www.wellsfargosupports.com Open in urlscan Pro
68.178.247.62 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.wellsfargosupports.com/
Effective URL:
https://www.wellsfargosupports.com/Login/index.php
Submission: On August 06 via automatic, source rescanner (August 6th 2022, 2:59:52 pm UTC) — Scanned from DE

Summary HTTP 16 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 16 HTTP transactions. The main IP is 68.178.247.62, located in United States and belongs to GO-DADDY-COM-LLC, US. The main domain is www.wellsfargosupports.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on August 6th 2022. Valid for: 3 months.

This is the only time www.wellsfargosupports.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Wells Fargo (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 11	68.178.247.62 68.178.247.62	398101 (GO-DADDY-...) (GO-DADDY-COM-LLC)
2 4	23.36.163.228 23.36.163.228	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
4	2a02:26f0:6c0... 2a02:26f0:6c00::210:bae3	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
16	3

11 68.178.247.62 (United States) 1 redirects

ASN398101 (GO-DADDY-COM-LLC, US)
PTR: ip-68-178-247-62.ip.secureserver.net

www.wellsfargosupports.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 23.36.163.228 (Frankfurt am Main, Germany) 2 redirects

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-36-163-228.deploy.static.akamaitechnologies.com

img1.wsimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
img6.wsimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a02:26f0:6c00::210:bae3 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

events.api.secureserver.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	wellsfargosupports.com 1 redirects www.wellsfargosupports.com	764 KB
4	secureserver.net events.api.secureserver.net — Cisco Umbrella Rank: 12055	1 KB
4	wsimg.com 2 redirects img1.wsimg.com — Cisco Umbrella Rank: 8529 img6.wsimg.com — Cisco Umbrella Rank: 10509	23 KB
16	3

	Domain	Requested by
11	www.wellsfargosupports.com	1 redirects www.wellsfargosupports.com
4	events.api.secureserver.net	img1.wsimg.com
2	img6.wsimg.com	www.wellsfargosupports.com
2	img1.wsimg.com	2 redirects
16	4

This site contains no links.

Subject Issuer	Validity	Valid
wellsfargosupports.com cPanel, Inc. Certification Authority	`2022-08-06` - `2022-11-04`	3 months	crt.sh
*.api.secureserver.net Starfield Secure Certificate Authority - G2	`2021-09-14` - `2022-10-16`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.wellsfargosupports.com/Login/index.php
Frame ID: 890F30CAABEDEC023F590CCFA32EFEB5
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign On to View Your Personal Accounts | Wells Fargo

Page URL History Show full URLs

https://www.wellsfargosupports.com/ Page URL
https://www.wellsfargosupports.com/anti/index.php HTTP 302
https://www.wellsfargosupports.com/Login/index.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

16
Requests

88 %
HTTPS

33 %
IPv6

3
Domains

4
Subdomains

3
IPs

2
Countries

788 kB
Transfer

1041 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.wellsfargosupports.com/ Page URL
https://www.wellsfargosupports.com/anti/index.php HTTP 302
https://www.wellsfargosupports.com/Login/index.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 2

https://img1.wsimg.com/traffic-assets/js/tccl.min.js HTTP 302
https://img6.wsimg.com/wrhs/362d20193a8fed115f99b16a157b7fc4/tccl.min.js

Request Chain 9

https://img1.wsimg.com/traffic-assets/js/tccl.min.js HTTP 302
https://img6.wsimg.com/wrhs/362d20193a8fed115f99b16a157b7fc4/tccl.min.js

16 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 / Show response
www.wellsfargosupports.com/ 4 KB
2 KB 609ms
230ms Document
text/html 68.178.247.62
GO-DADDY-COM-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://www.wellsfargosupports.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 68.178.247.62 , United States, ASN398101 (GO-DADDY-COM-LLC, US),
Reverse DNS: ip-68-178-247-62.ip.secureserver.net
Software: Apache / PHP/7.4.30
Resource Hash: b4cb359868e2b3ba737a425c2c74343d76f54d43376362739b17734457c72e64

