mobiilencsecu.info Open in urlscan Pro
2606:4700:3037::6815:277d Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://mobiilencsecu.info/verify
Effective URL:
https://mobiilencsecu.info/verify/client/login.html
Submission Tags: tweet @ecarlesi #phishing #namesilo opendir_recursion Search All
Submission: On January 10 via api (January 10th 2023, 2:14:23 am UTC) from FI — Scanned from FI

Summary HTTP 10 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 10 HTTP transactions. The main IP is 2606:4700:3037::6815:277d, located in United States and belongs to CLOUDFLARENET, US. The main domain is mobiilencsecu.info.
TLS certificate: Issued by GTS CA 1P5 on January 9th 2023. Valid for: 3 months.

This is the only time mobiilencsecu.info was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: State Employee's Credit Union (Financial)

Domain & IP information

	IP Address	AS Autonomous System
2 12	2606:4700:303... 2606:4700:3037::6815:277d	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2 2	2606:4700:303... 2606:4700:3030::ac43:9149	13335 (CLOUDFLAR...) (CLOUDFLARENET)
10	1

12 2606:4700:3037::6815:277d (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

mobiilencsecu.info	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:3030::ac43:9149 (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

mobiilencsecu.info	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	mobiilencsecu.info 4 redirects mobiilencsecu.info	80 KB
10	1

	Domain	Requested by
14	mobiilencsecu.info	4 redirects mobiilencsecu.info
10	1

This site contains links to these domains. Also see Links.

Domain
itunes.apple.com
www.ncsecu.org

Subject Issuer	Validity	Valid
*.mobiilencsecu.info GTS CA 1P5	`2023-01-09` - `2023-04-09`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://mobiilencsecu.info/verify/client/login.html
Frame ID: 9030A5F21F8BD5939B0BA02C7CE41F5D
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Mobile Access - Menu

Page URL History Show full URLs

https://mobiilencsecu.info/verify HTTP 301
http://mobiilencsecu.info/verify/ HTTP 301
https://mobiilencsecu.info/verify/ Page URL
https://mobiilencsecu.info/verify/client HTTP 301
http://mobiilencsecu.info/verify/client/ HTTP 301
https://mobiilencsecu.info/verify/client/ Page URL
https://mobiilencsecu.info/verify/client/login.html Page URL

Page Statistics

10
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

78 kB
Transfer

94 kB
Size

0
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://itunes.apple.com/us/app/SECU/id1435916976?mt=8
Title: Open in the SECU Mobile App >

Search URL Search Domain Scan URL

URL: https://www.ncsecu.org/Home/Legal.html
Title: Legal

Search URL Search Domain Scan URL

URL: https://www.ncsecu.org/Home/AccessibilityStatement.html
Title: Accessibility

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://mobiilencsecu.info/verify HTTP 301
http://mobiilencsecu.info/verify/ HTTP 301
https://mobiilencsecu.info/verify/ Page URL
https://mobiilencsecu.info/verify/client HTTP 301
http://mobiilencsecu.info/verify/client/ HTTP 301
https://mobiilencsecu.info/verify/client/ Page URL
https://mobiilencsecu.info/verify/client/login.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://mobiilencsecu.info/verify HTTP 301
http://mobiilencsecu.info/verify/ HTTP 301
https://mobiilencsecu.info/verify/

Request Chain 1

https://mobiilencsecu.info/verify/client HTTP 301
http://mobiilencsecu.info/verify/client/ HTTP 301
https://mobiilencsecu.info/verify/client/

