Report - wellrt.serveo.net/f/go

Report Overview

Submitted URL
wellrt.serveo.net/f/go
IP
138.68.79.95
ASN
#14061 DIGITALOCEAN-ASN
Submitted
2024-05-10 15:43:44
Access
public
Website Title
Sign On to View Your Personal Accounts | Wells Fargo
Final URL
wellrt.serveo.net/f/go/web/authen.php?web/auth/wells/login/overviewAccounts/overview/index=yngIO1j1L0y1rdMBmN5MpoVhRa2J8izkZsYx4hMJ2EyI8atG5zRgbbKIpjEXlSAmwkHbcLQmsiXhilyM
Tags
wellsfargo financial phishing
urlquery detections
Phishing - Wells Fargo

Detections

urlquery
20
Network Intrusion Detection
0
Threat Detection Systems
38

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
localhost	26644	unknown	No data	No data	441 B	0 B	0.0.0.0
zerossl.ocsp.sectigo.com	4049	2018-08-16	2020-05-09	2024-05-09	336 B	806 B	172.64.149.23
wellrt.serveo.net	unknown	unknown	No data	No data	9.5 kB	906 kB	138.68.79.95

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-05-10	medium	serveo.net	Sinkholed
2024-05-10	medium	serveo.net	Sinkholed
2024-05-10	medium	serveo.net	Sinkholed
2024-05-10	medium	serveo.net	Sinkholed
2024-05-10	medium	serveo.net	Sinkholed
2024-05-10	medium	serveo.net	Sinkholed
2024-05-10	medium	serveo.net	Sinkholed
2024-05-10	medium	serveo.net	Sinkholed
2024-05-10	medium	serveo.net	Sinkholed
2024-05-10	medium	serveo.net	Sinkholed
2024-05-10	medium	serveo.net	Sinkholed
2024-05-10	medium	serveo.net	Sinkholed
2024-05-10	medium	serveo.net	Sinkholed
2024-05-10	medium	serveo.net	Sinkholed
2024-05-10	medium	serveo.net	Sinkholed
2024-05-10	medium	serveo.net	Sinkholed
2024-05-10	medium	serveo.net	Sinkholed
2024-05-10	medium	serveo.net	Sinkholed
2024-05-10	medium	serveo.net	Sinkholed

ThreatFox

No alerts detected

JavaScript (1)

	URL	Size	First Seen	Last Seen
	wellrt.serveo.net/f/go/web/assets/js/index.js	14 kB	2023-03-07	2024-05-10
Pretty URL wellrt.serveo.net/f/go/web/assets/js/index.js IP 138.68.79.95 ASN #14061 DIGITALOCEAN-ASN Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:23:37 Last Seen2024-05-10 17:43:51 Times Seen23 Hash 7f1eba0d6c2d7838289374a3a6956ebb f89975576dbd6ed64cd7d473c22e382319a01e38 a810a4b0e255909c9a3fd9524c1c9a89b215b1f42e1c7cc40776826c31e1fda2 Loading...

HTTP Transactions (21)

URL IP Response Size

zerossl.ocsp.sectigo.com/

172.64.149.23

314 B

URL
zerossl.ocsp.sectigo.com/
IP
172.64.149.23:0
ASN
#13335 CLOUDFLARENET

File type
data
Size
314 B (314 bytes)
Hash
dd03ada071ce8472dececc35100debf6
2fc45c77dfb40efb564c5c05ffa24326705d4a8e
16e001863329cd0b963a14613420d8e7d15932b098d55b74c352b49c7a9d4978

HTTP Headers

POST / HTTP/1.1
Host: zerossl.ocsp.sectigo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 10 May 2024 15:43:19 GMT
Content-Type: application/ocsp-response
Content-Length: 314
Connection: keep-alive
Last-Modified: Tue, 07 May 2024 04:13:50 GMT
Expires: Tue, 14 May 2024 04:13:49 GMT
Etag: "2fc45c77dfb40efb564c5c05ffa24326705d4a8e"
Cache-Control: max-age=303629,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb2
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 881b0b4f582fb505-OSL

wellrt.serveo.net/f/go

138.68.79.95

301 Moved Permanently

345 B

URL User Request GET HTTP/2
wellrt.serveo.net/f/go
IP
138.68.79.95:443
ASN
#14061 DIGITALOCEAN-ASN

