welsfarg0t.ihmsoltech.co.za Open in urlscan Pro
41.185.64.125 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://welsfarg0t.ihmsoltech.co.za/faldtwos.htm
Submission: On June 07 via automatic, source openphish (June 7th 2017, 4:50:57 am UTC)

Summary HTTP 15 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 15 HTTP transactions. The main IP is 41.185.64.125, located in South Africa and belongs to webafrica, ZA. The main domain is welsfarg0t.ihmsoltech.co.za.

This is the only time welsfarg0t.ihmsoltech.co.za was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Wells Fargo (Banking)

Domain & IP information

	IP Address		AS Autonomous System
15	41.185.64.125 41.185.64.125		36943 (webafrica) (webafrica)
15	1

15 41.185.64.125 (South Africa)

ASN36943 (webafrica, ZA)
PTR: aeh77-cvps01monitor.cpt.wa.co.za

welsfarg0t.ihmsoltech.co.za	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
15	ihmsoltech.co.za welsfarg0t.ihmsoltech.co.za	32 KB
15	1

	Domain	Requested by
15	welsfarg0t.ihmsoltech.co.za	welsfarg0t.ihmsoltech.co.za
15	1

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://welsfarg0t.ihmsoltech.co.za/faldtwos.htm
Frame ID: 12657.1
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

