ob-navyfederal.com Open in urlscan Pro
185.193.89.50 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://ob-navyfederal.com/
Effective URL:
https://ob-navyfederal.com/NFOAA_Auth/login.jsp/
Submission: On February 09 via manual (February 9th 2022, 4:28:27 pm UTC) from US — Scanned from DE

Summary HTTP 16 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 16 HTTP transactions. The main IP is 185.193.89.50, located in Russian Federation and belongs to ERISHENNYA-ASN, UA. The main domain is ob-navyfederal.com.
TLS certificate: Issued by R3 on February 9th 2022. Valid for: 3 months.

This is the only time ob-navyfederal.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Navy Federal Credit Union (Government)

Domain & IP information

	IP Address	AS Autonomous System
4 18	185.193.89.50 185.193.89.50	210950 (ERISHENNY...) (ERISHENNYA-ASN)
2	2a00:1450:400... 2a00:1450:4001:82b::2003	15169 (GOOGLE) (GOOGLE)
16	2

18 185.193.89.50 (Russian Federation) 4 redirects

ASN210950 (ERISHENNYA-ASN, UA)

ob-navyfederal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
18	ob-navyfederal.com 4 redirects ob-navyfederal.com	338 KB
2	gstatic.com fonts.gstatic.com	26 KB
16	2

	Domain	Requested by
18	ob-navyfederal.com	4 redirects ob-navyfederal.com
2	fonts.gstatic.com	ob-navyfederal.com
16	2

This site contains no links.

Subject Issuer	Validity	Valid
ob-navyfederal.com R3	`2022-02-09` - `2022-05-10`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2022-01-10` - `2022-04-04`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://ob-navyfederal.com/NFOAA_Auth/login.jsp/
Frame ID: 040A04B88073B13FBD3EE241729D4150
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Navy Federal Credit Union - Our Members are the Mission®

Page URL History Show full URLs

http://ob-navyfederal.com/ HTTP 301
https://ob-navyfederal.com/ HTTP 302
https://ob-navyfederal.com/NFOAA_Auth/login.jsp HTTP 301
http://ob-navyfederal.com/NFOAA_Auth/login.jsp/ HTTP 301
https://ob-navyfederal.com/NFOAA_Auth/login.jsp/ Page URL

Page Statistics

16
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

363 kB
Transfer

461 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://ob-navyfederal.com/ HTTP 301
https://ob-navyfederal.com/ HTTP 302
https://ob-navyfederal.com/NFOAA_Auth/login.jsp HTTP 301
http://ob-navyfederal.com/NFOAA_Auth/login.jsp/ HTTP 301
https://ob-navyfederal.com/NFOAA_Auth/login.jsp/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
ob-navyfederal.com/NFOAA_Auth/login.jsp/
Redirect Chain

http://ob-navyfederal.com/
https://ob-navyfederal.com/
https://ob-navyfederal.com/NFOAA_Auth/login.jsp
http://ob-navyfederal.com/NFOAA_Auth/login.jsp/
https://ob-navyfederal.com/NFOAA_Auth/login.jsp/

116 KB
14 KB

155ms
155ms

Document
text/html

185.193.89.50
ERISHENNYA-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://ob-navyfederal.com/NFOAA_Auth/login.jsp/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.193.89.50 , Russian Federation, ASN210950 (ERISHENNYA-ASN, UA),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 4189dcf8c906a0cae762bd80a1cd3c13e47c947f0453c5d706bc759e4d739b5d

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

Server: nginx/1.18.0 (Ubuntu)
Date: Wed, 09 Feb 2022 16:28:21 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Content-Encoding: gzip

Redirect headers

Server: nginx/1.18.0 (Ubuntu)
Date: Wed, 09 Feb 2022 16:28:21 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Location: https://ob-navyfederal.com:443/NFOAA_Auth/login.jsp/

GET
H/1.1 200
OK NFCU_Mob_Logo-1d62888b4b662af9142e3c385f423f32.svg
ob-navyfederal.com/NFOAA_Auth/resources/images/ 4 KB
4 KB 75ms
75ms Image
image/svg+xml 185.193.89.50
ERISHENNYA-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ob-navyfederal.com/NFOAA_Auth/resources/images/NFCU_Mob_Logo-1d62888b4b662af9142e3c385f423f32.svg
Requested by: Host: ob-navyfederal.com
URL: https://ob-navyfederal.com/NFOAA_Auth/login.jsp/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.193.89.50 , Russian Federation, ASN210950 (ERISHENNYA-ASN, UA),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 2cca552b4d48760fdce1fb2c0a21e6bf09b6ada1f7e70f5b1f4b7b810367c630

