bayxwndpmb.duckdns.org Open in urlscan Pro
184.175.240.7 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://bayxwndpmb.duckdns.org/
Submission Tags: phishing malicious Search All
Submission: On June 22 via api (June 22nd 2022, 7:13:34 pm UTC) from JP — Scanned from JP

Summary HTTP 20 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 6 IPs in 4 countries across 5 domains to perform 20 HTTP transactions. The main IP is 184.175.240.7, located in Jacksonville, United States and belongs to NODESDIRECT, US. The main domain is bayxwndpmb.duckdns.org.
TLS certificate: Issued by R3 on June 17th 2022. Valid for: 3 months.

This is the only time bayxwndpmb.duckdns.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: au ID (Telecommunication)

Domain & IP information

	IP Address	AS Autonomous System
11	184.175.240.7 184.175.240.7	19531 (NODESDIRECT) (NODESDIRECT)
1	14.17.102.110 14.17.102.110	4134 (CHINANET-...) (CHINANET-BACKBONE No.31)
5	23.10.10.203 23.10.10.203	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2404:6800:400... 2404:6800:4004:821::200a	15169 (GOOGLE) (GOOGLE)
1	2404:6800:400... 2404:6800:4004:826::2003	15169 (GOOGLE) (GOOGLE)
20	6

11 184.175.240.7 (Jacksonville, United States)

ASN19531 (NODESDIRECT, US)
PTR: reavandents.com

bayxwndpmb.duckdns.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 14.17.102.110 (China)

ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN)

js.users.51.la	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 23.10.10.203 (Tokyo, Japan)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-10-10-203.deploy.static.akamaitechnologies.com

www.ymobile.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2404:6800:4004:821::200a (Australia)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2404:6800:4004:826::2003 (Australia)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	duckdns.org bayxwndpmb.duckdns.org	85 KB
5	ymobile.jp www.ymobile.jp — Cisco Umbrella Rank: 838063	10 KB
1	gstatic.com fonts.gstatic.com	26 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 71	949 B
1	51.la js.users.51.la — Cisco Umbrella Rank: 60541 ia.51.la Failed	3 KB
20	5

	Domain	Requested by
11	bayxwndpmb.duckdns.org	bayxwndpmb.duckdns.org
5	www.ymobile.jp	bayxwndpmb.duckdns.org
1	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	bayxwndpmb.duckdns.org
1	js.users.51.la	bayxwndpmb.duckdns.org
0	ia.51.la Failed	bayxwndpmb.duckdns.org
20	6

This site contains links to these domains. Also see Links.

Domain
m.yahoo.co.jp

Subject Issuer	Validity	Valid
feeifeyohj.duckdns.org R3	`2022-06-17` - `2022-09-15`	3 months	crt.sh
*.users.51.la GlobalSign GCC R3 DV TLS CA 2020	`2022-03-29` - `2023-04-30`	a year	crt.sh
www.ymobile.jp Cybertrust Japan SureServer CA G4	`2022-03-01` - `2023-03-31`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2022-06-06` - `2022-08-29`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2022-06-06` - `2022-08-29`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://bayxwndpmb.duckdns.org/
Frame ID: BBF7C60AF2F7905F5516379EFD83C93B
Requests: 20 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

20
Requests

95 %
HTTPS

40 %
IPv6

5
Domains

6
Subdomains

6
IPs

4
Countries

124 kB
Transfer

211 kB
Size

4
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://m.yahoo.co.jp/
Title: Yahoo! JAPAN

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

20 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
bayxwndpmb.duckdns.org/ 6 KB
3 KB 819ms
309ms Document
text/html 184.175.240.7
NODESDIRECT

General

Check archive.org

Show headers Download Go to

Full URL

https://bayxwndpmb.duckdns.org/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.175.240.7 Jacksonville, United States, ASN19531 (NODESDIRECT, US),

Reverse DNS

reavandents.com

Software

nginx /

Resource Hash

8e0aa37ba8afed6627c753ecaea60d83c0014f577205890936aa75debcdecbaf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: jp-JP,jp;q=0.9

Response headers

content-encoding: gzip
content-type: text/html; charset=utf-8
date: Wed, 22 Jun 2022 19:08:50 GMT
server: nginx
strict-transport-security: max-age=31536000
vary: Accept-Encoding