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, must-revalidate
content-encoding: br
content-length: 1350
content-type: text/html; charset=UTF-8
date: Sat, 06 Aug 2022 14:59:47 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/7.4.30

GET
H2 200 cf.css
www.wellsfargosupports.com/Export/css/ 2 KB
696 B 178ms
177ms Stylesheet
text/css 68.178.247.62
GO-DADDY-COM-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://www.wellsfargosupports.com/Export/css/cf.css
Requested by: Host: www.wellsfargosupports.com
URL: https://www.wellsfargosupports.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 68.178.247.62 , United States, ASN398101 (GO-DADDY-COM-LLC, US),
Reverse DNS: ip-68-178-247-62.ip.secureserver.net
Software: Apache /
Resource Hash: 6026255cc26e031389358227ccd1b7de6cba842c3978f9144d31cb30032276ef

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.wellsfargosupports.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Sat, 06 Aug 2022 14:59:47 GMT
content-encoding: br
last-modified: Wed, 02 Jun 2021 17:45:22 GMT
server: Apache
etag: "49e0e23-6d7-5c3cc05d2d080-br"
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 603

GET
H2

200

tccl.min.js Show response
img6.wsimg.com/wrhs/362d20193a8fed115f99b16a157b7fc4/
Redirect Chain

https://img1.wsimg.com/traffic-assets/js/tccl.min.js
https://img6.wsimg.com/wrhs/362d20193a8fed115f99b16a157b7fc4/tccl.min.js

44 KB
11 KB

37ms
27ms

Script
application/javascript

23.36.163.228
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://img6.wsimg.com/wrhs/362d20193a8fed115f99b16a157b7fc4/tccl.min.js
Requested by: Host: www.wellsfargosupports.com
URL: https://www.wellsfargosupports.com/
Protocol: H2
Server: 23.36.163.228 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-36-163-228.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 6cb0efedc1729d965016a35584cb00b03aa46e1a5e170f4b3ce092c7c3e99ec7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.wellsfargosupports.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

x-edgeconnect-origin-mex-latency: 135, 135
x-amz-version-id: Z0H0F1CdjRUI_nRMydHHi17Rv0HOw5tB
content-encoding: br
etag: "362d20193a8fed115f99b16a157b7fc4"
x-amz-request-id: N5JSXGJTVEFZM8E9
x-edgeconnect-midmile-rtt: 15, 139
x-amz-server-side-encryption: AES256
date: Sat, 06 Aug 2022 14:59:47 GMT
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 11155
x-amz-id-2: 73c+ZpWNgBh9xtilh6Nj22iH/BmUfkHwAgj9PgWHmvdTmSCUhi96da6Ell5SKHaif06RANK80zY=
last-modified: Mon, 11 Apr 2022 14:15:53 GMT
x-edgeconnect-cache-status: 2
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
timing-allow-origin: *

Redirect headers

location: https://img6.wsimg.com/wrhs/362d20193a8fed115f99b16a157b7fc4/tccl.min.js
date: Sat, 06 Aug 2022 14:59:47 GMT
cache-control: max-age=1800
access-control-allow-origin: *
timing-allow-origin: *
content-length: 0
expires: Sat, 06 Aug 2022 15:29:47 GMT

GET
H2 200 event Show response
events.api.secureserver.net/t/1/tl/ 43 B
299 B 356ms
282ms XHR
image/gif 2a02:26f0:6c00::210:bae3
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://events.api.secureserver.net/t/1/tl/event?cts=1659797987650&dh=www.wellsfargosupports.com&dr=&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F104.0.5112.79%20Safari%2F537.36&vci=2130786831&cv=2.0.0&z=589089202&vg=60de70f1-2547-576d-bac3-41c8cf2e1998&vtg=60de70f1-2547-576d-bac3-41c8cf2e1998&dp=%2F&ap=cpsh-oh&trfd=%7B%22ap%22%3A%22cpsh-oh%22%2C%22server%22%3A%22p3plzcpnl489522%22%2C%22id%22%3A%228876836%22%7D&hit_id=eb6b06ad-cfe4-5540-94a4-065f05442b7b&ht=pageview

