noinc.duckdns.org Open in urlscan Pro
54.234.170.249 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://noinc.duckdns.org/
Submission: On March 16 via automatic, source openphish (March 16th 2022, 1:22:04 am UTC) — Scanned from DE

Summary HTTP 11 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 3 domains to perform 11 HTTP transactions. The main IP is 54.234.170.249, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is noinc.duckdns.org.

This is the only time noinc.duckdns.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Chase (Banking)

Domain & IP information

	IP Address	AS Autonomous System
9	54.234.170.249 54.234.170.249	14618 (AMAZON-AES) (AMAZON-AES)
1	209.99.40.222 209.99.40.222	() ()
1	2.16.186.163 2.16.186.163	() ()
11	3

9 54.234.170.249 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-234-170-249.compute-1.amazonaws.com

noinc.duckdns.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 209.99.40.222 (None, )

ASN- ()

daebakpop.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.16.186.163 (None, )

ASN- ()

static.chasecdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	duckdns.org noinc.duckdns.org	555 KB
1	chasecdn.com static.chasecdn.com	247 KB
1	daebakpop.com daebakpop.com
11	3

	Domain	Requested by
9	noinc.duckdns.org	noinc.duckdns.org
1	static.chasecdn.com	noinc.duckdns.org
1	daebakpop.com	noinc.duckdns.org
11	3

This site contains no links.

Subject Issuer	Validity	Valid
daebakpop.com ZeroSSL ECC Domain Secure Site CA	`2022-03-09` - `2022-06-07`	3 months	crt.sh
static.chasecdn.com Entrust Certification Authority - L1M	`2021-10-22` - `2022-10-22`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://noinc.duckdns.org/
Frame ID: 5203F7F8D036BC4FCEF546F9A3F6DAE2
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign in - chase.com

Page Statistics

11
Requests

18 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

802 kB
Transfer

800 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
noinc.duckdns.org/ 14 KB
14 KB 262ms
100ms Document
text/html 54.234.170.249
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: http://noinc.duckdns.org/
Protocol: HTTP/1.1
Server: 54.234.170.249 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-234-170-249.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 606a5e22bb0e82b90ab032b98c11a8a905a0325e1c16fd4b6b4cb61bf448cf09

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

Date: Wed, 16 Mar 2022 01:21:55 GMT
Server: Apache
Last-Modified: Tue, 15 Mar 2022 17:06:10 GMT
Accept-Ranges: bytes
Content-Length: 14440
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html

GET
H/1.1 200
OK logon.css
noinc.duckdns.org/assets/web/2022/logon/assets/ 107 KB
108 KB 414ms
337ms Stylesheet
text/css 54.234.170.249
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: http://noinc.duckdns.org/assets/web/2022/logon/assets/logon.css
Requested by: Host: noinc.duckdns.org
URL: http://noinc.duckdns.org/
Protocol: HTTP/1.1
Server: 54.234.170.249 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-234-170-249.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 9d74a838c6dc6ef97b503a4aea8067b1651dcea1040783c481cdfc15e83b41dc

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://noinc.duckdns.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Wed, 16 Mar 2022 01:21:55 GMT
Last-Modified: Sun, 15 Apr 2018 04:15:14 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 110037

GET
H/1.1 200
OK blue-ui.css
noinc.duckdns.org/assets/web/2022/common/assets/ 380 KB
380 KB 198ms
99ms Stylesheet
text/css 54.234.170.249
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: http://noinc.duckdns.org/assets/web/2022/common/assets/blue-ui.css
Requested by: Host: noinc.duckdns.org
URL: http://noinc.duckdns.org/
Protocol: HTTP/1.1
Server: 54.234.170.249 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-234-170-249.compute-1.amazonaws.com
Software: Apache /
Resource Hash: e93833c14491ef399441c665587b8c356800b76add8759c4f314ab410b993b9c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://noinc.duckdns.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Wed, 16 Mar 2022 01:21:55 GMT
Last-Modified: Sun, 15 Apr 2018 03:59:06 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 388954