Certificate
IssuerZeroSSL
Subjectserveo.net
Fingerprint1F:90:6E:72:F5:FF:79:B0:2D:B6:C2:A3:2D:CB:4D:7E:A6:8D:33:7E
ValidityTue, 13 Feb 2024 00:00:00 GMT - Mon, 13 May 2024 23:59:59 GMT

File type
HTML document, ASCII text
Size
345 B (345 bytes)
Hash
ac65b4906ae491273dd66186d2ea980b
490f9c83f1998a43f540025bbecbb05bd69b161a
2196c5f0277b8459af61baa088b66d500564c14c56e123fef1a603238861d2ea

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Wells Fargo
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /f/go HTTP/1.1
Host: wellrt.serveo.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 301 Moved Permanently
content-type: text/html; charset=iso-8859-1
date: Fri, 10 May 2024 15:43:19 GMT
location: http://wellrt.serveo.net/f/go/
server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30
content-length: 345
X-Firefox-Spdy: h2

wellrt.serveo.net/f/go/

138.68.79.95

302 Found

0 B

URL User Request GET HTTP/1.1
wellrt.serveo.net/f/go/
IP
138.68.79.95:80
ASN
#14061 DIGITALOCEAN-ASN

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Wells Fargo
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /f/go/ HTTP/1.1
Host: wellrt.serveo.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Date: Fri, 10 May 2024 15:43:19 GMT
Location: web/authen.php?web/auth/wells/login/overviewAccounts/overview/index=yngIO1j1L0y1rdMBmN5MpoVhRa2J8izkZsYx4hMJ2EyI8atG5zRgbbKIpjEXlSAmwkHbcLQmsiXhilyM
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30
X-Powered-By: PHP/8.0.30

wellrt.serveo.net/f/go/web/authen.php?web/auth/wells/login/overviewAccounts/overview/index=yngIO1j1L0y1rdMBmN5MpoVhRa2J8izkZsYx4hMJ2EyI8atG5zRgbbKIpjEXlSAmwkHbcLQmsiXhilyM

138.68.79.95

200 OK

58 kB

URL User Request GET HTTP/1.1
wellrt.serveo.net/f/go/web/authen.php?web/auth/wells/login/overviewAccounts/overview/index=yngIO1j1L0y1rdMBmN5MpoVhRa2J8izkZsYx4hMJ2EyI8atG5zRgbbKIpjEXlSAmwkHbcLQmsiXhilyM
IP
138.68.79.95:80
ASN
#14061 DIGITALOCEAN-ASN

File type
HTML document, Unicode text, UTF-8 text, with very long lines (869), with CRLF line terminators
Size
58 kB (58545 bytes)
Hash
4d44bd8dd801cdb08220b348799446e3
ecc5db1cf01917566efa1a5acff1646f45c037ac
171a64d6aa7770f968833de3726fcfe490e8060ed73d1e19866ba3157240bcf7

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Wells Fargo
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /f/go/web/authen.php?web/auth/wells/login/overviewAccounts/overview/index=yngIO1j1L0y1rdMBmN5MpoVhRa2J8izkZsYx4hMJ2EyI8atG5zRgbbKIpjEXlSAmwkHbcLQmsiXhilyM HTTP/1.1
Host: wellrt.serveo.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
Date: Fri, 10 May 2024 15:43:19 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30
Set-Cookie: PHPSESSID=git7iqsrv3lac7c1hffqvfrgam; path=/
X-Powered-By: PHP/8.0.30
Transfer-Encoding: chunked

wellrt.serveo.net/f/go/web/assets/css/wfui.css

138.68.79.95

200 OK

144 kB

URL GET HTTP/1.1
wellrt.serveo.net/f/go/web/assets/css/wfui.css
IP
138.68.79.95:80
ASN
#14061 DIGITALOCEAN-ASN

Requested by
http://wellrt.serveo.net/f/go/web/authen.php?web/auth/wells/login/overviewAccounts/overview/index=yngIO1j1L0y1rdMBmN5MpoVhRa2J8izkZsYx4hMJ2EyI8atG5zRgbbKIpjEXlSAmwkHbcLQmsiXhilyM

