bankofamerica09support.duckdns.org Open in urlscan Pro
150.136.87.166 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://bankofamerica09support.duckdns.org/BofA/Step1.php?cmd=_account-details&session=bba91486dc70db1e61338ae6276ce707&dispatch=18...
Submission: On December 31 via automatic, source phishtank (December 31st 2020, 2:19:14 am UTC)

Summary HTTP 14 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 3 countries across 5 domains to perform 14 HTTP transactions. The main IP is 150.136.87.166, located in Seattle, United States and belongs to ORACLE-BMC-31898, US. The main domain is bankofamerica09support.duckdns.org.

This is the only time bankofamerica09support.duckdns.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Bank of America (Banking)

Domain & IP information

	IP Address	AS Autonomous System
11	150.136.87.166 150.136.87.166	31898 (ORACLE-BM...) (ORACLE-BMC-31898)
1	2a00:1450:400... 2a00:1450:4001:81e::200a	15169 (GOOGLE) (GOOGLE)
1	2a04:4e42:1b:... 2a04:4e42:1b::621	54113 (FASTLY) (FASTLY)
1 1	2606:4700:303... 2606:4700:3031::681c:1477	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6810:125e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
14	4

11 150.136.87.166 (Seattle, United States)

ASN31898 (ORACLE-BMC-31898, US)

bankofamerica09support.duckdns.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81e::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:1b::621 (Ascension Island)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3031::681c:1477 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

jqueryvalidation.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:125e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	duckdns.org bankofamerica09support.duckdns.org	634 KB
1	cloudflare.com cdnjs.cloudflare.com	6 KB
1	jqueryvalidation.org 1 redirects jqueryvalidation.org	748 B
1	jsdelivr.net cdn.jsdelivr.net	11 KB
1	googleapis.com ajax.googleapis.com	33 KB
14	5

	Domain	Requested by
11	bankofamerica09support.duckdns.org	bankofamerica09support.duckdns.org
1	cdnjs.cloudflare.com	bankofamerica09support.duckdns.org
1	jqueryvalidation.org	1 redirects
1	cdn.jsdelivr.net	bankofamerica09support.duckdns.org
1	ajax.googleapis.com	bankofamerica09support.duckdns.org
14	5

This site contains no links.

Subject Issuer	Validity	Valid
upload.video.google.com GTS CA 1O1	`2020-11-10` - `2021-02-02`	3 months	crt.sh
f3.shared.global.fastly.net GlobalSign CloudSSL CA - SHA256 - G3	`2020-10-26` - `2021-04-17`	6 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-10-21` - `2021-10-20`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://bankofamerica09support.duckdns.org/BofA/Step1.php?cmd=_account-details&session=bba91486dc70db1e61338ae6276ce707&dispatch=1801d8a79fa66369f702bbd8f87b8f1855bb697b
Frame ID: 52ACD9C1F9A8470ADBF9DECA8C12D6D5
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

14
Requests

21 %
HTTPS

80 %
IPv6

5
Domains

5
Subdomains

4
IPs

3
Countries

684 kB
Transfer

787 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 4

http://cdn.jsdelivr.net/jquery.validation/1.14.0/jquery.validate.js HTTP 307
https://cdn.jsdelivr.net/jquery.validation/1.14.0/jquery.validate.js

Request Chain 5

http://jqueryvalidation.org/files/dist/additional-methods.min.js HTTP 301
https://cdnjs.cloudflare.com/ajax/libs/jquery-validate/1.19.2/additional-methods.min.js

14 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request Step1.php Show response
bankofamerica09support.duckdns.org/BofA/ 20 KB
20 KB 210ms
189ms Document
text/html 150.136.87.166
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to

Full URL: http://bankofamerica09support.duckdns.org/BofA/Step1.php?cmd=_account-details&session=bba91486dc70db1e61338ae6276ce707&dispatch=1801d8a79fa66369f702bbd8f87b8f1855bb697b
Protocol: HTTP/1.1
Server: 150.136.87.166 Seattle, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software: Apache /
Resource Hash: d04534e0d6b65ee2ee627556a01cf990463576aac960ae9150c0fd4e10dad105

Request headers

Host: bankofamerica09support.duckdns.org
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 31 Dec 2020 02:18:57 GMT
Server: Apache
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK frd.css
bankofamerica09support.duckdns.org/BofA/assets/css/ 318 KB
318 KB 187ms
172ms Stylesheet
text/css 150.136.87.166
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to

