jscjc.duckdns.org Open in urlscan Pro
103.212.135.115 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://jscjc.duckdns.org/Exports/onedrivenew/error.php?email=&source=page.landing_protected&locale=en_US&question_box=v8
Submission Tags: @ipnigh
Submission: On July 25 via api (July 25th 2019, 6:04:31 pm UTC) from GB

Summary HTTP 13 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 13 HTTP transactions. The main IP is 103.212.135.115, located in India and belongs to WEBWERKS-AS-IN Web Werks India Pvt. Ltd., IN. The main domain is jscjc.duckdns.org.
TLS certificate: Issued by cPanel, Inc. Certification Authority on July 24th 2019. Valid for: 3 months.

This is the only time jscjc.duckdns.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: OneDrive (Online)

Domain & IP information

	IP Address	AS Autonomous System
9	103.212.135.115 103.212.135.115	133296 (WEBWERKS-...) (WEBWERKS-AS-IN Web Werks India Pvt. Ltd.)
1	205.185.208.52 205.185.208.52	20446 (HIGHWINDS3) (HIGHWINDS3 - Highwinds Network Group)
2	209.197.3.15 209.197.3.15	20446 (HIGHWINDS3) (HIGHWINDS3 - Highwinds Network Group)
1	2a00:1450:400... 2a00:1450:4001:817::200a	15169 (GOOGLE) (GOOGLE - Google LLC)
13	4

9 103.212.135.115 (India)

ASN133296 (WEBWERKS-AS-IN Web Werks India Pvt. Ltd., IN)
PTR: comforter.objectjob.com

jscjc.duckdns.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 205.185.208.52 (Phoenix, United States)

ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US)
PTR: vip052.ssl.hwcdn.net

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 209.197.3.15 (Phoenix, United States)

ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US)
PTR: vip0x00f.map2.ssl.hwcdn.net

maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:817::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	duckdns.org jscjc.duckdns.org	424 KB
2	bootstrapcdn.com maxcdn.bootstrapcdn.com	29 KB
1	googleapis.com ajax.googleapis.com	30 KB
1	jquery.com code.jquery.com	33 KB
13	4

	Domain	Requested by
9	jscjc.duckdns.org	jscjc.duckdns.org code.jquery.com
2	maxcdn.bootstrapcdn.com	jscjc.duckdns.org
1	ajax.googleapis.com	jscjc.duckdns.org
1	code.jquery.com	jscjc.duckdns.org
13	4

This site contains no links.

Subject Issuer	Validity	Valid
jscjc.duckdns.org cPanel, Inc. Certification Authority	`2019-07-24` - `2019-10-22`	3 months	crt.sh
jquery.org COMODO RSA Domain Validation Secure Server CA	`2018-10-17` - `2020-10-16`	2 years	crt.sh
*.bootstrapcdn.com COMODO RSA Domain Validation Secure Server CA	`2018-10-03` - `2019-10-12`	a year	crt.sh
*.googleapis.com Google Internet Authority G3	`2019-06-18` - `2019-09-10`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://jscjc.duckdns.org/Exports/onedrivenew/error.php?email=&source=page.landing_protected&locale=en_US&question_box=v8
Frame ID: 7411C6006DBA996170C9C58F6A0CDEAF
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
script /(?:\/([\d.]+))?(?:\/js)?\/bootstrap(?:\.min)?\.js/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

13
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

516 kB
Transfer

756 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request error.php Show response
jscjc.duckdns.org/Exports/onedrivenew/ 5 KB
5 KB 3700ms
163ms Document
text/html 103.212.135.115
WEBWERKS-AS-IN We...

