![](/screenshots/2640afad-5f72-4c75-9f8d-8e69c930f2b5.png)
onemedic.com.mx
Open in
urlscan Pro
107.180.40.21
Malicious Activity!
Public Scan
Submission: On September 26 via api from US — Scanned from DE
Summary
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on February 19th 2021. Valid for: a year.
This is the only time onemedic.com.mx was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Wells Fargo (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 2 | 107.180.40.21 107.180.40.21 | 26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC) | |
2 | 159.45.170.145 159.45.170.145 | 10837 (WELLSFARG...) (WELLSFARGO-10837) | |
17 | 23.79.128.179 23.79.128.179 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
6 | 23.79.140.155 23.79.140.155 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
1 | 2001:4de0:ac1... 2001:4de0:ac18::1:a:3a | 20446 (HIGHWINDS3) (HIGHWINDS3) | |
1 | 2606:4700::68... 2606:4700::6810:135e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700::68... 2606:4700::6812:bcf | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:812::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2606:4700::68... 2606:4700::6812:acf | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
31 | 9 |
ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: ip-107-180-40-21.ip.secureserver.net
onemedic.com.mx |
ASN16625 (AKAMAI-AS, US)
PTR: a23-79-128-179.deploy.static.akamaitechnologies.com
www01.wellsfargomedia.com |
ASN16625 (AKAMAI-AS, US)
PTR: a23-79-140-155.deploy.static.akamaitechnologies.com
www20.wellsfargomedia.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
23 |
wellsfargomedia.com
www01.wellsfargomedia.com www20.wellsfargomedia.com |
384 KB |
2 |
bootstrapcdn.com
maxcdn.bootstrapcdn.com stackpath.bootstrapcdn.com |
29 KB |
2 |
wellsfargo.com
www.wellsfargo.com |
15 KB |
2 |
onemedic.com.mx
1 redirects
onemedic.com.mx |
9 KB |
1 |
googleapis.com
ajax.googleapis.com |
30 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com |
7 KB |
1 |
jquery.com
code.jquery.com |
24 KB |
31 | 7 |
Domain | Requested by | |
---|---|---|
17 | www01.wellsfargomedia.com |
onemedic.com.mx
www.wellsfargo.com |
6 | www20.wellsfargomedia.com |
onemedic.com.mx
|
2 | www.wellsfargo.com |
onemedic.com.mx
|
2 | onemedic.com.mx | 1 redirects |
1 | stackpath.bootstrapcdn.com |
onemedic.com.mx
|
1 | ajax.googleapis.com |
onemedic.com.mx
|
1 | maxcdn.bootstrapcdn.com |
onemedic.com.mx
|
1 | cdnjs.cloudflare.com |
onemedic.com.mx
|
1 | code.jquery.com |
onemedic.com.mx
|
31 | 9 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
onemedic.com.mx Go Daddy Secure Certificate Authority - G2 |
2021-02-19 - 2022-03-23 |
a year | crt.sh |
www.wellsfargo.com DigiCert EV RSA CA G2 |
2020-07-11 - 2022-07-20 |
2 years | crt.sh |
www01.wellsfargomedia.com GeoTrust RSA CA 2018 |
2021-04-30 - 2022-05-11 |
a year | crt.sh |
www20.wellsfargomedia.com GeoTrust RSA CA 2018 |
2021-04-30 - 2022-05-11 |
a year | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2021-07-14 - 2022-08-14 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2021-09-21 - 2022-09-20 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2021-08-30 - 2021-11-22 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://onemedic.com.mx/wells-fargo-new-RD396-detail1/
Frame ID: 572FBFC95B41F984DD18A20E094FC79B
Requests: 31 HTTP requests in this frame
Screenshot
![](/screenshots/2640afad-5f72-4c75-9f8d-8e69c930f2b5.png)
Page Title
Wells Fargo – Banking, Credit Cards, Loans, Mortgages & MorePage URL History Show full URLs
-
https://onemedic.com.mx/wells-fargo-new-RD396-detail1
HTTP 301
https://onemedic.com.mx/wells-fargo-new-RD396-detail1/ Page URL
Detected technologies
![](/vendor/wappa/icons/Bootstrap.png)
Detected patterns
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