Full URL: http://bankofamerica09support.duckdns.org/BofA/assets/css/frd.css
Requested by: Host: bankofamerica09support.duckdns.org
URL: http://bankofamerica09support.duckdns.org/BofA/Step1.php?cmd=_account-details&session=bba91486dc70db1e61338ae6276ce707&dispatch=1801d8a79fa66369f702bbd8f87b8f1855bb697b
Protocol: HTTP/1.1
Server: 150.136.87.166 Seattle, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software: Apache /
Resource Hash: 81b6055cee7b9041a9ab190b679cad2dd6eeebcf0d8b28c286efe3fd14d63ea4

Request headers

Referer: http://bankofamerica09support.duckdns.org/BofA/Step1.php?cmd=_account-details&session=bba91486dc70db1e61338ae6276ce707&dispatch=1801d8a79fa66369f702bbd8f87b8f1855bb697b
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 31 Dec 2020 02:18:58 GMT
Last-Modified: Mon, 31 Jul 2017 16:09:58 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 325694

GET
H/1.1 200
OK verify2.css
bankofamerica09support.duckdns.org/BofA/assets/css/ 219 KB
219 KB 187ms
172ms Stylesheet
text/css 150.136.87.166
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to

Full URL: http://bankofamerica09support.duckdns.org/BofA/assets/css/verify2.css
Requested by: Host: bankofamerica09support.duckdns.org
URL: http://bankofamerica09support.duckdns.org/BofA/Step1.php?cmd=_account-details&session=bba91486dc70db1e61338ae6276ce707&dispatch=1801d8a79fa66369f702bbd8f87b8f1855bb697b
Protocol: HTTP/1.1
Server: 150.136.87.166 Seattle, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software: Apache /
Resource Hash: 9a5c5632847a54cab9c3e9c39175070b777f086564c7e4588b96ee0d94551b26

Request headers

Referer: http://bankofamerica09support.duckdns.org/BofA/Step1.php?cmd=_account-details&session=bba91486dc70db1e61338ae6276ce707&dispatch=1801d8a79fa66369f702bbd8f87b8f1855bb697b
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 31 Dec 2020 02:18:58 GMT
Last-Modified: Mon, 31 Jul 2017 16:22:50 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 224039

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/1.8.3/ 91 KB
33 KB 28ms
7ms Script
text/javascript 2a00:1450:4001:81e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js

Requested by

Host: bankofamerica09support.duckdns.org
URL: http://bankofamerica09support.duckdns.org/BofA/Step1.php?cmd=_account-details&session=bba91486dc70db1e61338ae6276ce707&dispatch=1801d8a79fa66369f702bbd8f87b8f1855bb697b

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c6caebd23921741fb5ffe6603f16634fca9840c2bf56ac8201e9264d6daccf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://bankofamerica09support.duckdns.org/BofA/Step1.php?cmd=_account-details&session=bba91486dc70db1e61338ae6276ce707&dispatch=1801d8a79fa66369f702bbd8f87b8f1855bb697b
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Dec 2020 04:26:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 597147
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33593
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 24 Dec 2021 04:26:31 GMT

GET
H/1.1 200
OK jquery.payment.js Show response
bankofamerica09support.duckdns.org/BofA/assets/js/ 17 KB
17 KB 187ms
172ms Script
application/javascript 150.136.87.166
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to

Full URL: http://bankofamerica09support.duckdns.org/BofA/assets/js/jquery.payment.js
Requested by: Host: bankofamerica09support.duckdns.org
URL: http://bankofamerica09support.duckdns.org/BofA/Step1.php?cmd=_account-details&session=bba91486dc70db1e61338ae6276ce707&dispatch=1801d8a79fa66369f702bbd8f87b8f1855bb697b
Protocol: HTTP/1.1
Server: 150.136.87.166 Seattle, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software: Apache /
Resource Hash: 846b450c473f23e66dfb6ea4c882fc1194486fe28ef78a9b5326483a9338ab52

Request headers

Referer: http://bankofamerica09support.duckdns.org/BofA/Step1.php?cmd=_account-details&session=bba91486dc70db1e61338ae6276ce707&dispatch=1801d8a79fa66369f702bbd8f87b8f1855bb697b
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 31 Dec 2020 02:18:58 GMT
Last-Modified: Mon, 31 Jul 2017 16:24:08 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 17596

