securedcu.com Open in urlscan Pro
2606:4700:7::60 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://securedcu.com/login
Submission: On April 01 via api (April 1st 2024, 3:41:49 pm UTC) from GB — Scanned from GB

Summary HTTP 20 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 20 HTTP transactions. The main IP is 2606:4700:7::60, located in United States and belongs to CLOUDFLARENET, US. The main domain is securedcu.com.
TLS certificate: Issued by GTS CA 1P5 on March 6th 2024. Valid for: 3 months.

This is the only time securedcu.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Digital Federal Credit Union (Banking) DCU (Banking)

Domain & IP information

	IP Address	AS Autonomous System
15	2606:4700:7::60 2606:4700:7::60	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2a00:1450:400... 2a00:1450:4001:81c::200a	15169 (GOOGLE) (GOOGLE)
1	52.216.209.136 52.216.209.136	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:810::2003	15169 (GOOGLE) (GOOGLE)
20	4

15 2606:4700:7::60 (United States)

ASN13335 (CLOUDFLARENET, US)

securedcu.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:81c::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.216.209.136 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-1.amazonaws.com

s3.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:810::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
15	securedcu.com securedcu.com	624 KB
3	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 35	3 KB
1	gstatic.com fonts.gstatic.com	31 KB
1	amazonaws.com s3.amazonaws.com	8 KB
20	4

	Domain	Requested by
15	securedcu.com	securedcu.com
3	fonts.googleapis.com	securedcu.com
1	fonts.gstatic.com	fonts.googleapis.com
1	s3.amazonaws.com	securedcu.com
20	4

This site contains no links.

Subject Issuer	Validity	Valid
securedcu.com GTS CA 1P5	`2024-03-06` - `2024-06-04`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2024-03-04` - `2024-05-27`	3 months	crt.sh
s3.amazonaws.com Amazon RSA 2048 M01	`2024-02-08` - `2025-01-11`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2024-03-04` - `2024-05-27`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://securedcu.com/login
Frame ID: 9B7D9C290CCC86404333A4872E71974F
Requests: 20 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

DCU Online - Login

Page Statistics

20
Requests

100 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

665 kB
Transfer

1700 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

20 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request login Show response
securedcu.com/ 463 KB
91 KB 849ms
756ms Document
text/html 2606:4700:7::60
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://securedcu.com/login
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:7::60 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Next.js
Resource Hash: eeda129bb7574ddef85349a474ed8c064c3b1d5d9e724c90f8b570f43cb8eb68

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language: en-GB,en;q=0.9
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

cache-control: private
cf-cache-status: MISS
cf-ray: 86d9af624b405314-LHR
content-encoding: br
content-type: text/html; charset=utf-8
date: Mon, 01 Apr 2024 15:41:45 GMT
server: cloudflare
vary: Accept-Encoding
x-do-app-origin: 31b5132e-88b2-4d70-9ad2-c4f8a7a93079
x-do-orig-status: 200
x-powered-by: Next.js

GET
H2 200 c47c75c09bad1449.css
securedcu.com/_next/static/css/ 6 KB
875 B 41ms
40ms Stylesheet
text/css 2606:4700:7::60
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://securedcu.com/_next/static/css/c47c75c09bad1449.css
Requested by: Host: securedcu.com
URL: https://securedcu.com/login
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:7::60 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1242d4fcf5164b2040961442f63bed5a5c8a63cefad4748a8eb44b6588ac308e

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://securedcu.com/login
Origin: https://securedcu.com
accept-language: en-GB,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 15:41:45 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 01 Jan 1980 00:00:01 GMT
server: cloudflare
x-do-app-origin: 31b5132e-88b2-4d70-9ad2-c4f8a7a93079
age: 281457
x-do-orig-status: 200
etag: W/"1698-49773873e8"
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
cache-control: public, max-age=31536000, immutable
cf-ray: 86d9af671fcf5314-LHR

GET
H2 200 webpack-36d12a75f0098f30.js Show response
securedcu.com/_next/static/chunks/ 2 KB
1 KB 44ms
43ms Script
application/javascript 2606:4700:7::60
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://securedcu.com/_next/static/chunks/webpack-36d12a75f0098f30.js
Requested by: Host: securedcu.com
URL: https://securedcu.com/login
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:7::60 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: febd258efb733049bebaeb24269fb6448aee953be138a3fbd7cb96bd63620727

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://securedcu.com/login
Origin: https://securedcu.com
accept-language: en-GB,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 15:41:45 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 01 Jan 1980 00:00:01 GMT
server: cloudflare
x-do-app-origin: 31b5132e-88b2-4d70-9ad2-c4f8a7a93079
age: 281457
x-do-orig-status: 200
etag: W/"892-49773873e8"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
cf-ray: 86d9af671fd05314-LHR

