urlscan.io logo urlscan.io
SecurityTrails logo

secu-my-acct.com Open in urlscan Pro
34.168.191.185  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://secu-my-acct.com/
Effective URL: https://secu-my-acct.com/
Submission: On November 05 via automatic, source openphish — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 10 HTTP transactions. The main IP is 34.168.191.185, located in The Dalles, United States and belongs to GOOGLE-CLOUD-PLATFORM, US. The main domain is secu-my-acct.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on November 1st 2022. Valid for: 3 months.
This is the only time secu-my-acct.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Wells Fargo (Banking)

Domain & IP information

IP Address AS Autonomous System
1 8 34.168.191.185 396982 (GOOGLE-CL...)
3 184.24.31.94 16625 (AKAMAI-AS)
10 2
Apex Domain
Subdomains		 Transfer
8 secu-my-acct.com
secu-my-acct.com
752 KB
3 wellsfargomedia.com
www15.wellsfargomedia.com — Cisco Umbrella Rank: 44195
71 KB
10 2
Domain Requested by
8 secu-my-acct.com 1 redirects secu-my-acct.com
3 www15.wellsfargomedia.com secu-my-acct.com
10 2

This site contains links to these domains. Also see Links.

Domain
oam.wellsfargo.com
Subject Issuer Validity Valid
secu-my-acct.com
cPanel, Inc. Certification Authority		 2022-11-01 -
2023-01-30		 3 months crt.sh
www15.wellsfargomedia.com
DigiCert SHA2 Secure Server CA		 2021-12-31 -
2023-01-03		 a year crt.sh

This page contains 1 frames:

Primary Page: https://secu-my-acct.com/
Frame ID: F90DE0EF24C81BA917717EAB9B0B6533
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Sign On to View Your Personal Accounts | Wells Fargo

Page URL History Show full URLs

  1. http://secu-my-acct.com/ HTTP 301
    https://secu-my-acct.com/ Page URL

Page Statistics

10
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

822 kB
Transfer

820 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://secu-my-acct.com/ HTTP 301
    https://secu-my-acct.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
secu-my-acct.com/
Redirect Chain
  • http://secu-my-acct.com/
  • https://secu-my-acct.com/
23 KB
24 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://secu-my-acct.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
34.168.191.185 The Dalles, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
185.191.168.34.bc.googleusercontent.com
Software
Apache /
Resource Hash
c465485aed683268f94dcdba95c6adfbc55f713aa7868df057f6e171600f9b00

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Cache-Control
no-store, no-cache, must-revalidate
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
Date
Sat, 05 Nov 2022 02:01:18 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive
timeout=5, max=100
Pragma
no-cache
Server
Apache
Transfer-Encoding
chunked

Redirect headers

Connection
Keep-Alive
Content-Length
233
Content-Type
text/html; charset=iso-8859-1
Date
Sat, 05 Nov 2022 02:01:17 GMT
Keep-Alive
timeout=5, max=100
Location
https://secu-my-acct.com/
Server
Apache
wfui.dc5a086beca5b68bfa75.chunk.css
secu-my-acct.com/resources/ 		94 KB
94 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://secu-my-acct.com/resources/wfui.dc5a086beca5b68bfa75.chunk.css
Requested by
Host: secu-my-acct.com
URL: https://secu-my-acct.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
34.168.191.185 The Dalles, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
185.191.168.34.bc.googleusercontent.com
Software
Apache /
Resource Hash
fe1bdc09b7399736efc6617cf6762dc9c82516e0b3f1e0d80fe5287c262c199a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://secu-my-acct.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

Date
Sat, 05 Nov 2022 02:01:20 GMT
Last-Modified
Tue, 01 Nov 2022 22:16:16 GMT
Server
Apache
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
95868
main.4870f47b74ad9141ce5b.chunk.css
secu-my-acct.com/resources/ 		3 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://secu-my-acct.com/resources/main.4870f47b74ad9141ce5b.chunk.css
Requested by
Host: secu-my-acct.com
URL: https://secu-my-acct.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
34.168.191.185 The Dalles, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
185.191.168.34.bc.googleusercontent.com
Software
Apache /
Resource Hash
c09753711c376ac7d47b28dca007a00ea49e907c3476fd12bdf8ae303cf52ec9

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://secu-my-acct.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

Date
Sat, 05 Nov 2022 02:01:21 GMT
Last-Modified
Tue, 01 Nov 2022 22:16:16 GMT
Server
Apache
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
3580
0.fccf6cebc9e0f1a0717f.chunk.css
secu-my-acct.com/resources/ 		8 KB
8 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://secu-my-acct.com/resources/0.fccf6cebc9e0f1a0717f.chunk.css
Requested by
Host: secu-my-acct.com
URL: https://secu-my-acct.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
34.168.191.185 The Dalles, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
185.191.168.34.bc.googleusercontent.com
Software
Apache /
Resource Hash
9e996fe967eb8587a13a25eb1d22741d17195385800cd9375bcf1f2f8739cdd5

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://secu-my-acct.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

