securefndom.com Open in urlscan Pro
2606:4700:3037::ac43:beba Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://securefndom.com/
Submission: On February 01 via automatic, source certstream-suspicious (February 1st 2023, 11:03:00 pm UTC) — Scanned from DE

Summary HTTP 11 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 3 domains to perform 11 HTTP transactions. The main IP is 2606:4700:3037::ac43:beba, located in United States and belongs to CLOUDFLARENET, US. The main domain is securefndom.com.
TLS certificate: Issued by GTS CA 1P5 on February 1st 2023. Valid for: 3 months.

This is the only time securefndom.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: First National Bank of Omaha (Banking)

Domain & IP information

	IP Address	AS Autonomous System
8	2606:4700:303... 2606:4700:3037::ac43:beba	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	204.58.233.181 204.58.233.181	14888 (FNNI-AS14888) (FNNI-AS14888)
1	204.58.233.127 204.58.233.127	14888 (FNNI-AS14888) (FNNI-AS14888)
11	3

8 2606:4700:3037::ac43:beba (United States)

ASN13335 (CLOUDFLARENET, US)

securefndom.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 204.58.233.181 (Omaha, United States)

ASN14888 (FNNI-AS14888, US)
PTR: 181

www.securebanklogin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 204.58.233.127 (Omaha, United States)

ASN14888 (FNNI-AS14888, US)
PTR: card.fnbo.com

www.fnbo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	securefndom.com securefndom.com	125 KB
2	securebanklogin.com www.securebanklogin.com — Cisco Umbrella Rank: 161777	26 KB
1	fnbo.com www.fnbo.com — Cisco Umbrella Rank: 144430	3 KB
11	3

	Domain	Requested by
8	securefndom.com	securefndom.com
2	www.securebanklogin.com	securefndom.com
1	www.fnbo.com	securefndom.com
11	3

This site contains links to these domains. Also see Links.

Domain
www.securebanklogin.com
auth.securebanklogin.com
www.fnbo.com

Subject Issuer	Validity	Valid
*.securefndom.com GTS CA 1P5	`2023-02-01` - `2023-05-02`	3 months	crt.sh
www.securebanklogin.com Sectigo RSA Organization Validation Secure Server CA	`2022-02-24` - `2023-02-24`	a year	crt.sh
www.fnbo.com Sectigo RSA Organization Validation Secure Server CA	`2022-02-24` - `2023-02-24`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://securefndom.com/
Frame ID: DDBEBB5473D2BA64DA0C033828C738FC
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

securebanklogin.com - Sign In

Page Statistics

11
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

153 kB
Transfer

385 kB
Size

0
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://www.securebanklogin.com/auth/fnbo/forgot-user-id
Title: Forgot User ID?

Search URL Search Domain Scan URL

URL: https://auth.securebanklogin.com/help/login
Title: Need help?

Search URL Search Domain Scan URL

URL: https://www.fnbo.com/privacy-policy/
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://www.fnbo.com/site/security-center/
Title: Security Statement

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
securefndom.com/ 10 KB
3 KB 578ms
324ms Document
text/html 2606:4700:3037::ac43:beba
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://securefndom.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::ac43:beba , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 47ca707aa14763906a5c60857edde5827a08c9d6fe1e7455cc2880560dd0bb6a

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 792e51363aa190ec-FRA
content-encoding: br
content-type: text/html
date: Wed, 01 Feb 2023 23:02:53 GMT
last-modified: Fri, 27 Jan 2023 12:43:10 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jPQ8BaHsIPHElZY5QOgOZsjch0aag4K963wcmidzNgmLmk7c%2BD4yakZuuI3F6T8GRE9tsg%2Fn1VbhZ4cYLrT7ANUFseQvPk8PdW56xBNkxuK2CIBnvnRSK7dKTfrweRGLCSY4kMXv2nM3SJucLmE%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H2 200 okta-sign-in.min.css
securefndom.com/assets/js/sdk/okta-signin-widget/3.9.2/css/ 213 KB
27 KB 490ms
489ms Stylesheet
text/css 2606:4700:3037::ac43:beba
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://securefndom.com/assets/js/sdk/okta-signin-widget/3.9.2/css/okta-sign-in.min.css
Requested by: Host: securefndom.com
URL: https://securefndom.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::ac43:beba , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 90dbc99bac56732cabd138e190153389a3fcfb496dba4c19623492fd34033188

