connect-secure-wellsfarg.duckdns.org
Open in
urlscan Pro
69.164.197.138
Malicious Activity!
Public Scan
Effective URL: https://connect-secure-wellsfarg.duckdns.org/auth/login/auth-present?connect.secure/auth/login/present?origin=cob&error=yes
Submission: On April 17 via api from JP — Scanned from JP
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on April 16th 2023. Valid for: 3 months.
This is the only time connect-secure-wellsfarg.duckdns.org was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Wells Fargo (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 18 | 69.164.197.138 69.164.197.138 | 63949 (AKAMAI-AP...) (AKAMAI-AP Akamai Technologies) | |
1 | 2606:4700::68... 2606:4700::6811:180e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
23 | 23.35.112.153 23.35.112.153 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
41 | 3 |
ASN63949 (AKAMAI-AP Akamai Technologies, Inc., SG)
PTR: 69-164-197-138.ip.linodeusercontent.com
connect-secure-wellsfarg.duckdns.org |
ASN16625 (AKAMAI-AS, US)
PTR: a23-35-112-153.deploy.static.akamaitechnologies.com
www01.wellsfargomedia.com | |
www04.wellsfargomedia.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
23 |
wellsfargomedia.com
www01.wellsfargomedia.com — Cisco Umbrella Rank: 21244 www04.wellsfargomedia.com — Cisco Umbrella Rank: 57091 |
334 KB |
18 |
duckdns.org
1 redirects
connect-secure-wellsfarg.duckdns.org |
291 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 206 |
15 KB |
41 | 3 |
Domain | Requested by | |
---|---|---|
20 | www01.wellsfargomedia.com |
connect-secure-wellsfarg.duckdns.org
|
18 | connect-secure-wellsfarg.duckdns.org |
1 redirects
connect-secure-wellsfarg.duckdns.org
|
3 | www04.wellsfargomedia.com |
connect-secure-wellsfarg.duckdns.org
|
1 | cdnjs.cloudflare.com |
connect-secure-wellsfarg.duckdns.org
|
41 | 4 |
This site contains links to these domains. Also see Links.
Domain |
---|
instagram.com |
www.pinterest.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
connect-secure-wellsfarg.duckdns.org cPanel, Inc. Certification Authority |
2023-04-16 - 2023-07-15 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-08-03 - 2023-08-02 |
a year | crt.sh |
www01.wellsfargomedia.com GeoTrust RSA CA 2018 |
2023-01-27 - 2024-01-26 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://connect-secure-wellsfarg.duckdns.org/auth/login/auth-present?connect.secure/auth/login/present?origin=cob&error=yes
Frame ID: E76DCAE1368A9BCD5D7AA8C720C618D5
Requests: 41 HTTP requests in this frame
Screenshot
Page Title
Page URL History Show full URLs
-
https://connect-secure-wellsfarg.duckdns.org/auth/login/
HTTP 302
https://connect-secure-wellsfarg.duckdns.org/auth/login/auth-present?connect.secure/auth/login/present?origin=cob&error=yes Page URL
Page Statistics
2 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://connect-secure-wellsfarg.duckdns.org/auth/login/
HTTP 302
https://connect-secure-wellsfarg.duckdns.org/auth/login/auth-present?connect.secure/auth/login/present?origin=cob&error=yes Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
41 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
auth-present
connect-secure-wellsfarg.duckdns.org/auth/login/ Redirect Chain
|
51 KB 52 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
homepage_ret.css
connect-secure-wellsfarg.duckdns.org/auth/login/assets/css/ |
53 KB 53 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
homepage-horz-logo.svg
connect-secure-wellsfarg.duckdns.org/auth/login/assets/images/ |
5 KB 6 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
homepage-lock.svg
connect-secure-wellsfarg.duckdns.org/auth/login/assets/images/ |
2 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
homepage-signon-lock.svg
connect-secure-wellsfarg.duckdns.org/auth/login/assets/images/ |
4 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
es6-shim.min.js
cdnjs.cloudflare.com/ajax/libs/es6-shim/0.35.3/ |
55 KB 15 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
FormValidation.min.js
connect-secure-wellsfarg.duckdns.org/auth/login/assets/dist/js/ |