General

Check archive.org

Show headers Download Go to

Full URL: https://jscjc.duckdns.org/Exports/onedrivenew/error.php?email=&source=page.landing_protected&locale=en_US&question_box=v8
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.212.135.115 , India, ASN133296 (WEBWERKS-AS-IN Web Werks India Pvt. Ltd., IN),
Reverse DNS: comforter.objectjob.com
Software: Apache /
Resource Hash: 27e0af5fc6afb4b4371dd4632cb9ae3611b6aefe05228b66cc0a05d963a2ad20

Request headers

Host: jscjc.duckdns.org
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36

Response headers

Date: Thu, 25 Jul 2019 18:02:28 GMT
Server: Apache
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK shakeppfl.css
jscjc.duckdns.org/Exports/onedrivenew/jinku/ 6 KB
6 KB 159ms
158ms Stylesheet
text/css 103.212.135.115
WEBWERKS-AS-IN We...

General

Check archive.org

Show headers Download Go to

Full URL: https://jscjc.duckdns.org/Exports/onedrivenew/jinku/shakeppfl.css
Requested by: Host: jscjc.duckdns.org
URL: https://jscjc.duckdns.org/Exports/onedrivenew/error.php?email=&source=page.landing_protected&locale=en_US&question_box=v8
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.212.135.115 , India, ASN133296 (WEBWERKS-AS-IN Web Werks India Pvt. Ltd., IN),
Reverse DNS: comforter.objectjob.com
Software: Apache /
Resource Hash: cde06417c052690cbfb2ece45e40f88bec9d5747649d2dcef209f510a57f13b8

Request headers

Referer: https://jscjc.duckdns.org/Exports/onedrivenew/error.php?email=&source=page.landing_protected&locale=en_US&question_box=v8
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36

Response headers

Date: Thu, 25 Jul 2019 18:02:28 GMT
Last-Modified: Tue, 05 Feb 2019 20:10:52 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 5935

GET
H/1.1 200
OK jquery.min.js Show response
code.jquery.com/ 94 KB
33 KB 1346ms
25ms Script
application/javascript 205.185.208.52
Highwinds Network...

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery.min.js
Requested by: Host: jscjc.duckdns.org
URL: https://jscjc.duckdns.org/Exports/onedrivenew/error.php?email=&source=page.landing_protected&locale=en_US&question_box=v8
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.185.208.52 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS: vip052.ssl.hwcdn.net
Software: nginx /
Resource Hash: 4b940065e2a67c37e3bd02b23c651f4744a3c219aba2d4fb99a631113494d376

Request headers

Referer: https://jscjc.duckdns.org/Exports/onedrivenew/error.php?email=&source=page.landing_protected&locale=en_US&question_box=v8
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36

Response headers

Date: Thu, 25 Jul 2019 18:04:15 GMT
Content-Encoding: gzip
Last-Modified: Fri, 24 Oct 2014 00:16:08 GMT
Server: nginx
ETag: W/"54499a48-1764d"
Vary: Accept-Encoding
X-HW: 1564077855.dop035.am5.shc,1564077855.dop035.am5.t,1564077855.cds018.am5.c
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=315360000, public
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 33226

GET
H/1.1 200
OK jquert7.js Show response
jscjc.duckdns.org/Exports/onedrivenew/jinku/ 85 KB
85 KB 317ms
158ms Script
application/javascript 103.212.135.115
WEBWERKS-AS-IN We...

General

Check archive.org

Show headers Download Go to

Full URL: https://jscjc.duckdns.org/Exports/onedrivenew/jinku/jquert7.js
Requested by: Host: jscjc.duckdns.org
URL: https://jscjc.duckdns.org/Exports/onedrivenew/error.php?email=&source=page.landing_protected&locale=en_US&question_box=v8
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.212.135.115 , India, ASN133296 (WEBWERKS-AS-IN Web Werks India Pvt. Ltd., IN),
Reverse DNS: comforter.objectjob.com
Software: Apache /
Resource Hash: d30b6114fb9496ae46b2a8cdf59379c8ffdb957534bd1dd73e626c7c61c7e67d

Request headers

Referer: https://jscjc.duckdns.org/Exports/onedrivenew/error.php?email=&source=page.landing_protected&locale=en_US&question_box=v8
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36

Response headers

Date: Thu, 25 Jul 2019 18:02:28 GMT
Last-Modified: Mon, 15 Oct 2018 09:34:46 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 86927

GET
H2 200 bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/3.4.0/css/ 119 KB
20 KB 1350ms
24ms Stylesheet
text/css 209.197.3.15
Highwinds Network...

