connect-rbfculogin.duckdns.org Open in urlscan Pro
34.239.50.116  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request session_index Show response connect-rbfculogin.duckdns.org/rbfcu/secure/login/ses/	68 KB 68 KB	838ms 395ms	Document text/html	34.239.50.116 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://connect-rbfculogin.duckdns.org/rbfcu/secure/login/ses/session_index Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 34.239.50.116 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-239-50-116.compute-1.amazonaws.com Software Apache / Resource Hash a341c5cb507b8ff9bd94affb69e35efe78e5b99a755a07b3748927d51592aa5c Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Sun, 16 Oct 2022 14:24:19 GMT Keep-Alive timeout=5, max=100 Server Apache Transfer-Encoding chunked
GET H/1.1	200 OK	icon.css connect-rbfculogin.duckdns.org/rbfcu/secure/login/ses/files/	569 B 876 B	201ms 199ms	Stylesheet text/css	34.239.50.116 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://connect-rbfculogin.duckdns.org/rbfcu/secure/login/ses/files/icon.css Requested by Host: connect-rbfculogin.duckdns.org URL: https://connect-rbfculogin.duckdns.org/rbfcu/secure/login/ses/session_index Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 34.239.50.116 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-239-50-116.compute-1.amazonaws.com Software Apache / Resource Hash e0c254788ad36f95d44c1786c590263e89ea3976fcbc9ae7c82c52493b254391 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://connect-rbfculogin.duckdns.org/rbfcu/secure/login/ses/session_index User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers Date Sun, 16 Oct 2022 14:24:19 GMT X-Content-Type-Options nosniff Last-Modified Wed, 16 Mar 2022 00:06:08 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 569 X-XSS-Protection 1; mode=block
GET H/1.1	200 OK	cssO.css connect-rbfculogin.duckdns.org/rbfcu/secure/login/ses/files/	10 KB 11 KB	875ms 675ms	Stylesheet text/css	34.239.50.116 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://connect-rbfculogin.duckdns.org/rbfcu/secure/login/ses/files/cssO.css Requested by Host: connect-rbfculogin.duckdns.org URL: https://connect-rbfculogin.duckdns.org/rbfcu/secure/login/ses/session_index Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 34.239.50.116 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-239-50-116.compute-1.amazonaws.com Software Apache / Resource Hash d69c01432ebe21bfd72cba936738c1ab831ce461de00e229dea799e6f932d510 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://connect-rbfculogin.duckdns.org/rbfcu/secure/login/ses/session_index User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers Date Sun, 16 Oct 2022 14:24:19 GMT X-Content-Type-Options nosniff Last-Modified Wed, 16 Mar 2022 00:06:42 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 10544 X-XSS-Protection 1; mode=block
GET H/1.1	200 OK	cssR.css connect-rbfculogin.duckdns.org/rbfcu/secure/login/ses/files/	6 KB 6 KB	904ms 698ms	Stylesheet text/css	34.239.50.116 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://connect-rbfculogin.duckdns.org/rbfcu/secure/login/ses/files/cssR.css Requested by Host: connect-rbfculogin.duckdns.org URL: https://connect-rbfculogin.duckdns.org/rbfcu/secure/login/ses/session_index Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 34.239.50.116 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-239-50-116.compute-1.amazonaws.com Software Apache / Resource Hash 2ddefcdc9f260c5ffeb93fed110fe9d929028226f9a2d8a4934ea52b546e9640 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://connect-rbfculogin.duckdns.org/rbfcu/secure/login/ses/session_index User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers Date Sun, 16 Oct 2022 14:24:19 GMT X-Content-Type-Options nosniff Last-Modified Wed, 16 Mar 2022 00:06:30 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 6014 X-XSS-Protection 1; mode=block
