www.neturja.com
Open in
urlscan Pro
173.82.211.58
Malicious Activity!
Public Scan
URL:
http://www.neturja.com/well/wellsfargo_internetbanking/onlinebanking/question.php
Submission: On March 26 via automatic, source openphish
Submission: On March 26 via automatic, source openphish
Summary
This website contacted 4 IPs
in 3 countries
across 5 domains to perform 23 HTTP transactions.
The main IP is 173.82.211.58, located in
Canyon Country, United States and
belongs to MULTA-ASN1 - MULTACOM CORPORATION, US.
The main domain is www.neturja.com.
This is the only time www.neturja.com was scanned on urlscan.io!
This is the only time www.neturja.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Wells Fargo (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 21 | 173.82.211.58 173.82.211.58 | 35916 (MULTA-ASN1) (MULTA-ASN1 - MULTACOM CORPORATION) | |
| 1 2 | 89.207.16.157 89.207.16.157 | 25751 (VALUECLICK) (VALUECLICK - Conversant) | |
| 1 1 | 64.158.223.140 64.158.223.140 | 25751 (VALUECLICK) (VALUECLICK - Conversant) | |
| 1 1 | 104.18.41.241 104.18.41.241 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
| 1 | 104.31.70.67 104.31.70.67 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
| 23 | 4 |
21
173.82.211.58
(Canyon Country, United States)
ASN35916 (MULTA-ASN1 - MULTACOM CORPORATION, US)
PTR: blinux.thesecurededicatedserver.com
ASN35916 (MULTA-ASN1 - MULTACOM CORPORATION, US)
PTR: blinux.thesecurededicatedserver.com
| www.neturja.com |
1
64.158.223.140
(Amsterdam, Netherlands)
ASN25751 (VALUECLICK - Conversant, Inc., US)
PTR: ams02-login.dotomi.com
ASN25751 (VALUECLICK - Conversant, Inc., US)
PTR: ams02-login.dotomi.com
| ams-login.dotomi.com |
1
104.18.41.241
(San Francisco, United States)
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
| www.superfish.com |
1
104.31.70.67
(San Francisco, United States)
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
| www.theravo.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 21 |
neturja.com
www.neturja.com |
127 KB |
| 2 |
mediaplex.com
1 redirects
adfarm.mediaplex.com |
1 KB |
| 1 |
theravo.com
www.theravo.com |
|
| 1 |
superfish.com
1 redirects
www.superfish.com |
360 B |
| 1 |
dotomi.com
1 redirects
ams-login.dotomi.com |
446 B |
| 23 | 5 |
| Domain | Requested by | |
|---|---|---|
| 21 | www.neturja.com |
www.neturja.com
|
| 2 | adfarm.mediaplex.com |
1 redirects
www.neturja.com
|
| 1 | www.theravo.com |
www.neturja.com
|
| 1 | www.superfish.com | 1 redirects |
| 1 | ams-login.dotomi.com | 1 redirects |
| 23 | 5 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| online.wellsfargo.com |
| www.wellsfargo.com |
| Subject Issuer | Validity | Valid |
|---|
This page contains 1 frames:
Primary Page:
http://www.neturja.com/well/wellsfargo_internetbanking/onlinebanking/question.php
Frame ID: F92319778DE3F85B0087A124ECE8689
Requests: 24 HTTP requests in this frame
Screenshot
Detected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- url /\.php(?:$|\?)/i
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
Lightbox
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- script /lightbox.*\.js/i
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- script /jquery.*\.js/i
- env /^jQuery$/i
- script /jquery-ui.*\.js/i
jQuery UI
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- script /jquery-ui.*\.js/i
Page Statistics
21 Outgoing links
These are links going to different origins than the main page.