Requested by

Host: img1.wsimg.com
URL: https://img1.wsimg.com/traffic-assets/js/tccl.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00::210:bae3 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.wellsfargosupports.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains
x-content-type-options: nosniff
date: Sat, 06 Aug 2022 14:59:48 GMT
x-frame-options: DENY
content-type: image/gif
access-control-allow-origin: https://www.wellsfargosupports.com
cache-control: private
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
content-length: 43
x-xss-protection: 1; mode=block

GET
H2 200 event Show response
events.api.secureserver.net/t/1/tl/ 43 B
299 B 351ms
280ms XHR
image/gif 2a02:26f0:6c00::210:bae3
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://events.api.secureserver.net/t/1/tl/event?cts=1659797987654&dh=www.wellsfargosupports.com&dr=&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F104.0.5112.79%20Safari%2F537.36&vci=2130786831&cv=2.0.0&z=2044041348&vg=60de70f1-2547-576d-bac3-41c8cf2e1998&vtg=60de70f1-2547-576d-bac3-41c8cf2e1998&dp=%2F&ap=cpsh-oh&trfd=%7B%22ap%22%3A%22cpsh-oh%22%2C%22server%22%3A%22p3plzcpnl489522%22%2C%22id%22%3A%228876836%22%7D&hit_id=e986847c-80f5-58ee-9a74-51aa9a89c3e2&ht=perf&tce=1659797987217&tcs=1659797986860&tdc=1659797987651&tdclee=1659797987651&tdcles=1659797987651&tdi=1659797987651&tdl=1659797987449&tdle=1659797986860&tdls=1659797986838&tfs=1659797986837&tns=1659797986837&trqs=1659797987217&tre=1659797987448&trps=1659797987447&tles=1659797987651&tlee=0&nt=navigate&nav_type=hard

Requested by

Host: img1.wsimg.com
URL: https://img1.wsimg.com/traffic-assets/js/tccl.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00::210:bae3 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.wellsfargosupports.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains
x-content-type-options: nosniff
date: Sat, 06 Aug 2022 14:59:48 GMT
x-frame-options: DENY
content-type: image/gif
access-control-allow-origin: https://www.wellsfargosupports.com
cache-control: private
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
content-length: 43
x-xss-protection: 1; mode=block

GET
H2

200

Primary Request index.php Show response
www.wellsfargosupports.com/Login/
Redirect Chain

https://www.wellsfargosupports.com/anti/index.php
https://www.wellsfargosupports.com/Login/index.php

56 KB
20 KB

194ms
193ms

Document
text/html

68.178.247.62
GO-DADDY-COM-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://www.wellsfargosupports.com/Login/index.php
Requested by: Host: www.wellsfargosupports.com
URL: https://www.wellsfargosupports.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 68.178.247.62 , United States, ASN398101 (GO-DADDY-COM-LLC, US),
Reverse DNS: ip-68-178-247-62.ip.secureserver.net
Software: Apache / PHP/7.4.30
Resource Hash: 4d19d91b856506dc3543be255af705fe8ccec27533f23a3921a37092faf4861e

Request headers

Referer: https://www.wellsfargosupports.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, must-revalidate
content-encoding: br
content-length: 19839
content-type: text/html; charset=UTF-8
date: Sat, 06 Aug 2022 14:59:49 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/7.4.30

Redirect headers

cache-control: no-store, no-cache, must-revalidate
content-encoding: br
content-length: 1
content-type: text/html; charset=UTF-8
date: Sat, 06 Aug 2022 14:59:49 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
location: ../Login/index.php
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/7.4.30

