![](/screenshots/80f8a002-6599-49fd-9166-43cea32e0738.png)
osidkfhdnsgris.duckdns.org
Open in
urlscan Pro
185.196.8.138
Malicious Activity!
Public Scan
Effective URL: https://osidkfhdnsgris.duckdns.org/83kuh3753u3h/
Submission: On July 19 via manual from US
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on July 13th 2021. Valid for: 3 months.
This is the only time osidkfhdnsgris.duckdns.org was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: PNC Financial (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 104.244.42.5 104.244.42.5 | 13414 (TWITTER) (TWITTER) | |
1 1 | 13.224.99.3 13.224.99.3 | 16509 (AMAZON-02) (AMAZON-02) | |
4 | 185.196.8.138 185.196.8.138 | 34888 (SIMPLECAR...) (SIMPLECARRER2) | |
15 | 23.45.109.64 23.45.109.64 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
20 | 3 |
ASN16509 (AMAZON-02, US)
PTR: server-13-224-99-3.zrh50.r.cloudfront.net
d0fuo.onelink.me |
ASN34888 (SIMPLECARRER2, US)
PTR: cphost22.qhoster.net
osidkfhdnsgris.duckdns.org |
ASN16625 (AKAMAI-AS, US)
PTR: a23-45-109-64.deploy.static.akamaitechnologies.com
www.onlinebanking.pnc.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
15 |
pnc.com
www.onlinebanking.pnc.com |
59 KB |
4 |
duckdns.org
osidkfhdnsgris.duckdns.org |
5 KB |
1 |
onelink.me
1 redirects
d0fuo.onelink.me |
313 B |
1 |
t.co
t.co |
504 B |
20 | 4 |
Domain | Requested by | |
---|---|---|
15 | www.onlinebanking.pnc.com |
osidkfhdnsgris.duckdns.org
www.onlinebanking.pnc.com |
4 | osidkfhdnsgris.duckdns.org |
t.co
osidkfhdnsgris.duckdns.org |
1 | d0fuo.onelink.me | 1 redirects |
1 | t.co | |
20 | 4 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.pnc.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
t.co DigiCert TLS RSA SHA256 2020 CA1 |
2021-02-05 - 2022-02-04 |
a year | crt.sh |
osidkfhdnsgris.duckdns.org cPanel, Inc. Certification Authority |
2021-07-13 - 2021-10-11 |
3 months | crt.sh |
www.onlinebanking.pnc.com Sectigo RSA Organization Validation Secure Server CA |
2020-02-05 - 2022-02-04 |
2 years | crt.sh |
This page contains 2 frames:
Primary Page:
https://osidkfhdnsgris.duckdns.org/83kuh3753u3h/
Frame ID: 2C73206E39C9E3F72147316EDED11926
Requests: 19 HTTP requests in this frame
Frame:
https://osidkfhdnsgris.duckdns.org/83kuh3753u3h/index_2.html
Frame ID: 7F785CD9CCD87EEA8B65DFEBFE8B2AB0
Requests: 1 HTTP requests in this frame
Screenshot
![](/screenshots/80f8a002-6599-49fd-9166-43cea32e0738.png)
Page URL History Show full URLs
- https://t.co/C2TDt1sbbU?amp=1sdhdnu3w Page URL
-
https://d0fuo.onelink.me/DXsi/dnus7sdi
HTTP 302
https://osidkfhdnsgris.duckdns.org/83kuh3753u3h/ Page URL
Page Statistics
6 Outgoing links
These are links going to different origins than the main page.
Title: Microsoft Internet Explorer
Search URL Search Domain Scan URL
Title: Mozilla Firefox
Search URL Search Domain Scan URL
Title: Netscape Navigator
Search URL Search Domain Scan URL
Title: Apple Safari
Search URL Search Domain Scan URL
Title: Terms and Conditions
Search URL Search Domain Scan URL
Title: Privacy Policy.
