urlscan.io logo urlscan.io
SecurityTrails logo

www.elportenio.com Open in urlscan Pro
104.21.58.169  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://www.elportenio.com/css/WellsFargoFinal/profile.php
Submission: On October 31 via automatic, source openphish — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 9 HTTP transactions. The main IP is 104.21.58.169, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.elportenio.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on July 18th 2021. Valid for: a year.
This is the only time www.elportenio.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Wells Fargo (Banking)

Domain & IP information

IP Address AS Autonomous System
8 104.21.58.169 13335 (CLOUDFLAR...)
1 172.217.18.97 15169 (GOOGLE)
9 3
Apex Domain
Subdomains		 Transfer
8 elportenio.com
www.elportenio.com
187 KB
1 blogspot.com
cssjas.blogspot.com
9 2
Domain Requested by
8 www.elportenio.com www.elportenio.com
1 cssjas.blogspot.com www.elportenio.com
9 2

This site contains no links.

Subject Issuer Validity Valid
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2021-07-18 -
2022-07-17		 a year crt.sh
misc-sni.blogspot.com
GTS CA 1C3		 2021-10-04 -
2021-12-27		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://www.elportenio.com/css/WellsFargoFinal/profile.php
Frame ID: 161192368BB14378F397956569720AD2
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Sign On to View Your Personal Accounts | Wells Fargo

Page Statistics

9
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

187 kB
Transfer

561 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request profile.php
www.elportenio.com/css/WellsFargoFinal/ 		10 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.elportenio.com/css/WellsFargoFinal/profile.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.21.58.169 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
862ac8453ce52bdca46b839fab85e8a95de37c8730cb6e08ec19e4872ede6936

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

date
Sun, 31 Oct 2021 13:13:26 GMT
content-type
text/html; charset=UTF-8
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1FNYPsUBPPdNhrSsdrMwsLANGSBXppg%2F%2B%2BRmaBOG6Mnfg3r4NPSFHP%2FgzrKsjq5Ysk26AK05oOnzOqGfZAyTi55Ppfk4l%2FdzQBCsxTd2OpdPBGTbbzxmrTt%2BHQb%2BFFcQi6K4CMg%3D"}],"group":"cf-nel","max_age":604800}
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
cf-ray
6a6d24015cdd05cc-FRA
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
angular.min.js
www.elportenio.com/css/WellsFargoFinal/style/js/ 		163 KB
58 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.elportenio.com/css/WellsFargoFinal/style/js/angular.min.js
Requested by
Host: www.elportenio.com
URL: https://www.elportenio.com/css/WellsFargoFinal/profile.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.21.58.169 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8c50aa8567731858e81bcfd2027718d9a7c8fd7bf54cf496499adbf5da5741b9

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.elportenio.com/css/WellsFargoFinal/profile.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Sun, 31 Oct 2021 13:13:26 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sun, 19 Nov 2017 03:55:28 GMT
server
cloudflare
age
4261
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6Ra5QLBmHwk%2FkMx1ceSQKsuRb9q%2FwSaVlgc7OFirHh1QcMlKJ%2F1QO8wS8PFZDJEXqF5RIZEtD0zsulgjSOWtVCifalYQMRB355WhMxq1LCR1Wpv7%2Ftfhmhn3Sf1U0iVTA2%2FAj%2Fk%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
6a6d2404fbfd05cc-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
jquery.min.js
www.elportenio.com/css/WellsFargoFinal/style/js/ 		286 KB
85 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.elportenio.com/css/WellsFargoFinal/style/js/jquery.min.js
Requested by
Host: www.elportenio.com
URL: https://www.elportenio.com/css/WellsFargoFinal/profile.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.21.58.169 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
692d421d5c163409a5918e802f507abbaa6bec90baa454c5252977a5b3b7ff0d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.elportenio.com/css/WellsFargoFinal/profile.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Sun, 31 Oct 2021 13:13:26 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sun, 03 Dec 2017 04:11:38 GMT
server
cloudflare
age
4261
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lcq3UgRS9291lGUO1kui9eKTqsz9g9Ku1y9tLMsHpXUZ252Df0q8o11aNT%2BLBX49UeVf2mhRAv6jlGUcJsfBAgO14eVikCRCqsoljGUUKWVDVyFuVW5ViSNJqMh8D1Qn9F2L6qs%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
6a6d2404fc0005cc-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
jquery.validate.min.js
www.elportenio.com/css/WellsFargoFinal/style/js/ 		49 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.elportenio.com/css/WellsFargoFinal/style/js/jquery.validate.min.js
Requested by
Host: www.elportenio.com
URL: https://www.elportenio.com/css/WellsFargoFinal/profile.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.21.58.169 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
95fa45a07af8d2be5412ce54289b24c7ff2c2f0d524eb69913b1bfe26b28e539

