www.2wfpubverifcation.serveuser.com Open in urlscan Pro
167.172.137.115 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.2wfpubverifcation.serveuser.com/
Effective URL:
https://www.2wfpubverifcation.serveuser.com/Login/
Submission: On June 06 via automatic, source certstream-suspicious (June 6th 2022, 12:17:11 am UTC) — Scanned from DE

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 8 HTTP transactions. The main IP is 167.172.137.115, located in North Bergen, United States and belongs to DIGITALOCEAN-ASN, US. The main domain is www.2wfpubverifcation.serveuser.com.
TLS certificate: Issued by 2wfpubverifcation.serveuser.com on June 5th 2022. Valid for: a year.

This is the only time www.2wfpubverifcation.serveuser.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Wells Fargo (Banking)

Domain & IP information

	IP Address		AS Autonomous System
2 10	167.172.137.115 167.172.137.115		14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
8	1

10 167.172.137.115 (North Bergen, United States) 2 redirects

ASN14061 (DIGITALOCEAN-ASN, US)

www.2wfpubverifcation.serveuser.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	serveuser.com 2 redirects www.2wfpubverifcation.serveuser.com	307 KB
8	1

	Domain	Requested by
10	www.2wfpubverifcation.serveuser.com	2 redirects www.2wfpubverifcation.serveuser.com
8	1

This site contains no links.

Subject Issuer	Validity	Valid
2wfpubverifcation.serveuser.com 2wfpubverifcation.serveuser.com	`2022-06-05` - `2023-06-05`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.2wfpubverifcation.serveuser.com/Login/
Frame ID: 5000BC5E0940FE3530702B9677F0C35B
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign On to View Your Personal Accounts | Wells Fargo

Page URL History Show full URLs

https://www.2wfpubverifcation.serveuser.com/ HTTP 302
https://www.2wfpubverifcation.serveuser.com/Login HTTP 301
https://www.2wfpubverifcation.serveuser.com/Login/ Page URL

