urlscan.io logo urlscan.io
SecurityTrails logo

asisstservice017.duckdns.org Open in urlscan Pro
104.248.11.28  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://t.sidekickopen84.com/Ctc/2O+23284/d2Mvvc04/Jk82-6q7W5BW0B06lZ3lKW2tj21T2RP62SW6Hr5k-9jf1ByW1fG4Yx6_YSsbW7Djnm-5PQxzdW...
Effective URL: https://asisstservice017.duckdns.org/ca3ed367bb405856c289259fe657b8b9/66284b968bbe66b7e1f59aecd1683200.aspx
Submission: On November 17 via manual from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 6 IPs in 4 countries across 8 domains to perform 9 HTTP transactions. The main IP is 104.248.11.28, located in Clifton, United States and belongs to DIGITALOCEAN-ASN, US. The main domain is asisstservice017.duckdns.org.
TLS certificate: Issued by R3 on November 16th 2022. Valid for: 3 months.
This is the only time asisstservice017.duckdns.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon (Online)

Domain & IP information

IP Address AS Autonomous System
1 2 2606:4700:440... 13335 (CLOUDFLAR...)
1 1 125.209.210.90 23576 (NHN-AS-KR...)
1 2a03:2880:f02... 32934 (FACEBOOK)
1 1 35.244.149.249 15169 (GOOGLE)
1 4 104.248.11.28 14061 (DIGITALOC...)
1 2600:9000:21f... 16509 (AMAZON-02)
1 51.210.3.236 16276 (OVH)
2 2600:9000:21f... 16509 (AMAZON-02)
9 6
2    2606:4700:4400::ac40:96be (United States)

ASN13335 (CLOUDFLARENET, US)
t.sidekickopen84.com
1    125.209.210.90 (Korea, Republic Of)

ASN23576 (NHN-AS-KR NAVER Cloud Corp., KR)
me2.do
1    2a03:2880:f02d:e:face:b00c:0:2 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
l.wl.co
1    35.244.149.249 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 249.149.244.35.bc.googleusercontent.com
lihi2.cc
4    104.248.11.28 (Clifton, United States)

ASN14061 (DIGITALOCEAN-ASN, US)
asisstservice017.duckdns.org
1    2600:9000:21f3:9600:1d:d7f6:39d2:2dc1 (United States)

ASN16509 (AMAZON-02, US)
images-na.ssl-images-amazon.com
1    51.210.3.236 (France)

ASN16276 (OVH, FR)
PTR: ns3172623.ip-51-210-3.eu
i.ibb.co
2    2600:9000:21f3:7c00:1d:d7f6:39d2:2dc1 (United States)

ASN16509 (AMAZON-02, US)
m.media-amazon.com
Apex Domain
Subdomains		 Transfer
4 duckdns.org
asisstservice017.duckdns.org
34 KB
2 media-amazon.com
m.media-amazon.com — Cisco Umbrella Rank: 488
33 KB
2 sidekickopen84.com
t.sidekickopen84.com — Cisco Umbrella Rank: 56516
3 KB
1 ibb.co
i.ibb.co — Cisco Umbrella Rank: 13047
260 KB
1 ssl-images-amazon.com
images-na.ssl-images-amazon.com — Cisco Umbrella Rank: 812
84 KB
1 lihi2.cc
lihi2.cc — Cisco Umbrella Rank: 914970
714 B
1 wl.co
l.wl.co — Cisco Umbrella Rank: 407363
735 B
1 me2.do
me2.do
314 B
9 8
Domain Requested by
4 asisstservice017.duckdns.org 1 redirects l.wl.co
asisstservice017.duckdns.org
2 m.media-amazon.com asisstservice017.duckdns.org
2 t.sidekickopen84.com 1 redirects
1 i.ibb.co asisstservice017.duckdns.org
1 images-na.ssl-images-amazon.com asisstservice017.duckdns.org
1 lihi2.cc 1 redirects
1 l.wl.co t.sidekickopen84.com
1 me2.do 1 redirects
9 8

This site contains no links.