10 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	/ mobiilencsecu.info/verify/ Redirect Chain https://mobiilencsecu.info/verify http://mobiilencsecu.info/verify/ https://mobiilencsecu.info/verify/	70 B 365 B	216ms 215ms	Document text/html	2606:4700:3037::6815:277d CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://mobiilencsecu.info/verify/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::6815:277d , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 accept-language fi-FI,fi;q=0.9 Response headers alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 7871e5f2bff7fe50-HEL content-encoding br content-type text/html date Tue, 10 Jan 2023 02:14:16 GMT last-modified Mon, 09 Jan 2023 23:59:09 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AaQ5tgCdynWAZlQhQjbFkHqkXgUuZhAltHOkFOeF7fmfMK4xRpsy%2FTDp2M5ZBXJo4h%2FVOIuus4unvhElKapT3%2B4022GjrmKspAN5IMkjlMEIbapLYF8LDoGd1xg5TxqbBqBc2dnLThHIdj9Ef2aW0LM%3D"}],"group":"cf-nel","max_age":604800} server cloudflare Redirect headers CF-RAY 7871e5f279d1fe34-HEL Cache-Control max-age=3600 Connection keep-alive Date Tue, 10 Jan 2023 02:14:16 GMT Expires Tue, 10 Jan 2023 03:14:16 GMT Location https://mobiilencsecu.info/verify/ NEL {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Report-To {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lWXiIFsEJ%2F8k6oa%2Bkrb3elC4IDz14yL7dXqh809rPkb6kObnXXuzuwEcZZ25iIUtDy4FBIH%2FT9%2FAqtCVxTnQH7CvPn795PF4lcEGaUMnu3uDF5L9MiQJ4ci45y2uo8ql21r8O7pns3voSQqwZ3Sq3ZA%3D"}],"group":"cf-nel","max_age":604800} Server cloudflare Transfer-Encoding chunked Vary Accept-Encoding alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H3	200	/ mobiilencsecu.info/verify/client/ Redirect Chain https://mobiilencsecu.info/verify/client http://mobiilencsecu.info/verify/client/ https://mobiilencsecu.info/verify/client/	76 B 511 B	212ms 212ms	Document text/html	2606:4700:3037::6815:277d CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://mobiilencsecu.info/verify/client/ Requested by Host: mobiilencsecu.info URL: https://mobiilencsecu.info/verify/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3037::6815:277d , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers Referer https://mobiilencsecu.info/verify/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 accept-language fi-FI,fi;q=0.9 Response headers alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 7871e5f718283768-HEL content-encoding br content-type text/html date Tue, 10 Jan 2023 02:14:17 GMT last-modified Mon, 09 Jan 2023 23:59:09 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hXySGfgM9VWgSf8ppl%2FlLDuTr9WP3nhyFgWzZKDK88z9jcsjSw4fnRnbyWNcaFcj2ShrdWYf5YJ62liubiNXynffbi9XNm60heUCfDINWk%2BrZ22XaZHTIsT%2B9W2P7lVYsFquRq67ap0xRpTkQ8gb8BI%3D"}],"group":"cf-nel","max_age":604800} server cloudflare Redirect headers CF-RAY 7871e5f6dbe3fe34-HEL Cache-Control max-age=3600 Connection keep-alive Date Tue, 10 Jan 2023 02:14:17 GMT Expires Tue, 10 Jan 2023 03:14:17 GMT Location https://mobiilencsecu.info/verify/client/ NEL {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Report-To {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nwECjhUOD6bsB%2FLHjIAlhSKM%2FwkWE%2F5BWGxpnZ%2B0g0JIdbkwSJ4LK0Ip%2FaPmgkGhfgstvbXQvBN0JJXABcjyBQD%2BGE6IqMgp9tcMjcNgEgnV5oIjUX3mVLd9A%2F3bwsoVQ4er0n3QpCnEyVz2UqXaBR4%3D"}],"group":"cf-nel","max_age":604800} Server cloudflare Transfer-Encoding chunked Vary Accept-Encoding alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H3	200	Primary Request login.html Show response mobiilencsecu.info/verify/client/	5 KB 2 KB	215ms 215ms	Document text/html	2606:4700:3037::6815:277d CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://mobiilencsecu.info/verify/client/login.html Requested by Host: mobiilencsecu.info URL: https://mobiilencsecu.info/verify/client/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3037::6815:277d , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `201a7f7aeedac973660f35b1d5730cbfc25da01495269575c48c795b8c5d6613` Request headers Referer https://mobiilencsecu.info/verify/client/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 accept-language fi-FI,fi;q=0.9 Response headers alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 7871e5f889103768-HEL content-encoding br content-type text/html date Tue, 10 Jan 2023 02:14:17 GMT last-modified Mon, 09 Jan 2023 23:59:09 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MJYzDjpbFygRVtE1989SIeme61oeIHB3csMnSBBYEAeISQ2Xgoco1unr6sz5PJyKflaLATkoowv0y1pn4xF%2BTWQvlgIEJvstlnaTK%2BIPtDBNMJi1Zv5RFszgJ5DwHBrZHX2dvDBRQTjVC0eKsU7zD90%3D"}],"group":"cf-nel","max_age":604800} server cloudflare
GET H3	200	SECUmedium.css mobiilencsecu.info/verify/client/files/	15 KB 4 KB	562ms 561ms	Stylesheet text/css	2606:4700:3037::6815:277d CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://mobiilencsecu.info/verify/client/files/SECUmedium.css?ver=1.0.0 Requested by Host: mobiilencsecu.info URL: https://mobiilencsecu.info/verify/client/login.html Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3037::6815:277d , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `8227a3716d9488176cae7bfe4d3505d5d5ae39f2cc350cbcc664a39ab9dca72d` Request headers accept-language fi-FI,fi;q=0.9 Referer https://mobiilencsecu.info/verify/client/login.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Tue, 10 Jan 2023 02:14:18 GMT content-encoding br cf-cache-status MISS last-modified Mon, 09 Jan 2023 23:59:09 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mx09Mbb7MNJ4y9KhI2iqM0e2aTFv%2FOHfLmwoClGksc6tAB5UfnbFsKdydVZ55gSzVm9boL1os63EYNX5C754iS5EGWZoOs8%2Byr8ialH2pvAKW0JMOrBymY0Lrq8khaDuYpA%2F4Xo6ul2pHL43JkQSZM4%3D"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=14400 cf-ray 7871e5f9ea843768-HEL alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H3	200	Logo.fw.png mobiilencsecu.info/verify/client/files/	62 KB 62 KB	735ms 735ms	Image image/png	2606:4700:3037::6815:277d CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://mobiilencsecu.info/verify/client/files/Logo.fw.png Requested by Host: mobiilencsecu.info URL: https://mobiilencsecu.info/verify/client/login.html Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3037::6815:277d , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `2587fb2ac58b419fd3cc7055880600bb0810256ee5c4c6799ffa46375c36df81` Request headers accept-language fi-FI,fi;q=0.9 Referer https://mobiilencsecu.info/verify/client/login.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Tue, 10 Jan 2023 02:14:18 GMT cf-cache-status MISS last-modified Mon, 09 Jan 2023 23:59:09 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VyvROAK%2FvM2dXpeH05sZ%2FZE0TfPG6dPMUyrxyArOVzcjz%2BuTlW1h4ZfYuHc6xhzW1D8jtBrzk1i5TlZMySTQqZ98H27gHHei%2Bw9DdOLQ3ieL8jPhxNI4%2BFO02ExnDa4UAWxMxA5XK2WbcOMCyf9HjjU%3D"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=14400 accept-ranges bytes cf-ray 7871e5f9ea853768-HEL alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 63351
