cf19.hc.ru
Open in
urlscan Pro
89.111.178.152
Malicious Activity!
Public Scan
Submission: On March 09 via automatic, source openphish
Summary
TLS certificate: Issued by thawte SSL CA - G2 on January 10th 2017. Valid for: a year.
This is the only time cf19.hc.ru was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Navy Federal Credit Union (Government)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
15 | 89.111.178.152 89.111.178.152 | 41126 (CENTROHOS...) (CENTROHOST-AS ) | |
1 | 2a00:1450:400... 2a00:1450:400f:803::200a | 15169 (GOOGLE) (GOOGLE - Google Inc.) | |
1 | 199.204.166.47 199.204.166.47 | 14222 (NFCU-AS) (NFCU-AS - Navy Federal Credit Union) | |
1 | 2a00:1450:401... 2a00:1450:401b:801::2004 | 15169 (GOOGLE) (GOOGLE - Google Inc.) | |
1 | 2a00:1450:400... 2a00:1450:400f:803::2003 | 15169 (GOOGLE) (GOOGLE - Google Inc.) | |
1 | 2a00:1450:401... 2a00:1450:401b:801::2003 | 15169 (GOOGLE) (GOOGLE - Google Inc.) | |
21 | 7 |
ASN14222 (NFCU-AS - Navy Federal Credit Union, US)
www.navyfederal.org |
Apex Domain Subdomains |
Transfer | |
---|---|---|
15 |
hc.ru
cf19.hc.ru |
111 KB |
2 |
gstatic.com
www.gstatic.com fonts.gstatic.com |
84 KB |
1 |
google.com
www.google.com |
411 B |
1 |
navyfederal.org
www.navyfederal.org |
18 KB |
1 |
googleapis.com
fonts.googleapis.com |
502 B |
21 | 5 |
Domain | Requested by | |
---|---|---|
15 | cf19.hc.ru |
cf19.hc.ru
|
1 | fonts.gstatic.com |
cf19.hc.ru
|
1 | www.gstatic.com |
www.google.com
|
1 | www.google.com |
cf19.hc.ru
|
1 | www.navyfederal.org |
cf19.hc.ru
|
1 | fonts.googleapis.com |
cf19.hc.ru
|
21 | 6 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.navyfederal.org |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.hc.ru thawte SSL CA - G2 |
2017-01-10 - 2018-01-10 |
a year | crt.sh |
*.googleapis.com Google Internet Authority G2 |
2017-02-22 - 2017-05-17 |
3 months | crt.sh |
www.navyfederal.org Symantec Class 3 Extended Validation SHA256 SSL CA |
2016-10-31 - 2017-11-18 |
a year | crt.sh |
www.google.com Google Internet Authority G2 |
2017-02-22 - 2017-05-17 |
3 months | crt.sh |
*.google.com Google Internet Authority G2 |
2017-02-22 - 2017-05-17 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://cf19.hc.ru/~c9734/wp-includes/js/uploads/work/verification/BE1D8455BC28C9B4DB8M/step1.php
Frame ID: 4644.1
Requests: 20 HTTP requests in this frame
Frame:
https://www.navyfederal.org/images/spacer.gif
Frame ID: 4644.6
Requests: 1 HTTP requests in this frame
3 Outgoing links
These are links going to different origins than the main page.