![](/vendor/wappa/icons/Popper.png)
Detected patterns
- /popper\.js/([0-9.]+)
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
- /([\d.]+)/jquery(?:\.min)?\.js
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://onemedic.com.mx/wells-fargo-new-RD396-detail1
HTTP 301
https://onemedic.com.mx/wells-fargo-new-RD396-detail1/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
31 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
onemedic.com.mx/wells-fargo-new-RD396-detail1/ Redirect Chain
|
65 KB 9 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
homepage_ret.css
www.wellsfargo.com/css/home/ |
51 KB 10 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
homepage-horz-logo.svg
www01.wellsfargomedia.com/assets/images/css/template/homepage/ |
5 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
homepage-lock.svg
www01.wellsfargomedia.com/assets/images/css/template/homepage/ |
2 KB 975 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
homepage-signon-lock.svg
www.wellsfargo.com/assets/images/css/template/homepage/ |
4 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
home_sprite_image.png
www01.wellsfargomedia.com/assets/images/css/template/homepage/ |
11 KB 11 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
6825911_gettyimages-1153899955_img_hph_1200x532.jpg
www20.wellsfargomedia.com/assets/images/contextual/banner/checking/1200x532/ |
57 KB 57 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wfi000_cash-wise-wallet_1200x532.jpg
www20.wellsfargomedia.com/assets/images/contextual/banner/credit-card/1200x532/ |
38 KB 38 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
6818104_gettyimages-890847206_1200_532.jpg
www20.wellsfargomedia.com/assets/images/contextual/banner/savings/1200x532/ |
44 KB 45 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icon-marquee-dot-active.svg
www01.wellsfargomedia.com/assets/images/css/template/homepage/ |
578 B 606 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icon-marquee-dot-inactive.svg
www01.wellsfargomedia.com/assets/images/css/template/homepage/ |
587 B 604 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wfi111_ic_nba_default2-gray_50x50.png
www20.wellsfargomedia.com/assets/images/contextual/banner/credit-card/50x50/ |
516 B 706 B |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
6825911_wf_icon_check_mark_50x50.png
www20.wellsfargomedia.com/assets/images/contextual/banner/checking/50x50/ |
528 B 748 B |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
6818104_cash-in-hand_icon_3b3331_50x50.png
www20.wellsfargomedia.com/assets/images/contextual/banner/savings/50x50/ |
652 B 872 B |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
task-icon-account-50x50.png
www01.wellsfargomedia.com/assets/images/homepage/ |
960 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
task-icon-rates-50x50.png
www01.wellsfargomedia.com/assets/images/homepage/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
FICO-phone-borrowing-and-credit-970x485.jpg
www01.wellsfargomedia.com/assets/images/photography/lifestyle/970x485/ |
26 KB 27 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
paying-phone-beach-banking-made-easy-970x485.jpg
www01.wellsfargomedia.com/assets/images/photography/lifestyle/970x485/ |
33 KB 33 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
couple-beach-retirement-970x485.jpg
www01.wellsfargomedia.com/assets/images/photography/lifestyle/970x485/ |
31 KB 31 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
couple-moving-in-homelending-970x485.jpg
www01.wellsfargomedia.com/assets/images/photography/lifestyle/970x485/ |
34 KB 34 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
student-graduation-going-to-college-970x485.jpg
www01.wellsfargomedia.com/assets/images/photography/lifestyle/970x485/ |