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securefndom.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Wed, 01 Feb 2023 23:02:53 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Fri, 27 Jan 2023 12:15:42 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"63d3c06e-35533"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jEXdCplKAlXFtHB3h0%2FNsRNfUrN5ZuNe58ODks55lkrNNpOK0xz%2FXTWkD%2F6bIa90JfTkiWFcDVWF7BWZdks2AA%2B5QPCKmpo0CNKsPlf%2Fz4ZIH9ZCkg%2BaKvog7cRJBeKKOrCsdP5mr3wguZc7sTE%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=315360000
cf-ray: 792e51383bd290ec-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 custom-signin.241e0fb439244dc50c5929c0513a6765.css
securefndom.com/assets/loginpage/css/ 2 KB
977 B 350ms
349ms Stylesheet
text/css 2606:4700:3037::ac43:beba
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://securefndom.com/assets/loginpage/css/custom-signin.241e0fb439244dc50c5929c0513a6765.css
Requested by: Host: securefndom.com
URL: https://securefndom.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::ac43:beba , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 12bb3449a4bb9ca47d25fdbd50416b38dbdd295d5a337acdff6d4c9d86187e98

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securefndom.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Wed, 01 Feb 2023 23:02:53 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Fri, 27 Jan 2023 12:15:42 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"63d3c06e-8cf"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=az91QZsbVZJiVjydM3aytxxO%2F6YDB%2BsQeSOJXhPwjjO1FvnVY%2Fe%2FWORFuMw2CcagVrw691LagXi7kW%2FiZakoLQeVQEMiWn%2FKBMn7PNb%2BrV7R6VOSMpfkYH0yKts%2Fx65JSHCdshc%2B7StFn9a%2BNa8%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=315360000
cf-ray: 792e51383bd390ec-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK main.css
www.securebanklogin.com/brand/css/ 5 KB
6 KB 1855ms
166ms Stylesheet
text/css 204.58.233.181
FNNI-AS14888

General

Check archive.org

Show headers Download Go to

Full URL

https://www.securebanklogin.com/brand/css/main.css

Requested by

Host: securefndom.com
URL: https://securefndom.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

204.58.233.181 Omaha, United States, ASN14888 (FNNI-AS14888, US),

Reverse DNS

181

Software

Resource Hash

4a4ad7b452b60390b77a287ccd80c90a95f8eb546c88aa04c783056a9d8e955d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains, max-age=16070400; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securefndom.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date: Wed, 01 Feb 2023 23:02:55 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains, max-age=16070400; includeSubDomains
X-Content-Type-Options: nosniff
Content-Security-Policy: frame-ancestors 'self'
Last-Modified: Tue, 31 Aug 2021 12:40:13 GMT
ETag: "13cb-5cada403d6540"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Vary: Accept-Encoding
Content-Type: text/css
Transfer-Encoding: chunked
Cache-Control: no-cache, no-store
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=10
X-Xss-Protection: 1

GET
H/1.1 200
OK fnbo-simple.svg
www.fnbo.com/images/logos/ 2 KB
3 KB 774ms
166ms Image
image/svg+xml 204.58.233.127
FNNI-AS14888

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fnbo.com/images/logos/fnbo-simple.svg

Requested by

Host: securefndom.com
URL: https://securefndom.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

204.58.233.127 Omaha, United States, ASN14888 (FNNI-AS14888, US),

Reverse DNS

card.fnbo.com

Software

Resource Hash

acf4af3d7cda611d7d3f64fffe00bde4c3ad92dd6bb45ba3596f085c674987c2

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains, max-age=16070400; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securefndom.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date: Wed, 01 Feb 2023 23:02:54 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains, max-age=16070400; includeSubDomains
X-Content-Type-Options: nosniff
Content-Security-Policy: frame-ancestors 'self'
Server-Timing: dtSInfo;desc="0", dtRpid;desc="-1615356560"
Connection: Keep-Alive
Content-Length: 1624
X-Xss-Protection: 1
Last-Modified: Mon, 30 Sep 2019 19:48:31 GMT
ETag: "658-593ca8533e1c0"
Vary: Origin
X-Frame-Options: SAMEORIGIN
Content-Type: image/svg+xml
Access-Control-Allow-Origin: https://www.banking.fnbo.com
Accept-Ranges: bytes
Keep-Alive: timeout=10

GET
H/1.1 200
OK logo-equal-housing-lender.png
www.securebanklogin.com/brand/images/ 19 KB
20 KB 1841ms
167ms Image
image/png 204.58.233.181
FNNI-AS14888

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.securebanklogin.com/brand/images/logo-equal-housing-lender.png

Requested by

Host: securefndom.com
URL: https://securefndom.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

