![](/screenshots/c92390a9-e7d6-4f9b-a743-8832a03b25f7.png)
tlxgwc-5000.csb.app
Open in
urlscan Pro
172.64.148.87
Malicious Activity!
Public Scan
Submission: On July 24 via automatic, source phishtank — Scanned from US
Summary
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on December 30th 2023. Valid for: a year.
This is the only time tlxgwc-5000.csb.app was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Wells Fargo (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
6 | 172.64.148.87 172.64.148.87 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
19 | 23.61.11.152 23.61.11.152 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
5 | 23.61.11.155 23.61.11.155 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
1 | 23.4.183.127 23.4.183.127 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
1 | 104.18.10.207 104.18.10.207 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 172.64.154.107 172.64.154.107 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2607:f8b0:400... 2607:f8b0:400d:c0c::5f | 15169 (GOOGLE) (GOOGLE) | |
1 | 152.199.4.33 152.199.4.33 | 15133 (EDGECAST) (EDGECAST) | |
1 | 104.17.24.14 104.17.24.14 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 2 | 173.194.175.149 173.194.175.149 | 15169 (GOOGLE) (GOOGLE) | |
1 | 209.85.201.154 209.85.201.154 | 15169 (GOOGLE) (GOOGLE) | |
1 | 146.75.77.230 146.75.77.230 | 54113 (FASTLY) (FASTLY) | |
2 | 35.241.45.82 35.241.45.82 | 15169 (GOOGLE) (GOOGLE) | |
53 | 13 |
ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-61-11-152.deploy.static.akamaitechnologies.com
static.wellsfargo.com |
ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-61-11-155.deploy.static.akamaitechnologies.com
connect.secure.wellsfargo.com |
ASN16625 (AKAMAI-AS, US)
PTR: a23-4-183-127.deploy.static.akamaitechnologies.com
www10.wellsfargomedia.com |
ASN15169 (GOOGLE, US)
PTR: qs-in-f149.1e100.net
ad.doubleclick.net |
ASN15169 (GOOGLE, US)
PTR: qu-in-f154.1e100.net
adservice.google.com |
ASN54113 (FASTLY, US)
resources.digital-cloud-prem.medallia.com |
ASN15169 (GOOGLE, US)
PTR: 82.45.241.35.bc.googleusercontent.com
udc-neb.kampyle.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
24 |
wellsfargo.com
static.wellsfargo.com — Cisco Umbrella Rank: 17268 connect.secure.wellsfargo.com — Cisco Umbrella Rank: 16624 rubicon.wellsfargo.com Failed |
535 KB |
6 |
csb.app
tlxgwc-5000.csb.app |
14 KB |
2 |
kampyle.com
udc-neb.kampyle.com — Cisco Umbrella Rank: 3965 |
394 B |
2 |
doubleclick.net
2 redirects
ad.doubleclick.net — Cisco Umbrella Rank: 210 |
48 B |
2 |
codesandbox.io
codesandbox.io — Cisco Umbrella Rank: 209528 |
56 KB |
1 |
medallia.com
resources.digital-cloud-prem.medallia.com — Cisco Umbrella Rank: 20005 |
3 KB |
1 |
google.com
adservice.google.com — Cisco Umbrella Rank: 468 |
|
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 336 |
5 KB |
1 |
aspnetcdn.com
ajax.aspnetcdn.com — Cisco Umbrella Rank: 5661 |
38 KB |
1 |
tenor.com
media.tenor.com — Cisco Umbrella Rank: 8660 |
12 KB |
1 |
bootstrapcdn.com
maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 1832 |
7 KB |
1 |
wellsfargomedia.com
www10.wellsfargomedia.com — Cisco Umbrella Rank: 20785 www15.wellsfargomedia.com Failed |
612 KB |
53 | 12 |
Domain | Requested by | |
---|---|---|
19 | static.wellsfargo.com |
tlxgwc-5000.csb.app
static.wellsfargo.com |
6 | tlxgwc-5000.csb.app |
tlxgwc-5000.csb.app
|
5 | connect.secure.wellsfargo.com |
tlxgwc-5000.csb.app
|
2 | udc-neb.kampyle.com | |
2 | ad.doubleclick.net | 2 redirects |
2 | codesandbox.io |
tlxgwc-5000.csb.app
codesandbox.io |
1 | resources.digital-cloud-prem.medallia.com |
static.wellsfargo.com
|
1 | adservice.google.com |
tlxgwc-5000.csb.app
|
1 | cdnjs.cloudflare.com |
tlxgwc-5000.csb.app
|
1 | ajax.aspnetcdn.com |
tlxgwc-5000.csb.app
|
1 | media.tenor.com |
tlxgwc-5000.csb.app
|
1 | maxcdn.bootstrapcdn.com |
tlxgwc-5000.csb.app
|
1 | www10.wellsfargomedia.com |
tlxgwc-5000.csb.app
|
0 | rubicon.wellsfargo.com Failed |
static.wellsfargo.com
|
0 | www15.wellsfargomedia.com Failed |
tlxgwc-5000.csb.app
connect.secure.wellsfargo.com |
53 | 15 |
This site contains links to these domains. Also see Links.