File type
Unicode text, UTF-8 text, with very long lines (420)
Size
144 kB (143571 bytes)
Hash
1619d2c7aeecd95521a227c60bdcdbee
42ea2360ff1b0faae0fbf2dc50dad34aa56c534d
8396ea7e71e3b1408f7e3516f9244622716733bb73cf1a9a5429523411e7e448

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Wells Fargo
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /f/go/web/assets/css/wfui.css HTTP/1.1
Host: wellrt.serveo.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://wellrt.serveo.net/f/go/web/authen.php?web/auth/wells/login/overviewAccounts/overview/index=yngIO1j1L0y1rdMBmN5MpoVhRa2J8izkZsYx4hMJ2EyI8atG5zRgbbKIpjEXlSAmwkHbcLQmsiXhilyM
Cookie: PHPSESSID=git7iqsrv3lac7c1hffqvfrgam
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Length: 143571
Content-Type: text/css
Date: Fri, 10 May 2024 15:43:19 GMT
Etag: "230d3-5e2aebd706580"
Last-Modified: Thu, 30 Jun 2022 18:50:14 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30

wellrt.serveo.net/f/go/web/assets/js/index.js

138.68.79.95

200 OK

14 kB

URL GET HTTP/1.1
wellrt.serveo.net/f/go/web/assets/js/index.js
IP
138.68.79.95:80
ASN
#14061 DIGITALOCEAN-ASN

Requested by
http://wellrt.serveo.net/f/go/web/authen.php?web/auth/wells/login/overviewAccounts/overview/index=yngIO1j1L0y1rdMBmN5MpoVhRa2J8izkZsYx4hMJ2EyI8atG5zRgbbKIpjEXlSAmwkHbcLQmsiXhilyM

File type
ASCII text, with very long lines (1392)
Size
14 kB (13499 bytes)
Hash
7f1eba0d6c2d7838289374a3a6956ebb
f89975576dbd6ed64cd7d473c22e382319a01e38
a810a4b0e255909c9a3fd9524c1c9a89b215b1f42e1c7cc40776826c31e1fda2

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Wells Fargo
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /f/go/web/assets/js/index.js HTTP/1.1
Host: wellrt.serveo.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://wellrt.serveo.net/f/go/web/authen.php?web/auth/wells/login/overviewAccounts/overview/index=yngIO1j1L0y1rdMBmN5MpoVhRa2J8izkZsYx4hMJ2EyI8atG5zRgbbKIpjEXlSAmwkHbcLQmsiXhilyM
Cookie: PHPSESSID=git7iqsrv3lac7c1hffqvfrgam
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Length: 13499
Content-Type: text/javascript
Date: Fri, 10 May 2024 15:43:20 GMT
Etag: "34bb-5dbdf05bcc300"
Last-Modified: Tue, 05 Apr 2022 02:30:04 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30

wellrt.serveo.net/f/go/web/assets/css/main.css

138.68.79.95

200 OK

23 kB

URL GET HTTP/1.1
wellrt.serveo.net/f/go/web/assets/css/main.css
IP
138.68.79.95:80
ASN
#14061 DIGITALOCEAN-ASN

Requested by
http://wellrt.serveo.net/f/go/web/authen.php?web/auth/wells/login/overviewAccounts/overview/index=yngIO1j1L0y1rdMBmN5MpoVhRa2J8izkZsYx4hMJ2EyI8atG5zRgbbKIpjEXlSAmwkHbcLQmsiXhilyM

File type
Unicode text, UTF-8 text
Size
23 kB (22564 bytes)
Hash
922412de6675f2d3e5a1f3c59fbfc44f
a94dd5d56b1375e1b2c255f73049f57387f69d7a
c8c20e76ddc7ab2b147d8dd0ba1c4c5b43e0c67e0a9e49cff6f4e918e0ea9b6f