GET H/1.1	404 Not Found	icon connect-rbfculogin.duckdns.org/rbfcu/secure/login/ses/files/	0 0	884ms 674ms	Stylesheet text/html	34.239.50.116 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://connect-rbfculogin.duckdns.org/rbfcu/secure/login/ses/files/icon Requested by Host: connect-rbfculogin.duckdns.org URL: https://connect-rbfculogin.duckdns.org/rbfcu/secure/login/ses/session_index Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 34.239.50.116 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-239-50-116.compute-1.amazonaws.com Software Apache / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer https://connect-rbfculogin.duckdns.org/rbfcu/secure/login/ses/session_index User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers Date Sun, 16 Oct 2022 14:24:19 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=100 Content-Length 315 Content-Type text/html; charset=iso-8859-1
GET H/1.1	200 OK	styles.f461454e21421afe7503.css connect-rbfculogin.duckdns.org/rbfcu/secure/login/ses/files/	189 KB 189 KB	890ms 677ms	Stylesheet text/css	34.239.50.116 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://connect-rbfculogin.duckdns.org/rbfcu/secure/login/ses/files/styles.f461454e21421afe7503.css Requested by Host: connect-rbfculogin.duckdns.org URL: https://connect-rbfculogin.duckdns.org/rbfcu/secure/login/ses/session_index Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 34.239.50.116 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-239-50-116.compute-1.amazonaws.com Software Apache / Resource Hash f4cf0333d9acf7960e3d2a31a49428dc63626458ba024a98b71d57685c471dc9 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://connect-rbfculogin.duckdns.org/rbfcu/secure/login/ses/session_index User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers Date Sun, 16 Oct 2022 14:24:19 GMT X-Content-Type-Options nosniff Last-Modified Wed, 16 Mar 2022 00:06:34 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 193629 X-XSS-Protection 1; mode=block
GET H/1.1	200 OK	rbfcu-logo.svg connect-rbfculogin.duckdns.org/rbfcu/secure/login/ses/files/	5 KB 6 KB	699ms 685ms	Image image/svg+xml	34.239.50.116 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://connect-rbfculogin.duckdns.org/rbfcu/secure/login/ses/files/rbfcu-logo.svg Requested by Host: connect-rbfculogin.duckdns.org URL: https://connect-rbfculogin.duckdns.org/rbfcu/secure/login/ses/session_index Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 34.239.50.116 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-239-50-116.compute-1.amazonaws.com Software Apache / Resource Hash 09092e11153b90955b14c6dcad28c3e2902b035f6b12ac85e24a693e5c97c884 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://connect-rbfculogin.duckdns.org/rbfcu/secure/login/ses/session_index User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers Date Sun, 16 Oct 2022 14:24:19 GMT X-Content-Type-Options nosniff Last-Modified Wed, 16 Mar 2022 00:06:58 GMT Server Apache Content-Type image/svg+xml Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 5383 X-XSS-Protection 1; mode=block
GET H/1.1	200 OK	NCUA-logo-gray.svg connect-rbfculogin.duckdns.org/rbfcu/secure/login/ses/files/	102 KB 102 KB	702ms 687ms	Image image/svg+xml	34.239.50.116 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://connect-rbfculogin.duckdns.org/rbfcu/secure/login/ses/files/NCUA-logo-gray.svg Requested by Host: connect-rbfculogin.duckdns.org URL: https://connect-rbfculogin.duckdns.org/rbfcu/secure/login/ses/session_index Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 34.239.50.116 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-239-50-116.compute-1.amazonaws.com Software Apache / Resource Hash 3dff3ca4b7e7bdeb6a9ee2c92c7141a270ab5f2373304299a99339ef96454759 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://connect-rbfculogin.duckdns.org/rbfcu/secure/login/ses/session_index User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers Date Sun, 16 Oct 2022 14:24:19 GMT X-Content-Type-Options nosniff Last-Modified Wed, 16 Mar 2022 00:06:54 GMT Server Apache Content-Type image/svg+xml Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 104580 X-XSS-Protection 1; mode=block
