report.ng
Open in
urlscan Pro
199.201.110.194
Malicious Activity!
Public Scan
Submission: On July 14 via automatic, source openphish
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on July 13th 2018. Valid for: 3 months.
This is the only time report.ng was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Wells Fargo (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
8 | 199.201.110.194 199.201.110.194 | 22612 (NAMECHEAP...) (NAMECHEAP-NET - Namecheap) | |
5 | 159.45.170.156 159.45.170.156 | 10837 (WELLSFARG...) (WELLSFARGO-10837 - Wells Fargo & Company) | |
3 | 159.45.2.177 159.45.2.177 | 10837 (WELLSFARG...) (WELLSFARGO-10837 - Wells Fargo & Company) | |
5 | 2400:cb00:204... 2400:cb00:2048:1::6813:c797 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
2 | 159.45.170.178 159.45.170.178 | 10837 (WELLSFARG...) (WELLSFARGO-10837 - Wells Fargo & Company) | |
23 | 6 |
ASN22612 (NAMECHEAP-NET - Namecheap, Inc., US)
PTR: nc-ph-1916-75.web-hosting.com
report.ng |
ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US)
connect.secure.wellsfargo.com |
ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US)
apply.wellsfargo.com |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
cdnjs.cloudflare.com |
ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US)
static.wellsfargo.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
wellsfargo.com
connect.secure.wellsfargo.com apply.wellsfargo.com static.wellsfargo.com |
321 KB |
8 |
report.ng
report.ng |
17 KB |
5 |
cloudflare.com
cdnjs.cloudflare.com |
107 KB |
23 | 3 |
Domain | Requested by | |
---|---|---|
8 | report.ng |
report.ng
|
5 | cdnjs.cloudflare.com |
report.ng
|
5 | connect.secure.wellsfargo.com |
report.ng
connect.secure.wellsfargo.com |
3 | apply.wellsfargo.com |
report.ng
|
2 | static.wellsfargo.com |
report.ng
|
23 | 5 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.wellsfargo.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
report.ng Let's Encrypt Authority X3 |
2018-07-13 - 2018-10-11 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://report.ng/home/wfverify/infoupdate/.com/auth/login/present/details.html?a648916c6a7b1504ef097584bf37a316-a648916c6a7b1504ef097584bf37a316-a648916c6a7b1504ef097584bf37a316a648916c6a7b1504ef097584bf37a316a648916c6a7b1504ef097584bf37a316a648916c6a7b1504ef097584bf37a316a648916c6a7b1504ef097584bf37a316a648916c6a7b1504ef097584bf37a316a648916c6a7b1504ef097584bf37a316a648916c6a7b1504ef097584bf37a316a648916c6a7b1504ef097584bf37a316
Frame ID: 3702FB78ECCB960DCD22BCC205C1F445
Requests: 25 HTTP requests in this frame
Screenshot
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
Typekit (Font Scripts) Expand
Detected patterns
- env /^Typekit$/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery.*\.js/i
- env /^jQuery$/i
Page Statistics
3 Outgoing links
These are links going to different origins than the main page.
Title:
Search URL Search Domain Scan URL
Title: Privacy, Cookies, Security & Legal
Search URL Search Domain Scan URL
Title: Ad Choices
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
23 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
details.html
report.ng/home/wfverify/infoupdate/.com/auth/login/present/ |
17 KB 17 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login-userprefs.min.js
connect.secure.wellsfargo.com/auth/static/prefs/ |
133 KB 55 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
desktop-tablet.combined.css
apply.wellsfargo.com/css/ |
177 KB 177 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
jquery.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.0.0-beta1/ |
256 KB 78 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
jquery.validate.js
cdnjs.cloudflare.com/ajax/libs/jquery-validate/1.15.0/ |
45 KB 12 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
additional-methods.js
cdnjs.cloudflare.com/ajax/libs/jquery-validate/1.15.0/ |
38 KB 11 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
jquery.maskedinput.js
cdnjs.cloudflare.com/ajax/libs/jquery.maskedinput/1.4.1/ |
10 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
jquery.payment.js
cdnjs.cloudflare.com/ajax/libs/jquery.payment/1.3.2/ |
17 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
myriad-font.js
apply.wellsfargo.com/javascript/ |
17 KB 17 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
utag.sync.js
static.wellsfargo.com/tracking/main/ |
19 KB 8 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.combined.js
report.ng/javascript/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
desktop-tablet.combined.js
report.ng/javascript/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login.js
report.ng/javascript/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
conutils-6.2.2.js
connect.secure.wellsfargo.com/auth/static/scripts/ |
10 KB 4 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
atadun.js
connect.secure.wellsfargo.com/auth/static/prefs/ |
1 KB 1 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
archer.css
apply.wellsfargo.com/css/ |