GET
H2

200

jquery.validate.js Show response
cdn.jsdelivr.net/jquery.validation/1.14.0/
Redirect Chain

http://cdn.jsdelivr.net/jquery.validation/1.14.0/jquery.validate.js
https://cdn.jsdelivr.net/jquery.validation/1.14.0/jquery.validate.js

42 KB
11 KB

7ms
6ms

Script
application/javascript

2a04:4e42:1b::621
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/jquery.validation/1.14.0/jquery.validate.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::621 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

ad5da6112553bd7511aea64dd18d23cef797432148142d766424c900dd919d0a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: http://bankofamerica09support.duckdns.org/BofA/Step1.php?cmd=_account-details&session=bba91486dc70db1e61338ae6276ce707&dispatch=1801d8a79fa66369f702bbd8f87b8f1855bb697b
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 3585159
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
content-length: 11438
etag: W/"a686-lD4vCzGkRPW9lmVTvUVEazM4/T0"
x-served-by: cache-fra19125-FRA, cache-hhn4022-HHN
date: Thu, 31 Dec 2020 02:18:58 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *

Redirect headers

Location: https://cdn.jsdelivr.net/jquery.validation/1.14.0/jquery.validate.js
Non-Authoritative-Reason: HSTS

GET
H2

200

additional-methods.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery-validate/1.19.2/
Redirect Chain

http://jqueryvalidation.org/files/dist/additional-methods.min.js
https://cdnjs.cloudflare.com/ajax/libs/jquery-validate/1.19.2/additional-methods.min.js

22 KB
6 KB

10ms
10ms

Script
application/javascript

2606:4700::6810:125e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery-validate/1.19.2/additional-methods.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

769a6653733b3e64e850f13421940414afafe8625acf963354e64dfaec51883c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: http://bankofamerica09support.duckdns.org/BofA/Step1.php?cmd=_account-details&session=bba91486dc70db1e61338ae6276ce707&dispatch=1801d8a79fa66369f702bbd8f87b8f1855bb697b
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 31 Dec 2020 02:18:58 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 426079
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
content-length: 5693
cf-request-id: 075830668f0000d6f562886000000001
timing-allow-origin: *
last-modified: Fri, 29 May 2020 16:54:59 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5ed13e63-5884"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=NQBisXmtCIiO0u%2BzH%2FHSlh5w8SCKFPqD9ONL1EVbOilExRqVQkHa7Vm0YtQ9wz%2BEZEkEz8AC6fU%2Fmy4ZOd3uttTpirMkD7s%2B1%2FjNRHAyblNHOSYOTe5qk4GRDnL89xOJoQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 60a08350e97cd6f5-FRA
expires: Tue, 21 Dec 2021 02:18:58 GMT

Redirect headers

Date: Thu, 31 Dec 2020 02:18:58 GMT
X-Content-Type-Options: nosniff
NEL: {"report_to":"cf-nel","max_age":604800}
Server: cloudflare
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=EZH7ybkzKKlGlN11YEg8frXeNLONIPTek%2B76xpI7RIDxdb9T6DbvlwtQgLryXOuBW5LNmjWuKTVRoeFCJkki%2FlcHvoTaMd9UmFBEXePCPinnKF%2BinLpOGWpsCfeFRfb5FA%3D%3D"}],"group":"cf-nel","max_age":604800}
Location: https://cdnjs.cloudflare.com/ajax/libs/jquery-validate/1.19.2/additional-methods.min.js
Cache-Control: max-age=3600
Transfer-Encoding: chunked
Connection: keep-alive
CF-RAY: 60a08350cc1fdfcf-FRA
cf-request-id: 075830667b0000dfcf1838e000000001
Expires: Thu, 31 Dec 2020 03:18:58 GMT

GET
H/1.1 200
OK logo.gif
bankofamerica09support.duckdns.org/BofA/assets/img/ 4 KB
4 KB 94ms
93ms Image
image/gif 150.136.87.166
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://bankofamerica09support.duckdns.org/BofA/assets/img/logo.gif
Requested by: Host: bankofamerica09support.duckdns.org
URL: http://bankofamerica09support.duckdns.org/BofA/Step1.php?cmd=_account-details&session=bba91486dc70db1e61338ae6276ce707&dispatch=1801d8a79fa66369f702bbd8f87b8f1855bb697b
Protocol: HTTP/1.1
Server: 150.136.87.166 Seattle, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software: Apache /
Resource Hash: 6faff1c939a50b046b98c124b959cb7cba4782252358581a19cbb06e9896afdc

