Protocol HTTP/1.1 Server 123.30.135.239 Ho Chi Minh City, Viet Nam, ASN45899 (VNPT-AS-VN VNPT Corp, VN), Reverse DNS sv135d239.static.dc.ngoinhamang.com Software Apache / Resource Hash bf09007ac554fd6a0e119113238ff10e8c560842c5f53ad031fa6a4859e11542 Request headers Pragma no-cache Accept-Encoding gzip, deflate Host thicong.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept */* Referer http://thicong.com/wellsfargo/wellsfargo/update.html?request_type=LogLogonHandler&location=us_logon1 Connection keep-alive Cache-Control no-cache Referer http://thicong.com/wellsfargo/wellsfargo/update.html?request_type=LogLogonHandler&location=us_logon1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Sat, 14 Jul 2018 02:03:29 GMT Last-Modified Mon, 23 May 2016 01:48:12 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 59040
GET H/1.1	200 OK	loader-sm.gif thicong.com/wellsfargo/wellsfargo/assets/images/osmp/	1 KB 2 KB	217ms 217ms	Image image/gif	123.30.135.239 VNPT-AS-VN VNPT Corp
General Check archive.org Show headers Download Go to Show image Full URL http://thicong.com/wellsfargo/wellsfargo/assets/images/osmp/loader-sm.gif Requested by Host: thicong.com URL: http://thicong.com/wellsfargo/wellsfargo/javascript/jquery.combinedec92.js?v= Protocol HTTP/1.1 Server 123.30.135.239 Ho Chi Minh City, Viet Nam, ASN45899 (VNPT-AS-VN VNPT Corp, VN), Reverse DNS sv135d239.static.dc.ngoinhamang.com Software Apache / Resource Hash 03d86f34db46f2d600926047d935ece5636899bd46cb9ad04d526d11ebd28308 Request headers Pragma no-cache Accept-Encoding gzip, deflate Host thicong.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept image/webp,image/apng,image/*,*/*;q=0.8 Referer http://thicong.com/wellsfargo/wellsfargo/css/desktop-tablet.combinedec92.css?v= Connection keep-alive Cache-Control no-cache Referer http://thicong.com/wellsfargo/wellsfargo/css/desktop-tablet.combinedec92.css?v= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Sat, 14 Jul 2018 02:03:29 GMT Last-Modified Mon, 23 May 2016 01:48:12 GMT Server Apache Content-Type image/gif Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 1519
GET DATA	200 OK	truncated /	43 B 0		Image image/gif
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363 Request headers Response headers Access-Control-Allow-Origin * Content-Type image/gif
GET H/1.1	200 OK	bg-footer.png thicong.com/wellsfargo/wellsfargo/assets/images/osmp/	563 B 563 B	214ms 214ms	Image image/png	123.30.135.239 VNPT-AS-VN VNPT Corp
General Check archive.org Show headers Download Go to Show image Full URL http://thicong.com/wellsfargo/wellsfargo/assets/images/osmp/bg-footer.png Requested by Host: thicong.com URL: http://thicong.com/wellsfargo/wellsfargo/javascript/jquery.combinedec92.js?v= Protocol HTTP/1.1 Server 123.30.135.239 Ho Chi Minh City, Viet Nam, ASN45899 (VNPT-AS-VN VNPT Corp, VN), Reverse DNS sv135d239.static.dc.ngoinhamang.com Software Apache / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Pragma no-cache Accept-Encoding gzip, deflate Host thicong.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept image/webp,image/apng,image/*,*/*;q=0.8 Referer http://thicong.com/wellsfargo/wellsfargo/css/desktop-tablet.combinedec92.css?v= Connection keep-alive Cache-Control no-cache Referer http://thicong.com/wellsfargo/wellsfargo/css/desktop-tablet.combinedec92.css?v= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Sat, 14 Jul 2018 02:03:29 GMT Last-Modified Mon, 23 May 2016 01:48:12 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 563
GET DATA	200 OK	truncated /	428 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 0d4c1faf314c56aa4dcbacb09ef48ca4a69c18501c14092e6e9dddd7382da1cf Request headers Response headers Access-Control-Allow-Origin * Content-Type image/svg+xml;charset=US-ASCII
GET H/1.1	200 OK	btn-icon-search.png thicong.com/wellsfargo/wellsfargo/assets/images/osmp/	1 KB 2 KB	214ms 214ms	Image image/png	123.30.135.239 VNPT-AS-VN VNPT Corp
General Check archive.org Show headers Download Go to Show image Full URL http://thicong.com/wellsfargo/wellsfargo/assets/images/osmp/btn-icon-search.png Requested by Host: thicong.com URL: http://thicong.com/wellsfargo/wellsfargo/javascript/jquery.combinedec92.js?v= Protocol HTTP/1.1 Server 123.30.135.239 Ho Chi Minh City, Viet Nam, ASN45899 (VNPT-AS-VN VNPT Corp, VN), Reverse DNS sv135d239.static.dc.ngoinhamang.com Software Apache / Resource Hash 81aac32d4a7ff60babc93d38baaab739c55773843757258afbae01e23288c6cc Request headers Pragma no-cache Accept-Encoding gzip, deflate Host thicong.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept image/webp,image/apng,image/*,*/*;q=0.8 Referer http://thicong.com/wellsfargo/wellsfargo/css/desktop-tablet.combinedec92.css?v= Connection keep-alive Cache-Control no-cache Referer http://thicong.com/wellsfargo/wellsfargo/css/desktop-tablet.combinedec92.css?v= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Sat, 14 Jul 2018 02:03:29 GMT Last-Modified Mon, 23 May 2016 01:48:12 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 1369
GET DATA	200 OK	truncated /	926 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 00ad27c585cb12f51f9087349e4dab2088f70343cfbad5309e204f176969040f Request headers Response headers Access-Control-Allow-Origin * Content-Type image/svg+xml;charset=US-ASCII
GET DATA	200 OK	truncated /	34 B 0		Image image/gif
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 1e85ec81b9800b4c443d39caca0d0926089a3ac201120db1ceb45b93789480b8 Request headers Response headers Access-Control-Allow-Origin * Content-Type image/gif
GET H/1.1	404 Not Found	loader-sm.gif thicong.com/assets/images/osmp/	349 B 349 B	211ms 211ms	Image text/html	123.30.135.239 VNPT-AS-VN VNPT Corp
General Check archive.org Show headers Download Go to Show image Full URL http://thicong.com/assets/images/osmp/loader-sm.gif Requested by Host: thicong.com URL: http://thicong.com/wellsfargo/wellsfargo/update.html?request_type=LogLogonHandler&location=us_logon1 Protocol HTTP/1.1 Server 123.30.135.239 Ho Chi Minh City, Viet Nam, ASN45899 (VNPT-AS-VN VNPT Corp, VN), Reverse DNS sv135d239.static.dc.ngoinhamang.com Software Apache / Resource Hash 6285d70d7c0cd572b0b82d02fc1fd316f89e982973f267002c3e8de2b5064641 Request headers Pragma no-cache Accept-Encoding gzip, deflate Host thicong.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept image/webp,image/apng,image/*,*/*;q=0.8 Referer http://thicong.com/wellsfargo/wellsfargo/update.html?request_type=LogLogonHandler&location=us_logon1 Connection keep-alive Cache-Control no-cache Referer http://thicong.com/wellsfargo/wellsfargo/update.html?request_type=LogLogonHandler&location=us_logon1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Sat, 14 Jul 2018 02:03:29 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=100 Content-Length 349 Content-Type text/html; charset=iso-8859-1