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://t.co/C2TDt1sbbU?amp=1sdhdnu3w Page URL
-
https://d0fuo.onelink.me/DXsi/dnus7sdi
HTTP 302
https://osidkfhdnsgris.duckdns.org/83kuh3753u3h/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
20 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
C2TDt1sbbU
t.co/ |
270 B 504 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
/
osidkfhdnsgris.duckdns.org/83kuh3753u3h/ Redirect Chain
|
19 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
common.css
www.onlinebanking.pnc.com/css2/ |
243 KB 41 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
company_logo.1033.1.jpg
osidkfhdnsgris.duckdns.org/83kuh3753u3h/Include/ |
0 26 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
livelook.png
www.onlinebanking.pnc.com/Images2/livelook/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
lock.png
osidkfhdnsgris.duckdns.org/83kuh3753u3h/Include/ |
0 24 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
reset.css
www.onlinebanking.pnc.com/css2/ |
1 KB 863 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
index_2.html
osidkfhdnsgris.duckdns.org/83kuh3753u3h/ Frame 7F78 |
0 47 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bg_fade.png
www.onlinebanking.pnc.com/Images2/wrapper/ |
244 B 487 B |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
topHeader_Short_bg.png
www.onlinebanking.pnc.com/Images2/wrapper/ |
7 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
navSprite.png
www.onlinebanking.pnc.com/Images2/ |
2 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
noNav_bg.png
www.onlinebanking.pnc.com/Images2/wrapper/ |
354 B 626 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
content_bg.png
www.onlinebanking.pnc.com/Images2/wrapper/ |
142 B 382 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
panelSprite.png
www.onlinebanking.pnc.com/Images2/ |
712 B 983 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
topRight.png
www.onlinebanking.pnc.com/Images2/panels/ |
150 B 422 B |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
buttons_disabled.png
www.onlinebanking.pnc.com/Images2/buttons/ |
172 B 444 B |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
botRight.png
www.onlinebanking.pnc.com/Images2/panels/ |
100 B 341 B |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
blank_topLeft.png
www.onlinebanking.pnc.com/Images2/panels/ |
170 B 412 B |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
blank_topRight.png
www.onlinebanking.pnc.com/Images2/panels/ |
94 B 365 B |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
footer_bot.png
www.onlinebanking.pnc.com/Images2/wrapper/ |
628 B 901 B |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: PNC Financial (Banking)13 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| check1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
osidkfhdnsgris.duckdns.org/ | Name: cazanova Value: e3aa2c909163eb1dabb3bac5f1713e5518185078 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=0 |
X-Xss-Protection | 0 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
d0fuo.onelink.me
osidkfhdnsgris.duckdns.org
t.co
www.onlinebanking.pnc.com
104.244.42.5
13.224.99.3
185.196.8.138
23.45.109.64
15437ff9e91a30ac2260c86ec2da1ad95bc1a508f610951a8ced45736e548fda
29ef8df8434833713e670f03526c1cef9f2cfb19c7d7e5e9cf4628f807a7d024
424171982c2e7b6ea8e2750cc0c709a103ac79291218331b6e0d86b2e5db7459
455e51d8d0a5eef169c9096a93d1551314ed14fb749f5513c5739e8c9cfe377a
504bd0d64fe73a49f07ebbb1682f3d1b7c58298d70040f5e0d997d819022a0be
5383c4886a2e2802ca1e09b5a08a18c8fbb9fd65b590c055882a2c709cd3dd8e
5967c6966f0c716e80d31797c83a4a56ed5ac22efc8b6694420d31bcbd93f3d4
5c7484f3edb6fe12bee237d7a090c728a3a2fa2cdf61b7637953fadd404fcaa3
6a1e22db4bf8076f7b2e67115b94dfe458743fe8e3be5e59373c45810d28d199
a5e34dff715ae6800da8ea8beab0abd05a036f8eb52e12ccf6ca43b67961867a
a99772fc532f03960dd45ea143b95b35134a4451474496a990923794051a8687
d21fb7c639ad1467608e47d38d195d3053c16dfdd71eee7895921f3f3599fd6a
e1ab40e38e139a56c56e2d27adc3b206bac6ff6555407314e869568630695df0
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ea5a07b73992e6376dad3be745a98001e77bdff9a1ed88ae0f49e5825957e294
edc468fb28baeb12d16bb1b039b8b384f7b02cab15e4457a35441c4236f7d216
f5d041b2d44847df9198d03e695f651fe9aa91bf1555331f9236d624c03714a2
fb8dc6f43f5fef822508fe0429d55e26c1082db8e300f56bee728b6b2de58c47