GET
H2 200 yahoo_main.css
bayxwndpmb.duckdns.org/static/line_vk/css/ 3 KB
1 KB 175ms
173ms Stylesheet
text/css 184.175.240.7
NODESDIRECT

General

Check archive.org

Show headers Download Go to

Full URL

https://bayxwndpmb.duckdns.org/static/line_vk/css/yahoo_main.css

Requested by

Host: bayxwndpmb.duckdns.org
URL: https://bayxwndpmb.duckdns.org/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.175.240.7 Jacksonville, United States, ASN19531 (NODESDIRECT, US),

Reverse DNS

reavandents.com

Software

nginx /

Resource Hash

4659ab7959700776aaba31c068f2628773c0fa05b799e16e909b1eb3a2b43bfa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://bayxwndpmb.duckdns.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Wed, 22 Jun 2022 19:08:50 GMT
content-encoding: gzip
last-modified: Tue, 21 Jun 2022 06:50:58 GMT
server: nginx
vary: Accept-Encoding
content-type: text/css; charset=utf-8
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
expires: Fri, 22 Jul 2022 19:08:50 GMT

GET
H2 200 local.css
bayxwndpmb.duckdns.org/static/line_vk/ 33 KB
6 KB 172ms
171ms Stylesheet
text/css 184.175.240.7
NODESDIRECT

General

Check archive.org

Show headers Download Go to

Full URL

https://bayxwndpmb.duckdns.org/static/line_vk/local.css

Requested by

Host: bayxwndpmb.duckdns.org
URL: https://bayxwndpmb.duckdns.org/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.175.240.7 Jacksonville, United States, ASN19531 (NODESDIRECT, US),

Reverse DNS

reavandents.com

Software

nginx /

Resource Hash

590e7800b23e22bb3f392a9f6fd63ec4de146db3df439cb14126d510cab8fc09

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://bayxwndpmb.duckdns.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Wed, 22 Jun 2022 19:08:50 GMT
content-encoding: gzip
last-modified: Tue, 14 Jun 2022 10:30:32 GMT
server: nginx
vary: Accept-Encoding
content-type: text/css; charset=utf-8
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
expires: Fri, 22 Jul 2022 19:08:50 GMT

GET
H2 200 base.css
bayxwndpmb.duckdns.org/static/line_vk/ 2 KB
1 KB 176ms
175ms Stylesheet
text/css 184.175.240.7
NODESDIRECT

General

Check archive.org

Show headers Download Go to

Full URL

https://bayxwndpmb.duckdns.org/static/line_vk/base.css

Requested by

Host: bayxwndpmb.duckdns.org
URL: https://bayxwndpmb.duckdns.org/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.175.240.7 Jacksonville, United States, ASN19531 (NODESDIRECT, US),

Reverse DNS

reavandents.com

Software

nginx /

Resource Hash

bb5f4cf1048b80b3608c5caaa0f9e2a783b7e122d5252d0646cc0107ad6641aa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://bayxwndpmb.duckdns.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Wed, 22 Jun 2022 19:08:50 GMT
content-encoding: gzip
last-modified: Tue, 14 Jun 2022 10:30:32 GMT
server: nginx
vary: Accept-Encoding
content-type: text/css; charset=utf-8
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
expires: Fri, 22 Jul 2022 19:08:50 GMT

GET
H2 200 model.css
bayxwndpmb.duckdns.org/static/line_vk/ 2 KB
1 KB 507ms
506ms Stylesheet
text/css 184.175.240.7
NODESDIRECT

General

Check archive.org

Show headers Download Go to

Full URL

https://bayxwndpmb.duckdns.org/static/line_vk/model.css

Requested by

Host: bayxwndpmb.duckdns.org
URL: https://bayxwndpmb.duckdns.org/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.175.240.7 Jacksonville, United States, ASN19531 (NODESDIRECT, US),

Reverse DNS

reavandents.com

Software

nginx /

Resource Hash

1fe9eed88179f20a36dc0a1899e25028762077b8a5da1a5b16e2d9e09864b4cb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://bayxwndpmb.duckdns.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Wed, 22 Jun 2022 19:08:50 GMT
content-encoding: gzip
last-modified: Sat, 18 Jun 2022 12:54:30 GMT
server: nginx
vary: Accept-Encoding
content-type: text/css; charset=utf-8
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
expires: Fri, 22 Jul 2022 19:08:50 GMT