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Wells Fargo
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /f/go/web/assets/css/main.css HTTP/1.1
Host: wellrt.serveo.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://wellrt.serveo.net/f/go/web/authen.php?web/auth/wells/login/overviewAccounts/overview/index=yngIO1j1L0y1rdMBmN5MpoVhRa2J8izkZsYx4hMJ2EyI8atG5zRgbbKIpjEXlSAmwkHbcLQmsiXhilyM
Cookie: PHPSESSID=git7iqsrv3lac7c1hffqvfrgam
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Length: 22564
Content-Type: text/css
Date: Fri, 10 May 2024 15:43:20 GMT
Etag: "5824-5e2aebd706580"
Last-Modified: Thu, 30 Jun 2022 18:50:14 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30

wellrt.serveo.net/f/go/web/assets/fonts/wellsfargoserif-rg.woff2

138.68.79.95

404 Not Found

303 B

URL GET HTTP/1.1
wellrt.serveo.net/f/go/web/assets/fonts/wellsfargoserif-rg.woff2
IP
138.68.79.95:80
ASN
#14061 DIGITALOCEAN-ASN

Requested by
http://wellrt.serveo.net/f/go/web/authen.php?web/auth/wells/login/overviewAccounts/overview/index=yngIO1j1L0y1rdMBmN5MpoVhRa2J8izkZsYx4hMJ2EyI8atG5zRgbbKIpjEXlSAmwkHbcLQmsiXhilyM

File type
HTML document, ASCII text
Size
303 B (303 bytes)
Hash
d15afd56cc9a42edf9caace0cba2c185
a872de4ef8eb36490d30267fad58e2cd730b9015
b3a987540aa7ff71c798d1f30fe24c95dc0b582f7f72719f780bd4f25c5cc123

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Wells Fargo
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /f/go/web/assets/fonts/wellsfargoserif-rg.woff2 HTTP/1.1
Host: wellrt.serveo.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: http://wellrt.serveo.net/f/go/web/assets/css/main.css
Cookie: PHPSESSID=git7iqsrv3lac7c1hffqvfrgam
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
Content-Length: 303
Content-Type: text/html; charset=iso-8859-1
Date: Fri, 10 May 2024 15:43:20 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30

wellrt.serveo.net/f/go/web/assets/fonts/wellsfargosans-sbd.woff2

138.68.79.95

404 Not Found

303 B

URL GET HTTP/1.1
wellrt.serveo.net/f/go/web/assets/fonts/wellsfargosans-sbd.woff2
IP
138.68.79.95:80
ASN
#14061 DIGITALOCEAN-ASN

Requested by
http://wellrt.serveo.net/f/go/web/authen.php?web/auth/wells/login/overviewAccounts/overview/index=yngIO1j1L0y1rdMBmN5MpoVhRa2J8izkZsYx4hMJ2EyI8atG5zRgbbKIpjEXlSAmwkHbcLQmsiXhilyM

File type
HTML document, ASCII text
Size
303 B (303 bytes)
Hash
d15afd56cc9a42edf9caace0cba2c185
a872de4ef8eb36490d30267fad58e2cd730b9015
b3a987540aa7ff71c798d1f30fe24c95dc0b582f7f72719f780bd4f25c5cc123

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Wells Fargo
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /f/go/web/assets/fonts/wellsfargosans-sbd.woff2 HTTP/1.1
Host: wellrt.serveo.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: http://wellrt.serveo.net/f/go/web/assets/css/main.css
Cookie: PHPSESSID=git7iqsrv3lac7c1hffqvfrgam
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
Content-Length: 303
Content-Type: text/html; charset=iso-8859-1
Date: Fri, 10 May 2024 15:43:21 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30

wellrt.serveo.net/f/go/web/assets/fonts/wellsfargosans-rg.woff2

138.68.79.95

404 Not Found

303 B

URL GET HTTP/1.1
wellrt.serveo.net/f/go/web/assets/fonts/wellsfargosans-rg.woff2
IP
138.68.79.95:80
ASN
#14061 DIGITALOCEAN-ASN

Requested by
http://wellrt.serveo.net/f/go/web/authen.php?web/auth/wells/login/overviewAccounts/overview/index=yngIO1j1L0y1rdMBmN5MpoVhRa2J8izkZsYx4hMJ2EyI8atG5zRgbbKIpjEXlSAmwkHbcLQmsiXhilyM

