httpverify.duckdns.org
Open in
urlscan Pro
52.40.133.3
Malicious Activity!
Public Scan
Submission: On December 09 via automatic, source openphish — Scanned from DE
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on December 8th 2022. Valid for: 3 months.
This is the only time httpverify.duckdns.org was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Wells Fargo (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 | 52.40.133.3 52.40.133.3 | 16509 (AMAZON-02) (AMAZON-02) | |
3 | 23.205.234.180 23.205.234.180 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
2 | 23.3.88.99 23.3.88.99 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
2 | 23.203.89.234 23.203.89.234 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
10 | 5 |
ASN16509 (AMAZON-02, US)
PTR: ec2-52-40-133-3.us-west-2.compute.amazonaws.com
httpverify.duckdns.org |
ASN16625 (AKAMAI-AS, US)
PTR: a23-205-234-180.deploy.static.akamaitechnologies.com
www10.wellsfargomedia.com |
ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-3-88-99.deploy.static.akamaitechnologies.com
static.wellsfargo.com |
ASN16625 (AKAMAI-AS, US)
PTR: a23-203-89-234.deploy.static.akamaitechnologies.com
www15.wellsfargomedia.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
wellsfargomedia.com
www10.wellsfargomedia.com — Cisco Umbrella Rank: 16025 www15.wellsfargomedia.com — Cisco Umbrella Rank: 25297 |
52 KB |
3 |
duckdns.org
httpverify.duckdns.org |
16 KB |
2 |
wellsfargo.com
static.wellsfargo.com — Cisco Umbrella Rank: 12036 |
58 KB |
10 | 3 |
Domain | Requested by | |
---|---|---|
3 | www10.wellsfargomedia.com |
httpverify.duckdns.org
|
3 | httpverify.duckdns.org |
httpverify.duckdns.org
|
2 | www15.wellsfargomedia.com |
www10.wellsfargomedia.com
|
2 | static.wellsfargo.com |
httpverify.duckdns.org
|
10 | 4 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.wellsfargo.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
httpverify.duckdns.org cPanel, Inc. Certification Authority |
2022-12-08 - 2023-03-08 |
3 months | crt.sh |
www10.wellsfargomedia.com DigiCert TLS RSA SHA256 2020 CA1 |
2022-04-05 - 2023-04-05 |
a year | crt.sh |
static.wellsfargo.com DigiCert EV RSA CA G2 |
2022-10-12 - 2023-10-12 |
a year | crt.sh |
www15.wellsfargomedia.com DigiCert TLS RSA SHA256 2020 CA1 |
2022-11-14 - 2023-11-16 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://httpverify.duckdns.org/wellsfargo/email.htm
Frame ID: DE36A79E2D0B9DED67644DE109AA4E75
Requests: 11 HTTP requests in this frame
6 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Title: About Us
Search URL Search Domain Scan URL
Title: Careers
Search URL Search Domain Scan URL
Title: Privacy, Cookies, Security & Legal
Search URL Search Domain Scan URL
Title: Sitemap
Search URL Search Domain Scan URL
Title: Ad Choices
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
10 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
email.htm
httpverify.duckdns.org/wellsfargo/ |
14 KB 14 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
theme.ssep.messaging.css
www10.wellsfargomedia.com/auth/static/css/ssep/ |
4 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wf-fonts.css
www10.wellsfargomedia.com/auth/static/css/ |
4 KB 772 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
redesigned.logout.css
www10.wellsfargomedia.com/auth/static/css/ssep/combined/ |
5 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
utag.136.js
static.wellsfargo.com/tracking/main/ |
54 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
utag.js
static.wellsfargo.com/tracking/main/ |
318 KB 53 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
6 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.js
httpverify.duckdns.org/auth/static/scripts/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sub.png
httpverify.duckdns.org/wellsfargo/ |
872 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wellsfargoserif-rg.woff2
www15.wellsfargomedia.com/wfui/css/fonts/ |
26 KB 26 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wellsfargosans-rg.woff2
www15.wellsfargomedia.com/wfui/css/fonts/ |
22 KB 22 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Wells Fargo (Banking)45 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontentvisibilityautostatechange boolean| utag_condload undefined| new_path object| utag_cfg_ovrd object| utag_data undefined| linkCanonical object| pagesToOptimize object| userAgentArr undefined| schemaDomain undefined| headTag undefined| loadschemaScripts object| dmtElems undefined| pathname undefined| urlArray undefined| url undefined| sRegExInput undefined| MDIGITAL_ON_PREM_PREFIX undefined| linkedIn_www_urlArray undefined| verizon_www_urlArray object| utag undefined| customDMPEvent undefined| getPayload undefined| fireDMPEvent function| isNotUndefinedOrNull function| getDocumentTitleLabel function| sendDataToGA function| closest function| previous_sibling function| getMtgApplyURL function| getMtgApplyAppInviteURL function| getMtgURL function| getMtgRatesURL function| getMtgRatesCalculatorURL function| getMtgRefinancURL function| getMtgFirstTimeHomeBuyerURL function| getMtgResultsURL function| getEquityURL function| getMtgCompareLoansURL function| getMtgComfortZoneURL boolean| __tealium_twc_switch function| utag_pad function| utag_visitor_id string| gtagRename object| dataLayer function| gtag0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
httpverify.duckdns.org
static.wellsfargo.com
www10.wellsfargomedia.com
www15.wellsfargomedia.com
23.203.89.234
23.205.234.180
23.3.88.99
52.40.133.3
04ea7cfd5a919efd82199cba5050a713ace204f4d92f7f85a2140b4a109ee26b
33e5f8366114562c3fb40a5e3ace24aadf8a66ac838bf7317d3c8eda01ad1c80
3a80ebe861b93c47265b21bc70a9fa88fc95e76f39cb291ad05b24597446ef8e
631f3b6267a831a8d67c45e480b5d5a2601f10ff8708bcf3a45a41b377a129cc
750284c53dc79db9ceeae1d6428a2b4ba2e23a40a910218fb16c44c63d7bf109
aeb7b3bfc4281d35b02dfde05ac7a6c0d3daa7f3123b35a9cbd4b5a8e3f3c310
b445132f71a00a242a272030d53a480d5e5977b27cbcb28c131cf8fdb326bd79
de30673d7384fd8ccb3a35e96ccc7b0d0799f22912ae5591fcd3d533ad7becf7
eaeccba3d96e1fe1f6a600ab5b9ebb2dc6bf06cac27ce733ce5b74bf3c85887f
f8cb039a63b11f207edf324bbfdabbbfaa2d421729785dca77020490c293185e