vvpaylqghx.duckdns.org
Open in
urlscan Pro
141.98.216.126
Malicious Activity!
Public Scan
URL:
http://vvpaylqghx.duckdns.org/
Submission: On November 25 via manual from GB
Submission: On November 25 via manual from GB
Summary
This website contacted 1 IPs
in 1 countries
across 1 domains to perform 7 HTTP transactions.
The main IP is 141.98.216.126, located in
United States and
belongs to DEDIPATH-LLC, US.
The main domain is vvpaylqghx.duckdns.org.
This is the only time vvpaylqghx.duckdns.org was scanned on urlscan.io!
This is the only time vvpaylqghx.duckdns.org was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Naver (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 7 | 141.98.216.126 141.98.216.126 | 35913 (DEDIPATH-LLC) (DEDIPATH-LLC) | |
| 7 | 1 |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 7 |
duckdns.org
vvpaylqghx.duckdns.org |
303 KB |
| 7 | 1 |
| Domain | Requested by | |
|---|---|---|
| 7 | vvpaylqghx.duckdns.org |
vvpaylqghx.duckdns.org
|
| 7 | 1 |
This site contains no links.
| Subject Issuer | Validity | Valid |
|---|
This page contains 1 frames:
Primary Page:
http://vvpaylqghx.duckdns.org/
Frame ID: 021C85E317E2FA54747B6FB849F46C35
Requests: 7 HTTP requests in this frame
Screenshot
Detected technologies
Windows Server
(Operating Systems)
Expand
Overall confidence: 50%
Detected patterns
Detected patterns
- headers server /^Kestrel/i
Microsoft ASP.NET
(Web Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /^Kestrel/i
Kestrel
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /^Kestrel/i
IIS
(Web Servers)
Expand
Overall confidence: 50%
Detected patterns
Detected patterns
- headers server /^Kestrel/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
/
vvpaylqghx.duckdns.org/ |
8 KB 8 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
w_20200707.css
vvpaylqghx.duckdns.org/css/ |
90 KB 90 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bvsd.1.3.4.min.js
vvpaylqghx.duckdns.org/js/ |
94 KB 94 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
default200417.js
vvpaylqghx.duckdns.org/js/ |
2 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
sp_u_skip.png
vvpaylqghx.duckdns.org/images/ |
967 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
pc_sp_login_190522.png
vvpaylqghx.duckdns.org/images/ |
88 KB 89 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
pc_qr_once.png
vvpaylqghx.duckdns.org/images/ |
18 KB 18 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Naver (Online)10 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| trustedTypes boolean| crossOriginIsolated object| __core-js_shared__ object| __sofabfp_registry object| sofa undefined| pwElement function| nolink0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
vvpaylqghx.duckdns.org
141.98.216.126
18646bcf187a14e4e07d42074365ba07dc98278ffa0dfc06389a379145d7aede
63d35e03b6583709f1326f90939025deb7ac744a55f7dd90069744ecb9efaf0f
67bef5d26af42c5a7842ecd98bf3df205cf8de0270802b34a2380de4eb517d46
8a071a70196749dfd8f829c4a46441fb3bfe376e014d7e17db8f6afd01845aa2
9b90a891455ececd09f30c1943bc587b1fb168588ac0a6ce4e39c5da71083ba8
b273657638e8b7e43fd5d9b06ac27a4ef8a8ad9150ef6a3d1fb26afaa67167ca
b283bd73dfa96ff9bbae95734e91f369d1f825b83c37860a993eabb75ea99ebc