15
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

32 kB
Transfer

33 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request faldtwos.htm Show response welsfarg0t.ihmsoltech.co.za/	16 KB 16 KB	880ms 537ms	Document text/html	41.185.64.125 webafrica
General Check archive.org Show headers Download Go to Full URL http://welsfarg0t.ihmsoltech.co.za/faldtwos.htm Protocol HTTP/1.1 Server 41.185.64.125 , South Africa, ASN36943 (webafrica, ZA), Reverse DNS aeh77-cvps01monitor.cpt.wa.co.za Software Apache / Resource Hash `4301144c8e88511e9d317c2a9f81d82adf79b0390aa5ccb2f4674b95a6d9def6` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host welsfarg0t.ihmsoltech.co.za Accept-Language en-US,en;q=0.8 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Cache-Control no-cache Connection keep-alive Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Response headers Date Wed, 07 Jun 2017 04:50:44 GMT Last-Modified Sat, 20 May 2017 08:03:38 GMT Server Apache Connection close Accept-Ranges bytes Content-Length 16884 Content-Type text/html
GET H/1.1	200 OK	async-keepalive.css welsfarg0t.ihmsoltech.co.za/	55 B 55 B	162ms 161ms	Stylesheet text/css	41.185.64.125 webafrica
General Check archive.org Show headers Download Go to Full URL http://welsfarg0t.ihmsoltech.co.za/async-keepalive.css Requested by Host: welsfarg0t.ihmsoltech.co.za URL: http://welsfarg0t.ihmsoltech.co.za/faldtwos.htm Protocol HTTP/1.1 Server 41.185.64.125 , South Africa, ASN36943 (webafrica, ZA), Reverse DNS aeh77-cvps01monitor.cpt.wa.co.za Software Apache / Resource Hash `cd68ccea3a4d856460b21ff523fbdfbe81aa59c4c1e4e35bdfb4395e79c5e40b` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host welsfarg0t.ihmsoltech.co.za Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Accept text/css,/;q=0.1 Referer http://welsfarg0t.ihmsoltech.co.za/faldtwos.htm Connection keep-alive Cache-Control no-cache Referer http://welsfarg0t.ihmsoltech.co.za/faldtwos.htm User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Response headers Date Wed, 07 Jun 2017 04:50:44 GMT Last-Modified Sat, 20 May 2017 08:03:38 GMT Server Apache Connection close Accept-Ranges bytes Content-Length 55 Content-Type text/css
GET H/1.1	404 Not Found	async-keepalive.js welsfarg0t.ihmsoltech.co.za/	0 0	328ms 165ms	Script text/html	41.185.64.125 webafrica
General Check archive.org Show headers Download Go to Full URL http://welsfarg0t.ihmsoltech.co.za/async-keepalive.js Requested by Host: welsfarg0t.ihmsoltech.co.za URL: http://welsfarg0t.ihmsoltech.co.za/faldtwos.htm Protocol HTTP/1.1 Server 41.185.64.125 , South Africa, ASN36943 (webafrica, ZA), Reverse DNS aeh77-cvps01monitor.cpt.wa.co.za Software Apache / Resource Hash Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host welsfarg0t.ihmsoltech.co.za Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Accept / Referer http://welsfarg0t.ihmsoltech.co.za/faldtwos.htm Connection keep-alive Cache-Control no-cache Referer http://welsfarg0t.ihmsoltech.co.za/faldtwos.htm User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Response headers Date Wed, 07 Jun 2017 04:50:44 GMT Server Apache Connection close Content-Length 335 Content-Type text/html; charset=iso-8859-1
GET H/1.1	200 OK	publicsite.css welsfarg0t.ihmsoltech.co.za/	12 KB 12 KB	318ms 160ms	Stylesheet text/css	41.185.64.125 webafrica
General Check archive.org Show headers Download Go to Full URL http://welsfarg0t.ihmsoltech.co.za/publicsite.css Requested by Host: welsfarg0t.ihmsoltech.co.za URL: http://welsfarg0t.ihmsoltech.co.za/faldtwos.htm Protocol HTTP/1.1 Server 41.185.64.125 , South Africa, ASN36943 (webafrica, ZA), Reverse DNS aeh77-cvps01monitor.cpt.wa.co.za Software Apache / Resource Hash `1e65090755bf331e624f523d0d596af788f0acd95685ead0c4f2ac75b3c9ac3a` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host welsfarg0t.ihmsoltech.co.za Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Accept text/css,/;q=0.1 Referer http://welsfarg0t.ihmsoltech.co.za/faldtwos.htm Connection keep-alive Cache-Control no-cache Referer http://welsfarg0t.ihmsoltech.co.za/faldtwos.htm User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Response headers Date Wed, 07 Jun 2017 04:50:44 GMT Last-Modified Sat, 20 May 2017 08:03:38 GMT Server Apache Connection close Accept-Ranges bytes Content-Length 12241 Content-Type text/css
GET H/1.1	200 OK	logo_62sq.gif welsfarg0t.ihmsoltech.co.za/	616 B 616 B	348ms 174ms	Image image/gif	41.185.64.125 webafrica
General Check archive.org Show headers Download Go to Show image Full URL http://welsfarg0t.ihmsoltech.co.za/logo_62sq.gif Requested by Host: welsfarg0t.ihmsoltech.co.za URL: http://welsfarg0t.ihmsoltech.co.za/faldtwos.htm Protocol HTTP/1.1 Server 41.185.64.125 , South Africa, ASN36943 (webafrica, ZA), Reverse DNS aeh77-cvps01monitor.cpt.wa.co.za Software Apache / Resource Hash `ebf4a535fa6a88962621940e780ca0cd6707b6cdaed59f469f0aeada311d09d1` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host welsfarg0t.ihmsoltech.co.za Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://welsfarg0t.ihmsoltech.co.za/faldtwos.htm Connection keep-alive Cache-Control no-cache Referer http://welsfarg0t.ihmsoltech.co.za/faldtwos.htm User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Response headers Date Wed, 07 Jun 2017 04:50:45 GMT Last-Modified Sat, 20 May 2017 08:03:38 GMT Server Apache Connection close Accept-Ranges bytes Content-Length 616 Content-Type image/gif