URL: https://online.wellsfargo.com/das/cgi-bin/session.cgi?sessargs=bSS6ljiprqaeQswrFfSEfpqPtUErlm5K
Search URL Search Domain Scan URL
URL: https://www.wellsfargo.com/
Search URL Search Domain Scan URL
URL: https://www.wellsfargo.com/auxiliary_access/aa_talkatmloc
Search URL Search Domain Scan URL
URL: https://online.wellsfargo.com/das/channel/enrollDisplay?LOB=CONS&OFFERCODE=WEB&#skip
Search URL Search Domain Scan URL
URL: https://www.wellsfargo.com/help/
Title: Customer Service
Title: Customer Service
Search URL Search Domain Scan URL
URL: https://www.wellsfargo.com/locator/
Title: Locations
Title: Locations
Search URL Search Domain Scan URL
URL: https://www.wellsfargo.com/products_services/applications_viewall.jhtml
Title: Apply
Title: Apply
Search URL Search Domain Scan URL
URL: https://www.wellsfargo.com/per/more/banking
Title: Banking
Title: Banking
Search URL Search Domain Scan URL
URL: https://www.wellsfargo.com/per/more/loans_credit
Title: Loans & Credit
Title: Loans & Credit
Search URL Search Domain Scan URL
URL: https://www.wellsfargo.com/insurance/
Title: Insurance
Title: Insurance
Search URL Search Domain Scan URL
URL: https://www.wellsfargo.com/investing/more
Title: Investing
Title: Investing
Search URL Search Domain Scan URL
URL: https://www.wellsfargo.com/help/enroll.jhtml
Title: Online Banking Enrollment
Title: Online Banking Enrollment
Search URL Search Domain Scan URL
URL: https://www.wellsfargo.com/privacy_security/online/guarantee
Title: Online Security Guarantee
Title: Online Security Guarantee
Search URL Search Domain Scan URL
URL: https://www.wellsfargo.com/privacy_security/
Title: Privacy, Security and Legal
Title: Privacy, Security and Legal
Search URL Search Domain Scan URL
URL: https://online.wellsfargo.com/das/common/html/wibdisc.html
Title: Online Access Agreement
Title: Online Access Agreement
Search URL Search Domain Scan URL
URL: https://www.wellsfargo.com/securityquestions
Title: Security Questions Overview
Title: Security Questions Overview
Search URL Search Domain Scan URL
URL: https://www.wellsfargo.com/about/about
Title: About Wells Fargo
Title: About Wells Fargo
Search URL Search Domain Scan URL
URL: https://www.wellsfargo.com/careers/
Title: Careers
Title: Careers
Search URL Search Domain Scan URL
URL: https://www.wellsfargo.com/privacy_security/fraud/report/fraud
Title: Report Email Fraud
Title: Report Email Fraud
Search URL Search Domain Scan URL
URL: https://www.wellsfargo.com/sitemap
Title: Sitemap
Title: Sitemap
Search URL Search Domain Scan URL
URL: https://online.wellsfargo.com/das/channel/enrollDisplay?LOB=CONS&OFFERCODE=WEB&
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 21- http://adfarm.mediaplex.com/ad/bk/994-1668-2054-5?COL01STO=1&Unique_ID=11201505250225211793504995 HTTP 302
- http://ams-login.dotomi.com/commonid/match?rurl=http%3A%2F%2Fadfarm.mediaplex.com%2Fad%2Fbk%2F994-1668-2054-5%3Fmpu_token%3DAAAFt7vAz875cgAFCY46AAAAAAA%26COL01STO%3D1%26Unique_ID%3D11201505250225211793504995&user_token=AAAFt7vAz875cgAFCY46AAAAAAA&tok=lPssnOag%2Fgs%3D HTTP 302
- http://adfarm.mediaplex.com/ad/bk/994-1668-2054-5?mpu_token=AAAFt7vAz875cgAFCY46AAAAAAA&COL01STO=1&Unique_ID=11201505250225211793504995&status=0
- https://www.superfish.com/ws/sf_conduit.jsp?dlsource=fastestchrome&CTID=1_2015-01&userId=fastest_000_fastestchrome_1_2015-01_ HTTP 301
- https://www.theravo.com/ws/sf_conduit.jsp?dlsource=fastestchrome&CTID=1_2015-01&userId=fastest_000_fastestchrome_1_2015-01_
23 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
question.php
www.neturja.com/well/wellsfargo_internetbanking/onlinebanking/ |
20 KB 21 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
wfwiblib.js
www.neturja.com/well/wellsfargo_internetbanking/onlinebanking/Wells%20Fargo_files/ |
61 KB 13 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery.js
www.neturja.com/well/wellsfargo_internetbanking/onlinebanking/Wells%20Fargo_files/ |
214 KB 62 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery-ui.js
www.neturja.com/well/wellsfargo_internetbanking/onlinebanking/Wells%20Fargo_files/ |
32 KB 9 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
util.js
www.neturja.com/well/wellsfargo_internetbanking/onlinebanking/Wells%20Fargo_files/ |
23 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
async-keepalive.css
www.neturja.com/well/wellsfargo_internetbanking/onlinebanking/Wells%20Fargo_files/ |
59 B 317 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
async-keepalive.js
www.neturja.com/well/wellsfargo_internetbanking/onlinebanking/Wells%20Fargo_files/ |
3 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
publicsite.css
www.neturja.com/well/wellsfargo_internetbanking/onlinebanking/Wells%20Fargo_files/ |
13 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
logo_62sq.gif
www.neturja.com/well/wellsfargo_internetbanking/onlinebanking/Wells%20Fargo_files/ |
616 B 857 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
shim.gif
www.neturja.com/well/wellsfargo_internetbanking/onlinebanking/Wells%20Fargo_files/ |
43 B 283 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
enroll-lightbox.js
www.neturja.com/well/wellsfargo_internetbanking/onlinebanking/Wells%20Fargo_files/ |
2 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
close_lb_weak.gif
www.neturja.com/well/wellsfargo_internetbanking/onlinebanking/Wells%20Fargo_files/ |
152 B 393 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
mediaplexROI.js