GET
H2 200 framework-5429a50ba5373c56.js Show response
securedcu.com/_next/static/chunks/ 138 KB
45 KB 45ms
44ms Script
application/javascript 2606:4700:7::60
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://securedcu.com/_next/static/chunks/framework-5429a50ba5373c56.js
Requested by: Host: securedcu.com
URL: https://securedcu.com/login
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:7::60 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a922d06946c153c130de6238a7d90e238f1341d19d42cee935017ad7495589e5

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://securedcu.com/login
Origin: https://securedcu.com
accept-language: en-GB,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 15:41:45 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 01 Jan 1980 00:00:01 GMT
server: cloudflare
x-do-app-origin: 31b5132e-88b2-4d70-9ad2-c4f8a7a93079
age: 281457
x-do-orig-status: 200
etag: W/"226b8-49773873e8"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
cf-ray: 86d9af671fd15314-LHR

GET
H2 200 main-cb086c1786f15058.js Show response
securedcu.com/_next/static/chunks/ 107 KB
31 KB 76ms
74ms Script
application/javascript 2606:4700:7::60
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://securedcu.com/_next/static/chunks/main-cb086c1786f15058.js
Requested by: Host: securedcu.com
URL: https://securedcu.com/login
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:7::60 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e9177ab6f90a8989a9f318443290e5319c1120224a8e0cce1158d404a01fc7fd

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://securedcu.com/login
Origin: https://securedcu.com
accept-language: en-GB,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 15:41:45 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 01 Jan 1980 00:00:01 GMT
server: cloudflare
x-do-app-origin: 31b5132e-88b2-4d70-9ad2-c4f8a7a93079
age: 281457
x-do-orig-status: 200
etag: W/"1aa96-49773873e8"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
cf-ray: 86d9af671fd45314-LHR

GET
H2 200 _app-af1d6c8de665c72d.js Show response
securedcu.com/_next/static/chunks/pages/ 1 KB
738 B 44ms
43ms Script
application/javascript 2606:4700:7::60
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://securedcu.com/_next/static/chunks/pages/_app-af1d6c8de665c72d.js
Requested by: Host: securedcu.com
URL: https://securedcu.com/login
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:7::60 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a0ef8191741825b056fb2ded7db636e052fafd5d4b5965e9256d437e91cdd5f7

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://securedcu.com/login
Origin: https://securedcu.com
accept-language: en-GB,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 15:41:45 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 01 Jan 1980 00:00:01 GMT
server: cloudflare
x-do-app-origin: 31b5132e-88b2-4d70-9ad2-c4f8a7a93079
age: 281457
x-do-orig-status: 200
etag: W/"494-49773873e8"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
cf-ray: 86d9af671fd65314-LHR

GET
H2 200 121-b2dfc195099c87c0.js Show response
securedcu.com/_next/static/chunks/ 51 KB
19 KB 49ms
48ms Script
application/javascript 2606:4700:7::60
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://securedcu.com/_next/static/chunks/121-b2dfc195099c87c0.js
Requested by: Host: securedcu.com
URL: https://securedcu.com/login
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:7::60 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e95d906c0c52216cdac16b8fb9ea72b407c806717d2bfa11c80bf7e9574c0272

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://securedcu.com/login
Origin: https://securedcu.com
accept-language: en-GB,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 15:41:45 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 01 Jan 1980 00:00:01 GMT
server: cloudflare
x-do-app-origin: 31b5132e-88b2-4d70-9ad2-c4f8a7a93079
age: 281457
x-do-orig-status: 200
etag: W/"cae4-49773873e8"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
cf-ray: 86d9af671fd75314-LHR

GET
H2 200 847-16b3285606471c70.js Show response
securedcu.com/_next/static/chunks/ 59 KB
20 KB 74ms
73ms Script
application/javascript 2606:4700:7::60
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://securedcu.com/_next/static/chunks/847-16b3285606471c70.js
Requested by: Host: securedcu.com
URL: https://securedcu.com/login
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:7::60 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6075cce8271f2252d195796c93b4810b830afeb37f70990493a4bad8602ec099

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://securedcu.com/login
Origin: https://securedcu.com
accept-language: en-GB,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 15:41:45 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 01 Jan 1980 00:00:01 GMT
server: cloudflare
x-do-app-origin: 31b5132e-88b2-4d70-9ad2-c4f8a7a93079
age: 281457
x-do-orig-status: 200
etag: W/"eb68-49773873e8"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
cf-ray: 86d9af671fd85314-LHR