File type
HTML document, ASCII text
Size
303 B (303 bytes)
Hash
d15afd56cc9a42edf9caace0cba2c185
a872de4ef8eb36490d30267fad58e2cd730b9015
b3a987540aa7ff71c798d1f30fe24c95dc0b582f7f72719f780bd4f25c5cc123

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Wells Fargo
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /f/go/web/assets/fonts/wellsfargosans-rg.woff2 HTTP/1.1
Host: wellrt.serveo.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: http://wellrt.serveo.net/f/go/web/assets/css/main.css
Cookie: PHPSESSID=git7iqsrv3lac7c1hffqvfrgam
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
Content-Length: 303
Content-Type: text/html; charset=iso-8859-1
Date: Fri, 10 May 2024 15:43:21 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30

wellrt.serveo.net/f/go/web/assets/fonts/wellsfargoserif-rg.woff

138.68.79.95

404 Not Found

303 B

URL GET HTTP/1.1
wellrt.serveo.net/f/go/web/assets/fonts/wellsfargoserif-rg.woff
IP
138.68.79.95:80
ASN
#14061 DIGITALOCEAN-ASN

Requested by
http://wellrt.serveo.net/f/go/web/authen.php?web/auth/wells/login/overviewAccounts/overview/index=yngIO1j1L0y1rdMBmN5MpoVhRa2J8izkZsYx4hMJ2EyI8atG5zRgbbKIpjEXlSAmwkHbcLQmsiXhilyM

File type
HTML document, ASCII text
Size
303 B (303 bytes)
Hash
d15afd56cc9a42edf9caace0cba2c185
a872de4ef8eb36490d30267fad58e2cd730b9015
b3a987540aa7ff71c798d1f30fe24c95dc0b582f7f72719f780bd4f25c5cc123

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Wells Fargo
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /f/go/web/assets/fonts/wellsfargoserif-rg.woff HTTP/1.1
Host: wellrt.serveo.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: http://wellrt.serveo.net/f/go/web/assets/css/main.css
Cookie: PHPSESSID=git7iqsrv3lac7c1hffqvfrgam
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
Content-Length: 303
Content-Type: text/html; charset=iso-8859-1
Date: Fri, 10 May 2024 15:43:21 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30

wellrt.serveo.net/f/go/web/assets/fonts/wellsfargosans-rg.woff

138.68.79.95

404 Not Found

303 B

URL GET HTTP/1.1
wellrt.serveo.net/f/go/web/assets/fonts/wellsfargosans-rg.woff
IP
138.68.79.95:80
ASN
#14061 DIGITALOCEAN-ASN

Requested by
http://wellrt.serveo.net/f/go/web/authen.php?web/auth/wells/login/overviewAccounts/overview/index=yngIO1j1L0y1rdMBmN5MpoVhRa2J8izkZsYx4hMJ2EyI8atG5zRgbbKIpjEXlSAmwkHbcLQmsiXhilyM

File type
HTML document, ASCII text
Size
303 B (303 bytes)
Hash
d15afd56cc9a42edf9caace0cba2c185
a872de4ef8eb36490d30267fad58e2cd730b9015
b3a987540aa7ff71c798d1f30fe24c95dc0b582f7f72719f780bd4f25c5cc123

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Wells Fargo
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /f/go/web/assets/fonts/wellsfargosans-rg.woff HTTP/1.1
Host: wellrt.serveo.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: http://wellrt.serveo.net/f/go/web/assets/css/main.css
Cookie: PHPSESSID=git7iqsrv3lac7c1hffqvfrgam
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
Content-Length: 303
Content-Type: text/html; charset=iso-8859-1
Date: Fri, 10 May 2024 15:43:22 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30

wellrt.serveo.net/f/go/web/assets/fonts/wellsfargosans-sbd.woff

138.68.79.95

404 Not Found

303 B

URL GET HTTP/1.1
wellrt.serveo.net/f/go/web/assets/fonts/wellsfargosans-sbd.woff
IP
138.68.79.95:80
ASN
#14061 DIGITALOCEAN-ASN

