spedometer.net
Open in
urlscan Pro
69.49.230.119
Malicious Activity!
Public Scan
URL:
https://spedometer.net/look/s-go/accounts.htm
Submission: On March 13 via automatic, source openphish — Scanned from DE
Submission: On March 13 via automatic, source openphish — Scanned from DE
Summary
This website contacted 3 IPs
in 2 countries
across 2 domains to perform 9 HTTP transactions.
The main IP is 69.49.230.119, located in
United States and
belongs to NETWORK-SOLUTIONS-HOSTING, US.
The main domain is spedometer.net.
TLS certificate: Issued by R3 on March 5th 2023. Valid for: 3 months.
This is the only time spedometer.net was scanned on urlscan.io!
TLS certificate: Issued by R3 on March 5th 2023. Valid for: 3 months.
This is the only time spedometer.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Wells Fargo (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 8 | 69.49.230.119 69.49.230.119 | 19871 (NETWORK-S...) (NETWORK-SOLUTIONS-HOSTING) | |
| 1 | 95.101.111.186 95.101.111.186 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
| 9 | 3 |
8
69.49.230.119
(United States)
ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: 69-49-230-119.webhostbox.net
ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: 69-49-230-119.webhostbox.net
| spedometer.net |
1
95.101.111.186
(Frankfurt am Main, Germany)
ASN20940 (AKAMAI-ASN1, NL)
PTR: a95-101-111-186.deploy.static.akamaitechnologies.com
ASN20940 (AKAMAI-ASN1, NL)
PTR: a95-101-111-186.deploy.static.akamaitechnologies.com
| connect.secure.wellsfargo.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 8 |
spedometer.net
spedometer.net |
257 KB |
| 1 |
wellsfargo.com
connect.secure.wellsfargo.com — Cisco Umbrella Rank: 12937 |
20 KB |
| 9 | 2 |
| Domain | Requested by | |
|---|---|---|
| 8 | spedometer.net |
spedometer.net
|
| 1 | connect.secure.wellsfargo.com |
spedometer.net
|
| 9 | 2 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| www.wellsfargo.com |
| oam.wellsfargo.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| cpcontacts.spedometer.net R3 |
2023-03-05 - 2023-06-03 |
3 months | crt.sh |
| connect.secure.wellsfargo.com DigiCert EV RSA CA G2 |
2022-10-11 - 2023-10-11 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://spedometer.net/look/s-go/accounts.htm
Frame ID: D4A9CFC8E035DB8B84CA96504CA904FA
Requests: 15 HTTP requests in this frame
Screenshot
Page Title
Wells Fargo Sign On to View Your AccountsPage Statistics
14 Outgoing links
These are links going to different origins than the main page.
URL: https://www.wellsfargo.com/
Search URL Search Domain Scan URL
URL: https://www.wellsfargo.com/help/apply/
Title: Apply
Title: Apply
Search URL Search Domain Scan URL
URL: https://www.wellsfargo.com/locator/
Title: Locations
Title: Locations
Search URL Search Domain Scan URL
URL: https://www.wellsfargo.com/help/
Title: Customer Service
Title: Customer Service
Search URL Search Domain Scan URL
URL: https://www.wellsfargo.com/help/faqs/sign-on
Title: Forgot Password/Username?
Title: Forgot Password/Username?
