urlscan.io logo urlscan.io
SecurityTrails logo

connectwellsfrgo.click Open in urlscan Pro
2a06:98c1:3121::3  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://auth-wells6578.dyndns.info/
Effective URL: https://connectwellsfrgo.click/?wells
Submission Tags: @ecarlesi possiblethreat phishing Search All
Submission: On December 09 via api from IT — Scanned from IT
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 6 HTTP transactions. The main IP is 2a06:98c1:3121::3, located in United States and belongs to CLOUDFLARENET, US. The main domain is connectwellsfrgo.click.
TLS certificate: Issued by E1 on December 8th 2023. Valid for: 3 months.
This is the only time connectwellsfrgo.click was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 172.173.151.226 8075 (MICROSOFT...)
1 6 2a06:98c1:312... 13335 (CLOUDFLAR...)
6 2
Apex Domain
Subdomains		 Transfer
6 connectwellsfrgo.click
connectwellsfrgo.click
14 KB
1 dyndns.info
auth-wells6578.dyndns.info
3 KB
6 2
Domain Requested by
6 connectwellsfrgo.click 1 redirects auth-wells6578.dyndns.info
connectwellsfrgo.click
1 auth-wells6578.dyndns.info
6 2

This site contains no links.

Subject Issuer Validity Valid
auth-wells6578.dyndns.info
R3		 2023-12-09 -
2024-03-08		 3 months crt.sh
connectwellsfrgo.click
E1		 2023-12-08 -
2024-03-07		 3 months crt.sh

This page contains 2 frames:

Primary Page: https://connectwellsfrgo.click/?wells
Frame ID: 46162D50B5C1BF3610F6FB8FAF6C2FA8
Requests: 4 HTTP requests in this frame

Frame: https://connectwellsfrgo.click/cdn-cgi/challenge-platform/h/b/scripts/jsd/56d3063b/main.js
Frame ID: AD5C3311EE6F10B7830FF023CE3C8968
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

403 Forbidden

Page URL History Show full URLs

  1. https://auth-wells6578.dyndns.info/ Page URL
  2. https://connectwellsfrgo.click/?wells Page URL
  3. https://connectwellsfrgo.click/?wells Page URL

Page Statistics

6
Requests

83 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

17 kB
Transfer

18 kB
Size

12
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://auth-wells6578.dyndns.info/ Page URL
  2. https://connectwellsfrgo.click/?wells Page URL
  3. https://connectwellsfrgo.click/?wells Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 3
  • https://connectwellsfrgo.click/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
  • https://connectwellsfrgo.click/cdn-cgi/challenge-platform/h/b/scripts/jsd/56d3063b/main.js

6 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
auth-wells6578.dyndns.info/ 		3 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://auth-wells6578.dyndns.info/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
172.173.151.226 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Apache /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language
it-IT,it;q=0.9

Response headers

Accept-Ranges
bytes
Connection
Keep-Alive
Content-Length
2926
Content-Type
text/html
Date
Sat, 09 Dec 2023 01:26:43 GMT
Keep-Alive
timeout=5, max=100
Last-Modified
Sat, 09 Dec 2023 01:14:39 GMT
Server
Apache
/
connectwellsfrgo.click/ 		7 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://connectwellsfrgo.click/?wells
Requested by
Host: auth-wells6578.dyndns.info
URL: https://auth-wells6578.dyndns.info/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e9133c8ce684fdc8b972887c0b044777e0cb768e0163baa6dd8afcb1f43dd3af
Security Headers
Name Value
X-Content-Type-Options nosniff nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block 1; mode=block

Request headers

Referer
https://auth-wells6578.dyndns.info/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language
it-IT,it;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
public, max-age=0 no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-cache-status
DYNAMIC
cf-ray
832976287ad44c57-MXP
content-type
text/html; charset=utf-8
date
Sat, 09 Dec 2023 01:26:43 GMT
expires
0
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma
no-cache
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SLGFph8mCKC%2ByPU51v69V1j3R7ZQqtp69vuC3RG6Ljfl%2BYwKpx3upC8D56X%2BTW1%2Bj%2BbeyCsTbU4GVUE8ebMBAW3Yp7H6QhSZZIaRxcBZ2vgaxZuvYo98jyemB%2BQ5nlBJgqtsDPsbmnzYzPvqB5Dh3%2FVYa9nF"}],"group":"cf-nel","max_age":604800}
server
cloudflare
x-content-type-options
nosniff nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block 1; mode=block
/
connectwellsfrgo.click/ 		0
756 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://connectwellsfrgo.click/?wells
Requested by
Host: auth-wells6578.dyndns.info
URL: https://auth-wells6578.dyndns.info/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff, nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block, 1; mode=block

