mail.join-whatsap-viral0953.duckdns.org
Open in
urlscan Pro
20.41.114.122
Malicious Activity!
Public Scan
Submission Tags: fd s0 duckdns Search All
Submission: On January 28 via api from US — Scanned from DE
Summary
TLS certificate: Issued by R3 on January 28th 2022. Valid for: 3 months.
This is the only time mail.join-whatsap-viral0953.duckdns.org was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Gaming (Entertainment)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
5 | 20.41.114.122 20.41.114.122 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
1 | 159.65.12.209 159.65.12.209 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN) | |
1 | 192.210.175.21 192.210.175.21 | 36352 (AS-COLOCR...) (AS-COLOCROSSING) | |
1 | 95.100.139.203 95.100.139.203 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
1 | 2001:4de0:ac1... 2001:4de0:ac18::1:a:1b | 20446 (HIGHWINDS3) (HIGHWINDS3) | |
2 | 2a00:1450:400... 2a00:1450:4001:82a::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 129.226.2.89 129.226.2.89 | 132203 (TENCENT-N...) (TENCENT-NET-AP-CN Tencent Building) | |
2 | 2a00:1450:400... 2a00:1450:4001:802::2003 | 15169 (GOOGLE) (GOOGLE) | |
14 | 8 |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
mail.join-whatsap-viral0953.duckdns.org |
ASN16625 (AKAMAI-AS, US)
PTR: a95-100-139-203.deploy.static.akamaitechnologies.com
img.utdstc.com |
ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN)
na.apps.amsoveasea.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
duckdns.org
mail.join-whatsap-viral0953.duckdns.org |
81 KB |
2 |
gstatic.com
fonts.gstatic.com |
23 KB |
2 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 47 |
2 KB |
1 |
amsoveasea.com
na.apps.amsoveasea.com — Cisco Umbrella Rank: 92491 |
181 B |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 584 |
30 KB |
1 |
utdstc.com
img.utdstc.com — Cisco Umbrella Rank: 91242 |
14 KB |
1 |
im.ge
i.im.ge — Cisco Umbrella Rank: 604577 |
28 KB |
1 |
alfascorpii.co.id
m.alfascorpii.co.id |
6 KB |
14 | 8 |
Domain | Requested by | |
---|---|---|
5 | mail.join-whatsap-viral0953.duckdns.org |
mail.join-whatsap-viral0953.duckdns.org
|
2 | fonts.gstatic.com |
fonts.googleapis.com
|
2 | fonts.googleapis.com |
mail.join-whatsap-viral0953.duckdns.org
|
1 | na.apps.amsoveasea.com |
code.jquery.com
|
1 | code.jquery.com |
mail.join-whatsap-viral0953.duckdns.org
|
1 | img.utdstc.com |
mail.join-whatsap-viral0953.duckdns.org
|
1 | i.im.ge |
mail.join-whatsap-viral0953.duckdns.org
|
1 | m.alfascorpii.co.id |
mail.join-whatsap-viral0953.duckdns.org
|
14 | 8 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
webmail.join-whatsap-viral0953.duckdns.org R3 |
2022-01-28 - 2022-04-28 |
3 months | crt.sh |
m.alfascorpii.co.id R3 |
2021-11-13 - 2022-02-11 |
3 months | crt.sh |
i.im.ge Sectigo RSA Domain Validation Secure Server CA |
2021-09-25 - 2022-09-25 |
a year | crt.sh |
uptodown.com DigiCert SHA2 Secure Server CA |
2021-09-14 - 2022-09-14 |
a year | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2021-07-14 - 2022-08-14 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2021-12-27 - 2022-03-21 |
3 months | crt.sh |
na.apps.amsoveasea.com TrustAsia TLS RSA CA |
2021-05-31 - 2022-05-30 |
a year | crt.sh |
*.gstatic.com GTS CA 1C3 |
2021-12-27 - 2022-03-21 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://mail.join-whatsap-viral0953.duckdns.org/
Frame ID: 52C192E2E45305C7404530E704C9FC2E
Requests: 14 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
mail.join-whatsap-viral0953.duckdns.org/ |
9 KB 10 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style.css
mail.join-whatsap-viral0953.duckdns.org/css/ |
6 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
fb_login.png
m.alfascorpii.co.id/web_lib/img/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Tw3QNy.png
i.im.ge/2021/09/15/ |
28 KB 28 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
e61511ae88f7d52fac67cd4c4f9c739bf71572d2923e1acf512f249ae0544fd4:200
img.utdstc.com/icon/e61/511/ |
14 KB 14 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.6.0.min.js
code.jquery.com/ |
87 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
1.mp4
mail.join-whatsap-viral0953.duckdns.org/media/ |
78 KB 0 |
Media
video/mp4 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
2 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
2 KB 622 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
na.apps.amsoveasea.com/swoole/ |
39 B 181 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
8QINdiTajsj_87rMuMdKyqDiOOg.woff2
fonts.gstatic.com/s/secularone/v9/ |
11 KB 11 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
4UaZrEtFpBI4f1ZSIK9d4LjJ4lM3OwRmOw.woff2
fonts.gstatic.com/s/exo/v15/ |
11 KB 11 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
1.mp4
mail.join-whatsap-viral0953.duckdns.org/media/ |
65 KB 65 KB |
Media
video/mp4 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
1.mp4
mail.join-whatsap-viral0953.duckdns.org/media/ |
3 MB 0 |
Media
video/mp4 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Gaming (Entertainment)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery function| play0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
code.jquery.com
fonts.googleapis.com
fonts.gstatic.com
i.im.ge
img.utdstc.com
m.alfascorpii.co.id
mail.join-whatsap-viral0953.duckdns.org
na.apps.amsoveasea.com
129.226.2.89
159.65.12.209
192.210.175.21
20.41.114.122
2001:4de0:ac18::1:a:1b
2a00:1450:4001:802::2003
2a00:1450:4001:82a::200a
95.100.139.203
092a3cd5f86b3f039feefdeb86694cd16ae545af214cfda614bdbbe2d1bde401
46989820a9b0643099415ba7b00bd0e2e48ba06142c0b5ab3035818c2b303e0f
8c4967c13572e41e718dfbb3d84dddeacc748aa14cb2d65ad91ecdde60f50664
8c595d8b5b209a8d02eb84f0d9097fbdcab284a91bbbab5353cbdc7e9b1c0a6c
94b3cda05875ea46ccf153116fa3eabc317b5b44e184f3113f3b66927a1783ad
97f06d0b35800d508f677b54fd49cd4ab415e799a5b80a3ab0c4c258d8c17748
9b3950f97da1f577c9804a4a33f20e8fd0de07e4c86b836487fee5857b09266d
a1106e31061475759438fcbee45210bdcf0153b05fa0cd607259b2c04970d4b6
b99d447354bcb44d6f36e655f86a56e29b0ff4bec54dde77a26cdaa5cb39a563
cd51bf0a5665e55258f20d1dc1fae0b2d953d0e057c3ce9285b04df70a547d4b
d1dddb1abd1c8b9cbe6d6037c3fc71aa52900d7fc48ce03e56e2221d45bcae06
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e