Subject Issuer Validity Valid
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2022-05-27 -
2023-05-27		 a year crt.sh
*.wl.co
DigiCert SHA2 High Assurance Server CA		 2022-08-26 -
2022-11-24		 3 months crt.sh
mail.asisstservice017.duckdns.org
R3		 2022-11-16 -
2023-02-14		 3 months crt.sh
images-na.ssl-images-amazon.com
DigiCert Global CA G2		 2022-10-26 -
2023-10-14		 a year crt.sh
ibb.co
R3		 2022-10-09 -
2023-01-07		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://asisstservice017.duckdns.org/ca3ed367bb405856c289259fe657b8b9/66284b968bbe66b7e1f59aecd1683200.aspx
Frame ID: C28C2F7481FCE6B6E872DD94A05C275F
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Amazon-Anmeldung

Page URL History Show full URLs

  1. https://t.sidekickopen84.com/Ctc/2O+23284/d2Mvvc04/Jk82-6q7W5BW0B06lZ3lKW2tj21T2RP62SW6Hr5k-9jf1ByW1fG4Yx... Page URL
  2. https://t.sidekickopen84.com/events/public/v1/encoded/track/tc/2O+23284/d2Mvvc04/Jk82-6q7W5BW0B06lZ3lKW2t... HTTP 307
    https://me2.do/GmVFvQod HTTP 307
    https://l.wl.co/l?u=https://lihi2.cc/TKxV2 Page URL
  3. https://lihi2.cc/TKxV2 HTTP 302
    https://asisstservice017.duckdns.org/?enco HTTP 302
    https://asisstservice017.duckdns.org/ca3ed367bb405856c289259fe657b8b9/66284b968bbe66b7e1f59aecd1683200.aspx Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.aspx?(?:$|\?)

Page Statistics

9
Requests

100 %
HTTPS

50 %
IPv6

8
Domains

8
Subdomains

6
IPs

4
Countries

415 kB
Transfer

643 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://t.sidekickopen84.com/Ctc/2O+23284/d2Mvvc04/Jk82-6q7W5BW0B06lZ3lKW2tj21T2RP62SW6Hr5k-9jf1ByW1fG4Yx6_YSsbW7Djnm-5PQxzdW8cRGG47cx2d8W29P02f2rcM1dW7ZWvc16fFbj3W1Yn-225DxsRFW8JbcD-7cjPCDVKcZpS7dVjq5W7gvz_Q2kHfHgW3wdhnC3ylCFgW5t2hRc4cF33jW5GwbKr87k6nlW8ZdLHK4YfVpQW3hFSq077h4z8W5Kw_pz74rQ77W7D-NMF8NbJ1Jf7pZcJT04 Page URL
  2. https://t.sidekickopen84.com/events/public/v1/encoded/track/tc/2O+23284/d2Mvvc04/Jk82-6q7W5BW0B06lZ3lKW2tj21T2RP62SW6Hr5k-9jf1ByW1fG4Yx6_YSsbW7Djnm-5PQxzdW8cRGG47cx2d8W29P02f2rcM1dW7ZWvc16fFbj3W1Yn-225DxsRFW8JbcD-7cjPCDVKcZpS7dVjq5W7gvz_Q2kHfHgW3wdhnC3ylCFgW5t2hRc4cF33jW5GwbKr87k6nlW8ZdLHK4YfVpQW3hFSq077h4z8W5Kw_pz74rQ77W7D-NMF8NbJ1Jf7pZcJT04?_ud=dc3c3668-a7b9-4fd4-b3e6-e5b5eacd5ab5&_jss=1&_fl=8&_pl=3&_hc=4&_lg=en-US,en&_plt=Win32&_scr=1600,1200 HTTP 307
    https://me2.do/GmVFvQod HTTP 307
    https://l.wl.co/l?u=https://lihi2.cc/TKxV2 Page URL
  3. https://lihi2.cc/TKxV2 HTTP 302
    https://asisstservice017.duckdns.org/?enco HTTP 302
    https://asisstservice017.duckdns.org/ca3ed367bb405856c289259fe657b8b9/66284b968bbe66b7e1f59aecd1683200.aspx Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1
  • https://t.sidekickopen84.com/events/public/v1/encoded/track/tc/2O+23284/d2Mvvc04/Jk82-6q7W5BW0B06lZ3lKW2tj21T2RP62SW6Hr5k-9jf1ByW1fG4Yx6_YSsbW7Djnm-5PQxzdW8cRGG47cx2d8W29P02f2rcM1dW7ZWvc16fFbj3W1Yn-225DxsRFW8JbcD-7cjPCDVKcZpS7dVjq5W7gvz_Q2kHfHgW3wdhnC3ylCFgW5t2hRc4cF33jW5GwbKr87k6nlW8ZdLHK4YfVpQW3hFSq077h4z8W5Kw_pz74rQ77W7D-NMF8NbJ1Jf7pZcJT04?_ud=dc3c3668-a7b9-4fd4-b3e6-e5b5eacd5ab5&_jss=1&_fl=8&_pl=3&_hc=4&_lg=en-US,en&_plt=Win32&_scr=1600,1200 HTTP 307
  • https://me2.do/GmVFvQod HTTP 307
  • https://l.wl.co/l?u=https://lihi2.cc/TKxV2

