intl-servicelimited-accountverify.duckdns.org
Open in
urlscan Pro
150.109.113.54
Malicious Activity!
Public Scan
Effective URL: https://intl-servicelimited-accountverify.duckdns.org/myaccount/?key=47c005cc3e875e0e222bf9dd1e3a11bc8298a49d
Submission Tags: phishing malicious Search All
Submission: On November 18 via api from US
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on November 18th 2020. Valid for: 3 months.
This is the only time intl-servicelimited-accountverify.duckdns.org was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: PayPal (Financial)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 2607:f8b0:400... 2607:f8b0:4003:c0a::79 | 15169 (GOOGLE) (GOOGLE) | |
16 | 151.101.194.133 151.101.194.133 | 54113 (FASTLY) (FASTLY) | |
1 | 172.217.16.194 172.217.16.194 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:820::200a | 15169 (GOOGLE) (GOOGLE) | |
2 | 99.86.2.47 99.86.2.47 | 16509 (AMAZON-02) (AMAZON-02) | |
1 5 | 150.109.113.54 150.109.113.54 | 132203 (TENCENT-N...) (TENCENT-NET-AP-CN Tencent Building) | |
3 | 52.85.47.119 52.85.47.119 | 16509 (AMAZON-02) (AMAZON-02) | |
30 | 7 |
ASN15169 (GOOGLE, US)
PTR: fra16s08-in-f194.1e100.net
www.googleadservices.com |
ASN16509 (AMAZON-02, US)
PTR: server-99-86-2-47.fra6.r.cloudfront.net
analytics.linktr.ee |
ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN)
intl-servicelimited-accountverify.duckdns.org |
ASN16509 (AMAZON-02, US)
PTR: server-52-85-47-119.hel50.r.cloudfront.net
i.linktr.ee |
Apex Domain Subdomains |
Transfer | |
---|---|---|
21 |
linktr.ee
linktr.ee analytics.linktr.ee i.linktr.ee |
773 KB |
5 |
duckdns.org
1 redirects
intl-servicelimited-accountverify.duckdns.org |
109 KB |
1 |
googleapis.com
fonts.googleapis.com |
512 B |
1 |
googleadservices.com
www.googleadservices.com |
12 KB |
1 |
yellowbasee.com
1 redirects
uey486281.yellowbasee.com |
224 B |
30 | 5 |
Domain | Requested by | |
---|---|---|
16 | linktr.ee |
linktr.ee
|
5 | intl-servicelimited-accountverify.duckdns.org |
1 redirects
linktr.ee
intl-servicelimited-accountverify.duckdns.org |
3 | i.linktr.ee |
linktr.ee
|
2 | analytics.linktr.ee |
linktr.ee
|
1 | fonts.googleapis.com |
linktr.ee
|
1 | www.googleadservices.com |
linktr.ee
|
1 | uey486281.yellowbasee.com | 1 redirects |
30 | 7 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.paypal.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
linktr.ee Let's Encrypt Authority X3 |
2020-09-29 - 2020-12-28 |
3 months | crt.sh |
www.googleadservices.com GTS CA 1O1 |
2020-10-28 - 2021-01-20 |
3 months | crt.sh |
upload.video.google.com GTS CA 1O1 |
2020-10-28 - 2021-01-20 |
3 months | crt.sh |
analytics.linktr.ee Amazon |
2020-02-29 - 2021-03-29 |
a year | crt.sh |
intl-servicelimited-accountverify.duckdns.org cPanel, Inc. Certification Authority |
2020-11-18 - 2021-02-16 |
3 months | crt.sh |
i.linktr.ee Amazon |
2020-09-01 - 2021-10-01 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://intl-servicelimited-accountverify.duckdns.org/myaccount/?key=47c005cc3e875e0e222bf9dd1e3a11bc8298a49d
Frame ID: CC7E6F93425D32B9C79ABA2579D9F435
Requests: 26 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://uey486281.yellowbasee.com/
HTTP 302
https://linktr.ee/flojwatkins Page URL
- https://intl-servicelimited-accountverify.duckdns.org/?jett666 Page URL
-
https://intl-servicelimited-accountverify.duckdns.org/myaccount?key=47c005cc3e875e0e222bf9dd1e3a11bc8298a49d
HTTP 301
https://intl-servicelimited-accountverify.duckdns.org/myaccount/?key=47c005cc3e875e0e222bf9dd1e3a11bc8298a49d Page URL
Detected technologies
