urlscan.io logo urlscan.io
SecurityTrails logo

teryh.duckdns.org Open in urlscan Pro
210.16.102.206  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://teryh.duckdns.org/home/
Submission: On April 18 via api from CA
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 2 countries across 3 domains to perform 12 HTTP transactions. The main IP is 210.16.102.206, located in India and belongs to AS40676 - Psychz Networks, US. The main domain is teryh.duckdns.org.
This is the only time teryh.duckdns.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Office 365 (Online) Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
6 210.16.102.206 40676 (AS40676)
3 23.111.9.35 33438 (HIGHWINDS2)
2 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
12 4
Domain Requested by
6 teryh.duckdns.org teryh.duckdns.org
3 cdnjs.cloudflare.com teryh.duckdns.org
use.fontawesome.com
3 use.fontawesome.com teryh.duckdns.org
use.fontawesome.com
12 3

This site contains no links.

Subject Issuer Validity Valid
*.fontawesome.com
DigiCert SHA2 Secure Server CA		 2018-09-17 -
2019-11-21		 a year crt.sh
ssl412106.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2		 2019-03-02 -
2019-09-08		 6 months crt.sh

This page contains 1 frames:

Primary Page: http://teryh.duckdns.org/home/
Frame ID: EAC5581E36EAB69DF82A973C0D484828
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+font-awesome(?:\.min)?\.css/i
  • html /<script[^>]* src=[^>]+fontawesome(?:\.js)?/i
Overall confidence: 100%
Detected patterns
  • script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
  • script /jquery.*\.js/i
  • env /^jQuery$/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]+?href="[^"]+bootstrap(?:\.min)?\.css/i

Page Statistics

12
Requests

50 %
HTTPS

50 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

315 kB
Transfer

412 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 2
  • http://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.3.0/css/font-awesome.min.css HTTP 307
  • https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.3.0/css/font-awesome.min.css

12 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
teryh.duckdns.org/home/ 		5 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://teryh.duckdns.org/home/
Protocol
HTTP/1.1
Server
210.16.102.206 , India, ASN40676 (AS40676 - Psychz Networks, US),
Reverse DNS
Software
Apache /
Resource Hash
b545d2503e058bc60f32a18a0e6f2ed97fb7506dfe0c4303ccdf404016332c19

Request headers

Host
teryh.duckdns.org
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 18 Apr 2019 03:55:36 GMT
Server
Apache
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html
3fa6ba2462.js
use.fontawesome.com/ 		9 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://use.fontawesome.com/3fa6ba2462.js
Requested by
Host: teryh.duckdns.org
URL: http://teryh.duckdns.org/home/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.111.9.35 Phoenix, United States, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US),
Reverse DNS
Software
NetDNA-cache/2.2 /
Resource Hash
4ba4997b46862ba86edbd4e739cbe478bf9a1a1f2f4340c89df7edd8e0b04bb3

Request headers

Referer
http://teryh.duckdns.org/home/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 18 Apr 2019 03:55:37 GMT
content-encoding
gzip
last-modified
Wed, 30 Aug 2017 11:22:47 GMT
server
NetDNA-cache/2.2
x-amz-request-id
352D67292382172F
etag
W/"bdfa9d3207034749e3bfc269c11d9a97"
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=0, private, must-revalidate
x-amz-id-2
0HXoyvShx5Ui6mJ2khpzFxNhQV026qe5/nuYJbggW272x5e3HK0lG6KNEdBCa8HZnHYDnRJ91L0=
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/2.0.3/ 		82 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/jquery/2.0.3/jquery.min.js
Requested by
Host: teryh.duckdns.org
URL: http://teryh.duckdns.org/home/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:c597 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
a57b5242b9a9adc4c1ef846c365147b89c472b9cd770face331efcb965346b25
Security Headers
Name Value
Strict-Transport-Security max-age=15780000; includeSubDomains

