mail.navymobilew01otp.duckdns.org
Open in
urlscan Pro
165.232.152.248
Malicious Activity!
Public Scan
Effective URL: http://mail.navymobilew01otp.duckdns.org/0.html
Submission: On July 03 via automatic, source openphish — Scanned from DE
Summary
This is the only time mail.navymobilew01otp.duckdns.org was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Navy Federal Credit Union (Government)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
13 | 165.232.152.248 165.232.152.248 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN) | |
1 | 2a00:1450:400... 2a00:1450:4001:828::200a | 15169 (GOOGLE) (GOOGLE) | |
1 2 | 23.67.139.30 23.67.139.30 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
1 | 2a00:1450:400... 2a00:1450:4001:806::2003 | 15169 (GOOGLE) (GOOGLE) | |
16 | 4 |
ASN14061 (DIGITALOCEAN-ASN, US)
mail.navymobilew01otp.duckdns.org |
ASN16625 (AKAMAI-AS, US)
PTR: a23-67-139-30.deploy.static.akamaitechnologies.com
www.navyfederal.org | |
web.navyfederal.org |
Apex Domain Subdomains |
Transfer | |
---|---|---|
13 |
duckdns.org
mail.navymobilew01otp.duckdns.org |
121 KB |
2 |
navyfederal.org
1 redirects
www.navyfederal.org — Cisco Umbrella Rank: 42424 web.navyfederal.org — Cisco Umbrella Rank: 146478 |
940 B |
1 |
gstatic.com
fonts.gstatic.com |
15 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 88 |
1 KB |
16 | 4 |
Domain | Requested by | |
---|---|---|
13 | mail.navymobilew01otp.duckdns.org |
mail.navymobilew01otp.duckdns.org
|
1 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | web.navyfederal.org |
mail.navymobilew01otp.duckdns.org
|
1 | www.navyfederal.org | 1 redirects |
1 | fonts.googleapis.com |
mail.navymobilew01otp.duckdns.org
|
16 | 5 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.navyfederal.org |
Subject Issuer | Validity | Valid | |
---|---|---|---|
upload.video.google.com GTS CA 1C3 |
2023-06-19 - 2023-09-11 |
3 months | crt.sh |
www.navyfederal.org DigiCert SHA2 Extended Validation Server CA |
2022-08-16 - 2023-08-16 |
a year | crt.sh |
*.gstatic.com GTS CA 1C3 |
2023-06-19 - 2023-09-11 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
http://mail.navymobilew01otp.duckdns.org/0.html
Frame ID: 10B7966C0B42E0065018C82BF712EC7C
Requests: 15 HTTP requests in this frame
Frame:
https://web.navyfederal.org/nfoaa-navads/signin.html
Frame ID: 394394BFB41F583192D39BF3A6D142AC
Requests: 1 HTTP requests in this frame
Screenshot
Page Title
Navy Federal Credit Union - We serve where you serve®Page URL History Show full URLs
- http://mail.navymobilew01otp.duckdns.org/ Page URL
- http://mail.navymobilew01otp.duckdns.org/0.html Page URL
Detected technologies
Google Font API (Font Scripts) ExpandDetected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Page Statistics
11 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Title: About Us
Search URL Search Domain Scan URL
Title: Branches & ATMs
Search URL Search Domain Scan URL
Title: Questions & Support
Search URL Search Domain Scan URL
Title: Become a Member »
Search URL Search Domain Scan URL
Title: Need More Information? »
Search URL Search Domain Scan URL
Title: Careers
Search URL Search Domain Scan URL
Title: Contact Us
Search URL Search Domain Scan URL
Title: Federally Insured by NCUA
Search URL Search Domain Scan URL
Title: Privacy Policy
Search URL Search Domain Scan URL
Title: Equal Housing Lender
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://mail.navymobilew01otp.duckdns.org/ Page URL
- http://mail.navymobilew01otp.duckdns.org/0.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 10- https://www.navyfederal.org/nfoaa-navads/signin.html HTTP 301