General

Check archive.org

Show headers Download Go to

Full URL: https://maxcdn.bootstrapcdn.com/bootstrap/3.4.0/css/bootstrap.min.css
Requested by: Host: jscjc.duckdns.org
URL: https://jscjc.duckdns.org/Exports/onedrivenew/error.php?email=&source=page.landing_protected&locale=en_US&question_box=v8
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 209.197.3.15 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS: vip0x00f.map2.ssl.hwcdn.net
Software: /
Resource Hash: 1f429f4e2829515fb4ff9b67d875c2d023f08610e15a049ac0976715dd02182a

Request headers

Referer: https://jscjc.duckdns.org/Exports/onedrivenew/error.php?email=&source=page.landing_protected&locale=en_US&question_box=v8
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36

Response headers

date: Thu, 25 Jul 2019 18:04:15 GMT
content-encoding: gzip
last-modified: Fri, 14 Dec 2018 05:14:43 GMT
access-control-allow-origin: *
etag: "1544764483"
vary: Accept-Encoding
x-cache: HIT
content-type: text/css; charset=utf-8
status: 200
cache-control: public, max-age=31536000
x-hello-human: Say hello back! @getBootstrapCDN on Twitter
accept-ranges: bytes
timing-allow-origin: *
content-length: 19736

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.3.1/ 85 KB
30 KB 18ms
6ms Script
text/javascript 2a00:1450:4001:817::200a
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js

Requested by

Host: jscjc.duckdns.org
URL: https://jscjc.duckdns.org/Exports/onedrivenew/error.php?email=&source=page.landing_protected&locale=en_US&question_box=v8

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://jscjc.duckdns.org/Exports/onedrivenew/error.php?email=&source=page.landing_protected&locale=en_US&question_box=v8
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36

Response headers

date: Wed, 19 Jun 2019 20:36:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3101252
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 30399
x-xss-protection: 0
last-modified: Thu, 25 Jan 2018 15:33:24 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 18 Jun 2020 20:36:41 GMT

GET
H2 200 bootstrap.min.js Show response
maxcdn.bootstrapcdn.com/bootstrap/3.4.0/js/ 37 KB
10 KB 1350ms
25ms Script
text/javascript 209.197.3.15
Highwinds Network...

General

Check archive.org

Show headers Download Go to

Full URL: https://maxcdn.bootstrapcdn.com/bootstrap/3.4.0/js/bootstrap.min.js
Requested by: Host: jscjc.duckdns.org
URL: https://jscjc.duckdns.org/Exports/onedrivenew/error.php?email=&source=page.landing_protected&locale=en_US&question_box=v8
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 209.197.3.15 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS: vip0x00f.map2.ssl.hwcdn.net
Software: /
Resource Hash: 909ae563eb34f7e4285a3a643ab5d7c21c5e6a80f3f455b949ac45f08d0389b4

Request headers

Referer: https://jscjc.duckdns.org/Exports/onedrivenew/error.php?email=&source=page.landing_protected&locale=en_US&question_box=v8
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36

Response headers

date: Thu, 25 Jul 2019 18:04:15 GMT
content-encoding: gzip
last-modified: Fri, 14 Dec 2018 05:14:43 GMT
access-control-allow-origin: *
etag: "1544764483"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript; charset=utf-8
status: 200
cache-control: public, max-age=31536000
x-hello-human: Say hello back! @getBootstrapCDN on Twitter
accept-ranges: bytes
timing-allow-origin: *
content-length: 10035