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ob-navyfederal.com/NFOAA_Auth/login.jsp/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Wed, 09 Feb 2022 16:28:22 GMT
Last-Modified: Mon, 10 Jan 2022 18:50:50 GMT
Server: nginx/1.18.0 (Ubuntu)
ETag: "61dc800a-e4c"
Content-Type: image/svg+xml
Cache-Control: max-age=86400
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3660
Expires: Thu, 10 Feb 2022 16:28:22 GMT

GET
H/1.1 200
OK img_logo-veterans-1d62888b4b662af9142e3c385f423f32.svg
ob-navyfederal.com/NFOAA_Auth/resources/images/ 21 KB
22 KB 330ms
174ms Image
image/svg+xml 185.193.89.50
ERISHENNYA-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ob-navyfederal.com/NFOAA_Auth/resources/images/img_logo-veterans-1d62888b4b662af9142e3c385f423f32.svg
Requested by: Host: ob-navyfederal.com
URL: https://ob-navyfederal.com/NFOAA_Auth/login.jsp/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.193.89.50 , Russian Federation, ASN210950 (ERISHENNYA-ASN, UA),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3e700f9ff93a023fcaee00daeb83062c9492803afc78643532d41d369133f991

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ob-navyfederal.com/NFOAA_Auth/login.jsp/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Wed, 09 Feb 2022 16:28:22 GMT
Last-Modified: Mon, 10 Jan 2022 18:50:50 GMT
Server: nginx/1.18.0 (Ubuntu)
ETag: "61dc800a-55ca"
Content-Type: image/svg+xml
Cache-Control: max-age=86400
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 21962
Expires: Thu, 10 Feb 2022 16:28:22 GMT

GET
H/1.1 200
OK contact-us-1d62888b4b662af9142e3c385f423f32.svg
ob-navyfederal.com/NFOAA_Auth/resources/images/ 1 KB
1 KB 370ms
216ms Image
image/svg+xml 185.193.89.50
ERISHENNYA-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ob-navyfederal.com/NFOAA_Auth/resources/images/contact-us-1d62888b4b662af9142e3c385f423f32.svg
Requested by: Host: ob-navyfederal.com
URL: https://ob-navyfederal.com/NFOAA_Auth/login.jsp/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.193.89.50 , Russian Federation, ASN210950 (ERISHENNYA-ASN, UA),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 16eb10aacb5be4e997453d0d2501d49e7d3a236828ee90f22cd3f913951a6d67

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ob-navyfederal.com/NFOAA_Auth/login.jsp/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Wed, 09 Feb 2022 16:28:22 GMT
Last-Modified: Mon, 10 Jan 2022 18:50:50 GMT
Server: nginx/1.18.0 (Ubuntu)
ETag: "61dc800a-478"
Content-Type: image/svg+xml
Cache-Control: max-age=86400
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1144
Expires: Thu, 10 Feb 2022 16:28:22 GMT

GET
H/1.1 200
OK img-BecomeAMember-1d62888b4b662af9142e3c385f423f32.jpg
ob-navyfederal.com/NFOAA_Auth/resources/images/ 181 KB
182 KB 451ms
236ms Image
image/jpeg 185.193.89.50
ERISHENNYA-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ob-navyfederal.com/NFOAA_Auth/resources/images/img-BecomeAMember-1d62888b4b662af9142e3c385f423f32.jpg
Requested by: Host: ob-navyfederal.com
URL: https://ob-navyfederal.com/NFOAA_Auth/login.jsp/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.193.89.50 , Russian Federation, ASN210950 (ERISHENNYA-ASN, UA),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: ee4321efb356cf875dacf07419eb2649351e5907c159754a94b7b3be02479fe9

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ob-navyfederal.com/NFOAA_Auth/login.jsp/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Wed, 09 Feb 2022 16:28:22 GMT
Last-Modified: Mon, 10 Jan 2022 18:50:48 GMT
Server: nginx/1.18.0 (Ubuntu)
ETag: "61dc8008-2d591"
Content-Type: image/jpeg
Cache-Control: max-age=86400
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 185745
Expires: Thu, 10 Feb 2022 16:28:22 GMT

GET
H/1.1 200
OK Group5159-1d62888b4b662af9142e3c385f423f32.svg
ob-navyfederal.com/NFOAA_Auth/resources/images/ 5 KB
5 KB 500ms
208ms Image
image/svg+xml 185.193.89.50
ERISHENNYA-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ob-navyfederal.com/NFOAA_Auth/resources/images/Group5159-1d62888b4b662af9142e3c385f423f32.svg
Requested by: Host: ob-navyfederal.com
URL: https://ob-navyfederal.com/NFOAA_Auth/login.jsp/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.193.89.50 , Russian Federation, ASN210950 (ERISHENNYA-ASN, UA),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: d3c66738cff7fddc343adf5eed0f1ace982866d8beacbd1d699c45ce7cde17d8

