verify-wellsfargoonline.com Open in urlscan Pro
185.156.72.17  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response verify-wellsfargoonline.com/	67 KB 11 KB	427ms 306ms	Document text/html	185.156.72.17 VAIZ-AS ITBks892
General Check archive.org Show headers Download Go to Full URL http://verify-wellsfargoonline.com/ Protocol HTTP/1.1 Server 185.156.72.17 , Russian Federation, ASN61432 (VAIZ-AS ITBks892, UA), Reverse DNS Software LiteSpeed / Resource Hash 57c11535fa294271d0472cc1bee66e52ccfa723950669e5b4dfbaef547f7112e Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Connection Keep-Alive Keep-Alive timeout=5, max=100 cache-control no-store, no-cache, must-revalidate content-encoding gzip content-length 10453 content-type text/html; charset=UTF-8 date Sat, 25 Feb 2023 02:41:26 GMT expires Thu, 19 Nov 1981 08:52:00 GMT pragma no-cache server LiteSpeed vary Accept-Encoding
GET H/1.1	200 OK	index.css verify-wellsfargoonline.com/wfu_assetz/css/	32 KB 6 KB	58ms 58ms	Stylesheet text/css	185.156.72.17 VAIZ-AS ITBks892
General Check archive.org Show headers Download Go to Full URL http://verify-wellsfargoonline.com/wfu_assetz/css/index.css Requested by Host: verify-wellsfargoonline.com URL: http://verify-wellsfargoonline.com/ Protocol HTTP/1.1 Server 185.156.72.17 , Russian Federation, ASN61432 (VAIZ-AS ITBks892, UA), Reverse DNS Software LiteSpeed / Resource Hash 5160865ea1d4198101e9c07c7bfb2171d6ce2fb47d53e05597113d3f268b8c20 Request headers accept-language de-DE,de;q=0.9 Referer http://verify-wellsfargoonline.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Sat, 25 Feb 2023 02:41:26 GMT content-encoding gzip last-modified Sat, 15 Oct 2022 07:02:30 GMT server LiteSpeed vary Accept-Encoding content-type text/css cache-control public, max-age=604800 Connection Keep-Alive accept-ranges bytes Keep-Alive timeout=5, max=100 content-length 5325 expires Sat, 04 Mar 2023 02:41:26 GMT
GET H/1.1	200 OK	COB-BOB-IRT-enroll_balloons.jpg verify-wellsfargoonline.com/wfu_assetz/img/	611 KB 611 KB	130ms 57ms	Image image/jpeg	185.156.72.17 VAIZ-AS ITBks892
General Check archive.org Show headers Download Go to Show image Full URL http://verify-wellsfargoonline.com/wfu_assetz/img/COB-BOB-IRT-enroll_balloons.jpg Requested by Host: verify-wellsfargoonline.com URL: http://verify-wellsfargoonline.com/ Protocol HTTP/1.1 Server 185.156.72.17 , Russian Federation, ASN61432 (VAIZ-AS ITBks892, UA), Reverse DNS Software LiteSpeed / Resource Hash b8325d272c72a041414d9fb349e9d4bca5e7fc8ad66f47a719e491960afa5683 Request headers accept-language de-DE,de;q=0.9 Referer http://verify-wellsfargoonline.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Sat, 25 Feb 2023 02:41:26 GMT last-modified Fri, 14 Oct 2022 18:46:50 GMT server LiteSpeed content-type image/jpeg cache-control public, max-age=604800 Connection Keep-Alive accept-ranges bytes Keep-Alive timeout=5, max=100 content-length 625433 expires Sat, 04 Mar 2023 02:41:26 GMT
GET H/1.1	200 OK	jquery.js Show response verify-wellsfargoonline.com/wfu_assetz/js/	87 KB 31 KB	103ms 58ms	Script application/javascript	185.156.72.17 VAIZ-AS ITBks892
General Check archive.org Show headers Download Go to Full URL http://verify-wellsfargoonline.com/wfu_assetz/js/jquery.js Requested by Host: verify-wellsfargoonline.com URL: http://verify-wellsfargoonline.com/ Protocol HTTP/1.1 Server 185.156.72.17 , Russian Federation, ASN61432 (VAIZ-AS ITBks892, UA), Reverse DNS Software LiteSpeed / Resource Hash ce9d07500ad91ec2b524c270764ec4c9a33e78320d8d374ec400ede488f6251b Request headers accept-language de-DE,de;q=0.9 Referer http://verify-wellsfargoonline.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Sat, 25 Feb 2023 02:41:26 GMT content-encoding gzip last-modified Tue, 04 Oct 2022 17:39:54 GMT server LiteSpeed vary Accept-Encoding content-type application/javascript cache-control public, max-age=604800 Connection Keep-Alive accept-ranges bytes Keep-Alive timeout=5, max=100 content-length 30972 expires Sat, 04 Mar 2023 02:41:26 GMT
GET H/1.1	200 OK	misc.js Show response verify-wellsfargoonline.com/wfu_assetz/js/	16 KB 6 KB	107ms 62ms	Script application/javascript	185.156.72.17 VAIZ-AS ITBks892