GET H/1.1	200 OK	shim.gif welsfarg0t.ihmsoltech.co.za/	43 B 43 B	359ms 177ms	Image image/gif	41.185.64.125 webafrica
General Check archive.org Show headers Download Go to Show image Full URL http://welsfarg0t.ihmsoltech.co.za/shim.gif Requested by Host: welsfarg0t.ihmsoltech.co.za URL: http://welsfarg0t.ihmsoltech.co.za/faldtwos.htm Protocol HTTP/1.1 Server 41.185.64.125 , South Africa, ASN36943 (webafrica, ZA), Reverse DNS aeh77-cvps01monitor.cpt.wa.co.za Software Apache / Resource Hash `89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host welsfarg0t.ihmsoltech.co.za Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://welsfarg0t.ihmsoltech.co.za/faldtwos.htm Connection keep-alive Cache-Control no-cache Referer http://welsfarg0t.ihmsoltech.co.za/faldtwos.htm User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Response headers Date Wed, 07 Jun 2017 04:50:45 GMT Last-Modified Sat, 20 May 2017 08:03:38 GMT Server Apache Connection close Accept-Ranges bytes Content-Length 43 Content-Type image/gif
GET H/1.1	404 Not Found	close_lb_weak.gif welsfarg0t.ihmsoltech.co.za/	334 B 0	666ms 166ms	Image text/html	41.185.64.125 webafrica
General Check archive.org Show headers Download Go to Show image Full URL http://welsfarg0t.ihmsoltech.co.za/close_lb_weak.gif Requested by Host: welsfarg0t.ihmsoltech.co.za URL: http://welsfarg0t.ihmsoltech.co.za/faldtwos.htm Protocol HTTP/1.1 Server 41.185.64.125 , South Africa, ASN36943 (webafrica, ZA), Reverse DNS aeh77-cvps01monitor.cpt.wa.co.za Software Apache / Resource Hash `3b723698e86835da897e120b4177f47af336cb5dce53b4b0b833d8d8d51f4c69` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host welsfarg0t.ihmsoltech.co.za Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://welsfarg0t.ihmsoltech.co.za/faldtwos.htm Connection keep-alive Cache-Control no-cache Referer http://welsfarg0t.ihmsoltech.co.za/faldtwos.htm User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Response headers Date Wed, 07 Jun 2017 04:50:45 GMT Server Apache Connection close Content-Length 334 Content-Type text/html; charset=iso-8859-1
GET H/1.1	200 OK	new_search_corner.gif welsfarg0t.ihmsoltech.co.za/	49 B 49 B	663ms 167ms	Image image/gif	41.185.64.125 webafrica
General Check archive.org Show headers Download Go to Show image Full URL http://welsfarg0t.ihmsoltech.co.za/new_search_corner.gif Requested by Host: welsfarg0t.ihmsoltech.co.za URL: http://welsfarg0t.ihmsoltech.co.za/faldtwos.htm Protocol HTTP/1.1 Server 41.185.64.125 , South Africa, ASN36943 (webafrica, ZA), Reverse DNS aeh77-cvps01monitor.cpt.wa.co.za Software Apache / Resource Hash `1e776523ad4b7aabbafe543437026068fa33850abd9fdc8c482c22b9357f5ba2` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host welsfarg0t.ihmsoltech.co.za Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://welsfarg0t.ihmsoltech.co.za/publicsite.css Connection keep-alive Cache-Control no-cache Referer http://welsfarg0t.ihmsoltech.co.za/publicsite.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Response headers Date Wed, 07 Jun 2017 04:50:45 GMT Last-Modified Sat, 20 May 2017 08:03:38 GMT Server Apache Connection close Accept-Ranges bytes Content-Length 49 Content-Type image/gif
GET H/1.1	200 OK	btn_blueslice.gif welsfarg0t.ihmsoltech.co.za/	152 B 152 B	655ms 160ms	Image image/gif	41.185.64.125 webafrica
General Check archive.org Show headers Download Go to Show image Full URL http://welsfarg0t.ihmsoltech.co.za/btn_blueslice.gif Requested by Host: welsfarg0t.ihmsoltech.co.za URL: http://welsfarg0t.ihmsoltech.co.za/faldtwos.htm Protocol HTTP/1.1 Server 41.185.64.125 , South Africa, ASN36943 (webafrica, ZA), Reverse DNS aeh77-cvps01monitor.cpt.wa.co.za Software Apache / Resource Hash `dd77bede93256e88a4f6b6b05bca756126011650ce56a2a5e7ea6ecf44941fe2` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host welsfarg0t.ihmsoltech.co.za Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://welsfarg0t.ihmsoltech.co.za/publicsite.css Connection keep-alive Cache-Control no-cache Referer http://welsfarg0t.ihmsoltech.co.za/publicsite.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Response headers Date Wed, 07 Jun 2017 04:50:45 GMT Last-Modified Sat, 20 May 2017 08:03:38 GMT Server Apache Connection close Accept-Ranges bytes Content-Length 152 Content-Type image/gif
GET H/1.1	200 OK	tab_bottom.gif welsfarg0t.ihmsoltech.co.za/	43 B 43 B	664ms 165ms	Image image/gif	41.185.64.125 webafrica
General Check archive.org Show headers Download Go to Show image Full URL http://welsfarg0t.ihmsoltech.co.za/tab_bottom.gif Requested by Host: welsfarg0t.ihmsoltech.co.za URL: http://welsfarg0t.ihmsoltech.co.za/faldtwos.htm Protocol HTTP/1.1 Server 41.185.64.125 , South Africa, ASN36943 (webafrica, ZA), Reverse DNS aeh77-cvps01monitor.cpt.wa.co.za Software Apache / Resource Hash `94bf27c86dff6f26021e00eeaeff8149de4acdbd60c2b9dd63d0dfb709855a56` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host welsfarg0t.ihmsoltech.co.za Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://welsfarg0t.ihmsoltech.co.za/publicsite.css Connection keep-alive Cache-Control no-cache Referer http://welsfarg0t.ihmsoltech.co.za/publicsite.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Response headers Date Wed, 07 Jun 2017 04:50:45 GMT Last-Modified Sat, 20 May 2017 08:03:38 GMT Server Apache Connection close Accept-Ranges bytes Content-Length 43 Content-Type image/gif
