urlscan.io logo urlscan.io
SecurityTrails logo

help-feedback-support164.duckdns.org Open in urlscan Pro
20.196.195.155  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://go.nvsu.edu.ph/eDXfj
Effective URL: https://help-feedback-support164.duckdns.org/login.srf/signin?wa=wsignin1.0&rpsnv=15&ct=1690804743&rver=7.0.6737.0&wp=MBI_SSL&wreply=https%3a...
Submission: On September 07 via manual from IT — Scanned from IT
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 5 countries across 5 domains to perform 7 HTTP transactions. The main IP is 20.196.195.155, located in Seoul, Korea, Republic Of and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is help-feedback-support164.duckdns.org.
TLS certificate: Issued by R3 on September 7th 2023. Valid for: 3 months.
This is the only time help-feedback-support164.duckdns.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
1 1 119.92.169.204 9299 (IPG-AS-AP...)
1 1 172.67.156.162 13335 (CLOUDFLAR...)
1 1 104.21.13.157 13335 (CLOUDFLAR...)
1 1 164.92.238.9 14061 (DIGITALOC...)
1 1 70.32.23.104 55293 (A2HOSTING)
6 20.196.195.155 8075 (MICROSOFT...)
7 2
1    119.92.169.204 (Manila, Philippines)

ASN9299 (IPG-AS-AP Philippine Long Distance Telephone Company, PH)
PTR: host.13.static.nvsu.edu.ph
go.nvsu.edu.ph
1    172.67.156.162 (United States)

ASN13335 (CLOUDFLARENET, US)
gol.to
1    104.21.13.157 (None, )

ASN13335 (CLOUDFLARENET, US)
gol.to
1    164.92.238.9 (Frankfurt am Main, Germany)

ASN14061 (DIGITALOCEAN-ASN, US)
PTR: kont.ly
kont.ly
1    70.32.23.104 (United States)

ASN55293 (A2HOSTING, US)
PTR: mi3-ts12.a2hosting.com
roq.to
6    20.196.195.155 (Seoul, Korea, Republic Of)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
help-feedback-support164.duckdns.org
Apex Domain
Subdomains		 Transfer
6 duckdns.org
help-feedback-support164.duckdns.org
149 KB
2 gol.to
gol.to
2 KB
1 roq.to
roq.to
1 KB
1 kont.ly
kont.ly
347 B
1 nvsu.edu.ph
go.nvsu.edu.ph
224 B
7 5
Domain Requested by
6 help-feedback-support164.duckdns.org help-feedback-support164.duckdns.org
2 gol.to 2 redirects
1 roq.to 1 redirects
1 kont.ly 1 redirects
1 go.nvsu.edu.ph 1 redirects
7 5

This site contains no links.

Subject Issuer Validity Valid
www.help-feedback-support164.duckdns.org
R3		 2023-09-07 -
2023-12-06		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://help-feedback-support164.duckdns.org/login.srf/signin?wa=wsignin1.0&rpsnv=15&ct=1690804743&rver=7.0.6737.0&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f%3fnlp%3d1%26RpsCsrfState%7dd51e095560536652bf4cc37a88ce1819d207f3&id=292841&aadredir=1&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015
Frame ID: 1A92F6CEED87AEFCA847674FB2E2884F
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://go.nvsu.edu.ph/eDXfj HTTP 301
    http://gol.to/8j8vn HTTP 301
    https://gol.to/8j8vn HTTP 301
    https://kont.ly/da7a2cc9 HTTP 301
    https://roq.to/2jEqR HTTP 301
    https://help-feedback-support164.duckdns.org/?pantek15 Page URL
  2. https://help-feedback-support164.duckdns.org/login.srf/signin?wa=wsignin1.0&rpsnv=15&ct=1690804743&rver=7.0.6737.0&wp=MBI... Page URL