9 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Jk82-6q7W5BW0B06lZ3lKW2tj21T2RP62SW6Hr5k-9jf1ByW1fG4Yx6_YSsbW7Djnm-5PQxzdW8cRGG47cx2d8W29P02f2rcM1dW7ZWvc16fFbj3W1Yn-225DxsRFW8JbcD-7cjPCDVKcZpS7dVjq5W7gvz_Q2kHfHgW3wdhnC3ylCFgW5t2hRc4cF33jW5GwbKr8...
t.sidekickopen84.com/Ctc/2O+23284/d2Mvvc04/ 		9 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://t.sidekickopen84.com/Ctc/2O+23284/d2Mvvc04/Jk82-6q7W5BW0B06lZ3lKW2tj21T2RP62SW6Hr5k-9jf1ByW1fG4Yx6_YSsbW7Djnm-5PQxzdW8cRGG47cx2d8W29P02f2rcM1dW7ZWvc16fFbj3W1Yn-225DxsRFW8JbcD-7cjPCDVKcZpS7dVjq5W7gvz_Q2kHfHgW3wdhnC3ylCFgW5t2hRc4cF33jW5GwbKr87k6nlW8ZdLHK4YfVpQW3hFSq077h4z8W5Kw_pz74rQ77W7D-NMF8NbJ1Jf7pZcJT04
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::ac40:96be , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-credentials
false
cf-cache-status
DYNAMIC
cf-ray
76b4a5d2dfcb927f-FRA
content-encoding
gzip
content-type
text/html;charset=utf-8
date
Thu, 17 Nov 2022 01:21:07 GMT
referrer-policy
no-referrer
server
cloudflare
vary
origin
x-hubspot-correlation-id
c470993c-4e26-4c5c-b4cc-c1ffaf5bb07a
x-robots-tag
none
l
l.wl.co/
Redirect Chain
  • https://t.sidekickopen84.com/events/public/v1/encoded/track/tc/2O+23284/d2Mvvc04/Jk82-6q7W5BW0B06lZ3lKW2tj21T2RP62SW6Hr5k-9jf1ByW1fG4Yx6_YSsbW7Djnm-5PQxzdW8cRGG47cx2d8W29P02f2rcM1dW7ZWvc16fFbj3W1Yn...
  • https://me2.do/GmVFvQod
  • https://l.wl.co/l?u=https://lihi2.cc/TKxV2
216 B
735 B 		Document
General
Check archive.org
Download Go to
Full URL
https://l.wl.co/l?u=https://lihi2.cc/TKxV2
Requested by
Host: t.sidekickopen84.com
URL: https://t.sidekickopen84.com/Ctc/2O+23284/d2Mvvc04/Jk82-6q7W5BW0B06lZ3lKW2tj21T2RP62SW6Hr5k-9jf1ByW1fG4Yx6_YSsbW7Djnm-5PQxzdW8cRGG47cx2d8W29P02f2rcM1dW7ZWvc16fFbj3W1Yn-225DxsRFW8JbcD-7cjPCDVKcZpS7dVjq5W7gvz_Q2kHfHgW3wdhnC3ylCFgW5t2hRc4cF33jW5GwbKr87k6nlW8ZdLHK4YfVpQW3hFSq077h4z8W5Kw_pz74rQ77W7D-NMF8NbJ1Jf7pZcJT04
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f02d:e:face:b00c:0:2 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' data: blob: https://*.wl.co https://*.fbcdn.net;block-all-mixed-content;upgrade-insecure-requests;
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://t.sidekickopen84.com/Ctc/2O+23284/d2Mvvc04/Jk82-6q7W5BW0B06lZ3lKW2tj21T2RP62SW6Hr5k-9jf1ByW1fG4Yx6_YSsbW7Djnm-5PQxzdW8cRGG47cx2d8W29P02f2rcM1dW7ZWvc16fFbj3W1Yn-225DxsRFW8JbcD-7cjPCDVKcZpS7dVjq5W7gvz_Q2kHfHgW3wdhnC3ylCFgW5t2hRc4cF33jW5GwbKr87k6nlW8ZdLHK4YfVpQW3hFSq077h4z8W5Kw_pz74rQ77W7D-NMF8NbJ1Jf7pZcJT04
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
private, no-cache, no-store, must-revalidate
content-encoding
br
content-security-policy
default-src 'self' 'unsafe-inline' data: blob: https://*.wl.co https://*.fbcdn.net;block-all-mixed-content;upgrade-insecure-requests;
content-type
text/html; charset="utf-8"
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-resource-policy
rollout
date
Thu, 17 Nov 2022 01:21:08 GMT
document-policy
force-load-at-top
expires
Sat, 01 Jan 2000 00:00:00 GMT
pragma
no-cache
referrer-policy
origin
refresh
1;URL=https://lihi2.cc/TKxV2
vary
Accept-Encoding
x-content-type-options
nosniff
x-fb-debug
u2WXVQG+bOiyvViZ2LDkftGvvzhSERLWBT+z+19qkt81EqwklZzJ//ILtWu70zkwI5Zel/25F/XoKkDqOlmxXA==
x-frame-options
DENY
x-robots-tag
noindex, nofollow
x-xss-protection
0