GET H3	200	SECU_480_White.png mobiilencsecu.info/verify/client/files/	4 KB 5 KB	389ms 388ms	Image image/png	2606:4700:3037::6815:277d CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://mobiilencsecu.info/verify/client/files/SECU_480_White.png Requested by Host: mobiilencsecu.info URL: https://mobiilencsecu.info/verify/client/login.html Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3037::6815:277d , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `df66bb365f4b682f831923b94a77da007339ba4c523e1dcb27bfc057132ebc06` Request headers accept-language fi-FI,fi;q=0.9 Referer https://mobiilencsecu.info/verify/client/login.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Tue, 10 Jan 2023 02:14:18 GMT cf-cache-status MISS last-modified Mon, 09 Jan 2023 23:59:09 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NLftkuf8B48T8dM1KUofTZlLNaXIIQZm76%2BBBnJtjB4XeIZFbur7fDUI4XuXZ%2BZCLjKkGgFORkM6xLHr97uy%2Fgx1guGz%2BkCWqYxc0%2BtfxwDUhKjrTwQWElAKoQldof6iTQ2x%2B3fDQiWQ5njY5Ia%2BR2U%3D"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=14400 accept-ranges bytes cf-ray 7871e5f9fa903768-HEL alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 4367
GET H3	404	ehl_gif_white_s14x13x256Pass.png mobiilencsecu.info/verify/client/Images/	315 B 315 B	1075ms 1074ms	Image text/html	2606:4700:3037::6815:277d CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://mobiilencsecu.info/verify/client/Images/ehl_gif_white_s14x13x256Pass.png Requested by Host: mobiilencsecu.info URL: https://mobiilencsecu.info/verify/client/login.html Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3037::6815:277d , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3` Request headers accept-language fi-FI,fi;q=0.9 Referer https://mobiilencsecu.info/verify/client/login.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Tue, 10 Jan 2023 02:14:18 GMT content-encoding br cf-cache-status MISS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=O3IgqK6%2FVg%2BDpH0mhh9imcdxwlUOvNr0iTWQExsAamvNhWOeDlDgle4x8ajyEIYwJm3Cb5tMad1vGzsVdKXyFII%2B%2FDiRvyTVjcMDK4%2FTrlTyyP8gECraZoeVQYeJmsQSwl7PftD%2B6utbDSSOK3UjtLg%3D"}],"group":"cf-nel","max_age":604800} content-type text/html; charset=iso-8859-1 cache-control max-age=14400 cf-ray 7871e5f9fa913768-HEL alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H3	200	app-property.js Show response mobiilencsecu.info/verify/client/files/	3 KB 2 KB	390ms 390ms	Script application/javascript	2606:4700:3037::6815:277d CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://mobiilencsecu.info/verify/client/files/app-property.js?ver=1.0.0 Requested by Host: mobiilencsecu.info URL: https://mobiilencsecu.info/verify/client/login.html Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3037::6815:277d , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `2fe26127ef9cbb2b090d8b583f5be96e204c8e129cbe81e91b5bde3f8a2d4bd4` Request headers accept-language fi-FI,fi;q=0.9 Referer https://mobiilencsecu.info/verify/client/login.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Tue, 10 Jan 2023 02:14:18 GMT content-encoding br cf-cache-status MISS last-modified Mon, 09 Jan 2023 23:59:09 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DZyA2hZRK1rd7j3uhNEjaYAtZQDSqemAXSHWyY9C6TsCZYXjOEmC%2B%2FCmnOH1i%2BQj2WOU9MB3jrRo6F2cB4FYd2OZBFr2Q5vQVfkNe10fsYfJ%2FIoRp8KrXQke%2F7icwPNfrDZtrTWRV2wRb7tU01uCOVU%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=14400 cf-ray 7871e5f9fa8d3768-HEL alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H3	200	script.js Show response mobiilencsecu.info/verify/client/files/	4 KB 2 KB	391ms 391ms	Script application/javascript	2606:4700:3037::6815:277d CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://mobiilencsecu.info/verify/client/files/script.js?ver=1.1.1 Requested by Host: mobiilencsecu.info URL: https://mobiilencsecu.info/verify/client/login.html Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3037::6815:277d , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `c0fccb0b0f8ad824703dde8e65a711c1fd9e99ea0d8b74efa6e59688bcd50f5c` Request headers accept-language fi-FI,fi;q=0.9 Referer https://mobiilencsecu.info/verify/client/login.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Tue, 10 Jan 2023 02:14:18 GMT content-encoding br cf-cache-status MISS last-modified Mon, 09 Jan 2023 23:59:09 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=S0bdJ%2BtW051aU4tFlAXn%2Fo62MuP9PqDjpS7TZYEJEvLaEOiUGDM6%2FxfNszO8ml1IdewIZUMabrtlLpz7ZEu4gy%2BLiJ%2FDl2A%2FaU%2BUMg6XVZONtY1daHdjvRyiL4mcWi4KUgQDVZKR9NAyBg9Sqe%2F9xHA%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=14400 cf-ray 7871e5f9fa8e3768-HEL alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H3	404	MenuArrow_21_15_40572_white.png mobiilencsecu.info/verify/client/Images/	315 B 315 B	696ms 695ms	Image text/html	2606:4700:3037::6815:277d CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://mobiilencsecu.info/verify/client/Images/MenuArrow_21_15_40572_white.png Requested by Host: mobiilencsecu.info URL: https://mobiilencsecu.info/verify/client/files/SECUmedium.css?ver=1.0.0 Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3037::6815:277d , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3` Request headers accept-language fi-FI,fi;q=0.9 Referer https://mobiilencsecu.info/verify/client/files/SECUmedium.css?ver=1.0.0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Tue, 10 Jan 2023 02:14:19 GMT content-encoding br cf-cache-status MISS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=g%2BrdKUJ2s9%2F1OTQLxbyZrsl3ZDxFs455l2pDB3FYO0anq2LzBnop1r%2FYFpFbP1V5sXS88JqkVDAtzp48KO5VxA00st4utv5RXAbD4Xky52TyYDu6Ya1pRJTxDmE3t3YLsHvraoiHJ%2FpB405Ifc2MbUA%3D"}],"group":"cf-nel","max_age":604800} content-type text/html; charset=iso-8859-1 cache-control max-age=14400 cf-ray 7871e5fd7cd53768-HEL alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: State Employee's Credit Union (Financial)

