wellsfargo.com.ea81.vip
Open in
urlscan Pro
74.48.73.18
Public Scan
URL:
https://wellsfargo.com.ea81.vip/
Submission Tags: @ecarlesi threat phishing wellsfargo Search All
Submission: On January 20 via api from IT — Scanned from IT
Submission Tags: @ecarlesi threat phishing wellsfargo Search All
Submission: On January 20 via api from IT — Scanned from IT
Summary
This website contacted 4 IPs
in 2 countries
across 4 domains to perform 10 HTTP transactions.
The main IP is 74.48.73.18, located in
Los Angeles, United States and
belongs to MULTA-ASN1, US.
The main domain is wellsfargo.com.ea81.vip.
TLS certificate: Issued by R3 on January 19th 2024. Valid for: 3 months.
This is the only time wellsfargo.com.ea81.vip was scanned on urlscan.io!
TLS certificate: Issued by R3 on January 19th 2024. Valid for: 3 months.
This is the only time wellsfargo.com.ea81.vip was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 5 | 74.48.73.18 74.48.73.18 | 35916 (MULTA-ASN1) (MULTA-ASN1) | |
| 2 | 23.94.158.119 23.94.158.119 | 36352 (AS-COLOCR...) (AS-COLOCROSSING) | |
| 1 | 104.18.26.170 104.18.26.170 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
| 10 | 4 |
5
74.48.73.18
(Los Angeles, United States)
ASN35916 (MULTA-ASN1, US)
PTR: panhattack.com
ASN35916 (MULTA-ASN1, US)
PTR: panhattack.com
| wellsfargo.com.ea81.vip |
2
23.94.158.119
(United States)
ASN36352 (AS-COLOCROSSING, CA)
PTR: 23-94-158-119-host.colocrossing.com
ASN36352 (AS-COLOCROSSING, CA)
PTR: 23-94-158-119-host.colocrossing.com
| usps.com.lzn22.vip |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 5 |
ea81.vip
wellsfargo.com.ea81.vip |
150 KB |
| 2 |
lzn22.vip
usps.com.lzn22.vip |
4 KB |
| 1 |
ipregistry.co
api.ipregistry.co — Cisco Umbrella Rank: 142954 |
2 KB |
| 0 |
Failed
function sub() { [native code] }. Failed |
|
| 10 | 4 |
| Domain | Requested by | |
|---|---|---|
| 5 | wellsfargo.com.ea81.vip |
wellsfargo.com.ea81.vip
|
| 2 | usps.com.lzn22.vip |
wellsfargo.com.ea81.vip
|
| 1 | api.ipregistry.co |
wellsfargo.com.ea81.vip
|
| 0 | localhost Failed |
wellsfargo.com.ea81.vip
|
| 10 | 4 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| wellsfargo.com.ea81.vip R3 |
2024-01-19 - 2024-04-18 |
3 months | crt.sh |
| usps.com.lzn22.vip R3 |
2023-12-05 - 2024-03-04 |
3 months | crt.sh |
| ipregistry.co Cloudflare Inc ECC CA-3 |
2023-10-03 - 2024-10-02 |
a year | crt.sh |
This page contains 1 frames:
Frame:
https://localhost/
Frame ID: 29824EC3C50935164298E73B21ABD1E9
Requests: 10 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
10 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
/
wellsfargo.com.ea81.vip/ |
9 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery-3.6.0.min.js
wellsfargo.com.ea81.vip/static/lib/jquery/ |
87 KB 34 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
vue.js
wellsfargo.com.ea81.vip/static/lib/vue/ |
336 KB 105 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
axios.min.js
wellsfargo.com.ea81.vip/static/lib/axios/ |
20 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
config.js
wellsfargo.com.ea81.vip/static/ |
95 B 307 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
getRuleList
usps.com.lzn22.vip/qyhldbe6/general.Config/ |
3 KB 3 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
/
api.ipregistry.co/ |
2 KB 2 KB |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
checkIp
usps.com.lzn22.vip/qyhldbe6/Card/ |
55 B 543 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
/
localhost/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
/
localhost/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- localhost
- URL
- https://localhost/
- Domain
- localhost
- URL
- https://localhost/
Verdicts & Comments Add Verdict or Comment
0 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
| Header | Value |
|---|---|
| Strict-Transport-Security | max-age=31536000 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
api.ipregistry.co
localhost
usps.com.lzn22.vip
wellsfargo.com.ea81.vip
localhost
104.18.26.170
23.94.158.119
74.48.73.18
2f40d73861508f23a495cb4749774978cc731cf59e415cf854847dccc9efdb99
69b75483b270421e1a89426dd59387ba090772313561c3e9fa415396a78e8936
90bc0e85063c6a3986a3c25c56d76431bcf6db95a278c01efc1746618e39a427
e373b70a5167485c73a265421bcfcd1fdddbae49c9c51605e6d2918a3de4ae0d
e79e50075176e33a566578b018de0c9559aae1acae2daee40be795a1ff61db15
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e