GET
H2 200 wfui.css
www.wellsfargosupports.com/Export/css/ 140 KB
19 KB 185ms
184ms Stylesheet
text/css 68.178.247.62
GO-DADDY-COM-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://www.wellsfargosupports.com/Export/css/wfui.css
Requested by: Host: www.wellsfargosupports.com
URL: https://www.wellsfargosupports.com/Login/index.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 68.178.247.62 , United States, ASN398101 (GO-DADDY-COM-LLC, US),
Reverse DNS: ip-68-178-247-62.ip.secureserver.net
Software: Apache /
Resource Hash: 8396ea7e71e3b1408f7e3516f9244622716733bb73cf1a9a5429523411e7e448

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.wellsfargosupports.com/Login/index.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Sat, 06 Aug 2022 14:59:50 GMT
content-encoding: br
last-modified: Wed, 02 Jun 2021 17:45:24 GMT
server: Apache
etag: "49e0e2b-230d3-5c3cc05f15500-br"
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 19542

GET
H2 200 main.css
www.wellsfargosupports.com/Export/css/ 22 KB
2 KB 179ms
179ms Stylesheet
text/css 68.178.247.62
GO-DADDY-COM-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://www.wellsfargosupports.com/Export/css/main.css
Requested by: Host: www.wellsfargosupports.com
URL: https://www.wellsfargosupports.com/Login/index.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 68.178.247.62 , United States, ASN398101 (GO-DADDY-COM-LLC, US),
Reverse DNS: ip-68-178-247-62.ip.secureserver.net
Software: Apache /
Resource Hash: c8c20e76ddc7ab2b147d8dd0ba1c4c5b43e0c67e0a9e49cff6f4e918e0ea9b6f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.wellsfargosupports.com/Login/index.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Sat, 06 Aug 2022 14:59:50 GMT
content-encoding: br
last-modified: Wed, 02 Jun 2021 17:45:22 GMT
server: Apache
etag: "49e0e28-5824-5c3cc05d2d080-br"
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 1959

GET
H2 200 COB-BOB-IRT-enroll_park.jpg
www.wellsfargosupports.com/Export/img/ 644 KB
648 KB 341ms
340ms Image
image/jpeg 68.178.247.62
GO-DADDY-COM-LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.wellsfargosupports.com/Export/img/COB-BOB-IRT-enroll_park.jpg
Requested by: Host: www.wellsfargosupports.com
URL: https://www.wellsfargosupports.com/Login/index.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 68.178.247.62 , United States, ASN398101 (GO-DADDY-COM-LLC, US),
Reverse DNS: ip-68-178-247-62.ip.secureserver.net
Software: Apache /
Resource Hash: 0ec17c78a8c0de92bd385f344308a3e0c715fedbb9b784820bd7aefcfc69c214

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.wellsfargosupports.com/Login/index.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Sat, 06 Aug 2022 14:59:50 GMT
last-modified: Wed, 02 Jun 2021 17:45:26 GMT
server: Apache
accept-ranges: bytes
etag: "49e0e5b-a0f77-5c3cc060fd980"
content-length: 659319
content-type: image/jpeg

GET
H2 200 index.js Show response
www.wellsfargosupports.com/Export/js/ 13 KB
2 KB 529ms
527ms Script
application/javascript 68.178.247.62
GO-DADDY-COM-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://www.wellsfargosupports.com/Export/js/index.js
Requested by: Host: www.wellsfargosupports.com
URL: https://www.wellsfargosupports.com/Login/index.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 68.178.247.62 , United States, ASN398101 (GO-DADDY-COM-LLC, US),
Reverse DNS: ip-68-178-247-62.ip.secureserver.net
Software: Apache /
Resource Hash: a810a4b0e255909c9a3fd9524c1c9a89b215b1f42e1c7cc40776826c31e1fda2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.wellsfargosupports.com/Login/index.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Sat, 06 Aug 2022 14:59:50 GMT
content-encoding: br
last-modified: Wed, 02 Jun 2021 17:45:26 GMT
server: Apache
etag: "49e0e78-34bb-5c3cc060fd980-br"
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 1548

