home-mailhelp12.duckdns.org
Open in
urlscan Pro
138.197.175.213
Malicious Activity!
Public Scan
Effective URL: https://home-mailhelp12.duckdns.org/727b0bfd7df43dac4bdd1181c09e5601/97301191d38c1ee50f5c4f9f8f5a1123.aspx
Submission: On June 03 via manual from US — Scanned from DE
Summary
TLS certificate: Issued by R3 on June 3rd 2023. Valid for: 3 months.
This is the only time home-mailhelp12.duckdns.org was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Amazon (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 216.239.32.21 216.239.32.21 | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a00:1450:400... 2a00:1450:4001:803::200e | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:80b::2014 | 15169 (GOOGLE) (GOOGLE) | |
7 | 2a00:1450:400... 2a00:1450:4001:80b::2013 | 15169 (GOOGLE) (GOOGLE) | |
1 2 | 2001:4de0:ac1... 2001:4de0:ac18::1:a:2b | 20446 (STACKPATH...) (STACKPATH-CDN) | |
4 | 2a00:1450:400... 2a00:1450:4001:810::2001 | 15169 (GOOGLE) (GOOGLE) | |
7 | 2a00:1450:400... 2a00:1450:4001:813::200a | 15169 (GOOGLE) (GOOGLE) | |
1 4 | 138.197.175.213 138.197.175.213 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN) | |
1 | 162.19.58.159 162.19.58.159 | 16276 (OVH) (OVH) | |
1 | 2600:9000:225... 2600:9000:2250:b000:1d:d7f6:39d2:2dc1 | 16509 (AMAZON-02) (AMAZON-02) | |
2 | 2600:9000:225... 2600:9000:2250:4c00:1d:d7f6:39d2:2dc1 | 16509 (AMAZON-02) (AMAZON-02) | |
30 | 11 |
ASN15169 (GOOGLE, US)
imos006-dot-im--os.appspot.com |
ASN20446 (STACKPATH-CDN, US)
code.jquery.com | |
releases.jquery.com |
ASN15169 (GOOGLE, US)
lh3.googleusercontent.com |
ASN16509 (AMAZON-02, US)
images-na.ssl-images-amazon.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 66 |
10 KB |
7 |
imcreator.com
www.imcreator.com — Cisco Umbrella Rank: 809270 |
59 KB |
4 |
duckdns.org
1 redirects
home-mailhelp12.duckdns.org |
34 KB |
4 |
googleusercontent.com
lh3.googleusercontent.com — Cisco Umbrella Rank: 93 |
2 KB |
2 |
media-amazon.com
m.media-amazon.com — Cisco Umbrella Rank: 470 |
33 KB |
2 |
jquery.com
1 redirects
code.jquery.com — Cisco Umbrella Rank: 745 releases.jquery.com — Cisco Umbrella Rank: 64490 |
30 KB |
2 |
youtube.com
www.youtube.com — Cisco Umbrella Rank: 99 |
64 KB |
1 |
ssl-images-amazon.com
images-na.ssl-images-amazon.com — Cisco Umbrella Rank: 719 |
97 KB |
1 |
ibb.co
i.ibb.co — Cisco Umbrella Rank: 11860 |
51 KB |
1 |
appspot.com
imos006-dot-im--os.appspot.com — Cisco Umbrella Rank: 496411 |
2 KB |
1 |
snappycms.co.za
snappycms.co.za |
18 KB |
30 | 11 |
Domain | Requested by | |
---|---|---|
7 | fonts.googleapis.com |
www.imcreator.com
|
7 | www.imcreator.com |
snappycms.co.za
|
4 | home-mailhelp12.duckdns.org |
1 redirects
snappycms.co.za
home-mailhelp12.duckdns.org |
4 | lh3.googleusercontent.com |
snappycms.co.za
|
2 | m.media-amazon.com |
home-mailhelp12.duckdns.org
|
2 | www.youtube.com |
snappycms.co.za
www.youtube.com |
1 | images-na.ssl-images-amazon.com |
home-mailhelp12.duckdns.org
|
1 | i.ibb.co |
home-mailhelp12.duckdns.org
|
1 | releases.jquery.com |
snappycms.co.za
|
1 | code.jquery.com | 1 redirects |
1 | imos006-dot-im--os.appspot.com |
snappycms.co.za
|
1 | snappycms.co.za | |
30 | 12 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.google.com GTS CA 1C3 |
2023-05-19 - 2023-08-11 |
3 months | crt.sh |
*.appspot.com GTS CA 1C3 |
2023-05-19 - 2023-08-11 |
3 months | crt.sh |
*.googleusercontent.com GTS CA 1C3 |
2023-05-19 - 2023-08-11 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-05-19 - 2023-08-11 |
3 months | crt.sh |
www.home-mailhelp12.duckdns.org R3 |
2023-06-03 - 2023-09-01 |
3 months | crt.sh |
i.ibb.co R3 |
2023-04-11 - 2023-07-10 |
3 months | crt.sh |
images-na.ssl-images-amazon.com DigiCert Global CA G2 |
2022-10-26 - 2023-10-14 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://home-mailhelp12.duckdns.org/727b0bfd7df43dac4bdd1181c09e5601/97301191d38c1ee50f5c4f9f8f5a1123.aspx
Frame ID: EFE574D080DAB6EA0A88B7B6F74FDDAB
Requests: 30 HTTP requests in this frame
Screenshot
Page Title
Amazon-AnmeldungPage URL History Show full URLs
- http://snappycms.co.za/free/maindesk3/help?=jGtstDCk Page URL
-
https://home-mailhelp12.duckdns.org/?help
HTTP 302
https://home-mailhelp12.duckdns.org/727b0bfd7df43dac4bdd1181c09e5601/97301191d38c1ee50f5c4f9f8f5a1123.aspx Page URL
Detected technologies
Microsoft ASP.NET (Web Frameworks) ExpandDetected patterns
- \.aspx?(?:$|\?)
