navymobilew01otp.duckdns.org Open in urlscan Pro
165.232.152.248 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://navymobilew01otp.duckdns.org/0.html
Submission: On July 03 via automatic, source openphish (July 3rd 2023, 2:05:19 am UTC) — Scanned from DE

Summary HTTP 14 Redirects Links 11 Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 14 HTTP transactions. The main IP is 165.232.152.248, located in Santa Clara, United States and belongs to DIGITALOCEAN-ASN, US. The main domain is navymobilew01otp.duckdns.org.

This is the only time navymobilew01otp.duckdns.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Navy Federal Credit Union (Government)

Domain & IP information

	IP Address	AS Autonomous System
11	165.232.152.248 165.232.152.248	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	2a00:1450:400... 2a00:1450:4001:831::200a	15169 (GOOGLE) (GOOGLE)
1 2	23.67.139.30 23.67.139.30	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2a00:1450:400... 2a00:1450:4001:810::2003	15169 (GOOGLE) (GOOGLE)
14	4

11 165.232.152.248 (Santa Clara, United States)

ASN14061 (DIGITALOCEAN-ASN, US)

navymobilew01otp.duckdns.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:831::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.67.139.30 (Frankfurt am Main, Germany) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a23-67-139-30.deploy.static.akamaitechnologies.com

www.navyfederal.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
web.navyfederal.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:810::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	duckdns.org navymobilew01otp.duckdns.org	120 KB
2	navyfederal.org 1 redirects www.navyfederal.org — Cisco Umbrella Rank: 42424 web.navyfederal.org — Cisco Umbrella Rank: 146478	941 B
1	gstatic.com fonts.gstatic.com	15 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 88	1 KB
14	4

	Domain	Requested by
11	navymobilew01otp.duckdns.org	navymobilew01otp.duckdns.org
1	fonts.gstatic.com	fonts.googleapis.com
1	web.navyfederal.org	navymobilew01otp.duckdns.org
1	www.navyfederal.org	1 redirects
1	fonts.googleapis.com	navymobilew01otp.duckdns.org
14	5

This site contains links to these domains. Also see Links.

Domain
www.navyfederal.org

Subject Issuer	Validity	Valid
upload.video.google.com GTS CA 1C3	`2023-06-19` - `2023-09-11`	3 months	crt.sh
www.navyfederal.org DigiCert SHA2 Extended Validation Server CA	`2022-08-16` - `2023-08-16`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2023-06-19` - `2023-09-11`	3 months	crt.sh

This page contains 2 frames:

Primary Page: http://navymobilew01otp.duckdns.org/0.html
Frame ID: AA73C0946527ED9346D27E00F168374C
Requests: 13 HTTP requests in this frame

Frame: https://web.navyfederal.org/nfoaa-navads/signin.html
Frame ID: D3F5514C74094C3B0D5A082C3EDCCC8F
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Navy Federal Credit Union - We serve where you serve®

Detected technologies

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Page Statistics

14
Requests

21 %
HTTPS

50 %
IPv6

4
Domains

5
Subdomains

4
IPs

2
Countries

136 kB
Transfer

137 kB
Size

0
Cookies

11 Outgoing links

These are links going to different origins than the main page.

URL: https://www.navyfederal.org/

Search URL Search Domain Scan URL

URL: https://www.navyfederal.org/about/about.php
Title: About Us

Search URL Search Domain Scan URL

URL: https://www.navyfederal.org/branches-atms/index.php
Title: Branches & ATMs

Search URL Search Domain Scan URL

URL: https://www.navyfederal.org/about/frequently-asked-questions.php
Title: Questions & Support

Search URL Search Domain Scan URL

URL: https://www.navyfederal.org/how-to-become-a-member/how-to-become-a-member.php
Title: Become a Member »

Search URL Search Domain Scan URL

URL: https://www.navyfederal.org/account-management/how-do-i.php
Title: Need More Information? »

Search URL Search Domain Scan URL

URL: https://www.navyfederal.org/about/careers/
Title: Careers

Search URL Search Domain Scan URL

URL: https://www.navyfederal.org/contact-us/
Title: Contact Us

Search URL Search Domain Scan URL

URL: https://www.navyfederal.org/pdf/ebrochures/1116e.pdf
Title: Federally Insured by NCUA

Search URL Search Domain Scan URL

URL: https://www.navyfederal.org/pdf/publications/NFCU_198_PrivacyPolicy.pdf
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://www.navyfederal.org/pdf/ebrochures/3035_EHL_Poster.pdf
Title: Equal Housing Lender

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 8

https://www.navyfederal.org/nfoaa-navads/signin.html HTTP 301
https://web.navyfederal.org/nfoaa-navads/signin.html