GET
H2 200 common.css
bayxwndpmb.duckdns.org/static/hyahoo/model/ 899 B
1 KB 508ms
507ms Stylesheet
text/css 184.175.240.7
NODESDIRECT

General

Check archive.org

Show headers Download Go to

Full URL

https://bayxwndpmb.duckdns.org/static/hyahoo/model/common.css

Requested by

Host: bayxwndpmb.duckdns.org
URL: https://bayxwndpmb.duckdns.org/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.175.240.7 Jacksonville, United States, ASN19531 (NODESDIRECT, US),

Reverse DNS

reavandents.com

Software

nginx /

Resource Hash

70fe796ea3872a4f96dc3603b7b4e26fef3415acd88d5667ceca0e00bb444d64

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://bayxwndpmb.duckdns.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Wed, 22 Jun 2022 19:08:50 GMT
last-modified: Tue, 21 Jun 2022 09:32:16 GMT
server: nginx
strict-transport-security: max-age=31536000
content-type: text/css; charset=utf-8
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 899
expires: Fri, 22 Jul 2022 19:08:50 GMT

GET
H2 200 jquery-3.3.1.min.js Show response
bayxwndpmb.duckdns.org/static/js/ 85 KB
34 KB 343ms
342ms Script
application/javascript 184.175.240.7
NODESDIRECT

General

Check archive.org

Show headers Download Go to

Full URL

https://bayxwndpmb.duckdns.org/static/js/jquery-3.3.1.min.js

Requested by

Host: bayxwndpmb.duckdns.org
URL: https://bayxwndpmb.duckdns.org/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.175.240.7 Jacksonville, United States, ASN19531 (NODESDIRECT, US),

Reverse DNS

reavandents.com

Software

nginx /

Resource Hash

160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://bayxwndpmb.duckdns.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Wed, 22 Jun 2022 19:08:50 GMT
content-encoding: gzip
last-modified: Thu, 17 Mar 2022 06:46:10 GMT
server: nginx
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
expires: Fri, 22 Jul 2022 19:08:50 GMT

GET
H/1.1 200
OK 21267695.js Show response
js.users.51.la/ 5 KB
3 KB 261ms
74ms Script
application/javascript 14.17.102.110
CHINANET-BACKBONE...

General

Check archive.org

Show headers Download Go to

Full URL: https://js.users.51.la/21267695.js
Requested by: Host: bayxwndpmb.duckdns.org
URL: https://bayxwndpmb.duckdns.org/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 14.17.102.110 , China, ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN),
Reverse DNS
Software: openresty /
Resource Hash: 9e5f2a81a690f19889f45dd3e384da0e56def0ec0199721836159736f6283c67

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://bayxwndpmb.duckdns.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Wed, 22 Jun 2022 19:13:29 GMT
Content-Encoding: gzip
Server: openresty
Transfer-Encoding: chunked
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=360000
Access-Control-Allow-Credentials: true
Connection: keep-alive

GET
H2 200 jg_icon.png
bayxwndpmb.duckdns.org/static/line_vk/images/ 2 KB
3 KB 168ms
168ms Image
image/png 184.175.240.7
NODESDIRECT

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bayxwndpmb.duckdns.org/static/line_vk/images/jg_icon.png

Requested by

Host: bayxwndpmb.duckdns.org
URL: https://bayxwndpmb.duckdns.org/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.175.240.7 Jacksonville, United States, ASN19531 (NODESDIRECT, US),

Reverse DNS

reavandents.com

Software

nginx /

Resource Hash

6dc19a1d50098fe9e3b159a69a7b53e7b0d5ca937c18441736c5a4bbdc159332

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://bayxwndpmb.duckdns.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Wed, 22 Jun 2022 19:08:51 GMT
last-modified: Sun, 19 Jun 2022 03:16:40 GMT
server: nginx
strict-transport-security: max-age=31536000
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 2547
expires: Fri, 22 Jul 2022 19:08:51 GMT

GET
H2 200 vcard.jpeg
bayxwndpmb.duckdns.org/static/au_order/ 32 KB
32 KB 170ms
169ms Image
image/jpeg 184.175.240.7
NODESDIRECT

