52.40.133.3 Open in urlscan Pro
52.40.133.3  Malicious Activity! Public Scan

6 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request email.htm Show response 52.40.133.3/wellsfargo/	14 KB 14 KB	366ms 121ms	Document text/html	52.40.133.3 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://52.40.133.3/wellsfargo/email.htm Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 52.40.133.3 Boardman, United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-40-133-3.us-west-2.compute.amazonaws.com Software Apache / Resource Hash 04ea7cfd5a919efd82199cba5050a713ace204f4d92f7f85a2140b4a109ee26b Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 accept-language jp-JP,jp;q=0.9 Response headers Accept-Ranges bytes Connection Keep-Alive Content-Length 14546 Content-Type text/html Date Sun, 11 Dec 2022 16:07:45 GMT Keep-Alive timeout=5, max=100 Last-Modified Tue, 21 Sep 2021 01:36:26 GMT Server Apache
GET H2	200	theme.ssep.messaging.css www10.wellsfargomedia.com/auth/static/css/ssep/	4 KB 1 KB	15ms 7ms	Stylesheet text/css	23.2.142.77 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://www10.wellsfargomedia.com/auth/static/css/ssep/theme.ssep.messaging.css?v= Requested by Host: 52.40.133.3 URL: https://52.40.133.3/wellsfargo/email.htm Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.2.142.77 Tokyo, Japan, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-2-142-77.deploy.static.akamaitechnologies.com Software Akamai Resource Optimizer / Resource Hash 750284c53dc79db9ceeae1d6428a2b4ba2e23a40a910218fb16c44c63d7bf109 Security Headers Name Value Content-Security-Policy default-src 'self'; script-src 'self'; object-src 'self'; frame-ancestors 'self'; report-uri https://ort.wellsfargo.com/reporting/csp Strict-Transport-Security max-age=31536000; includeSubdomains; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language jp-JP,jp;q=0.9 Referer https://52.40.133.3/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers content-security-policy default-src 'self'; script-src 'self'; object-src 'self'; frame-ancestors 'self'; report-uri https://ort.wellsfargo.com/reporting/csp content-encoding br x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubdomains; date Sun, 11 Dec 2022 16:07:45 GMT content-length 842 x-xss-protection 1; mode=block last-modified Thu, 01 Dec 2022 21:19:02 GMT server Akamai Resource Optimizer etag W/"6369c7b7-f0e" allow GET, POST, OPTIONS access-control-allow-methods POST content-type text/css vary Accept-Encoding x-frame-options SAMEORIGIN cache-control max-age=10368000 expires Mon, 10 Apr 2023 16:07:45 GMT
GET H2	200	wf-fonts.css www10.wellsfargomedia.com/auth/static/css/	4 KB 772 B	15ms 7ms	Stylesheet text/css	23.2.142.77 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://www10.wellsfargomedia.com/auth/static/css/wf-fonts.css?v= Requested by Host: 52.40.133.3 URL: https://52.40.133.3/wellsfargo/email.htm Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.2.142.77 Tokyo, Japan, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-2-142-77.deploy.static.akamaitechnologies.com Software Akamai Resource Optimizer / Resource Hash 3a80ebe861b93c47265b21bc70a9fa88fc95e76f39cb291ad05b24597446ef8e Security Headers Name Value Content-Security-Policy default-src 'self'; script-src 'self'; object-src 'self'; frame-ancestors 'self'; report-uri https://ort.wellsfargo.com/reporting/csp Strict-Transport-Security max-age=31536000; includeSubdomains; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language jp-JP,jp;q=0.9 Referer https://52.40.133.3/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers content-security-policy default-src 'self'; script-src 'self'; object-src 'self'; frame-ancestors 'self'; report-uri https://ort.wellsfargo.com/reporting/csp content-encoding br x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubdomains; date Sun, 11 Dec 2022 16:07:45 GMT content-length 314 x-xss-protection 1; mode=block last-modified Wed, 16 Nov 2022 04:23:57 GMT server Akamai Resource Optimizer etag W/"6369c7b8-edb" allow GET, POST, OPTIONS access-control-allow-methods POST content-type text/css vary Accept-Encoding x-frame-options SAMEORIGIN cache-control max-age=10368000 expires Mon, 10 Apr 2023 16:07:45 GMT