Domain |
---|
oam.wellsfargo.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
csb.app Cloudflare Inc ECC CA-3 |
2023-12-30 - 2024-12-29 |
a year | crt.sh |
static.wellsfargo.com DigiCert EV RSA CA G2 |
2023-08-30 - 2024-09-29 |
a year | crt.sh |
connect.secure.wellsfargo.com DigiCert EV RSA CA G2 |
2023-08-29 - 2024-09-28 |
a year | crt.sh |
www10.wellsfargomedia.com GeoTrust RSA CA 2018 |
2023-12-05 - 2024-12-04 |
a year | crt.sh |
bootstrapcdn.com WE1 |
2024-07-23 - 2024-10-21 |
3 months | crt.sh |
codesandbox.io E6 |
2024-07-21 - 2024-10-19 |
3 months | crt.sh |
c.tenor.com WR2 |
2024-06-24 - 2024-09-16 |
3 months | crt.sh |
*.vo.msecnd.net DigiCert SHA2 Secure Server CA |
2024-06-06 - 2025-06-06 |
a year | crt.sh |
cdnjs.cloudflare.com E1 |
2024-06-02 - 2024-08-31 |
3 months | crt.sh |
*.google.com WR2 |
2024-06-24 - 2024-09-16 |
3 months | crt.sh |
*.digital-cloud-prem.medallia.com SSL.com RSA SSL subCA |
2023-11-01 - 2024-12-01 |
a year | crt.sh |
*.kampyle.com SSL.com RSA SSL subCA |
2023-11-07 - 2024-12-07 |
a year | crt.sh |
This page contains 3 frames:
Primary Page:
https://tlxgwc-5000.csb.app/
Frame ID: E884B13334DFE100E993880EEBDE2B82
Requests: 51 HTTP requests in this frame
Frame:
https://adservice.google.com/ddm/fls/z/src=2549153;dc_pre=CLu5n5WHv4cDFaU6RAgdhpEYZg;type=allv40;cat=all_a012;u1=4520240102052010932720974;u4=LOGIN;u5=n;u8=loginapp;u11=PROD;u19=GA1.2.756597098.1704201605;u23=DESKTOP;ord=8668721575748.634
Frame ID: A62063DF45302ECFD410951DD892F799
Requests: 1 HTTP requests in this frame
Frame:
https://codesandbox.io/p/devtool/inline-preview/tlxgwc-5000
Frame ID: B5CB8EE700F9CE70617DD20B9FFCFCD8
Requests: 1 HTTP requests in this frame
Screenshot
![](/screenshots/c92390a9-e7d6-4f9b-a743-8832a03b25f7.png)
Page Title
Sign On to View Your Personal Accounts | Wells FargoDetected technologies
![](/vendor/wappa/icons/Bootstrap.png)
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
![](/vendor/wappa/icons/AppDynamics.png)
Detected patterns
- adrum
![](/vendor/wappa/icons/Font Awesome.png)
Detected patterns
- <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: Forgot username or password?
