www.mysecure.investments Open in urlscan Pro
139.99.179.201  Malicious Activity! Public Scan

Submitted URL: http://mysecure.investments/dashboard/
Effective URL: https://www.mysecure.investments/
Submission: On June 26 via manual from AU — Scanned from AU

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 10 HTTP transactions. The main IP is 139.99.179.201, located in Sydney, Australia and belongs to OVH, FR. The main domain is www.mysecure.investments.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on December 7th 2023. Valid for: a year.
This is the only time www.mysecure.investments was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: ING Group (Banking)

Domain & IP information

IP Address AS Autonomous System
4 14 139.99.179.201 16276 (OVH)
10 1
Apex Domain
Subdomains
Transfer
14 mysecure.investments
mysecure.investments
www.mysecure.investments
536 KB
10 1
Domain Requested by
12 www.mysecure.investments 2 redirects www.mysecure.investments
2 mysecure.investments 2 redirects
10 2

This site contains no links.

Subject Issuer Validity Valid
*.mysecure.investments
Sectigo RSA Domain Validation Secure Server CA
2023-12-07 -
2024-12-07
a year crt.sh

This page contains 1 frames:

Primary Page: https://www.mysecure.investments/
Frame ID: 8AFFB693792313CFEFAFBB0F29DA1B90
Requests: 10 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. http://mysecure.investments/dashboard/ HTTP 307
    https://mysecure.investments/dashboard/ HTTP 301
    https://www.mysecure.investments/dashboard/ HTTP 302
    https://www.mysecure.investments/ HTTP 307
    http://mysecure.investments/dashboard/ HTTP 307
    https://mysecure.investments/dashboard/ HTTP 301
    https://www.mysecure.investments/dashboard/ HTTP 302
    https://www.mysecure.investments/ Page URL

Page Statistics

10
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

2
Subdomains

1
IPs

1
Countries

535 kB
Transfer

641 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://mysecure.investments/dashboard/ HTTP 307
    https://mysecure.investments/dashboard/ HTTP 301
    https://www.mysecure.investments/dashboard/ HTTP 302
    https://www.mysecure.investments/ HTTP 307
    http://mysecure.investments/dashboard/ HTTP 307
    https://mysecure.investments/dashboard/ HTTP 301
    https://www.mysecure.investments/dashboard/ HTTP 302
    https://www.mysecure.investments/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
www.mysecure.investments/
Redirect Chain
  • http://mysecure.investments/dashboard/
  • https://mysecure.investments/dashboard/
  • https://www.mysecure.investments/dashboard/
  • https://www.mysecure.investments/
  • http://mysecure.investments/dashboard/
  • https://mysecure.investments/dashboard/
  • https://www.mysecure.investments/dashboard/
  • https://www.mysecure.investments/
2 KB
917 B
Document
General
Full URL
https://www.mysecure.investments/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
139.99.179.201 Sydney, Australia, ASN16276 (OVH, FR),
Reverse DNS
ip201.ip-139-99-179.net
Software
nginx-rc /
Resource Hash
4b7e3eb17f68962fdfa5bb7c7293c94ff623987dbbffeccac41641201eaf26ac
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
en-AU,en;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

cache-control
no-store, no-cache, must-revalidate
content-encoding
br
content-type
text/html; charset=UTF-8
date
Wed, 26 Jun 2024 22:57:43 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
pragma
no-cache
server
nginx-rc
strict-transport-security
max-age=31536000
vary
Accept-Encoding
x-azion-edge-pop
OVH
x-azion-request-id
4d435b0b7306ee2ec3345b02345fdb06-9a105521
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block