GET H/1.1	200 OK	unselected_tab.jpg welsfarg0t.ihmsoltech.co.za/	1 KB 1 KB	318ms 183ms	Image image/jpeg	41.185.64.125 webafrica
General Check archive.org Show headers Download Go to Show image Full URL http://welsfarg0t.ihmsoltech.co.za/unselected_tab.jpg Requested by Host: welsfarg0t.ihmsoltech.co.za URL: http://welsfarg0t.ihmsoltech.co.za/faldtwos.htm Protocol HTTP/1.1 Server 41.185.64.125 , South Africa, ASN36943 (webafrica, ZA), Reverse DNS aeh77-cvps01monitor.cpt.wa.co.za Software Apache / Resource Hash `d36fa2bc1f382dced31e931e3ccda676ae87c58f2b5a2f27df533106ef8812b9` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host welsfarg0t.ihmsoltech.co.za Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://welsfarg0t.ihmsoltech.co.za/publicsite.css Connection keep-alive Cache-Control no-cache Referer http://welsfarg0t.ihmsoltech.co.za/publicsite.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Response headers Date Wed, 07 Jun 2017 04:50:45 GMT Last-Modified Sat, 20 May 2017 08:03:40 GMT Server Apache Connection close Accept-Ranges bytes Content-Length 1438 Content-Type image/jpeg
GET H/1.1	200 OK	selected_tab.gif welsfarg0t.ihmsoltech.co.za/	462 B 462 B	326ms 179ms	Image image/gif	41.185.64.125 webafrica
General Check archive.org Show headers Download Go to Show image Full URL http://welsfarg0t.ihmsoltech.co.za/selected_tab.gif Requested by Host: welsfarg0t.ihmsoltech.co.za URL: http://welsfarg0t.ihmsoltech.co.za/faldtwos.htm Protocol HTTP/1.1 Server 41.185.64.125 , South Africa, ASN36943 (webafrica, ZA), Reverse DNS aeh77-cvps01monitor.cpt.wa.co.za Software Apache / Resource Hash `b73a2e2123b60703b83815724b2c76c7165b7bb8f51dee49f732d35cfcef4dc8` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host welsfarg0t.ihmsoltech.co.za Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://welsfarg0t.ihmsoltech.co.za/publicsite.css Connection keep-alive Cache-Control no-cache Referer http://welsfarg0t.ihmsoltech.co.za/publicsite.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Response headers Date Wed, 07 Jun 2017 04:50:45 GMT Last-Modified Sat, 20 May 2017 08:03:38 GMT Server Apache Connection close Accept-Ranges bytes Content-Length 462 Content-Type image/gif
GET H/1.1	200 OK	caret_header_left.gif welsfarg0t.ihmsoltech.co.za/	55 B 55 B	341ms 201ms	Image image/gif	41.185.64.125 webafrica
General Check archive.org Show headers Download Go to Show image Full URL http://welsfarg0t.ihmsoltech.co.za/caret_header_left.gif Requested by Host: welsfarg0t.ihmsoltech.co.za URL: http://welsfarg0t.ihmsoltech.co.za/faldtwos.htm Protocol HTTP/1.1 Server 41.185.64.125 , South Africa, ASN36943 (webafrica, ZA), Reverse DNS aeh77-cvps01monitor.cpt.wa.co.za Software Apache / Resource Hash `db53c3c794890dacc6969a17d1c28c1645007870e20e1fdfcff7b84324100301` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host welsfarg0t.ihmsoltech.co.za Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://welsfarg0t.ihmsoltech.co.za/publicsite.css Connection keep-alive Cache-Control no-cache Referer http://welsfarg0t.ihmsoltech.co.za/publicsite.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Response headers Date Wed, 07 Jun 2017 04:50:45 GMT Last-Modified Sat, 20 May 2017 08:03:38 GMT Server Apache Connection close Accept-Ranges bytes Content-Length 55 Content-Type image/gif
GET H/1.1	200 OK	left_nav_dot.gif welsfarg0t.ihmsoltech.co.za/	43 B 43 B	327ms 191ms	Image image/gif	41.185.64.125 webafrica
General Check archive.org Show headers Download Go to Show image Full URL http://welsfarg0t.ihmsoltech.co.za/left_nav_dot.gif Requested by Host: welsfarg0t.ihmsoltech.co.za URL: http://welsfarg0t.ihmsoltech.co.za/faldtwos.htm Protocol HTTP/1.1 Server 41.185.64.125 , South Africa, ASN36943 (webafrica, ZA), Reverse DNS aeh77-cvps01monitor.cpt.wa.co.za Software Apache / Resource Hash `04ebbc8b6a0071e1d78440d674dad23569fd0f33217cfb13c57fe0cf07b14547` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host welsfarg0t.ihmsoltech.co.za Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://welsfarg0t.ihmsoltech.co.za/publicsite.css Connection keep-alive Cache-Control no-cache Referer http://welsfarg0t.ihmsoltech.co.za/publicsite.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Response headers Date Wed, 07 Jun 2017 04:50:45 GMT Last-Modified Sat, 20 May 2017 08:03:38 GMT Server Apache Connection close Accept-Ranges bytes Content-Length 43 Content-Type image/gif
GET H/1.1	200 OK	favicon.ico welsfarg0t.ihmsoltech.co.za/	1 KB 1 KB	328ms 166ms	Other image/x-icon	41.185.64.125 webafrica
General Check archive.org Show headers Download Go to Full URL http://welsfarg0t.ihmsoltech.co.za/favicon.ico Protocol HTTP/1.1 Server 41.185.64.125 , South Africa, ASN36943 (webafrica, ZA), Reverse DNS aeh77-cvps01monitor.cpt.wa.co.za Software Apache / Resource Hash `4e9079a2ad7d41120a9dddde6aba75d5d90cb102acab3c3e6a8c203c831e353f` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host welsfarg0t.ihmsoltech.co.za Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://welsfarg0t.ihmsoltech.co.za/faldtwos.htm Connection keep-alive Cache-Control no-cache Referer http://welsfarg0t.ihmsoltech.co.za/faldtwos.htm User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Response headers Date Wed, 07 Jun 2017 04:50:45 GMT Last-Modified Sat, 20 May 2017 08:03:38 GMT Server Apache Connection close Accept-Ranges bytes Content-Length 1078 Content-Type image/x-icon