Nginx (Web Servers) ExpandDetected patterns
- headers server /nginx(?:\/([\d.]+))?/i
Varnish (Cache Tools) Expand
Detected patterns
- headers via /varnish(?: \(Varnish\/([\d.]+)\))?/i
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: manage your cookies
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://uey486281.yellowbasee.com/
HTTP 302
https://linktr.ee/flojwatkins Page URL
- https://intl-servicelimited-accountverify.duckdns.org/?jett666 Page URL
-
https://intl-servicelimited-accountverify.duckdns.org/myaccount?key=47c005cc3e875e0e222bf9dd1e3a11bc8298a49d
HTTP 301
https://intl-servicelimited-accountverify.duckdns.org/myaccount/?key=47c005cc3e875e0e222bf9dd1e3a11bc8298a49d Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://uey486281.yellowbasee.com/ HTTP 302
- https://linktr.ee/flojwatkins
30 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
flojwatkins
linktr.ee/ Redirect Chain
|
11 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
9c222da8fca3c5e9a882f8fefb924baa18ce1de1_CSS.af1f508a.chunk.css
linktr.ee/_next/static/css/ |
20 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
_app.js
linktr.ee/_next/static/DUWZZ6qqj1nAL8ybaesdE/pages/ |
1 KB 947 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
%5Bprofile%5D.js
linktr.ee/_next/static/DUWZZ6qqj1nAL8ybaesdE/pages/ |
7 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
webpack-6ef28db84b4c42ad34e9.js
linktr.ee/_next/static/runtime/ |
1 KB 959 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
framework.8293b41d86da2f0201a3.js
linktr.ee/_next/static/chunks/ |
137 KB 45 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
commons.a2d313fdf1fe3659cd29.js
linktr.ee/_next/static/chunks/ |
428 KB 123 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1440fbad0e90089b012a17381523a21a22e2bbee.796d287e187d762acebb.js
linktr.ee/_next/static/chunks/ |
30 KB 12 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
5ff9b1efc949c6dce4dea1b184e49b2267b8a3cb.6d815db3086d9933c66c.js
linktr.ee/_next/static/chunks/ |
17 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main-c2c69c55796a17c6796c.js
linktr.ee/_next/static/runtime/ |
17 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
4674618e.4ad7d42d9ea6c7f2fc02.js
linktr.ee/_next/static/chunks/ |
76 KB 28 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
37aee9ee.f7b2fbbbb44a2d1eb1b3.js
linktr.ee/_next/static/chunks/ |
238 KB 58 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
9c222da8fca3c5e9a882f8fefb924baa18ce1de1.0d8a4ba8c69c6373dbe9.js
linktr.ee/_next/static/chunks/ |
1 MB 481 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
9c222da8fca3c5e9a882f8fefb924baa18ce1de1_CSS.244c3afbbfc751a1196f.js
linktr.ee/_next/static/chunks/ |
61 B 262 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
conversion_async.js
www.googleadservices.com/pagead/ |
30 KB 12 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
1 KB 512 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
_buildManifest.js
linktr.ee/_next/static/DUWZZ6qqj1nAL8ybaesdE/ |
557 B 759 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
_ssgManifest.js
linktr.ee/_next/static/DUWZZ6qqj1nAL8ybaesdE/ |
76 B 520 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H2 |
51939459
analytics.linktr.ee/api/links/ |
0 0 |
Other
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
51939459
analytics.linktr.ee/api/links/ |
16 B 404 B |
XHR
application/body |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Cookie set
/
intl-servicelimited-accountverify.duckdns.org/ |
159 B 540 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