- https://web.navyfederal.org/nfoaa-navads/signin.html
16 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
mail.navymobilew01otp.duckdns.org/ |
186 B 428 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
init.js
mail.navymobilew01otp.duckdns.org/next/ |
349 B 603 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
0.html
mail.navymobilew01otp.duckdns.org/ |
11 KB 11 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
5 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main-fe9836c9d63c5417997722230cd7d71c.css
mail.navymobilew01otp.duckdns.org/resources/css/ |
80 KB 81 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
nauth-fe9836c9d63c5417997722230cd7d71c.css
mail.navymobilew01otp.duckdns.org/resources/css/ |
4 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
next.js
mail.navymobilew01otp.duckdns.org/next/ |
752 B 1007 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
img_logo-14091710c18c4576bb05b77eae62912e.png
mail.navymobilew01otp.duckdns.org/resources/images/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
toolTip-14091710c18c4576bb05b77eae62912e.png
mail.navymobilew01otp.duckdns.org/resources/images/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
tooltip-arrow-left-14091710c18c4576bb05b77eae62912e.png
mail.navymobilew01otp.duckdns.org/resources/images/ |
366 B 607 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
img_footer_logo-14091710c18c4576bb05b77eae62912e.png
mail.navymobilew01otp.duckdns.org/resources/images/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
signin.html
web.navyfederal.org/nfoaa-navads/ Frame 3943 Redirect Chain
|
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bg_footer.png
mail.navymobilew01otp.duckdns.org/resources/images/css/ |
188 B 429 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bg_globe.png
mail.navymobilew01otp.duckdns.org/resources/images/css/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icons.png
mail.navymobilew01otp.duckdns.org/resources/images/css/ |
5 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ |
14 KB 15 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Navy Federal Credit Union (Government)8 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 boolean| credentialless object| onbeforetoggle object| onscrollend function| next function| enable number| year0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fonts.googleapis.com
fonts.gstatic.com
mail.navymobilew01otp.duckdns.org
web.navyfederal.org
www.navyfederal.org
165.232.152.248
23.67.139.30
2a00:1450:4001:806::2003
2a00:1450:4001:828::200a
154562251791247dd95fcddbbd905d6a4266b328f5ecc0b5e30d2b83c07aca61
26aa1e5d382461643776161453f29771a528577f5a831f0bb2036e4357513c1e
2a73d3044e3b66f0ec9fd279b6da6665d524956077c28195344f1a05bde08c4f
74ac80d444b24e2901fcf4d55fe19ee14482a3615d477ebaf84792d2ad8a0712
9d544e86ba76cf0862763c44521e7d08798a7c7a69a963913b01d1cbe618be01
9d7a6897957a480b2632a2b94661e4c8a609e3fb59cdcb391298e2123706af5e
aa00e07dba6cb64bf1167ff7a523028f64dc648f2e58382488feeb7689abedfb
c211bb6d3d6e50b58d05da43cd24dd6706a8af7b009dcfbb226a28901a2ec743
ca57b79a870bbf54700730858603a70d79743779c1b059922ec401bfddc5adc9
d27c34d729a5ecd6e06a8f129aa9204554bee5f9ccd9305e3aacc8ec976ada68
d2860cf4cc49d5ec7dd1dab34f52c9d581125bf44808b437939a9f682e115e0c
e07f2fb0014dbce90e269cc01c54d59ddb723c4c8b93380d4abc38563eab6d67
e334ca19f092778f57815a534078daf8e3fce269e56f7ea374ab3a117eee92ad
eac7a5450fce00715e381e02b2359fa4bd7ddd5a30f52e15ca9c342ce24d3b37
fe63c84509133d0aa0265c63a2e18e6c52129bc227b1e2394d8f7c4393193ca7