etrade-test.duckdns.org Open in urlscan Pro
182.160.12.148  Malicious Activity! Public Scan

Submitted URL: http://etrade-test.duckdns.org/
Effective URL: https://etrade-test.duckdns.org/
Submission: On December 16 via manual from US — Scanned from PL

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 1 HTTP transactions. The main IP is 182.160.12.148, located in Hong Kong, Hong Kong and belongs to HWCLOUDS-AS-AP HUAWEI CLOUDS, HK. The main domain is etrade-test.duckdns.org.
TLS certificate: Issued by R11 on December 14th 2024. Valid for: 3 months.
This is the only time etrade-test.duckdns.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: E-Trade (Financial)

Domain & IP information

IP Address AS Autonomous System
1 182.160.12.148 136907 (HWCLOUDS-...)
1 2
Apex Domain
Subdomains
Transfer
1 duckdns.org
etrade-test.duckdns.org
7 MB
1 1
Domain Requested by
1 etrade-test.duckdns.org
1 1
Subject Issuer Validity Valid
etrade-test.duckdns.org
R11
2024-12-14 -
2025-03-14
3 months crt.sh

This page contains 1 frames:

Primary Page: https://etrade-test.duckdns.org/
Frame ID: 3BB4A9C7F996DCD1DD8F6B731ECE2934
Requests: 16 HTTP requests in this frame

Screenshot

Page Title

Log on to E*TRADE

Page URL History Show full URLs

  1. http://etrade-test.duckdns.org/ HTTP 307
    https://etrade-test.duckdns.org/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns

Page Statistics

1
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

7566 kB
Transfer

10199 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://etrade-test.duckdns.org/ HTTP 307
    https://etrade-test.duckdns.org/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

1 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
etrade-test.duckdns.org/
Redirect Chain
  • http://etrade-test.duckdns.org/
  • https://etrade-test.duckdns.org/
10 MB
7 MB
Document
General
Full URL
https://etrade-test.duckdns.org/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
182.160.12.148 Hong Kong, Hong Kong, ASN136907 (HWCLOUDS-AS-AP HUAWEI CLOUDS, HK),
Reverse DNS
ecs-182-160-12-148.compute.hwclouds-dns.com
Software
nginx /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

cache-control
public
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Mon, 16 Dec 2024 16:53:27 GMT
last-modified
Sat, 14 Dec 2024 08:51:12 GMT
server
nginx
strict-transport-security
max-age=31536000
vary
Accept-Encoding

Redirect headers

Location
https://etrade-test.duckdns.org/
Non-Authoritative-Reason
HttpsUpgrades
truncated
/
46 KB
46 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
fe6b81a71da1414cac19c8af100631f7e0b45f1adc39610e684582a42e9eddcb

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin
https://etrade-test.duckdns.org
Referer

Response headers

Content-Type
font/woff
truncated
/
6 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1f9dd0648e272f59730ffdbde1971481b59226c500ed31c8e7f4d0d5a8a892bf

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml
truncated
/
63 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e3a310f187e7d8053ffdc772f8b8cfe60eb20d333702c2e9a923d0532b78226f

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml
truncated
/
24 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
089f8464112ea8a130d95c579311b30720c968841de737412e8230e3e17fc6c1

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml
truncated
/
421 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
322cdd29422f6cb2f07b5c8d2159075dde960acae144c35042839b31eb01d316

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/png
truncated
/
465 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
87c60ebea9df791d5fabe2e5765f48556d2ff3a4ea4b3a3855ca4bdd5c5528ff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml;charset=utf8
truncated
/
569 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
41af06952dd0bfb0fc1c231ec84c89f8e7cbdddb7fd1a0387abd22e592de69ce

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml;charset=utf8
truncated
/
1 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
8facdcddac8104d0d0c2830e463752f09df9f96bee01835e963a5af55ef55a35

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml;charset=utf8
truncated
/
1 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
907d51525d1948c3149b9e3000aa5d4082a11d8830dc3e6c131416e6705f6563

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml;charset=utf8
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d7de291aba718aedafa628280062b732eae4b9f0d490a30bfd5d327fcac21a27

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml;charset=utf8
truncated
/
946 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e71e04e67156b491a68e0cdfb12bf180115bfbba0b0d53f255e1e6cd507d8791

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml;charset=utf8
truncated
/
50 KB
50 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
8e6a0d503c9a5e165640ef528c521ad9dc0e0de9a6c5d006866521d62f333a0d

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin
https://etrade-test.duckdns.org
Referer

Response headers

Content-Type
font/woff
truncated
/
45 KB
45 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
03b1deebb44691a3a1eadec8600bf58a979da16d0700497cfec848f73eb5c4cd

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin
https://etrade-test.duckdns.org
Referer

Response headers

Content-Type
font/woff
truncated
/
43 KB
43 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a87d66c91b2e7dc5530aef76c03bd6a3d25ea5826110bf4803b561b811cc8726

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin
https://etrade-test.duckdns.org
Referer

Response headers

Content-Type
font/woff2
truncated
/
281 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
fb5548ea743b5b7ac5bfd66e66cf6484651483d6307d67f70abaa6716eda20b1

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: E-Trade (Financial)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1

2 Cookies

Domain/Path Name / Value
etrade-test.duckdns.org/ Name: XSRF-TOKEN
Value: eyJpdiI6Ii9Sc2c3NHBkczFzZStmdXIvbVhFZEE9PSIsInZhbHVlIjoiZ3huMnpUY0xRYXN0T0pjT0lEQjBIdnR1TmtXT2poYlgreWpLbC9tZHZhc0IzKzlQdXRJb2xuQkhqTGMxaHNEbXRoMDEvYmxLYW9hNk5uaGZDVU5qVklFdHNQNjRiUHNGb3d6QXh1eVVSQ1hrQW5DUENtRmhxTG9ZRlhNd1FlL2wiLCJtYWMiOiIyYzgzZWEwOGNkMDc0Nzc4MDJlZTQ4NDg1ZTE5YTBkMTZmMDg4NjI0MGY3ZjkzNmEyNWZhNGVkYjg0ZmY4NzNhIiwidGFnIjoiIn0%3D
etrade-test.duckdns.org/ Name: laravel_session
Value: eyJpdiI6IldWRkMyYlNrMzVEQlNDVGFaSVIzL2c9PSIsInZhbHVlIjoiRDhrSFFaVUNZVUVzMmE5U1RveTRqckpRNnlraXNFWTR0WWZUWTZqcEJmY01ncEo2c3duRy9WbDBVUDJzU3RVMzU2Q0RTeWtEbXNqa3F1akxNTS9OU21lcWYvSzBlbXRzQldFbklkT2l1djIrUHd0R0NaNnZEdVdWRlp0UUp2Q1MiLCJtYWMiOiIxZjQzZjlkYzY5ODJjYWQxZTg1YzFjYjYzNGE2NTg4MGNjOWQ5ZDQ4NTg2ZGY4MTA2MTAwYzk1ZjllMGRkOGQ1IiwidGFnIjoiIn0%3D

1 Console Messages

Source Level URL
Text
recommendation verbose URL: https://etrade-test.duckdns.org/
Message:
[DOM] Password field is not contained in a form: (More info: https://goo.gl/9p2vKq) %o

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000