Page Statistics

7
Requests

86 %
HTTPS

0 %
IPv6

5
Domains

5
Subdomains

2
IPs

5
Countries

149 kB
Transfer

147 kB
Size

6
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://go.nvsu.edu.ph/eDXfj HTTP 301
    http://gol.to/8j8vn HTTP 301
    https://gol.to/8j8vn HTTP 301
    https://kont.ly/da7a2cc9 HTTP 301
    https://roq.to/2jEqR HTTP 301
    https://help-feedback-support164.duckdns.org/?pantek15 Page URL
  2. https://help-feedback-support164.duckdns.org/login.srf/signin?wa=wsignin1.0&rpsnv=15&ct=1690804743&rver=7.0.6737.0&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f%3fnlp%3d1%26RpsCsrfState%7dd51e095560536652bf4cc37a88ce1819d207f3&id=292841&aadredir=1&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://go.nvsu.edu.ph/eDXfj HTTP 301
  • http://gol.to/8j8vn HTTP 301
  • https://gol.to/8j8vn HTTP 301
  • https://kont.ly/da7a2cc9 HTTP 301
  • https://roq.to/2jEqR HTTP 301
  • https://help-feedback-support164.duckdns.org/?pantek15

7 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
help-feedback-support164.duckdns.org/
Redirect Chain
  • https://go.nvsu.edu.ph/eDXfj
  • http://gol.to/8j8vn
  • https://gol.to/8j8vn
  • https://kont.ly/da7a2cc9
  • https://roq.to/2jEqR
  • https://help-feedback-support164.duckdns.org/?pantek15
330 B
822 B 		Document
General
Check archive.org
Download Go to
Full URL
https://help-feedback-support164.duckdns.org/?pantek15
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
20.196.195.155 Seoul, Korea, Republic Of, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Apache /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36
accept-language
it-IT,it;q=0.9

Response headers

Cache-Control
no-store, no-cache, must-revalidate
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
Date
Thu, 07 Sep 2023 21:02:00 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive
timeout=5, max=100
Pragma
no-cache
Server
Apache
Transfer-Encoding
chunked

Redirect headers

alt-svc
h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
cache-control
no-cache, no-store, private
content-encoding
br
content-length
182
content-type
text/html; charset=UTF-8
date
Thu, 07 Sep 2023 21:01:59 GMT
expires
-1
location
https://help-feedback-support164.duckdns.org/?pantek15
server
LiteSpeed
strict-transport-security
max-age=63072000; includeSubDomains
vary
Accept-Encoding
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-powered-by
PHP/8.1.22
Primary Request signin
help-feedback-support164.duckdns.org/login.srf/ 		10 KB
10 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://help-feedback-support164.duckdns.org/login.srf/signin?wa=wsignin1.0&rpsnv=15&ct=1690804743&rver=7.0.6737.0&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f%3fnlp%3d1%26RpsCsrfState%7dd51e095560536652bf4cc37a88ce1819d207f3&id=292841&aadredir=1&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015
Requested by
Host: help-feedback-support164.duckdns.org
URL: https://help-feedback-support164.duckdns.org/?pantek15
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
20.196.195.155 Seoul, Korea, Republic Of, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Apache /
Resource Hash
cc992817455d605dfc308ff72f7b1eaf563728791c013c8adf4bb553bf0d8d8b

Request headers

Referer
https://help-feedback-support164.duckdns.org/?pantek15
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36
accept-language
it-IT,it;q=0.9

Response headers

Cache-Control
no-store, no-cache, must-revalidate
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
Date
Thu, 07 Sep 2023 21:02:08 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive
timeout=5, max=99
Pragma
no-cache
Server
Apache
Transfer-Encoding
chunked
signin1.css
help-feedback-support164.duckdns.org/css/ 		134 KB
134 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://help-feedback-support164.duckdns.org/css/signin1.css
Requested by
Host: help-feedback-support164.duckdns.org
URL: https://help-feedback-support164.duckdns.org/login.srf/signin?wa=wsignin1.0&rpsnv=15&ct=1690804743&rver=7.0.6737.0&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f%3fnlp%3d1%26RpsCsrfState%7dd51e095560536652bf4cc37a88ce1819d207f3&id=292841&aadredir=1&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
20.196.195.155 Seoul, Korea, Republic Of, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Apache /
Resource Hash
6473b8cff0a8c2dae7e82fe9e73c4755988058faf859312f928e2444b203005c

Request headers

accept-language
it-IT,it;q=0.9
Referer
https://help-feedback-support164.duckdns.org/login.srf/signin?wa=wsignin1.0&rpsnv=15&ct=1690804743&rver=7.0.6737.0&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f%3fnlp%3d1%26RpsCsrfState%7dd51e095560536652bf4cc37a88ce1819d207f3&id=292841&aadredir=1&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

