yyyhcgfhvjby.duckdns.org Open in urlscan Pro
165.227.14.3  Malicious Activity! Public Scan

Submitted URL: http://tastytasty.ee.realpro.lt/g/?email=info@apple.com
Effective URL: http://yyyhcgfhvjby.duckdns.org/z/home.php?cid=2327&utm_term=2327&utm_campaign=login&utm_medium=help-and-learn&utm_source=login_...
Submission Tags: @jcybersec_
Submission: On June 16 via api from GB

Summary

This website contacted 5 IPs in 3 countries across 4 domains to perform 5 HTTP transactions. The main IP is 165.227.14.3, located in Santa Clara, United States and belongs to DIGITALOCEAN-ASN, US. The main domain is yyyhcgfhvjby.duckdns.org.
This is the only time yyyhcgfhvjby.duckdns.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Outlook Web Access (Online)

Live information

Domain & IP information

IP Address AS Autonomous System
1 3 176.223.143.106 62282 (RACKRAY U...)
1 151.101.65.187 54113 (FASTLY)
1 51.178.88.195 16276 (OVH)
1 2 165.227.14.3 14061 (DIGITALOC...)
5 5
Apex Domain
Subdomains
Transfer
3 realpro.lt
tastytasty.ee.realpro.lt
9 KB
2 duckdns.org
yyyhcgfhvjby.duckdns.org
20 KB
1 ibb.co
i.ibb.co
2 KB
1 luna1.co
luna1.co
17 KB
5 4
Domain Requested by
3 tastytasty.ee.realpro.lt 1 redirects tastytasty.ee.realpro.lt
2 yyyhcgfhvjby.duckdns.org 1 redirects
1 i.ibb.co tastytasty.ee.realpro.lt
1 luna1.co tastytasty.ee.realpro.lt
5 4

This site contains no links.

Subject Issuer Validity Valid
w.ssl.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3
2020-04-19 -
2021-04-20
a year crt.sh
ibb.co
Let's Encrypt Authority X3
2020-05-28 -
2020-08-26
3 months crt.sh

This page contains 1 frames:

Primary Page: http://yyyhcgfhvjby.duckdns.org/z/home.php?cid=2327&utm_term=2327&utm_campaign=login&utm_medium=help-and-learn&utm_source=login_frontend_hosting&utm_content=flyin&id=aW5mb0BhcHBsZS5jb20=
Frame ID: 4A8E818E73B77FFC074A77A8444ADCC2
Requests: 9 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. http://tastytasty.ee.realpro.lt/g/?email=info@apple.com Page URL
  2. http://yyyhcgfhvjby.duckdns.org/z/index.php?email=info@apple.com HTTP 302
    http://yyyhcgfhvjby.duckdns.org/z/home.php?cid=2327&utm_term=2327&utm_campaign=login&utm_medium=help-and-lea... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /Ubuntu/i

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

5
Requests

40 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

5
IPs

3
Countries

47 kB
Transfer

122 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://tastytasty.ee.realpro.lt/g/?email=info@apple.com Page URL
  2. http://yyyhcgfhvjby.duckdns.org/z/index.php?email=info@apple.com HTTP 302
    http://yyyhcgfhvjby.duckdns.org/z/home.php?cid=2327&utm_term=2327&utm_campaign=login&utm_medium=help-and-learn&utm_source=login_frontend_hosting&utm_content=flyin&id=aW5mb0BhcHBsZS5jb20= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1
  • http://tastytasty.ee.realpro.lt/g/asset/sendspace.css HTTP 301
  • http://tastytasty.ee.realpro.lt/g/asset/sendspace.css/

5 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
/
tastytasty.ee.realpro.lt/g/
798 B
685 B
Document
General
Full URL
http://tastytasty.ee.realpro.lt/g/?email=info@apple.com
Protocol
HTTP/1.1
Server
176.223.143.106 Vilnius, Lithuania, ASN62282 (RACKRAY UAB Rakrejus, LT),
Reverse DNS
711566.s.dedikuoti.lt
Software
Apache/2.4.18 (Ubuntu) /
Resource Hash
529fc49f567751976969a006d5abffa711e906b9cf5f7da7dbec4dcb2b23fb2e

