www.au-one.duckdns.org Open in urlscan Pro
162.241.127.227  Malicious Activity! Public Scan

5 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response www.au-one.duckdns.org/	9 KB 10 KB	863ms 337ms	Document text/html	162.241.127.227 NETWORK-SOLUTIONS...
General Check archive.org Show headers Download Go to Full URL http://www.au-one.duckdns.org/ Protocol HTTP/1.1 Server 162.241.127.227 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US), Reverse DNS 162-241-127-227.webhostbox.net Software Apache / Resource Hash 635962ab42c0027cf1142eeb03e6dca4eb4ebd317d9eb7f2c8cd760517ad8850 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 accept-language en-AU,en;q=0.9 Response headers Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Tue, 07 Feb 2023 13:05:40 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Keep-Alive timeout=5, max=100 Pragma no-cache Server Apache Transfer-Encoding chunked
GET H/1.1	200 OK	idk.css connect.auone.jp/net/vwc/cca_lg_eu_nets/resources/style/common/	47 KB 10 KB	1228ms 250ms	Stylesheet text/css	111.87.221.81 KDDI KDDI CORPORA...
General Check archive.org Show headers Download Go to Full URL https://connect.auone.jp/net/vwc/cca_lg_eu_nets/resources/style/common/idk.css?20221105 Requested by Host: www.au-one.duckdns.org URL: http://www.au-one.duckdns.org/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 111.87.221.81 Meieki, Japan, ASN2516 (KDDI KDDI CORPORATION, JP), Reverse DNS Software Apache / Resource Hash 055c041f8be9e665ba6498db2892456488866d98e697f3f50d726788b2dbc635 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 1; mode=block Request headers accept-language en-AU,en;q=0.9 Referer http://www.au-one.duckdns.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers Date Tue, 07 Feb 2023 13:05:42 GMT Content-Encoding gzip X-Content-Type-Options nosniff Last-Modified Fri, 20 Jan 2023 08:02:45 GMT Server Apache X-Frame-Options DENY Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=1, max=50 Content-Length 9582 X-XSS-Protection 1; mode=block Expires "-1"
GET H/1.1	200 OK	checkboxRadio.css connect.auone.jp/net/vwc/cca_lg_eu_nets/resources/style/common/	4 KB 1 KB	1234ms 220ms	Stylesheet text/css	111.87.221.81 KDDI KDDI CORPORA...
General Check archive.org Show headers Download Go to Full URL https://connect.auone.jp/net/vwc/cca_lg_eu_nets/resources/style/common/checkboxRadio.css?20221105 Requested by Host: www.au-one.duckdns.org URL: http://www.au-one.duckdns.org/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 111.87.221.81 Meieki, Japan, ASN2516 (KDDI KDDI CORPORATION, JP), Reverse DNS Software Apache / Resource Hash a63fd3959f8cd89c2706cb778dea2994b82cfc800bf5db9257edcf1fa7222b80 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 1; mode=block Request headers accept-language en-AU,en;q=0.9 Referer http://www.au-one.duckdns.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers Date Tue, 07 Feb 2023 13:05:42 GMT Content-Encoding gzip X-Content-Type-Options nosniff Last-Modified Fri, 20 Jan 2023 08:02:45 GMT Server Apache X-Frame-Options DENY Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=1, max=50 Content-Length 958 X-XSS-Protection 1; mode=block Expires "-1"
GET H/1.1	200 OK	au_id.jpg connect.auone.jp/net/vwc/cca_lg_eu_nets/resources/image/common/	34 KB 34 KB	1323ms 251ms	Image image/jpeg	111.87.221.81 KDDI KDDI CORPORA...
General Check archive.org Show headers Download Go to Show image Full URL https://connect.auone.jp/net/vwc/cca_lg_eu_nets/resources/image/common/au_id.jpg?20220817 Requested by Host: www.au-one.duckdns.org URL: http://www.au-one.duckdns.org/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 111.87.221.81 Meieki, Japan, ASN2516 (KDDI KDDI CORPORATION, JP), Reverse DNS Software Apache / Resource Hash 1ec5abc3e4e21e84224089afccec3c1677323ec02fe04f2bbf6083a9b9d3fc2d Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 1; mode=block Request headers accept-language en-AU,en;q=0.9 Referer http://www.au-one.duckdns.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers Date Tue, 07 Feb 2023 13:05:42 GMT X-Content-Type-Options nosniff Last-Modified Tue, 22 Nov 2022 08:04:01 GMT Server Apache X-Frame-Options DENY Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=1, max=50 Content-Length 34778 X-XSS-Protection 1; mode=block Expires "-1"
GET H/1.1	404 Not Found	contentsBase.js www.au-one.duckdns.org/resources/js/common/	0 0	289ms 289ms	Script text/html	162.241.127.227 NETWORK-SOLUTIONS...