14 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request 0.html Show response
navymobilew01otp.duckdns.org/ 11 KB
11 KB 412ms
158ms Document
text/html 165.232.152.248
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: http://navymobilew01otp.duckdns.org/0.html
Protocol: HTTP/1.1
Server: 165.232.152.248 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache /
Resource Hash: 9d7a6897957a480b2632a2b94661e4c8a609e3fb59cdcb391298e2123706af5e

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Connection: Keep-Alive
Content-Length: 10958
Content-Type: text/html
Date: Mon, 03 Jul 2023 02:05:14 GMT
Keep-Alive: timeout=5, max=100
Last-Modified: Tue, 20 Aug 2019 07:08:36 GMT
Server: Apache

GET
H2 200 css
fonts.googleapis.com/ 5 KB
1 KB 37ms
15ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Requested by

Host: navymobilew01otp.duckdns.org
URL: http://navymobilew01otp.duckdns.org/0.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e334ca19f092778f57815a534078daf8e3fce269e56f7ea374ab3a117eee92ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://navymobilew01otp.duckdns.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 03 Jul 2023 02:05:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 03 Jul 2023 01:04:08 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 03 Jul 2023 02:05:14 GMT

GET
H/1.1 200
OK main-fe9836c9d63c5417997722230cd7d71c.css
navymobilew01otp.duckdns.org/resources/css/ 80 KB
81 KB 158ms
158ms Stylesheet
text/css 165.232.152.248
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: http://navymobilew01otp.duckdns.org/resources/css/main-fe9836c9d63c5417997722230cd7d71c.css
Requested by: Host: navymobilew01otp.duckdns.org
URL: http://navymobilew01otp.duckdns.org/0.html
Protocol: HTTP/1.1
Server: 165.232.152.248 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache /
Resource Hash: 2a73d3044e3b66f0ec9fd279b6da6665d524956077c28195344f1a05bde08c4f

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://navymobilew01otp.duckdns.org/0.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Mon, 03 Jul 2023 02:05:14 GMT
Last-Modified: Sun, 18 Aug 2019 04:52:40 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 82199

GET
H/1.1 200
OK nauth-fe9836c9d63c5417997722230cd7d71c.css
navymobilew01otp.duckdns.org/resources/css/ 4 KB
4 KB 161ms
160ms Stylesheet
text/css 165.232.152.248
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: http://navymobilew01otp.duckdns.org/resources/css/nauth-fe9836c9d63c5417997722230cd7d71c.css
Requested by: Host: navymobilew01otp.duckdns.org
URL: http://navymobilew01otp.duckdns.org/0.html
Protocol: HTTP/1.1
Server: 165.232.152.248 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache /
Resource Hash: aa00e07dba6cb64bf1167ff7a523028f64dc648f2e58382488feeb7689abedfb

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://navymobilew01otp.duckdns.org/0.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Mon, 03 Jul 2023 02:05:14 GMT
Last-Modified: Sun, 18 Aug 2019 04:52:48 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 4229

GET
H/1.1 200
OK next.js Show response
navymobilew01otp.duckdns.org/next/ 752 B
1007 B 316ms
157ms Script
application/javascript 165.232.152.248
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: http://navymobilew01otp.duckdns.org/next/next.js
Requested by: Host: navymobilew01otp.duckdns.org
URL: http://navymobilew01otp.duckdns.org/0.html
Protocol: HTTP/1.1
Server: 165.232.152.248 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache /
Resource Hash: c211bb6d3d6e50b58d05da43cd24dd6706a8af7b009dcfbb226a28901a2ec743

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://navymobilew01otp.duckdns.org/0.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Mon, 03 Jul 2023 02:05:14 GMT
Last-Modified: Tue, 20 Aug 2019 06:30:42 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 752

GET
H/1.1 200
OK img_logo-14091710c18c4576bb05b77eae62912e.png
navymobilew01otp.duckdns.org/resources/images/ 5 KB
5 KB 158ms
157ms Image
image/png 165.232.152.248
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://navymobilew01otp.duckdns.org/resources/images/img_logo-14091710c18c4576bb05b77eae62912e.png
Requested by: Host: navymobilew01otp.duckdns.org
URL: http://navymobilew01otp.duckdns.org/0.html
Protocol: HTTP/1.1
Server: 165.232.152.248 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache /
Resource Hash: fe63c84509133d0aa0265c63a2e18e6c52129bc227b1e2394d8f7c4393193ca7

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://navymobilew01otp.duckdns.org/0.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Mon, 03 Jul 2023 02:05:14 GMT
Last-Modified: Sun, 18 Aug 2019 04:53:42 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 5293

