urlscan.io logo urlscan.io
SecurityTrails logo

servicecsamz224.duckdns.org Open in urlscan Pro
206.189.45.87  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://googleads.g.doubleclick.net/pcs/click?xai=AKAOjsvfG-7ngPewlrotzy0L9jgkGeVDIo7OeZz3kOZNLpTjofqspgzkcyCDAO_JxomC_GGys_gMT9iiA1...
Effective URL: https://servicecsamz224.duckdns.org/?pandora
Submission Tags: phishing
Submission: On January 30 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 3 countries across 5 domains to perform 3 HTTP transactions. The main IP is 206.189.45.87, located in Singapore, Singapore and belongs to DIGITALOCEAN-ASN, US. The main domain is servicecsamz224.duckdns.org.
TLS certificate: Issued by R3 on January 24th 2024. Valid for: 3 months.
This is the only time servicecsamz224.duckdns.org was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 2a00:1450:400... 15169 (GOOGLE)
1 1 2a06:98c1:3120:: 13335 (CLOUDFLAR...)
1 206.189.45.87 14061 (DIGITALOC...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 1 2a05:d014:58f... 16509 (AMAZON-02)
1 2a05:d014:275... 16509 (AMAZON-02)
3 3
1    2a00:1450:4001:813::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
googleads.g.doubleclick.net
1    2a06:98c1:3120:: (United States)

ASN13335 (CLOUDFLARENET, US)
lihi.cc
1    206.189.45.87 (Singapore, Singapore)

ASN14061 (DIGITALOCEAN-ASN, US)
servicecsamz224.duckdns.org
1    2606:4700::6811:190e (United States)

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
1    2a05:d014:58f:6200::64 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
www.mattboldt.com
1    2a05:d014:275:cb02::c8 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
mattboldt.com
Apex Domain
Subdomains		 Transfer
2 mattboldt.com
www.mattboldt.com
mattboldt.com
3 KB
1 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 225
27 KB
1 duckdns.org
servicecsamz224.duckdns.org
5 KB
1 lihi.cc
lihi.cc — Cisco Umbrella Rank: 703127
1005 B
1 doubleclick.net
googleads.g.doubleclick.net — Cisco Umbrella Rank: 38
648 B
3 5
Domain Requested by
1 mattboldt.com servicecsamz224.duckdns.org
1 www.mattboldt.com 1 redirects
1 cdnjs.cloudflare.com servicecsamz224.duckdns.org
1 servicecsamz224.duckdns.org
1 lihi.cc 1 redirects
1 googleads.g.doubleclick.net 1 redirects
3 6

This site contains no links.

Subject Issuer Validity Valid
cpanel.servicecsamz224.duckdns.org
R3		 2024-01-24 -
2024-04-23		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2023-07-03 -
2024-07-02		 a year crt.sh

This page contains 1 frames:

Primary Page: https://servicecsamz224.duckdns.org/?pandora
Frame ID: 83130C3D247B0ECC2A296A1146DEC114
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://googleads.g.doubleclick.net/pcs/click?xai=AKAOjsvfG-7ngPewlrotzy0L9jgkGeVDIo7OeZz3kOZNLpTjofqspgzkcyCDAO... HTTP 302
    https://lihi.cc/CI6Nl?=5 HTTP 302
    https://servicecsamz224.duckdns.org/?pandora Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