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bayxwndpmb.duckdns.org/static/au_order/vcard.jpeg

Requested by

Host: bayxwndpmb.duckdns.org
URL: https://bayxwndpmb.duckdns.org/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.175.240.7 Jacksonville, United States, ASN19531 (NODESDIRECT, US),

Reverse DNS

reavandents.com

Software

nginx /

Resource Hash

30ac02f2f32bd6449033baedc40fe40ed9019dcebc63b514fdb6e32dfeba0758

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://bayxwndpmb.duckdns.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Wed, 22 Jun 2022 19:08:51 GMT
last-modified: Thu, 17 Mar 2022 06:44:22 GMT
server: nginx
strict-transport-security: max-age=31536000
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 32796
expires: Fri, 22 Jul 2022 19:08:51 GMT

GET
H2 200 fig_cc-01.png
www.ymobile.jp/help/myym/resource/data/add/obi/09/img/shared/ 2 KB
2 KB 35ms
15ms Image
image/png 23.10.10.203
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.ymobile.jp/help/myym/resource/data/add/obi/09/img/shared/fig_cc-01.png
Requested by: Host: bayxwndpmb.duckdns.org
URL: https://bayxwndpmb.duckdns.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.10.10.203 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-10-10-203.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: ca12241ddbe5e9e4c018782bfe45123e61348371e32f60d3a5abd2019e1197c9

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://bayxwndpmb.duckdns.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Wed, 22 Jun 2022 19:13:29 GMT
last-modified: Thu, 23 Jan 2020 08:02:14 GMT
server: Apache
accept-ranges: bytes
etag: "6cd-59cca0f164d80"
content-length: 1741
content-type: image/png

GET
H2 200 icon_seven.png
www.ymobile.jp/help/myym/resource/data/add/obi/03/img/shared/ 2 KB
2 KB 75ms
56ms Image
image/png 23.10.10.203
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.ymobile.jp/help/myym/resource/data/add/obi/03/img/shared/icon_seven.png
Requested by: Host: bayxwndpmb.duckdns.org
URL: https://bayxwndpmb.duckdns.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.10.10.203 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-10-10-203.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: f4c13cfc9310805af5435b0d5f04960dcae82109c7aa89389bd04d8fe5d26896

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://bayxwndpmb.duckdns.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Wed, 22 Jun 2022 19:13:29 GMT
last-modified: Wed, 24 Apr 2019 08:33:18 GMT
server: Apache
accept-ranges: bytes
etag: "844-587428dabef80"
content-length: 2116
content-type: image/png

GET
H2 200 icon_lawson.png
www.ymobile.jp/help/myym/resource/data/add/obi/03/img/shared/ 1 KB
1 KB 172ms
153ms Image
image/png 23.10.10.203
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.ymobile.jp/help/myym/resource/data/add/obi/03/img/shared/icon_lawson.png
Requested by: Host: bayxwndpmb.duckdns.org
URL: https://bayxwndpmb.duckdns.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.10.10.203 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-10-10-203.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: c1a87c4599f42a2cc86ec8e78d0f6ef3b02a1ecd41a6bff8f1d9050c9490a936

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://bayxwndpmb.duckdns.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Wed, 22 Jun 2022 19:13:29 GMT
last-modified: Wed, 24 Apr 2019 08:33:51 GMT
server: Apache
accept-ranges: bytes
etag: "563-587428fa379c0"
content-length: 1379
content-type: image/png

GET
H2 200 icon_ministop.png
www.ymobile.jp/help/myym/resource/data/add/obi/03/img/shared/ 1 KB
1 KB 222ms
203ms Image
image/png 23.10.10.203
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.ymobile.jp/help/myym/resource/data/add/obi/03/img/shared/icon_ministop.png
Requested by: Host: bayxwndpmb.duckdns.org
URL: https://bayxwndpmb.duckdns.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.10.10.203 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-10-10-203.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: c46abe457820829f581a15b2b25baa925fc78d6aa7c1989503b47859d0569b6e

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://bayxwndpmb.duckdns.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Wed, 22 Jun 2022 19:13:29 GMT
last-modified: Wed, 24 Apr 2019 08:33:30 GMT
server: Apache
accept-ranges: bytes
etag: "4eb-587428e630a80"
content-length: 1259
content-type: image/png

