www.verify-account6547.ns02.info Open in urlscan Pro
3.82.127.17 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.verify-account6547.ns02.info/
Effective URL:
https://www.verify-account6547.ns02.info/Login/?token=
Submission: On December 25 via automatic, source certstream-suspicious (December 25th 2021, 3:31:15 pm UTC) — Scanned from DE

Summary HTTP 10 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 10 HTTP transactions. The main IP is 3.82.127.17, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is www.verify-account6547.ns02.info.
TLS certificate: Issued by cPanel, Inc. Certification Authority on December 25th 2021. Valid for: 3 months.

This is the only time www.verify-account6547.ns02.info was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Wells Fargo (Banking)

Domain & IP information

	IP Address		AS Autonomous System
10	3.82.127.17 3.82.127.17		14618 (AMAZON-AES) (AMAZON-AES)
10	1

10 3.82.127.17 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-82-127-17.compute-1.amazonaws.com

www.verify-account6547.ns02.info	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	ns02.info www.verify-account6547.ns02.info	312 KB
10	1

	Domain	Requested by
10	www.verify-account6547.ns02.info	www.verify-account6547.ns02.info
10	1

This site contains no links.

Subject Issuer	Validity	Valid
verify-account6547.ns02.info cPanel, Inc. Certification Authority	`2021-12-25` - `2022-03-25`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.verify-account6547.ns02.info/Login/?token=
Frame ID: B02807CEC524C85F346598E38CEE675C
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign On to View Your Personal Accounts | Wells Fargo

Page URL History Show full URLs

https://www.verify-account6547.ns02.info/ Page URL
https://www.verify-account6547.ns02.info/Login/?token= Page URL