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 42- https://ad.doubleclick.net/ddm/activity/src=2549153;type=allv40;cat=all_a012;u1=4520240102052010932720974;u4=LOGIN;u5=n;u8=loginapp;u11=PROD;u19=GA1.2.756597098.1704201605;u23=DESKTOP;ord=8668721575748.634 HTTP 302
- https://ad.doubleclick.net/ddm/activity/src=2549153;dc_pre=CLu5n5WHv4cDFaU6RAgdhpEYZg;type=allv40;cat=all_a012;u1=4520240102052010932720974;u4=LOGIN;u5=n;u8=loginapp;u11=PROD;u19=GA1.2.756597098.1704201605;u23=DESKTOP;ord=8668721575748.634 HTTP 302
- https://adservice.google.com/ddm/fls/z/src=2549153;dc_pre=CLu5n5WHv4cDFaU6RAgdhpEYZg;type=allv40;cat=all_a012;u1=4520240102052010932720974;u4=LOGIN;u5=n;u8=loginapp;u11=PROD;u19=GA1.2.756597098.1704201605;u23=DESKTOP;ord=8668721575748.634
53 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H3 |
Primary Request
/
tlxgwc-5000.csb.app/ |
59 KB 13 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ga.js
static.wellsfargo.com/tracking/ga/ |
48 KB 20 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ga_conversion_async.js
static.wellsfargo.com/tracking/ga/ |
35 KB 14 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
gtag.js
static.wellsfargo.com/tracking/ga/ |
104 KB 41 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
gtag.js
static.wellsfargo.com/tracking/ga/ |
104 KB 41 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
gtag.js
static.wellsfargo.com/tracking/ga/ |
104 KB 41 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
adrum-ext.b4436be974de477658d4a93afb752165.js
tlxgwc-5000.csb.app/auth/static/scripts/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
nd
connect.secure.wellsfargo.com/jenny/ |
53 KB 20 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
gtag.js
static.wellsfargo.com/tracking/ga/ |
104 KB 41 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
detector-dom.min.js
static.wellsfargo.com/tracking/gb/ |
503 KB 151 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
medallia-digital-embed.js
static.wellsfargo.com/tracking/medallia/wdcusprem/57907/onsite/ |
2 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ytc.js
static.wellsfargo.com/tracking/ytc/ |
15 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
general_alt.js
tlxgwc-5000.csb.app/auth/login/static/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
general_alt.js
tlxgwc-5000.csb.app/auth/login/static/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
wfui.df76c94872b557f8b8f8.css
connect.secure.wellsfargo.com/auth/static/ui/loginaltsignon/public/stylesheets/ |
114 KB 18 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main.6539fceb73733687f14d.css
connect.secure.wellsfargo.com/auth/static/ui/loginaltsignon/public/stylesheets/ |
7 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
COB-BOB-IRT-enroll_balloons.jpg
www10.wellsfargomedia.com/auth/static/images/ |
611 KB 612 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.5.0/css/ |
27 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
src_app_page_login_Login_js.bb7e73ad23c1d7b51bcf.chunk.css
connect.secure.wellsfargo.com/auth/static/ui/loginaltsignon/public/stylesheets/ |
135 KB 20 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
utag.3.js
static.wellsfargo.com/tracking/secure-auth/ |
5 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
utag.4.js
static.wellsfargo.com/tracking/secure-auth/ |
6 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
utag.5.js
static.wellsfargo.com/tracking/secure-auth/ |
6 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
utag.7.js
static.wellsfargo.com/tracking/secure-auth/ |
10 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
utag.10.js
static.wellsfargo.com/tracking/secure-auth/ |
20 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
utag.9.js
static.wellsfargo.com/tracking/secure-auth/ |
11 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
utag.15.js
static.wellsfargo.com/tracking/secure-auth/ |
4 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
utag.21.js