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Wells Fargo (Banking)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

welsfarg0t.ihmsoltech.co.za
41.185.64.125
04ebbc8b6a0071e1d78440d674dad23569fd0f33217cfb13c57fe0cf07b14547
1e65090755bf331e624f523d0d596af788f0acd95685ead0c4f2ac75b3c9ac3a
1e776523ad4b7aabbafe543437026068fa33850abd9fdc8c482c22b9357f5ba2
3b723698e86835da897e120b4177f47af336cb5dce53b4b0b833d8d8d51f4c69
4301144c8e88511e9d317c2a9f81d82adf79b0390aa5ccb2f4674b95a6d9def6
4e9079a2ad7d41120a9dddde6aba75d5d90cb102acab3c3e6a8c203c831e353f
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
94bf27c86dff6f26021e00eeaeff8149de4acdbd60c2b9dd63d0dfb709855a56
b73a2e2123b60703b83815724b2c76c7165b7bb8f51dee49f732d35cfcef4dc8
cd68ccea3a4d856460b21ff523fbdfbe81aa59c4c1e4e35bdfb4395e79c5e40b
d36fa2bc1f382dced31e931e3ccda676ae87c58f2b5a2f27df533106ef8812b9
db53c3c794890dacc6969a17d1c28c1645007870e20e1fdfcff7b84324100301
dd77bede93256e88a4f6b6b05bca756126011650ce56a2a5e7ea6ecf44941fe2
ebf4a535fa6a88962621940e780ca0cd6707b6cdaed59f469f0aeada311d09d1

welsfarg0t.ihmsoltech.co.za Open in urlscan Pro 41.185.64.125 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

15 Requests

0 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

32 kBTransfer

33 kBSize

0 Cookies

0 Outgoing links

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

Indicators

welsfarg0t.ihmsoltech.co.za Open in urlscan Pro
41.185.64.125 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

32 kB
Transfer

33 kB
Size

0
Cookies

15 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!