Request headers

Referer: http://bankofamerica09support.duckdns.org/BofA/Step1.php?cmd=_account-details&session=bba91486dc70db1e61338ae6276ce707&dispatch=1801d8a79fa66369f702bbd8f87b8f1855bb697b
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 31 Dec 2020 02:18:58 GMT
Last-Modified: Mon, 31 Jul 2017 16:11:34 GMT
Server: Apache
Content-Type: image/gif
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 3595

GET
H/1.1 200
OK house.gif
bankofamerica09support.duckdns.org/BofA/assets/img/ 1 KB
1 KB 93ms
92ms Image
image/gif 150.136.87.166
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://bankofamerica09support.duckdns.org/BofA/assets/img/house.gif
Requested by: Host: bankofamerica09support.duckdns.org
URL: http://bankofamerica09support.duckdns.org/BofA/Step1.php?cmd=_account-details&session=bba91486dc70db1e61338ae6276ce707&dispatch=1801d8a79fa66369f702bbd8f87b8f1855bb697b
Protocol: HTTP/1.1
Server: 150.136.87.166 Seattle, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software: Apache /
Resource Hash: d05ba37b19ddc879a8a4fd6f594a263a3819d904e3a6ba80eef3be40541b2bb4

Request headers

Referer: http://bankofamerica09support.duckdns.org/BofA/Step1.php?cmd=_account-details&session=bba91486dc70db1e61338ae6276ce707&dispatch=1801d8a79fa66369f702bbd8f87b8f1855bb697b
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 31 Dec 2020 02:18:58 GMT
Last-Modified: Mon, 31 Jul 2017 16:16:20 GMT
Server: Apache
Content-Type: image/gif
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 1173

GET
H/1.1 200
OK secure-sprite.png
bankofamerica09support.duckdns.org/BofA/assets/img/ 473 B
714 B 93ms
92ms Image
image/png 150.136.87.166
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://bankofamerica09support.duckdns.org/BofA/assets/img/secure-sprite.png
Requested by: Host: bankofamerica09support.duckdns.org
URL: http://bankofamerica09support.duckdns.org/BofA/assets/css/verify2.css
Protocol: HTTP/1.1
Server: 150.136.87.166 Seattle, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software: Apache /
Resource Hash: 8c37fb372596058d87dd9208541c49b020d0e840e4f3a5baa27d39be2dc70b01

Request headers

Referer: http://bankofamerica09support.duckdns.org/BofA/assets/css/verify2.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 31 Dec 2020 02:18:58 GMT
Last-Modified: Mon, 31 Jul 2017 16:26:22 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 473

GET
H/1.1 200
OK bar-sprite.gif
bankofamerica09support.duckdns.org/BofA/assets/img/ 680 B
921 B 93ms
93ms Image
image/gif 150.136.87.166
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://bankofamerica09support.duckdns.org/BofA/assets/img/bar-sprite.gif
Requested by: Host: bankofamerica09support.duckdns.org
URL: http://bankofamerica09support.duckdns.org/BofA/assets/css/verify2.css
Protocol: HTTP/1.1
Server: 150.136.87.166 Seattle, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software: Apache /
Resource Hash: 092bcd41933eafc9d859063ff5eb4812581c734a74e52fb4298826baea316bce

Request headers

Referer: http://bankofamerica09support.duckdns.org/BofA/assets/css/verify2.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 31 Dec 2020 02:18:58 GMT
Last-Modified: Mon, 31 Jul 2017 16:28:10 GMT
Server: Apache
Content-Type: image/gif
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 680

GET
H/1.1 200
OK bar2-sprite.png
bankofamerica09support.duckdns.org/BofA/assets/img/ 4 KB
4 KB 185ms
171ms Image
image/png 150.136.87.166
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://bankofamerica09support.duckdns.org/BofA/assets/img/bar2-sprite.png
Requested by: Host: bankofamerica09support.duckdns.org
URL: http://bankofamerica09support.duckdns.org/BofA/assets/css/verify2.css
Protocol: HTTP/1.1
Server: 150.136.87.166 Seattle, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software: Apache /
Resource Hash: a5c321093780de21e48d9cb15d0b0bade2d48c8102b7cd7875a2abfdf0eeb0c6

