mlbb-claim290.duckdns.org
Open in
urlscan Pro
75.119.136.206
Malicious Activity!
Public Scan
Submission: On April 25 via automatic, source phishtank
Summary
TLS certificate: Issued by R3 on April 24th 2021. Valid for: 3 months.
This is the only time mlbb-claim290.duckdns.org was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Facebook (Social Network) Generic Gaming (Entertainment)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 | 75.119.136.206 75.119.136.206 | 51167 (CONTABO) (CONTABO) | |
2 | 2606:4700::68... 2606:4700::6812:acf | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:82f::200a | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a00:1450:400... 2a00:1450:4001:828::2003 | 15169 (GOOGLE) (GOOGLE) | |
9 | 5 |
ASN51167 (CONTABO, DE)
PTR: ngen.suppreme.in
mlbb-claim290.duckdns.org |
Apex Domain Subdomains |
Transfer | |
---|---|---|
3 |
duckdns.org
mlbb-claim290.duckdns.org |
30 KB |
2 |
gstatic.com
fonts.gstatic.com |
31 KB |
2 |
bootstrapcdn.com
stackpath.bootstrapcdn.com |
83 KB |
1 |
googleapis.com
fonts.googleapis.com |
982 B |
0 |
gcube.id
Failed
gcube.id Failed |
|
9 | 5 |
Domain | Requested by | |
---|---|---|
3 | mlbb-claim290.duckdns.org |
mlbb-claim290.duckdns.org
|
2 | fonts.gstatic.com |
fonts.googleapis.com
|
2 | stackpath.bootstrapcdn.com |
mlbb-claim290.duckdns.org
stackpath.bootstrapcdn.com |
1 | fonts.googleapis.com |
mlbb-claim290.duckdns.org
|
0 | gcube.id Failed |
mlbb-claim290.duckdns.org
|
9 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
webmail.mlbb-claim290.duckdns.org R3 |
2021-04-24 - 2021-07-23 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2021-03-01 - 2022-02-28 |
a year | crt.sh |
upload.video.google.com GTS CA 1O1 |
2021-04-13 - 2021-07-06 |
3 months | crt.sh |
*.gstatic.com GTS CA 1O1 |
2021-03-23 - 2021-06-15 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://mlbb-claim290.duckdns.org/login/facebook/
Frame ID: 4E2089CDEE1D4B07C0A6209422B18DE0
Requests: 9 HTTP requests in this frame
Screenshot
Detected technologies
LiteSpeed (Web Servers) ExpandDetected patterns
- headers server /^LiteSpeed$/i
Font Awesome (Font Scripts) Expand
Detected patterns
- html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
9 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
mlbb-claim290.duckdns.org/login/facebook/ |
2 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
style.css
mlbb-claim290.duckdns.org/login/facebook/css/ |
4 KB 1012 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font-awesome.min.css
stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/ |
30 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
fb.png
mlbb-claim290.duckdns.org/login/facebook/img/ |
28 KB 28 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
mobile-legends-app-icon.png
gcube.id/wp-content/uploads/2017/11/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
11 KB 982 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v27/ |
15 KB 15 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
fontawesome-webfont.woff2
stackpath.bootstrapcdn.com/font-awesome/4.7.0/fonts/ |
75 KB 76 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v27/ |
15 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- gcube.id
- URL
- https://gcube.id/wp-content/uploads/2017/11/mobile-legends-app-icon.png
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Facebook (Social Network) Generic Gaming (Entertainment)11 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fonts.googleapis.com
fonts.gstatic.com
gcube.id
mlbb-claim290.duckdns.org
stackpath.bootstrapcdn.com
gcube.id
2606:4700::6812:acf
2a00:1450:4001:828::2003
2a00:1450:4001:82f::200a
75.119.136.206
092a3cd5f86b3f039feefdeb86694cd16ae545af214cfda614bdbbe2d1bde401
0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
30d9fa71528fce8bca930a63a1319b40e680cc4eb4fb160093c41499ffd9d182
420b2861d7aed4d6ce84d31d15b3d543cc6d0bad65d643be962e722faed0637d
57bf1b25c56bd3c3819897a990eaa16ba6dce859fe6feeb0edd533318ebddcff
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca