u20966695.onlinehome-server.com
Open in
urlscan Pro
2607:f1c0:866:cf00::3c:fbee
Malicious Activity!
Public Scan
Effective URL: http://u20966695.onlinehome-server.com/admin/alaskausa/password.php?cmd=login_submit&id=&session=
Submission: On July 08 via automatic, source openphish — Scanned from DE
Summary
This is the only time u20966695.onlinehome-server.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Alaska USA Federal Credit Union (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 2 | 2607:f1c0:866... 2607:f1c0:866:cf00::3c:fbee | 8560 (IONOS-AS ...) (IONOS-AS This is the joint network for IONOS) | |
10 | 107.162.174.74 107.162.174.74 | 55002 (DEFENSE-NET) (DEFENSE-NET) | |
1 | 107.162.171.161 107.162.171.161 | 55002 (DEFENSE-NET) (DEFENSE-NET) | |
12 | 3 |
ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE)
u20966695.onlinehome-server.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
alaskausa.org
ultrabranch3.alaskausa.org — Cisco Umbrella Rank: 274875 www.alaskausa.org — Cisco Umbrella Rank: 282208 |
55 KB |
2 |
onlinehome-server.com
1 redirects
u20966695.onlinehome-server.com |
4 KB |
12 | 2 |
Domain | Requested by | |
---|---|---|
10 | ultrabranch3.alaskausa.org |
u20966695.onlinehome-server.com
ultrabranch3.alaskausa.org |
2 | u20966695.onlinehome-server.com | 1 redirects |
1 | www.alaskausa.org |
u20966695.onlinehome-server.com
|
12 | 3 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.alaskausa.org |
Subject Issuer | Validity | Valid | |
---|---|---|---|
ultrabranch3.alaskausa.org DigiCert TLS RSA SHA256 2020 CA1 |
2022-05-11 - 2023-06-11 |
a year | crt.sh |
www.alaskausa.org DigiCert TLS RSA SHA256 2020 CA1 |
2022-05-10 - 2023-06-10 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
http://u20966695.onlinehome-server.com/admin/alaskausa/password.php?cmd=login_submit&id=&session=
Frame ID: C07A549BAB0FA88FDAEFF5A8AB798520
Requests: 12 HTTP requests in this frame
Screenshot
Page Title
UltraBranch LoginPage URL History Show full URLs
-
http://u20966695.onlinehome-server.com/admin/alaskausa/1.php
HTTP 302
http://u20966695.onlinehome-server.com/admin/alaskausa/password.php?cmd=login_submit&id=&session= Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- \.php(?:$|\?)
Page Statistics
2 Outgoing links
These are links going to different origins than the main page.
Title: If you are using a screen reader and having difficulties with the site, call the Member Service Center 24/7 at 800-525-9094.
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://u20966695.onlinehome-server.com/admin/alaskausa/1.php
HTTP 302
http://u20966695.onlinehome-server.com/admin/alaskausa/password.php?cmd=login_submit&id=&session= Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
password.php
u20966695.onlinehome-server.com/admin/alaskausa/ Redirect Chain
|
7 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ub-main.css
ultrabranch3.alaskausa.org/efs/efs/jsp/inc/css/ |
21 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ub-login-new.css
ultrabranch3.alaskausa.org/efs/efs/jsp/inc/css/ |
8 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
common_functions.js
ultrabranch3.alaskausa.org/efs/efs/jslibrary/ |
8 KB 3 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
akusafcu_logo.png
ultrabranch3.alaskausa.org/efs/efs/grafx/akusa/ |
16 KB 17 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
hobby-yellowlab.
ultrabranch3.alaskausa.org/efs/efs/grafx/akusa/security/ |
0 0 |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo-ehl-tri.gif
ultrabranch3.alaskausa.org/efs/efs/grafx/akusa/ |
2 KB 3 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo-ncua.gif
ultrabranch3.alaskausa.org/efs/efs/grafx/akusa/ |
4 KB 5 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ub-print.css
ultrabranch3.alaskausa.org/efs/efs/jsp/inc/css/ |
3 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
header_bg.png
ultrabranch3.alaskausa.org/efs/efs/grafx/akusa/ |
8 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
pgMainEdge.png
www.alaskausa.org/css/nav/ |
960 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bullet-right.png
ultrabranch3.alaskausa.org/efs/images/ |
154 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Alaska USA Federal Credit Union (Banking)26 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch object| navigation function| isBlank function| isValidMask function| trimSpaces function| isNum function| hasInvalidChar function| isInvalidChar function| hasInvalidCharBeneficiary function| isInvalidCharBeneficiary function| isChar function| isNumOrChar function| stripChars function| isLength function| parseString function| isAllNums function| stripSpaces function| containsInvalidChar function| isItInvalidChar function| showNote function| toggleTree function| toggleNote1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
u20966695.onlinehome-server.com/ | Name: PHPSESSID Value: pihm10is3fjehh742auuk2v6h4 |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
u20966695.onlinehome-server.com
ultrabranch3.alaskausa.org
www.alaskausa.org
107.162.171.161
107.162.174.74
2607:f1c0:866:cf00::3c:fbee
1fb28d9c14ec42912599df0f34b14c6e6f996084ca13e06bb11dcb4c9459ed34
29f161d18451bce9531e883b733fb8e0089f6d1f5c97fd954948f4a95cd190aa
5cd6b433131a0f7972117a1de73410cd07059f385b4dceb1e99b1c9dd6351fb6
70a46f91c5948576ac320802ed148ed967757b8391f9b3e958c2dcbe1f333d14
990e387806872b7606ecf7211145356f5b6321fe6ff53e4ad3301b0373b1ceaa
a3941d5f3a221368776c19f01fef5fdcff8825460e416580fc809dbdd83972cc
a6b94488693950651d0529e4f968e21a333af9e121ba2088d19f1b0cb92e370a
ae0a9f620731be24cc8c6fc0f2cc46e789f276f497e96ad92734bd7facd2f9e8
dcfdce79105743aeda2d194642ba6c291664dd193002cf0e761762896af7ac08
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e9d50b964802b2bb60004481eb67394bd994ba4c6f8a67e3ded7574ef58fcfc2
f9d3f2498ba008a3eae2c43f5e83321fff0b2dfc4743bd2e56b6f3bcf716436f