204.58.233.181 Omaha, United States, ASN14888 (FNNI-AS14888, US),

Reverse DNS

181

Software

Resource Hash

c605c016ef2e50c11792b9813e19ce69d04a85c39dfaa96d13b369ee7f002a59

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains, max-age=16070400; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securefndom.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date: Wed, 01 Feb 2023 23:02:55 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains, max-age=16070400; includeSubDomains
X-Content-Type-Options: nosniff
Content-Security-Policy: frame-ancestors 'self'
Last-Modified: Thu, 22 Oct 2020 13:14:51 GMT
ETag: "4bed-5b2423fc4c8c0"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/png
Cache-Control: no-cache, no-store
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=10
Content-Length: 19437
X-Xss-Protection: 1

GET
H2 200 main.js Show response
securefndom.com/js/ 67 KB
25 KB 484ms
484ms Script
application/javascript 2606:4700:3037::ac43:beba
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://securefndom.com/js/main.js
Requested by: Host: securefndom.com
URL: https://securefndom.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::ac43:beba , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f43e8655e57a02158195fb622bee4187a5a95fd667d5ca858b624e0791ab3b5c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securefndom.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Wed, 01 Feb 2023 23:02:53 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Fri, 27 Jan 2023 12:47:04 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"63d3c7c8-10ddc"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UKj6ubIOvzLiqnKf8Ch%2Fr5%2FKucvBaUm8fvkp53g04CcVeSpIZkeU9tsv0Qcs%2FwTGjW%2FrXL1Ur3f8iSAvF2q89e4%2F5rvP4BLYwG%2BIhGbRVFFoH40hjq2FzxSbLCRRKMSSo5TPRxKz%2BpXIhUXTJnE%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=315360000
cf-ray: 792e51385be990ec-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 checkbox-sign-in-widget.png
securefndom.com/assets/js/sdk/okta-signin-widget/3.9.2/img/ui/forms/ 3 KB
4 KB 51ms
50ms Image
image/png 2606:4700:3037::ac43:beba
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securefndom.com/assets/js/sdk/okta-signin-widget/3.9.2/img/ui/forms/checkbox-sign-in-widget.png
Requested by: Host: securefndom.com
URL: https://securefndom.com/assets/js/sdk/okta-signin-widget/3.9.2/css/okta-sign-in.min.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::ac43:beba , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 40810b0318131f9ba52c83a17e633a0ac476ade66ea8a914d6c4980571397665

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securefndom.com/assets/js/sdk/okta-signin-widget/3.9.2/css/okta-sign-in.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Wed, 01 Feb 2023 23:02:55 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 17299
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 3141
last-modified: Fri, 27 Jan 2023 12:15:42 GMT
server: cloudflare
etag: "63d3c06e-c45"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=S3cVEYXprviL9FPHDrlVlKchZ4EAYp6vaLUkBgrj2BMC13vg7kGWVVFn6iTNaSPD3KFqSxquslvy9Tp0CTMjLFoU92r6N5Q8rH%2BHhRBb1qlshkLuOEx%2FvD5S2OM2FabbzaiWr7dRvPasCRWQxe0%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 792e5143dcef3736-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 montserrat-light-webfont.woff
securefndom.com/assets/js/sdk/okta-signin-widget/3.9.2/font/ 22 KB
22 KB 496ms
496ms Font
font/woff 2606:4700:3037::ac43:beba
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://securefndom.com/assets/js/sdk/okta-signin-widget/3.9.2/font/montserrat-light-webfont.woff
Requested by: Host: securefndom.com
URL: https://securefndom.com/assets/js/sdk/okta-signin-widget/3.9.2/css/okta-sign-in.min.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::ac43:beba , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: feb177fb563f478cb8ecade71caea5df5ad318ca161c71875114e504ce304ace

Request headers

Referer: https://securefndom.com/assets/js/sdk/okta-signin-widget/3.9.2/css/okta-sign-in.min.css
Origin: https://securefndom.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Wed, 01 Feb 2023 23:02:55 GMT
cf-cache-status: MISS
last-modified: Fri, 27 Jan 2023 12:33:44 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "63d3c4a8-5660"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9k0vOuSFQJq07hiC5CdxCRI6Hfvw9UhMiM8fKzWyArWbElfcOSPfbCCG%2F%2BST9ZYs75Ug7Jj7QqCnFw9zNnXmc4KkiI56g3nFv1BC4yor7QJ4xqP%2B%2FboTP40b%2Ft3srH4%2Frf%2BZj820W271Bx9kUN4%3D"}],"group":"cf-nel","max_age":604800}
content-type: font/woff
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 792e5143dcf23736-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 22112
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 montserrat-regular-webfont.woff
securefndom.com/assets/js/sdk/okta-signin-widget/3.9.2/font/ 21 KB
22 KB 497ms
496ms Font
font/woff 2606:4700:3037::ac43:beba
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://securefndom.com/assets/js/sdk/okta-signin-widget/3.9.2/font/montserrat-regular-webfont.woff
Requested by: Host: securefndom.com
URL: https://securefndom.com/assets/js/sdk/okta-signin-widget/3.9.2/css/okta-sign-in.min.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::ac43:beba , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1d5325892ecf2dc3abd0caf2a1ef4eabf2477e2937c9a372760fd2acae8fddf3

