wllz-online-sysstem-com.preview-domain.com
Open in
urlscan Pro
2606:4700::6812:1878
Malicious Activity!
Public Scan
Effective URL: https://wllz-online-sysstem-com.preview-domain.com/wells/authen
Submission: On August 08 via automatic, source openphish — Scanned from DE
Summary
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on June 3rd 2022. Valid for: a year.
This is the only time wllz-online-sysstem-com.preview-domain.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Wells Fargo (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 2 | 2606:4700::68... 2606:4700::6812:1878 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 159.45.66.156 159.45.66.156 | 4196 (WELLSFARG...) (WELLSFARGO-4196) | |
1 | 23.7.201.53 23.7.201.53 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
3 | 23.6.126.246 23.6.126.246 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
7 | 4 |
ASN13335 (CLOUDFLARENET, US)
wllz-online-sysstem-com.preview-domain.com |
ASN16625 (AKAMAI-AS, US)
PTR: a23-7-201-53.deploy.static.akamaitechnologies.com
www10.wellsfargomedia.com |
ASN16625 (AKAMAI-AS, US)
PTR: a23-6-126-246.deploy.static.akamaitechnologies.com
www15.wellsfargomedia.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
wellsfargomedia.com
www10.wellsfargomedia.com — Cisco Umbrella Rank: 17378 www15.wellsfargomedia.com — Cisco Umbrella Rank: 20247 |
717 KB |
2 |
wellsfargo.com
connect.secure.wellsfargo.com — Cisco Umbrella Rank: 10672 |
20 KB |
2 |
preview-domain.com
1 redirects
wllz-online-sysstem-com.preview-domain.com |
21 KB |
7 | 3 |
Domain | Requested by | |
---|---|---|
3 | www15.wellsfargomedia.com |
connect.secure.wellsfargo.com
|
2 | connect.secure.wellsfargo.com |
wllz-online-sysstem-com.preview-domain.com
|
2 | wllz-online-sysstem-com.preview-domain.com | 1 redirects |
1 | www10.wellsfargomedia.com |
wllz-online-sysstem-com.preview-domain.com
|
7 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-06-03 - 2023-06-02 |
a year | crt.sh |
connect.secure.wellsfargo.com DigiCert EV RSA CA G2 |
2022-06-22 - 2023-06-22 |
a year | crt.sh |
www10.wellsfargomedia.com DigiCert TLS RSA SHA256 2020 CA1 |
2022-04-05 - 2023-04-05 |
a year | crt.sh |
www15.wellsfargomedia.com DigiCert SHA2 Secure Server CA |
2021-12-31 - 2023-01-03 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://wllz-online-sysstem-com.preview-domain.com/wells/authen
Frame ID: 2E099730F53F50D66FD275D09BCF99F5
Requests: 7 HTTP requests in this frame
Screenshot
Page Title
Sign On to View Your Personal Accounts | Wells FargoPage URL History Show full URLs
-
https://wllz-online-sysstem-com.preview-domain.com/wells/
HTTP 307
https://wllz-online-sysstem-com.preview-domain.com/wells/authen Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://wllz-online-sysstem-com.preview-domain.com/wells/
HTTP 307
https://wllz-online-sysstem-com.preview-domain.com/wells/authen Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
authen
wllz-online-sysstem-com.preview-domain.com/wells/ Redirect Chain
|
82 KB 21 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
wfui.3dc34704aa095fbbf839.chunk.css
connect.secure.wellsfargo.com/auth/static/ui/loginaltsignon/public/stylesheets/ |
98 KB 17 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main.62a557a6c2784a3722c9.chunk.css
connect.secure.wellsfargo.com/auth/static/ui/loginaltsignon/public/stylesheets/ |
11 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
COB-BOB-IRT-enroll_park.jpg
www10.wellsfargomedia.com/auth/static/images/ |
644 KB 646 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wellsfargosans-rg.woff2
www15.wellsfargomedia.com/wfui/css/fonts/ |
22 KB 22 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wellsfargosans-sbd.woff2
www15.wellsfargomedia.com/wfui/css/fonts/ |
22 KB 22 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wellsfargoserif-rg.woff2
www15.wellsfargomedia.com/wfui/css/fonts/ |
26 KB 26 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Wells Fargo (Banking)15 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation string| webId string| ndURI number| adrum-start-time object| adrum-config boolean| isReact object| mwfGlobals object| utag_data1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
wllz-online-sysstem-com.preview-domain.com/ | Name: cazanova Value: b0e7cb8a278aaf8cbfc14f21d91f88accb3a9d88 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
connect.secure.wellsfargo.com
wllz-online-sysstem-com.preview-domain.com
www10.wellsfargomedia.com
www15.wellsfargomedia.com
159.45.66.156
23.6.126.246
23.7.201.53
2606:4700::6812:1878
0ec17c78a8c0de92bd385f344308a3e0c715fedbb9b784820bd7aefcfc69c214
388f2ffe9aecbcf983f8d803ba670962125f24d73ee9326a8825c735e7be244a
5c433f5260a109d528f4b68f10535c74406b95e02db8b3055d26bb1abf233f9d
631f3b6267a831a8d67c45e480b5d5a2601f10ff8708bcf3a45a41b377a129cc
7fea627acd4a58ddab75dc10e4f2b430883141ede83b259aa871d62b9f6e55ec
ab9d8c97b35ed86b6224aca911aa304a0d7dbcbd28e00a4c6585b96e28ed30ba
aeb7b3bfc4281d35b02dfde05ac7a6c0d3daa7f3123b35a9cbd4b5a8e3f3c310