wefckushgkurs-wkehgfmvrhkdtgret.duckdns.org Open in urlscan Pro
162.240.42.244 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://wefckushgkurs-wkehgfmvrhkdtgret.duckdns.org/?signin
Effective URL:
https://wefckushgkurs-wkehgfmvrhkdtgret.duckdns.org/myaccount/signin?session=f492fb9399f67f9977180d650f0a34db09efe59b
Submission: On January 07 via api (January 7th 2022, 1:02:11 am UTC) from US — Scanned from DE

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 8 HTTP transactions. The main IP is 162.240.42.244, located in United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is wefckushgkurs-wkehgfmvrhkdtgret.duckdns.org.
TLS certificate: Issued by R3 on January 6th 2022. Valid for: 3 months.

This is the only time wefckushgkurs-wkehgfmvrhkdtgret.duckdns.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Coinbase (Crypto Exchange)

Domain & IP information

	IP Address		AS Autonomous System
1 6	162.240.42.244 162.240.42.244		46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
8	2

6 162.240.42.244 (United States) 1 redirects

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 5615685.bintangberke.com

wefckushgkurs-wkehgfmvrhkdtgret.duckdns.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	duckdns.org 1 redirects wefckushgkurs-wkehgfmvrhkdtgret.duckdns.org	758 KB
8	1

	Domain	Requested by
6	wefckushgkurs-wkehgfmvrhkdtgret.duckdns.org	1 redirects wefckushgkurs-wkehgfmvrhkdtgret.duckdns.org
8	1

This site contains no links.

Subject Issuer	Validity	Valid
wefckushgkurs-wkehgfmvrhkdtgret.duckdns.org R3	`2022-01-06` - `2022-04-06`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://wefckushgkurs-wkehgfmvrhkdtgret.duckdns.org/myaccount/signin?session=f492fb9399f67f9977180d650f0a34db09efe59b
Frame ID: DC5447EC233603EB6419A108E79B3CF1
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Coinbase - Buy/Sell Cryptocurrency

Page URL History Show full URLs

https://wefckushgkurs-wkehgfmvrhkdtgret.duckdns.org/?signin HTTP 302
https://wefckushgkurs-wkehgfmvrhkdtgret.duckdns.org/myaccount/signin?session=f492fb9399f67f9977180d650f0a34db09efe59b Page URL