GET
H2

200

tccl.min.js Show response
img6.wsimg.com/wrhs/362d20193a8fed115f99b16a157b7fc4/
Redirect Chain

https://img1.wsimg.com/traffic-assets/js/tccl.min.js
https://img6.wsimg.com/wrhs/362d20193a8fed115f99b16a157b7fc4/tccl.min.js

44 KB
11 KB

27ms
26ms

Script
application/javascript

23.36.163.228
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://img6.wsimg.com/wrhs/362d20193a8fed115f99b16a157b7fc4/tccl.min.js
Requested by: Host: www.wellsfargosupports.com
URL: https://www.wellsfargosupports.com/Login/index.php
Protocol: H2
Server: 23.36.163.228 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-36-163-228.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 6cb0efedc1729d965016a35584cb00b03aa46e1a5e170f4b3ce092c7c3e99ec7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.wellsfargosupports.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

x-edgeconnect-origin-mex-latency: 135, 135
x-amz-version-id: Z0H0F1CdjRUI_nRMydHHi17Rv0HOw5tB
content-encoding: br
etag: "362d20193a8fed115f99b16a157b7fc4"
x-amz-request-id: N5JSXGJTVEFZM8E9
x-edgeconnect-midmile-rtt: 15, 139
x-amz-server-side-encryption: AES256
date: Sat, 06 Aug 2022 14:59:50 GMT
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 11155
x-amz-id-2: 73c+ZpWNgBh9xtilh6Nj22iH/BmUfkHwAgj9PgWHmvdTmSCUhi96da6Ell5SKHaif06RANK80zY=
last-modified: Mon, 11 Apr 2022 14:15:53 GMT
x-edgeconnect-cache-status: 2
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
timing-allow-origin: *

Redirect headers

location: https://img6.wsimg.com/wrhs/362d20193a8fed115f99b16a157b7fc4/tccl.min.js
date: Sat, 06 Aug 2022 14:59:50 GMT
cache-control: max-age=1800
access-control-allow-origin: *
timing-allow-origin: *
content-length: 0
expires: Sat, 06 Aug 2022 15:29:50 GMT

GET
H2 200 wellsfargosans-rg.woff2
www.wellsfargosupports.com/Export/fonts/ 22 KB
22 KB 509ms
508ms Font
font/woff2 68.178.247.62
GO-DADDY-COM-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://www.wellsfargosupports.com/Export/fonts/wellsfargosans-rg.woff2
Requested by: Host: www.wellsfargosupports.com
URL: https://www.wellsfargosupports.com/Export/css/wfui.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 68.178.247.62 , United States, ASN398101 (GO-DADDY-COM-LLC, US),
Reverse DNS: ip-68-178-247-62.ip.secureserver.net
Software: Apache /
Resource Hash: 631f3b6267a831a8d67c45e480b5d5a2601f10ff8708bcf3a45a41b377a129cc

Request headers

Referer: https://www.wellsfargosupports.com/Export/css/wfui.css
Origin: https://www.wellsfargosupports.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Sat, 06 Aug 2022 14:59:50 GMT
content-encoding: br
last-modified: Wed, 02 Jun 2021 17:45:26 GMT
server: Apache
etag: "49e0e41-5798-5c3cc060fd980-br"
vary: Accept-Encoding
content-type: font/woff2
accept-ranges: bytes
content-length: 22423

GET
H2 200 wellsfargosans-sbd.woff2
www.wellsfargosupports.com/Export/fonts/ 22 KB
22 KB 509ms
509ms Font
font/woff2 68.178.247.62
GO-DADDY-COM-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://www.wellsfargosupports.com/Export/fonts/wellsfargosans-sbd.woff2
Requested by: Host: www.wellsfargosupports.com
URL: https://www.wellsfargosupports.com/Export/css/wfui.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 68.178.247.62 , United States, ASN398101 (GO-DADDY-COM-LLC, US),
Reverse DNS: ip-68-178-247-62.ip.secureserver.net
Software: Apache /
Resource Hash: ab9d8c97b35ed86b6224aca911aa304a0d7dbcbd28e00a4c6585b96e28ed30ba