GET H2	200	redesigned.logout.css www10.wellsfargomedia.com/auth/static/css/ssep/combined/	5 KB 2 KB	11ms 3ms	Stylesheet text/css	23.2.142.77 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://www10.wellsfargomedia.com/auth/static/css/ssep/combined/redesigned.logout.css?v= Requested by Host: 52.40.133.3 URL: https://52.40.133.3/wellsfargo/email.htm Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.2.142.77 Tokyo, Japan, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-2-142-77.deploy.static.akamaitechnologies.com Software Akamai Resource Optimizer / Resource Hash b445132f71a00a242a272030d53a480d5e5977b27cbcb28c131cf8fdb326bd79 Security Headers Name Value Content-Security-Policy default-src 'self'; script-src 'self'; object-src 'self'; frame-ancestors 'self'; report-uri https://ort.wellsfargo.com/reporting/csp Strict-Transport-Security max-age=31536000; includeSubdomains; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language jp-JP,jp;q=0.9 Referer https://52.40.133.3/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers content-security-policy default-src 'self'; script-src 'self'; object-src 'self'; frame-ancestors 'self'; report-uri https://ort.wellsfargo.com/reporting/csp content-encoding br x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubdomains; date Sun, 11 Dec 2022 16:07:45 GMT content-length 1108 x-xss-protection 1; mode=block last-modified Thu, 01 Dec 2022 21:18:24 GMT server Akamai Resource Optimizer etag W/"6369c7b7-136b" allow GET, POST, OPTIONS access-control-allow-methods POST content-type text/css vary Accept-Encoding x-frame-options SAMEORIGIN cache-control max-age=10368000 expires Mon, 10 Apr 2023 16:07:45 GMT
GET H/1.1	200 OK	utag.136.js Show response static.wellsfargo.com/tracking/main/	54 KB 5 KB	21ms 11ms	Script application/javascript	23.200.55.23 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://static.wellsfargo.com/tracking/main/utag.136.js?utv=ut4.88wri7BVgm73UdVGNg6ndy7QmQTMTcYSSfAPsukavoUDdy8zxNgHUugNJcEBtzp6VdR1ZCwtySwsQaA9pHbTSnpZ4vnPyBqmain_201 Requested by Host: 52.40.133.3 URL: https://52.40.133.3/wellsfargo/email.htm Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 23.200.55.23 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a23-200-55-23.deploy.static.akamaitechnologies.com Software / Resource Hash eaeccba3d96e1fe1f6a600ab5b9ebb2dc6bf06cac27ce733ce5b74bf3c85887f Security Headers Name Value Strict-Transport-Security max-age=31536000 ; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language jp-JP,jp;q=0.9 Referer https://52.40.133.3/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers Date Sun, 11 Dec 2022 16:07:45 GMT Content-Encoding gzip X-Content-Type-Options nosniff Strict-Transport-Security max-age=31536000 ; includeSubDomains Last-Modified Thu, 11 Aug 2022 20:02:46 GMT ETag W/"62f56066-d8e3" Vary Accept-Encoding X-Frame-Options SAMEORIGIN Content-Type application/javascript; charset=utf-8 Cache-Control max-age=1800 Connection keep-alive Content-Length 4329 X-XSS-Protection 1; mode=block