GET
H/1.1 200
OK side2.png
jscjc.duckdns.org/Exports/onedrivenew/jinku/ 52 KB
52 KB 951ms
160ms Image
image/png 103.212.135.115
WEBWERKS-AS-IN We...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jscjc.duckdns.org/Exports/onedrivenew/jinku/side2.png
Requested by: Host: jscjc.duckdns.org
URL: https://jscjc.duckdns.org/Exports/onedrivenew/error.php?email=&source=page.landing_protected&locale=en_US&question_box=v8
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.212.135.115 , India, ASN133296 (WEBWERKS-AS-IN Web Werks India Pvt. Ltd., IN),
Reverse DNS: comforter.objectjob.com
Software: Apache /
Resource Hash: 418019d168be0b2926def4bccd3f573c79489a736cb12b8277ec6ef423819582

Request headers

Referer: https://jscjc.duckdns.org/Exports/onedrivenew/error.php?email=&source=page.landing_protected&locale=en_US&question_box=v8
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36

Response headers

Date: Thu, 25 Jul 2019 18:02:29 GMT
Last-Modified: Tue, 05 Feb 2019 06:10:34 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 53442

GET
H/1.1 200
OK run.png
jscjc.duckdns.org/Exports/onedrivenew/jinku/ 50 KB
50 KB 160ms
159ms Image
image/png 103.212.135.115
WEBWERKS-AS-IN We...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jscjc.duckdns.org/Exports/onedrivenew/jinku/run.png
Requested by: Host: code.jquery.com
URL: https://code.jquery.com/jquery.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.212.135.115 , India, ASN133296 (WEBWERKS-AS-IN Web Werks India Pvt. Ltd., IN),
Reverse DNS: comforter.objectjob.com
Software: Apache /
Resource Hash: 387e2eaa68dbdd9f8e42c82099cdf8a8d594b71e07810f3a7337989023e25770

Request headers

Referer: https://jscjc.duckdns.org/Exports/onedrivenew/jinku/shakeppfl.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36

Response headers

Date: Thu, 25 Jul 2019 18:02:29 GMT
Last-Modified: Tue, 05 Feb 2019 05:12:36 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=96
Content-Length: 51385

GET
H/1.1 200
OK side1.png
jscjc.duckdns.org/Exports/onedrivenew/jinku/ 49 KB
49 KB 455ms
151ms Image
image/png 103.212.135.115
WEBWERKS-AS-IN We...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jscjc.duckdns.org/Exports/onedrivenew/jinku/side1.png
Requested by: Host: code.jquery.com
URL: https://code.jquery.com/jquery.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.212.135.115 , India, ASN133296 (WEBWERKS-AS-IN Web Werks India Pvt. Ltd., IN),
Reverse DNS: comforter.objectjob.com
Software: Apache /
Resource Hash: b8953f2ea0efd62e46e65782785223b47e185e90b076fd5f35659be1498061af

Request headers

Referer: https://jscjc.duckdns.org/Exports/onedrivenew/jinku/shakeppfl.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36

Response headers

Date: Thu, 25 Jul 2019 18:02:30 GMT
Last-Modified: Tue, 05 Feb 2019 05:16:30 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 50416

GET
H/1.1 200
OK side3.png
jscjc.duckdns.org/Exports/onedrivenew/jinku/ 73 KB
73 KB 482ms
161ms Image
image/png 103.212.135.115
WEBWERKS-AS-IN We...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jscjc.duckdns.org/Exports/onedrivenew/jinku/side3.png
Requested by: Host: code.jquery.com
URL: https://code.jquery.com/jquery.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.212.135.115 , India, ASN133296 (WEBWERKS-AS-IN Web Werks India Pvt. Ltd., IN),
Reverse DNS: comforter.objectjob.com
Software: Apache /
Resource Hash: 9d65a2723cb391bb30084a73addd71eed842868db177658892af4c4f0d864258

Request headers

Referer: https://jscjc.duckdns.org/Exports/onedrivenew/jinku/shakeppfl.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36

Response headers

Date: Thu, 25 Jul 2019 18:02:30 GMT
Last-Modified: Tue, 05 Feb 2019 05:30:38 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=95
Content-Length: 74635