GET
H2 200 238-c14ed87cdf7f64e6.js Show response
securedcu.com/_next/static/chunks/ 17 KB
6 KB 76ms
75ms Script
application/javascript 2606:4700:7::60
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://securedcu.com/_next/static/chunks/238-c14ed87cdf7f64e6.js
Requested by: Host: securedcu.com
URL: https://securedcu.com/login
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:7::60 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: acc34ef4c08acda33db0ed4209553989b9fda2cbf3f21211f17cfd81210bda39

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://securedcu.com/login
Origin: https://securedcu.com
accept-language: en-GB,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 15:41:45 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 01 Jan 1980 00:00:01 GMT
server: cloudflare
x-do-app-origin: 31b5132e-88b2-4d70-9ad2-c4f8a7a93079
age: 281457
x-do-orig-status: 200
etag: W/"45f8-49773873e8"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
cf-ray: 86d9af671fd95314-LHR

GET
H2 200 login-d93b1e682bb52989.js Show response
securedcu.com/_next/static/chunks/pages/ 471 KB
92 KB 75ms
75ms Script
application/javascript 2606:4700:7::60
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://securedcu.com/_next/static/chunks/pages/login-d93b1e682bb52989.js
Requested by: Host: securedcu.com
URL: https://securedcu.com/login
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:7::60 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b23cecd3463c21b90d83e7857f1dac486997b66bb27f83d5f71687146c8dcd4e

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://securedcu.com/login
Origin: https://securedcu.com
accept-language: en-GB,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 15:41:45 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 01 Jan 1980 00:00:01 GMT
server: cloudflare
x-do-app-origin: 31b5132e-88b2-4d70-9ad2-c4f8a7a93079
age: 281457
x-do-orig-status: 200
etag: W/"75cb4-49773873e8"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
cf-ray: 86d9af671fdb5314-LHR

GET
H2 200 _buildManifest.js Show response
securedcu.com/_next/static/xX9VEJMYaIyvOlR6hCcnn/ 2 KB
831 B 47ms
47ms Script
application/javascript 2606:4700:7::60
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://securedcu.com/_next/static/xX9VEJMYaIyvOlR6hCcnn/_buildManifest.js
Requested by: Host: securedcu.com
URL: https://securedcu.com/login
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:7::60 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b76498cbe1c7b2fb96c3b89de96e5170be04d3493d03f861aaca2b31af087c43

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://securedcu.com/login
Origin: https://securedcu.com
accept-language: en-GB,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 15:41:45 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 01 Jan 1980 00:00:01 GMT
server: cloudflare
x-do-app-origin: 31b5132e-88b2-4d70-9ad2-c4f8a7a93079
age: 281457
x-do-orig-status: 200
etag: W/"82e-49773873e8"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
cf-ray: 86d9af671fdc5314-LHR

GET
H2 200 _ssgManifest.js Show response
securedcu.com/_next/static/xX9VEJMYaIyvOlR6hCcnn/ 77 B
125 B 75ms
75ms Script
application/javascript 2606:4700:7::60
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://securedcu.com/_next/static/xX9VEJMYaIyvOlR6hCcnn/_ssgManifest.js
Requested by: Host: securedcu.com
URL: https://securedcu.com/login
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:7::60 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6f5b4aa00d2f8d6aed9935b471806bf7acef464d0c1d390260e5fe27f800c67e

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://securedcu.com/login
Origin: https://securedcu.com
accept-language: en-GB,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 15:41:45 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 01 Jan 1980 00:00:01 GMT
server: cloudflare
x-do-app-origin: 31b5132e-88b2-4d70-9ad2-c4f8a7a93079
age: 281457
x-do-orig-status: 200
etag: W/"4d-49773873e8"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
cf-ray: 86d9af674ffc5314-LHR

GET
H2 200 css2
fonts.googleapis.com/ 11 KB
1 KB 138ms
50ms Stylesheet
text/css 2a00:1450:4001:81c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Nunito+Sans:wght@300;400;600;700;800&display=swap

Requested by

Host: securedcu.com
URL: https://securedcu.com/login

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

6df562d9e42d2e0be020a7045f7acfa1453c5907c1dd08f8bbe440a37c4f03d3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://securedcu.com/
accept-language: en-GB,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000
date: Mon, 01 Apr 2024 15:41:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 01 Apr 2024 15:41:29 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 01 Apr 2024 15:41:45 GMT