General Check archive.org Show headers Download Go to Full URL http://verify-wellsfargoonline.com/wfu_assetz/js/misc.js Requested by Host: verify-wellsfargoonline.com URL: http://verify-wellsfargoonline.com/ Protocol HTTP/1.1 Server 185.156.72.17 , Russian Federation, ASN61432 (VAIZ-AS ITBks892, UA), Reverse DNS Software LiteSpeed / Resource Hash 475575a56670c4ab3f05ca4b001674bbea9e6cbacaf9e0c0f2527a1aacdb9731 Request headers accept-language de-DE,de;q=0.9 Referer http://verify-wellsfargoonline.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Sat, 25 Feb 2023 02:41:26 GMT content-encoding gzip last-modified Tue, 04 Oct 2022 17:39:54 GMT server LiteSpeed vary Accept-Encoding content-type application/javascript cache-control public, max-age=604800 Connection Keep-Alive accept-ranges bytes Keep-Alive timeout=5, max=100 content-length 5712 expires Sat, 04 Mar 2023 02:41:26 GMT
GET H2	200	wellsfargosans-rg.woff2 www15.wellsfargomedia.com/wfui/css/fonts/	22 KB 22 KB	174ms 41ms	Font font/woff2	104.76.144.209 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://www15.wellsfargomedia.com/wfui/css/fonts/wellsfargosans-rg.woff2 Requested by Host: verify-wellsfargoonline.com URL: http://verify-wellsfargoonline.com/wfu_assetz/css/index.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.76.144.209 Vienna, Austria, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-76-144-209.deploy.static.akamaitechnologies.com Software / Resource Hash 631f3b6267a831a8d67c45e480b5d5a2601f10ff8708bcf3a45a41b377a129cc Request headers Referer http://verify-wellsfargoonline.com/ Origin http://verify-wellsfargoonline.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Sat, 25 Feb 2023 02:41:26 GMT last-modified Tue, 26 Feb 2019 19:38:34 GMT etag "5c7595ba-5798" content-type font/woff2 access-control-allow-origin * cache-control max-age=31536000 accept-ranges bytes content-length 22424 expires Sun, 25 Feb 2024 02:41:26 GMT
GET H2	200	wellsfargoserif-rg.woff2 www15.wellsfargomedia.com/wfui/css/fonts/	26 KB 26 KB	230ms 98ms	Font font/woff2	104.76.144.209 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://www15.wellsfargomedia.com/wfui/css/fonts/wellsfargoserif-rg.woff2 Requested by Host: verify-wellsfargoonline.com URL: http://verify-wellsfargoonline.com/wfu_assetz/css/index.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.76.144.209 Vienna, Austria, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-76-144-209.deploy.static.akamaitechnologies.com Software / Resource Hash aeb7b3bfc4281d35b02dfde05ac7a6c0d3daa7f3123b35a9cbd4b5a8e3f3c310 Request headers Referer http://verify-wellsfargoonline.com/ Origin http://verify-wellsfargoonline.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Sat, 25 Feb 2023 02:41:26 GMT last-modified Mon, 11 Mar 2019 20:52:01 GMT etag "5c86ca71-6854" content-type font/woff2 access-control-allow-origin * cache-control max-age=31536000 accept-ranges bytes content-length 26708 expires Sun, 25 Feb 2024 02:41:26 GMT
GET H2	200	wellsfargosans-sbd.woff2 www15.wellsfargomedia.com/wfui/css/fonts/	22 KB 22 KB	216ms 84ms	Font font/woff2	104.76.144.209 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://www15.wellsfargomedia.com/wfui/css/fonts/wellsfargosans-sbd.woff2 Requested by Host: verify-wellsfargoonline.com URL: http://verify-wellsfargoonline.com/wfu_assetz/css/index.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.76.144.209 Vienna, Austria, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-76-144-209.deploy.static.akamaitechnologies.com Software / Resource Hash ab9d8c97b35ed86b6224aca911aa304a0d7dbcbd28e00a4c6585b96e28ed30ba Request headers Referer http://verify-wellsfargoonline.com/ Origin http://verify-wellsfargoonline.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Sat, 25 Feb 2023 02:41:26 GMT last-modified Tue, 26 Feb 2019 19:38:34 GMT etag "5c7595ba-5848" content-type font/woff2 access-control-allow-origin * cache-control max-age=31536000 accept-ranges bytes content-length 22600 expires Sun, 25 Feb 2024 02:41:26 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Wells Fargo (Banking)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless function| $ function| jQuery object| $jscomp

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			verify-wellsfargoonline.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 8ebe608325082543825ad5f9277f172f

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

verify-wellsfargoonline.com
www15.wellsfargomedia.com
104.76.144.209
185.156.72.17
475575a56670c4ab3f05ca4b001674bbea9e6cbacaf9e0c0f2527a1aacdb9731
5160865ea1d4198101e9c07c7bfb2171d6ce2fb47d53e05597113d3f268b8c20
57c11535fa294271d0472cc1bee66e52ccfa723950669e5b4dfbaef547f7112e
631f3b6267a831a8d67c45e480b5d5a2601f10ff8708bcf3a45a41b377a129cc
ab9d8c97b35ed86b6224aca911aa304a0d7dbcbd28e00a4c6585b96e28ed30ba
aeb7b3bfc4281d35b02dfde05ac7a6c0d3daa7f3123b35a9cbd4b5a8e3f3c310
b8325d272c72a041414d9fb349e9d4bca5e7fc8ad66f47a719e491960afa5683
ce9d07500ad91ec2b524c270764ec4c9a33e78320d8d374ec400ede488f6251b