static.wellsfargo.com/tracking/secure-auth/ |
4 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
preview-protocol.js
codesandbox.io/p/ |
176 KB 56 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
loading-loading-gif.gif
media.tenor.com/guhB4PpjrmUAAAAM/ |
11 KB 12 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
utag.js
static.wellsfargo.com/tracking/secure-auth/ |
36 KB 11 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
login-userprefs.min.js
tlxgwc-5000.csb.app/auth/static/prefs/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
atadun.js
connect.secure.wellsfargo.com/auth/static/prefs/ |
1 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
generic1697649041190.js
static.wellsfargo.com/tracking/medallia/wdcusprem/57907/onsite/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.3.1.min.js
ajax.aspnetcdn.com/ajax/jQuery/ |
85 KB 38 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
jquery.mask.js
cdnjs.cloudflare.com/ajax/libs/jquery.mask/1.14.10/ |
20 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
wellsfargosans-rg.woff2
www15.wellsfargomedia.com/wfui/css/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
wellsfargosans-sbd.woff2
www15.wellsfargomedia.com/wfui/css/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
wellsfargoserif-rg.woff2
www15.wellsfargomedia.com/wfui/css/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
wellsfargosans-rg.woff
www15.wellsfargomedia.com/wfui/css/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
wellsfargosans-sbd.woff
www15.wellsfargomedia.com/wfui/css/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
wellsfargoserif-rg.woff
www15.wellsfargomedia.com/wfui/css/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
wellsfargosans-rg.woff2
www15.wellsfargomedia.com/wfui/css/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
wellsfargosans-sbd.woff2
www15.wellsfargomedia.com/wfui/css/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
src=2549153;dc_pre=CLu5n5WHv4cDFaU6RAgdhpEYZg;type=allv40;cat=all_a012;u1=4520240102052010932720974;u4=LOGIN;u5=n;u8=loginapp;u11=PROD;u19=GA1.2.756597098.1704201605;u23=DESKTOP;ord=8668721575748.634
adservice.google.com/ddm/fls/z/ Frame A620 Redirect Chain
|
0 0 |
Document
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
tlxgwc-5000
codesandbox.io/p/devtool/inline-preview/ Frame B5CB |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
wellsfargosans-rg.woff
www15.wellsfargomedia.com/wfui/css/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
wellsfargosans-sbd.woff
www15.wellsfargomedia.com/wfui/css/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
generic1703025661264.js
static.wellsfargo.com/tracking/medallia/wdcusprem/57907/onsite/ |
358 KB 81 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
cls_report
rubicon.wellsfargo.com/glassbox/reporting/0C458F45-AC71-02CE-34D8-401C8A313B38/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
tlxgwc-5000.csb.app/ |
2 KB 853 B |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
onsiteData.json
resources.digital-cloud-prem.medallia.com/wdcusprem/57907/onsite/ |
35 KB 3 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
__cool.gif
udc-neb.kampyle.com/egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/ |
0 77 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
__cool.gif
udc-neb.kampyle.com/egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/ |
0 317 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- static.wellsfargo.com
- URL
- https://static.wellsfargo.com/tracking/medallia/wdcusprem/57907/onsite/generic1697649041190.js
- Domain
- www15.wellsfargomedia.com
- URL
- https://www15.wellsfargomedia.com/wfui/css/fonts/wellsfargosans-rg.woff2
- Domain
- www15.wellsfargomedia.com
- URL
- https://www15.wellsfargomedia.com/wfui/css/fonts/wellsfargosans-sbd.woff2
- Domain
- www15.wellsfargomedia.com
- URL
- https://www15.wellsfargomedia.com/wfui/css/fonts/wellsfargoserif-rg.woff2
- Domain
- www15.wellsfargomedia.com
- URL