Lightbox (JavaScript Libraries) Expand
Detected patterns
- lightbox(?:-plus-jquery)?.{0,32}\.js
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://snappycms.co.za/free/maindesk3/help?=jGtstDCk Page URL
-
https://home-mailhelp12.duckdns.org/?help
HTTP 302
https://home-mailhelp12.duckdns.org/727b0bfd7df43dac4bdd1181c09e5601/97301191d38c1ee50f5c4f9f8f5a1123.aspx Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 5- https://code.jquery.com/jquery-2.x-git.min.js HTTP 301
- https://releases.jquery.com/git/jquery-2.x-git.min.js
30 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
help
snappycms.co.za/free/maindesk3/ |
112 KB 18 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
iframe_api
www.youtube.com/ |
1 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
imos.js
imos006-dot-im--os.appspot.com/js/ |
6 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
fonts.css
www.imcreator.com/css/ |
5 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
static_style
www.imcreator.com/ |
16 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-2.x-git.min.js
releases.jquery.com/git/ Redirect Chain
|
84 KB 29 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
xprs_helper.js
www.imcreator.com/js/ |
35 KB 11 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
all_js.js
www.imcreator.com/ |
92 KB 14 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.mobile.custom.min.js
www.imcreator.com/js/lib/touchswipe/ |
8 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
EWqW7DEI4kOTRMLjK2-ObFHp-EYBt5apFYZ1LVFAhLtTLjigCRfx5hCCTKbIjIm68VQ00p9twloHJ9w8=s50
lh3.googleusercontent.com/ |
688 B 987 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
TgRyMQvJ3_h9RmOnu7AlhIE7NLOOBsRoBounARrs8fQv8HCRPaFtpBneSqJOSZpI6l7He_bAZKN179JBig=s50
lh3.googleusercontent.com/ |
206 B 295 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
43-pXHjwrpmVO8Oean-6BD0uzARvcqUQrpdi7Yw2bxaXwEoP21UdN5kW6Ks9pdOxf7ropMUrh0djgYPwYPU=s50
lh3.googleusercontent.com/ |
265 B 356 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
9rwgVnDglPdPFugSu98fhDmxzjXC9KovZ_7BuHkXPIv6jvg9S96flGnhL_e4y8mIpPpZQstfqEV-WitY=s50
lh3.googleusercontent.com/ |
262 B 287 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
lightbox.js
www.imcreator.com/js/ |
16 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
spimeengine.js
www.imcreator.com/js/ |
75 KB 22 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
www-widgetapi.js
www.youtube.com/s/player/f55759b8/www-widgetapi.vflset/ |
198 KB 62 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
76 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
2 KB 643 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
807 B 476 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
423 B 406 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
5 KB 837 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
20 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
5 KB 834 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
97301191d38c1ee50f5c4f9f8f5a1123.aspx
home-mailhelp12.duckdns.org/727b0bfd7df43dac4bdd1181c09e5601/ Redirect Chain
|
7 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
asset@css_desktop1.css
home-mailhelp12.duckdns.org/727b0bfd7df43dac4bdd1181c09e5601/ |
12 KB 12 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
asset@js_desktop1.js
home-mailhelp12.duckdns.org/727b0bfd7df43dac4bdd1181c09e5601/ |
14 KB 14 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Bye-H-LPc-U-NMwe.png