Date
Thu, 07 Sep 2023 21:02:10 GMT
Last-Modified
Tue, 01 Aug 2023 22:25:06 GMT
Server
Apache
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
137232
microsoft_logo_ea19b2112f4dfd8e90b4505ef7dcb4f9.png
help-feedback-support164.duckdns.org/img/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://help-feedback-support164.duckdns.org/img/microsoft_logo_ea19b2112f4dfd8e90b4505ef7dcb4f9.png
Requested by
Host: help-feedback-support164.duckdns.org
URL: https://help-feedback-support164.duckdns.org/login.srf/signin?wa=wsignin1.0&rpsnv=15&ct=1690804743&rver=7.0.6737.0&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f%3fnlp%3d1%26RpsCsrfState%7dd51e095560536652bf4cc37a88ce1819d207f3&id=292841&aadredir=1&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
20.196.195.155 Seoul, Korea, Republic Of, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Apache /
Resource Hash
f664b8138c2da6ec7565500a7cc839da6372614a31dc04c5a2169a26b8d9767c

Request headers

accept-language
it-IT,it;q=0.9
Referer
https://help-feedback-support164.duckdns.org/login.srf/signin?wa=wsignin1.0&rpsnv=15&ct=1690804743&rver=7.0.6737.0&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f%3fnlp%3d1%26RpsCsrfState%7dd51e095560536652bf4cc37a88ce1819d207f3&id=292841&aadredir=1&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

Date
Thu, 07 Sep 2023 21:02:11 GMT
Last-Modified
Wed, 02 Aug 2023 03:10:10 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
1057
tandatanya.png
help-feedback-support164.duckdns.org/img/ 		360 B
601 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://help-feedback-support164.duckdns.org/img/tandatanya.png
Requested by
Host: help-feedback-support164.duckdns.org
URL: https://help-feedback-support164.duckdns.org/login.srf/signin?wa=wsignin1.0&rpsnv=15&ct=1690804743&rver=7.0.6737.0&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f%3fnlp%3d1%26RpsCsrfState%7dd51e095560536652bf4cc37a88ce1819d207f3&id=292841&aadredir=1&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
20.196.195.155 Seoul, Korea, Republic Of, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Apache /
Resource Hash
fbd90be1d86eeb3bb80b49505a8a1f1a45c52ebfdd4153d0a327d88334385885

Request headers

accept-language
it-IT,it;q=0.9
Referer
https://help-feedback-support164.duckdns.org/login.srf/signin?wa=wsignin1.0&rpsnv=15&ct=1690804743&rver=7.0.6737.0&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f%3fnlp%3d1%26RpsCsrfState%7dd51e095560536652bf4cc37a88ce1819d207f3&id=292841&aadredir=1&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

Date
Thu, 07 Sep 2023 21:02:12 GMT
Last-Modified
Tue, 01 Aug 2023 23:26:40 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
360
svgexport-1.svg
help-feedback-support164.duckdns.org/img/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://help-feedback-support164.duckdns.org/img/svgexport-1.svg
Requested by
Host: help-feedback-support164.duckdns.org
URL: https://help-feedback-support164.duckdns.org/login.srf/signin?wa=wsignin1.0&rpsnv=15&ct=1690804743&rver=7.0.6737.0&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f%3fnlp%3d1%26RpsCsrfState%7dd51e095560536652bf4cc37a88ce1819d207f3&id=292841&aadredir=1&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
20.196.195.155 Seoul, Korea, Republic Of, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Apache /
Resource Hash
8675a695c2aa4edc0133cf4476e235c1bfa4a5b3ed7d8eb4355407d89e56f2f7

Request headers

accept-language
it-IT,it;q=0.9
Referer
https://help-feedback-support164.duckdns.org/login.srf/signin?wa=wsignin1.0&rpsnv=15&ct=1690804743&rver=7.0.6737.0&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f%3fnlp%3d1%26RpsCsrfState%7dd51e095560536652bf4cc37a88ce1819d207f3&id=292841&aadredir=1&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

