![](/screenshots/10602772-c567-4274-8e3e-d9e97cad7d73.png)
34-230-59-252.cprapid.com
Open in
urlscan Pro
34.230.59.252
Malicious Activity!
Public Scan
Effective URL: https://34-230-59-252.cprapid.com/wells/
Submission: On May 25 via manual from US
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on May 24th 2021. Valid for: a year.
This is the only time 34-230-59-252.cprapid.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Wells Fargo (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 198.71.233.51 198.71.233.51 | 26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC) | |
3 | 34.230.59.252 34.230.59.252 | 14618 (AMAZON-AES) (AMAZON-AES) | |
1 | 13.35.253.165 13.35.253.165 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2606:4700:10:... 2606:4700:10::ac43:88d | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 67.202.114.216 67.202.114.216 | 32748 (STEADFAST) (STEADFAST) | |
7 | 6 |
ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: ip-198-71-233-51.ip.secureserver.net
moredentalimplantleads.com |
ASN14618 (AMAZON-AES, US)
PTR: ec2-34-230-59-252.compute-1.amazonaws.com
34-230-59-252.cprapid.com |
ASN16509 (AMAZON-02, US)
PTR: server-13-35-253-165.fra6.r.cloudfront.net
dg6qn11ynnp6a.cloudfront.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
3 |
cprapid.com
34-230-59-252.cprapid.com |
2 KB |
2 |
amung.us
widgets.amung.us whos.amung.us |
4 KB |
1 |
cloudfront.net
dg6qn11ynnp6a.cloudfront.net |
31 KB |
1 |
moredentalimplantleads.com
moredentalimplantleads.com |
597 B |
7 | 4 |
Domain | Requested by | |
---|---|---|
3 | 34-230-59-252.cprapid.com |
moredentalimplantleads.com
34-230-59-252.cprapid.com |
1 | whos.amung.us |
widgets.amung.us
|
1 | widgets.amung.us |
34-230-59-252.cprapid.com
|
1 | dg6qn11ynnp6a.cloudfront.net |
34-230-59-252.cprapid.com
|
1 | moredentalimplantleads.com | |
7 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
34-230-59-252.cprapid.com cPanel, Inc. Certification Authority |
2021-05-24 - 2022-05-24 |
a year | crt.sh |
*.cloudfront.net DigiCert Global CA G2 |
2021-02-22 - 2022-02-21 |
a year | crt.sh |
whos.amung.us Sectigo RSA Domain Validation Secure Server CA |
2020-05-21 - 2022-05-21 |
2 years | crt.sh |
This page contains 2 frames:
Primary Page:
https://34-230-59-252.cprapid.com/wells/
Frame ID: 04FCC84FFF8B71915E884D64CEECE97B
Requests: 4 HTTP requests in this frame
Frame:
https://34-230-59-252.cprapid.com/wells/framei.php
Frame ID: 30BE13E8F5EE72571BF034596E01A7CE
Requests: 4 HTTP requests in this frame
Screenshot
![](/screenshots/10602772-c567-4274-8e3e-d9e97cad7d73.png)
Page URL History Show full URLs
- http://moredentalimplantleads.com/wls.html Page URL
- https://34-230-59-252.cprapid.com/wells/ Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://moredentalimplantleads.com/wls.html Page URL
- https://34-230-59-252.cprapid.com/wells/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
wls.html
moredentalimplantleads.com/ |
203 B 597 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
/
34-230-59-252.cprapid.com/wells/ |
1 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
gen_validatorv2.js
34-230-59-252.cprapid.com/wells/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
wellsfargo200x200.jpg
dg6qn11ynnp6a.cloudfront.net/wp-content/uploads/2016/02/02144636/ |
30 KB 31 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
framei.php
34-230-59-252.cprapid.com/wells/ Frame 30BE |
382 B 610 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
small.js
widgets.amung.us/ Frame 30BE |
8 KB 4 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
whos.amung.us/pingjs/ Frame 30BE |
29 B 145 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame 30BE |
439 B 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Wells Fargo (Banking)12 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Content-Type-Options | nosniff |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
34-230-59-252.cprapid.com
dg6qn11ynnp6a.cloudfront.net
moredentalimplantleads.com
whos.amung.us
widgets.amung.us
13.35.253.165
198.71.233.51
2606:4700:10::ac43:88d
34.230.59.252
67.202.114.216
0298a25db873588e37945ece2b90e9f573dda86bfc84ae9f3efb8c3fbdcbce84
1646d8da705ec396df601e73021a4723b5d14ec4a5f07c727f265e5f88215a75
29f4040102d66aba1a4aa46de325e6b12689d7b2abde3fb92768b5ba92599551
7d36345ccb6cfaf6af0e49bd04a5c0ef8150d737b013be595275a1ee9e2461dd
f2163d39d322368519ce2c0be0df0bd01b4f7b152d1f5b2dc098b3d0ff026be5
f6d82f567d08ec91a1b6ef0d4abf21be7a2d3dbc0a41c122584ea3536755b3ac