![](/screenshots/1f458a22-32ad-4ec6-bb9c-e02336e1e85f.png)
whatsapp-grupjoin18.duckdns.org
Open in
urlscan Pro
52.247.224.99
Malicious Activity!
Public Scan
Submission: On October 07 via automatic, source openphish — Scanned from DE
Summary
TLS certificate: Issued by R3 on October 6th 2021. Valid for: 3 months.
This is the only time whatsapp-grupjoin18.duckdns.org was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Gaming (Entertainment)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
7 | 52.247.224.99 52.247.224.99 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
1 | 104.20.15.194 104.20.15.194 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
6 | 124.155.223.237 124.155.223.237 | 4657 (STARHUB-I...) (STARHUB-INTERNET StarHub Ltd) | |
1 | 162.159.152.4 162.159.152.4 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 172.67.131.245 172.67.131.245 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 69.16.175.10 69.16.175.10 | 20446 (HIGHWINDS3) (HIGHWINDS3) | |
1 | 104.16.19.94 104.16.19.94 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 216.58.212.170 216.58.212.170 | 15169 (GOOGLE) (GOOGLE) | |
1 | 143.204.98.62 143.204.98.62 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 172.67.177.154 172.67.177.154 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
21 | 10 |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
whatsapp-grupjoin18.duckdns.org |
ASN4657 (STARHUB-INTERNET StarHub Ltd, SG)
assets.jalantikus.com |
ASN15169 (GOOGLE, US)
PTR: ams15s22-in-f170.1e100.net
fonts.googleapis.com |
ASN16509 (AMAZON-02, US)
PTR: server-143-204-98-62.fra50.r.cloudfront.net
api.pubgameshowtime.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
duckdns.org
whatsapp-grupjoin18.duckdns.org |
163 KB |
6 |
jalantikus.com
assets.jalantikus.com |
121 KB |
1 |
inews.co.id
img.inews.co.id |
31 KB |
1 |
pubgameshowtime.com
api.pubgameshowtime.com |
428 B |
1 |
googleapis.com
fonts.googleapis.com |
1 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com |
28 KB |
1 |
jquery.com
code.jquery.com |
30 KB |
1 |
stickpng.com
assets.stickpng.com |
150 KB |
1 |
medium.com
miro.medium.com |
89 KB |
1 |
alphacoders.com
images5.alphacoders.com |
78 KB |
21 | 10 |
Domain | Requested by | |
---|---|---|
7 | whatsapp-grupjoin18.duckdns.org |
whatsapp-grupjoin18.duckdns.org
|
6 | assets.jalantikus.com |
whatsapp-grupjoin18.duckdns.org
|
1 | img.inews.co.id |
whatsapp-grupjoin18.duckdns.org
|
1 | api.pubgameshowtime.com |
cdnjs.cloudflare.com
|
1 | fonts.googleapis.com |
whatsapp-grupjoin18.duckdns.org
|
1 | cdnjs.cloudflare.com |
whatsapp-grupjoin18.duckdns.org
|
1 | code.jquery.com |
whatsapp-grupjoin18.duckdns.org
|
1 | assets.stickpng.com |
whatsapp-grupjoin18.duckdns.org
|
1 | miro.medium.com |
whatsapp-grupjoin18.duckdns.org
|
1 | images5.alphacoders.com |
whatsapp-grupjoin18.duckdns.org
|
21 | 10 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
webdisk.whatsapp-grupjoin18.duckdns.org R3 |
2021-10-06 - 2022-01-04 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2021-07-15 - 2022-07-14 |
a year | crt.sh |
jalantikus.com Go Daddy Secure Certificate Authority - G2 |
2021-01-26 - 2022-02-27 |
a year | crt.sh |
medium.com Cloudflare Inc ECC CA-3 |
2021-09-01 - 2021-11-29 |
3 months | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2021-07-14 - 2022-08-14 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2021-09-13 - 2021-11-20 |
2 months | crt.sh |
api.pubgameshowtime.com Amazon |
2020-04-17 - 2021-05-17 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://whatsapp-grupjoin18.duckdns.org/
Frame ID: 03109483F89AD9F2E05C6B5CB53D4DBE
Requests: 21 HTTP requests in this frame
Screenshot
![](/screenshots/1f458a22-32ad-4ec6-bb9c-e02336e1e85f.png)
Page Title
Whatsapp Group LinkDetected technologies
Detected patterns
- medium\.com
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
- /([\d.]+)/jquery(?:\.min)?\.js
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
21 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
whatsapp-grupjoin18.duckdns.org/ |
7 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
whatsapp-grupjoin18.duckdns.org/css/ |
4 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
facebook.css
whatsapp-grupjoin18.duckdns.org/css/ |
4 KB 860 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