66 KB 67 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
forms.js
connect-secure-wellsfarg.duckdns.org/auth/login/assets/dist/js/ |
11 KB 11 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
home-sprite-image.png
connect-secure-wellsfarg.duckdns.org/auth/login/assets/images/ |
315 B 315 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
wfi111_ph_hph_default1_1200x532.jpg
connect-secure-wellsfarg.duckdns.org/auth/login/assets/images/ |
56 KB 56 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
wfi111_ph_hph_default1_1200x532.jpg
connect-secure-wellsfarg.duckdns.org/auth/login/images/ |
315 B 315 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon-marquee-dot-active.svg
connect-secure-wellsfarg.duckdns.org/auth/login/assets/images/ |
578 B 823 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon-marquee-dot-inactive.svg
connect-secure-wellsfarg.duckdns.org/auth/login/assets/images/ |
315 B 315 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
task-icon-checking-50x50.png
connect-secure-wellsfarg.duckdns.org/auth/login/assets/images/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
task-icon-credit-50x50.png
connect-secure-wellsfarg.duckdns.org/auth/login/assets/images/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
task-icon-student-50x50.png
connect-secure-wellsfarg.duckdns.org/auth/login/assets/images/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
task-icon-account-50x50.png
www01.wellsfargomedia.com/assets/images/homepage/ |
960 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
task-icon-rates-50x50.png
www01.wellsfargomedia.com/assets/images/homepage/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
FICO-phone-borrowing-and-credit-970x485.jpg
www01.wellsfargomedia.com/assets/images/photography/lifestyle/970x485/ |
26 KB 27 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
paying-phone-beach-banking-made-easy-970x485.jpg
www01.wellsfargomedia.com/assets/images/photography/lifestyle/970x485/ |
33 KB 33 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
couple-beach-retirement-970x485.jpg
www01.wellsfargomedia.com/assets/images/photography/lifestyle/970x485/ |
31 KB 31 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
woman-tablet-investing-basics-970x485.jpg
www01.wellsfargomedia.com/assets/images/photography/lifestyle/970x485/ |
28 KB 28 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
woman-card-security-center-970x485.jpg
www01.wellsfargomedia.com/assets/images/photography/lifestyle/970x485/ |
34 KB 34 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wfic638_ph_b-jk_0224_4057_489x234.jpg
www01.wellsfargomedia.com/assets/images/homepage/ |
19 KB 19 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wfi111_ph_hre_default1_304x194.jpg
www01.wellsfargomedia.com/assets/images/homepage/ |
10 KB 10 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wfi111_ph_hre_default2_304x194.jpg
www01.wellsfargomedia.com/assets/images/homepage/ |
11 KB 11 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wells-fargo-volunteer-gardening_414x240.jpg
www01.wellsfargomedia.com/assets/images/photography/lifestyle/ |
25 KB 25 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
stagecoach-two-drivers-field-green-414x240.jpg
www04.wellsfargomedia.com/assets/images/homepage/ |
27 KB 28 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
redress_414x240.jpg
www01.wellsfargomedia.com/assets/images/homepage/ |
18 KB 18 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
three-men-volunteer-house-414x240.jpg
www04.wellsfargomedia.com/assets/images/homepage/ |
24 KB 24 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
woman-sitting-chair-tablet-screenshot-414x240.jpg
www01.wellsfargomedia.com/assets/images/homepage/ |
12 KB 12 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
homepage_footer_stagecoach.svg
www01.wellsfargomedia.com/assets/images/global/ |
14 KB 6 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
home-sprite-image.png
connect-secure-wellsfarg.duckdns.org/auth/login/images/ |
