![](/screenshots/00160965-1bff-4b0e-8443-1786e2b489bb.png)
27alert-action31needed2server3connect3au.duckdns.org
Open in
urlscan Pro
143.198.140.192
Malicious Activity!
Public Scan
Effective URL: http://27alert-action31needed2server3connect3au.duckdns.org/home/8838b3a7bb03c9d4008fff52385b88dd/?token=5c6ac16b49a7e6cc5abec3d8e17b64426edc7b5f3f02a3612e7...
Submission: On April 06 via automatic, source openphish — Scanned from DE
Summary
This is the only time 27alert-action31needed2server3connect3au.duckdns.org was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Citibank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 10 | 143.198.140.192 143.198.140.192 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN) | |
1 | 199.188.200.254 199.188.200.254 | 22612 (NAMECHEAP...) (NAMECHEAP-NET) | |
1 | 104.89.31.32 104.89.31.32 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
1 | 104.90.147.119 104.90.147.119 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
22 | 5 |
ASN14061 (DIGITALOCEAN-ASN, US)
27alert-action31needed2server3connect3au.duckdns.org |
ASN22612 (NAMECHEAP-NET, US)
PTR: server267-5.web-hosting.com
devilsms.live |
ASN16625 (AKAMAI-AS, US)
PTR: a104-89-31-32.deploy.static.akamaitechnologies.com
www.citi.com |
ASN16625 (AKAMAI-AS, US)
PTR: a104-90-147-119.deploy.static.akamaitechnologies.com
online.citi.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
duckdns.org
3 redirects
27alert-action31needed2server3connect3au.duckdns.org |
309 KB |
2 |
citi.com
www.citi.com — Cisco Umbrella Rank: 29952 Failed online.citi.com — Cisco Umbrella Rank: 24660 |
172 KB |
1 |
devilsms.live
devilsms.live |
137 KB |
0 |
iovation.com
Failed
ci-mpsnare.iovation.com Failed |
|
22 | 4 |
Domain | Requested by | |
---|---|---|
10 | 27alert-action31needed2server3connect3au.duckdns.org |
3 redirects
27alert-action31needed2server3connect3au.duckdns.org
|
1 | online.citi.com |
27alert-action31needed2server3connect3au.duckdns.org
|
1 | devilsms.live |
27alert-action31needed2server3connect3au.duckdns.org
devilsms.live |
1 | www.citi.com |
27alert-action31needed2server3connect3au.duckdns.org
|
0 | ci-mpsnare.iovation.com Failed |
27alert-action31needed2server3connect3au.duckdns.org
|
22 | 5 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.citi.com |
www.citicards.com |
online.citi.com |
citigoldprivateclient.citi.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
devilsms.live Sectigo RSA Domain Validation Secure Server CA |
2021-09-16 - 2022-09-16 |
a year | crt.sh |
www.citi.com DigiCert SHA2 Extended Validation Server CA |
2021-11-02 - 2022-12-03 |
a year | crt.sh |
online.citibank.com DigiCert SHA2 Extended Validation Server CA |
2020-03-13 - 2022-05-14 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
http://27alert-action31needed2server3connect3au.duckdns.org/home/8838b3a7bb03c9d4008fff52385b88dd/?token=5c6ac16b49a7e6cc5abec3d8e17b64426edc7b5f3f02a3612e7cd8ff8419b82b78b2f961b3a9ea8de587f6873f98a8435f3fed4b6b9ef18660aeb0ef0509884b
Frame ID: 6138D33C63EDCF777398F42EB6364EE6
Requests: 22 HTTP requests in this frame
Screenshot
![](/screenshots/00160965-1bff-4b0e-8443-1786e2b489bb.png)
Page Title
Sign On to Your Citi Account - CitibankPage URL History Show full URLs
-
http://27alert-action31needed2server3connect3au.duckdns.org/home/d9df09f015ed3a3cd5dc8a7d168e3251/?token=0d8538891ad84091457e93929329d87...
