urlscan.io logo urlscan.io
SecurityTrails logo

au-one.duckdns.org Open in urlscan Pro
162.241.127.227  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://au-one.duckdns.org/
Submission: On February 13 via api from JP — Scanned from JP
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 3 countries across 3 domains to perform 7 HTTP transactions. The main IP is 162.241.127.227, located in United States and belongs to NETWORK-SOLUTIONS-HOSTING, US. The main domain is au-one.duckdns.org.
This is the only time au-one.duckdns.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: au ID (Telecommunication)

Domain & IP information

IP Address AS Autonomous System
2 162.241.127.227 19871 (NETWORK-S...)
3 111.87.221.81 2516 (KDDI KDDI...)
1 103.42.133.35 11054 (LIVEPERSON)
1 103.42.133.5 11054 (LIVEPERSON)
7 4
Apex Domain
Subdomains		 Transfer
3 auone.jp
connect.auone.jp
46 KB
2 lpsnmedia.net
lpcdn.lpsnmedia.net — Cisco Umbrella Rank: 3808
accdn.lpsnmedia.net — Cisco Umbrella Rank: 3380
17 KB
2 duckdns.org
au-one.duckdns.org
10 KB
7 3
Domain Requested by
3 connect.auone.jp au-one.duckdns.org
2 au-one.duckdns.org au-one.duckdns.org
1 accdn.lpsnmedia.net lpcdn.lpsnmedia.net
1 lpcdn.lpsnmedia.net au-one.duckdns.org
7 4

This site contains links to these domains. Also see Links.

Domain
id.auone.jp
www.kddi.com
Subject Issuer Validity Valid
connect.auone.jp
GlobalSign RSA OV SSL CA 2018		 2022-02-17 -
2023-03-21		 a year crt.sh
*.lpsnmedia.net
Sectigo RSA Organization Validation Secure Server CA		 2023-01-09 -
2024-01-09		 a year crt.sh

This page contains 2 frames:

Primary Page: http://au-one.duckdns.org/
Frame ID: 70EE53C8ADB5120296EFA154731D506D
Requests: 5 HTTP requests in this frame

Frame: https://lpcdn.lpsnmedia.net/le_secure_storage/3.19.0.0-release_5079/storage.secure.min.html?loc=file%3A%2F%2F&site=16820676&env=prod&isCrossDomain=true
Frame ID: 366330252546CCB9D21E21C1EB3B641D
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

au IDログイン

Detected technologies

Overall confidence: 100%
Detected patterns
  • <!-- (?:End )?Google Tag Manager -->

Page Statistics

7
Requests

71 %
HTTPS

0 %
IPv6

3
Domains

4
Subdomains

4
IPs

3
Countries

73 kB
Transfer

133 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
au-one.duckdns.org/ 		9 KB
10 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://au-one.duckdns.org/
Protocol
HTTP/1.1
Server
162.241.127.227 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS
162-241-127-227.webhostbox.net
Software
Apache /
Resource Hash
635962ab42c0027cf1142eeb03e6dca4eb4ebd317d9eb7f2c8cd760517ad8850

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
accept-language
jp-JP,jp;q=0.9

Response headers

Cache-Control
no-store, no-cache, must-revalidate
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
Date
Mon, 13 Feb 2023 08:03:29 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive
timeout=5, max=100
Pragma
no-cache
Server
Apache
Transfer-Encoding
chunked
idk.css
connect.auone.jp/net/vwc/cca_lg_eu_nets/resources/style/common/ 		47 KB
10 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://connect.auone.jp/net/vwc/cca_lg_eu_nets/resources/style/common/idk.css?20221105
Requested by
Host: au-one.duckdns.org
URL: http://au-one.duckdns.org/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
111.87.221.81 Meieki, Japan, ASN2516 (KDDI KDDI CORPORATION, JP),
Reverse DNS
Software
Apache /
Resource Hash
055c041f8be9e665ba6498db2892456488866d98e697f3f50d726788b2dbc635
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
http://au-one.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date
Mon, 13 Feb 2023 08:03:30 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Fri, 20 Jan 2023 08:02:45 GMT
Server
Apache
X-Frame-Options
DENY
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=1, max=50
Content-Length
9582
X-XSS-Protection
1; mode=block
Expires
"-1"
checkboxRadio.css
connect.auone.jp/net/vwc/cca_lg_eu_nets/resources/style/common/ 		4 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://connect.auone.jp/net/vwc/cca_lg_eu_nets/resources/style/common/checkboxRadio.css?20221105
Requested by
Host: au-one.duckdns.org
URL: http://au-one.duckdns.org/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
111.87.221.81 Meieki, Japan, ASN2516 (KDDI KDDI CORPORATION, JP),
Reverse DNS
Software
Apache /
Resource Hash
a63fd3959f8cd89c2706cb778dea2994b82cfc800bf5db9257edcf1fa7222b80
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
http://au-one.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date
Mon, 13 Feb 2023 08:03:30 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Fri, 20 Jan 2023 08:02:45 GMT
Server
Apache
X-Frame-Options
DENY
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=1, max=50
Content-Length
958
X-XSS-Protection
1; mode=block
Expires
"-1"
au_id.jpg
connect.auone.jp/net/vwc/cca_lg_eu_nets/resources/image/common/ 		34 KB
34 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://connect.auone.jp/net/vwc/cca_lg_eu_nets/resources/image/common/au_id.jpg?20220817
Requested by
Host: au-one.duckdns.org
URL: http://au-one.duckdns.org/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
111.87.221.81 Meieki, Japan, ASN2516 (KDDI KDDI CORPORATION, JP),
Reverse DNS
Software
Apache /
Resource Hash
1ec5abc3e4e21e84224089afccec3c1677323ec02fe04f2bbf6083a9b9d3fc2d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
http://au-one.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date
Mon, 13 Feb 2023 08:03:30 GMT
X-Content-Type-Options
nosniff
Last-Modified
Tue, 22 Nov 2022 08:04:01 GMT
Server
Apache
X-Frame-Options
DENY
Content-Type
image/jpeg
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=1, max=49
Content-Length
34778
X-XSS-Protection
1; mode=block
Expires
"-1"
contentsBase.js
au-one.duckdns.org/resources/js/common/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
http://au-one.duckdns.org/resources/js/common/contentsBase.js?20221105
Requested by
Host: au-one.duckdns.org
URL: http://au-one.duckdns.org/
Protocol
HTTP/1.1
Server
162.241.127.227 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS
162-241-127-227.webhostbox.net
Software
Apache /
Resource Hash