Date
Sat, 05 Nov 2022 02:01:21 GMT
Last-Modified
Tue, 01 Nov 2022 22:16:16 GMT
Server
Apache
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
7726
1.f547b6e66267c52604e9.chunk.css
secu-my-acct.com/resources/ 		4 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://secu-my-acct.com/resources/1.f547b6e66267c52604e9.chunk.css
Requested by
Host: secu-my-acct.com
URL: https://secu-my-acct.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
34.168.191.185 The Dalles, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
185.191.168.34.bc.googleusercontent.com
Software
Apache /
Resource Hash
444238afa2c5dff88714941474ff5153227a31fe6a58f4cc8a0c3e517d5da629

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://secu-my-acct.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

Date
Sat, 05 Nov 2022 02:01:21 GMT
Last-Modified
Tue, 01 Nov 2022 22:16:16 GMT
Server
Apache
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
3997
2.d908c227d892a97fd57c.chunk.css
secu-my-acct.com/resources/ 		19 KB
19 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://secu-my-acct.com/resources/2.d908c227d892a97fd57c.chunk.css
Requested by
Host: secu-my-acct.com
URL: https://secu-my-acct.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
34.168.191.185 The Dalles, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
185.191.168.34.bc.googleusercontent.com
Software
Apache /
Resource Hash
00f37084a77125b6ec9a0d7adbfe986578d1d5ef26514bc0d88b2b4ec39740f8

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://secu-my-acct.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

Date
Sat, 05 Nov 2022 02:01:21 GMT
Last-Modified
Tue, 01 Nov 2022 22:16:16 GMT
Server
Apache
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
19337
COB-BOB-IRT-enroll_tractor.jpg
secu-my-acct.com/resources/ 		599 KB
599 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://secu-my-acct.com/resources/COB-BOB-IRT-enroll_tractor.jpg
Requested by
Host: secu-my-acct.com
URL: https://secu-my-acct.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
34.168.191.185 The Dalles, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
185.191.168.34.bc.googleusercontent.com
Software
Apache /
Resource Hash
d3ee0c954f26a12702c2ad4ca5fc14fa14198eadd59113a5baef17e0c1240ebe

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://secu-my-acct.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

Date
Sat, 05 Nov 2022 02:01:21 GMT
Last-Modified
Tue, 01 Nov 2022 22:16:16 GMT
Server
Apache
Content-Type
image/jpeg
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
613304
wellsfargosans-rg.woff2
www15.wellsfargomedia.com/wfui/css/fonts/ 		22 KB
22 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www15.wellsfargomedia.com/wfui/css/fonts/wellsfargosans-rg.woff2
Requested by
Host: secu-my-acct.com
URL: https://secu-my-acct.com/resources/wfui.dc5a086beca5b68bfa75.chunk.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.24.31.94 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-24-31-94.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
631f3b6267a831a8d67c45e480b5d5a2601f10ff8708bcf3a45a41b377a129cc

Request headers

Referer
https://secu-my-acct.com/
Origin
https://secu-my-acct.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Sat, 05 Nov 2022 02:01:21 GMT
last-modified
Tue, 26 Feb 2019 19:38:34 GMT
etag
"5c7595ba-5798"
content-type
font/woff2
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
content-length
22424
expires
Sun, 05 Nov 2023 02:01:21 GMT
wellsfargosans-sbd.woff2
www15.wellsfargomedia.com/wfui/css/fonts/ 		22 KB
22 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www15.wellsfargomedia.com/wfui/css/fonts/wellsfargosans-sbd.woff2
Requested by
Host: secu-my-acct.com
URL: https://secu-my-acct.com/resources/wfui.dc5a086beca5b68bfa75.chunk.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.24.31.94 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-24-31-94.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
ab9d8c97b35ed86b6224aca911aa304a0d7dbcbd28e00a4c6585b96e28ed30ba

Request headers

Referer
https://secu-my-acct.com/
Origin
https://secu-my-acct.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Sat, 05 Nov 2022 02:01:21 GMT
last-modified
Tue, 26 Feb 2019 19:38:34 GMT
etag
"5c7595ba-5848"
content-type
font/woff2
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
content-length
22600
expires
Sun, 05 Nov 2023 02:01:21 GMT
wellsfargoserif-rg.woff2
www15.wellsfargomedia.com/wfui/css/fonts/ 		26 KB
26 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www15.wellsfargomedia.com/wfui/css/fonts/wellsfargoserif-rg.woff2
Requested by
Host: secu-my-acct.com
URL: https://secu-my-acct.com/resources/wfui.dc5a086beca5b68bfa75.chunk.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.24.31.94 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-24-31-94.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
aeb7b3bfc4281d35b02dfde05ac7a6c0d3daa7f3123b35a9cbd4b5a8e3f3c310

Request headers

Referer
https://secu-my-acct.com/
Origin
https://secu-my-acct.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Sat, 05 Nov 2022 02:01:21 GMT
last-modified
Mon, 11 Mar 2019 20:52:01 GMT
etag
"5c86ca71-6854"
content-type
font/woff2
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
content-length
26708
expires
Sun, 05 Nov 2023 02:01:21 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Wells Fargo (Banking)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| doo function| dooe function| su

1 Cookies

Domain/Path Name / Value
secu-my-acct.com/ Name: PHPSESSID
Value: 2748a88aa98c9a9a8f051231ae2ef3a5