HTTP 302
http://27alert-action31needed2server3connect3au.duckdns.org/home/index.php HTTP 302
http://27alert-action31needed2server3connect3au.duckdns.org/home/8838b3a7bb03c9d4008fff52385b88dd?token=5c6ac16b49a7e6cc5abec3d8e17b6442... HTTP 301
http://27alert-action31needed2server3connect3au.duckdns.org/home/8838b3a7bb03c9d4008fff52385b88dd/?token=5c6ac16b49a7e6cc5abec3d8e17b644... Page URL
Page Statistics
17 Outgoing links
These are links going to different origins than the main page.
Title: ATM / Branch
Search URL Search Domain Scan URL
Title: Continuar
Search URL Search Domain Scan URL
Title: CitiĀ® Credit Knowledge Center
Search URL Search Domain Scan URL
Title: Respond to Mail Offer
Search URL Search Domain Scan URL
Title: Savings Made Simple
Search URL Search Domain Scan URL
Title: Mortgage Calculators
Search URL Search Domain Scan URL
Title: Home Equity Calculators
Search URL Search Domain Scan URL
Title: Financial Planning
Search URL Search Domain Scan URL
Title: Market Insights
Search URL Search Domain Scan URL
Title: Investments & Insurance
Search URL Search Domain Scan URL
Title: Find a Wealth Team
Search URL Search Domain Scan URL
Title: Citi Wealth Advisor
Search URL Search Domain Scan URL
Title: Open an Account
Search URL Search Domain Scan URL
Title: Forgot User ID?
Search URL Search Domain Scan URL
Title: Activate a Card
Search URL Search Domain Scan URL
Title: Forgot Password?
Search URL Search Domain Scan URL
Title: Register for Online Access
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://27alert-action31needed2server3connect3au.duckdns.org/home/d9df09f015ed3a3cd5dc8a7d168e3251/?token=0d8538891ad84091457e93929329d87711cd2e225d1eeb0719d8ee608873ad6ee3bdae32e9d538b122b7305f29dd37014160326f65292bb75cab95010e772455
HTTP 302
http://27alert-action31needed2server3connect3au.duckdns.org/home/index.php HTTP 302
http://27alert-action31needed2server3connect3au.duckdns.org/home/8838b3a7bb03c9d4008fff52385b88dd?token=5c6ac16b49a7e6cc5abec3d8e17b64426edc7b5f3f02a3612e7cd8ff8419b82b78b2f961b3a9ea8de587f6873f98a8435f3fed4b6b9ef18660aeb0ef0509884b HTTP 301
http://27alert-action31needed2server3connect3au.duckdns.org/home/8838b3a7bb03c9d4008fff52385b88dd/?token=5c6ac16b49a7e6cc5abec3d8e17b64426edc7b5f3f02a3612e7cd8ff8419b82b78b2f961b3a9ea8de587f6873f98a8435f3fed4b6b9ef18660aeb0ef0509884b Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
22 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
27alert-action31needed2server3connect3au.duckdns.org/home/8838b3a7bb03c9d4008fff52385b88dd/ Redirect Chain
|
306 KB 307 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
Interstate-Light.woff
www.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
Interstate-Bold.woff
www.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
Interstate-Regular.woff
www.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
snare.js
ci-mpsnare.iovation.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
styles.96e48ab9a5610e0bcfb4.css
devilsms.live/css/citi/ |
1 MB 137 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
citilogoredesign.png
www.citi.com/cbol-pre-login-static-assets/citi-branding-assets/images/ |
0 0 |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
050-location@2x.svg
27alert-action31needed2server3connect3au.duckdns.org/home/8838b3a7bb03c9d4008fff52385b88dd/cbol-pre-login-static-assets/citi-branding-assets/images/ |
315 B 315 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon_globe_med-grey@2x.svg
27alert-action31needed2server3connect3au.duckdns.org/home/8838b3a7bb03c9d4008fff52385b88dd/cbol-pre-login-static-assets/citi-branding-assets/images/ |
315 B 315 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
LSO_4959.jpg
online.citi.com/nga-lite-signon/ |
171 KB 172 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Interstate-Light.woff
27alert-action31needed2server3connect3au.duckdns.org/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Interstate-Bold.woff