Request headers

X-Requested-TimeStamp-Expire
accept-language
it-IT,it;q=0.9
VXnD-18iJYq1rWdhyVrfO5yvClo
4II2ZieRccDrPi-IsFW-aQOZYQ
X-Requested-TimeStamp-Combination
X-Requested-Type-Combination
GET
Content-type
application/x-www-form-urlencoded
bYB0Onutdmnhwj5ZCpzwYXXAV1M
28353231
X-Requested-Type
GET
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Referer
https://connectwellsfrgo.click/?wells
X-Requested-with
XMLHttpRequest
X-Requested-TimeStamp

Response headers

pragma
no-cache
date
Sat, 09 Dec 2023 01:26:44 GMT
x-server-powered-by
Engintron
x-content-type-options
nosniff, nosniff
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VFtOIyzLOu329SSoObbNcUirU%2F5CDVyD1nLEdKlncvVSrOXppu1%2F5X31MyCWVFN1QOYjM7biUuY1a%2BhjD4hqBcJ04z8mikl%2Fc08%2BUixTJoZTsZJUnMfzrhzDa3dAcEFPRz4C%2BUwRHbdH4cioxPJKsRh%2BnAmH"}],"group":"cf-nel","max_age":604800}
cache-control
public, max-age=0 no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray
8329762bcc374c57-MXP
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block, 1; mode=block
expires
0
main.js
connectwellsfrgo.click/cdn-cgi/challenge-platform/h/b/scripts/jsd/56d3063b/ Frame AD5C
Redirect Chain
  • https://connectwellsfrgo.click/cdn-cgi/challenge-platform/scripts/jsd/main.js
  • https://connectwellsfrgo.click/cdn-cgi/challenge-platform/h/b/scripts/jsd/56d3063b/main.js
7 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connectwellsfrgo.click/cdn-cgi/challenge-platform/h/b/scripts/jsd/56d3063b/main.js
Protocol
H2
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
98dc1085ac5f81bf2fbbd79522bef23438003b934727d44b6e980b99f4886b77
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
it-IT,it;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date
Sat, 09 Dec 2023 01:26:43 GMT
content-encoding
br
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
accept-encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ggrv%2Fu5qoU2HWjp3RIrPrIdzrC77wJm8fIoxSFwg%2F%2FIy%2BNkqDsrtielImHBdIDmzh8DriXB%2BGOrSbwaeQ7GjsnQs%2BxBhLIrDI%2B%2BREhH%2FnL1fHHdhiqqPmqenD%2FCWgHtavDXDD65hrbltrI04P8x%2BxmwGWJrf"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=UTF-8
cache-control
max-age=14400, public
cf-ray
8329762bfc494c57-MXP
alt-svc
h3=":443"; ma=86400

Redirect headers

date
Sat, 09 Dec 2023 01:26:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
accept-encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Hg5bmQTrhlM3epTgxay34VNCzhBvVCrhBKsqcPQHpu%2FCN2UYCrE6YBOwfgV2wIorpXMUv0W4KuT29ZlB0RfovGQprwGoJVHvArBgfloaPD46EvcrozhBo27Tq6Y%2BqCb2OMYDvAMn8hmf4i3x1lgqp3OKQFnU"}],"group":"cf-nel","max_age":604800}
location
/cdn-cgi/challenge-platform/h/b/scripts/jsd/56d3063b/main.js
access-control-allow-origin
*
cache-control
max-age=300, public
cf-ray
8329762bcc3a4c57-MXP
alt-svc
h3=":443"; ma=86400
832976287ad44c57
connectwellsfrgo.click/cdn-cgi/challenge-platform/h/b/jsd/r/ Frame AD5C 		0
608 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://connectwellsfrgo.click/cdn-cgi/challenge-platform/h/b/jsd/r/832976287ad44c57
Requested by
Host: connectwellsfrgo.click
URL: https://connectwellsfrgo.click/cdn-cgi/challenge-platform/scripts/jsd/main.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
accept-language
it-IT,it;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type
application/json