Redirect headers

Cache-Control
no-cache, no-store, must-revalidate, max-age=0
Connection
close
Content-Length
0
Content-Type
text/html;charset=UTF-8
Date
Thu, 17 Nov 2022 01:21:08 GMT
Location
https://l.wl.co/l?u=https://lihi2.cc/TKxV2
Pragma
No-cache
Referrer-Policy
unsafe-url
Server
Apache
Primary Request 66284b968bbe66b7e1f59aecd1683200.aspx
asisstservice017.duckdns.org/ca3ed367bb405856c289259fe657b8b9/
Redirect Chain
  • https://lihi2.cc/TKxV2
  • https://asisstservice017.duckdns.org/?enco
  • https://asisstservice017.duckdns.org/ca3ed367bb405856c289259fe657b8b9/66284b968bbe66b7e1f59aecd1683200.aspx
7 KB
7 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://asisstservice017.duckdns.org/ca3ed367bb405856c289259fe657b8b9/66284b968bbe66b7e1f59aecd1683200.aspx
Requested by
Host: l.wl.co
URL: https://l.wl.co/l?u=https://lihi2.cc/TKxV2
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
104.248.11.28 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache /
Resource Hash
a3bc64197ef3ff2a47f3044f3944d31a745491c65e5b431b8e24394c45625445