GET
H2 200 icon_seicomart.png
www.ymobile.jp/help/myym/resource/data/add/obi/03/img/shared/ 3 KB
4 KB 106ms
88ms Image
image/png 23.10.10.203
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.ymobile.jp/help/myym/resource/data/add/obi/03/img/shared/icon_seicomart.png
Requested by: Host: bayxwndpmb.duckdns.org
URL: https://bayxwndpmb.duckdns.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.10.10.203 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-10-10-203.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b0baf30a5d52de6372685e6c3935205b7f38433ba114332de655de078c64d8d0

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://bayxwndpmb.duckdns.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Wed, 22 Jun 2022 19:13:29 GMT
last-modified: Wed, 24 Apr 2019 08:33:09 GMT
server: Apache
accept-ranges: bytes
etag: "dc5-587428d229b40"
content-length: 3525
content-type: image/png

GET
H2 200 css
fonts.googleapis.com/ 2 KB
949 B 92ms
41ms Stylesheet
text/css 2404:6800:4004:821::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Quicksand:400,700

Requested by

Host: bayxwndpmb.duckdns.org
URL: https://bayxwndpmb.duckdns.org/static/line_vk/model.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4004:821::200a , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

748a742e3dc9d4c993e789fb7dd2a15fc7f7dc20d26c2f9ad3e06acaab8f5b0a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://bayxwndpmb.duckdns.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 22 Jun 2022 18:09:04 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Wed, 22 Jun 2022 19:13:29 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 22 Jun 2022 19:13:29 GMT

GET go1
ia.51.la/ 0
0

GET
H2 200 logo.png
bayxwndpmb.duckdns.org/static/line_vk/images/ 2 KB
2 KB 293ms
292ms Image
image/png 184.175.240.7
NODESDIRECT

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bayxwndpmb.duckdns.org/static/line_vk/images/logo.png

Requested by

Host: bayxwndpmb.duckdns.org
URL: https://bayxwndpmb.duckdns.org/static/line_vk/css/yahoo_main.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.175.240.7 Jacksonville, United States, ASN19531 (NODESDIRECT, US),

Reverse DNS

reavandents.com

Software

nginx /

Resource Hash

925f861c228dce5aec5354551a9a70790b7f111e0c1988f5ec1ebdd1241645ff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://bayxwndpmb.duckdns.org/static/line_vk/css/yahoo_main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Wed, 22 Jun 2022 19:08:51 GMT
last-modified: Tue, 21 Jun 2022 06:38:10 GMT
server: nginx
strict-transport-security: max-age=31536000
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 2035
expires: Fri, 22 Jul 2022 19:08:51 GMT

GET
H2 200 y_icon.png
bayxwndpmb.duckdns.org/static/line_vk/images/ 482 B
680 B 294ms
294ms Image
image/png 184.175.240.7
NODESDIRECT

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bayxwndpmb.duckdns.org/static/line_vk/images/y_icon.png

Requested by

Host: bayxwndpmb.duckdns.org
URL: https://bayxwndpmb.duckdns.org/static/line_vk/css/yahoo_main.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.175.240.7 Jacksonville, United States, ASN19531 (NODESDIRECT, US),

Reverse DNS

reavandents.com

Software

nginx /

Resource Hash

6bf57bdb695769de996d53cdf297d06951bfdb02e389fb15b80dab063b1cf967

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://bayxwndpmb.duckdns.org/static/line_vk/css/yahoo_main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Wed, 22 Jun 2022 19:08:51 GMT
last-modified: Tue, 21 Jun 2022 06:38:16 GMT
server: nginx
strict-transport-security: max-age=31536000
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 482
expires: Fri, 22 Jul 2022 19:08:51 GMT

