secure8w-dcubank.duckdns.org
Open in
urlscan Pro
159.253.120.235
Malicious Activity!
Public Scan
Submission: On October 03 via automatic, source openphish — Scanned from DE
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on September 29th 2022. Valid for: 3 months.
This is the only time secure8w-dcubank.duckdns.org was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Digital Federal Credit Union (Banking) DCU (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 159.253.120.235 159.253.120.235 | 200019 (ALEXHOST) (ALEXHOST) | |
5 | 2600:9000:205... 2600:9000:2057:5400:1a:7edc:a600:93a1 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2a00:1450:400... 2a00:1450:4001:800::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 3.232.141.152 3.232.141.152 | 14618 (AMAZON-AES) (AMAZON-AES) | |
1 | 2a00:1450:400... 2a00:1450:4001:827::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 54.231.231.40 54.231.231.40 | 16509 (AMAZON-02) (AMAZON-02) | |
4 | 2a00:1450:400... 2a00:1450:400d:80a::2003 | 15169 (GOOGLE) (GOOGLE) | |
14 | 7 |
ASN200019 (ALEXHOST, MD)
PTR: c20-cpanel.duckdns.org
secure8w-dcubank.duckdns.org |
ASN14618 (AMAZON-AES, US)
PTR: ec2-3-232-141-152.compute-1.amazonaws.com
usassets.cobrowse.pega.com |
ASN16509 (AMAZON-02, US)
PTR: s3-1.amazonaws.com
s3.amazonaws.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
dcu.org
app.dcu.org — Cisco Umbrella Rank: 225682 |
|
4 |
gstatic.com
fonts.gstatic.com |
251 KB |
2 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 284 fonts.googleapis.com — Cisco Umbrella Rank: 41 |
32 KB |
1 |
amazonaws.com
s3.amazonaws.com |
8 KB |
1 |
pega.com
usassets.cobrowse.pega.com — Cisco Umbrella Rank: 65552 |
4 KB |
1 |
duckdns.org
secure8w-dcubank.duckdns.org |
84 KB |
14 | 6 |
Domain | Requested by | |
---|---|---|
5 | app.dcu.org |
secure8w-dcubank.duckdns.org
|
4 | fonts.gstatic.com |
secure8w-dcubank.duckdns.org
fonts.googleapis.com |
1 | s3.amazonaws.com |
secure8w-dcubank.duckdns.org
|
1 | fonts.googleapis.com |
secure8w-dcubank.duckdns.org
|
1 | usassets.cobrowse.pega.com |
secure8w-dcubank.duckdns.org
|
1 | ajax.googleapis.com |
secure8w-dcubank.duckdns.org
|
1 | secure8w-dcubank.duckdns.org | |
14 | 7 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
secure8w-dcubank.duckdns.org cPanel, Inc. Certification Authority |
2022-09-29 - 2022-12-28 |
3 months | crt.sh |
app.dcu.org Go Daddy Secure Certificate Authority - G2 |
2022-09-15 - 2023-09-07 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2022-09-12 - 2022-12-05 |
3 months | crt.sh |
*.cobrowse.pega.com Go Daddy Secure Certificate Authority - G2 |
2022-03-31 - 2023-03-31 |
a year | crt.sh |
s3.amazonaws.com Amazon |
2022-04-01 - 2023-03-30 |
a year | crt.sh |
*.gstatic.com GTS CA 1C3 |
2022-09-12 - 2022-12-05 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://secure8w-dcubank.duckdns.org/email.html
Frame ID: E725CAD9A7E0B16A85C28535F5416D9E
Requests: 14 HTTP requests in this frame
Screenshot
Page Title
DCU Online - LoginDetected technologies
Google Font API (Font Scripts) ExpandDetected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
jQuery (JavaScript Libraries) Expand
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
email.html
secure8w-dcubank.duckdns.org/ |
84 KB 84 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vendor.d18b62ce.css
app.dcu.org//css/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app.dce111a8.css
app.dcu.org//css/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
64.64d4d70e.css
app.dcu.org//css/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
chunk-common.c2a46c33.css
app.dcu.org//css/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2.7199a3b6.css
app.dcu.org//css/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.6.0/ |
87 KB 31 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
default.css
usassets.cobrowse.pega.com/assets/stylesheets/customer/final/ |
14 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
695 B 965 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
dcuLogoDark.png
s3.amazonaws.com/assets.projectfinance.io/siteAssets/DCU/ |
8 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pe03MImSLYBIv1o4X1M8cc9iB85tU1ECVZl_.woff2
fonts.gstatic.com/s/nunitosans/v12/ |
11 KB 12 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pe03MImSLYBIv1o4X1M8cc8GBs5tU1ECVZl_.woff2
fonts.gstatic.com/s/nunitosans/v12/ |
11 KB 11 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
kJF1BvYX7BgnkSrUwT8OhrdQw4oELdPIeeII9v6oDMzByHX9rA6RzaxHMPdY43zj-jCxv3fzvRNU22ZXGJpEpjC_1n-q_4MrImHCIJIZrDCvHOej.woff2
fonts.gstatic.com/s/materialsymbolsoutlined/v60/ |
216 KB 216 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pe0qMImSLYBIv1o4X1M8cce9I9tAcVwo.woff2
fonts.gstatic.com/s/nunitosans/v12/ |
11 KB 11 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Digital Federal Credit Union (Banking) DCU (Banking)12 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| $ function| jQuery function| myFunction1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
usassets.cobrowse.pega.com/ | Name: AWSALBCORS Value: jwZ/4aYxG29V4s+U8TOgiSyqzQSo47NsrMR2lfcDEHB5uavnqK4Q+8WATvQiZcJYg94gRE92ls1WbZ+ZtZjC1H1AY2G4/siGrHCUMBDTvCEuzeleYxH2oJawNca4 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
app.dcu.org
fonts.googleapis.com
fonts.gstatic.com
s3.amazonaws.com
secure8w-dcubank.duckdns.org
usassets.cobrowse.pega.com
159.253.120.235
2600:9000:2057:5400:1a:7edc:a600:93a1
2a00:1450:4001:800::200a
2a00:1450:4001:827::200a
2a00:1450:400d:80a::2003
3.232.141.152
54.231.231.40
0a91022b9da445fe9aaa584256fdf5d53cd999dbe519c1d6b7fef932ff23febf
1d0212a72c945f081f95aeb32affdb4098f66eda2a4d503cdf6cc9c8138eae4a
a58472929d355d4c4f61a7039048444dae5b9910d7ec0c1aa53cb4634c5a6fae
ae166251db1350a6a21bbe90fdfc17122e7b59ce69e11bccb35bc3692f1567e0
b979904d685baa066813a9a1d569d4b2ef0a0dc16401de96d2f737d76dcb7d2c
c6c96574ba294f0f34a00b5c490ab0f294195668062a04293a5613d2ddee0a13
d1093fceb5f8b35c09e5d3329c8dc55509d7f46096efeea840f6e433212ba45e
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ed539425ada9c89bc1d3f195a530b65d2a9a41dbdd598c2a2a32849d83b357e5
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e