Requested by
http://wellrt.serveo.net/f/go/web/authen.php?web/auth/wells/login/overviewAccounts/overview/index=yngIO1j1L0y1rdMBmN5MpoVhRa2J8izkZsYx4hMJ2EyI8atG5zRgbbKIpjEXlSAmwkHbcLQmsiXhilyM

File type
HTML document, ASCII text
Size
303 B (303 bytes)
Hash
d15afd56cc9a42edf9caace0cba2c185
a872de4ef8eb36490d30267fad58e2cd730b9015
b3a987540aa7ff71c798d1f30fe24c95dc0b582f7f72719f780bd4f25c5cc123

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Wells Fargo
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /f/go/web/assets/fonts/wellsfargosans-sbd.woff HTTP/1.1
Host: wellrt.serveo.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: http://wellrt.serveo.net/f/go/web/assets/css/main.css
Cookie: PHPSESSID=git7iqsrv3lac7c1hffqvfrgam
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
Content-Length: 303
Content-Type: text/html; charset=iso-8859-1
Date: Fri, 10 May 2024 15:43:22 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30

wellrt.serveo.net/f/go/web/assets/fonts/wellsfargoserif-rg.woff2

138.68.79.95

404 Not Found

303 B

URL GET HTTP/1.1
wellrt.serveo.net/f/go/web/assets/fonts/wellsfargoserif-rg.woff2
IP
138.68.79.95:80
ASN
#14061 DIGITALOCEAN-ASN

Requested by
http://wellrt.serveo.net/f/go/web/authen.php?web/auth/wells/login/overviewAccounts/overview/index=yngIO1j1L0y1rdMBmN5MpoVhRa2J8izkZsYx4hMJ2EyI8atG5zRgbbKIpjEXlSAmwkHbcLQmsiXhilyM

File type
HTML document, ASCII text
Size
303 B (303 bytes)
Hash
d15afd56cc9a42edf9caace0cba2c185
a872de4ef8eb36490d30267fad58e2cd730b9015
b3a987540aa7ff71c798d1f30fe24c95dc0b582f7f72719f780bd4f25c5cc123

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Wells Fargo
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /f/go/web/assets/fonts/wellsfargoserif-rg.woff2 HTTP/1.1
Host: wellrt.serveo.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: http://wellrt.serveo.net/f/go/web/assets/css/wfui.css
Cookie: PHPSESSID=git7iqsrv3lac7c1hffqvfrgam
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
Content-Length: 303
Content-Type: text/html; charset=iso-8859-1
Date: Fri, 10 May 2024 15:43:22 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30

wellrt.serveo.net/f/go/web/assets/img/COB-BOB-IRT-enroll_park.jpg

138.68.79.95

200 OK

659 kB

URL GET HTTP/1.1
wellrt.serveo.net/f/go/web/assets/img/COB-BOB-IRT-enroll_park.jpg
IP
138.68.79.95:80
ASN
#14061 DIGITALOCEAN-ASN

Requested by
http://wellrt.serveo.net/f/go/web/authen.php?web/auth/wells/login/overviewAccounts/overview/index=yngIO1j1L0y1rdMBmN5MpoVhRa2J8izkZsYx4hMJ2EyI8atG5zRgbbKIpjEXlSAmwkHbcLQmsiXhilyM

File type
JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=1, copyright=© Jim Purdum], progressive, precision 8, 2400x1600, components 3
Size
659 kB (659319 bytes)
Hash
133068d7ee306f24743190a69b433d39
ddc86ce7958b001acdcd32ff8ee65a9e444a2204
0ec17c78a8c0de92bd385f344308a3e0c715fedbb9b784820bd7aefcfc69c214