Request headers

Referer: https://www.wellsfargosupports.com/Export/css/wfui.css
Origin: https://www.wellsfargosupports.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Sat, 06 Aug 2022 14:59:50 GMT
content-encoding: br
last-modified: Wed, 02 Jun 2021 17:45:26 GMT
server: Apache
etag: "49e0e44-5848-5c3cc060fd980-br"
vary: Accept-Encoding
content-type: font/woff2
accept-ranges: bytes
content-length: 22598

GET
H2 200 wellsfargoserif-rg.woff2
www.wellsfargosupports.com/Export/fonts/ 26 KB
26 KB 508ms
508ms Font
font/woff2 68.178.247.62
GO-DADDY-COM-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://www.wellsfargosupports.com/Export/fonts/wellsfargoserif-rg.woff2
Requested by: Host: www.wellsfargosupports.com
URL: https://www.wellsfargosupports.com/Export/css/wfui.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 68.178.247.62 , United States, ASN398101 (GO-DADDY-COM-LLC, US),
Reverse DNS: ip-68-178-247-62.ip.secureserver.net
Software: Apache /
Resource Hash: aeb7b3bfc4281d35b02dfde05ac7a6c0d3daa7f3123b35a9cbd4b5a8e3f3c310

Request headers

Referer: https://www.wellsfargosupports.com/Export/css/wfui.css
Origin: https://www.wellsfargosupports.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Sat, 06 Aug 2022 14:59:50 GMT
content-encoding: br
last-modified: Wed, 02 Jun 2021 17:45:26 GMT
server: Apache
etag: "49e0e50-6854-5c3cc060fd980-br"
vary: Accept-Encoding
content-type: font/woff2
accept-ranges: bytes
content-length: 26712

GET
H2 200 event Show response
events.api.secureserver.net/t/1/tl/ 43 B
299 B 110ms
110ms XHR
image/gif 2a02:26f0:6c00::210:bae3
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://events.api.secureserver.net/t/1/tl/event?cts=1659797990770&dh=www.wellsfargosupports.com&dr=https%3A%2F%2Fwww.wellsfargosupports.com%2F&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F104.0.5112.79%20Safari%2F537.36&vci=704691536&cv=2.0.0&z=812999326&vg=60de70f1-2547-576d-bac3-41c8cf2e1998&vtg=60de70f1-2547-576d-bac3-41c8cf2e1998&dp=%2FLogin%2Findex.php&ap=cpsh-oh&trfd=%7B%22ap%22%3A%22cpsh-oh%22%2C%22server%22%3A%22p3plzcpnl489522%22%2C%22id%22%3A%228876836%22%7D&hit_id=5e64f25d-4ca8-51d8-b55d-d4ab359c9911&ht=pageview

Requested by

Host: img1.wsimg.com
URL: https://img1.wsimg.com/traffic-assets/js/tccl.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00::210:bae3 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.wellsfargosupports.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains
x-content-type-options: nosniff
date: Sat, 06 Aug 2022 14:59:51 GMT
x-frame-options: DENY
content-type: image/gif
access-control-allow-origin: https://www.wellsfargosupports.com
cache-control: private
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
content-length: 43
x-xss-protection: 1; mode=block