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ob-navyfederal.com/NFOAA_Auth/login.jsp/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Wed, 09 Feb 2022 16:28:22 GMT
Last-Modified: Mon, 10 Jan 2022 18:50:50 GMT
Server: nginx/1.18.0 (Ubuntu)
ETag: "61dc800a-139a"
Content-Type: image/svg+xml
Cache-Control: max-age=86400
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 5018
Expires: Thu, 10 Feb 2022 16:28:22 GMT

GET
H/1.1 200
OK Group5166-1d62888b4b662af9142e3c385f423f32.svg
ob-navyfederal.com/NFOAA_Auth/resources/images/ 2 KB
2 KB 533ms
204ms Image
image/svg+xml 185.193.89.50
ERISHENNYA-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ob-navyfederal.com/NFOAA_Auth/resources/images/Group5166-1d62888b4b662af9142e3c385f423f32.svg
Requested by: Host: ob-navyfederal.com
URL: https://ob-navyfederal.com/NFOAA_Auth/login.jsp/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.193.89.50 , Russian Federation, ASN210950 (ERISHENNYA-ASN, UA),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 89a821c2c4f26ce58357c1e2fe213e58de98e7a7dd0ddc17e2b3aedeb3a1beae

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ob-navyfederal.com/NFOAA_Auth/login.jsp/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Wed, 09 Feb 2022 16:28:22 GMT
Last-Modified: Mon, 10 Jan 2022 18:50:48 GMT
Server: nginx/1.18.0 (Ubuntu)
ETag: "61dc8008-7e0"
Content-Type: image/svg+xml
Cache-Control: max-age=86400
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2016
Expires: Thu, 10 Feb 2022 16:28:22 GMT

GET
H/1.1 200
OK Group5158-1d62888b4b662af9142e3c385f423f32.svg
ob-navyfederal.com/NFOAA_Auth/resources/images/ 4 KB
4 KB 236ms
235ms Image
image/svg+xml 185.193.89.50
ERISHENNYA-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ob-navyfederal.com/NFOAA_Auth/resources/images/Group5158-1d62888b4b662af9142e3c385f423f32.svg
Requested by: Host: ob-navyfederal.com
URL: https://ob-navyfederal.com/NFOAA_Auth/login.jsp/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.193.89.50 , Russian Federation, ASN210950 (ERISHENNYA-ASN, UA),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 137f34c69c07dd3f6c1caf23bf0611cff6fe684b58ce75b22677abc149643001

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ob-navyfederal.com/NFOAA_Auth/login.jsp/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Wed, 09 Feb 2022 16:28:22 GMT
Last-Modified: Mon, 10 Jan 2022 18:50:50 GMT
Server: nginx/1.18.0 (Ubuntu)
ETag: "61dc800a-fd0"
Content-Type: image/svg+xml
Cache-Control: max-age=86400
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4048
Expires: Thu, 10 Feb 2022 16:28:22 GMT

GET
H/1.1 200
OK bg_globe.png
ob-navyfederal.com/NFOAA_Auth/resources/images/css/ 5 KB
5 KB 254ms
140ms Image
image/png 185.193.89.50
ERISHENNYA-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ob-navyfederal.com/NFOAA_Auth/resources/images/css/bg_globe.png
Requested by: Host: ob-navyfederal.com
URL: https://ob-navyfederal.com/NFOAA_Auth/login.jsp/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.193.89.50 , Russian Federation, ASN210950 (ERISHENNYA-ASN, UA),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: eac7a5450fce00715e381e02b2359fa4bd7ddd5a30f52e15ca9c342ce24d3b37

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ob-navyfederal.com/NFOAA_Auth/login.jsp/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Wed, 09 Feb 2022 16:28:22 GMT
Last-Modified: Mon, 10 Jan 2022 18:50:50 GMT
Server: nginx/1.18.0 (Ubuntu)
ETag: "61dc800a-12bd"
Content-Type: image/png
Cache-Control: max-age=86400
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4797
Expires: Thu, 10 Feb 2022 16:28:22 GMT