27alert-action31needed2server3connect3au.duckdns.org/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Interstate-Light.ttf
27alert-action31needed2server3connect3au.duckdns.org/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Interstate-Bold.ttf
27alert-action31needed2server3connect3au.duckdns.org/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
Interstate-Light.woff
devilsms.live/css/citi/cds-assets/fonts/interstate/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
Interstate-Bold.woff
devilsms.live/css/citi/cds-assets/fonts/interstate/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
Interstate-Light.ttf
devilsms.live/css/citi/cds-assets/fonts/interstate/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
Interstate-Bold.ttf
devilsms.live/css/citi/cds-assets/fonts/interstate/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
Interstate-Light.woff
devilsms.live/css/citi/commonui-assets/fonts/interstate/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
Interstate-Bold.woff
devilsms.live/css/citi/commonui-assets/fonts/interstate/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
Interstate-Light.ttf
devilsms.live/css/citi/commonui-assets/fonts/interstate/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
Interstate-Bold.ttf
devilsms.live/css/citi/commonui-assets/fonts/interstate/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- www.citi.com
- URL
- https://www.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Light.woff
- Domain
- www.citi.com
- URL
- https://www.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Bold.woff
- Domain
- www.citi.com
- URL
- https://www.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Regular.woff
- Domain
- ci-mpsnare.iovation.com
- URL
- https://ci-mpsnare.iovation.com/snare.js?_=2352742549835470
- Domain
- devilsms.live
- URL
- https://devilsms.live/css/citi/cds-assets/fonts/interstate/Interstate-Light.woff
- Domain
- devilsms.live
- URL
- https://devilsms.live/css/citi/cds-assets/fonts/interstate/Interstate-Bold.woff
- Domain
- devilsms.live
- URL
- https://devilsms.live/css/citi/cds-assets/fonts/interstate/Interstate-Light.ttf
- Domain
- devilsms.live
- URL
- https://devilsms.live/css/citi/cds-assets/fonts/interstate/Interstate-Bold.ttf
- Domain
- devilsms.live
- URL
- https://devilsms.live/css/citi/commonui-assets/fonts/interstate/Interstate-Light.woff
- Domain
- devilsms.live
- URL
- https://devilsms.live/css/citi/commonui-assets/fonts/interstate/Interstate-Bold.woff
- Domain
- devilsms.live
- URL
- https://devilsms.live/css/citi/commonui-assets/fonts/interstate/Interstate-Light.ttf
- Domain
- devilsms.live
- URL
- https://devilsms.live/css/citi/commonui-assets/fonts/interstate/Interstate-Bold.ttf
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Citibank (Banking)16 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| structuredClone object| oncontextlost object| oncontextrestored boolean| isSpaPage function| _trackAnalytics object| _dl undefined| head undefined| hideStyle undefined| ua undefined| isIE undefined| syncLoadLinks undefined| waitFor object| citiData number| num string| src object| script1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
27alert-action31needed2server3connect3au.duckdns.org/ | Name: PHPSESSID Value: ac13c0820e5427e0b8571bbbb233e882 |
28 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
27alert-action31needed2server3connect3au.duckdns.org
ci-mpsnare.iovation.com
devilsms.live
online.citi.com
www.citi.com
ci-mpsnare.iovation.com
devilsms.live
www.citi.com
104.89.31.32
104.90.147.119
143.198.140.192
199.188.200.254
0e23245693bca156441c22fb50df09547abd2ed825bc4cda1cf16a493d112428
48e89b7e40e096b89d864a5c8ee340ce44ca60fe9675310ef2f3f40a53a7d593
4c4bceaa67185ef298cd35996a41cb40513af27624efed661338f11e234f4955
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855