phatduckmusic.com - urlscan.io

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 5 HTTP transactions. The main IP is 149.56.121.61, located in Montréal, Canada and belongs to OVH, FR. The main domain is phatduckmusic.com.

This is the only time phatduckmusic.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Excel / PDF download (Online)

Domain & IP information

	IP Address	AS Autonomous System
3	149.56.121.61 149.56.121.61	16276 (OVH) (OVH)
1	2a00:1450:400... 2a00:1450:4001:81f::200a	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a00:1450:400... 2a00:1450:4001:821::2003	15169 (GOOGLE) (GOOGLE - Google LLC)
5	3

3 149.56.121.61 (Montréal, Canada)

ASN16276 (OVH, FR)
PTR: mail.nofussdigital.com

phatduckmusic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81f::200a (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:821::2003 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	phatduckmusic.com phatduckmusic.com	96 KB
1	gstatic.com fonts.gstatic.com	13 KB
1	googleapis.com fonts.googleapis.com	884 B
5	3

	Domain	Requested by
3	phatduckmusic.com	phatduckmusic.com
1	fonts.gstatic.com
1	fonts.googleapis.com	phatduckmusic.com
5	3

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://phatduckmusic.com/wp-includes/images/163-exel/5fgff/
Frame ID: 21FBC9DCF813BECD4817A718EDB700D4
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Page Statistics

5
Requests

0 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

110 kB
Transfer

109 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
phatduckmusic.com/wp-includes/images/163-exel/5fgff/ 1 KB
1 KB 303ms
183ms Document
text/html 149.56.121.61
OVH

General

Check archive.org

Show headers Download Go to

Full URL: http://phatduckmusic.com/wp-includes/images/163-exel/5fgff/
Protocol: HTTP/1.1
Server: 149.56.121.61 Montréal, Canada, ASN16276 (OVH, FR),
Reverse DNS: mail.nofussdigital.com
Software: Apache /
Resource Hash: 4092376a37a56c755dcf39ba0257ffbd81e7ecfed61a19a382ddba4f7becc294

Request headers

Host: phatduckmusic.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 22 Apr 2019 22:38:01 GMT
Server: Apache
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK style.css
phatduckmusic.com/wp-includes/images/163-exel/5fgff/ 2 KB
956 B 108ms
103ms Stylesheet
text/css 149.56.121.61
OVH

General

Check archive.org

Show headers Download Go to

Full URL: http://phatduckmusic.com/wp-includes/images/163-exel/5fgff/style.css
Requested by: Host: phatduckmusic.com
URL: http://phatduckmusic.com/wp-includes/images/163-exel/5fgff/
Protocol: HTTP/1.1
Server: 149.56.121.61 Montréal, Canada, ASN16276 (OVH, FR),
Reverse DNS: mail.nofussdigital.com
Software: Apache /
Resource Hash: d79c162546f1b3d7e79c5d4557e619f9d990b2b044806ff058193e142e6c7f2c

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: phatduckmusic.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://phatduckmusic.com/wp-includes/images/163-exel/5fgff/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://phatduckmusic.com/wp-includes/images/163-exel/5fgff/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 22 Apr 2019 22:38:02 GMT
Content-Encoding: gzip
Referrer-Policy
Last-Modified: Tue, 10 Jul 2018 01:01:09 GMT
Server: Apache
Vary: Accept-Encoding
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 650

GET
H/1.1 200
OK css
fonts.googleapis.com/ 817 B
884 B 22ms
15ms Stylesheet
text/css 2a00:1450:4001:81f::200a
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.googleapis.com/css?family=Oleo+Script

Requested by

Host: phatduckmusic.com
URL: http://phatduckmusic.com/wp-includes/images/163-exel/5fgff/

Protocol

HTTP/1.1

Server

2a00:1450:4001:81f::200a , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

c16852b9cddb795940959f9e0ea9cef0dfc2ec04d82511d9870961af21d0ca6c

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://phatduckmusic.com/wp-includes/images/163-exel/5fgff/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 22 Apr 2019 22:38:02 GMT
Content-Encoding: gzip
Last-Modified: Mon, 22 Apr 2019 22:38:02 GMT
Server: ESF
X-Frame-Options: SAMEORIGIN
Content-Type: text/css; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: private, max-age=86400, stale-while-revalidate=604800
Transfer-Encoding: chunked
Timing-Allow-Origin: *
Link: <http://fonts.gstatic.com>; rel=preconnect; crossorigin
X-XSS-Protection: 1; mode=block
Expires: Mon, 22 Apr 2019 22:38:02 GMT

GET
H/1.1 200
OK bg.png
phatduckmusic.com/wp-includes/images/163-exel/5fgff/ 94 KB
94 KB 99ms
98ms Image
image/png 149.56.121.61
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://phatduckmusic.com/wp-includes/images/163-exel/5fgff/bg.png
Protocol: HTTP/1.1
Server: 149.56.121.61 Montréal, Canada, ASN16276 (OVH, FR),
Reverse DNS: mail.nofussdigital.com
Software: Apache /
Resource Hash: 34aa021f8933baefa64cd07e049433d1052e6618713dfd7e5a77eefb4883ab90

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: phatduckmusic.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://phatduckmusic.com/wp-includes/images/163-exel/5fgff/style.css
Connection: keep-alive
Cache-Control: no-cache
Referer: http://phatduckmusic.com/wp-includes/images/163-exel/5fgff/style.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 22 Apr 2019 22:38:02 GMT
Referrer-Policy
Last-Modified: Tue, 10 Jul 2018 01:01:09 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 96054

GET
H/1.1 200
OK rax5HieDvtMOe0iICsUccChdu0_y8zac.woff2
fonts.gstatic.com/s/oleoscript/v7/ 12 KB
13 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:821::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.gstatic.com/s/oleoscript/v7/rax5HieDvtMOe0iICsUccChdu0_y8zac.woff2

Protocol

HTTP/1.1

Server

2a00:1450:4001:821::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

8a8fa64052ca144061a70622bbac56e630d73be314e369d99b6f7b1e39f9efa9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: http://fonts.googleapis.com/css?family=Oleo+Script
Origin: http://phatduckmusic.com

Response headers

Date: Sat, 09 Mar 2019 04:38:42 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 15 Jan 2019 19:46:44 GMT
Server: sffe
Age: 3866360
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 12484
X-XSS-Protection: 1; mode=block
Expires: Sun, 08 Mar 2020 04:38:42 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Excel / PDF download (Online)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
fonts.gstatic.com
phatduckmusic.com
149.56.121.61
2a00:1450:4001:81f::200a
2a00:1450:4001:821::2003
34aa021f8933baefa64cd07e049433d1052e6618713dfd7e5a77eefb4883ab90
4092376a37a56c755dcf39ba0257ffbd81e7ecfed61a19a382ddba4f7becc294
8a8fa64052ca144061a70622bbac56e630d73be314e369d99b6f7b1e39f9efa9
c16852b9cddb795940959f9e0ea9cef0dfc2ec04d82511d9870961af21d0ca6c
d79c162546f1b3d7e79c5d4557e619f9d990b2b044806ff058193e142e6c7f2c

phatduckmusic.com Open in urlscan Pro 149.56.121.61 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

5 Requests

0 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

110 kBTransfer

109 kBSize

0 Cookies

0 Outgoing links

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

0 Cookies

Indicators

phatduckmusic.com Open in urlscan Pro
149.56.121.61 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

0 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

110 kB
Transfer

109 kB
Size

0
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!