Request headers

Referer
https://l.wl.co/l?u=https://lihi2.cc/TKxV2
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Cache-Control
no-store, no-cache, must-revalidate
Connection
Keep-Alive
Content-Type
text/html;charset=UTF-8
Date
Thu, 17 Nov 2022 01:21:09 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive
timeout=5, max=99
Pragma
no-cache
Server
Apache
Transfer-Encoding
chunked

Redirect headers

Cache-Control
no-store, no-cache, must-revalidate
Connection
Keep-Alive
Content-Length
0
Content-Type
text/html; charset=UTF-8
Date
Thu, 17 Nov 2022 01:21:09 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive
timeout=5, max=100
Location
./ca3ed367bb405856c289259fe657b8b9/66284b968bbe66b7e1f59aecd1683200.aspx
Pragma
no-cache
Server
Apache
asset@css_desktop1.css
asisstservice017.duckdns.org/ca3ed367bb405856c289259fe657b8b9/ 		12 KB
12 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://asisstservice017.duckdns.org/ca3ed367bb405856c289259fe657b8b9/asset@css_desktop1.css
Requested by
Host: asisstservice017.duckdns.org
URL: https://asisstservice017.duckdns.org/ca3ed367bb405856c289259fe657b8b9/66284b968bbe66b7e1f59aecd1683200.aspx
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
104.248.11.28 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache /
Resource Hash
2a119e867b8b5ead33ef9986f78181dee0a23efaba9a094192ef7e060583a95e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://asisstservice017.duckdns.org/ca3ed367bb405856c289259fe657b8b9/66284b968bbe66b7e1f59aecd1683200.aspx
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 17 Nov 2022 01:21:09 GMT
Server
Apache
Transfer-Encoding
chunked
Content-Type
text/css;charset=UTF-8
Cache-Control
no-store, no-cache, must-revalidate
Connection
Keep-Alive
Keep-Alive
timeout=5, max=98
Expires
Thu, 19 Nov 1981 08:52:00 GMT
asset@js_desktop1.js
asisstservice017.duckdns.org/ca3ed367bb405856c289259fe657b8b9/ 		14 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://asisstservice017.duckdns.org/ca3ed367bb405856c289259fe657b8b9/asset@js_desktop1.js
Requested by
Host: asisstservice017.duckdns.org
URL: https://asisstservice017.duckdns.org/ca3ed367bb405856c289259fe657b8b9/66284b968bbe66b7e1f59aecd1683200.aspx
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
104.248.11.28 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache /
Resource Hash
e900470f72fe43136df67b8fd87a8422a6d7f0f98332bd3907f901aac2cc4d5c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://asisstservice017.duckdns.org/ca3ed367bb405856c289259fe657b8b9/66284b968bbe66b7e1f59aecd1683200.aspx
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 17 Nov 2022 01:21:09 GMT
Server
Apache
Transfer-Encoding
chunked
Content-Type
text/javascript;charset=UTF-8
Cache-Control
no-store, no-cache, must-revalidate
Connection
Keep-Alive
Keep-Alive
timeout=5, max=97
Expires
Thu, 19 Nov 1981 08:52:00 GMT
61-6nKPKyWL._RC%7C11Y+5x+kkTL.js,51KMV3Cz2XL.js,31x4ENTlVIL.js,31f4+QIEeqL.js,01N6xzIJxbL.js,518BI433aLL.js,01rpauTep4L.js,31QZSjMuoeL.js,61ofwvddDeL.js,01KsMxlPtzL.js_.js
images-na.ssl-images-amazon.com/images/I/ 		309 KB
84 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://images-na.ssl-images-amazon.com/images/I/61-6nKPKyWL._RC%7C11Y+5x+kkTL.js,51KMV3Cz2XL.js,31x4ENTlVIL.js,31f4+QIEeqL.js,01N6xzIJxbL.js,518BI433aLL.js,01rpauTep4L.js,31QZSjMuoeL.js,61ofwvddDeL.js,01KsMxlPtzL.js_.js?AUIClients/AmazonUI
Requested by
Host: asisstservice017.duckdns.org
URL: https://asisstservice017.duckdns.org/ca3ed367bb405856c289259fe657b8b9/asset@js_desktop1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21f3:9600:1d:d7f6:39d2:2dc1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
512aeeb05776eb3c904600e0e3f7fb30c511841c12764b54af96319ce8e925a4