GET
H/1.1 200
OK img-billboard-BG.svg
ob-navyfederal.com/NFOAA_Auth/resources/images/css/ 9 KB
10 KB 177ms
73ms Image
image/svg+xml 185.193.89.50
ERISHENNYA-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ob-navyfederal.com/NFOAA_Auth/resources/images/css/img-billboard-BG.svg
Requested by: Host: ob-navyfederal.com
URL: https://ob-navyfederal.com/NFOAA_Auth/login.jsp/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.193.89.50 , Russian Federation, ASN210950 (ERISHENNYA-ASN, UA),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: abd0ba3bfcdb6d0b220ce116d51b7317e7e872106601e1d4451fab6f23698d42

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ob-navyfederal.com/NFOAA_Auth/login.jsp/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Wed, 09 Feb 2022 16:28:22 GMT
Last-Modified: Mon, 10 Jan 2022 18:50:50 GMT
Server: nginx/1.18.0 (Ubuntu)
ETag: "61dc800a-2577"
Content-Type: image/svg+xml
Cache-Control: max-age=86400
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 9591
Expires: Thu, 10 Feb 2022 16:28:22 GMT

GET
H/1.1 200
OK toolTip.svg
ob-navyfederal.com/NFOAA_Auth/resources/images/css/ 640 B
961 B 296ms
179ms Image
image/svg+xml 185.193.89.50
ERISHENNYA-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ob-navyfederal.com/NFOAA_Auth/resources/images/css/toolTip.svg
Requested by: Host: ob-navyfederal.com
URL: https://ob-navyfederal.com/NFOAA_Auth/login.jsp/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.193.89.50 , Russian Federation, ASN210950 (ERISHENNYA-ASN, UA),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: f7da84eea3d03884fcce20e3c82b7d11f3f0ac91c48b0f57d675ab54e2646ee3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ob-navyfederal.com/NFOAA_Auth/login.jsp/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Wed, 09 Feb 2022 16:28:22 GMT
Last-Modified: Mon, 10 Jan 2022 18:50:50 GMT
Server: nginx/1.18.0 (Ubuntu)
ETag: "61dc800a-280"
Content-Type: image/svg+xml
Cache-Control: max-age=86400
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 640
Expires: Thu, 10 Feb 2022 16:28:22 GMT

GET
H/1.1 200
OK icons.png
ob-navyfederal.com/NFOAA_Auth/resources/images/css/ 6 KB
7 KB 240ms
240ms Image
image/png 185.193.89.50
ERISHENNYA-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ob-navyfederal.com/NFOAA_Auth/resources/images/css/icons.png
Requested by: Host: ob-navyfederal.com
URL: https://ob-navyfederal.com/NFOAA_Auth/login.jsp/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.193.89.50 , Russian Federation, ASN210950 (ERISHENNYA-ASN, UA),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 83de0b26f5230608c42df74eab660c8e7a51ffe1710ce6c2514bd9c7756b5488

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ob-navyfederal.com/NFOAA_Auth/login.jsp/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Wed, 09 Feb 2022 16:28:22 GMT
Last-Modified: Mon, 10 Jan 2022 18:50:50 GMT
Server: nginx/1.18.0 (Ubuntu)
ETag: "61dc800a-18fa"
Content-Type: image/png
Cache-Control: max-age=86400
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 6394
Expires: Thu, 10 Feb 2022 16:28:22 GMT

GET
H2 200 6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v18/ 13 KB
13 KB 32ms
8ms Font
font/woff2 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v18/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2

Requested by

Host: ob-navyfederal.com
URL: https://ob-navyfederal.com/NFOAA_Auth/login.jsp/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

72dbd696f7961daf9049faacc868865d959f3d126f40d5271f48d5d9a0ccc652

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ob-navyfederal.com/
Origin: https://ob-navyfederal.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 21:39:33 GMT
x-content-type-options: nosniff
age: 154129
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13072
x-xss-protection: 0
last-modified: Wed, 10 Nov 2021 18:17:36 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Tue, 07 Feb 2023 21:39:33 GMT

GET
H2 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v18/ 13 KB
13 KB 33ms
9ms Font
font/woff2 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v18/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: ob-navyfederal.com
URL: https://ob-navyfederal.com/NFOAA_Auth/login.jsp/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

428f1eb7935944229430ac0fdce0033f05d9b8c1c020b87c681dd7a78ab4dd19

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ob-navyfederal.com/
Origin: https://ob-navyfederal.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Wed, 09 Feb 2022 14:56:27 GMT
x-content-type-options: nosniff
age: 5515
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13080
x-xss-protection: 0
last-modified: Wed, 10 Nov 2021 18:10:26 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 09 Feb 2023 14:56:27 GMT

