![](/screenshots/70436aa8-d979-4743-9d03-76bad0ae2cf4.png)
boasecured01231.myddns.me
Open in
urlscan Pro
23.20.213.10
Malicious Activity!
Public Scan
Effective URL: https://boasecured01231.myddns.me/login/
Submission: On August 16 via api from US — Scanned from US
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on August 15th 2023. Valid for: 3 months.
This is the only time boasecured01231.myddns.me was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Bank of America (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 5 | 23.20.213.10 23.20.213.10 | 14618 (AMAZON-AES) (AMAZON-AES) | |
1 | 2606:4700::68... 2606:4700::6811:180e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2607:f8b0:400... 2607:f8b0:4006:81c::200a | 15169 (GOOGLE) (GOOGLE) | |
6 | 104.16.168.131 104.16.168.131 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 192.124.249.58 192.124.249.58 | 30148 (SUCURI-SEC) (SUCURI-SEC) | |
1 | 2607:f8b0:400... 2607:f8b0:4006:80c::2003 | 15169 (GOOGLE) (GOOGLE) | |
15 | 7 |
ASN14618 (AMAZON-AES, US)
PTR: ec2-23-20-213-10.compute-1.amazonaws.com
boasecured01231.myddns.me |
ASN13335 (CLOUDFLARENET, US)
hcaptcha.com | |
newassets.hcaptcha.com | |
api2.hcaptcha.com |
ASN30148 (SUCURI-SEC, US)
PTR: cloudproxy10058.sucuri.net
www.popular.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
hcaptcha.com
hcaptcha.com — Cisco Umbrella Rank: 8485 newassets.hcaptcha.com — Cisco Umbrella Rank: 11906 api2.hcaptcha.com — Cisco Umbrella Rank: 24607 |
269 KB |
5 |
myddns.me
2 redirects
boasecured01231.myddns.me |
340 KB |
2 |
popular.com
www.popular.com — Cisco Umbrella Rank: 469346 |
56 KB |
2 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 67 |
2 KB |
1 |
gstatic.com
fonts.gstatic.com |
48 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 245 |
27 KB |
15 | 6 |
Domain | Requested by | |
---|---|---|
5 | boasecured01231.myddns.me |
2 redirects
boasecured01231.myddns.me
|
4 | newassets.hcaptcha.com |
hcaptcha.com
newassets.hcaptcha.com |
2 | www.popular.com |
boasecured01231.myddns.me
|
2 | fonts.googleapis.com |
boasecured01231.myddns.me
|
1 | api2.hcaptcha.com |
newassets.hcaptcha.com
|
1 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | hcaptcha.com |
boasecured01231.myddns.me
|
1 | cdnjs.cloudflare.com |
boasecured01231.myddns.me
|
15 | 8 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
boasecured01231.myddns.me cPanel, Inc. Certification Authority |
2023-08-15 - 2023-11-13 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-07-03 - 2024-07-02 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-07-17 - 2023-10-09 |
3 months | crt.sh |
popular.com Starfield Secure Certificate Authority - G2 |
2023-04-17 - 2024-05-16 |
a year | crt.sh |
*.gstatic.com GTS CA 1C3 |
2023-07-17 - 2023-10-09 |
3 months | crt.sh |
This page contains 3 frames:
Primary Page:
https://boasecured01231.myddns.me/login/
Frame ID: 05FA4A241B3007BAD64E34D677E838A8
Requests: 10 HTTP requests in this frame
Frame:
https://newassets.hcaptcha.com/captcha/v1/c29d40e/static/hcaptcha.html
Frame ID: 4CFFEAAD73940AADB6D8AC1BA8BB27F3
Requests: 2 HTTP requests in this frame
Frame:
https://newassets.hcaptcha.com/captcha/v1/c29d40e/static/hcaptcha.html
Frame ID: 3F18833FAD484B0DA18B107C3966F368
Requests: 4 HTTP requests in this frame
Screenshot
![](/screenshots/70436aa8-d979-4743-9d03-76bad0ae2cf4.png)
Page Title
ShieldSquare CaptchaBank of America | Online Banking | Log In | User IDPage URL History Show full URLs
-
https://boasecured01231.myddns.me/
HTTP 302
https://boasecured01231.myddns.me/login HTTP 301
https://boasecured01231.myddns.me/login/ Page URL
Detected technologies
Detected patterns