3
Requests

67 %
HTTPS

83 %
IPv6

5
Domains

6
Subdomains

3
IPs

3
Countries

35 kB
Transfer

98 kB
Size

4
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://googleads.g.doubleclick.net/pcs/click?xai=AKAOjsvfG-7ngPewlrotzy0L9jgkGeVDIo7OeZz3kOZNLpTjofqspgzkcyCDAO_JxomC_GGys_gMT9iiA1eximZsnGm9CP75sJnJ3WojVKhB7o1VXCHcE9GRJaWV40iJbfvMPNyM1oaxsdxMKubGRKrEgcKqqnixFGlG71btt8NM4V8sFickRvREKIIw0qELAc_zYk-91XCqP3rShcKz9rEyirghOgkK3RZ1rEUFwNhrpOOc9PDgX3K4XEl1lDTmNboZxfWVexcU_9-faVqKM62gYoTRkV8Dg065scjFXQIaD-McSohqr6NG8D68jxGl4O0DtP0zMpDn6LQRFwBYfWRgC5HdP-h9y72PTwpHzRYilSWhJKka4l7kOnC5n4s89OOMhEWbZ7GlitL3MvtCDf92Y0mk1PuhjIlOqwBP&sai=AMfl-YS17WS1tsmufrMuzWrssk0Fm1aOY4Ovw3sOv2XCTQHRfzftY10i58pdp8aQaF0UNV57umFXAOIViRV93vP6_3wJw5VOmZoERgitf2IfRNb3xaY&sig=Cg0ArKJSzEFGB1vdX2he&fbs_aeid=%5Bgw_fbsaeid%5D&adurl=https%3A%2F%2Flihi.cc%2FCI6Nl?=5&nx=122&ny=-189&mb=2?=40514425! HTTP 302
    https://lihi.cc/CI6Nl?=5 HTTP 302
    https://servicecsamz224.duckdns.org/?pandora Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1
  • https://www.mattboldt.com/demos/typed-js/js/typed.custom.js HTTP 301
  • https://mattboldt.com/demos/typed-js/js/typed.custom.js

3 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
servicecsamz224.duckdns.org/
Redirect Chain
  • https://googleads.g.doubleclick.net/pcs/click?xai=AKAOjsvfG-7ngPewlrotzy0L9jgkGeVDIo7OeZz3kOZNLpTjofqspgzkcyCDAO_JxomC_GGys_gMT9iiA1eximZsnGm9CP75sJnJ3WojVKhB7o1VXCHcE9GRJaWV40iJbfvMPNyM1oaxsdxMKub...
  • https://lihi.cc/CI6Nl?=5
  • https://servicecsamz224.duckdns.org/?pandora
4 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://servicecsamz224.duckdns.org/?pandora
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
206.189.45.87 Singapore, Singapore, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache /
Resource Hash
f4ae8b77a1a0839c2d9b5e4fa2851f9d5ca3c8a4d31f562409db37db65bda66a

Request headers

Upgrade-Insecure-Requests
1
User-Agent
ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)
accept-language
de-DE,de;q=0.9

Response headers

Cache-Control
no-store, no-cache, must-revalidate
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
Date
Tue, 30 Jan 2024 16:07:50 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive
timeout=5, max=100
Pragma
no-cache
Server
Apache
Transfer-Encoding
chunked

Redirect headers

alt-svc
h3=":443"; ma=86400
cache-control
no-cache, private
cf-cache-status
DYNAMIC
cf-ray
84daf84be97d4d3a-FRA
content-type
text/html; charset=UTF-8
date
Tue, 30 Jan 2024 16:07:48 GMT
location
https://servicecsamz224.duckdns.org/?pandora
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LjmGCddJRozsCIXFU0BKpxMwmpwiPFrDrro%2BY4eOfzUpRLqe%2B7584q5cN78HEf1u6xmAwkrzG8EeEc5vWPwsgndBczUL%2FPIN9shF4fKkwZQZqxsCkIlEcVN1Bx7%2BpJVPXrJ8JT6K"}],"group":"cf-nel","max_age":604800}
server
cloudflare
via
1.1 google
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/2.1.3/ 		82 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.3/jquery.min.js
Requested by
Host: servicecsamz224.duckdns.org
URL: https://servicecsamz224.duckdns.org/?pandora
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2051d61446d4dbffb03727031022a08c84528ab44d203a7669c101e5fbdd5515
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://servicecsamz224.duckdns.org/
User-Agent
ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