Search URL Search Domain Scan URL
URL: https://oam.wellsfargo.com/oamo/identity/enrollment
Title: Enroll Now
Title: Enroll Now
Search URL Search Domain Scan URL
URL: https://www.wellsfargo.com/help/faqs/enroll
Title: Enrollment FAQs
Title: Enrollment FAQs
Search URL Search Domain Scan URL
URL: https://www.wellsfargo.com/privacy-security/guarantee
Title: Online Security Guarantee
Title: Online Security Guarantee
Search URL Search Domain Scan URL
URL: https://www.wellsfargo.com/privacy-security/
Title: Privacy, Security and Legal
Title: Privacy, Security and Legal
Search URL Search Domain Scan URL
URL: https://www.wellsfargo.com/online-banking/online-access-agreement/
Title: Online Access Agreement
Title: Online Access Agreement
Search URL Search Domain Scan URL
URL: https://www.wellsfargo.com/about/
Title: About Wells Fargo
Title: About Wells Fargo
Search URL Search Domain Scan URL
URL: https://www.wellsfargo.com/about/careers/
Title: Careers
Title: Careers
Search URL Search Domain Scan URL
URL: https://www.wellsfargo.com/privacy-security/fraud/report/phish
Title: Report Email Fraud
Title: Report Email Fraud
Search URL Search Domain Scan URL
URL: https://www.wellsfargo.com/sitemap
Title: Sitemap
Title: Sitemap
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
9 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
accounts.htm
spedometer.net/look/s-go/ |
62 KB 62 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
a
spedometer.net/look/s-go/accounts_files/ |
471 B 687 B |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
nd
spedometer.net/look/s-go/accounts_files/ |
39 KB 39 KB |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
login-userprefs.js
spedometer.net/look/s-go/accounts_files/ |
144 KB 144 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
conutils-6.js
spedometer.net/look/s-go/accounts_files/ |
10 KB 10 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
atadun.js
spedometer.net/look/s-go/accounts_files/ |
1 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
12 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
839 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
889 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
conutils-6.2.2.js
spedometer.net/auth/static/scripts/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
atadun.js
spedometer.net/auth/static/prefs/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
nd
connect.secure.wellsfargo.com/jenny/ |
53 KB 20 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Wells Fargo (Banking)207 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless function| ndoGetObjectKeys string| ndjsStaticVersion object| nsxywmulou object| nskedivqjx boolean| nsxywmul number| nsqxicymqi number| nszkefz object| nsyqgzwld object| nsyqgzwl object| nsgtjzd object| nsgtjzdj object| nsqxi object| nstjvfxa boolean| nsqxicy string| nsxywm object| nds object| nszkefzbu number| numQueries object| returned string| version undefined| nszkefzb string| nsgtj string| nskedivqj string| nszkefzbuf string| nsxywmu string| nsyqg string| nskediv object| nswbfux object| nswbfu function| nsgtjzdjfs function| nsqxicymq function| nsked boolean| nswbfuxxzo object| nstjvf function| nskedivq function| nstjv function| ndwts function| nskedi function| nsyqgzw function| nsxyw function| nszkef function| nswbfuxx function| nsgtjzdjf function| nsgtjz function| nsqxic function| nszke function| nstjvfxazz function| nsxywmulo function| nstjvfx function| nswbf function| nsyqgzwldq function| nstjvfxaz function| nsyqgz function| nswbfuxxz function| nsqxicym function| nsmsc function| nsfubfucrh function| nspkzbvjhd function| nsfubfucr function| nspkzbvj function| nsptobzd function| nsptobzdc function| nsqekh function| HashUtil function| nsvaymeqvg function| nstumfnnfk function| nstumf function| nsvaymeq