- https://hcaptcha.com/([\d]+?)/api.js
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://boasecured01231.myddns.me/
HTTP 302
https://boasecured01231.myddns.me/login HTTP 301
https://boasecured01231.myddns.me/login/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
15 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
boasecured01231.myddns.me/login/ Redirect Chain
|
10 KB 11 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/2.2.2/ |
84 KB 27 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
17 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
all-popular.min.css
boasecured01231.myddns.me/login/def/assets/ |
290 KB 290 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
api.js
hcaptcha.com/1/ |
313 KB 89 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
5 KB 751 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
BofA_rgb.png
boasecured01231.myddns.me/login/def/assets/ |
38 KB 39 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Gotham-Light.woff
www.popular.com/assets/fonts/ |
27 KB 28 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v35/ |
47 KB 48 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Gotham-Medium.woff
www.popular.com/assets/fonts/ |
28 KB 28 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
hcaptcha.html
newassets.hcaptcha.com/captcha/v1/c29d40e/static/ Frame 4CFF |
2 KB 935 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
hcaptcha.html
newassets.hcaptcha.com/captcha/v1/c29d40e/static/ Frame 3F18 |
2 KB 763 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
hcaptcha.js
newassets.hcaptcha.com/captcha/v1/c29d40e/ Frame 4CFF |
313 KB 89 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
hcaptcha.js
newassets.hcaptcha.com/captcha/v1/c29d40e/ Frame 3F18 |
313 KB 89 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame 3F18 |
798 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
checksiteconfig
api2.hcaptcha.com/ Frame 3F18 |
682 B 1 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Bank of America (Banking)11 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 function| $ function| jQuery function| toggleLanguage function| onHcaptchaLoad function| onExpired function| onSubmit object| Raven object| hcaptcha object| grecaptcha2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
boasecured01231.myddns.me/ | Name: PHPSESSID Value: 12984437574dba9ffa47d04d9e250767 |
|
api2.hcaptcha.com/ | Name: __cflb Value: 02DiuHLwzyAZNoSCVjn6MALgguX5ocQp7Ed2mdkSC152k |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
api2.hcaptcha.com
boasecured01231.myddns.me
cdnjs.cloudflare.com
fonts.googleapis.com
fonts.gstatic.com
hcaptcha.com
newassets.hcaptcha.com
www.popular.com
104.16.168.131
192.124.249.58
23.20.213.10
2606:4700::6811:180e
2607:f8b0:4006:80c::2003
2607:f8b0:4006:81c::200a
0c959f3bdb7fd6d4f9a67b416f322e4d1b98bb46c28b257871d9ad7f50aa33f9
30652cee5990b3b76f6cbf6f26362be9254dd62b4c6e6003c1127d1484573787
36e2e222520b1c127e3f90c6563f5e9601738d096aecab7321a166bc55ca78e5
45b3d19466f86d5ea67f1e847d132f25e9234a4c4c72d9bca05aa5ca05387dfd
57cafa49fb677c3f09d6e90b051917d10e7bb54e83102a25f3d32b06e8fa59a7
60acc774f17d339db51c6e762d01202494f4f8d67b20d85d637b74263519647b
661eb7e565261dffa1d061a32c2b7e622c8b292d85fe0964fdd92c02111fb164
67eb879fb1645c73ccbaac598e815fd3901eb5114228021d686b8b5e470edbbd
680cca0752e03485f8f0bf52f01f54d37192243202e1a5a4e663f0f3ffe73e57
7c7818c25a18e8a38553fcbcbc2ad0b5e964103a7d2e494f82815e3f70bf3fc5
8d8feb59ebfd215cb12552201254de8da7406e04fce5019757f104588b05b669
c0c04fb2465be140537197e04b0af2c19132b5376f76c6a74e0c8e5812da349d
dfa729d82a3effadab1000181cb99108f232721e3b0af74cfae4c12704b35a32