GET H/1.1	200 OK	utag.js Show response static.wellsfargo.com/tracking/main/	318 KB 53 KB	24ms 16ms	Script application/javascript	23.200.55.23 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://static.wellsfargo.com/tracking/main/utag.js Requested by Host: 52.40.133.3 URL: https://52.40.133.3/wellsfargo/email.htm Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 23.200.55.23 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a23-200-55-23.deploy.static.akamaitechnologies.com Software / Resource Hash de30673d7384fd8ccb3a35e96ccc7b0d0799f22912ae5591fcd3d533ad7becf7 Security Headers Name Value Strict-Transport-Security max-age=31536000 ; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language jp-JP,jp;q=0.9 Referer https://52.40.133.3/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers Date Sun, 11 Dec 2022 16:07:45 GMT Content-Encoding gzip X-Content-Type-Options nosniff Strict-Transport-Security max-age=31536000 ; includeSubDomains Last-Modified Wed, 16 Nov 2022 21:08:13 GMT ETag W/"6375513d-4f786" Vary Accept-Encoding X-Frame-Options SAMEORIGIN Content-Type application/javascript; charset=utf-8 Cache-Control max-age=1800 Connection keep-alive Content-Length 53951 X-XSS-Protection 1; mode=block
GET DATA	200 OK	truncated /	6 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash f8cb039a63b11f207edf324bbfdabbbfaa2d421729785dca77020490c293185e Request headers accept-language jp-JP,jp;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers Content-Type image/svg+xml
GET H/1.1	404 Not Found	jquery.js 52.40.133.3/auth/static/scripts/	0 0	121ms 121ms	Script text/html	52.40.133.3 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://52.40.133.3/auth/static/scripts/jquery.js?v= Requested by Host: 52.40.133.3 URL: https://52.40.133.3/wellsfargo/email.htm Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 52.40.133.3 Boardman, United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-40-133-3.us-west-2.compute.amazonaws.com Software Apache / Resource Hash Request headers accept-language jp-JP,jp;q=0.9 Referer https://52.40.133.3/wellsfargo/email.htm User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers Date Sun, 11 Dec 2022 16:07:45 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=99 Content-Length 315 Content-Type text/html; charset=iso-8859-1
GET H/1.1	200 OK	sub.png 52.40.133.3/wellsfargo/	872 B 1 KB	243ms 121ms	Image image/png	52.40.133.3 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://52.40.133.3/wellsfargo/sub.png Requested by Host: 52.40.133.3 URL: https://52.40.133.3/wellsfargo/email.htm Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 52.40.133.3 Boardman, United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-40-133-3.us-west-2.compute.amazonaws.com Software Apache / Resource Hash 33e5f8366114562c3fb40a5e3ace24aadf8a66ac838bf7317d3c8eda01ad1c80 Request headers accept-language jp-JP,jp;q=0.9 Referer https://52.40.133.3/wellsfargo/email.htm User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers Date Sun, 11 Dec 2022 16:07:45 GMT Last-Modified Tue, 21 Sep 2021 01:29:06 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 872
GET H2	200	wellsfargoserif-rg.woff2 www15.wellsfargomedia.com/wfui/css/fonts/	26 KB 26 KB	11ms 5ms	Font font/woff2	23.2.132.13 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://www15.wellsfargomedia.com/wfui/css/fonts/wellsfargoserif-rg.woff2 Requested by Host: www10.wellsfargomedia.com URL: https://www10.wellsfargomedia.com/auth/static/css/wf-fonts.css?v= Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.2.132.13 Tokyo, Japan, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-2-132-13.deploy.static.akamaitechnologies.com Software / Resource Hash aeb7b3bfc4281d35b02dfde05ac7a6c0d3daa7f3123b35a9cbd4b5a8e3f3c310 Request headers Referer https://www10.wellsfargomedia.com/ Origin https://52.40.133.3 accept-language jp-JP,jp;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers unused62 8096267 date Sun, 11 Dec 2022 16:07:45 GMT last-modified Mon, 11 Mar 2019 20:52:01 GMT etag "5c86ca71-6854" content-type font/woff2 access-control-allow-origin * cache-control max-age=31536000 accept-ranges bytes content-length 26708 expires Mon, 11 Dec 2023 16:07:45 GMT
