![](/screenshots/3546ff85-0e52-4c45-80aa-ac680ce3af97.png)
support-account.duckdns.org
Open in
urlscan Pro
34.135.218.55
Malicious Activity!
Public Scan
Submission: On November 19 via automatic, source openphish — Scanned from DE
Summary
TLS certificate: Issued by R3 on November 19th 2022. Valid for: 3 months.
This is the only time support-account.duckdns.org was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Wells Fargo (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 | 34.135.218.55 34.135.218.55 | 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM) | |
19 | 23.205.244.224 23.205.244.224 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
1 | 2606:4700:440... 2606:4700:4400::6812:2b9f | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
23 | 3 |
ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 55.218.135.34.bc.googleusercontent.com
support-account.duckdns.org |
ASN16625 (AKAMAI-AS, US)
PTR: a23-205-244-224.deploy.static.akamaitechnologies.com
www17.wellsfargomedia.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
19 |
wellsfargomedia.com
www17.wellsfargomedia.com — Cisco Umbrella Rank: 22484 |
209 KB |
3 |
duckdns.org
support-account.duckdns.org |
54 KB |
1 |
waldenu.edu
www.waldenu.edu — Cisco Umbrella Rank: 259985 |
146 KB |
23 | 3 |
Domain | Requested by | |
---|---|---|
19 | www17.wellsfargomedia.com |
support-account.duckdns.org
|
3 | support-account.duckdns.org |
support-account.duckdns.org
|
1 | www.waldenu.edu |
support-account.duckdns.org
|
23 | 3 |
This site contains links to these domains. Also see Links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
support-account.duckdns.org R3 |
2022-11-19 - 2023-02-17 |
3 months | crt.sh |
www17.wellsfargomedia.com DigiCert TLS RSA SHA256 2020 CA1 |
2022-06-09 - 2023-06-11 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-02-07 - 2023-02-06 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://support-account.duckdns.org/
Frame ID: 0C2E59C67B4631E94CAEA724DEC6AFCA
Requests: 23 HTTP requests in this frame
26 Outgoing links
These are links going to different origins than the main page.
Title: Credit Cards
Search URL Search Domain Scan URL
Title: Make an appointment
Search URL Search Domain Scan URL
Title: Wells Fargo Active Cash® Card Unlimited 2% cash rewards on purchases
Search URL Search Domain Scan URL
Title: Wells Fargo AutographSM Card Many ways to earn 3X points
Search URL Search Domain Scan URL
Title: Wells Fargo Reflect® Card Enjoy our lowest intro APR
Search URL Search Domain Scan URL
Title: Hotels.com® Rewards Visa® Credit Card Get closer to unlocking your next escape
Search URL Search Domain Scan URL
Title: Bilt World Elite Mastercard® Earn points on rent. And more.
Search URL Search Domain Scan URL
Title: Confirm credit card
Search URL Search Domain Scan URL
Title: Respond to mail offer
Search URL Search Domain Scan URL
Title: See my loan options
Search URL Search Domain Scan URL
Title: Current auto loan customers Sign in to make payments, view statements, set up alerts, and more
Search URL Search Domain Scan URL
Title: Enroll in Wells Fargo Online® Use online banking to manage your auto loan
Search URL Search Domain Scan URL
Title: Learn about electric vehicles
Search URL Search Domain Scan URL
Title: Make an appointment
Search URL Search Domain Scan URL
Title: Find a credit card Learn more
Search URL Search Domain Scan URL
Title: Wells Fargo Stories
Search URL Search Domain Scan URL
Title: Continue to Sign On
Search URL Search Domain Scan URL
Title: Continue
Search URL Search Domain Scan URL
Title: Continue
Search URL Search Domain Scan URL
Title: Continue
Search URL Search Domain Scan URL
Title: Continue
Search URL Search Domain Scan URL
Title: Continue
Search URL Search Domain Scan URL
Title: Continue
Search URL Search Domain Scan URL
Title: Continue
Search URL Search Domain Scan URL
Title: Continue
Search URL Search Domain Scan URL
Title: Continue
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
23 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
support-account.duckdns.org/ |
115 KB 15 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ps-homepage.css
support-account.duckdns.org/ui/css/homepage-ui/ |
165 KB 23 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wf_logo_220x23.png
www17.wellsfargomedia.com/assets/images/rwd/ |
2 KB 2 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Active-Cash-Card-79x50.png
www17.wellsfargomedia.com/assets/images/rwd/ |
852 B 1 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wf_autograph_card_79x50.jpg
