delta-app-ylaiz-if9kj.ondigitalocean.app
172.66.0.96
Malicious Activity!
Public Scan
Open in
urlscan Pro
Submission: On April 19 via manual from JP — Scanned from JP
Summary
TLS certificate: Issued by WE1 on March 30th 2026. Valid for: 3mo.
This is the only time delta-app-ylaiz-if9kj.ondigitalocean.app was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Tech Support Scam (Consumer) Microsoft (Consumer)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 7 | 172.66.0.96 172.66.0.96 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
| 1 | 172.66.172.57 172.66.172.57 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
| 1 | 172.67.152.209 172.67.152.209 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
| 9 | 4 |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
| delta-app-ylaiz-if9kj.ondigitalocean.app 21d old |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
| ipwhois.pro 6yr old |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
| audio.jukehost.co.uk 7yr old |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 7 |
ondigitalocean.app
delta-app-ylaiz-if9kj.ondigitalocean.app 21d old |
871 KB |
| 1 |
jukehost.co.uk
audio.jukehost.co.uk — Cisco Umbrella Rank: 657033 7yr old |
339 KB |
| 1 |
ipwhois.pro
ipwhois.pro — Cisco Umbrella Rank: 209252 6yr old |
702 B |
| 9 | 3 |
| Domain | Requested by | |
|---|---|---|
| 7 | delta-app-ylaiz-if9kj.ondigitalocean.app |
delta-app-ylaiz-if9kj.ondigitalocean.app
|
| 1 | audio.jukehost.co.uk |
delta-app-ylaiz-if9kj.ondigitalocean.app
|
| 1 | ipwhois.pro |
delta-app-ylaiz-if9kj.ondigitalocean.app
|
| 9 | 3 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| ondigitalocean.app WE1 |
2026-03-30 - 2026-06-28 |
3mo | crt.sh |
| ipwhois.pro WE1 |
2026-04-12 - 2026-07-11 |
3mo | crt.sh |
| jukehost.co.uk WE1 |
2026-03-05 - 2026-06-03 |
3mo | crt.sh |
This page contains 1 frames:
Primary Page:
https://delta-app-ylaiz-if9kj.ondigitalocean.app/3d6666488a/index.html?wbrinmin=(0101)%2055137%2021835
Frame ID: 6FBD29235231C0AFA8DFA7F62A7EA5DC
Requests: 21 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
9 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H3 |
Primary Request
index.html
delta-app-ylaiz-if9kj.ondigitalocean.app/3d6666488a/ |
236 B 800 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
4rmsa7.js
delta-app-ylaiz-if9kj.ondigitalocean.app/3d6666488a/pkg/ |
4 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
html_loader_bg.wasm
delta-app-ylaiz-if9kj.ondigitalocean.app/3d6666488a/pkg/ |
1 MB 864 KB |
Fetch
application/wasm |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
favicon.ico
delta-app-ylaiz-if9kj.ondigitalocean.app/ |
1019 B 972 B |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
/
ipwhois.pro/ |
757 B 702 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
472 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
187 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
168 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
364 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
349 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
722 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
116 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
276 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
347 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
3 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
14 KB 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
xs9jlAxUSxeI94ygxgKuJzxLH3EoV3go
audio.jukehost.co.uk/ |
338 KB 339 KB |
Media
audio/mp3 |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
aix2.mp3
delta-app-ylaiz-if9kj.ondigitalocean.app/3d6666488a/ |
1019 B 2 KB |
Media
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
hijax1.mp3
delta-app-ylaiz-if9kj.ondigitalocean.app/3d6666488a/ |
1019 B 2 KB |
Media
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
favicon.ico
delta-app-ylaiz-if9kj.ondigitalocean.app/ |
1019 B 0 |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Tech Support Scam (Consumer) Microsoft (Consumer)13 JavaScript Window variables
These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.
function| decodeBase64UTF8 string| _0x1a2b3c string| decoded function| $ function| jQuery function| playAudio object| t function| wbrinminfetchvar string| wbrinmin string| wbrinminvar function| toggleFullScreen function| addEvent function| myFunction0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
4 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
audio.jukehost.co.uk
delta-app-ylaiz-if9kj.ondigitalocean.app
ipwhois.pro
172.66.0.96
172.66.172.57
172.67.152.209
04658eaaadb8d55b3b1d716ab901552af1b66ab4043562721d862e346668bbb8
102031d14002e152907017f3b2c3435634a73f858941159913b3d338b320993d
1062361de4627c89f8ea0541b529769540a46687daa3f4b5c9e4a84e3de604d5
11d4d0aa8bf0ab597bee785cd9d03301787faee4aae43d66ab53b15f0fe7d849
1ab5ef4e7e196cb1ff39df44e1a0a39f6880b906ef6fd6da3cfdbb92ffd33115
2c29fd26e37b2e099881734694d4661af6f17b1f631b604a58cb88d8b53cb709
31c6dbe9d867436244f38566adad57e3870f4c8489c6804280eb564bfac5c1bd
44f752b0bd2e48052d538bc6aca5379f3630ca64da945f794690ddf47e8eaef7
4b436b0b6a47db85c88f83dc3fe3fd9a96c0a4018b28832165df929dffe0bc86
4c1606563842cce5f1788329d4417ae3618b33c6365c56a7122439b6ab45c977
8e4039a48ffb24b4cdc57ddd4384a16af9eb7efa678577e280308bc9750a0bbc
aca34ecea21a4e57816fd2483737ecc613d3bb213d3da3ff91e93c8b42e452a7
afe332157f4efe355f3181284e99f4331c4d19703ed1678b5316d2933f95e98e
b13a03e0db893734298cbe203bf264407636ffe5dab0a141f83c492d0034dd6a
b1e9d0861c6671644ad118df8150e394f8cba36b9536f64898bd35919e5515b4
b8c02a652014b7a6192065e5b66b394a52c9345e80d0eed0134f645b65d5d570
c5a324f181af16879b6c4c52b731b23392f2816def159b157c4de620cff1cd41
ebb791d699b77ee1137f7e66d436db917084785237adcf4d02408f329615092e