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.elportenio.com/css/WellsFargoFinal/profile.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Sun, 31 Oct 2021 13:13:26 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 20 Sep 2018 00:52:28 GMT
server
cloudflare
age
4261
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ioPrXa3KRRJ6wEpCR3tB0CqoHUVw0mYLDsPnjK1bpvtiPdxj%2BKGrxSGa4W5wHqbTVyH2exyW2V4uf6FNju34smxkOSb08WI%2Bf%2FssLOasbxiTD%2FzZS5bsiVkeFIWxbVH9GYWCdFE%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
6a6d2404fc0105cc-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
jquery.mask.js
www.elportenio.com/css/WellsFargoFinal/style/js/ 		18 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.elportenio.com/css/WellsFargoFinal/style/js/jquery.mask.js
Requested by
Host: www.elportenio.com
URL: https://www.elportenio.com/css/WellsFargoFinal/profile.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.21.58.169 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf1f0d954cbbbcb32d170b1ff68c5b082a1086f34f2bbee825ca88b7c9fb213a

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.elportenio.com/css/WellsFargoFinal/profile.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Sun, 31 Oct 2021 13:13:26 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 30 Jan 2016 12:57:28 GMT
server
cloudflare
age
4261
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gHSNrC3a%2BQsr0cvDF1wd%2FIZB0Eit1WK8mDNKIFtUhk2Kew6jKSmdltb4RcRung4YVbgVmLW0skvoTt0wfGoyhj%2F%2BpseJQQgm%2B3ThiaNXZ6k41u52ZXm0Sam7321A0Q7S9rg5krQ%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
6a6d2404fc0605cc-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
global.css
www.elportenio.com/css/WellsFargoFinal/style/css/ 		20 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.elportenio.com/css/WellsFargoFinal/style/css/global.css
Requested by
Host: www.elportenio.com
URL: https://www.elportenio.com/css/WellsFargoFinal/profile.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.21.58.169 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
13595f56fb54c7f67d92aaee693fe3d3e92455497ab7fcf990e63d8d07680ab4

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.elportenio.com/css/WellsFargoFinal/profile.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Sun, 31 Oct 2021 13:13:26 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 23 Oct 2018 05:09:26 GMT
server
cloudflare
age
4260
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CKRwMsjNRVhWBYsmQcmjq9gvMU8qCgG4jB1ZjjKnDotrj07dwN2c1PEGXdpgiRdOL%2BwgBSktfI4%2F9ik1vQZZTcMk4PtlOoKtPXzlUc9oOYz1auo%2B58mXxDRmAtjHp6AJ6SmFHRo%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
6a6d2404fc0205cc-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
logo.png
www.elportenio.com/css/WellsFargoFinal/style/css/ 		12 KB
13 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.elportenio.com/css/WellsFargoFinal/style/css/logo.png
Requested by
Host: www.elportenio.com
URL: https://www.elportenio.com/css/WellsFargoFinal/profile.php
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.21.58.169 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f809fa596dc2e66029e195d0aef2d6d7b077ea1f7d145455441ba893875aec41

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.elportenio.com/css/WellsFargoFinal/profile.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Sun, 31 Oct 2021 13:13:26 GMT
cf-cache-status
HIT
last-modified
Wed, 19 Sep 2018 23:06:52 GMT
server
cloudflare
age
4260
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RKQAHl2HiMRHZEmMO7ouG6VE%2BRcFWZFb%2BBcHIYAZYYZgkwt1nwBnpRvq28Wc1yogO7%2B%2Bh6Nv0GkT6DOMB4rqvtSIPDA8ERNDYhikwDE%2FtP%2Fan6sQLMk0YFtftriJ%2BG9jL1UFdlc%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
accept-ranges
bytes
cf-ray
6a6d24052f52696a-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
12501
rooro.png
www.elportenio.com/css/WellsFargoFinal/style/css/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.elportenio.com/css/WellsFargoFinal/style/css/rooro.png
Requested by
Host: www.elportenio.com
URL: https://www.elportenio.com/css/WellsFargoFinal/profile.php
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.21.58.169 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
17f3818bba16137fba7657230309043ae41cd08a5df25a7c61cd9583291c1354

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.elportenio.com/css/WellsFargoFinal/profile.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Sun, 31 Oct 2021 13:13:26 GMT
cf-cache-status
HIT
last-modified
Wed, 19 Sep 2018 23:07:32 GMT
server
cloudflare
age
4260
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hzFCIWeT21vlhTU5NgElX6qhsDyqNnp6qCfVULOfuKpqIQrAP5A9EZYDwwBu%2FoYagfzfzceyOOKNAPeXMKpC%2BrhaDT1QaPtIitaPDaia%2F7VGTfrLN4f8WFE25LmWzYva%2FLoMiK8%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
accept-ranges
bytes
cf-ray
6a6d24053f91696a-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
1098
/
cssjas.blogspot.com/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cssjas.blogspot.com/
Requested by
Host: www.elportenio.com
URL: https://www.elportenio.com/css/WellsFargoFinal/style/css/global.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.18.97 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
zrh04s05-in-f97.1e100.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.elportenio.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers
truncated
/ 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1ed889a15705bc76729d29d715c64f3d7f35de2ea519e1d2704924cf40d9e30d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Type
image/jpeg

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Wells Fargo (Banking)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler object| angular function| $ function| jQuery

0 Cookies