Request headers

Host
tastytasty.ee.realpro.lt
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 16 Jun 2020 10:44:38 GMT
Server
Apache/2.4.18 (Ubuntu)
Vary
Accept-Encoding
Content-Encoding
gzip
Content-Length
433
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
/
tastytasty.ee.realpro.lt/g/asset/sendspace.css/
Redirect Chain
  • http://tastytasty.ee.realpro.lt/g/asset/sendspace.css
  • http://tastytasty.ee.realpro.lt/g/asset/sendspace.css/
30 KB
8 KB
Stylesheet
General
Full URL
http://tastytasty.ee.realpro.lt/g/asset/sendspace.css/
Requested by
Host: tastytasty.ee.realpro.lt
URL: http://tastytasty.ee.realpro.lt/g/?email=info@apple.com
Protocol
HTTP/1.1
Server
176.223.143.106 Vilnius, Lithuania, ASN62282 (RACKRAY UAB Rakrejus, LT),
Reverse DNS
711566.s.dedikuoti.lt
Software
Apache/2.4.18 (Ubuntu) /
Resource Hash
3e6ed50f6a91f00d1707b0da2ad4f4d05581533632d5c57e1af7f8c17fbe5af0

Request headers

Referer
http://tastytasty.ee.realpro.lt/g/?email=info@apple.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 16 Jun 2020 10:44:38 GMT
Content-Encoding
gzip
Server
Apache/2.4.18 (Ubuntu)
Vary
Accept-Encoding
Content-Type
text/html; charset=UTF-8
Connection
Keep-Alive
Link
<http://tastytasty.ee.realpro.lt/index.php?rest_route=/>; rel="https://api.w.org/", <http://tastytasty.ee.realpro.lt/>; rel=shortlink
Content-Length
7588
Keep-Alive
timeout=5, max=98

Redirect headers

Date
Tue, 16 Jun 2020 10:44:38 GMT
Server
Apache/2.4.18 (Ubuntu)
X-Redirect-By
WordPress
Content-Type
text/html; charset=UTF-8
Location
http://tastytasty.ee.realpro.lt/g/asset/sendspace.css/
Connection
Keep-Alive
Keep-Alive
timeout=5, max=99
Content-Length
0
6e6990.png
luna1.co/
17 KB
17 KB
Image
General
Full URL
https://luna1.co/6e6990.png
Requested by
Host: tastytasty.ee.realpro.lt
URL: http://tastytasty.ee.realpro.lt/g/?email=info@apple.com
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.65.187 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
e66f59461c3e4a1c3de07d2864a5038e3dbc33edbde685f57de9e562da0da91d

Request headers

Referer
http://tastytasty.ee.realpro.lt/g/?email=info@apple.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 16 Jun 2020 10:44:38 GMT
via
1.1 varnish
age
19073187
x-cache
HIT
status
200
content-length
17469
x-amz-id-2
wDF61GtLw6K0Ks7n0N0p9QKSgblrGR+92jFVHrZYVaGO7F/6/kHKeCP0LQLiYGRPgtUMWV4Y7qQ=
x-served-by
cache-hhn4071-HHN
last-modified
Wed, 18 Apr 2018 22:33:48 GMT
server
AmazonS3
x-timer
S1592304278.402491,VS0,VE1
etag
"43558fe7d6a3cdc302cbccbadda23713"
x-amz-request-id
A893F4FE3E6E23B5
access-control-allow-origin
*
cache-control
max-age=31556926
accept-ranges
bytes
content-type
image/png
x-cache-hits
1
load.gif
i.ibb.co/zN3pfMY/
2 KB
2 KB
Image
General
Full URL
https://i.ibb.co/zN3pfMY/load.gif
Requested by
Host: tastytasty.ee.realpro.lt
URL: http://tastytasty.ee.realpro.lt/g/?email=info@apple.com
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
51.178.88.195 , France, ASN16276 (OVH, FR),
Reverse DNS
i.ibb.co
Software
nginx /
Resource Hash
cfb365099ae602f8e7994580e16d7cdc2349275b0b7e70fd283bf21905813b00