Redirect headers

cache-control
no-store, no-cache, must-revalidate
content-type
text/html; charset=UTF-8
date
Wed, 26 Jun 2024 22:57:43 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
location
/
pragma
no-cache
server
nginx-rc
strict-transport-security
max-age=31536000
x-azion-edge-pop
OVH
x-azion-request-id
747b8ae6dd75be97b623485c7c3ba7dd-9a105521
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block
uicons-regular-rounded.min.css
www.mysecure.investments/clientlibs/css/
74 KB
13 KB
Stylesheet
General
Full URL
https://www.mysecure.investments/clientlibs/css/uicons-regular-rounded.min.css
Requested by
Host: www.mysecure.investments
URL: https://www.mysecure.investments/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
139.99.179.201 Sydney, Australia, ASN16276 (OVH, FR),
Reverse DNS
ip201.ip-139-99-179.net
Software
nginx-rc /
Resource Hash
a2c2d93283199ccba077c8343b4bdb898362ae2054305983f54bc7e40af1679d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.mysecure.investments/
Accept-Language
en-AU,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 26 Jun 2024 22:57:44 GMT
content-encoding
br
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
last-modified
Thu, 07 Dec 2023 05:07:17 GMT
server
nginx-rc
x-azion-edge-pop
OVH
etag
W/"65715305-1273b"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/css
cache-control
max-age=2592000
x-azion-request-id
52c6b087eb26819a1c8789ada246d3d0-9a105521
x-xss-protection
1; mode=block
expires
Fri, 26 Jul 2024 22:57:44 GMT
global.min.css
www.mysecure.investments/clientlibs/css/
38 KB
8 KB
Stylesheet
General
Full URL
https://www.mysecure.investments/clientlibs/css/global.min.css
Requested by
Host: www.mysecure.investments
URL: https://www.mysecure.investments/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
139.99.179.201 Sydney, Australia, ASN16276 (OVH, FR),
Reverse DNS
ip201.ip-139-99-179.net
Software
nginx-rc /
Resource Hash
e24c6e1c757f9dd45577cd7c2c4795a9fc9972ede9b1e42eb32dcb0921faa759
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.mysecure.investments/
Accept-Language
en-AU,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 26 Jun 2024 22:57:44 GMT
content-encoding
br
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
last-modified
Thu, 07 Dec 2023 05:07:16 GMT
server
nginx-rc
x-azion-edge-pop
OVH
etag
W/"65715304-994a"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/css
cache-control
max-age=2592000
x-azion-request-id
071fcca998632a9859214dca5cf7e94e-9a105521
x-xss-protection
1; mode=block
expires
Fri, 26 Jul 2024 22:57:44 GMT
auth.min.js
www.mysecure.investments/clientlibs/js/
2 KB
940 B
Script
General
Full URL
https://www.mysecure.investments/clientlibs/js/auth.min.js
Requested by
Host: www.mysecure.investments
URL: https://www.mysecure.investments/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
139.99.179.201 Sydney, Australia, ASN16276 (OVH, FR),
Reverse DNS
ip201.ip-139-99-179.net
Software
nginx-rc /
Resource Hash
e2be7f479711d1ec83fa71c0ef93afc278d6ef6224756050875353d047b0310e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.mysecure.investments/
Accept-Language
en-AU,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 26 Jun 2024 22:57:44 GMT
content-encoding
br
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
last-modified
Thu, 07 Dec 2023 05:16:44 GMT
server
nginx-rc
x-azion-edge-pop
OVH
etag
W/"6571553c-6e8"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/javascript
cache-control
max-age=2592000
x-azion-request-id
b44262bd95f9f2d7922d8ef8eca646aa-9a105521
x-xss-protection
1; mode=block
expires
Fri, 26 Jul 2024 22:57:44 GMT
MeWeb-Regular.woff
www.mysecure.investments/clientlibs/fonts/
36 KB
37 KB
Font
General
Full URL
https://www.mysecure.investments/clientlibs/fonts/MeWeb-Regular.woff
Requested by
Host: www.mysecure.investments
URL: https://www.mysecure.investments/clientlibs/css/global.min.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
139.99.179.201 Sydney, Australia, ASN16276 (OVH, FR),
Reverse DNS
ip201.ip-139-99-179.net
Software
nginx-rc /
Resource Hash
4a0a7668aaa847d33f49023d0982c6331bc9705cad2586eccb8086a680ef534c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.mysecure.investments/clientlibs/css/global.min.css
Origin
https://www.mysecure.investments
Accept-Language
en-AU,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 26 Jun 2024 22:57:44 GMT
content-encoding
br
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
last-modified
Thu, 07 Dec 2023 05:07:19 GMT
server
nginx-rc
x-azion-edge-pop
OVH
etag
W/"65715307-91e0"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
font/woff
cache-control
max-age=2592000
x-azion-request-id
c32aaa43c7f7108f41c16b866f2beccc-9a105521
x-xss-protection
1; mode=block
expires
Fri, 26 Jul 2024 22:57:44 GMT
form-loading.svg
www.mysecure.investments/clientlibs/icons/
642 B
656 B
Image
General
Full URL
https://www.mysecure.investments/clientlibs/icons/form-loading.svg
Requested by
Host: www.mysecure.investments
URL: https://www.mysecure.investments/clientlibs/css/global.min.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
139.99.179.201 Sydney, Australia, ASN16276 (OVH, FR),
Reverse DNS
ip201.ip-139-99-179.net
Software
nginx-rc /
Resource Hash
42e6d71cdd366ee3b9dc6b57e7fcceda458cc400b72404fc718e0b866388c2d6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.mysecure.investments/clientlibs/css/global.min.css