General Check archive.org Show headers Download Go to Full URL http://www.au-one.duckdns.org/resources/js/common/contentsBase.js?20221105 Requested by Host: www.au-one.duckdns.org URL: http://www.au-one.duckdns.org/ Protocol HTTP/1.1 Server 162.241.127.227 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US), Reverse DNS 162-241-127-227.webhostbox.net Software Apache / Resource Hash Request headers accept-language en-AU,en;q=0.9 Referer http://www.au-one.duckdns.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers Date Tue, 07 Feb 2023 13:05:40 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=99 Content-Length 315 Content-Type text/html; charset=iso-8859-1
GET H2	200	storage.secure.min.html Show response lpcdn.lpsnmedia.net/le_secure_storage/3.19.0.0-release_5079/ Frame 689E	39 KB 16 KB	2394ms 195ms	Document text/html	103.42.133.35 LIVEPERSON
General Check archive.org Show headers Download Go to Full URL https://lpcdn.lpsnmedia.net/le_secure_storage/3.19.0.0-release_5079/storage.secure.min.html?loc=file%3A%2F%2F&site=16820676&env=prod&isCrossDomain=true Requested by Host: www.au-one.duckdns.org URL: http://www.au-one.duckdns.org/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 103.42.133.35 , Australia, ASN11054 (LIVEPERSON, US), Reverse DNS Software ws / Resource Hash 639fcd75ad19240531093db9d079f4be79913034b5ce3a7ae0b4006735f1fb2f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers Referer http://www.au-one.duckdns.org/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 accept-language en-AU,en;q=0.9 Response headers access-control-allow-credentials true access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-state-rev access-control-allow-methods GET, POST, PATCH access-control-expose-headers X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options, x-lp-state-rev cache-control max-age=31536000 content-encoding gzip content-type text/html date Tue, 07 Feb 2023 13:05:45 GMT expires Wed, 07 Feb 2024 13:05:45 GMT last-modified Thu, 03 Nov 2022 22:00:39 GMT server ws strict-transport-security max-age=31536000; includeSubDomains vary Origin x-cache-status HIT x-content-type-options nosniff
GET H2	200	refererrestrictions Show response accdn.lpsnmedia.net/api/account/16820676/configuration/domainprotection/ Frame 689E	256 B 1 KB	1515ms 386ms	Script application/javascript	103.42.133.5
General Check archive.org Show headers Download Go to Full URL https://accdn.lpsnmedia.net/api/account/16820676/configuration/domainprotection/refererrestrictions?cb=lpCb57967x59068 Requested by Host: lpcdn.lpsnmedia.net URL: https://lpcdn.lpsnmedia.net/le_secure_storage/3.19.0.0-release_5079/storage.secure.min.html?loc=file%3A%2F%2F&site=16820676&env=prod&isCrossDomain=true Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 103.42.133.5 -, , ASN (), Reverse DNS Software ws / Resource Hash 190d9699d19565933ffb3ae4314c1e80f6d0ce29b814addfc77db16d7db2ba0d Security Headers Name Value Strict-Transport-Security max-age=99999999999; includeSubDomains X-Content-Type-Options nosniff Request headers accept-language en-AU,en;q=0.9 Referer https://lpcdn.lpsnmedia.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers date Tue, 07 Feb 2023 13:05:46 GMT strict-transport-security max-age=99999999999; includeSubDomains x-content-type-options nosniff content-encoding gzip server ws x-cache-status EXPIRED vary Accept access-control-allow-methods GET, POST, PATCH content-type application/javascript access-control-expose-headers X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options x-envoy-upstream-service-time 1 access-control-allow-credentials true access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token expires Tue, 07 Feb 2023 13:06:46 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: au ID (Telecommunication)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| oncontentvisibilityautostatechange

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.au-one.duckdns.org/	1969-12-31 23:59:59	Name: PHPSESSID Value: 26258b6585e7f61fcb374274504646bf

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: http://www.au-one.duckdns.org/resources/js/common/contentsBase.js?20221105 Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

accdn.lpsnmedia.net
connect.auone.jp
lpcdn.lpsnmedia.net
www.au-one.duckdns.org
103.42.133.35
103.42.133.5
111.87.221.81
162.241.127.227
055c041f8be9e665ba6498db2892456488866d98e697f3f50d726788b2dbc635
190d9699d19565933ffb3ae4314c1e80f6d0ce29b814addfc77db16d7db2ba0d
1ec5abc3e4e21e84224089afccec3c1677323ec02fe04f2bbf6083a9b9d3fc2d
635962ab42c0027cf1142eeb03e6dca4eb4ebd317d9eb7f2c8cd760517ad8850
639fcd75ad19240531093db9d079f4be79913034b5ce3a7ae0b4006735f1fb2f
a63fd3959f8cd89c2706cb778dea2994b82cfc800bf5db9257edcf1fa7222b80