GET H2	200	wellsfargosans-rg.woff2 www15.wellsfargomedia.com/wfui/css/fonts/	22 KB 22 KB	10ms 4ms	Font font/woff2	23.2.132.13 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://www15.wellsfargomedia.com/wfui/css/fonts/wellsfargosans-rg.woff2 Requested by Host: www10.wellsfargomedia.com URL: https://www10.wellsfargomedia.com/auth/static/css/wf-fonts.css?v= Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.2.132.13 Tokyo, Japan, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-2-132-13.deploy.static.akamaitechnologies.com Software / Resource Hash 631f3b6267a831a8d67c45e480b5d5a2601f10ff8708bcf3a45a41b377a129cc Request headers Referer https://www10.wellsfargomedia.com/ Origin https://52.40.133.3 accept-language jp-JP,jp;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers unused62 8096267 date Sun, 11 Dec 2022 16:07:45 GMT last-modified Tue, 26 Feb 2019 19:38:34 GMT etag "5c7595ba-5798" content-type font/woff2 access-control-allow-origin * cache-control max-age=31536000 accept-ranges bytes content-length 22424 expires Mon, 11 Dec 2023 16:07:45 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Wells Fargo (Banking)

45 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontentvisibilityautostatechange boolean| utag_condload undefined| new_path object| utag_cfg_ovrd object| utag_data undefined| linkCanonical object| pagesToOptimize object| userAgentArr undefined| schemaDomain undefined| headTag undefined| loadschemaScripts object| dmtElems undefined| pathname undefined| urlArray undefined| url undefined| sRegExInput undefined| MDIGITAL_ON_PREM_PREFIX undefined| linkedIn_www_urlArray undefined| verizon_www_urlArray object| utag undefined| customDMPEvent undefined| getPayload undefined| fireDMPEvent function| isNotUndefinedOrNull function| getDocumentTitleLabel function| sendDataToGA function| closest function| previous_sibling function| getMtgApplyURL function| getMtgApplyAppInviteURL function| getMtgURL function| getMtgRatesURL function| getMtgRatesCalculatorURL function| getMtgRefinancURL function| getMtgFirstTimeHomeBuyerURL function| getMtgResultsURL function| getEquityURL function| getMtgCompareLoansURL function| getMtgComfortZoneURL boolean| __tealium_twc_switch function| utag_pad function| utag_visitor_id string| gtagRename object| dataLayer function| gtag

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://52.40.133.3/auth/static/scripts/jquery.js?v= Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

static.wellsfargo.com
www10.wellsfargomedia.com
www15.wellsfargomedia.com
23.2.132.13
23.2.142.77
23.200.55.23
52.40.133.3
04ea7cfd5a919efd82199cba5050a713ace204f4d92f7f85a2140b4a109ee26b
33e5f8366114562c3fb40a5e3ace24aadf8a66ac838bf7317d3c8eda01ad1c80
3a80ebe861b93c47265b21bc70a9fa88fc95e76f39cb291ad05b24597446ef8e
631f3b6267a831a8d67c45e480b5d5a2601f10ff8708bcf3a45a41b377a129cc
750284c53dc79db9ceeae1d6428a2b4ba2e23a40a910218fb16c44c63d7bf109
aeb7b3bfc4281d35b02dfde05ac7a6c0d3daa7f3123b35a9cbd4b5a8e3f3c310
b445132f71a00a242a272030d53a480d5e5977b27cbcb28c131cf8fdb326bd79
de30673d7384fd8ccb3a35e96ccc7b0d0799f22912ae5591fcd3d533ad7becf7
eaeccba3d96e1fe1f6a600ab5b9ebb2dc6bf06cac27ce733ce5b74bf3c85887f
f8cb039a63b11f207edf324bbfdabbbfaa2d421729785dca77020490c293185e