Request headers

Referer
https://asisstservice017.duckdns.org/
Origin
https://asisstservice017.duckdns.org
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date
Sun, 09 Oct 2022 16:02:13 GMT
content-encoding
br
via
1.1 debe291145dc27044f50d04bac101cd8.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C2
age
3316737
edge-cache-tag
x-cache-774,/images/I/61-6nKPKyWL
x-cache
Hit from cloudfront
x-nginx-cache-status
HIT
surrogate-key
x-cache-774 /images/I/61-6nKPKyWL
last-modified
Thu, 12 Sep 2019 21:14:10 GMT
server
Server
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=630720000,public
x-amz-ir-id
1e370625-c998-4754-8fbb-776fd40a1cf5
timing-allow-origin
https://www.amazon.in, https://www.amazon.com
x-amz-cf-id
hG8DWnFFnIe0p_LRy6Q5_5Kx1hWzQPvXJjZzn3zBZeg_o35p58wecA==
expires
Fri, 03 Oct 2042 09:07:53 GMT
Bgn-Vcheb-DR5-Ds4h.png
i.ibb.co/cTHnq49/ 		259 KB
260 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.ibb.co/cTHnq49/Bgn-Vcheb-DR5-Ds4h.png
Requested by
Host: asisstservice017.duckdns.org
URL: https://asisstservice017.duckdns.org/ca3ed367bb405856c289259fe657b8b9/asset@css_desktop1.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
51.210.3.236 , France, ASN16276 (OVH, FR),
Reverse DNS
ns3172623.ip-51-210-3.eu
Software
nginx /
Resource Hash
8cd259ed040281a419452769d540f30d8f3814f00ddc59081fd606595a8ea1df

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://asisstservice017.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date
Thu, 17 Nov 2022 01:21:10 GMT
last-modified
Mon, 06 Sep 2021 17:39:09 GMT
server
nginx
access-control-allow-methods
GET, OPTIONS
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
265634
expires
Thu, 31 Dec 2037 23:55:55 GMT
pDxWAF1pBB0dzGB.woff2
m.media-amazon.com/images/S/sash/ 		16 KB
17 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://m.media-amazon.com/images/S/sash/pDxWAF1pBB0dzGB.woff2
Requested by
Host: asisstservice017.duckdns.org
URL: https://asisstservice017.duckdns.org/ca3ed367bb405856c289259fe657b8b9/asset@css_desktop1.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21f3:7c00:1d:d7f6:39d2:2dc1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
013d1dc68fadda651c773b6deb153e3e8b4dd612fb2af70db48c87af7808d1e7