Request headers

Referer
http://teryh.duckdns.org/home/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 18 Apr 2019 03:55:37 GMT
content-encoding
br
cf-cache-status
HIT
status
200
strict-transport-security
max-age=15780000; includeSubDomains
timing-allow-origin
*
last-modified
Thu, 17 May 2018 09:20:15 GMT
server
cloudflare
etag
W/"5afd494f-14696"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
expires
Tue, 07 Apr 2020 03:55:37 GMT
cache-control
public, max-age=30672000
cf-ray
4c93b448189597b6-FRA
served-in-seconds
0.006
font-awesome.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.3.0/css/
Redirect Chain
  • http://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.3.0/css/font-awesome.min.css
  • https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.3.0/css/font-awesome.min.css
23 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.3.0/css/font-awesome.min.css
Requested by
Host: teryh.duckdns.org
URL: http://teryh.duckdns.org/home/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:c597 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
541ac58217a8ade1a5e292a65a0661dc9db7a49ae13654943817a4fbc6761afd
Security Headers
Name Value
Strict-Transport-Security max-age=15780000; includeSubDomains

Request headers

Referer
http://teryh.duckdns.org/home/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 18 Apr 2019 03:55:37 GMT
content-encoding
br
cf-cache-status
HIT
status
200
strict-transport-security
max-age=15780000; includeSubDomains
timing-allow-origin
*
last-modified
Thu, 17 May 2018 09:19:12 GMT
server
cloudflare
etag
W/"5afd4910-5cbb"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
expires
Tue, 07 Apr 2020 03:55:37 GMT
cache-control
public, max-age=30672000
cf-ray
4c93b448189797b6-FRA
served-in-seconds
0.027

Redirect headers

Location
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.3.0/css/font-awesome.min.css
Non-Authoritative-Reason
HSTS
bootstrap.min.css
teryh.duckdns.org/home/css/ 		0
0 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://teryh.duckdns.org/home/css/bootstrap.min.css
Requested by
Host: teryh.duckdns.org
URL: http://teryh.duckdns.org/home/
Protocol
HTTP/1.1
Server
210.16.102.206 , India, ASN40676 (AS40676 - Psychz Networks, US),
Reverse DNS
Software
Apache /
Resource Hash

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
teryh.duckdns.org
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
http://teryh.duckdns.org/home/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://teryh.duckdns.org/home/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 18 Apr 2019 03:55:40 GMT
Server
Apache
Connection
close
Content-Length
671
Content-Type
text/html; charset=iso-8859-1
back.png
teryh.duckdns.org/home/img/ 		199 KB
199 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://teryh.duckdns.org/home/img/back.png
Requested by
Host: teryh.duckdns.org
URL: http://teryh.duckdns.org/home/
Protocol
HTTP/1.1
Server
210.16.102.206 , India, ASN40676 (AS40676 - Psychz Networks, US),
Reverse DNS
Software
Apache /
Resource Hash
7e50e406688bd898803f653058d14ca384734cb9b39ba900bc5e2734b59c073b

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
teryh.duckdns.org
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://teryh.duckdns.org/home/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://teryh.duckdns.org/home/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 18 Apr 2019 03:55:40 GMT
Last-Modified
Mon, 18 Sep 2017 19:10:22 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
203294
new.PNG
teryh.duckdns.org/home/img// 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://teryh.duckdns.org/home/img//new.PNG
Requested by
Host: teryh.duckdns.org
URL: http://teryh.duckdns.org/home/
Protocol
HTTP/1.1
Server
210.16.102.206 , India, ASN40676 (AS40676 - Psychz Networks, US),
Reverse DNS
Software
Apache /
Resource Hash
d0829edfe8f951b39720f08aacead0e963d22dc6002f9c2be375de26ada64c72

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
teryh.duckdns.org
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://teryh.duckdns.org/home/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://teryh.duckdns.org/home/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 18 Apr 2019 03:55:40 GMT
Last-Modified
Mon, 18 Sep 2017 23:23:16 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
3160
logo.PNG
teryh.duckdns.org/home/img// 		4 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://teryh.duckdns.org/home/img//logo.PNG
Requested by
Host: teryh.duckdns.org
URL: http://teryh.duckdns.org/home/
Protocol
HTTP/1.1
Server
210.16.102.206 , India, ASN40676 (AS40676 - Psychz Networks, US),
Reverse DNS
Software
Apache /
Resource Hash
fc5c3d7d2b298a42ec44dad2d8cd227b734db966b4afa68c0254a497e805f603

