appbox99.com
Open in
urlscan Pro
192.185.79.206
Malicious Activity!
Public Scan
URL:
https://appbox99.com/aaaaaaa/well-fargo-fullz/card.html
Submission: On January 13 via automatic, source openphish — Scanned from DE
Submission: On January 13 via automatic, source openphish — Scanned from DE
Summary
This website contacted 3 IPs
in 2 countries
across 2 domains to perform 9 HTTP transactions.
The main IP is 192.185.79.206, located in
United States and
belongs to UNIFIEDLAYER-AS-1, US.
The main domain is appbox99.com.
TLS certificate: Issued by R3 on December 4th 2021. Valid for: 3 months.
This is the only time appbox99.com was scanned on urlscan.io!
TLS certificate: Issued by R3 on December 4th 2021. Valid for: 3 months.
This is the only time appbox99.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Wells Fargo (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 7 | 192.185.79.206 192.185.79.206 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
| 2 | 104.90.132.220 104.90.132.220 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
| 9 | 3 |
7
192.185.79.206
(United States)
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 192-185-79-206.unifiedlayer.com
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 192-185-79-206.unifiedlayer.com
| appbox99.com |
2
104.90.132.220
(Frankfurt am Main, Germany)
ASN16625 (AKAMAI-AS, US)
PTR: a104-90-132-220.deploy.static.akamaitechnologies.com
ASN16625 (AKAMAI-AS, US)
PTR: a104-90-132-220.deploy.static.akamaitechnologies.com
| www15.wellsfargomedia.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 7 |
appbox99.com
appbox99.com |
255 KB |
| 2 |
wellsfargomedia.com
www15.wellsfargomedia.com — Cisco Umbrella Rank: 19526 |
45 KB |
| 9 | 2 |
| Domain | Requested by | |
|---|---|---|
| 7 | appbox99.com |
appbox99.com
|
| 2 | www15.wellsfargomedia.com |
appbox99.com
|
| 9 | 2 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| appbox99.com R3 |
2021-12-04 - 2022-03-04 |
3 months | crt.sh |
| www15.wellsfargomedia.com DigiCert SHA2 Secure Server CA |
2021-02-22 - 2022-02-28 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://appbox99.com/aaaaaaa/well-fargo-fullz/card.html
Frame ID: 38B43735968A33FB894948AB29AA392E
Requests: 14 HTTP requests in this frame
Screenshot
Page Title
Sign On to View Your Personal Accounts | Wells FargoPage Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
9 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
card.html
appbox99.com/aaaaaaa/well-fargo-fullz/ |
30 KB 16 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
global.css
appbox99.com/aaaaaaa/well-fargo-fullz/css/ |
20 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
enhanced-header.css
appbox99.com/aaaaaaa/well-fargo-fullz/css/ |
4 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
wf-fonts.css
appbox99.com/aaaaaaa/well-fargo-fullz/css/ |
4 KB 434 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
content.css
appbox99.com/aaaaaaa/well-fargo-fullz/css/ |
1 KB 692 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
enhanced-footer.css
appbox99.com/aaaaaaa/well-fargo-fullz/css/ |
3 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
WF_stagecoach_rgb_ylw_F1.svg
appbox99.com/aaaaaaa/well-fargo-fullz/images/ |
226 KB 228 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
6 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
467 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
wellsfargosans-rg.woff2
www15.wellsfargomedia.com/wfui/css/fonts/ |
22 KB 22 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
wellsfargosans-sbd.woff2
www15.wellsfargomedia.com/wfui/css/fonts/ |
22 KB 22 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Wells Fargo (Banking)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onsecuritypolicyviolation object| onslotchange0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
appbox99.com
www15.wellsfargomedia.com
104.90.132.220
192.185.79.206
29a62821c3d407913d603602dfe9d23eacded368f22d39c4ff58124a08ef1d56
3a80ebe861b93c47265b21bc70a9fa88fc95e76f39cb291ad05b24597446ef8e
5145f5faf6c1269bdd974357ed344b9cd5f4e4cea424c14dd302a9c11a206741
631f3b6267a831a8d67c45e480b5d5a2601f10ff8708bcf3a45a41b377a129cc
7771de27489be5e0c7b06e07de4f30f7d4cfb7bb7e88dc93d792e19f89693ca3
8dbca82c7c6b96415fee4d0e7fdddaed8042de685bf3c5d087c3f67f41866668
9843ab395fb4cf414353b03927156a9d38c3cc3157469afd9ee97f2058445e39
ab9d8c97b35ed86b6224aca911aa304a0d7dbcbd28e00a4c6585b96e28ed30ba
b319b049366dde73690990738ac5af4fb9937d18abac85b01aaff185b5262868
d7bc2f4db871d09a6c2640c4caf8d13e69ddf3f481ad9bf199113cb1dc905301
d8401dffb0fbd458ce8332222f9a1d3431bcba86f9401debf60e7783242d4150
df500743bbedcef7623fdf2ef0c05ca411437c6216674271f4cc8b32f910f96d
ed6ee05587907928e253a6176cf2e50ae1653f3f255bb1f95e8fe7a0946d2bcb
f8cb039a63b11f207edf324bbfdabbbfaa2d421729785dca77020490c293185e