GET
H2 200 6xKtdSZaM9iE8KbpRA_hK1QN.woff2
fonts.gstatic.com/s/quicksand/v29/ 25 KB
26 KB 46ms
3ms Font
font/woff2 2404:6800:4004:826::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/quicksand/v29/6xKtdSZaM9iE8KbpRA_hK1QN.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Quicksand:400,700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4004:826::2003 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1a77bc9cd8df8f7680ab07cf42d9aef3147f5c6fc7fe2050ccee4ea11b22c6cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://bayxwndpmb.duckdns.org
accept-language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Wed, 15 Jun 2022 19:49:25 GMT
x-content-type-options: nosniff
age: 602644
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25700
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:11:53 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 15 Jun 2023 19:49:25 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: ia.51.la
URL: https://ia.51.la/go1?id=21267695&rt=1655925209675&rl=1600*1200&lang=en-US&ct=unknow&pf=1&ins=1&vd=1&ce=1&cd=24&ds=&ing=1&ekc=&sid=1655925209675&tt=&kw=&cu=https%253A%252F%252Fbayxwndpmb.duckdns.org%252F&pu=

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: au ID (Telecommunication)

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
bayxwndpmb.duckdns.org/	1969-12-31 23:59:59	Name: sessionid Value: f737e3c93ee9abecd3ab29d7f129fa5f
bayxwndpmb.duckdns.org/	1969-12-31 23:59:59	Name: __tins__21267695 Value: %7B%22sid%22%3A%201655925209675%2C%20%22vd%22%3A%201%2C%20%22expires%22%3A%201655927009675%7D
bayxwndpmb.duckdns.org/	1969-12-31 23:59:59	Name: __51cke__ Value:
bayxwndpmb.duckdns.org/	1969-12-31 23:59:59	Name: __51laig__ Value: 1

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bayxwndpmb.duckdns.org
fonts.googleapis.com
fonts.gstatic.com
ia.51.la
js.users.51.la
www.ymobile.jp
ia.51.la
14.17.102.110
184.175.240.7
23.10.10.203
2404:6800:4004:821::200a
2404:6800:4004:826::2003
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
1a77bc9cd8df8f7680ab07cf42d9aef3147f5c6fc7fe2050ccee4ea11b22c6cd
1fe9eed88179f20a36dc0a1899e25028762077b8a5da1a5b16e2d9e09864b4cb
30ac02f2f32bd6449033baedc40fe40ed9019dcebc63b514fdb6e32dfeba0758
4659ab7959700776aaba31c068f2628773c0fa05b799e16e909b1eb3a2b43bfa
590e7800b23e22bb3f392a9f6fd63ec4de146db3df439cb14126d510cab8fc09
6bf57bdb695769de996d53cdf297d06951bfdb02e389fb15b80dab063b1cf967
6dc19a1d50098fe9e3b159a69a7b53e7b0d5ca937c18441736c5a4bbdc159332
70fe796ea3872a4f96dc3603b7b4e26fef3415acd88d5667ceca0e00bb444d64
748a742e3dc9d4c993e789fb7dd2a15fc7f7dc20d26c2f9ad3e06acaab8f5b0a
8e0aa37ba8afed6627c753ecaea60d83c0014f577205890936aa75debcdecbaf
925f861c228dce5aec5354551a9a70790b7f111e0c1988f5ec1ebdd1241645ff
9e5f2a81a690f19889f45dd3e384da0e56def0ec0199721836159736f6283c67
b0baf30a5d52de6372685e6c3935205b7f38433ba114332de655de078c64d8d0
bb5f4cf1048b80b3608c5caaa0f9e2a783b7e122d5252d0646cc0107ad6641aa
c1a87c4599f42a2cc86ec8e78d0f6ef3b02a1ecd41a6bff8f1d9050c9490a936
c46abe457820829f581a15b2b25baa925fc78d6aa7c1989503b47859d0569b6e
ca12241ddbe5e9e4c018782bfe45123e61348371e32f60d3a5abd2019e1197c9
f4c13cfc9310805af5435b0d5f04960dcae82109c7aa89389bd04d8fe5d26896

bayxwndpmb.duckdns.org Open in urlscan Pro 184.175.240.7 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

20 Requests

95 %HTTPS

40 %IPv6

5 Domains

6 Subdomains

6 IPs

4 Countries

124 kBTransfer

211 kBSize

4 Cookies

1 Outgoing links

Redirected requests

20 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

15 JavaScript Global Variables

4 Cookies

Security Headers

Indicators

bayxwndpmb.duckdns.org Open in urlscan Pro
184.175.240.7 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

20
Requests

95 %
HTTPS

40 %
IPv6

5
Domains

6
Subdomains

6
IPs

4
Countries

124 kB
Transfer

211 kB
Size

4
Cookies

20 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!