GET
H/1.1 200
OK cart,jpg
daebakpop.com/ 0
0 6918ms
4638ms Stylesheet
text/html 209.99.40.222

General

Check archive.org

Show headers Download Go to

Full URL: https://daebakpop.com/cart,jpg
Requested by: Host: noinc.duckdns.org
URL: http://noinc.duckdns.org/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 209.99.40.222 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://noinc.duckdns.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

GET
H/1.1 200
OK wordmark-white.svg
noinc.duckdns.org/assets/web/2022/common/assets/img/logos/ 1 KB
2 KB 100ms
99ms Image
image/svg+xml 54.234.170.249
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://noinc.duckdns.org/assets/web/2022/common/assets/img/logos/wordmark-white.svg
Requested by: Host: noinc.duckdns.org
URL: http://noinc.duckdns.org/assets/web/2022/logon/assets/logon.css
Protocol: HTTP/1.1
Server: 54.234.170.249 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-234-170-249.compute-1.amazonaws.com
Software: Apache /
Resource Hash: d3bf9c143e5e360da41736b1d4e833b5ac6b6f7093ddc91ffc538233a78488d0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://noinc.duckdns.org/assets/web/2022/logon/assets/logon.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Wed, 16 Mar 2022 01:21:59 GMT
Last-Modified: Sun, 15 Apr 2018 04:13:54 GMT
Server: Apache
Content-Type: image/svg+xml
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 1409

GET
H2 200 background.desktop.night.2.jpeg
static.chasecdn.com/content/geo-images/images/ 246 KB
247 KB 330ms
24ms Image
image/jpeg 2.16.186.163

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.chasecdn.com/content/geo-images/images/background.desktop.night.2.jpeg

Requested by

Host: noinc.duckdns.org
URL: http://noinc.duckdns.org/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.16.186.163 -, , ASN (),

Reverse DNS

Software

Resource Hash

adeebee7de25f9f59583ffc96521843d8fddf218d650643a0accdfe8bfd527ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://noinc.duckdns.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
last-modified: Tue, 06 Oct 2020 14:31:38 GMT
date: Wed, 16 Mar 2022 01:22:00 GMT
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=2592000,s-maxage=2592000
accept-ranges: bytes
content-length: 251996

GET
H/1.1 404
Not Found opensans-regular.woff
noinc.duckdns.org/content/dam/cpo-static/fonts/ 0
0 99ms
99ms Font
text/html 54.234.170.249
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: http://noinc.duckdns.org/content/dam/cpo-static/fonts/opensans-regular.woff
Requested by: Host: noinc.duckdns.org
URL: http://noinc.duckdns.org/
Protocol: HTTP/1.1
Server: 54.234.170.249 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-234-170-249.compute-1.amazonaws.com
Software: Apache /
Resource Hash

Request headers

Referer: http://noinc.duckdns.org/
Origin: http://noinc.duckdns.org
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Wed, 16 Mar 2022 01:21:59 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=99
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 404
Not Found opensans-semibold.woff
noinc.duckdns.org/content/dam/cpo-static/fonts/ 0
0 100ms
99ms Font
text/html 54.234.170.249
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: http://noinc.duckdns.org/content/dam/cpo-static/fonts/opensans-semibold.woff
Requested by: Host: noinc.duckdns.org
URL: http://noinc.duckdns.org/
Protocol: HTTP/1.1
Server: 54.234.170.249 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-234-170-249.compute-1.amazonaws.com
Software: Apache /
Resource Hash