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Wells Fargo (Banking)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery object| jQuery11100696739772681205 object| WF object| utag_data

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

thicong.com
123.30.135.239
00ad27c585cb12f51f9087349e4dab2088f70343cfbad5309e204f176969040f
03d86f34db46f2d600926047d935ece5636899bd46cb9ad04d526d11ebd28308
0d4c1faf314c56aa4dcbacb09ef48ca4a69c18501c14092e6e9dddd7382da1cf
1e85ec81b9800b4c443d39caca0d0926089a3ac201120db1ceb45b93789480b8
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
41f65e2f54a0cdf9aae7a8504590ef6acb2c16ad62f441355d44be2f5ae2f803
5f3e1ba177c652254f4b10a121d6890c52deab722a9c4adc9e7929416ff3a922
6285d70d7c0cd572b0b82d02fc1fd316f89e982973f267002c3e8de2b5064641
81aac32d4a7ff60babc93d38baaab739c55773843757258afbae01e23288c6cc
9e4d152536a44a33931cdb8b08a6f085aa55632959eb4912ac22d78545969a27
bf09007ac554fd6a0e119113238ff10e8c560842c5f53ad031fa6a4859e11542
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5e35268c6ace67d34dcb88594fa3fc43ed095b9f1a7560de8967a2039f39fc4
edc5ee3b590dae17b0eb19063c34680c15ee144d13583d006e6a7976b69cd2db