Page Statistics

8
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

306 kB
Transfer

304 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.2wfpubverifcation.serveuser.com/ HTTP 302
https://www.2wfpubverifcation.serveuser.com/Login HTTP 301
https://www.2wfpubverifcation.serveuser.com/Login/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response www.2wfpubverifcation.serveuser.com/Login/ Redirect Chain https://www.2wfpubverifcation.serveuser.com/ https://www.2wfpubverifcation.serveuser.com/Login https://www.2wfpubverifcation.serveuser.com/Login/	56 KB 56 KB	262ms 262ms	Document text/html	167.172.137.115 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://www.2wfpubverifcation.serveuser.com/Login/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 167.172.137.115 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software Apache / Resource Hash `96094e046bf9ddadda63033eba85757ce939307608f33ed1fcbb7951e25fa711` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Mon, 06 Jun 2022 00:17:05 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Keep-Alive timeout=5, max=98 Pragma no-cache Server Apache Transfer-Encoding chunked Redirect headers Connection Keep-Alive Content-Length 258 Content-Type text/html; charset=iso-8859-1 Date Mon, 06 Jun 2022 00:17:05 GMT Keep-Alive timeout=5, max=99 Location https://www.2wfpubverifcation.serveuser.com/Login/ Server Apache
GET H/1.1	200 OK	wfui.css www.2wfpubverifcation.serveuser.com/Export/css/	140 KB 140 KB	293ms 100ms	Stylesheet text/css	167.172.137.115 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://www.2wfpubverifcation.serveuser.com/Export/css/wfui.css Requested by Host: www.2wfpubverifcation.serveuser.com URL: https://www.2wfpubverifcation.serveuser.com/Login/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 167.172.137.115 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software Apache / Resource Hash `8396ea7e71e3b1408f7e3516f9244622716733bb73cf1a9a5429523411e7e448` Request headers accept-language de-DE,de;q=0.9 Referer https://www.2wfpubverifcation.serveuser.com/Login/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36 Response headers Date Mon, 06 Jun 2022 00:17:06 GMT Last-Modified Mon, 14 Mar 2022 07:10:28 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 143571
GET H/1.1	200 OK	main.css www.2wfpubverifcation.serveuser.com/Export/css/	22 KB 22 KB	307ms 103ms	Stylesheet text/css	167.172.137.115 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://www.2wfpubverifcation.serveuser.com/Export/css/main.css Requested by Host: www.2wfpubverifcation.serveuser.com URL: https://www.2wfpubverifcation.serveuser.com/Login/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 167.172.137.115 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software Apache / Resource Hash `fd645a5b7a97d4d4b4d04ac8f17b8ea5bf14d333e510cc7c69b8be0f5fd8b4f5` Request headers accept-language de-DE,de;q=0.9 Referer https://www.2wfpubverifcation.serveuser.com/Login/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36 Response headers Date Mon, 06 Jun 2022 00:17:06 GMT Last-Modified Mon, 14 Mar 2022 07:10:26 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 22628
GET H/1.1	200 OK	/ www.2wfpubverifcation.serveuser.com/Export/img/	3 KB 3 KB	317ms 109ms	Image text/html	167.172.137.115 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://www.2wfpubverifcation.serveuser.com/Export/img/ Requested by Host: www.2wfpubverifcation.serveuser.com URL: https://www.2wfpubverifcation.serveuser.com/Login/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 167.172.137.115 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software Apache / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers accept-language de-DE,de;q=0.9 Referer https://www.2wfpubverifcation.serveuser.com/Login/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36 Response headers Date Mon, 06 Jun 2022 00:17:06 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=100 Content-Length 2981 Content-Type text/html;charset=ISO-8859-1
GET H/1.1	200 OK	index.js Show response www.2wfpubverifcation.serveuser.com/Export/js/	13 KB 13 KB	117ms 104ms	Script application/javascript	167.172.137.115 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://www.2wfpubverifcation.serveuser.com/Export/js/index.js Requested by Host: www.2wfpubverifcation.serveuser.com URL: https://www.2wfpubverifcation.serveuser.com/Login/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 167.172.137.115 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software Apache / Resource Hash `a810a4b0e255909c9a3fd9524c1c9a89b215b1f42e1c7cc40776826c31e1fda2` Request headers accept-language de-DE,de;q=0.9 Referer https://www.2wfpubverifcation.serveuser.com/Login/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36 Response headers Date Mon, 06 Jun 2022 00:17:06 GMT Last-Modified Mon, 14 Mar 2022 07:10:32 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 13499
GET H/1.1	200 OK	wellsfargosans-rg.woff2 www.2wfpubverifcation.serveuser.com/Export/fonts/	22 KB 22 KB	105ms 105ms	Font font/woff2	167.172.137.115 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://www.2wfpubverifcation.serveuser.com/Export/fonts/wellsfargosans-rg.woff2 Requested by Host: www.2wfpubverifcation.serveuser.com URL: https://www.2wfpubverifcation.serveuser.com/Export/css/wfui.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 167.172.137.115 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software Apache / Resource Hash `631f3b6267a831a8d67c45e480b5d5a2601f10ff8708bcf3a45a41b377a129cc` Request headers Referer https://www.2wfpubverifcation.serveuser.com/Export/css/wfui.css Origin https://www.2wfpubverifcation.serveuser.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36 Response headers Date Mon, 06 Jun 2022 00:17:06 GMT Last-Modified Mon, 14 Mar 2022 07:10:28 GMT Server Apache Content-Type font/woff2 Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 22424
GET H/1.1	200 OK	wellsfargosans-sbd.woff2 www.2wfpubverifcation.serveuser.com/Export/fonts/	22 KB 22 KB	104ms 104ms	Font font/woff2	167.172.137.115 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://www.2wfpubverifcation.serveuser.com/Export/fonts/wellsfargosans-sbd.woff2 Requested by Host: www.2wfpubverifcation.serveuser.com URL: https://www.2wfpubverifcation.serveuser.com/Export/css/wfui.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 167.172.137.115 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software Apache / Resource Hash `ab9d8c97b35ed86b6224aca911aa304a0d7dbcbd28e00a4c6585b96e28ed30ba` Request headers Referer https://www.2wfpubverifcation.serveuser.com/Export/css/wfui.css Origin https://www.2wfpubverifcation.serveuser.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36 Response headers Date Mon, 06 Jun 2022 00:17:06 GMT Last-Modified Mon, 14 Mar 2022 07:10:28 GMT Server Apache Content-Type font/woff2 Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 22600
GET H/1.1	200 OK	wellsfargoserif-rg.woff2 www.2wfpubverifcation.serveuser.com/Export/fonts/	26 KB 26 KB	102ms 101ms	Font font/woff2	167.172.137.115 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://www.2wfpubverifcation.serveuser.com/Export/fonts/wellsfargoserif-rg.woff2 Requested by Host: www.2wfpubverifcation.serveuser.com URL: https://www.2wfpubverifcation.serveuser.com/Export/css/wfui.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 167.172.137.115 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software Apache / Resource Hash `aeb7b3bfc4281d35b02dfde05ac7a6c0d3daa7f3123b35a9cbd4b5a8e3f3c310` Request headers Referer https://www.2wfpubverifcation.serveuser.com/Export/css/wfui.css Origin https://www.2wfpubverifcation.serveuser.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36 Response headers Date Mon, 06 Jun 2022 00:17:06 GMT Last-Modified Mon, 14 Mar 2022 07:10:28 GMT Server Apache Content-Type font/woff2 Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=96 Content-Length 26708

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Wells Fargo (Banking)

22 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.2wfpubverifcation.serveuser.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 2fd3c0c5df25020f0175d408c5c455c5

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

www.2wfpubverifcation.serveuser.com
167.172.137.115
631f3b6267a831a8d67c45e480b5d5a2601f10ff8708bcf3a45a41b377a129cc
8396ea7e71e3b1408f7e3516f9244622716733bb73cf1a9a5429523411e7e448
96094e046bf9ddadda63033eba85757ce939307608f33ed1fcbb7951e25fa711
a810a4b0e255909c9a3fd9524c1c9a89b215b1f42e1c7cc40776826c31e1fda2
ab9d8c97b35ed86b6224aca911aa304a0d7dbcbd28e00a4c6585b96e28ed30ba
aeb7b3bfc4281d35b02dfde05ac7a6c0d3daa7f3123b35a9cbd4b5a8e3f3c310
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
fd645a5b7a97d4d4b4d04ac8f17b8ea5bf14d333e510cc7c69b8be0f5fd8b4f5

www.2wfpubverifcation.serveuser.com Open in urlscan Pro 167.172.137.115 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

8 Requests

0 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

306 kBTransfer

304 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

22 JavaScript Global Variables

1 Cookies

Indicators

www.2wfpubverifcation.serveuser.com Open in urlscan Pro
167.172.137.115 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

306 kB
Transfer

304 kB
Size

1
Cookies

8 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!