315 B 315 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
home-sprite-image.png
www04.wellsfargomedia.com/assets/images/css/template/homepage/ |
11 KB 11 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
homepage-magnifying-glass.png
www01.wellsfargomedia.com/assets/images/css/template/homepage/ |
236 B 466 B |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
chevron-right-blue.png
www01.wellsfargomedia.com/assets/images/css/template/ |
140 B 319 B |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icn-uti-checkbox.svg
www01.wellsfargomedia.com/assets/images/css/template/homepage/ |
728 B 643 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
auth-present
connect-secure-wellsfarg.duckdns.org/auth/login/ |
32 KB 32 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
home-sprite-image.png
www01.wellsfargomedia.com/assets/images/css/template/homepage/ |
11 KB 11 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icon-marquee-dot-active.svg
www01.wellsfargomedia.com/assets/images/css/template/homepage/ |
578 B 602 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icon-marquee-dot-inactive.svg
www01.wellsfargomedia.com/assets/images/css/template/homepage/ |
587 B 600 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Wells Fargo (Banking)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| returnExports object| FormValidation1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
connect-secure-wellsfarg.duckdns.org/ | Name: PHPSESSID Value: 566d24fe1f3b1602612908eda057a56e |
4 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdnjs.cloudflare.com
connect-secure-wellsfarg.duckdns.org
www01.wellsfargomedia.com
www04.wellsfargomedia.com
23.35.112.153
2606:4700::6811:180e
69.164.197.138
004590468c4ed29e2b9ac5192217c685059d0d623e4398c49cdb4a0b5a386831
09504bdecbf274d2b3322b86c6cc699a186b4656cc220d563fcbfb08df220b08
11fa95cade4d31642d17ebba420d3706837b9a91090992b2d2aecc74a6b6ab88
15edc68516d9016f5df0651edcd4eedfd5c2f440d85f932f7a2b973b70d37883
16b5311ddbd849fd1808d3d855f79d9640417d7c65714ffec6f6bb6f17416883
172b637e7559c7d6c2d3dbe28cd5d921d27e63ccff5298481cfc0918508b6e75
2af5bcc0ab347f0e039ec86b4f0a5f2fb506ef539c284331b5e8e78f3f94badc
2e2222aa5f6102fc859ca7a6a7f70f0346be560d819cc1f21b5dd2cab940f68b
37822f946f1b79d00138a6e027d921492874dc7a79882dc5934277cccbd194b9
3809cf83b36ac6b2f21dc1b73e22d2e594acf734d71e348dbd7f66ea38bfc658
3d1833e56f85cb5da7f97d9b6742dd183fbf68ea61c8a4b4baca4374a07bb264
4519a61d26f153bd19bda2ffdca5d102c56d61f6f5ef6f29727ca878f6ea1947
4c79606528eab7b89d35276752f1b2a53b970790b8855f644ae3d8adb8aad7da
64d26b13235eb023ef3168e1f331a409e5c37fe8914f678ce13ca142fdfe2dfa
780b98a3861aa8d4afe428953ad3b9e988a74cd5f064b4a1eb453f5d901221e7
7926323a712a1fa861283bbdbde6f6df758e3a39c418fe1459f2b5dbe18102be
7b1acbecc92198d28a194bab0fa46dd84878d9cb78f3e2bbbd4ba771ef168ebd
7bfab3d904c5effc47fe1577c20615a1efcf84f2a6e1b8e5ccaa501ac657fcab
86c5f9147fefd3a21470c9d79755037b3b3d28ba4110e820cfe1ee4b803e7feb
87c33e7fd82ad1d9ccdf87d2bae750853883635723d5c3b27adccccd54493a3a
8dc5436dce4423f0e53e85904b6dc0552c1c8bbde0dd4ec1c929a1c272201c4c
8dd5481f66610c830acc8ed072d8b7bfe7ddc27dc3d58c6651112d79b3c2f670
8e484163d648d7a53f20bc673aeab303c13d0b4b7c704501e72fbdbd979a8faa
96c235d6343aaa272187a96413ebbd8fa15417c7591c02cf0d79fee2e03dfbbe
a3c29f410134247964a2c1c60db95b81f6e7925a0d1ab0063841b5bb0b18a553
ab15ef84ab70a529be42cd80dcf9655f320ad4eaedb6e85a5feccf8755007431
aee5245049750ff1e0f9368e3f69e0804e637539bb95c22db5325f884fbe5e9e
b4e93c9fa44c1184b7d30d13a312489e5e820c1d88af5ad56e655f97b6aae5b5
c550a26340fc6971f4767d351ae9c987603d3f5cf3cb18e91e3164d5fdca8be5
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
d6e3a5a263a697df3e5989b893e27ac29972dd9346b01da3e5476becb9a73a25
d6f9a6d48f3d43b2f7004bb3f1bea032abe36c545087c45907bf36f6d1949bc6
d90224cd9ba0d138e7ba721d12b39e5e680999b2a1b246691542b195514e91ad
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ea4b20ddecd76a86c3dc31d488970cf15e6284756c271b1d983f597652ebeb61
eb38bf6136b9b597e78c4a80f041d4e3bbc9231b348e999ba5aa1e52ec2bbd0f