- https://www15.wellsfargomedia.com/wfui/css/fonts/wellsfargosans-rg.woff
- Domain
- www15.wellsfargomedia.com
- URL
- https://www15.wellsfargomedia.com/wfui/css/fonts/wellsfargosans-sbd.woff
- Domain
- www15.wellsfargomedia.com
- URL
- https://www15.wellsfargomedia.com/wfui/css/fonts/wellsfargoserif-rg.woff
- Domain
- www15.wellsfargomedia.com
- URL
- https://www15.wellsfargomedia.com/wfui/css/fonts/wellsfargosans-rg.woff2
- Domain
- www15.wellsfargomedia.com
- URL
- https://www15.wellsfargomedia.com/wfui/css/fonts/wellsfargosans-sbd.woff2
- Domain
- www15.wellsfargomedia.com
- URL
- https://www15.wellsfargomedia.com/wfui/css/fonts/wellsfargosans-rg.woff
- Domain
- www15.wellsfargomedia.com
- URL
- https://www15.wellsfargomedia.com/wfui/css/fonts/wellsfargosans-sbd.woff
- Domain
- rubicon.wellsfargo.com
- URL
- https://rubicon.wellsfargo.com/glassbox/reporting/0C458F45-AC71-02CE-34D8-401C8A313B38/cls_report?_cls_s=14b0beeb-a9b1-4a8a-bfa6-557a57230ec4%3A0&_cls_v=cdbede55-3024-4843-9e83-8a501fdc33b8&pv=2&f_cls_s=true
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Wells Fargo (Banking)167 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 object| __REACT_DEVTOOLS_GLOBAL_HOOK__ function| GooglemKTybQhCsO function| google_trackConversion string| nstjab function| nsnlhzz function| validateSessionIdCookie function| nstjabtskf string| NDS_LISTEN_FOCUS string| NDS_LISTEN_TOUCH string| NDS_LISTEN_KEYBOARD string| NDS_LISTEN_DEVICE_MOTION_SENSORS string| NDS_LISTEN_MOUSE function| nsvqyzfg string| NDS_LISTEN_FORM string| NDS_LISTEN_ALL function| nsofcyols function| ndwti string| NDS_LISTEN_NONE string| nsoybdzzcf string| nsbnemqnzv string| nsnlhzzp string| nsoybd function| nsssmigu string| nsdoommj string| nsnlhz string| nsofcyolsp string| nsnlh string| nsofc string| nsdoomm string| nszdoekt string| nsdoo object| nsoybdz function| nsdkeyavgl function| nspezyovm function| ndoIsKeyIncluded function| ndoIsModifierKey function| nspezyo function| nsfitd function| ndoIsNavigationKey function| ndoIsEditingKey function| attachEventListener object| KEYBOARD_LOCATION object| KEY_TYPE_AND_LOCATION function| ndoGetKeyboardLocation function| ndoGetKeyTypeAndLocationIndicator function| nspezyovmx function| ndoGetObjectKeys string| ndjsStaticVersion function| nsdke object| nsdoommjp function| nspezyov function| nspez object| nszdoek boolean| nsbnemq number| nszdoe function| nsssmi function| nsdkeyav number| nsvqyz function| nszgu object| nszdoektzl object| nsofcyo function| nsvlnnlv object| nsbnemqnz object| nsoybdzz object| nstjabtsk function| nsfitdrrd object| nszdoektz string| nsoyb object| nds object| returned string| version function| nsfit string| ndsWidgetVersion function| nsssmigume string| nsbne string| nsvqyzf string| nsbnemqn function| nszguh string| nsoybdzzc string| nsnlhzzpe function| nshzovfh string| nsvqy function| nspezy object| nsvqyzfgae object| nstjabt function| nstja function| nsvlnn function| nsofcy function| HashUtil function| nsvqyzfga function| nsssmig function| nszguhxm function| ndwts function| nsssm function| getEnabledEvents function| nszguhxmlw function| nssysnix function| nszguhx function| nsdkeyavg function| nsfitdr function| nsssmigum function| nsvlnnl function| nshzovfhy function| nshzovfhyb function| nsdkeya function| nshzovf function| nsvln function| nsdkey function| nssysnixq function| nshzov function| nszguhxml function| nssysn function| nsvlnnlvw function| nsfitdrr function| nshzo function| nssysni function| nssysnixqm object| nsdoom object| ndsapi object| google_tag_data function| ga object| gaplugins number| counter string| GTAG_TYPE object| GTAG_CONFIG function| $ function| jQuery object| CODESANDBOX_PREVIEW object| __CSB_PREVIEW_PROTOCOL object| KAMPYLE_EMBED object| YAHOO object| _gbLocalStorage object| _gbSessionStorage object| _detector object| webVitals object| convertize object| dotq object| utag_cfg_ovrd object| utag function| isNotUndefinedOrNull function| getDocumentTitleLabel