![](/screenshots/219afd72-cd6c-4f1e-8b81-fa3854baeddf.png)
mediere-croma.ro
Open in
urlscan Pro
176.223.96.43
Malicious Activity!
Public Scan
Submission: On September 08 via automatic, source openphish
Summary
This is the only time mediere-croma.ro was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Wells Fargo (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 176.223.96.43 176.223.96.43 | 57746 (MACOSOFT-AS) (MACOSOFT-AS) | |
7 | 104.108.33.238 104.108.33.238 | 16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies) | |
4 | 159.45.2.145 159.45.2.145 | 10837 (WELLSFARG...) (WELLSFARGO-10837 - Wells Fargo & Company) | |
12 | 3 |
ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-108-33-238.deploy.static.akamaitechnologies.com
www01.wellsfargomedia.com |
ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US)
www.wellsfargo.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
wellsfargomedia.com
www01.wellsfargomedia.com |
49 KB |
4 |
wellsfargo.com
www.wellsfargo.com |
68 KB |
1 |
mediere-croma.ro
mediere-croma.ro |
12 KB |
12 | 3 |
Domain | Requested by | |
---|---|---|
7 | www01.wellsfargomedia.com |
mediere-croma.ro
|
4 | www.wellsfargo.com |
mediere-croma.ro
|
1 | mediere-croma.ro | |
12 | 3 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.wellsfargo.com |
online.wellsfargo.com |
www.wellsfargoblogs.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
www01.wellsfargomedia.com GeoTrust SSL CA - G3 |
2016-09-27 - 2017-12-27 |
a year | crt.sh |
www.wellsfargo.com Symantec Class 3 Secure Server CA - G4 |
2017-01-31 - 2019-02-01 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
http://mediere-croma.ro/plugins/system/highlight/secure/wellsfargo.com/wellsfargo-online/identity.php
Frame ID: 16280.1
Requests: 12 HTTP requests in this frame
Screenshot
![](/screenshots/219afd72-cd6c-4f1e-8b81-fa3854baeddf.png)
Detected technologies
![](/vendor/wappa/icons/FrontPage.png)
Detected patterns
- meta generator /Microsoft FrontPage(?:\s((?:Express )?[\d.]+))?/i
Detected patterns
- url /\.php(?:$|\?)/i
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
Page Statistics
20 Outgoing links
These are links going to different origins than the main page.
Title: Skip to content
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title: Customer Service
Search URL Search Domain Scan URL
Title: ATMs/Locations
Search URL Search Domain Scan URL
Title: Espa?l
Search URL Search Domain Scan URL
Title: Small Business
Search URL Search Domain Scan URL
Title: Commercial
Search URL Search Domain Scan URL
Title: Financial Education
Search URL Search Domain Scan URL
Title: About Wells Fargo
Search URL Search Domain Scan URL
Title: Help
Search URL Search Domain Scan URL
Title: Help
Search URL Search Domain Scan URL
Title: Why do we need to know this?
Search URL Search Domain Scan URL
Title: Careers
Search URL Search Domain Scan URL
Title: PRIVACY, Security & Legal
Search URL Search Domain Scan URL
Title: Report Fraud
Search URL Search Domain Scan URL
Title: Sitemap
Search URL Search Domain Scan URL
Title: Diversity & Accessibility
Search URL Search Domain Scan URL
Title: Online Access Agreement
Search URL Search Domain Scan URL
Title: Blogs & Social Media
Search URL Search Domain Scan URL
Title: Learn More
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
identity.php
mediere-croma.ro/plugins/system/highlight/secure/wellsfargo.com/wellsfargo-online/ |
12 KB 12 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
homepage.css
www01.wellsfargomedia.com/css/home/ |
63 KB 16 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
wf-logo.gif
www01.wellsfargomedia.com/assets/images/global/ |
4 KB 4 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
stagecoach.jpg
www01.wellsfargomedia.com/assets/images/global/ |
5 KB 5 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon-equal-housing.gif
www01.wellsfargomedia.com/assets/images/global/ |
776 B 776 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
user-prefs.js
www.wellsfargo.com/javascript/ |
12 KB 5 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.js
www.wellsfargo.com/js/frameworks/jq/ |
96 KB 33 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
home.js
www.wellsfargo.com/js/global/ |
113 KB 29 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
tas.js
www.wellsfargo.com/js/global/ |
3 KB 1 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sprite-homepage.png
www01.wellsfargomedia.com/assets/images/css/ |
22 KB 22 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
btn-icon-search.png
www01.wellsfargomedia.com/assets/images/css/template/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bg-footer.png
www01.wellsfargomedia.com/assets/images/css/template/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Wells Fargo (Banking)0 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
mediere-croma.ro
www.wellsfargo.com
www01.wellsfargomedia.com
104.108.33.238
159.45.2.145
176.223.96.43
1ed889a15705bc76729d29d715c64f3d7f35de2ea519e1d2704924cf40d9e30d
1f55cd70e90f5dcc98ed0b5555f10259828e3084d36d0567b15b35e5bd523823
297662a85dae4b1360d8a87cf7cfa04bf36608c0d290c2ece76fdd35da059b0a
336e737bec5ca6ebdb4877faf62304f9d75a9cd30154d82a9a33db9b8aaf320c
397bf475ca4b12d3595efbfebb09b9dff2529df4c3a55e5a3bbe7fab0a5cefe7
565263d801f4fd62e36c1808df02ba171fc66b25e10392a53bc7f2f996436097
64f941b34d5f011e147a837d1f30eb3f89c51c16dc0f459523c74f631f0e7049
84bbaa858fe566665f3d4b5c97431c4e56d8a023fc72615a27d0171614851886
8784635b44663acc6868117191a30671f40c051bfd0db9bdbe2a994243882f52
da38fd7d6d2e1425dc8fecba13e64cd220d4f34d7c7d3ae76f9916d3b489b5d2
dc9402ae4b104a52590d04c1904e8b9a2e21bbb5f30a52f7659ee7ef36463964
edc5ee3b590dae17b0eb19063c34680c15ee144d13583d006e6a7976b69cd2db