function| nsmscrvwt function| nsflj function| nsfub function| ndwti object| ndsapi object| antiClickjack string| webId string| ndURI object| bundle function| disableSubmitsCollectUserPrefs function| addLoginFormFieldsAndSubmit function| jsEnabled function| addEvent object| UserPrefsHelper object| collector function| loadUserPrefs function| submitUserPrefs function| getUserPrefsOnPageLoad function| undoSaveUsername function| maskedUsernameChanged boolean| m object| q object| options object| lun3 boolean| isNative object| js object| fjs object| LoginForm object| Search function| updateCustomSelect string| nsoltceajy string| NDS_LISTEN_FOCUS string| NDS_LISTEN_TOUCH string| NDS_LISTEN_KEYBOARD string| NDS_LISTEN_DEVICE_MOTION_SENSORS string| NDS_LISTEN_MOUSE string| NDS_LISTEN_FORM string| NDS_LISTEN_ALL string| NDS_LISTEN_NONE string| nsoltc string| nsflzdey string| nstmpenaqf string| nsrexqmz string| nsopu string| nsflzdeywx string| nsflz string| nsflzd string| nseinze string| nsein function| nsflzdeyw string| nstmpe string| nsopuz function| nstmpena object| nseinzertu function| validateSessionIdCookie function| nsoltcea function| ndoIsKeyIncluded function| ndoIsModifierKey function| nsdyl function| ndoIsNavigationKey function| nswjike function| ndoIsEditingKey object| KEYBOARD_LOCATION object| KEY_TYPE_AND_LOCATION function| ndoGetKeyboardLocation function| ndoGetKeyTypeAndLocationIndicator function| nswji function| attachEventListener boolean| nsdyllhet object| nstmpenaq object| nsopuzlm boolean| nsfdksr number| nsopuzl number| nsdyllhe function| nsawleqr object| nsdyll object| nsdyllhetb object| nsrex object| nsfdksrobf object| nsfdksro function| nsvfj function| nswjikeazb function| nsdtgnq object| nsopuzlmik boolean| nsdyllh string| nsopuzlmi object| nsrexq object| nseinzert function| nsdtg function| nsawleqrlj string| nsfdks function| nshgdqvxb string| ndsWidgetVersion string| nsoltce string| nsrexqm function| nskyvq function| nsvfjjfa string| nsrexqmzh string| nseinzer string| nstmp string| nsflzde string| nstmpen object| nsolt object| nsoltceaj function| nsaiis function| nsfdksrob function| nsrexqmzhe function| nseinz function| nsawleqrl function| nsdtgnqs function| nsvfjjf function| nshgdqvx function| nsaiisxn function| nswjik function| nsaiisxney function| nseoohvtxw function| nsvfjjfax function| nskyv function| nshgd function| nsdtgnqsbl function| nskyvqwlu function| nswjikeaz function| nskyvqw function| nshgdqvxbj function| nswjikea function| nseoohvtx function| nsvfjj function| getEnabledEvents function| nseoo function| nsdtgn function| nseoohv function| nshgdq function| nsvfjjfaxe function| nsawleq function| nseooh function| nsaiisxne object| nsfdk function| nsaii1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| .spedometer.net/ | Name: ndsid Value: ndsadxyx7c4n1dlf7e2ug3 |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
connect.secure.wellsfargo.com
spedometer.net
69.49.230.119
95.101.111.186
142c4396fd2e164ae4406a3e4276d20be3bdbefdbd4203f8ef4374e5be05b7b2
17f3818bba16137fba7657230309043ae41cd08a5df25a7c61cd9583291c1354
1ed889a15705bc76729d29d715c64f3d7f35de2ea519e1d2704924cf40d9e30d
2c74fe336daab80e964b33c48802b68f6672ad9d7f1979513386abb153b22089
3313ac9f2c148df9dc8581ae4d7bb9023c3ef933d1152db47de29e32ec5f67b0
3ec4ec8576065be9cd595d9733710a3bed441953abe4891d2028be2cc22d6a3a
597dad02202c54dd08ed75d2e54f92c463ef726480583aafd2a675d428aa431f
5fb7b85658a6e615400e0f1f3e16fc869bbd099b3c3c181c294c05d1d7d1cfe5
734077a5b9c3d697da3cf327cea858f8ee0e548bb1c84186bfb6ab9cfe8fe103
b99dead0deb91299630edd2fdc72855aac3836ea262473d47348e218a7744264
df500743bbedcef7623fdf2ef0c05ca411437c6216674271f4cc8b32f910f96d
f7899cfdbc342decc4aeb0bae9ada39bfaa8ae3c687fc72119fca2efdf77dff2
f809fa596dc2e66029e195d0aef2d6d7b077ea1f7d145455441ba893875aec41