tncsgodemos.ddns.net
Open in
urlscan Pro
51.38.32.202
Public Scan
URL:
https://tncsgodemos.ddns.net/
Submission Tags: phishingrod
Submission: On June 05 via api from DE — Scanned from FR
Submission Tags: phishingrod
Submission: On June 05 via api from DE — Scanned from FR
Summary
This website contacted 2 IPs
in 2 countries
across 2 domains to perform 6 HTTP transactions.
The main IP is 51.38.32.202, located in
Paris, France and
belongs to OVH, FR.
The main domain is tncsgodemos.ddns.net.
TLS certificate: Issued by R3 on June 5th 2023. Valid for: 3 months.
This is the only time tncsgodemos.ddns.net was scanned on urlscan.io!
TLS certificate: Issued by R3 on June 5th 2023. Valid for: 3 months.
This is the only time tncsgodemos.ddns.net was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 2 | 51.38.32.202 51.38.32.202 | 16276 (OVH) (OVH) | |
| 4 | 2a02:4780:dea... 2a02:4780:dead:f1ed::1 | 204915 (AWEX) (AWEX) | |
| 6 | 2 |
2
51.38.32.202
(Paris, France)
ASN16276 (OVH, FR)
PTR: vps-379de73e.vps.ovh.net
ASN16276 (OVH, FR)
PTR: vps-379de73e.vps.ovh.net
| tncsgodemos.ddns.net |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 4 |
000webhostapp.com
csgodemoscdn.000webhostapp.com |
824 KB |
| 2 |
ddns.net
tncsgodemos.ddns.net |
3 KB |
| 6 | 2 |
| Domain | Requested by | |
|---|---|---|
| 4 | csgodemoscdn.000webhostapp.com |
tncsgodemos.ddns.net
csgodemoscdn.000webhostapp.com |
| 2 | tncsgodemos.ddns.net |
csgodemoscdn.000webhostapp.com
|
| 6 | 2 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| steamcommunity.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| tncsgodemos.ddns.net R3 |
2023-06-05 - 2023-09-03 |
3 months | crt.sh |
| *.000webhostapp.com RapidSSL Global TLS RSA4096 SHA256 2022 CA1 |
2022-08-04 - 2023-07-10 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://tncsgodemos.ddns.net/
Frame ID: F5ADAD0073189903586BC774AA333380
Requests: 6 HTTP requests in this frame
Screenshot
Page Title
CS:GO Demos ManagerDetected technologies
Bootstrap
(Web Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
URL: https://steamcommunity.com/id/noxianwill/
Title: nox
Title: nox
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
6 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
/
tncsgodemos.ddns.net/ |
6 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bootstrap.min.css
csgodemoscdn.000webhostapp.com/ |
152 KB 29 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
style.css
csgodemoscdn.000webhostapp.com/ |
2 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery.min.js
csgodemoscdn.000webhostapp.com/ |
91 KB 38 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
background.jpg
csgodemoscdn.000webhostapp.com/ |
755 KB 757 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
/
tncsgodemos.ddns.net/ |
48 B 115 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
6 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| onbeforetoggle object| onscrollend function| $ function| jQuery object| jQuery182035300109035333780 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
csgodemoscdn.000webhostapp.com
tncsgodemos.ddns.net
2a02:4780:dead:f1ed::1
51.38.32.202
01964268e8c2d51dc7a7faff84e3e85ee2ce34246ae152c2bb86dd72eedd33d0
286bbeb3bae579d15574c4bfd14f4df9cb0483005180e8b3eda0b5f7f3f8ed6f
66d90e5e13ae94c17031290690e477df30e56e72eff21a0c8e102bebc80aaea2
73333850ffcd31008bd6b44dd464086a58f664a1c99a82af1b187cb2f3efd7fd
765b5ef04fa9a863e959030674e48f6cef3c28f6aad1dc448c1e17a3ae1867ab
ae576713bc196098f7438dede6ff1f835a23291c32b745ad7e6fb6db809a719b