Request headers

Referer: http://bankofamerica09support.duckdns.org/BofA/assets/css/verify2.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 31 Dec 2020 02:18:58 GMT
Last-Modified: Mon, 31 Jul 2017 16:27:46 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 4204

GET
H/1.1 200
OK fot-sprite.png
bankofamerica09support.duckdns.org/BofA/assets/img/ 48 KB
48 KB 184ms
171ms Image
image/png 150.136.87.166
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://bankofamerica09support.duckdns.org/BofA/assets/img/fot-sprite.png
Requested by: Host: bankofamerica09support.duckdns.org
URL: http://bankofamerica09support.duckdns.org/BofA/assets/css/verify2.css
Protocol: HTTP/1.1
Server: 150.136.87.166 Seattle, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software: Apache /
Resource Hash: ca3205c6a4eecfd67ad990b62b10e19f601230a2a5b2791676089e82836763f4

Request headers

Referer: http://bankofamerica09support.duckdns.org/BofA/assets/css/verify2.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 31 Dec 2020 02:18:58 GMT
Last-Modified: Mon, 31 Jul 2017 16:27:24 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 48667

GET
H/1.1 404
Not Found gfoot-home-icon.png
bankofamerica09support.duckdns.org/pa/components/modules/global-footer-module/2.5/graphic/ 315 B
315 B 93ms
92ms Image
text/html 150.136.87.166
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://bankofamerica09support.duckdns.org/pa/components/modules/global-footer-module/2.5/graphic/gfoot-home-icon.png
Requested by: Host: bankofamerica09support.duckdns.org
URL: http://bankofamerica09support.duckdns.org/BofA/assets/css/verify2.css
Protocol: HTTP/1.1
Server: 150.136.87.166 Seattle, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software: Apache /
Resource Hash: d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Request headers

Referer: http://bankofamerica09support.duckdns.org/BofA/assets/css/verify2.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 31 Dec 2020 02:18:58 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=98
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Bank of America (Banking)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
bankofamerica09support.duckdns.org
cdn.jsdelivr.net
cdnjs.cloudflare.com
jqueryvalidation.org
150.136.87.166
2606:4700:3031::681c:1477
2606:4700::6810:125e
2a00:1450:4001:81e::200a
2a04:4e42:1b::621
092bcd41933eafc9d859063ff5eb4812581c734a74e52fb4298826baea316bce
61c6caebd23921741fb5ffe6603f16634fca9840c2bf56ac8201e9264d6daccf
6faff1c939a50b046b98c124b959cb7cba4782252358581a19cbb06e9896afdc
769a6653733b3e64e850f13421940414afafe8625acf963354e64dfaec51883c
81b6055cee7b9041a9ab190b679cad2dd6eeebcf0d8b28c286efe3fd14d63ea4
846b450c473f23e66dfb6ea4c882fc1194486fe28ef78a9b5326483a9338ab52
8c37fb372596058d87dd9208541c49b020d0e840e4f3a5baa27d39be2dc70b01
9a5c5632847a54cab9c3e9c39175070b777f086564c7e4588b96ee0d94551b26
a5c321093780de21e48d9cb15d0b0bade2d48c8102b7cd7875a2abfdf0eeb0c6
ad5da6112553bd7511aea64dd18d23cef797432148142d766424c900dd919d0a
ca3205c6a4eecfd67ad990b62b10e19f601230a2a5b2791676089e82836763f4
d04534e0d6b65ee2ee627556a01cf990463576aac960ae9150c0fd4e10dad105
d05ba37b19ddc879a8a4fd6f594a263a3819d904e3a6ba80eef3be40541b2bb4
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

bankofamerica09support.duckdns.org Open in urlscan Pro 150.136.87.166 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

14 Requests

21 %HTTPS

80 %IPv6

5 Domains

5 Subdomains

4 IPs

3 Countries

684 kBTransfer

787 kBSize

0 Cookies

0 Outgoing links

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

8 JavaScript Global Variables

0 Cookies

Indicators

bankofamerica09support.duckdns.org Open in urlscan Pro
150.136.87.166 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

21 %
HTTPS

80 %
IPv6

5
Domains

5
Subdomains

4
IPs

3
Countries

684 kB
Transfer

787 kB
Size

0
Cookies

14 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!