thumb-350-821024.png
images5.alphacoders.com/821/ |
78 KB 78 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
karakter-anime-cantik-2-0e6af.jpg.webp
assets.jalantikus.com/assets/cache/560/315/userfiles/2019/03/06/ |
11 KB 11 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
karakter-anime-cantik-5-b1053.jpg.webp
assets.jalantikus.com/assets/cache/560/302/userfiles/2019/03/06/ |
20 KB 21 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
karakter-anime-cantik-6-9df5b.jpg.webp
assets.jalantikus.com/assets/cache/560/350/userfiles/2019/03/06/ |
24 KB 24 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
karakter-anime-cantik-8-62975.jpg.webp
assets.jalantikus.com/assets/cache/560/300/userfiles/2019/03/06/ |
13 KB 13 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
karakter-anime-cantik-9-5d82f.jpg.webp
assets.jalantikus.com/assets/cache/560/373/userfiles/2019/03/06/ |
33 KB 33 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
karakter-anime-cantik-13-a715e.jpg.webp
assets.jalantikus.com/assets/cache/560/315/userfiles/2019/03/06/ |
17 KB 18 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
0*ptDX0HfJCYpo9Pcs.gif
miro.medium.com/max/1600/ |
88 KB 89 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
facebook_text.png
whatsapp-grupjoin18.duckdns.org/img/ |
28 KB 28 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
580b57fcd9996e24bc43c543.png
assets.stickpng.com/images/ |
149 KB 150 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.5.1.min.js
code.jquery.com/ |
87 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/ |
85 KB 28 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
1 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
getcountry
api.pubgameshowtime.com/ip/ |
61 B 428 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bege.jpeg
whatsapp-grupjoin18.duckdns.org/css/ |
91 KB 92 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
thin.ttf
whatsapp-grupjoin18.duckdns.org/css/ |
39 KB 19 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Korea.jpg
img.inews.co.id/media/600/files/inews_new/2019/08/28/ |
30 KB 31 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
font.ttf
whatsapp-grupjoin18.duckdns.org/css/ |
39 KB 19 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Gaming (Entertainment)7 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect boolean| originAgentCluster function| $ function| jQuery object| desc object| more function| checkip1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.medium.com/ | Name: __cfruid Value: 5e21ccafbec0e2835822c6311d25b3d499d8ddf0-1633568950 |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
api.pubgameshowtime.com
assets.jalantikus.com
assets.stickpng.com
cdnjs.cloudflare.com
code.jquery.com
fonts.googleapis.com
images5.alphacoders.com
img.inews.co.id
miro.medium.com
whatsapp-grupjoin18.duckdns.org
104.16.19.94
104.20.15.194
124.155.223.237
143.204.98.62
162.159.152.4
172.67.131.245
172.67.177.154
216.58.212.170
52.247.224.99
69.16.175.10
092a3cd5f86b3f039feefdeb86694cd16ae545af214cfda614bdbbe2d1bde401
139fc22ed87280a2011dfa727ece25c6af12cd433576980a0a6c29e9bc1e5faf
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
16a4e80a42006599c53b3451bc31ca6eccfe87dceb5453e4a1458b48b095569f
3153a06ba18e39e65902144be0e71ca8c0f14ac948a719c6aa8642414c1db3f3
3685c43bc9d7c07cc6da92f4df87c1a8be82958b77d6845c67da92ce11396850
39cda5e7a819fe468455d1daf68a545fbe8eb07d1d9c3f0dc95c0e5b8f7c2341
3ef50ce5ebf525053581d80d9be4f43b0162fa2d5fe8a967bf8faecd96ab0318
56babcbbc9a77250e02af474d32387f88869217d234465cfcd171d90311bdd40
61852ca7f641ed14b004242974c8648e8e598c901cda0052e0580625c33e992f
74b8457bf6fc94155d74fcf2c8fab6809e5a3bf251c2ab007f334cfc96aa9cb9
7d8c329264275748c586498a45884c20faa1f726a5fc694c6303c72258c3f5a6
a518b174c9a9edc80baafa08907f534a9205376414c17a0f7ac7a6de9a9bbe22
b8161d87f27830eb39deb9e632fe7cb2d954991107da659662ee2b3a71964ef4
c0c3dafdb631b6055cb1e9cf25a807c3663a42c258d5ebeb1f8f38cc767a397a
c2f413ec031122040ebc7dd93353b86cf8b29569f922838d04283425eb0c4fca
d15c880b55b3ed610b5af0bddb63b50e386da5d32658e069dac8d8c512f801e8
d2dc4ac20e31d96a5a8ffe7eee874e184afa59a5e24a568bf26bacd8f8b8357d
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
fbb3f96ca310ae1eb55dc322ce24812c0687ab7fbeb4fce40ca27c149332ebaa
fc38486ae929ac77f93331fa8afcdb1c6c7b7af2b03da4ceaf4b7f9ab5f35eee