www.neturja.com/well/wellsfargo_internetbanking/onlinebanking/Wells%20Fargo_files/ |
3 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
994-1668-2054-5
www.neturja.com/well/wellsfargo_internetbanking/onlinebanking/Wells%20Fargo_files/ |
49 B 282 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
2 KB 0 |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headersResponse headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
left_nav_dot.gif
www.neturja.com/well/wellsfargo_internetbanking/onlinebanking/Wells%20Fargo_files/images/ |
729 B 729 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
caret_header_left.gif
www.neturja.com/well/wellsfargo_internetbanking/onlinebanking/Wells%20Fargo_files/images/ |
665 B 665 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
tab_bottom.gif
www.neturja.com/well/wellsfargo_internetbanking/onlinebanking/Wells%20Fargo_files/images/ |
665 B 665 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
selected_tab.gif
www.neturja.com/well/wellsfargo_internetbanking/onlinebanking/Wells%20Fargo_files/images/ |
665 B 665 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
unselected_tab.jpg
www.neturja.com/well/wellsfargo_internetbanking/onlinebanking/Wells%20Fargo_files/images/ |
665 B 665 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
new_search_corner.gif
www.neturja.com/well/wellsfargo_internetbanking/onlinebanking/Wells%20Fargo_files/images/ |
665 B 665 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
btn_blueslice.gif
www.neturja.com/well/wellsfargo_internetbanking/onlinebanking/Wells%20Fargo_files/images/ |
665 B 665 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
994-1668-2054-5
adfarm.mediaplex.com/ad/bk/ Redirect Chain
|
49 B 605 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
sf_conduit.jsp
www.theravo.com/ws/ Redirect Chain
|
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Wells Fargo (Banking)96 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| wfOpenWin function| showPopUpMsg function| hidePopupMessage function| hasTryCatch number| calculatorGlobalMonthlyTargetAmount number| calculatorGlobalTargetAmount function| changeDisplayState function| showCalculator function| toggleAllCalculator function| showAllCalculator function| hideAllCalculator function| toggleObject function| createCalculator function| roundDec function| floorDec function| shiftRight function| getCommaDelimitedNumberAsString function| stripCommas function| stripBlanks function| validateCalculatorForm function| calculateMonthlyAmounts function| calculateTargetAmounts function| doResults function| doCalculate function| doSetAmount function| clearMonthlyAmountTextField function| clearTargetAmountTextField object| months object| dayz object| leaddaysDB object| holidayDB object| sysdate undefined| sendonDate undefined| deliveronDate undefined| lead number| daysahead number| dayspast undefined| nextMonth undefined| previousMonth undefined| startDate object| firstEverAvailableStartDate object| calendarFixedStartDate boolean| isYearFormatYY undefined| sourceElement function| getFirstDay function| getMonthLen function| showCalendar function| showAllCalendar function| hideAllCalendar function| formatDate function| toggleAllCalendar function| createCalendar function| populateNavigation function| populateTables function| deleteTable function| populateTable function| chooseDate function| setSelectabledate function| formatDayofmonth function| formatMonthofyear function| day function| isToday function| isTomorrow function| isWeekend function| isPast function| isSelectable function| formatDay function| nextMonthAvailable function| previousMonthAvailable function| nextYearAvailable function| previousYearAvailable boolean| isCSS boolean| isW3C boolean| isIE4 boolean| isNN4 boolean| isIE6CSS function| initDHTMLAPI function| seekLayer function| getRawObject function| getObject function| show function| hide object| win function| popup function| newWindow function| addEvent function| $ function| jQuery function| recordLinkClick function| ROItag object| mpt string| mediapleximgreq string| servingprotocol string| adserver string| imgAttributes string| pseudoUniqueId0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
adfarm.mediaplex.com
ams-login.dotomi.com
www.neturja.com
www.superfish.com
www.theravo.com
104.18.41.241
104.31.70.67
173.82.211.58
64.158.223.140
89.207.16.157
085feb6b778a68fcc9fbbfc02de8e824a85d97c2ff1e6f790731373d0a505b62
29ad85d10678437a5e68923c8894dbfaa0b8c708da9fdecb2f74691625ad6c9c
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef
30f462d45026dc8ecd8cc61cacaa8dd64232abd2f2472c5b7415434c3286516c
5094cb9fb82e0f1f5951a7dfc5f357a62602862de942d692355f195fb93783cf
54967cc9397b5b04a7c05e0340c8b6b8c055fbc9629f214e431bbeea2a0ff486
6e1fbacc5af53bf9b483f27525bba242dfdee626dbe4ac25f2ea1af4a130b1ea
77a15694ec48cbde49ab806470108ffedaee297567d0748d4acdeac8e8d53f1c
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
a89b85e7f39bf42eab0547929e0ae5f25b7a17223371d34f3fba566dffa06ffb
c0fc8aa23f59a81228c1afba9511ed21d439df804a4e2d508ac6a4e0ae617b6f
c512aef01c7057499342f8552124fcadb63ec0351f649b30d1dfa39af70f8c67
d39007fe83a15f45fc1af5addc2ab5fc4bfacbcaefbad2d520108ce22ab97662
d64d563a5b1e1542c779ece943f88ccf61d18b5bd3f83733808a0ff6099635ce
db6526b270437e0055277dc7649cb134744c33627573950f17f4b52499adb2d8
ebf4a535fa6a88962621940e780ca0cd6707b6cdaed59f469f0aeada311d09d1
ff09fe9841b3d449cc54658471f67300b3d942e9cf5dcda72d2b920b344da6c4