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
teryh.duckdns.org
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://teryh.duckdns.org/home/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://teryh.duckdns.org/home/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 18 Apr 2019 03:55:40 GMT
Last-Modified
Mon, 18 Sep 2017 19:55:36 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
4585
mo.png
teryh.duckdns.org/home/img/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://teryh.duckdns.org/home/img/mo.png
Requested by
Host: teryh.duckdns.org
URL: http://teryh.duckdns.org/home/
Protocol
HTTP/1.1
Server
210.16.102.206 , India, ASN40676 (AS40676 - Psychz Networks, US),
Reverse DNS
Software
Apache /
Resource Hash
f664b8138c2da6ec7565500a7cc839da6372614a31dc04c5a2169a26b8d9767c

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
teryh.duckdns.org
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://teryh.duckdns.org/home/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://teryh.duckdns.org/home/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 18 Apr 2019 03:55:40 GMT
Last-Modified
Mon, 18 Sep 2017 19:51:34 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
1057
3fa6ba2462.css
use.fontawesome.com/ 		1 KB
686 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://use.fontawesome.com/3fa6ba2462.css
Requested by
Host: use.fontawesome.com
URL: https://use.fontawesome.com/3fa6ba2462.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.111.9.35 Phoenix, United States, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US),
Reverse DNS
Software
NetDNA-cache/2.2 /
Resource Hash
c67215cb72fca6e1912e29e0f2384c9899857d3c452f095588c1bdf937baf789

Request headers

Referer
http://teryh.duckdns.org/home/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 18 Apr 2019 03:55:37 GMT
content-encoding
gzip
last-modified
Wed, 30 Aug 2017 11:22:47 GMT
server
NetDNA-cache/2.2
x-amz-request-id
2CB55AD66B56C419
etag
W/"366389759ac4b0c0361542c35e6f2cad"
x-cache
HIT
content-type
text/css
status
200
cache-control
max-age=0, private, must-revalidate
x-amz-id-2
j8GYzZM0jzGgWVXS4kQlpXKpqC/6TDu5g0hmSpVgcTDKB89EPaXtJ71/Vt3XPAMhwtBZAqqxBbc=
font-awesome-css.min.css
use.fontawesome.com/releases/v4.7.0/css/ 		30 KB
8 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://use.fontawesome.com/releases/v4.7.0/css/font-awesome-css.min.css
Requested by
Host: teryh.duckdns.org
URL: http://teryh.duckdns.org/home/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.111.9.35 Phoenix, United States, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US),
Reverse DNS
Software
NetDNA-cache/2.2 /
Resource Hash
5b9573e1023da775390e9284ec0eb1c606df9b468a28980055b4a6aa804f4350

Request headers

Referer
http://teryh.duckdns.org/home/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 18 Apr 2019 03:55:37 GMT
content-encoding
gzip
last-modified
Tue, 25 Oct 2016 17:21:58 GMT
server
NetDNA-cache/2.2
access-control-allow-origin
*
etag
W/"36082410df2ef7f83932219089dc1443"
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods
GET
content-type
text/css
status
200
access-control-max-age
3000
cache-control
max-age=31556926
x-cache
HIT
fontawesome-webfont.woff2
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.3.0/fonts/ 		55 KB
56 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.3.0/fonts/fontawesome-webfont.woff2?v=4.3.0
Requested by
Host: use.fontawesome.com
URL: https://use.fontawesome.com/3fa6ba2462.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:c397 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
aadc3580d2b64ff5a7e6f1425587db4e8b033efcbf8f5c332ca52a5ed580c87c
Security Headers
Name Value
Strict-Transport-Security max-age=15780000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.3.0/css/font-awesome.min.css
Origin
http://teryh.duckdns.org

Response headers

date
Thu, 18 Apr 2019 03:55:37 GMT
cf-cache-status
HIT
cf-ray
4c93b44888dfc2dd-FRA
status
200
strict-transport-security
max-age=15780000; includeSubDomains
content-length
56780
last-modified
Thu, 17 May 2018 09:19:53 GMT
server
cloudflare
etag
"5afd4939-ddcc"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/octet-stream
access-control-allow-origin
*
expires
Tue, 07 Apr 2020 03:55:37 GMT
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
served-in-seconds
0.036

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Office 365 (Online) Microsoft (Consumer)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask object| FontAwesomeCdnConfig string| cssUrl function| $ function| jQuery

0 Cookies