GET
H/1.1 200
OK toolTip-14091710c18c4576bb05b77eae62912e.png
navymobilew01otp.duckdns.org/resources/images/ 3 KB
3 KB 158ms
158ms Image
image/png 165.232.152.248
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://navymobilew01otp.duckdns.org/resources/images/toolTip-14091710c18c4576bb05b77eae62912e.png
Requested by: Host: navymobilew01otp.duckdns.org
URL: http://navymobilew01otp.duckdns.org/0.html
Protocol: HTTP/1.1
Server: 165.232.152.248 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache /
Resource Hash: d27c34d729a5ecd6e06a8f129aa9204554bee5f9ccd9305e3aacc8ec976ada68

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://navymobilew01otp.duckdns.org/0.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Mon, 03 Jul 2023 02:05:14 GMT
Last-Modified: Sun, 18 Aug 2019 04:53:58 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 3252

GET
H/1.1 200
OK tooltip-arrow-left-14091710c18c4576bb05b77eae62912e.png
navymobilew01otp.duckdns.org/resources/images/ 366 B
607 B 158ms
158ms Image
image/png 165.232.152.248
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://navymobilew01otp.duckdns.org/resources/images/tooltip-arrow-left-14091710c18c4576bb05b77eae62912e.png
Requested by: Host: navymobilew01otp.duckdns.org
URL: http://navymobilew01otp.duckdns.org/0.html
Protocol: HTTP/1.1
Server: 165.232.152.248 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache /
Resource Hash: 9d544e86ba76cf0862763c44521e7d08798a7c7a69a963913b01d1cbe618be01

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://navymobilew01otp.duckdns.org/0.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Mon, 03 Jul 2023 02:05:14 GMT
Last-Modified: Sun, 18 Aug 2019 04:54:10 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 366

GET
H/1.1 200
OK img_footer_logo-14091710c18c4576bb05b77eae62912e.png
navymobilew01otp.duckdns.org/resources/images/ 3 KB
3 KB 161ms
161ms Image
image/png 165.232.152.248
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://navymobilew01otp.duckdns.org/resources/images/img_footer_logo-14091710c18c4576bb05b77eae62912e.png
Requested by: Host: navymobilew01otp.duckdns.org
URL: http://navymobilew01otp.duckdns.org/0.html
Protocol: HTTP/1.1
Server: 165.232.152.248 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache /
Resource Hash: 26aa1e5d382461643776161453f29771a528577f5a831f0bb2036e4357513c1e

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://navymobilew01otp.duckdns.org/0.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Mon, 03 Jul 2023 02:05:14 GMT
Last-Modified: Sun, 18 Aug 2019 04:53:30 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 3014

GET
H2

200

signin.html
web.navyfederal.org/nfoaa-navads/ Frame D3F5
Redirect Chain

https://www.navyfederal.org/nfoaa-navads/signin.html
https://web.navyfederal.org/nfoaa-navads/signin.html

0
0

687ms
657ms

Document
text/html

23.67.139.30
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://web.navyfederal.org/nfoaa-navads/signin.html

Requested by

Host: navymobilew01otp.duckdns.org
URL: http://navymobilew01otp.duckdns.org/0.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.67.139.30 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-67-139-30.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://navymobilew01otp.duckdns.org/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=21600
content-encoding: gzip
content-length: 2429
content-type: text/html; charset=UTF-8
date: Mon, 03 Jul 2023 02:05:15 GMT
etag: "1cd4-59c1a4eb327c0-gzip"
expires: Mon, 03 Jul 2023 08:05:15 GMT
last-modified: Tue, 14 Jan 2020 14:21:27 GMT
server: Apache
strict-transport-security: max-age=31536000 ; includeSubDomains
vary: Accept-Encoding
x-akamai-transformed: 9 2225 0 pmb=mTOE,2
x-frame-options: SAMEORIGIN

Redirect headers

content-length: 0
date: Mon, 03 Jul 2023 02:05:14 GMT
location: https://web.navyfederal.org/nfoaa-navads/signin.html
permissions-policy: interest-cohort=()
server: AkamaiGHost
strict-transport-security: max-age=31536000

GET
H/1.1 200
OK bg_footer.png
navymobilew01otp.duckdns.org/resources/images/css/ 188 B
429 B 290ms
158ms Image
image/png 165.232.152.248
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://navymobilew01otp.duckdns.org/resources/images/css/bg_footer.png
Requested by: Host: navymobilew01otp.duckdns.org
URL: http://navymobilew01otp.duckdns.org/resources/css/main-fe9836c9d63c5417997722230cd7d71c.css
Protocol: HTTP/1.1
Server: 165.232.152.248 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache /
Resource Hash: d2860cf4cc49d5ec7dd1dab34f52c9d581125bf44808b437939a9f682e115e0c

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://navymobilew01otp.duckdns.org/resources/css/main-fe9836c9d63c5417997722230cd7d71c.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Mon, 03 Jul 2023 02:05:14 GMT
Last-Modified: Sun, 18 Aug 2019 04:54:24 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 188