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Wells Fargo
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /f/go/web/assets/img/COB-BOB-IRT-enroll_park.jpg HTTP/1.1
Host: wellrt.serveo.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://wellrt.serveo.net/f/go/web/authen.php?web/auth/wells/login/overviewAccounts/overview/index=yngIO1j1L0y1rdMBmN5MpoVhRa2J8izkZsYx4hMJ2EyI8atG5zRgbbKIpjEXlSAmwkHbcLQmsiXhilyM
Cookie: PHPSESSID=git7iqsrv3lac7c1hffqvfrgam
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Length: 659319
Content-Type: image/jpeg
Date: Fri, 10 May 2024 15:43:20 GMT
Etag: "a0f77-5dbdf05bcc300"
Last-Modified: Tue, 05 Apr 2022 02:30:04 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30

wellrt.serveo.net/f/go/web/assets/fonts/wellsfargosans-rg.woff2

138.68.79.95

404 Not Found

303 B

URL GET HTTP/1.1
wellrt.serveo.net/f/go/web/assets/fonts/wellsfargosans-rg.woff2
IP
138.68.79.95:80
ASN
#14061 DIGITALOCEAN-ASN

Requested by
http://wellrt.serveo.net/f/go/web/authen.php?web/auth/wells/login/overviewAccounts/overview/index=yngIO1j1L0y1rdMBmN5MpoVhRa2J8izkZsYx4hMJ2EyI8atG5zRgbbKIpjEXlSAmwkHbcLQmsiXhilyM

File type
HTML document, ASCII text
Size
303 B (303 bytes)
Hash
d15afd56cc9a42edf9caace0cba2c185
a872de4ef8eb36490d30267fad58e2cd730b9015
b3a987540aa7ff71c798d1f30fe24c95dc0b582f7f72719f780bd4f25c5cc123

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Wells Fargo
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /f/go/web/assets/fonts/wellsfargosans-rg.woff2 HTTP/1.1
Host: wellrt.serveo.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: http://wellrt.serveo.net/f/go/web/assets/css/wfui.css
Cookie: PHPSESSID=git7iqsrv3lac7c1hffqvfrgam
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
Content-Length: 303
Content-Type: text/html; charset=iso-8859-1
Date: Fri, 10 May 2024 15:43:23 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30

wellrt.serveo.net/f/go/web/assets/fonts/wellsfargosans-sbd.woff2

138.68.79.95

404 Not Found

303 B

URL GET HTTP/1.1
wellrt.serveo.net/f/go/web/assets/fonts/wellsfargosans-sbd.woff2
IP
138.68.79.95:80
ASN
#14061 DIGITALOCEAN-ASN

Requested by
http://wellrt.serveo.net/f/go/web/authen.php?web/auth/wells/login/overviewAccounts/overview/index=yngIO1j1L0y1rdMBmN5MpoVhRa2J8izkZsYx4hMJ2EyI8atG5zRgbbKIpjEXlSAmwkHbcLQmsiXhilyM

File type
HTML document, ASCII text
Size
303 B (303 bytes)
Hash
d15afd56cc9a42edf9caace0cba2c185
a872de4ef8eb36490d30267fad58e2cd730b9015
b3a987540aa7ff71c798d1f30fe24c95dc0b582f7f72719f780bd4f25c5cc123

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Wells Fargo
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /f/go/web/assets/fonts/wellsfargosans-sbd.woff2 HTTP/1.1
Host: wellrt.serveo.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: http://wellrt.serveo.net/f/go/web/assets/css/wfui.css
Cookie: PHPSESSID=git7iqsrv3lac7c1hffqvfrgam
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
Content-Length: 303
Content-Type: text/html; charset=iso-8859-1
Date: Fri, 10 May 2024 15:43:23 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30

wellrt.serveo.net/f/go/web/assets/fonts/wellsfargoserif-rg.woff

138.68.79.95

404 Not Found

303 B

URL GET HTTP/1.1
wellrt.serveo.net/f/go/web/assets/fonts/wellsfargoserif-rg.woff
IP
138.68.79.95:80
ASN
#14061 DIGITALOCEAN-ASN

Requested by
http://wellrt.serveo.net/f/go/web/authen.php?web/auth/wells/login/overviewAccounts/overview/index=yngIO1j1L0y1rdMBmN5MpoVhRa2J8izkZsYx4hMJ2EyI8atG5zRgbbKIpjEXlSAmwkHbcLQmsiXhilyM

File type
HTML document, ASCII text
Size
303 B (303 bytes)
Hash
d15afd56cc9a42edf9caace0cba2c185
a872de4ef8eb36490d30267fad58e2cd730b9015
b3a987540aa7ff71c798d1f30fe24c95dc0b582f7f72719f780bd4f25c5cc123