GET H/1.1	200 OK	EHL-logo-gray.svg connect-rbfculogin.duckdns.org/rbfcu/secure/login/ses/files/	2 KB 2 KB	195ms 195ms	Image image/svg+xml	34.239.50.116 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://connect-rbfculogin.duckdns.org/rbfcu/secure/login/ses/files/EHL-logo-gray.svg Requested by Host: connect-rbfculogin.duckdns.org URL: https://connect-rbfculogin.duckdns.org/rbfcu/secure/login/ses/session_index Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 34.239.50.116 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-239-50-116.compute-1.amazonaws.com Software Apache / Resource Hash 8113eb956366da6d18ed13faa5cc8e9a459c09cdcf41c2619c80828d4ac2b152 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://connect-rbfculogin.duckdns.org/rbfcu/secure/login/ses/session_index User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers Date Sun, 16 Oct 2022 14:24:20 GMT X-Content-Type-Options nosniff Last-Modified Wed, 16 Mar 2022 00:06:56 GMT Server Apache Content-Type image/svg+xml Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 1613 X-XSS-Protection 1; mode=block
GET H/1.1	404 Not Found	white-phone-header.4a066fd87a48426d8cf5.svg connect-rbfculogin.duckdns.org/online/	315 B 315 B	106ms 106ms	Image text/html	34.239.50.116 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://connect-rbfculogin.duckdns.org/online/white-phone-header.4a066fd87a48426d8cf5.svg Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 34.239.50.116 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-239-50-116.compute-1.amazonaws.com Software Apache / Resource Hash d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3 Request headers accept-language de-DE,de;q=0.9 Referer https://connect-rbfculogin.duckdns.org/rbfcu/secure/login/ses/session_index User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers Date Sun, 16 Oct 2022 14:24:20 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=99 Content-Length 315 Content-Type text/html; charset=iso-8859-1
GET H2	200	KFOlCnqEu92Fr1MmEU9fBBc4.woff2 fonts.gstatic.com/s/roboto/v29/	16 KB 16 KB	72ms 23ms	Font font/woff2	2a00:1450:4001:831::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmEU9fBBc4.woff2 Requested by Host: connect-rbfculogin.duckdns.org URL: https://connect-rbfculogin.duckdns.org/rbfcu/secure/login/ses/files/cssR.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash bb46ed079c3dd3c39af5051b4ada48f29f49151dad4fa218117bad2fdb5e616f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://connect-rbfculogin.duckdns.org/ Origin https://connect-rbfculogin.duckdns.org accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers date Tue, 11 Oct 2022 14:02:22 GMT x-content-type-options nosniff age 433318 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 15920 x-xss-protection 0 last-modified Wed, 22 Sep 2021 16:13:21 GMT server sffe report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="apps-themes" expires Wed, 11 Oct 2023 14:02:22 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Randolph Brooks Federal Credit Union (Banking)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://connect-rbfculogin.duckdns.org/rbfcu/secure/login/ses/files/icon Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://connect-rbfculogin.duckdns.org/online/white-phone-header.4a066fd87a48426d8cf5.svg Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

connect-rbfculogin.duckdns.org
fonts.gstatic.com
2a00:1450:4001:831::2003
34.239.50.116
09092e11153b90955b14c6dcad28c3e2902b035f6b12ac85e24a693e5c97c884
2ddefcdc9f260c5ffeb93fed110fe9d929028226f9a2d8a4934ea52b546e9640
3dff3ca4b7e7bdeb6a9ee2c92c7141a270ab5f2373304299a99339ef96454759
8113eb956366da6d18ed13faa5cc8e9a459c09cdcf41c2619c80828d4ac2b152
a341c5cb507b8ff9bd94affb69e35efe78e5b99a755a07b3748927d51592aa5c
bb46ed079c3dd3c39af5051b4ada48f29f49151dad4fa218117bad2fdb5e616f
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
d69c01432ebe21bfd72cba936738c1ab831ce461de00e229dea799e6f932d510
e0c254788ad36f95d44c1786c590263e89ea3976fcbc9ae7c82c52493b254391
f4cf0333d9acf7960e3d2a31a49428dc63626458ba024a98b71d57685c471dc9