GET
H2 200 event Show response
events.api.secureserver.net/t/1/tl/ 43 B
299 B 115ms
115ms XHR
image/gif 2a02:26f0:6c00::210:bae3
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://events.api.secureserver.net/t/1/tl/event?cts=1659797991492&dh=www.wellsfargosupports.com&dr=https%3A%2F%2Fwww.wellsfargosupports.com%2F&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F104.0.5112.79%20Safari%2F537.36&vci=704691536&cv=2.0.0&z=1394601406&vg=60de70f1-2547-576d-bac3-41c8cf2e1998&vtg=60de70f1-2547-576d-bac3-41c8cf2e1998&dp=%2FLogin%2Findex.php&ap=cpsh-oh&trfd=%7B%22ap%22%3A%22cpsh-oh%22%2C%22server%22%3A%22p3plzcpnl489522%22%2C%22id%22%3A%228876836%22%7D&hit_id=ab67f1f4-aecd-571a-87e7-78df1e637d1a&ht=perf&tce=1659797989862&tcs=1659797989862&tdc=1659797991491&tdclee=1659797990771&tdcles=1659797990771&tdi=1659797990771&tdl=1659797990060&tdle=1659797989862&tdls=1659797989862&tfs=1659797989862&tns=1659797989130&trqs=1659797989864&tre=1659797990234&trps=1659797990057&tles=1659797991491&tlee=0&nt=navigate&nav_type=hard

Requested by

Host: img1.wsimg.com
URL: https://img1.wsimg.com/traffic-assets/js/tccl.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00::210:bae3 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.wellsfargosupports.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains
x-content-type-options: nosniff
date: Sat, 06 Aug 2022 14:59:51 GMT
x-frame-options: DENY
content-type: image/gif
access-control-allow-origin: https://www.wellsfargosupports.com
cache-control: private
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
content-length: 43
x-xss-protection: 1; mode=block

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Wells Fargo (Banking)

29 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.wellsfargosupports.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: d57db0b2e2e02e07c707180b6914a4f1
.wellsfargosupports.com/	1970-01-20 13:48:53	Name: _tccl_visitor Value: 60de70f1-2547-576d-bac3-41c8cf2e1998
.wellsfargosupports.com/	1970-01-20 05:03:19	Name: _tccl_visit Value: 60de70f1-2547-576d-bac3-41c8cf2e1998

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

events.api.secureserver.net
img1.wsimg.com
img6.wsimg.com
www.wellsfargosupports.com
23.36.163.228
2a02:26f0:6c00::210:bae3
68.178.247.62
0ec17c78a8c0de92bd385f344308a3e0c715fedbb9b784820bd7aefcfc69c214
4d19d91b856506dc3543be255af705fe8ccec27533f23a3921a37092faf4861e
6026255cc26e031389358227ccd1b7de6cba842c3978f9144d31cb30032276ef
631f3b6267a831a8d67c45e480b5d5a2601f10ff8708bcf3a45a41b377a129cc
6cb0efedc1729d965016a35584cb00b03aa46e1a5e170f4b3ce092c7c3e99ec7
8396ea7e71e3b1408f7e3516f9244622716733bb73cf1a9a5429523411e7e448
a810a4b0e255909c9a3fd9524c1c9a89b215b1f42e1c7cc40776826c31e1fda2
ab9d8c97b35ed86b6224aca911aa304a0d7dbcbd28e00a4c6585b96e28ed30ba
aeb7b3bfc4281d35b02dfde05ac7a6c0d3daa7f3123b35a9cbd4b5a8e3f3c310
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b4cb359868e2b3ba737a425c2c74343d76f54d43376362739b17734457c72e64
c8c20e76ddc7ab2b147d8dd0ba1c4c5b43e0c67e0a9e49cff6f4e918e0ea9b6f

www.wellsfargosupports.com Open in urlscan Pro 68.178.247.62 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

16 Requests

88 %HTTPS

33 %IPv6

3 Domains

4 Subdomains

3 IPs

2 Countries

788 kBTransfer

1041 kBSize

3 Cookies

0 Outgoing links

Page URL History

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

29 JavaScript Global Variables

3 Cookies

Indicators

www.wellsfargosupports.com Open in urlscan Pro
68.178.247.62 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

88 %
HTTPS

33 %
IPv6

3
Domains

4
Subdomains

3
IPs

2
Countries

788 kB
Transfer

1041 kB
Size

3
Cookies

16 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!