Accept-Language
en-AU,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 26 Jun 2024 22:57:44 GMT
content-encoding
br
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
last-modified
Thu, 07 Dec 2023 05:07:19 GMT
server
nginx-rc
x-azion-edge-pop
OVH
etag
W/"65715307-282"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
cache-control
max-age=2592000
x-azion-request-id
6cdd910dabce1242923e3994f07e44a6-9a105521
x-xss-protection
1; mode=block
expires
Fri, 26 Jul 2024 22:57:44 GMT
welcome-image.webp
www.mysecure.investments/clientlibs/img/
238 KB
238 KB
Image
General
Full URL
https://www.mysecure.investments/clientlibs/img/welcome-image.webp
Requested by
Host: www.mysecure.investments
URL: https://www.mysecure.investments/clientlibs/css/global.min.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
139.99.179.201 Sydney, Australia, ASN16276 (OVH, FR),
Reverse DNS
ip201.ip-139-99-179.net
Software
nginx-rc /
Resource Hash
a25efe506d496fc92230cc33cd967094677bd3f771663bc207be3a8af0724e0e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.mysecure.investments/clientlibs/css/global.min.css
Accept-Language
en-AU,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 26 Jun 2024 22:57:44 GMT
content-encoding
br
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
last-modified
Thu, 07 Dec 2023 05:07:23 GMT
server
nginx-rc
x-azion-edge-pop
OVH
etag
W/"6571530b-3b674"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/webp
cache-control
max-age=2592000
x-azion-request-id
c7ffba33e44faee4e8e31514966e3024-9a105521
x-xss-protection
1; mode=block
expires
Fri, 26 Jul 2024 22:57:44 GMT
MeWeb-Bold.woff
www.mysecure.investments/clientlibs/fonts/
37 KB
38 KB
Font
General
Full URL
https://www.mysecure.investments/clientlibs/fonts/MeWeb-Bold.woff
Requested by
Host: www.mysecure.investments
URL: https://www.mysecure.investments/clientlibs/css/global.min.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
139.99.179.201 Sydney, Australia, ASN16276 (OVH, FR),
Reverse DNS
ip201.ip-139-99-179.net
Software
nginx-rc /
Resource Hash
e5cb35bd410aba4b717a1cc46814a88b50ff311f9514630dffa3480cb43b92e0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.mysecure.investments/clientlibs/css/global.min.css
Origin
https://www.mysecure.investments
Accept-Language
en-AU,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 26 Jun 2024 22:57:44 GMT
content-encoding
br
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
last-modified
Thu, 07 Dec 2023 05:07:19 GMT
server
nginx-rc
x-azion-edge-pop
OVH
etag
W/"65715307-9594"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
font/woff
cache-control
max-age=2592000
x-azion-request-id
90e1f434420c4e456ae3581ef7c0b9ee-9a105521
x-xss-protection
1; mode=block
expires
Fri, 26 Jul 2024 22:57:44 GMT
uicons-regular-rounded.woff2
www.mysecure.investments/clientlibs/icons/
187 KB
187 KB
Font
General
Full URL
https://www.mysecure.investments/clientlibs/icons/uicons-regular-rounded.woff2
Requested by
Host: www.mysecure.investments
URL: https://www.mysecure.investments/clientlibs/css/uicons-regular-rounded.min.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
139.99.179.201 Sydney, Australia, ASN16276 (OVH, FR),
Reverse DNS
ip201.ip-139-99-179.net
Software
nginx-rc /
Resource Hash
9eee7cc9326b966230adf25258fa600bcc53d1938f0fb61bab14982093b893e0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.mysecure.investments/clientlibs/css/uicons-regular-rounded.min.css
Origin
https://www.mysecure.investments
Accept-Language
en-AU,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 26 Jun 2024 22:57:44 GMT
content-encoding
br
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
last-modified
Thu, 07 Dec 2023 05:07:21 GMT
server
nginx-rc
x-azion-edge-pop
OVH
etag
W/"65715309-2eb44"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
font/woff2
cache-control
max-age=2592000
x-azion-request-id
6fc0990059f957ca78b4b93ae1ce370f-9a105521
x-xss-protection
1; mode=block
expires
Fri, 26 Jul 2024 22:57:44 GMT
favicon.svg
www.mysecure.investments/
27 KB
12 KB
Other
General
Full URL
https://www.mysecure.investments/favicon.svg
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
139.99.179.201 Sydney, Australia, ASN16276 (OVH, FR),
Reverse DNS
ip201.ip-139-99-179.net
Software
nginx-rc /
Resource Hash
2a6f0ceb8885c59be4c86a7d0719b4eca4c03ba7490477024bc0746d33682e0e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.mysecure.investments/
Accept-Language
en-AU,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 26 Jun 2024 22:57:44 GMT
content-encoding
br
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
last-modified
Thu, 07 Dec 2023 05:07:12 GMT
server
nginx-rc
x-azion-edge-pop
OVH
etag
W/"65715300-6b46"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
cache-control
max-age=2592000
x-azion-request-id
e26d9458bbb2a9fe91028ecd9859ff67-9a105521
x-xss-protection
1; mode=block
expires
Fri, 26 Jul 2024 22:57:44 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: ING Group (Banking)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

undefined| event object| fence object| sharedStorage

1 Cookies

Domain/Path Name / Value
www.mysecure.investments/ Name: PHPSESSID
Value: p7np93dbpng8tim1kjgn131052

1 Console Messages

Source Level URL
Text
recommendation verbose URL: https://www.mysecure.investments/
Message:
[DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block