Request headers

Referer: http://noinc.duckdns.org/
Origin: http://noinc.duckdns.org
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Wed, 16 Mar 2022 01:21:59 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 200
OK dcefont.woff
noinc.duckdns.org/assets/web/2022/common/assets/fonts/ 51 KB
51 KB 186ms
100ms Font
font/woff 54.234.170.249
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: http://noinc.duckdns.org/assets/web/2022/common/assets/fonts/dcefont.woff
Requested by: Host: noinc.duckdns.org
URL: http://noinc.duckdns.org/assets/web/2022/common/assets/blue-ui.css
Protocol: HTTP/1.1
Server: 54.234.170.249 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-234-170-249.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 002a5f21378ae680359252b4fb352a3de46ed0f33fec75e311b43eca7c9feddd

Request headers

Referer: http://noinc.duckdns.org/assets/web/2022/common/assets/blue-ui.css
Origin: http://noinc.duckdns.org
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Wed, 16 Mar 2022 01:21:59 GMT
Last-Modified: Sun, 15 Apr 2018 04:12:14 GMT
Server: Apache
Content-Type: font/woff
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 52400

GET
H/1.1 404
Not Found opensans-regular.ttf
noinc.duckdns.org/content/dam/cpo-static/fonts/ 0
0 99ms
99ms Font
text/html 54.234.170.249
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: http://noinc.duckdns.org/content/dam/cpo-static/fonts/opensans-regular.ttf
Requested by: Host: noinc.duckdns.org
URL: http://noinc.duckdns.org/
Protocol: HTTP/1.1
Server: 54.234.170.249 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-234-170-249.compute-1.amazonaws.com
Software: Apache /
Resource Hash

Request headers

Referer: http://noinc.duckdns.org/
Origin: http://noinc.duckdns.org
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Wed, 16 Mar 2022 01:21:59 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=98
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 404
Not Found opensans-semibold.ttf
noinc.duckdns.org/content/dam/cpo-static/fonts/ 0
0 100ms
100ms Font
text/html 54.234.170.249
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: http://noinc.duckdns.org/content/dam/cpo-static/fonts/opensans-semibold.ttf
Requested by: Host: noinc.duckdns.org
URL: http://noinc.duckdns.org/
Protocol: HTTP/1.1
Server: 54.234.170.249 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-234-170-249.compute-1.amazonaws.com
Software: Apache /
Resource Hash

Request headers

Referer: http://noinc.duckdns.org/
Origin: http://noinc.duckdns.org
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Wed, 16 Mar 2022 01:21:59 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=99
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Chase (Banking)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone object| oncontextlost object| oncontextrestored

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: http://noinc.duckdns.org/content/dam/cpo-static/fonts/opensans-regular.woff Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: http://noinc.duckdns.org/content/dam/cpo-static/fonts/opensans-semibold.woff Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: http://noinc.duckdns.org/content/dam/cpo-static/fonts/opensans-regular.ttf Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: http://noinc.duckdns.org/content/dam/cpo-static/fonts/opensans-semibold.ttf Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

daebakpop.com
noinc.duckdns.org
static.chasecdn.com
2.16.186.163
209.99.40.222
54.234.170.249
002a5f21378ae680359252b4fb352a3de46ed0f33fec75e311b43eca7c9feddd
606a5e22bb0e82b90ab032b98c11a8a905a0325e1c16fd4b6b4cb61bf448cf09
9d74a838c6dc6ef97b503a4aea8067b1651dcea1040783c481cdfc15e83b41dc
adeebee7de25f9f59583ffc96521843d8fddf218d650643a0accdfe8bfd527ad
d3bf9c143e5e360da41736b1d4e833b5ac6b6f7093ddc91ffc538233a78488d0
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e93833c14491ef399441c665587b8c356800b76add8759c4f314ab410b993b9c

noinc.duckdns.org Open in urlscan Pro 54.234.170.249 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

11 Requests

18 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

3 IPs

1 Countries

802 kBTransfer

800 kBSize

0 Cookies

0 Outgoing links

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

0 Cookies

4 Console Messages

Indicators

noinc.duckdns.org Open in urlscan Pro
54.234.170.249 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

18 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

802 kB
Transfer

800 kB
Size

0
Cookies

11 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!