date
Tue, 30 Jan 2024 16:07:50 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
4805901
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
26660
last-modified
Mon, 04 May 2020 16:11:48 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03ec4-14983"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=S%2BrJ0g4ulnjx6HQf64vfNkQ7leqTPjp3EEJlnRyQtBKY4gAPCtcU6EmmAacgQf18SAp8bWzcZ5veN%2FKsBukDV3S8QiDa2ojGXAZ4YZU9yg9zioduYSfmst1U30Mb4k9nu6IgLU0bK0CWfJbH%2FqWr3wSw"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
84daf85bfa159205-FRA
expires
Sun, 19 Jan 2025 16:07:50 GMT
typed.custom.js
mattboldt.com/demos/typed-js/js/
Redirect Chain
  • https://www.mattboldt.com/demos/typed-js/js/typed.custom.js
  • https://mattboldt.com/demos/typed-js/js/typed.custom.js
12 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://mattboldt.com/demos/typed-js/js/typed.custom.js
Requested by
Host: servicecsamz224.duckdns.org
URL: https://servicecsamz224.duckdns.org/?pandora
Protocol
H2
Server
2a05:d014:275:cb02::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Netlify /
Resource Hash
bce3c0af770357084d2f4d1117fd066e0d78f2a76d8d605f8c32bad5d0f11c95
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://servicecsamz224.duckdns.org/
User-Agent
ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

x-nf-request-id
01HNDJ0XG2FT1P1Z9AEY5JNRSG
date
Tue, 30 Jan 2024 16:07:50 GMT
content-encoding
br
strict-transport-security
max-age=31536000
server
Netlify
age
10425
cache-status
"Netlify Edge"; hit
etag
"b8b13ca4fe8e66c608bb8c10a342eb18-ssl-df"
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
cache-control
public,max-age=0,must-revalidate
accept-ranges
bytes
content-length
3125

Redirect headers

location
https://mattboldt.com/demos/typed-js/js/typed.custom.js
x-nf-request-id
01HNDJ0XBWE768P6EBS227PRJT
date
Tue, 30 Jan 2024 16:07:50 GMT
strict-transport-security
max-age=31536000
server
Netlify
content-length
70
content-type
text/plain; charset=utf-8

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery function| runScripts

4 Cookies

Domain/Path Name / Value
.doubleclick.net/ Name: IDE
Value: AHWqTUnRgKlyPuciEJTUep3emeXctPHaxR7AGLXD1-K3hhx41C7_b5NmnS7WDHoRTM0
lihi.cc/ Name: redirect_id
Value: eyJpdiI6IktEcTVIcCtvcElvVXdYXC8yVU1hSEZBPT0iLCJ2YWx1ZSI6IjBkRktPYkhaOG1RNVpwZlgrQnF4VHV5N3krU0w1YmRjYVN2Z2tnWEZSb3lyUmZTOWVUdXExSXBGYktTeEtiNkkiLCJtYWMiOiIxMTM4ODMzMTAyN2EzN2JiYTE2MTRmZDE2YWIxYzQ2ZWViNjAwMzdkNDQ1ZWM0YzY1YTE3ZDMwNjcxZTJlNWJkIn0%3D
lihi.cc/ Name: lihi_session
Value: eyJpdiI6ImcwcmdoQnA5aE55dWhnODJEbkthS2c9PSIsInZhbHVlIjoiVHZSY0RIT21jRXorT003ek5cL1VNQVQ4Z2MwWTNDQTJaVFpKWEp0Y1REXC9DZHc1RTl1MzRqNERYTHAzYUlrbG1pIiwibWFjIjoiZDUzNDFhMzE3YmIyODMyOTc4M2Q5MWRlNWRiNzllZjZmZmUwODY0Njg5YzE1MDBmM2Y3NDAzYWExMTczZGJiZCJ9
servicecsamz224.duckdns.org/ Name: PHPSESSID
Value: 96ad5a38aed005394dd8d2717ccb6f72

1 Console Messages

Source Level URL
Text
network error URL: https://servicecsamz224.duckdns.org/?pandora
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)