Request headers

Referer: https://securefndom.com/assets/js/sdk/okta-signin-widget/3.9.2/css/okta-sign-in.min.css
Origin: https://securefndom.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Wed, 01 Feb 2023 23:02:55 GMT
cf-cache-status: MISS
last-modified: Fri, 27 Jan 2023 12:33:46 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "63d3c4aa-55dc"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=h7nqmr7bhkm6QwuidL2thlvik4%2BCQL8yiXp%2BmboGTFiHJYylF6hU3gE%2Fjq5pjoiqzjo5eS2fceufcxEE55jOa46tyDoUVjXFIQA2OkF4q3t7nU1E00pNZg8qGoufRb7LNcfaSEfn3jFrqU8E%2FU8%3D"}],"group":"cf-nel","max_age":604800}
content-type: font/woff
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 792e5143dcf43736-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 21980
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 okticon.woff
securefndom.com/assets/js/sdk/okta-signin-widget/3.9.2/font/ 20 KB
21 KB 456ms
456ms Font
font/woff 2606:4700:3037::ac43:beba
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://securefndom.com/assets/js/sdk/okta-signin-widget/3.9.2/font/okticon.woff
Requested by: Host: securefndom.com
URL: https://securefndom.com/assets/js/sdk/okta-signin-widget/3.9.2/css/okta-sign-in.min.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::ac43:beba , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7eccbb3b4b68f9f24a3b826f2eea4a1bbb48196cb734afc1b62c3d045cb680e1

Request headers

Referer: https://securefndom.com/assets/js/sdk/okta-signin-widget/3.9.2/css/okta-sign-in.min.css
Origin: https://securefndom.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Wed, 01 Feb 2023 23:02:55 GMT
cf-cache-status: MISS
last-modified: Fri, 27 Jan 2023 12:33:48 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "63d3c4ac-5078"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OC1Nqicae%2FhacTjjno2uxXQ7R2jrPUSWLiBBUSeaHUcu6%2FiJKoS1f%2FT4VJO1FSZZwdel6VF3trfZtuK88QtkunTqZ5IN%2BS7VIBVT0DQac25rNY44IPp92FQRRF2R02%2FyZAXSLYc7cID4l%2B0%2FXfw%3D"}],"group":"cf-nel","max_age":604800}
content-type: font/woff
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 792e5143dcf53736-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 20600
expires: Thu, 31 Dec 2037 23:55:55 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: First National Bank of Omaha (Banking)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

securefndom.com
www.fnbo.com
www.securebanklogin.com
204.58.233.127
204.58.233.181
2606:4700:3037::ac43:beba
12bb3449a4bb9ca47d25fdbd50416b38dbdd295d5a337acdff6d4c9d86187e98
1d5325892ecf2dc3abd0caf2a1ef4eabf2477e2937c9a372760fd2acae8fddf3
40810b0318131f9ba52c83a17e633a0ac476ade66ea8a914d6c4980571397665
47ca707aa14763906a5c60857edde5827a08c9d6fe1e7455cc2880560dd0bb6a
4a4ad7b452b60390b77a287ccd80c90a95f8eb546c88aa04c783056a9d8e955d
7eccbb3b4b68f9f24a3b826f2eea4a1bbb48196cb734afc1b62c3d045cb680e1
90dbc99bac56732cabd138e190153389a3fcfb496dba4c19623492fd34033188
acf4af3d7cda611d7d3f64fffe00bde4c3ad92dd6bb45ba3596f085c674987c2
c605c016ef2e50c11792b9813e19ce69d04a85c39dfaa96d13b369ee7f002a59
f43e8655e57a02158195fb622bee4187a5a95fd667d5ca858b624e0791ab3b5c
feb177fb563f478cb8ecade71caea5df5ad318ca161c71875114e504ce304ace

securefndom.com Open in urlscan Pro 2606:4700:3037::ac43:beba Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

11 Requests

100 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

3 IPs

1 Countries

153 kBTransfer

385 kBSize

0 Cookies

4 Outgoing links

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

12 JavaScript Global Variables

0 Cookies

Indicators

securefndom.com Open in urlscan Pro
2606:4700:3037::ac43:beba Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

153 kB
Transfer

385 kB
Size

0
Cookies

11 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!