GET
H2 200 css2
fonts.googleapis.com/ 14 KB
896 B 143ms
55ms Stylesheet
text/css 2a00:1450:4001:81c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Inter:wght@300;400;500;600;700;800&display=swap

Requested by

Host: securedcu.com
URL: https://securedcu.com/login

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

24afedd35bb3e4952b7bb115aa726fd5e4b91bce7e8393cc2812dcef850c72e2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://securedcu.com/
accept-language: en-GB,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000
date: Mon, 01 Apr 2024 15:41:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 01 Apr 2024 14:11:55 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 01 Apr 2024 15:41:45 GMT

GET
H2 200 css2
fonts.googleapis.com/ 5 KB
553 B 150ms
62ms Stylesheet
text/css 2a00:1450:4001:81c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=DM+Sans:wght@300;400;500;600;700;800&display=swap

Requested by

Host: securedcu.com
URL: https://securedcu.com/login

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

643ad283417f3fd1330376d4c8e82cac2314bfed4230a35bb145953d0e10bb04

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://securedcu.com/
accept-language: en-GB,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000
date: Mon, 01 Apr 2024 15:41:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 01 Apr 2024 15:41:45 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 01 Apr 2024 15:41:45 GMT

GET
H/1.1 200
OK dcuLogoDark.png
s3.amazonaws.com/assets.projectfinance.io/siteAssets/DCU/ 8 KB
8 KB 383ms
140ms Image
image/png 52.216.209.136
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/assets.projectfinance.io/siteAssets/DCU/dcuLogoDark.png
Requested by: Host: securedcu.com
URL: https://securedcu.com/login
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.216.209.136 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: d1093fceb5f8b35c09e5d3329c8dc55509d7f46096efeea840f6e433212ba45e

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://securedcu.com/
accept-language: en-GB,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Mon, 01 Apr 2024 15:41:46 GMT
Last-Modified: Tue, 12 May 2020 18:43:36 GMT
Server: AmazonS3
x-amz-request-id: 1NQ81K7PEX4YHSRH
ETag: "ae64e87365d6e6696145c8c53ce3632e"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 7743
x-amz-id-2: nWpGS5/gAPQIXzzOiQFlTPlR3lOgEIrx6oa96Tfoo9Dzdw/iWpk++Tvl4xrMA+X+mrAYaYdnzDk=

GET
H2 200 pe0TMImSLYBIv1o4X1M8ce2xCx3yop4tQpF_MeTm0lfGWVpNn64CL7U8upHZIbMV51Q42ptCp7t1R-s.woff2
fonts.gstatic.com/s/nunitosans/v15/ 30 KB
31 KB 132ms
42ms Font
font/woff2 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/nunitosans/v15/pe0TMImSLYBIv1o4X1M8ce2xCx3yop4tQpF_MeTm0lfGWVpNn64CL7U8upHZIbMV51Q42ptCp7t1R-s.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Nunito+Sans:wght@300;400;600;700;800&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1393acc632c160def86b45c2521c8ee742b7e6239d0d90fb95f51d55cf48b9c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://fonts.googleapis.com/
Origin: https://securedcu.com
accept-language: en-GB,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 25 Mar 2024 17:14:35 GMT
x-content-type-options: nosniff
age: 599230
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31052
x-xss-protection: 0
last-modified: Thu, 27 Apr 2023 00:27:41 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 25 Mar 2025 17:14:35 GMT

GET
H2 200 fa-solid-900.0a037305.woff2
securedcu.com/fonts/ 313 KB
313 KB 851ms
849ms Font
font/woff2 2606:4700:7::60
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://securedcu.com/fonts/fa-solid-900.0a037305.woff2
Requested by: Host: securedcu.com
URL: https://securedcu.com/login
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:7::60 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c0fd7653283e19ac86a3245bfd82feab6bc58794511975e68af222fa3800e455

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://securedcu.com/login
Origin: https://securedcu.com
accept-language: en-GB,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 15:41:46 GMT
cf-cache-status: MISS
last-modified: Tue, 01 Jan 1980 00:00:01 GMT
server: cloudflare
x-do-app-origin: 31b5132e-88b2-4d70-9ad2-c4f8a7a93079
x-do-orig-status: 200
etag: W/"4e250-49773873e8"
vary: Accept-Encoding
content-type: font/woff2
cache-control: public, max-age=0
accept-ranges: bytes
cf-ray: 86d9af68390d5314-LHR
content-length: 320080

GET
H2 200 favicon.png
securedcu.com/ 2 KB
2 KB 587ms
587ms Other
image/png 2606:4700:7::60
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://securedcu.com/favicon.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:7::60 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a373c7013ebde4fc6fe1d57199da161a061807cf9068f7f0091948e2008dd4c5