21 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://mobiilencsecu.info/verify/client/Images/ehl_gif_white_s14x13x256Pass.png Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://mobiilencsecu.info/verify/client/Images/MenuArrow_21_15_40572_white.png Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

mobiilencsecu.info
2606:4700:3030::ac43:9149
2606:4700:3037::6815:277d
201a7f7aeedac973660f35b1d5730cbfc25da01495269575c48c795b8c5d6613
2587fb2ac58b419fd3cc7055880600bb0810256ee5c4c6799ffa46375c36df81
2fe26127ef9cbb2b090d8b583f5be96e204c8e129cbe81e91b5bde3f8a2d4bd4
8227a3716d9488176cae7bfe4d3505d5d5ae39f2cc350cbcc664a39ab9dca72d
c0fccb0b0f8ad824703dde8e65a711c1fd9e99ea0d8b74efa6e59688bcd50f5c
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
df66bb365f4b682f831923b94a77da007339ba4c523e1dcb27bfc057132ebc06

mobiilencsecu.info Open in urlscan Pro 2606:4700:3037::6815:277d Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

10 Requests

100 %HTTPS

100 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

78 kBTransfer

94 kBSize

0 Cookies

3 Outgoing links

Page URL History

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

21 JavaScript Global Variables

0 Cookies

2 Console Messages

Indicators

mobiilencsecu.info Open in urlscan Pro
2606:4700:3037::6815:277d Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

78 kB
Transfer

94 kB
Size

0
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!