URL: https://captcha.afy.duckdns.org/
Submission Tags: phishingrod
Submission: On June 28 via api from DE — Scanned from DE

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 3 HTTP transactions. The main IP is 95.70.183.127, located in Istanbul, Turkey and belongs to ASTURKNET, TR. The main domain is captcha.afy.duckdns.org.
TLS certificate: Issued by on April 13th 2023. Valid for: a month.
This is the only time captcha.afy.duckdns.org was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
3 95.70.183.127 12735 (ASTURKNET)
3 1
Apex Domain
Subdomains
Transfer
3 duckdns.org
captcha.afy.duckdns.org
5 KB
3 1
Domain Requested by
3 captcha.afy.duckdns.org captcha.afy.duckdns.org
3 1

This site contains no links.

Subject Issuer Validity Valid

2023-04-13 -
2023-05-13
a month crt.sh

This page contains 1 frames:

Primary Page: https://captcha.afy.duckdns.org/
Frame ID: EED534B2258B17C5BB319E0B3B4382A2
Requests: 3 HTTP requests in this frame

Screenshot

Page Title

bingus-files

Page Statistics

3
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

5 kB
Transfer

4 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
captcha.afy.duckdns.org/
4 KB
4 KB
Document
General
Full URL
https://captcha.afy.duckdns.org/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.70.183.127 Istanbul, Turkey, ASN12735 (ASTURKNET, TR),
Reverse DNS
127.183.70.95.static.turk.net
Software
lighttpd/1.4.59 / Express
Resource Hash
bc8e3ed94e88a03773742ae439231929f906a413f629d40b1aa374aa5407adcc

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-length
3979
content-type
text/html; charset=utf-8
date
Wed, 28 Jun 2023 19:58:00 GMT
etag
W/"f8b-UxjnXQkpknSsWr7h5yetYtjictI"
server
lighttpd/1.4.59
x-powered-by
Express
style.css
captcha.afy.duckdns.org/
281 B
397 B
Stylesheet
General
Full URL
https://captcha.afy.duckdns.org/style.css
Requested by
Host: captcha.afy.duckdns.org
URL: https://captcha.afy.duckdns.org/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.70.183.127 Istanbul, Turkey, ASN12735 (ASTURKNET, TR),
Reverse DNS
127.183.70.95.static.turk.net
Software
lighttpd/1.4.59 / Express
Resource Hash
e7a92c4bc1433fc797f330162608c2883929afdc2a297e2ccc7586c5e8936395

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://captcha.afy.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Wed, 28 Jun 2023 19:58:00 GMT
last-modified
Sat, 01 Apr 2023 09:39:24 GMT
server
lighttpd/1.4.59
x-powered-by
Express
etag
W/"119-1873c2f9833"
content-type
text/css; charset=UTF-8
cache-control
public, max-age=0
accept-ranges
bytes
content-length
281
stats
captcha.afy.duckdns.org/
87 B
177 B
Fetch
General
Full URL
https://captcha.afy.duckdns.org/stats
Requested by
Host: captcha.afy.duckdns.org
URL: https://captcha.afy.duckdns.org/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.70.183.127 Istanbul, Turkey, ASN12735 (ASTURKNET, TR),
Reverse DNS
127.183.70.95.static.turk.net
Software
lighttpd/1.4.59 / Express
Resource Hash
5bf5852abf668104afa4a44f9a66939c016e5b406c697d68ed194f58333c3358

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://captcha.afy.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Wed, 28 Jun 2023 19:58:00 GMT
server
lighttpd/1.4.59
x-powered-by
Express
content-length
87
etag
W/"57-IuGTontvmPIVUoeDRQnC5kDdU8I"
content-type
application/json; charset=utf-8

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| onbeforetoggle object| onscrollend function| loadStats

0 Cookies

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

captcha.afy.duckdns.org
95.70.183.127
5bf5852abf668104afa4a44f9a66939c016e5b406c697d68ed194f58333c3358
bc8e3ed94e88a03773742ae439231929f906a413f629d40b1aa374aa5407adcc
e7a92c4bc1433fc797f330162608c2883929afdc2a297e2ccc7586c5e8936395