22 KB 22 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
5 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headersResponse headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headersResponse headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.combined.js
report.ng/javascript/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
nd
connect.secure.wellsfargo.com/jenny/ |
40 KB 14 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
connect.secure.wellsfargo.com/ATADUN/2.2/w/w-642409/init/js/ |
482 B 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
desktop-tablet.combined.js
report.ng/javascript/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
utag.js
static.wellsfargo.com/tracking/main/ |
140 KB 20 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
proactive-chat.js
report.ng/javascript/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login.js
report.ng/javascript/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Wells Fargo (Banking)133 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
string| USERPREFS_PATH string| UPRESOURCE_PATH string| ATADUN_PATH string| loginUrlBase object| scriptParent function| disableSubmitsCollectUserPrefs function| addLoginFormFieldsAndSubmit function| jsEnabled function| addEvent object| UserPrefsHelper object| collector function| loadUserPrefs function| submitUserPrefs function| getUserPrefsOnPageLoad function| undoSaveUsername function| maskedUsernameChanged function| addScriptElement object| bundle function| $ function| jQuery object| Typekit undefined| TNL function| testandlearn undefined| CryptoJS boolean| m object| q object| options object| lun3 string| ndURI boolean| isNative object| ndsapi object| nds object| js object| fjs function| ndoGetObjectKeys string| ndjsStaticVersion object| nslsbeukrb object| nsfvxlqmlr boolean| nsoqm number| nslsb number| nslsbeu object| nsnbwwbub object| nsnbww object| nsfvxl object| nsfvxlqm object| nsoqmleto object| nscfqdo boolean| nsrhgkmu string| nscfqdoeds string| nstjtin number| numQueries object| returned string| version string| nsrhgkm string| nsoqmle string| nscfqdoe string| nscfqdoed string| nsoqmlet string| nsrhgkmuia string| nslmz object| nslsbeukr object| nsrhg function| nsfvxlqml function| nsnbwwbu function| nstjtinmzx boolean| nslmzlpzap object| nstjt function| nstjtinmz function| ndwti function| nsnbwwbubw function| nslmzlpz function| nsnbwwb function| nsnbw function| nstjti function| nslsbeuk function| ndwts function| nsoqml function| nscfqd function| nsrhgkmui function| nslmzlpza function| nslmzl function| nscfq function| nsfvxlq function| nslsbe function| nslmzlp function| nstjtinm function| nsrhgk function| nsfvx function| nsoqmletop function| nsrywtxxy function| nsrdxxhob function| HashUtil function| nshpb function| nsbfudtsn function| nsbfudts function| nsbfudt function| nskfqt function| nslumgx function| nslkm function| nslumgxr function| nslumgxrpz function| nskfqtbxh function| nshpbeyag function| nsrywtxx function| nsqjxt boolean| egainAuth string| proactiveChatWebServer string| clickChat string| fieldname_2 string| fieldname_3 string| fieldname_4 string| fieldname_6 string| fieldname_7 string| fieldname_8 string| fieldname_9 string| fieldname_10 string| fieldname_11 string| fieldname_12 string| fieldname_13 string| fieldname_14 string| fieldname_15 string| fieldname_19 boolean| authenticationRequired string| flowExeUrl boolean| authenticated boolean| utag_condload undefined| new_path undefined| utag_cfg_ovrd object| utag_data undefined| userAgentArr object| utag function| utag_pad function| utag_visitor_id0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
apply.wellsfargo.com
cdnjs.cloudflare.com
connect.secure.wellsfargo.com
report.ng
static.wellsfargo.com
159.45.170.156
159.45.170.178
159.45.2.177
199.201.110.194
2400:cb00:2048:1::6813:c797
1960b96e1f74c500980a34e61605f6c438d1081d35806bf70121bff8c1b82650
198506f95f9c0cf3a670f82ea63f9a560bd6ff9a17c153ad4ac5d8777e0fda21
1a93301260b9caf184badb78bde86c2b9c149226757082f20632b4d97e22108a
266a8a7b5c0ebad26e3ba4e21d78b1999b1f7ea893b41a8d6346d48606321ccf
2bc06c9a6e73540eeea744621c94d7dc1b87a987f410875021839fa09cf613ae
3ad944527d89cfebaa390187d7106e9dfb49d8cc07648e4888ce43b8e8e4303c
3e8ea6ff9a83a3978a310e89a8c6c5ef5d945eb7ae475ea4aa78ce6922f9492b
484193e72f648576cf8c77061144b0cf8c8ed8acbe95328b2e36b38f1d1d71fb
524334591f0a303f83bca01c7c38da4147eb139c098aeff6fe0e393cca06630c
60499c4335239d51fa6ef40bd909ba8e62a2a468b16b74f0fd9fadac1eee4bbf
6db68ef3cdd3ec3d31409f8abb5cc4e517c10c5e986323be13f8fff7ead1cf1c
78f27c3d7cb5d766466703adc7f7ad7706b7fb05514eec39be0aa253449bd0f8
7ef14a1e070a6a2ec9ff44ccf5e923cb2a460c5861a3db8a9ae1e21557d27020
813cbe42d3c6328a00994409cdb780b27a0871cdbdabd78d74c3cdec6c3e57ab
96b88292dd9bd8d23dee232fed356de71e9a81ea9062c2e7d9beff0f30dbb5d7
9d6d810b425482c52769515f91250eb85bf4da9fc4294c8ab5a8845c78330127
d030f6633a5d0efd3f76fcf5ec98a0468c76770e618a401ffe5ddc7f6ccc844b
d617332408652c764ece833cae43811f40fd5229743f1991813f0fdb7e1184db