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Wells Fargo
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /f/go/web/assets/fonts/wellsfargoserif-rg.woff HTTP/1.1
Host: wellrt.serveo.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: http://wellrt.serveo.net/f/go/web/assets/css/wfui.css
Cookie: PHPSESSID=git7iqsrv3lac7c1hffqvfrgam
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
Content-Length: 303
Content-Type: text/html; charset=iso-8859-1
Date: Fri, 10 May 2024 15:43:23 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30

wellrt.serveo.net/f/go/web/assets/fonts/wellsfargosans-rg.woff

138.68.79.95

404 Not Found

303 B

URL GET HTTP/1.1
wellrt.serveo.net/f/go/web/assets/fonts/wellsfargosans-rg.woff
IP
138.68.79.95:80
ASN
#14061 DIGITALOCEAN-ASN

Requested by
http://wellrt.serveo.net/f/go/web/authen.php?web/auth/wells/login/overviewAccounts/overview/index=yngIO1j1L0y1rdMBmN5MpoVhRa2J8izkZsYx4hMJ2EyI8atG5zRgbbKIpjEXlSAmwkHbcLQmsiXhilyM

File type
HTML document, ASCII text
Size
303 B (303 bytes)
Hash
d15afd56cc9a42edf9caace0cba2c185
a872de4ef8eb36490d30267fad58e2cd730b9015
b3a987540aa7ff71c798d1f30fe24c95dc0b582f7f72719f780bd4f25c5cc123

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Wells Fargo
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /f/go/web/assets/fonts/wellsfargosans-rg.woff HTTP/1.1
Host: wellrt.serveo.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: http://wellrt.serveo.net/f/go/web/assets/css/wfui.css
Cookie: PHPSESSID=git7iqsrv3lac7c1hffqvfrgam
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
Content-Length: 303
Content-Type: text/html; charset=iso-8859-1
Date: Fri, 10 May 2024 15:43:23 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30

wellrt.serveo.net/f/go/web/assets/fonts/wellsfargosans-sbd.woff

138.68.79.95

404 Not Found

303 B

URL GET HTTP/1.1
wellrt.serveo.net/f/go/web/assets/fonts/wellsfargosans-sbd.woff
IP
138.68.79.95:80
ASN
#14061 DIGITALOCEAN-ASN

Requested by
http://wellrt.serveo.net/f/go/web/authen.php?web/auth/wells/login/overviewAccounts/overview/index=yngIO1j1L0y1rdMBmN5MpoVhRa2J8izkZsYx4hMJ2EyI8atG5zRgbbKIpjEXlSAmwkHbcLQmsiXhilyM

File type
HTML document, ASCII text
Size
303 B (303 bytes)
Hash
d15afd56cc9a42edf9caace0cba2c185
a872de4ef8eb36490d30267fad58e2cd730b9015
b3a987540aa7ff71c798d1f30fe24c95dc0b582f7f72719f780bd4f25c5cc123

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Wells Fargo
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /f/go/web/assets/fonts/wellsfargosans-sbd.woff HTTP/1.1
Host: wellrt.serveo.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: http://wellrt.serveo.net/f/go/web/assets/css/wfui.css
Cookie: PHPSESSID=git7iqsrv3lac7c1hffqvfrgam
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
Content-Length: 303
Content-Type: text/html; charset=iso-8859-1
Date: Fri, 10 May 2024 15:43:24 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30

localhost/WellsFargo/Export/img/favicon.ico

0.0.0.0

0 B

URL GET
localhost/WellsFargo/Export/img/favicon.ico
IP
0.0.0.0:0
ASN
#0

Requested by
http://wellrt.serveo.net/f/go/web/authen.php?web/auth/wells/login/overviewAccounts/overview/index=yngIO1j1L0y1rdMBmN5MpoVhRa2J8izkZsYx4hMJ2EyI8atG5zRgbbKIpjEXlSAmwkHbcLQmsiXhilyM

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /WellsFargo/Export/img/favicon.ico HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://wellrt.serveo.net/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (1)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (21)

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL User Request GET HTTP/1.1

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL User Request GET HTTP/1.1

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

File type