GET
H/1.1 200
OK nfcu-icons.woff
ob-navyfederal.com/NFOAA_Auth/resources/fonts/ 81 B
331 B 150ms
80ms Font
font/woff 185.193.89.50
ERISHENNYA-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://ob-navyfederal.com/NFOAA_Auth/resources/fonts/nfcu-icons.woff
Requested by: Host: ob-navyfederal.com
URL: https://ob-navyfederal.com/NFOAA_Auth/login.jsp/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.193.89.50 , Russian Federation, ASN210950 (ERISHENNYA-ASN, UA),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 8d7de86a8f9b9e41fca21e9ce8d5be76e34e66d31d225febf8f9e3d13cde193f

Request headers

Referer: https://ob-navyfederal.com/NFOAA_Auth/login.jsp/
Origin: https://ob-navyfederal.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Wed, 09 Feb 2022 16:28:22 GMT
Last-Modified: Mon, 10 Jan 2022 18:50:50 GMT
Server: nginx/1.18.0 (Ubuntu)
ETag: "51-5d53ed0b89680"
Content-Type: font/woff
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 81

GET
H/1.1 200
OK nfcu-icons.ttf
ob-navyfederal.com/NFOAA_Auth/resources/fonts/ 80 KB
80 KB 346ms
343ms Font
font/ttf 185.193.89.50
ERISHENNYA-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://ob-navyfederal.com/NFOAA_Auth/resources/fonts/nfcu-icons.ttf
Requested by: Host: ob-navyfederal.com
URL: https://ob-navyfederal.com/NFOAA_Auth/login.jsp/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.193.89.50 , Russian Federation, ASN210950 (ERISHENNYA-ASN, UA),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 28cc589ed8a25130802719844e3f971e28ad2f25772666c2f50764ca83ea2c78

Request headers

Referer: https://ob-navyfederal.com/NFOAA_Auth/login.jsp/
Origin: https://ob-navyfederal.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Wed, 09 Feb 2022 16:28:22 GMT
Last-Modified: Mon, 10 Jan 2022 18:54:24 GMT
Server: nginx/1.18.0 (Ubuntu)
ETag: "14034-5d53edd79f800"
Content-Type: font/ttf
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 81972

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Navy Federal Credit Union (Government)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://ob-navyfederal.com/NFOAA_Auth/login.jsp/ Message: Failed to decode downloaded font: https://ob-navyfederal.com/NFOAA_Auth/resources/fonts/nfcu-icons.woff
other	warning	URL: https://ob-navyfederal.com/NFOAA_Auth/login.jsp/ Message: OTS parsing error: invalid sfntVersion: 1315905603

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.gstatic.com
ob-navyfederal.com
185.193.89.50
2a00:1450:4001:82b::2003
137f34c69c07dd3f6c1caf23bf0611cff6fe684b58ce75b22677abc149643001
16eb10aacb5be4e997453d0d2501d49e7d3a236828ee90f22cd3f913951a6d67
28cc589ed8a25130802719844e3f971e28ad2f25772666c2f50764ca83ea2c78
2cca552b4d48760fdce1fb2c0a21e6bf09b6ada1f7e70f5b1f4b7b810367c630
3e700f9ff93a023fcaee00daeb83062c9492803afc78643532d41d369133f991
4189dcf8c906a0cae762bd80a1cd3c13e47c947f0453c5d706bc759e4d739b5d
428f1eb7935944229430ac0fdce0033f05d9b8c1c020b87c681dd7a78ab4dd19
72dbd696f7961daf9049faacc868865d959f3d126f40d5271f48d5d9a0ccc652
83de0b26f5230608c42df74eab660c8e7a51ffe1710ce6c2514bd9c7756b5488
89a821c2c4f26ce58357c1e2fe213e58de98e7a7dd0ddc17e2b3aedeb3a1beae
8d7de86a8f9b9e41fca21e9ce8d5be76e34e66d31d225febf8f9e3d13cde193f
abd0ba3bfcdb6d0b220ce116d51b7317e7e872106601e1d4451fab6f23698d42
d3c66738cff7fddc343adf5eed0f1ace982866d8beacbd1d699c45ce7cde17d8
eac7a5450fce00715e381e02b2359fa4bd7ddd5a30f52e15ca9c342ce24d3b37
ee4321efb356cf875dacf07419eb2649351e5907c159754a94b7b3be02479fe9
f7da84eea3d03884fcce20e3c82b7d11f3f0ac91c48b0f57d675ab54e2646ee3

ob-navyfederal.com Open in urlscan Pro 185.193.89.50 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

16 Requests

100 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

363 kBTransfer

461 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

0 Cookies

2 Console Messages

Indicators

ob-navyfederal.com Open in urlscan Pro
185.193.89.50 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

363 kB
Transfer

461 kB
Size

0
Cookies

16 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!