![](/screenshots/6f1ab3a1-666e-4e42-9085-68f225daf4fd.png)
navymobilew01otp.duckdns.org
Open in
urlscan Pro
165.232.152.248
Malicious Activity!
Public Scan
Submission: On July 03 via automatic, source openphish — Scanned from DE
Summary
This is the only time navymobilew01otp.duckdns.org was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Navy Federal Credit Union (Government)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
11 | 165.232.152.248 165.232.152.248 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN) | |
1 | 2a00:1450:400... 2a00:1450:4001:831::200a | 15169 (GOOGLE) (GOOGLE) | |
1 2 | 23.67.139.30 23.67.139.30 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
1 | 2a00:1450:400... 2a00:1450:4001:810::2003 | 15169 (GOOGLE) (GOOGLE) | |
14 | 4 |
ASN14061 (DIGITALOCEAN-ASN, US)
navymobilew01otp.duckdns.org |
ASN16625 (AKAMAI-AS, US)
PTR: a23-67-139-30.deploy.static.akamaitechnologies.com
www.navyfederal.org | |
web.navyfederal.org |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
duckdns.org
navymobilew01otp.duckdns.org |
120 KB |
2 |
navyfederal.org
1 redirects
www.navyfederal.org — Cisco Umbrella Rank: 42424 web.navyfederal.org — Cisco Umbrella Rank: 146478 |
941 B |
1 |
gstatic.com
fonts.gstatic.com |
15 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 88 |
1 KB |
14 | 4 |
Domain | Requested by | |
---|---|---|
11 | navymobilew01otp.duckdns.org |
navymobilew01otp.duckdns.org
|
1 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | web.navyfederal.org |
navymobilew01otp.duckdns.org
|
1 | www.navyfederal.org | 1 redirects |
1 | fonts.googleapis.com |
navymobilew01otp.duckdns.org
|
14 | 5 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.navyfederal.org |
Subject Issuer | Validity | Valid | |
---|---|---|---|
upload.video.google.com GTS CA 1C3 |
2023-06-19 - 2023-09-11 |
3 months | crt.sh |
www.navyfederal.org DigiCert SHA2 Extended Validation Server CA |
2022-08-16 - 2023-08-16 |
a year | crt.sh |
*.gstatic.com GTS CA 1C3 |
2023-06-19 - 2023-09-11 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
http://navymobilew01otp.duckdns.org/0.html
Frame ID: AA73C0946527ED9346D27E00F168374C
Requests: 13 HTTP requests in this frame
Frame:
https://web.navyfederal.org/nfoaa-navads/signin.html
Frame ID: D3F5514C74094C3B0D5A082C3EDCCC8F
Requests: 1 HTTP requests in this frame
Screenshot
![](/screenshots/6f1ab3a1-666e-4e42-9085-68f225daf4fd.png)
Page Title
Navy Federal Credit Union - We serve where you serve®Detected technologies
![](/vendor/wappa/icons/Google Font API.png)
Detected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Page Statistics
11 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Title: About Us
Search URL Search Domain Scan URL
Title: Branches & ATMs
Search URL Search Domain Scan URL
Title: Questions & Support
Search URL Search Domain Scan URL
Title: Become a Member »
Search URL Search Domain Scan URL
Title: Need More Information? »
Search URL Search Domain Scan URL
Title: Careers
Search URL Search Domain Scan URL
Title: Contact Us
Search URL Search Domain Scan URL
Title: Federally Insured by NCUA
Search URL Search Domain Scan URL
Title: Privacy Policy
Search URL Search Domain Scan URL
Title: Equal Housing Lender
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 8- https://www.navyfederal.org/nfoaa-navads/signin.html HTTP 301
- https://web.navyfederal.org/nfoaa-navads/signin.html
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
0.html
navymobilew01otp.duckdns.org/ |
11 KB 11 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
5 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main-fe9836c9d63c5417997722230cd7d71c.css
navymobilew01otp.duckdns.org/resources/css/ |
80 KB 81 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
nauth-fe9836c9d63c5417997722230cd7d71c.css
navymobilew01otp.duckdns.org/resources/css/ |
4 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
next.js
navymobilew01otp.duckdns.org/next/ |
752 B 1007 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
img_logo-14091710c18c4576bb05b77eae62912e.png
navymobilew01otp.duckdns.org/resources/images/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
toolTip-14091710c18c4576bb05b77eae62912e.png
navymobilew01otp.duckdns.org/resources/images/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
tooltip-arrow-left-14091710c18c4576bb05b77eae62912e.png
navymobilew01otp.duckdns.org/resources/images/ |
366 B 607 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
img_footer_logo-14091710c18c4576bb05b77eae62912e.png
navymobilew01otp.duckdns.org/resources/images/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
signin.html
web.navyfederal.org/nfoaa-navads/ Frame D3F5 Redirect Chain
|
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bg_footer.png
navymobilew01otp.duckdns.org/resources/images/css/ |
188 B 429 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bg_globe.png
navymobilew01otp.duckdns.org/resources/images/css/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icons.png
navymobilew01otp.duckdns.org/resources/images/css/ |
5 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ |
14 KB 15 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Navy Federal Credit Union (Government)8 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 boolean| credentialless object| onbeforetoggle object| onscrollend function| next function| enable number| year0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fonts.googleapis.com
fonts.gstatic.com
navymobilew01otp.duckdns.org
web.navyfederal.org
www.navyfederal.org
165.232.152.248
23.67.139.30
2a00:1450:4001:810::2003
2a00:1450:4001:831::200a
26aa1e5d382461643776161453f29771a528577f5a831f0bb2036e4357513c1e
2a73d3044e3b66f0ec9fd279b6da6665d524956077c28195344f1a05bde08c4f
9d544e86ba76cf0862763c44521e7d08798a7c7a69a963913b01d1cbe618be01
9d7a6897957a480b2632a2b94661e4c8a609e3fb59cdcb391298e2123706af5e
aa00e07dba6cb64bf1167ff7a523028f64dc648f2e58382488feeb7689abedfb
c211bb6d3d6e50b58d05da43cd24dd6706a8af7b009dcfbb226a28901a2ec743
ca57b79a870bbf54700730858603a70d79743779c1b059922ec401bfddc5adc9
d27c34d729a5ecd6e06a8f129aa9204554bee5f9ccd9305e3aacc8ec976ada68
d2860cf4cc49d5ec7dd1dab34f52c9d581125bf44808b437939a9f682e115e0c
e07f2fb0014dbce90e269cc01c54d59ddb723c4c8b93380d4abc38563eab6d67
e334ca19f092778f57815a534078daf8e3fce269e56f7ea374ab3a117eee92ad
eac7a5450fce00715e381e02b2359fa4bd7ddd5a30f52e15ca9c342ce24d3b37
fe63c84509133d0aa0265c63a2e18e6c52129bc227b1e2394d8f7c4393193ca7