urlscan.io logo urlscan.io
SecurityTrails logo

2738174849.duckdns.org Open in urlscan Pro
209.145.57.60  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://2738174849.duckdns.org/
Submission: On June 04 via automatic, source openphish
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 3 countries across 4 domains to perform 6 HTTP transactions. The main IP is 209.145.57.60, located in United States and belongs to CONTABO, US. The main domain is 2738174849.duckdns.org.
This is the only time 2738174849.duckdns.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: WhatsApp (Instant Messenger)

Domain & IP information

IP Address AS Autonomous System
4 209.145.57.60 40021 (CONTABO)
1 103.251.44.182 131775 (IDNIC-JAL...)
1 2 2a03:2880:f22... 32934 (FACEBOOK)
6 3
Domain Requested by
4 2738174849.duckdns.org 2738174849.duckdns.org
1 www.whatsapp.com 2738174849.duckdns.org
1 www-cdn.whatsapp.net 1 redirects
1 collection123.serveuser.com 2738174849.duckdns.org
6 4
Subject Issuer Validity Valid
collection123.serveuser.com
cPanel, Inc. Certification Authority		 2021-03-31 -
2021-06-29		 3 months crt.sh
*.whatsapp.net
DigiCert SHA2 High Assurance Server CA		 2021-05-22 -
2021-08-20		 3 months crt.sh

This page contains 1 frames:

Primary Page: http://2738174849.duckdns.org/
Frame ID: C6FCFB2158A13FA220C69DDF4B9EA324
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /^LiteSpeed$/i

Page Statistics

6
Requests

33 %
HTTPS

33 %
IPv6

4
Domains

4
Subdomains

3
IPs

3
Countries

192 kB
Transfer

388 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 2
  • https://www-cdn.whatsapp.net/img/v4/whatsapp-logo.svg?v=46fe27fc8 HTTP 302
  • https://www.whatsapp.com/img/v4/whatsapp-logo.svg

6 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
2738174849.duckdns.org/ 		7 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://2738174849.duckdns.org/
Protocol
HTTP/1.1
Server
209.145.57.60 , United States, ASN40021 (CONTABO, US),
Reverse DNS
vmi602271.contaboserver.net
Software
LiteSpeed /
Resource Hash
98e67c6837645f97fd5cba80d1a389b8dd070a1f4759fec58ae11472b6ad544d

Request headers

Host
2738174849.duckdns.org
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
Content-Length
2016
Content-Encoding
gzip
Vary
Accept-Encoding
Date
Fri, 04 Jun 2021 01:22:28 GMT
Server
LiteSpeed
style.build35e635e635e6.css
2738174849.duckdns.org/css/ 		241 KB
49 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://2738174849.duckdns.org/css/style.build35e635e635e6.css
Requested by
Host: 2738174849.duckdns.org
URL: http://2738174849.duckdns.org/
Protocol
HTTP/1.1
Server
209.145.57.60 , United States, ASN40021 (CONTABO, US),
Reverse DNS
vmi602271.contaboserver.net
Software
LiteSpeed /
Resource Hash
2fb7ba66fb9d7004714c358e7f6be03c55b6957f8993669c5bf11f9692f6d2de

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
2738174849.duckdns.org
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
http://2738174849.duckdns.org/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://2738174849.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Fri, 04 Jun 2021 01:22:28 GMT
Content-Encoding
gzip
Last-Modified
Mon, 02 Nov 2020 09:14:45 GMT
Server
LiteSpeed
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
49391
Expires
Fri, 11 Jun 2021 01:22:28 GMT
file2.js
collection123.serveuser.com/wa/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://collection123.serveuser.com/wa/file2.js
Requested by
Host: 2738174849.duckdns.org
URL: http://2738174849.duckdns.org/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.251.44.182 , Indonesia, ASN131775 (IDNIC-JALANET-AS-ID PT. Jupiter Jala Arta, ID),
Reverse DNS
onslaughtshare.hosterserver.com
Software
/
Resource Hash

Request headers

Referer
http://2738174849.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers
whatsapp-logo.svg
www.whatsapp.com/img/v4/
Redirect Chain
  • https://www-cdn.whatsapp.net/img/v4/whatsapp-logo.svg?v=46fe27fc8
  • https://www.whatsapp.com/img/v4/whatsapp-logo.svg
0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.whatsapp.com/img/v4/whatsapp-logo.svg
Requested by
Host: 2738174849.duckdns.org
URL: http://2738174849.duckdns.org/css/style.build35e635e635e6.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f22d:c5:face:b00c:0:167 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
http://2738174849.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Redirect headers

location
https://www.whatsapp.com/img/v4/whatsapp-logo.svg
date
Fri, 04 Jun 2021 01:22:28 GMT
x-fb-trip-id
1679558926
server
proxygen-bolt
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
0
content-type
text/plain
icon-chat.png
2738174849.duckdns.org/img/v4/ 		20 KB
20 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://2738174849.duckdns.org/img/v4/icon-chat.png
Requested by
Host: 2738174849.duckdns.org
URL: http://2738174849.duckdns.org/css/style.build35e635e635e6.css
Protocol
HTTP/1.1
Server
209.145.57.60 , United States, ASN40021 (CONTABO, US),
Reverse DNS
vmi602271.contaboserver.net
Software
LiteSpeed /
Resource Hash
b6b5990665e9b1e7db462f4f74c4d9517e1e6b315403cdc43150bd26084ea4c4

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
2738174849.duckdns.org
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer
http://2738174849.duckdns.org/css/style.build35e635e635e6.css
Connection
keep-alive
Cache-Control
no-cache
Referer
http://2738174849.duckdns.org/css/style.build35e635e635e6.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Fri, 04 Jun 2021 01:22:28 GMT
Last-Modified
Mon, 02 Nov 2020 09:13:45 GMT
Server
LiteSpeed
Content-Type
image/png
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
20384
Expires
Fri, 11 Jun 2021 01:22:28 GMT
18+.jpg
2738174849.duckdns.org/img/ 		120 KB
121 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://2738174849.duckdns.org/img/18+.jpg
Requested by
Host: 2738174849.duckdns.org
URL: http://2738174849.duckdns.org/
Protocol
HTTP/1.1
Server
209.145.57.60 , United States, ASN40021 (CONTABO, US),
Reverse DNS
vmi602271.contaboserver.net
Software
LiteSpeed /
Resource Hash
3963d75e53a3c5d4d71c2510b4f7d31115fb7e0ec62891d9733c600db0e5ce69

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
2738174849.duckdns.org
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer
http://2738174849.duckdns.org/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://2738174849.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Fri, 04 Jun 2021 01:22:28 GMT
Last-Modified
Fri, 28 May 2021 09:09:22 GMT
Server
LiteSpeed
Content-Type
image/jpeg
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
123213
Expires
Fri, 11 Jun 2021 01:22:28 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: WhatsApp (Instant Messenger)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated

0 Cookies