GET
H/1.1 200
OK side4.png
jscjc.duckdns.org/Exports/onedrivenew/jinku/ 52 KB
52 KB 804ms
159ms Image
image/png 103.212.135.115
WEBWERKS-AS-IN We...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jscjc.duckdns.org/Exports/onedrivenew/jinku/side4.png
Requested by: Host: code.jquery.com
URL: https://code.jquery.com/jquery.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.212.135.115 , India, ASN133296 (WEBWERKS-AS-IN Web Werks India Pvt. Ltd., IN),
Reverse DNS: comforter.objectjob.com
Software: Apache /
Resource Hash: e9b4fe843eda020b02e3cc8298903e9b3e64c96e5e88307ab07ae666681a396e

Request headers

Referer: https://jscjc.duckdns.org/Exports/onedrivenew/jinku/shakeppfl.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36

Response headers

Date: Thu, 25 Jul 2019 18:02:30 GMT
Last-Modified: Tue, 05 Feb 2019 06:16:12 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=94
Content-Length: 53179

GET
H/1.1 200
OK soide1.png
jscjc.duckdns.org/Exports/onedrivenew/jinku/ 50 KB
50 KB 910ms
151ms Image
image/png 103.212.135.115
WEBWERKS-AS-IN We...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jscjc.duckdns.org/Exports/onedrivenew/jinku/soide1.png
Requested by: Host: code.jquery.com
URL: https://code.jquery.com/jquery.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.212.135.115 , India, ASN133296 (WEBWERKS-AS-IN Web Werks India Pvt. Ltd., IN),
Reverse DNS: comforter.objectjob.com
Software: Apache /
Resource Hash: ba637cdcb265213c86f775d0e251aa33ea0dc87507ff978f98ecbc3d6b916253

Request headers

Referer: https://jscjc.duckdns.org/Exports/onedrivenew/jinku/shakeppfl.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36

Response headers

Date: Thu, 25 Jul 2019 18:02:30 GMT
Last-Modified: Tue, 05 Feb 2019 06:48:32 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 50714

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: OneDrive (Online)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
code.jquery.com
jscjc.duckdns.org
maxcdn.bootstrapcdn.com
103.212.135.115
205.185.208.52
209.197.3.15
2a00:1450:4001:817::200a
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
1f429f4e2829515fb4ff9b67d875c2d023f08610e15a049ac0976715dd02182a
27e0af5fc6afb4b4371dd4632cb9ae3611b6aefe05228b66cc0a05d963a2ad20
387e2eaa68dbdd9f8e42c82099cdf8a8d594b71e07810f3a7337989023e25770
418019d168be0b2926def4bccd3f573c79489a736cb12b8277ec6ef423819582
4b940065e2a67c37e3bd02b23c651f4744a3c219aba2d4fb99a631113494d376
909ae563eb34f7e4285a3a643ab5d7c21c5e6a80f3f455b949ac45f08d0389b4
9d65a2723cb391bb30084a73addd71eed842868db177658892af4c4f0d864258
b8953f2ea0efd62e46e65782785223b47e185e90b076fd5f35659be1498061af
ba637cdcb265213c86f775d0e251aa33ea0dc87507ff978f98ecbc3d6b916253
cde06417c052690cbfb2ece45e40f88bec9d5747649d2dcef209f510a57f13b8
d30b6114fb9496ae46b2a8cdf59379c8ffdb957534bd1dd73e626c7c61c7e67d
e9b4fe843eda020b02e3cc8298903e9b3e64c96e5e88307ab07ae666681a396e

jscjc.duckdns.org Open in urlscan Pro 103.212.135.115 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

13 Requests

100 %HTTPS

25 %IPv6

4 Domains

4 Subdomains

4 IPs

3 Countries

516 kBTransfer

756 kBSize

0 Cookies

0 Outgoing links

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

0 Cookies

Indicators

jscjc.duckdns.org Open in urlscan Pro
103.212.135.115 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

516 kB
Transfer

756 kB
Size

0
Cookies

13 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!