www17.wellsfargomedia.com/assets/images/rwd/ |
1 KB 1 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Reflect-Card-79x50.png
www17.wellsfargomedia.com/assets/images/rwd/ |
712 B 897 B |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
h.com_card_79x50.png
www17.wellsfargomedia.com/assets/images/rwd/ |
2 KB 2 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bilt_card_79x50.png
www17.wellsfargomedia.com/assets/images/rwd/ |
1 KB 2 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
seo-1038-bs-washington-dc-usa-june-246176785-1200x675.jpg
www.waldenu.edu/-/media/walden/images/seo-article/ |
145 KB 146 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wfi000_ic_b-wf_icon_house_gradient_64x64.png
www17.wellsfargomedia.com/assets/images/contextual/responsive/smlprimary/ |
1004 B 1 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wfi000_ic_b-wf_icon_check_mark_gradient_64x64.png
www17.wellsfargomedia.com/assets/images/contextual/responsive/smlprimary/ |
1 KB 1 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wfi000_ic_b-wf_icon_ui_card_gradient_64x64.png
www17.wellsfargomedia.com/assets/images/contextual/responsive/smlprimary/ |
562 B 748 B |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
first_time_experience-account_summary.png
www17.wellsfargomedia.com/assets/images/rwd/ |
2 KB 3 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wfi_ph_g_1199830824_1600x700.jpg
www17.wellsfargomedia.com/assets/images/contextual/responsive/lpromo/ |
50 KB 51 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
support-account.duckdns.org/ |
15 KB 15 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
responsive-sprite-v7.png
www17.wellsfargomedia.com/assets/images/sprite/ |
47 KB 48 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
position-1-bg-gradient.png
www17.wellsfargomedia.com/assets/images/homepage/ |
2 KB 2 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
position-2-bg-gradient.png
www17.wellsfargomedia.com/assets/images/homepage/ |
2 KB 2 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
position-3-bg-gradient.png
www17.wellsfargomedia.com/assets/images/homepage/ |
2 KB 2 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wellsfargosans-rg.woff2
www17.wellsfargomedia.com/assets/fonts/ |
22 KB 22 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wellsfargosans-bd.woff2
www17.wellsfargomedia.com/assets/fonts/ |
22 KB 22 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wellsfargosans-sbd.woff2
www17.wellsfargomedia.com/assets/fonts/ |
22 KB 22 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wellsfargosans-lt.woff2
www17.wellsfargomedia.com/assets/fonts/ |
21 KB 21 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Wells Fargo (Banking)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| utag_data object| WFUI_CONTAINER0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
support-account.duckdns.org
www.waldenu.edu
www17.wellsfargomedia.com
23.205.244.224
2606:4700:4400::6812:2b9f
34.135.218.55
0d7727e08780a04f9c86fca16ed264664eea2b161744cfb70836880bf04fc1ac
10c22e3b130204065c1a61e7995a9defe21f0408801e8b442035a03f8d16ad64
13e436a4398e8f02f5285f12406abe4bce73e1ae0ccd5d5a14e56ee29b724cc3
50ce7b0d954443e5fd62e3cd003bc7124bda0b30dd58d6a66485c72be96959c0
5220e2267bf1d52810fa37112ed26e7d0d6a6f8cfaaa7d36c032b68562030d05
62da487c479bf8abb379fa4c87f24a986e9265b8bbbc19b38b2fca6dfbde35fd
631f3b6267a831a8d67c45e480b5d5a2601f10ff8708bcf3a45a41b377a129cc
63673faef8532b2789dee1ac7534f87b1a6a249590acc7da8644beda141794fc
659ec8c02bafa9c286c39731fb1d2d382a7a8dd2ee8cc4132146558dbe27b6a8
6bc7e16d4b6822a6867d7dd9f9d29f5fd77cd803750b0fe38a92309d9eb00704
749d47078866f2ebe0c2b692de339996ede393b570c7f73418ac0ed9a6882539
7867b0f1e4d21ebd684268360f820149578a15141a9128b57a97843c0fcb3b72
8e16030cdf2d91809d0540f79aa3a3be4b83e4a9bf13bd91def3962f1484406f
9730d81c67de0dae104be9a17b43a179e68557cc4a10a81c95fd451630d04b39
9bd4d77dfdadd6574d42e469c1968fffce0422134f4487f1d785367752743f96
9d7f1fe0833268a6a9468b9fc19436ffe00b8596c67131b09361467deaed1b76
ab9d8c97b35ed86b6224aca911aa304a0d7dbcbd28e00a4c6585b96e28ed30ba
b5b73fb58b90213e3e94e8bb2f2821ae968e4a14c736940a2a80673c5039919b
c2f04b9277e2158e498ea44ff61a651461ac7bcf0eed712b78fa8e21ae6eabfb
c9ed466cf80821ca1f76d41bc202afaf8c7d8bdb69cf0a36bb4c6cd06421f285
e037cf255bed27ebd83c682b368532fc925848a9ff0e42d97132ac995e43bbdf
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ea103ea932d2ebdd8e57887e4beabb394c21b6f260f49adfa8be4772cb61faec