34 KB 35 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
woman-tablet-investing-basics-970x485.jpg
www01.wellsfargomedia.com/assets/images/photography/lifestyle/970x485/ |
28 KB 28 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
woman_checking_tablet_device.jpg
www01.wellsfargomedia.com/assets/images/photography/lifestyle/970x485/ |
28 KB 29 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
homepage_footer_stagecoach.svg
www01.wellsfargomedia.com/assets/images/global/ |
14 KB 6 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.2.1.slim.min.js
code.jquery.com/ |
68 KB 24 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
popper.min.js
cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/ |
19 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/ |
48 KB 14 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ |
84 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/ |
50 KB 15 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
homepage-magnifying-glass.png
www01.wellsfargomedia.com/assets/images/css/template/homepage/ |
236 B 456 B |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icn-uti-checkbox.svg
www01.wellsfargomedia.com/assets/images/css/template/homepage/ |
728 B 647 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Wells Fargo (Banking)6 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect boolean| originAgentCluster function| $ function| jQuery function| Popper object| bootstrap0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
cdnjs.cloudflare.com
code.jquery.com
maxcdn.bootstrapcdn.com
onemedic.com.mx
stackpath.bootstrapcdn.com
www.wellsfargo.com
www01.wellsfargomedia.com
www20.wellsfargomedia.com
107.180.40.21
159.45.170.145
2001:4de0:ac18::1:a:3a
23.79.128.179
23.79.140.155
2606:4700::6810:135e
2606:4700::6812:acf
2606:4700::6812:bcf
2a00:1450:4001:812::200a
004590468c4ed29e2b9ac5192217c685059d0d623e4398c49cdb4a0b5a386831
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
09504bdecbf274d2b3322b86c6cc699a186b4656cc220d563fcbfb08df220b08
14ebe41c047e0cfca8e17b68f81bc0f980b75321c35d784360cf3491b1f9a06d
16b5311ddbd849fd1808d3d855f79d9640417d7c65714ffec6f6bb6f17416883
439e6c4f53727e4e9508ecea1298f043e2850fefb140c3cd9eb15b330743d040
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
5d9b0cc56c91ab12ec75723842b74f37a77d02dc70904dd7c153b04ad3af284b
780b98a3861aa8d4afe428953ad3b9e988a74cd5f064b4a1eb453f5d901221e7
7926323a712a1fa861283bbdbde6f6df758e3a39c418fe1459f2b5dbe18102be
7b1acbecc92198d28a194bab0fa46dd84878d9cb78f3e2bbbd4ba771ef168ebd
7bfab3d904c5effc47fe1577c20615a1efcf84f2a6e1b8e5ccaa501ac657fcab
831150f5bd06a7701451029da2c866c0b936bdb142262a6d62180fee0f87b7ba
8dc5436dce4423f0e53e85904b6dc0552c1c8bbde0dd4ec1c929a1c272201c4c
8dd5481f66610c830acc8ed072d8b7bfe7ddc27dc3d58c6651112d79b3c2f670
9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398
99d1c8cdf8f9d69e2f1d8fdddea3fce041675b0b475388e7bf761c067848f462
9fb3c29fc277b8b6a9dc86c8cb00c686ee9404213c21cea0d4ff64e6851039a6
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
aee5245049750ff1e0f9368e3f69e0804e637539bb95c22db5325f884fbe5e9e
bad076c316b96cc04b2df0418f986f332e01ff6016eab56fa116a4ef4c9ca594
bfc829bbda3f304a823d51b86da1b430a18afcaa3d6859bd40e8372eed12e7f2
c0f467eb127e772785d0dacfc03c3231dd7ab659da91e0666cd8e12b51a5f32b
cfd4c24ae595a860f108f4de55ce9a1744bad06d612d508c4d0bf39901b9862c
d510b44eb432254133e3a77667c96ea0eee0a356614ef7938c0cab6b5d7fbcd9
d6e3a5a263a697df3e5989b893e27ac29972dd9346b01da3e5476becb9a73a25
d6f9a6d48f3d43b2f7004bb3f1bea032abe36c545087c45907bf36f6d1949bc6
d6fdad356ecabcdcfb77a0486b3e240f450369e0304739e55c71a112d5f3d2df
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b
ea4b20ddecd76a86c3dc31d488970cf15e6284756c271b1d983f597652ebeb61
eb38bf6136b9b597e78c4a80f041d4e3bbc9231b348e999ba5aa1e52ec2bbd0f