Request headers

Referer
http://tastytasty.ee.realpro.lt/g/?email=info@apple.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 16 Jun 2020 10:44:38 GMT
last-modified
Mon, 25 Feb 2019 11:35:42 GMT
server
nginx
status
200
access-control-allow-methods
GET, OPTIONS
content-type
image/gif
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
1560
expires
Thu, 31 Dec 2037 23:55:55 GMT
Primary Request home.php
yyyhcgfhvjby.duckdns.org/z/
Redirect Chain
  • http://yyyhcgfhvjby.duckdns.org/z/index.php?email=info@apple.com
  • http://yyyhcgfhvjby.duckdns.org/z/home.php?cid=2327&utm_term=2327&utm_campaign=login&utm_medium=help-and-learn&utm_source=login_frontend_hosting&utm_content=flyin&id=aW5mb0BhcHBsZS5jb20=
41 KB
19 KB
Document
General
Full URL
http://yyyhcgfhvjby.duckdns.org/z/home.php?cid=2327&utm_term=2327&utm_campaign=login&utm_medium=help-and-learn&utm_source=login_frontend_hosting&utm_content=flyin&id=aW5mb0BhcHBsZS5jb20=
Protocol
HTTP/1.1
Server
165.227.14.3 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
bizcloud-abmakky.duckdns.org
Software
nginx / PHP/7.4.7RC1
Resource Hash
8dc9c3dbc24927e51e66ec291b984d91cc369886d0cfd07b69ba4c28cae56b1b

Request headers

Host
yyyhcgfhvjby.duckdns.org
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer
http://tastytasty.ee.realpro.lt/g/?email=info@apple.com
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Cookie
PHPSESSID=3urkih89gl60ft994203pm9ig2
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
http://tastytasty.ee.realpro.lt/g/?email=info@apple.com

Response headers

Server
nginx
Date
Tue, 16 Jun 2020 10:44:39 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Keep-Alive
timeout=60
Vary
Accept-Encoding
X-Powered-By
PHP/7.4.7RC1
Content-Encoding
gzip

Redirect headers

Server
nginx
Date
Tue, 16 Jun 2020 10:44:39 GMT
Content-Type
text/html; charset=UTF-8
Content-Length
1
Connection
keep-alive
Keep-Alive
timeout=60
X-Powered-By
PHP/7.4.7RC1
Set-Cookie
PHPSESSID=3urkih89gl60ft994203pm9ig2; path=/
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control
no-store, no-cache, must-revalidate
Pragma
no-cache
Location
home.php?cid=2327&utm_term=2327&utm_campaign=login&utm_medium=help-and-learn&utm_source=login_frontend_hosting&utm_content=flyin&id=aW5mb0BhcHBsZS5jb20=
truncated
/
20 KB
0
Stylesheet
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
379765ab31aed2e0d3cdef473f0c2a3f0ee46391724fc7a8024e901c261cdcba

Request headers

Referer
http://yyyhcgfhvjby.duckdns.org/z/home.php?cid=2327&utm_term=2327&utm_campaign=login&utm_medium=help-and-learn&utm_source=login_frontend_hosting&utm_content=flyin&id=aW5mb0BhcHBsZS5jb20=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
text/css
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png
truncated
/
8 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a7c14ee84d81a536a4cd54e3a144f388f2174a4a5c409ae118ea49f0da6b4aa6

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png
truncated
/
1 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Outlook Web Access (Online)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate

1 Cookies

Domain/Path Name / Value
yyyhcgfhvjby.duckdns.org/ Name: PHPSESSID
Value: 3urkih89gl60ft994203pm9ig2