i.ibb.co/ZYfFxJP/ |
51 KB 51 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
61-6nKPKyWL._RC%7C11Y+5x+kkTL.js,51KMV3Cz2XL.js,31x4ENTlVIL.js,31f4+QIEeqL.js,01N6xzIJxbL.js,518BI433aLL.js,01rpauTep4L.js,31QZSjMuoeL.js,61ofwvddDeL.js,01KsMxlPtzL.js_.js
images-na.ssl-images-amazon.com/images/I/ |
309 KB 97 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pDxWAF1pBB0dzGB.woff2
m.media-amazon.com/images/S/sash/ |
16 KB 17 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFPk-9IF4FqAqY-.woff2
m.media-amazon.com/images/S/sash/ |
16 KB 17 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Amazon (Online)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| onbeforetoggle object| onscrollend object| jQuery16400561083664334338653 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.youtube.com/ | Name: YSC Value: Wa_J8gJmKtc |
|
.youtube.com/ | Name: VISITOR_INFO1_LIVE Value: G2zHwS9LO9c |
|
home-mailhelp12.duckdns.org/ | Name: PHPSESSID Value: 0986614888d86d80db75dca9a8bd2cb9 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
code.jquery.com
fonts.googleapis.com
home-mailhelp12.duckdns.org
i.ibb.co
images-na.ssl-images-amazon.com
imos006-dot-im--os.appspot.com
lh3.googleusercontent.com
m.media-amazon.com
releases.jquery.com
snappycms.co.za
www.imcreator.com
www.youtube.com
138.197.175.213
162.19.58.159
2001:4de0:ac18::1:a:2b
216.239.32.21
2600:9000:2250:4c00:1d:d7f6:39d2:2dc1
2600:9000:2250:b000:1d:d7f6:39d2:2dc1
2a00:1450:4001:803::200e
2a00:1450:4001:80b::2013
2a00:1450:4001:80b::2014
2a00:1450:4001:810::2001
2a00:1450:4001:813::200a
013d1dc68fadda651c773b6deb153e3e8b4dd612fb2af70db48c87af7808d1e7
06b37316b38c8f1f7d9a254158baeff84ea85bdb10e5e261bc75a17b20ce3b5d
0e052a42588678115282200dfcf7a9e187ac63bcc6828521886de793221b2c24
0eef431cee18b1dc43636dd2a7703b7c0ce9f6bdbad9f280b7313d0ded232327
1384259e6f4ab2c7553cb9b40c64bcc72a3ddfee4a3665a92fc9b6bf617413c7
16236a16a95009024cebc75718409ad144ef5dd78a3227a44b4f642ae2cfff07
289d25d68f730e581e0a16b8bee8f63a061717973f8ac8c29ccf2ba8fed15adf
2943a116688be6f00f50b4155a44c3ea148b047d69b7e6df58c58d957a67a54a
2f67ad1428e3fd9f16874c486daddc967b42eafdb4cd4d645bffc65da352c8a6
4d0043cf27b66c2a38040edf85abca8596be2d9368c73bef172a668160e50665
512aeeb05776eb3c904600e0e3f7fb30c511841c12764b54af96319ce8e925a4
590c154cc711d0fc02e4bdf6167bfdddb8230dd5bd2da1f02cea90d81ee3bb68
59fd3f3110d59069b57725f79966c7f2e499df8a50049be6ae7718ec24fcd2ea
7cb4efd75d841420c32a07f5880f53c1b59a78a2ca21e4c805a6a10c0f1ad429
884663c1137f80922a8e50d96df7b23ba59ea46caf3bf6cd89b38e231decf4e5
8b30ed59735372b16ccb1d15957a1afeb82fd607dcc6e181c8b4c7b6aeee3ddd
9060a290f229a10d3358d3fb1d89df6eb0e085ce49e1e14a751febb50c27f69a
943272099685f993fa2d471530b496dd0bb861df627318b4585b0b70519acc4d
9a125df1d257d6cc1f82f703c40b513df8a6cfa1b710c5f7955e97aaebb496aa
a23bd39042db7aa9763a64d8b7975eaaeb55253dc2c4bb6203cb2a9bb2e344b5
afba008659b26a4bc09e3a77502e896206359fefe6bd50a00a89d270c4c6c864
b96979fb43be8ab4e533ad542426182558f82034b1c54c2cefd6397a252d86b2
bce587a05f16dcc4c6160c77318f9cbc0253c0c178469bdf4dcb3ee74a4c6009
c3e0d1b01c02cca5545bbe9a85d904b97723600a61a4e157b1f7116ae2aee4d8
cb8eab14aa277ecaf3902994b79deb5856d38efdcea8c2baebfe2c110cd379d6
e8264d13e251f946a04be79b1e9d75cac352d52565218583bfd74948e5904606
e900470f72fe43136df67b8fd87a8422a6d7f0f98332bd3907f901aac2cc4d5c
f20e26f58626bee6c98e4ae3b104bbf633079c4127beff649dd57afbbd6444e8
f4a09886e48d5ecf18fd5bcb5ccfe14ca7ea3be913075465ea301d1ac1ece6db