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
http://au-one.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date
Mon, 13 Feb 2023 08:03:29 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=99
Content-Length
315
Content-Type
text/html; charset=iso-8859-1
storage.secure.min.html
lpcdn.lpsnmedia.net/le_secure_storage/3.19.0.0-release_5079/ Frame 3663 		39 KB
16 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://lpcdn.lpsnmedia.net/le_secure_storage/3.19.0.0-release_5079/storage.secure.min.html?loc=file%3A%2F%2F&site=16820676&env=prod&isCrossDomain=true
Requested by
Host: au-one.duckdns.org
URL: http://au-one.duckdns.org/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.42.133.35 , Australia, ASN11054 (LIVEPERSON, US),
Reverse DNS
Software
ws /
Resource Hash
639fcd75ad19240531093db9d079f4be79913034b5ce3a7ae0b4006735f1fb2f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Referer
http://au-one.duckdns.org/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
accept-language
jp-JP,jp;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-state-rev
access-control-allow-methods
GET, POST, PATCH
access-control-expose-headers
X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options, x-lp-state-rev
cache-control
max-age=31536000
content-encoding
gzip
content-type
text/html
date
Mon, 13 Feb 2023 08:03:31 GMT
expires
Tue, 13 Feb 2024 08:03:31 GMT
last-modified
Thu, 03 Nov 2022 22:00:39 GMT
server
ws
strict-transport-security
max-age=31536000; includeSubDomains
vary
Origin
x-cache-status
HIT
x-content-type-options
nosniff
refererrestrictions
accdn.lpsnmedia.net/api/account/16820676/configuration/domainprotection/ Frame 3663 		256 B
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://accdn.lpsnmedia.net/api/account/16820676/configuration/domainprotection/refererrestrictions?cb=lpCb41818x37279
Requested by
Host: lpcdn.lpsnmedia.net
URL: https://lpcdn.lpsnmedia.net/le_secure_storage/3.19.0.0-release_5079/storage.secure.min.html?loc=file%3A%2F%2F&site=16820676&env=prod&isCrossDomain=true
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.42.133.5 , Australia, ASN11054 (LIVEPERSON, US),
Reverse DNS
Software
ws /
Resource Hash
0066b4fb9a87754f75ae2768e89b8ce708d5007460375a933b0559db2a911dcf
Security Headers
Name Value
Strict-Transport-Security max-age=99999999999; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://lpcdn.lpsnmedia.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date
Mon, 13 Feb 2023 08:03:32 GMT
strict-transport-security
max-age=99999999999; includeSubDomains
x-content-type-options
nosniff
content-encoding
gzip
server
ws
x-cache-status
EXPIRED
vary
Accept
access-control-allow-methods
GET, POST, PATCH
content-type
application/javascript
access-control-expose-headers
X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
x-envoy-upstream-service-time
1
access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token
expires
Mon, 13 Feb 2023 08:04:32 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: au ID (Telecommunication)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 boolean| credentialless object| oncontentvisibilityautostatechange

1 Cookies

Domain/Path Name / Value
au-one.duckdns.org/ Name: PHPSESSID
Value: 615e0a9428a04a0997a085ed674b0a92

1 Console Messages

Source Level URL
Text
network error URL: http://au-one.duckdns.org/resources/js/common/contentsBase.js?20221105
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)