Date
Thu, 07 Sep 2023 21:02:12 GMT
Last-Modified
Wed, 02 Aug 2023 03:17:08 GMT
Server
Apache
Content-Type
image/svg+xml
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
1635
bg.png
help-feedback-support164.duckdns.org/img/ 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
help-feedback-support164.duckdns.org
URL
https://help-feedback-support164.duckdns.org/img/bg.png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture

6 Cookies

Domain/Path Name / Value
gol.to/ Name: XSRF-TOKEN
Value: eyJpdiI6IjdCNmNwNC8wYVR5Vm40d01zT1A1VUE9PSIsInZhbHVlIjoiTHZtb0VlUHNYUVFtcCtVVkpSMEhtNHVGa1VtQXJlcU5ldjJ6UXU0bUZzeHFDbVlEMFpKbGFXeGR6ZFpLL1lZYzJSQjBmTllzNHhyNmFNeCt4d3ZVdVJmeGVaZk1sT213bnZVV2R2VktTeWpDc0l3QzVETzlmUFVWWG42ZEpGZWgiLCJtYWMiOiI4NmRhN2M5YzhkOTcxY2Q4M2NjOGUwZDg5OGU2YWNjZDZhMGQzOWZhYzViZmUzYzAyMTE1Nzk1NjJkNTNlMjExIiwidGFnIjoiIn0%3D
gol.to/ Name: phpshort_session
Value: eyJpdiI6Ik12MGtDQ2l5OUM2ZU91MGx1NFNsTEE9PSIsInZhbHVlIjoiMXlTY2plNG80VjhYQnQ3ZVo4SkxOL0tLZ0FJYWZlR0JBOXN4M0pwZS9jQXRING5WRk5pR1FGaDdBS0MxTjFzc3dMV01vRnB0SUlnSURVSlFyWVhmei9yZHNWa24vRWtTbWRSRWZVclMrb1M0TmVmcjVKZ3o2dG5LOHMwRjFVNHEiLCJtYWMiOiI1YmY4ZjQzYjVhYjhmZmQ5NjQxNmJhNjMzZmJjZTMxMjMzZjg1YTM1YmM5MmI1OTlmNDg0NGE1OWFjMDA2ZWE5IiwidGFnIjoiIn0%3D
roq.to/ Name: XSRF-TOKEN
Value: eyJpdiI6IkpyNjEySXNmWGlkRDBRVHV0cDkwN2c9PSIsInZhbHVlIjoiTlN1dmtrWTlyMlBhRlRnVzNCTVVGQVk5aVh0NjUzMTB3Z3JBZnpmMkdjR3RBY0VNRCswS1gxK2c3OVhCT0E4TUxoMWNTa1o1ZW9NaEhZZ2FrSStPTzRNcXladVBkT3F3TzBmYTMrRVNtUnc0UVE2VE5BMmlzdDBtNzhpTXNvbkUiLCJtYWMiOiI0NzQ4NTQ3NGFlNTllZWE1MjczNjAzMjgyNTg2MTQ3NDUwMzZiNWNiN2RhMzA1ZjcxY2Q0YTA4YWZkODQ5NWFiIiwidGFnIjoiIn0%3D
roq.to/ Name: roq2_session
Value: eyJpdiI6IkxrMWhPWU5xVis2NCtscTBpYVRvV1E9PSIsInZhbHVlIjoiSVREUzlCeGRHdmJmQ0s4STdXNStqRjVRelZBakF3SmpYYkp4alArQXRtQjJvdWY4aDZaYU92NnhpanV6RC9GZU9vMjc4d3l2eTF3WVFnU0tVRFVLTWg5Znd2L2txVXNmc2gzSStrQm1jaW5rVUJxb1p2c3Nudkc0R1ZSYnJ1TE0iLCJtYWMiOiIyZDNjZWFmZjZkMTUzMzM3NjA2ZTE2YzAyOGRiZmFlMTA1YWNlNzVjOThhNWJlOTQwMWRjOTUzZTNhOGYxYzVlIiwidGFnIjoiIn0%3D
help-feedback-support164.duckdns.org/ Name: PHPSESSID
Value: c7dce2e31567ba02943875b7dace229a
help-feedback-support164.duckdns.org/ Name: access_key
Value: f125e29b4f12e8a947320f63fab3e16c