GET
H/1.1 200
OK bg_globe.png
navymobilew01otp.duckdns.org/resources/images/css/ 5 KB
5 KB 292ms
157ms Image
image/png 165.232.152.248
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://navymobilew01otp.duckdns.org/resources/images/css/bg_globe.png
Requested by: Host: navymobilew01otp.duckdns.org
URL: http://navymobilew01otp.duckdns.org/resources/css/main-fe9836c9d63c5417997722230cd7d71c.css
Protocol: HTTP/1.1
Server: 165.232.152.248 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache /
Resource Hash: eac7a5450fce00715e381e02b2359fa4bd7ddd5a30f52e15ca9c342ce24d3b37

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://navymobilew01otp.duckdns.org/resources/css/main-fe9836c9d63c5417997722230cd7d71c.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Mon, 03 Jul 2023 02:05:14 GMT
Last-Modified: Sun, 18 Aug 2019 04:54:34 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 4797

GET
H/1.1 200
OK icons.png
navymobilew01otp.duckdns.org/resources/images/css/ 5 KB
6 KB 317ms
160ms Image
image/png 165.232.152.248
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://navymobilew01otp.duckdns.org/resources/images/css/icons.png
Requested by: Host: navymobilew01otp.duckdns.org
URL: http://navymobilew01otp.duckdns.org/resources/css/main-fe9836c9d63c5417997722230cd7d71c.css
Protocol: HTTP/1.1
Server: 165.232.152.248 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache /
Resource Hash: e07f2fb0014dbce90e269cc01c54d59ddb723c4c8b93380d4abc38563eab6d67

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://navymobilew01otp.duckdns.org/resources/css/main-fe9836c9d63c5417997722230cd7d71c.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Mon, 03 Jul 2023 02:05:14 GMT
Last-Modified: Sun, 18 Aug 2019 04:54:46 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 5527

GET
H2 200 6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ 14 KB
15 KB 28ms
7ms Font
font/woff2 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ca57b79a870bbf54700730858603a70d79743779c1b059922ec401bfddc5adc9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: http://navymobilew01otp.duckdns.org
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 26 Jun 2023 18:52:01 GMT
x-content-type-options: nosniff
age: 544393
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14824
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 25 Jun 2024 18:52:01 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Navy Federal Credit Union (Government)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	error	URL: chrome-error://chromewebdata/ Message: Refused to display 'https://web.navyfederal.org/' in a frame because it set 'X-Frame-Options' to 'sameorigin'.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
fonts.gstatic.com
navymobilew01otp.duckdns.org
web.navyfederal.org
www.navyfederal.org
165.232.152.248
23.67.139.30
2a00:1450:4001:810::2003
2a00:1450:4001:831::200a
26aa1e5d382461643776161453f29771a528577f5a831f0bb2036e4357513c1e
2a73d3044e3b66f0ec9fd279b6da6665d524956077c28195344f1a05bde08c4f
9d544e86ba76cf0862763c44521e7d08798a7c7a69a963913b01d1cbe618be01
9d7a6897957a480b2632a2b94661e4c8a609e3fb59cdcb391298e2123706af5e
aa00e07dba6cb64bf1167ff7a523028f64dc648f2e58382488feeb7689abedfb
c211bb6d3d6e50b58d05da43cd24dd6706a8af7b009dcfbb226a28901a2ec743
ca57b79a870bbf54700730858603a70d79743779c1b059922ec401bfddc5adc9
d27c34d729a5ecd6e06a8f129aa9204554bee5f9ccd9305e3aacc8ec976ada68
d2860cf4cc49d5ec7dd1dab34f52c9d581125bf44808b437939a9f682e115e0c
e07f2fb0014dbce90e269cc01c54d59ddb723c4c8b93380d4abc38563eab6d67
e334ca19f092778f57815a534078daf8e3fce269e56f7ea374ab3a117eee92ad
eac7a5450fce00715e381e02b2359fa4bd7ddd5a30f52e15ca9c342ce24d3b37
fe63c84509133d0aa0265c63a2e18e6c52129bc227b1e2394d8f7c4393193ca7

navymobilew01otp.duckdns.org Open in urlscan Pro 165.232.152.248 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

14 Requests

21 %HTTPS

50 %IPv6

4 Domains

5 Subdomains

4 IPs

2 Countries

136 kBTransfer

137 kBSize

0 Cookies

11 Outgoing links

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

8 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

navymobilew01otp.duckdns.org Open in urlscan Pro
165.232.152.248 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

21 %
HTTPS

50 %
IPv6

4
Domains

5
Subdomains

4
IPs

2
Countries

136 kB
Transfer

137 kB
Size

0
Cookies

14 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!