Title: Federally Insured by NCUA
Search URL Search Domain Scan URL
Title: Privacy Policy
Search URL Search Domain Scan URL
Title: Equal Housing Lender
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request 18- https://rnemsg.navyfederal.org/ci/pta/logout
- https://www.navyfederal.org/images/spacer.gif
21 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
step1.php
cf19.hc.ru/~c9734/wp-includes/js/uploads/work/verification/BE1D8455BC28C9B4DB8M/ |
14 KB 14 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
2 KB 502 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main.css
cf19.hc.ru/~c9734/wp-includes/js/uploads/work/verification/BE1D8455BC28C9B4DB8M/css/ |
82 KB 82 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
tooltip.js
cf19.hc.ru/~c9734/wp-includes/js/uploads/work/verification/BE1D8455BC28C9B4DB8M/resources/js/dev/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
s_code.js
www.navyfederal.org/js/ |
47 KB 18 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main.min.js
cf19.hc.ru/~c9734/wp-includes/js/uploads/work/verification/BE1D8455BC28C9B4DB8M/resources/js/dist/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
rsaCookieGenerator.js
cf19.hc.ru/~c9734/wp-includes/js/uploads/work/verification/BE1D8455BC28C9B4DB8M/resources/js/dev/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login.js
cf19.hc.ru/~c9734/wp-includes/js/uploads/work/verification/BE1D8455BC28C9B4DB8M/resources/js/dev/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
api.js
www.google.com/recaptcha/ |
697 B 411 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
img_logo.png
cf19.hc.ru/~c9734/wp-includes/js/uploads/work/verification/BE1D8455BC28C9B4DB8M/img/ |
8 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
img_footer_logo.png
cf19.hc.ru/~c9734/wp-includes/js/uploads/work/verification/BE1D8455BC28C9B4DB8M/img/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main.min.js
cf19.hc.ru/~c9734/wp-includes/js/uploads/work/verification/BE1D8455BC28C9B4DB8M/resources/js/dist/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
rsaCookieGenerator.js
cf19.hc.ru/~c9734/wp-includes/js/uploads/work/verification/BE1D8455BC28C9B4DB8M/resources/js/dev/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login.js
cf19.hc.ru/~c9734/wp-includes/js/uploads/work/verification/BE1D8455BC28C9B4DB8M/resources/js/dev/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
recaptcha__en.js
www.gstatic.com/recaptcha/api2/r20170307150823/ |
220 KB 71 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bg_footer.png
cf19.hc.ru/~c9734/wp-includes/js/uploads/work/verification/BE1D8455BC28C9B4DB8M/images/ |
176 B 176 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bg_globe.png
cf19.hc.ru/~c9734/wp-includes/js/uploads/work/verification/BE1D8455BC28C9B4DB8M/images/ |
2 KB 2 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
toadOcfmlt9b38dHJxOBGCOFnW3Jk0f09zW_Yln67Ac.woff2
fonts.gstatic.com/s/sourcesanspro/v9/ |
14 KB 14 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icons.png
cf19.hc.ru/~c9734/wp-includes/js/uploads/work/verification/BE1D8455BC28C9B4DB8M/images/ |
176 B 176 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
spacer.gif
www.navyfederal.org/images/ Frame 4644 Redirect Chain
|
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
favicon.ico
cf19.hc.ru/~c9734/wp-includes/js/uploads/work/verification/BE1D8455BC28C9B4DB8M/img/ |
1 KB 1 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- www.navyfederal.org
- URL
- https://www.navyfederal.org/images/spacer.gif
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Navy Federal Credit Union (Government)0 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cf19.hc.ru
fonts.googleapis.com
fonts.gstatic.com
www.google.com
www.gstatic.com
www.navyfederal.org
www.navyfederal.org
199.204.166.47
2a00:1450:400f:803::2003
2a00:1450:400f:803::200a
2a00:1450:401b:801::2003
2a00:1450:401b:801::2004
89.111.178.152
0b1dd42ccd2f5da83fa717b15fdd9f91879436b84a15d95340fc7ed5c2bc0269
26aa1e5d382461643776161453f29771a528577f5a831f0bb2036e4357513c1e
3adc614acaa6918cfb31a80d3589231c0d38fba7401e05d6f7302c4054aaace0
4b1758c54c969b2059e748a9b5426f7444b473884a9b616fb5dbae76518755a2
525a6300bbbfd71ed4bd97954bdf48878630af9c60c1330e81dc1dd3010f501b
55ad8b9b01f6cbc3b499dab7d62c84f76e55127344d3523a5e1ed99ce28a880f
ae60bb77b5b58abeacae1c52d46103996fb474e977c1d809504ab4f853bb960e
b3cdf897c70ad9073042003c24c191bd733ccb78ec4c2c7b550f1f702ef0a343
c0d93ce094d1488ed32d98d4e4aa22ff9fc09688e79cb15d73517ebd46cce0d2
dfe20dbdc9a348201ac1ac9af0af857e82a80a018bc055466b8c2274714f1b2a
eeae4a9c860a00faa338b225313cca2edcceafb4d219a0b858970bacdae36d33
fe3bfdf80a9a7d598f57ea486d5985e3ea1df0d418b59f1b33e0722f3426096f