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://securedcu.com/login
accept-language: en-GB,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 15:41:47 GMT
cf-cache-status: MISS
last-modified: Tue, 01 Jan 1980 00:00:01 GMT
server: cloudflare
x-do-app-origin: 31b5132e-88b2-4d70-9ad2-c4f8a7a93079
x-do-orig-status: 200
etag: W/"635-49773873e8"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=0
accept-ranges: bytes
cf-ray: 86d9af6f989b5314-LHR
content-length: 1589

GET
H2 200 favicon.png
securedcu.com/ 2 KB
2 KB 238ms
238ms Other
image/png 2606:4700:7::60
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://securedcu.com/favicon.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:7::60 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a373c7013ebde4fc6fe1d57199da161a061807cf9068f7f0091948e2008dd4c5

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://securedcu.com/login
accept-language: en-GB,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 15:41:47 GMT
cf-cache-status: MISS
last-modified: Tue, 01 Jan 1980 00:00:01 GMT
server: cloudflare
x-do-app-origin: 31b5132e-88b2-4d70-9ad2-c4f8a7a93079
x-do-orig-status: 200
etag: W/"635-49773873e8"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=0
accept-ranges: bytes
cf-ray: 86d9af734bca5314-LHR
content-length: 1589

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Digital Federal Credit Union (Banking) DCU (Banking)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.securedcu.com/	1970-01-20 19:33:07	Name: __cf_bm Value: LTZSX1F.T0FjoKt9zJnUjZx9uYQrNFSxZzoyjiz7udo-1711986105-1.0.1.1-oDf6C6dFVPkvkdOhrAspCuu5.eCa1zVMigQIXirSA8wuC3HHS_b7pKuRrKEcFsKUhG782e_fCmdPoX2jtb98qQ

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
fonts.gstatic.com
s3.amazonaws.com
securedcu.com
2606:4700:7::60
2a00:1450:4001:810::2003
2a00:1450:4001:81c::200a
52.216.209.136
1242d4fcf5164b2040961442f63bed5a5c8a63cefad4748a8eb44b6588ac308e
1393acc632c160def86b45c2521c8ee742b7e6239d0d90fb95f51d55cf48b9c3
24afedd35bb3e4952b7bb115aa726fd5e4b91bce7e8393cc2812dcef850c72e2
6075cce8271f2252d195796c93b4810b830afeb37f70990493a4bad8602ec099
643ad283417f3fd1330376d4c8e82cac2314bfed4230a35bb145953d0e10bb04
6df562d9e42d2e0be020a7045f7acfa1453c5907c1dd08f8bbe440a37c4f03d3
6f5b4aa00d2f8d6aed9935b471806bf7acef464d0c1d390260e5fe27f800c67e
a0ef8191741825b056fb2ded7db636e052fafd5d4b5965e9256d437e91cdd5f7
a373c7013ebde4fc6fe1d57199da161a061807cf9068f7f0091948e2008dd4c5
a922d06946c153c130de6238a7d90e238f1341d19d42cee935017ad7495589e5
acc34ef4c08acda33db0ed4209553989b9fda2cbf3f21211f17cfd81210bda39
b23cecd3463c21b90d83e7857f1dac486997b66bb27f83d5f71687146c8dcd4e
b76498cbe1c7b2fb96c3b89de96e5170be04d3493d03f861aaca2b31af087c43
c0fd7653283e19ac86a3245bfd82feab6bc58794511975e68af222fa3800e455
d1093fceb5f8b35c09e5d3329c8dc55509d7f46096efeea840f6e433212ba45e
e9177ab6f90a8989a9f318443290e5319c1120224a8e0cce1158d404a01fc7fd
e95d906c0c52216cdac16b8fb9ea72b407c806717d2bfa11c80bf7e9574c0272
eeda129bb7574ddef85349a474ed8c064c3b1d5d9e724c90f8b570f43cb8eb68
febd258efb733049bebaeb24269fb6448aee953be138a3fbd7cb96bd63620727

securedcu.com Open in urlscan Pro 2606:4700:7::60 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

20 Requests

100 %HTTPS

75 %IPv6

4 Domains

4 Subdomains

4 IPs

2 Countries

665 kBTransfer

1700 kBSize

1 Cookies

0 Outgoing links

Redirected requests

20 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

11 JavaScript Global Variables

1 Cookies

Indicators

securedcu.com Open in urlscan Pro
2606:4700:7::60 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

20
Requests

100 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

665 kB
Transfer

1700 kB
Size

1
Cookies

20 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!