Request headers

Referer
https://asisstservice017.duckdns.org/
Origin
https://asisstservice017.duckdns.org
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date
Tue, 30 Aug 2022 08:13:13 GMT
via
1.1 2afacc6ad96dbba3f0b477cd95f16458.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C2
age
6800877
edge-cache-tag
x-cache-428,/images/S/sash/pDxWAF1pBB0dzGB
x-cache
Hit from cloudfront
x-nginx-cache-status
HIT
content-length
16616
surrogate-key
x-cache-428 /images/S/sash/pDxWAF1pBB0dzGB
last-modified
Fri, 30 Oct 2020 21:19:16 GMT
server
Server
content-type
application/font-woff2; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=630720000,public
x-amz-ir-id
775f18a0-6b9b-4da0-a219-c5787bc3ed58
accept-ranges
bytes
timing-allow-origin
https://www.amazon.in, https://www.amazon.com
x-amz-cf-id
IXg02FeBmHVVJfq0_kD31BjPRWGceiCkEoP1JrMXj_DcZKqkAmHIbw==
expires
Thu, 07 Aug 2042 23:04:31 GMT
KFPk-9IF4FqAqY-.woff2
m.media-amazon.com/images/S/sash/ 		16 KB
17 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://m.media-amazon.com/images/S/sash/KFPk-9IF4FqAqY-.woff2
Requested by
Host: asisstservice017.duckdns.org
URL: https://asisstservice017.duckdns.org/ca3ed367bb405856c289259fe657b8b9/asset@css_desktop1.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21f3:7c00:1d:d7f6:39d2:2dc1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
0eef431cee18b1dc43636dd2a7703b7c0ce9f6bdbad9f280b7313d0ded232327

Request headers

Referer
https://asisstservice017.duckdns.org/
Origin
https://asisstservice017.duckdns.org
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date
Sun, 04 Sep 2022 13:45:02 GMT
via
1.1 2afacc6ad96dbba3f0b477cd95f16458.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C2
age
6348968
edge-cache-tag
x-cache-821,/images/S/sash/KFPk-9IF4FqAqY-
x-cache
Hit from cloudfront
x-nginx-cache-status
HIT
content-length
16460
surrogate-key
x-cache-821 /images/S/sash/KFPk-9IF4FqAqY-
last-modified
Fri, 30 Oct 2020 21:19:26 GMT
server
Server
content-type
application/font-woff2; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=630720000,public
x-amz-ir-id
104fd2d6-0e1a-4fd2-bf34-5851e1b3953b
accept-ranges
bytes
timing-allow-origin
https://www.amazon.in, https://www.amazon.com
x-amz-cf-id
qVL69voHfQgIR-ytFuHsYs6J1tbQsBXW2jhsQClP4cELiKeELEk5hQ==
expires
Sat, 15 Mar 2042 23:40:19 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| jQuery164005874469687057249

3 Cookies

Domain/Path Name / Value
lihi2.cc/ Name: redirect_id
Value: eyJpdiI6IkRoY0R1RUVubTZDdkxTTWJxM3Y2ZkE9PSIsInZhbHVlIjoidmVMZHBZSHBcL2VGSnM5TEw2Z2xSRlo1b2FmQmhoWkh1VWI3NmlaVEc4MmZyM1ZsT0NyNW43N2xFZGxqVGtPXC9VIiwibWFjIjoiNjFjZTc1NTU2NmM5YTRhNTVkZmFhYWEzNjc3YmI2NWYzMTY2YzI0NTc4ZjFjZTZhOTNmNjA1MjgzMmNmMDkyMyJ9
lihi2.cc/ Name: lihi_session
Value: eyJpdiI6IkpNcjhkbitSSDR5RVZZc3p4cE5hSGc9PSIsInZhbHVlIjoiZU84V2pVbzZ3bWF3Y1N0dmhXRzRUTkdFSE9VRmVjQ2hcL1wvcFo1ekRHUEhhY2NKNzhVSDh6WUljZHlaYTB2ZjhtIiwibWFjIjoiN2QxYWQ5YTZlZmIxYTE3Mjg0OTU1NTUwNWJjYTk1MGM3ZjQyNGE1OGU3MmNjZGYxNDA5OTJmNjQzZTc1MWFiMCJ9
asisstservice017.duckdns.org/ Name: PHPSESSID
Value: 67601f310cc6b3897045c7327714a89c