Page Statistics

10
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

312 kB
Transfer

310 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.verify-account6547.ns02.info/ Page URL
https://www.verify-account6547.ns02.info/Login/?token= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	/ Show response www.verify-account6547.ns02.info/	4 KB 4 KB	600ms 361ms	Document text/html	3.82.127.17 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://www.verify-account6547.ns02.info/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 3.82.127.17 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-82-127-17.compute-1.amazonaws.com Software Apache / Resource Hash `ad100977c97c15d514f9e65f0226a773536d876c9feebec82f498ca7157d5830` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers Date Sat, 25 Dec 2021 15:31:11 GMT Server Apache Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate Pragma no-cache Keep-Alive timeout=5, max=100 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	cf.css www.verify-account6547.ns02.info/Export/css/	2 KB 2 KB	90ms 90ms	Stylesheet text/css	3.82.127.17 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://www.verify-account6547.ns02.info/Export/css/cf.css Requested by Host: www.verify-account6547.ns02.info URL: https://www.verify-account6547.ns02.info/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 3.82.127.17 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-82-127-17.compute-1.amazonaws.com Software Apache / Resource Hash `6026255cc26e031389358227ccd1b7de6cba842c3978f9144d31cb30032276ef` Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.verify-account6547.ns02.info/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Sat, 25 Dec 2021 15:31:11 GMT Last-Modified Fri, 23 Apr 2021 14:51:46 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 1751
GET H/1.1	200 OK	Primary Request / Show response www.verify-account6547.ns02.info/Login/	56 KB 56 KB	94ms 93ms	Document text/html	3.82.127.17 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://www.verify-account6547.ns02.info/Login/?token= Requested by Host: www.verify-account6547.ns02.info URL: https://www.verify-account6547.ns02.info/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 3.82.127.17 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-82-127-17.compute-1.amazonaws.com Software Apache / Resource Hash `479606a2a06de5a4dd8b3df3713dafa70d13aa0cd8c9c547ee6824f768306769` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://www.verify-account6547.ns02.info/ Response headers Date Sat, 25 Dec 2021 15:31:13 GMT Server Apache Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate Pragma no-cache Keep-Alive timeout=5, max=98 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	wfui.css www.verify-account6547.ns02.info/Export/css/	140 KB 140 KB	242ms 91ms	Stylesheet text/css	3.82.127.17 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://www.verify-account6547.ns02.info/Export/css/wfui.css Requested by Host: www.verify-account6547.ns02.info URL: https://www.verify-account6547.ns02.info/Login/?token= Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 3.82.127.17 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-82-127-17.compute-1.amazonaws.com Software Apache / Resource Hash `8396ea7e71e3b1408f7e3516f9244622716733bb73cf1a9a5429523411e7e448` Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.verify-account6547.ns02.info/Login/?token= User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Sat, 25 Dec 2021 15:31:13 GMT Last-Modified Fri, 23 Apr 2021 19:19:52 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 143571
GET H/1.1	200 OK	main.css www.verify-account6547.ns02.info/Export/css/	22 KB 22 KB	299ms 100ms	Stylesheet text/css	3.82.127.17 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://www.verify-account6547.ns02.info/Export/css/main.css Requested by Host: www.verify-account6547.ns02.info URL: https://www.verify-account6547.ns02.info/Login/?token= Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 3.82.127.17 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-82-127-17.compute-1.amazonaws.com Software Apache / Resource Hash `fd645a5b7a97d4d4b4d04ac8f17b8ea5bf14d333e510cc7c69b8be0f5fd8b4f5` Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.verify-account6547.ns02.info/Login/?token= User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Sat, 25 Dec 2021 15:31:13 GMT Last-Modified Fri, 23 Apr 2021 14:56:50 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 22628
GET H/1.1	200 OK	/ www.verify-account6547.ns02.info/Export/img/	3 KB 3 KB	304ms 104ms	Image text/html	3.82.127.17 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://www.verify-account6547.ns02.info/Export/img/ Requested by Host: www.verify-account6547.ns02.info URL: https://www.verify-account6547.ns02.info/Login/?token= Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 3.82.127.17 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-82-127-17.compute-1.amazonaws.com Software Apache / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.verify-account6547.ns02.info/Login/?token= User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Sat, 25 Dec 2021 15:31:13 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=100 Content-Length 2981 Content-Type text/html;charset=ISO-8859-1
GET H/1.1	200 OK	index.js Show response www.verify-account6547.ns02.info/Export/js/	13 KB 13 KB	150ms 100ms	Script application/javascript	3.82.127.17 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://www.verify-account6547.ns02.info/Export/js/index.js Requested by Host: www.verify-account6547.ns02.info URL: https://www.verify-account6547.ns02.info/Login/?token= Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 3.82.127.17 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-82-127-17.compute-1.amazonaws.com Software Apache / Resource Hash `a810a4b0e255909c9a3fd9524c1c9a89b215b1f42e1c7cc40776826c31e1fda2` Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.verify-account6547.ns02.info/Login/?token= User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Sat, 25 Dec 2021 15:31:13 GMT Last-Modified Sat, 24 Apr 2021 13:12:44 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 13499
GET H/1.1	200 OK	wellsfargosans-rg.woff2 www.verify-account6547.ns02.info/Export/fonts/	22 KB 22 KB	91ms 91ms	Font font/woff2	3.82.127.17 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://www.verify-account6547.ns02.info/Export/fonts/wellsfargosans-rg.woff2 Requested by Host: www.verify-account6547.ns02.info URL: https://www.verify-account6547.ns02.info/Export/css/wfui.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 3.82.127.17 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-82-127-17.compute-1.amazonaws.com Software Apache / Resource Hash `631f3b6267a831a8d67c45e480b5d5a2601f10ff8708bcf3a45a41b377a129cc` Request headers Referer https://www.verify-account6547.ns02.info/Export/css/wfui.css Origin https://www.verify-account6547.ns02.info Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Sat, 25 Dec 2021 15:31:13 GMT Last-Modified Fri, 23 Apr 2021 15:06:08 GMT Server Apache Content-Type font/woff2 Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=96 Content-Length 22424
GET H/1.1	200 OK	wellsfargosans-sbd.woff2 www.verify-account6547.ns02.info/Export/fonts/	22 KB 22 KB	102ms 102ms	Font font/woff2	3.82.127.17 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://www.verify-account6547.ns02.info/Export/fonts/wellsfargosans-sbd.woff2 Requested by Host: www.verify-account6547.ns02.info URL: https://www.verify-account6547.ns02.info/Export/css/wfui.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 3.82.127.17 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-82-127-17.compute-1.amazonaws.com Software Apache / Resource Hash `ab9d8c97b35ed86b6224aca911aa304a0d7dbcbd28e00a4c6585b96e28ed30ba` Request headers Referer https://www.verify-account6547.ns02.info/Export/css/wfui.css Origin https://www.verify-account6547.ns02.info Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Sat, 25 Dec 2021 15:31:13 GMT Last-Modified Fri, 23 Apr 2021 15:06:08 GMT Server Apache Content-Type font/woff2 Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 22600
GET H/1.1	200 OK	wellsfargoserif-rg.woff2 www.verify-account6547.ns02.info/Export/fonts/	26 KB 26 KB	100ms 100ms	Font font/woff2	3.82.127.17 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://www.verify-account6547.ns02.info/Export/fonts/wellsfargoserif-rg.woff2 Requested by Host: www.verify-account6547.ns02.info URL: https://www.verify-account6547.ns02.info/Export/css/wfui.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 3.82.127.17 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-82-127-17.compute-1.amazonaws.com Software Apache / Resource Hash `aeb7b3bfc4281d35b02dfde05ac7a6c0d3daa7f3123b35a9cbd4b5a8e3f3c310` Request headers Referer https://www.verify-account6547.ns02.info/Export/css/wfui.css Origin https://www.verify-account6547.ns02.info Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Sat, 25 Dec 2021 15:31:13 GMT Last-Modified Fri, 23 Apr 2021 15:06:08 GMT Server Apache Content-Type font/woff2 Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 26708

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Wells Fargo (Banking)

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.verify-account6547.ns02.info/	1969-12-31 23:59:59	Name: PHPSESSID Value: 3541cc6842f22baa3dc4190ac2161517

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

www.verify-account6547.ns02.info
3.82.127.17
479606a2a06de5a4dd8b3df3713dafa70d13aa0cd8c9c547ee6824f768306769
6026255cc26e031389358227ccd1b7de6cba842c3978f9144d31cb30032276ef
631f3b6267a831a8d67c45e480b5d5a2601f10ff8708bcf3a45a41b377a129cc
8396ea7e71e3b1408f7e3516f9244622716733bb73cf1a9a5429523411e7e448
a810a4b0e255909c9a3fd9524c1c9a89b215b1f42e1c7cc40776826c31e1fda2
ab9d8c97b35ed86b6224aca911aa304a0d7dbcbd28e00a4c6585b96e28ed30ba
ad100977c97c15d514f9e65f0226a773536d876c9feebec82f498ca7157d5830
aeb7b3bfc4281d35b02dfde05ac7a6c0d3daa7f3123b35a9cbd4b5a8e3f3c310
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
fd645a5b7a97d4d4b4d04ac8f17b8ea5bf14d333e510cc7c69b8be0f5fd8b4f5

www.verify-account6547.ns02.info Open in urlscan Pro 3.82.127.17 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

10 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

312 kBTransfer

310 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

15 JavaScript Global Variables

1 Cookies

Indicators

www.verify-account6547.ns02.info Open in urlscan Pro
3.82.127.17 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

312 kB
Transfer

310 kB
Size

1
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!