xnby97bf32bv
i.linktr.ee/api/ |
78 B 465 B |
XHR
application/body |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H2 |
xnby97bf32bv
i.linktr.ee/api/ |
0 0 |
Other
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H2 |
xnby97bf32bv
i.linktr.ee/api/ |
0 0 |
Other
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST |
xnby97bf32bv
i.linktr.ee/api/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST |
6b91c293babd40bc97240dc78286e9993387655c
analytics.linktr.ee/api/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS |
6b91c293babd40bc97240dc78286e9993387655c
analytics.linktr.ee/api/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
/
intl-servicelimited-accountverify.duckdns.org/myaccount/ Redirect Chain
|
9 KB 9 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login.css
intl-servicelimited-accountverify.duckdns.org/myaccount/assets/css/ |
93 KB 94 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
pp-logo.svg
intl-servicelimited-accountverify.duckdns.org/myaccount/assets/img/ |
5 KB 5 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- i.linktr.ee
- URL
- https://i.linktr.ee/api/xnby97bf32bv
- Domain
- analytics.linktr.ee
- URL
- https://analytics.linktr.ee/api/6b91c293babd40bc97240dc78286e9993387655c
- Domain
- analytics.linktr.ee
- URL
- https://analytics.linktr.ee/api/6b91c293babd40bc97240dc78286e9993387655c
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: PayPal (Financial)5 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
intl-servicelimited-accountverify.duckdns.org/ | Name: PHPSESSID Value: 450b9c777e689d89ae8ff463d89a5601 |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=15552000; includeSubDomains |
X-Content-Type-Options | nosniff |
X-Frame-Options | SAMEORIGIN |
X-Xss-Protection | 0 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
analytics.linktr.ee
fonts.googleapis.com
i.linktr.ee
intl-servicelimited-accountverify.duckdns.org
linktr.ee
uey486281.yellowbasee.com
www.googleadservices.com
analytics.linktr.ee
i.linktr.ee
150.109.113.54
151.101.194.133
172.217.16.194
2607:f8b0:4003:c0a::79
2a00:1450:4001:820::200a
52.85.47.119
99.86.2.47
1bb3ae725d6af0f3cd5622336e40568637645f8c76c01cff1f67a8e82fe802a7
30b509528a09195b7a7080345419048fd35269803cdfeab438a98c2176a1d9d0
451b489942ea58e3313b63249dc2bd34aae2015ceba0df9b9a6c29ae33016715
573b4f508831312c28c59d8facf2a098c921e516e71a184dcff642deebcd1131
653f3e53e89b4f8548ff86c19e92bb3c6b84b6be7485a320b1e00893ed877479
68df542ae42ef8a4f960a08064dda153a46f20ce12ce39f5a192f2581a0d9ad7
704aecd16e7caaf79414cdcbad9d0061e37610abb14e538b6b43880fdb31c87b
846bd2506ff67e6fb04c1b886fa912d325ecc49f6a5045e71e2bec59bc843341
918e76d268140f2bb0379e02b657fbd9e2861d4582643889dd6cdca3f07bf126
932461001b08fe8c0404807f92b28f85491241a397be3d6ab638c6b4079355c1
9fbafe17ccf61ea39a66ffc6c9c4d1189b6bf3231dafbde36505105fbd38332f
a7b75f8a7782a7c69f155650c793341028dea8ba1866f3ebcfa40423e9180342
b3cc50b9e94bbecaaeb1079b64b8ca50616d1732824964c1cc2c5422627a0ec5
b7757a91b30a5c7e08d3efa2db7604c0e4283aea9f1469c53101737cb390451f
bf7b0e6fea82ad8b779baff110b9c894f502c8a934b9c955c72a7442887d68aa
c7d9a30e093fafe3334b140328dfccd42719b276ab35af0c92a64f5eb40e83ed
cf97d2326885233c716865867552bf9482fc309dd5f59753fb7c1b6b32990778
d57c33ef1b4efce6d6f694e80ae06f50fadfb98bc7f5ab4a91b08d1dfc3e6d24
e2fbb88b4d15a9f7702ca58ebbe8d1d927ffd2667e585e70a5f3d51acb1a37d2
f9f55da3d08e8a62d3f68516fa14c2b2f5b0d0793a1dde18f7544b22e5e561b5
fbea068f60691fa32a46e4da470e30f3ac1e2934521b7aee137e19ba949bc878
fdd6422076de8adf06570a1ddbe3ab311a63d7cba716c3519f42d04c32c807bb