Response headers

date
Sat, 09 Dec 2023 01:26:43 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6HXA2WzJu97h6QnQTFSILt%2By19y2QbUzpCrmAA7NJwgb2zUErlB5ywUMOcSFNPqoavVzNmM84VrkU%2BL9WsAX2AhrRqiG%2FJYoDjlufiUYZiNNlXSOeoApO248uE7Gsra7vcI%2Bc067SCJ%2BCk0yF5%2F1nVcuzr7K"}],"group":"cf-nel","max_age":604800}
content-type
text/plain; charset=UTF-8
cf-ray
8329762c9f6959d7-MXP
alt-svc
h3=":443"; ma=86400
Primary Request /
connectwellsfrgo.click/ 		548 B
565 B 		Document
General
Check archive.org
Download Go to
Full URL
https://connectwellsfrgo.click/?wells
Requested by
Host: auth-wells6578.dyndns.info
URL: https://auth-wells6578.dyndns.info/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
25fb23868ebf48348f9e438e00cb9b9d9b3a054f32482a781c762cc4f9cc6393
Security Headers
Name Value
X-Content-Type-Options nosniff nosniff
X-Xss-Protection 1; mode=block 1; mode=block

Request headers

Referer
https://connectwellsfrgo.click/?wells
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language
it-IT,it;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
8329762d6fc659d7-MXP
content-encoding
br
content-type
text/html
date
Sat, 09 Dec 2023 01:26:44 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=c45e8o2hAcAVA5%2FRSeT4RuGFUk8767uxaRKjMz6JwkQkbm1AmIvU7xpFAVkqDW%2BfSg6QU9%2BXewYxYaXBbh%2Fomg5ch2U7TO5dBXiyVbPffRlFiD3NGLvEoShsVGMzYhvJXLewSW3u9KkksixnfeO2X13Mr2n5"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
x-content-type-options
nosniff nosniff
x-xss-protection
1; mode=block 1; mode=block

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture

12 Cookies

Domain/Path Name / Value
connectwellsfrgo.click/ Name: WNNpUV2kpJdA46PkT64BZ5UERQM
Value: qxeyLumGVVD5RqTgPjFKbRqPTXY
connectwellsfrgo.click/ Name: EvPWbybm-gt46vXOM_qZPoXBGXI
Value: 1702085198
connectwellsfrgo.click/ Name: lZz9pOCKCsLOS772m9M4U3qlU7M
Value: 1702171598
connectwellsfrgo.click/ Name: _aThwXgPabYYnJSfwv0jdsyMmY8
Value: 9Z_74yyyaWsB0aE39robM3FkZu4
connectwellsfrgo.click/ Name: Z0emZrOHdYuJqvxteBv_eCgvtCA
Value: kQHYfXJJNeYBIuRAhdZILW7TPec
connectwellsfrgo.click/ Name: W2j4t_6fNNJxVN8VDsZveMQSPVg
Value: p_UWGoAcjKTH5VL5l3oKcaSzrSY
.connectwellsfrgo.click/ Name: cf_clearance
Value: TXc2kppHTtkcd3Xy7W7xvXM2zJOc_y78bTMpDUsI_FU-1702085203-0-1-67fd6868.5800db09.fab1868-0.2.1702085203
connectwellsfrgo.click/ Name: gHeSeMPjMj5h6ONx9h-mkxRhUn0
Value: BfItWtDbzRMqyAsZTvq23Oc5Yjw
connectwellsfrgo.click/ Name: OG-_mZBJjCciLNcu2xzLZkDvHF0
Value: 1702085203
connectwellsfrgo.click/ Name: 3fHC33Ee--svA3NLGaOsA01SE6I
Value: 1702171603
connectwellsfrgo.click/ Name: ADke-BK62X1bQwoFMFFEYf6Jag4
Value: 5erkHEyAlYmEOpxGTYWwGETedgk
connectwellsfrgo.click/ Name: EbDmgJaBrsBb_xwKDHRVjT3x6j0
Value: aS4eq7gwBhOLEZlUTn7xOAxhKVc

2 Console Messages

Source Level URL
Text
network error URL: https://connectwellsfrgo.click/?wells
Message:
Failed to load resource: the server responded with a status of 503 ()
network error URL: https://connectwellsfrgo.click/?wells
Message:
Failed to load resource: the server responded with a status of 403 ()