object| utag_data function| enableLocalhostProxy string| MDIGITAL_ON_PREM_PREFIX object| MDIGITAL object| KAMPYLE_CONSTANT object| KAMPYLE_FUNC object| KAMPYLE_DATA object| KAMPYLE_TARGETING object| KAMPYLE_ANIMATION object| KAMPYLE_VIEW object| KAMPYLE_MESSAGE object| KAMPYLE_UTILS object| KAMPYLE_EVENT_DISPATCHER object| KAMPYLE_GA object| MDIGITAL_ELEMENT_BUILDER object| COOLADATA_CODE object| KAMPYLE_COOLADATA object| KAMPYLE_COMMON object| KAMPYLE_THERMO_TEALEAF_FUNC object| KAMPYLE_ADOBE_ANALYTICS object| KAMPYLE_SCREEN_CAPTURE object| KAMPYLE_ONSITE_SDK object| KAMPYLE_INTEGRATION object| cooladata6 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
tlxgwc-5000.csb.app/ | Name: _cls_s Value: 14b0beeb-a9b1-4a8a-bfa6-557a57230ec4:0 |
|
.doubleclick.net/ | Name: test_cookie Value: CheckForPermission |
|
.doubleclick.net/ | Name: ar_debug Value: 1 |
|
.doubleclick.net/ | Name: receive-cookie-deprecation Value: 1 |
|
.codesandbox.io/ | Name: _cfuvid Value: Uw5eme6Jof0Wki5mM48Wx4FfsvHNClCjIqprVPYP66I-1721802773145-0.0.1.1-604800000 |
|
.codesandbox.io/ | Name: cf_clearance Value: r9YTMy2TNN6lIdrt_ERJtQ0zx7FcFHUAeeKxyQcl8vE-1721802775-1.0.1.1-J2psU0d89CwejUKl7Br2oynwCN7RwtZu0HvHDzXI.smN0bh7CtzS9JPP95vQKh3Al6wNvwC9oQWqAzvrWvFncA |
33 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31536000; includeSubDomains |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ad.doubleclick.net
adservice.google.com
ajax.aspnetcdn.com
cdnjs.cloudflare.com
codesandbox.io
connect.secure.wellsfargo.com
maxcdn.bootstrapcdn.com
media.tenor.com
resources.digital-cloud-prem.medallia.com
rubicon.wellsfargo.com
static.wellsfargo.com
tlxgwc-5000.csb.app
udc-neb.kampyle.com
www10.wellsfargomedia.com
www15.wellsfargomedia.com
rubicon.wellsfargo.com
static.wellsfargo.com
www15.wellsfargomedia.com
104.17.24.14
104.18.10.207
146.75.77.230
152.199.4.33
172.64.148.87
172.64.154.107
173.194.175.149
209.85.201.154
23.4.183.127
23.61.11.152
23.61.11.155
2607:f8b0:400d:c0c::5f
35.241.45.82
03f1ef1e95f80497722a225cce3f4b61b7b65a5dd3a9298f4b89433cba8bcad6
050e2aa89c3945fa04373c714347297146adebc89effa9e41c0df8090ba0ed51
052776ce5bb96d76cced9b9d9d5cc8ab2110e33eaba59f6cd3259642a83ff4d4
0b2af045acafbdf14516bf55f310568036ace959946d16edb1acebcd58029d22
13291c7a822148ddc4fa2d17b5076114d25f4707c3c44b2f9b5449ab9ab728c1
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
1eb822991702356efc7f44c031eda1c3932396c708416befb0a7165f3e651692
1eeda03edbc2bb72ab44077bd30e718f3a9b2a2dcb493b9cc05976a2a1d7f2ec
2ce2384e7671e772be60c73edfa3aab7dc80d1462d7c5e4c5cf6a6e8c5156795
34d6af1ed862f62ede259dedabcadba6446c1e9182cd70b19c66cb3acedae93d
3636799d3181248d5db968a7851b9aa972ea77f64b3cba9ce6b0a8933106c0c2
384f41d37d3a9be1a72e761589096fcce4119150ea81ead29ba758514d321e94
412d7679e90f175d2b2e29e7804d2544131d66577e212943defba9bf17ec0dc9
62575ab13c76dd901434c782bf0fe360ca100f517ebf4a7c650694a3ec5c4120
6aa606ed689e61a4c9c959c43e8b66eba4c943cbabfb39a8da74f4a3a0d24c44
6c771bd1c269646a76015f2f6410a40c031e5adea88f665bfe9ae15a972ab6ab
8c45c679f40c3f81c111fbf2398d568189c3ab34d8a9704ad225cd8efe1b819f
9c4cf53fef9222fc5d6659fa4b776fe20d64c46886c3d96547aaae16134afb2a
a516686d918dbcae3fe0309b18aae7a0715d66c754c73cef89a6c494c3a81780
adbca63acdee1261254ba7c9399650249a79e2d1f1e056108fd53eb21cfc7a73
b8325d272c72a041414d9fb349e9d4bca5e7fc8ad66f47a719e491960afa5683
be483938eb34538b970684f72e312f62652e84b42b7ad86953962d1ce2217c44
c3da138d9164db792ba6876aa7582949c985b072ee1ac5de2b20fc60153226c0
cfe80d66ccbcce18793e4aeb13ba527b1f32ff94ccc43bd3052863e9c17e63bb
d05c6eece255484babbedeb74b3a5b19daaa9763049e08362b82cfdf1fc8bfbe
ddd92f10ad162c7449eff0acaf40598c05b1111739587edb75e5326b6697c5d5
de5f63b7382d3479f84e396eb2b19ea62be6a30a6292bbf5b95d46716be552c7
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5816a040f78bd21a0a149637977c04c952c491111c5dcbec993fa91b4cb566c
fa7432fc26791d56392fbfe25f9335e46c7f0d85e772c7bf7ec2d62e6a3a8ce9
fc15bb4896d216769cf5e8b4ee14d4d6868b712cd06d32bd6ca6c94885bbcf78