Detected technologies

CodeIgniter (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

Stimulus (JavaScript frameworks) Expand

Overall confidence: 100%
Detected patterns

<[^>]+data-controller

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

8
Requests

63 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

758 kB
Transfer

765 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://wefckushgkurs-wkehgfmvrhkdtgret.duckdns.org/?signin HTTP 302
https://wefckushgkurs-wkehgfmvrhkdtgret.duckdns.org/myaccount/signin?session=f492fb9399f67f9977180d650f0a34db09efe59b Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request signin Show response wefckushgkurs-wkehgfmvrhkdtgret.duckdns.org/myaccount/ Redirect Chain https://wefckushgkurs-wkehgfmvrhkdtgret.duckdns.org/?signin https://wefckushgkurs-wkehgfmvrhkdtgret.duckdns.org/myaccount/signin?session=f492fb9399f67f9977180d650f0a34db09efe59b	17 KB 4 KB	758ms 758ms	Document text/html	162.240.42.244 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://wefckushgkurs-wkehgfmvrhkdtgret.duckdns.org/myaccount/signin?session=f492fb9399f67f9977180d650f0a34db09efe59b Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 162.240.42.244 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 5615685.bintangberke.com Software Apache / Resource Hash `6fb3bc07c4579ed6fb74eaefcd44a524914500b54ab1e647a51f8337a863b475` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers expires Thu, 19 Nov 1981 08:52:00 GMT cache-control no-store, no-cache, must-revalidate pragma no-cache content-encoding gzip vary Accept-Encoding content-type text/html; charset=UTF-8 date Fri, 07 Jan 2022 01:01:39 GMT server Apache Redirect headers expires Thu, 19 Nov 1981 08:52:00 GMT cache-control no-store, no-cache, must-revalidate pragma no-cache content-encoding gzip vary Accept-Encoding location https://wefckushgkurs-wkehgfmvrhkdtgret.duckdns.org/myaccount/signin?session=f492fb9399f67f9977180d650f0a34db09efe59b content-type text/html; charset=UTF-8 date Fri, 07 Jan 2022 01:01:38 GMT server Apache
GET H2	200	jquery-min.js Show response wefckushgkurs-wkehgfmvrhkdtgret.duckdns.org/assets/js/	96 KB 96 KB	154ms 152ms	Script application/javascript	162.240.42.244 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://wefckushgkurs-wkehgfmvrhkdtgret.duckdns.org/assets/js/jquery-min.js Requested by Host: wefckushgkurs-wkehgfmvrhkdtgret.duckdns.org URL: https://wefckushgkurs-wkehgfmvrhkdtgret.duckdns.org/myaccount/signin?session=f492fb9399f67f9977180d650f0a34db09efe59b Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 162.240.42.244 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 5615685.bintangberke.com Software Apache / Resource Hash `465af1e16966f18866fe01296d1d44c211cea6dd584790562e1d3bedc03374d9` Request headers Accept-Language de-DE,de;q=0.9 Referer https://wefckushgkurs-wkehgfmvrhkdtgret.duckdns.org/myaccount/signin?session=f492fb9399f67f9977180d650f0a34db09efe59b User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers date Fri, 07 Jan 2022 01:01:40 GMT last-modified Fri, 30 Apr 2021 11:57:44 GMT server Apache accept-ranges bytes content-length 97862 content-type application/javascript
GET H2	200	login.css wefckushgkurs-wkehgfmvrhkdtgret.duckdns.org/assets/css/	331 KB 333 KB	1899ms 1897ms	Stylesheet text/css	162.240.42.244 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://wefckushgkurs-wkehgfmvrhkdtgret.duckdns.org/assets/css/login.css Requested by Host: wefckushgkurs-wkehgfmvrhkdtgret.duckdns.org URL: https://wefckushgkurs-wkehgfmvrhkdtgret.duckdns.org/myaccount/signin?session=f492fb9399f67f9977180d650f0a34db09efe59b Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 162.240.42.244 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 5615685.bintangberke.com Software Apache / Resource Hash `8ae849895d0a3f39fcfe845a6f7cf4133566e682c530b414e7471cd11ed8f9fc` Request headers Accept-Language de-DE,de;q=0.9 Referer https://wefckushgkurs-wkehgfmvrhkdtgret.duckdns.org/myaccount/signin?session=f492fb9399f67f9977180d650f0a34db09efe59b User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers date Fri, 07 Jan 2022 01:01:40 GMT last-modified Fri, 30 Apr 2021 11:59:04 GMT server Apache accept-ranges bytes content-length 338988 content-type text/css
GET H2	200	login-min.css wefckushgkurs-wkehgfmvrhkdtgret.duckdns.org/assets/css/	322 KB 324 KB	1899ms 1897ms	Stylesheet text/css	162.240.42.244 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://wefckushgkurs-wkehgfmvrhkdtgret.duckdns.org/assets/css/login-min.css Requested by Host: wefckushgkurs-wkehgfmvrhkdtgret.duckdns.org URL: https://wefckushgkurs-wkehgfmvrhkdtgret.duckdns.org/myaccount/signin?session=f492fb9399f67f9977180d650f0a34db09efe59b Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 162.240.42.244 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 5615685.bintangberke.com Software Apache / Resource Hash `65257f38fa7d7c3c4e47cf1ef8d3a03ceb327cb688a5984697d04e92073f6807` Request headers Accept-Language de-DE,de;q=0.9 Referer https://wefckushgkurs-wkehgfmvrhkdtgret.duckdns.org/myaccount/signin?session=f492fb9399f67f9977180d650f0a34db09efe59b User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers date Fri, 07 Jan 2022 01:01:40 GMT last-modified Thu, 29 Jul 2021 18:29:12 GMT server Apache accept-ranges bytes content-length 329492 content-type text/css
GET H2	404	Graphik-Medium-Web-da9a70ddd8603cbd79019518639c58f289f6ce194204496523c1dab3e9e47d6a.woff2 wefckushgkurs-wkehgfmvrhkdtgret.duckdns.org/assets/graphik/	0 0	452ms 451ms	Font text/html	162.240.42.244 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://wefckushgkurs-wkehgfmvrhkdtgret.duckdns.org/assets/graphik/Graphik-Medium-Web-da9a70ddd8603cbd79019518639c58f289f6ce194204496523c1dab3e9e47d6a.woff2 Requested by Host: wefckushgkurs-wkehgfmvrhkdtgret.duckdns.org URL: https://wefckushgkurs-wkehgfmvrhkdtgret.duckdns.org/assets/css/login.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 162.240.42.244 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 5615685.bintangberke.com Software Apache / Resource Hash Request headers Referer https://wefckushgkurs-wkehgfmvrhkdtgret.duckdns.org/assets/css/login.css Origin https://wefckushgkurs-wkehgfmvrhkdtgret.duckdns.org Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers date Fri, 07 Jan 2022 01:02:10 GMT content-encoding gzip server Apache vary Accept-Encoding content-type text/html; charset=UTF-8
GET		Graphik-Medium-Web-bc831fc7bcbd2eb22321535637f67f6068dc64124e9ac5733f868ed697e4ad66.woff wefckushgkurs-wkehgfmvrhkdtgret.duckdns.org/assets/graphik/	0 0

GET		Graphik-Regular-Web-aeabadfcbec89b7a55d9a65893d93f275b406984811f8236b60bc9d9a7653360.woff2 wefckushgkurs-wkehgfmvrhkdtgret.duckdns.org/assets/graphik/	0 0

GET		icon-visible-active-402d81fd99fe281230bdf39a8bf63c1d3012f790fb521b1c1f0624296eac4be7.svg wefckushgkurs-wkehgfmvrhkdtgret.duckdns.org/assets/app/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: wefckushgkurs-wkehgfmvrhkdtgret.duckdns.org
URL: https://wefckushgkurs-wkehgfmvrhkdtgret.duckdns.org/assets/graphik/Graphik-Medium-Web-bc831fc7bcbd2eb22321535637f67f6068dc64124e9ac5733f868ed697e4ad66.woff

Domain: wefckushgkurs-wkehgfmvrhkdtgret.duckdns.org
URL: https://wefckushgkurs-wkehgfmvrhkdtgret.duckdns.org/assets/graphik/Graphik-Regular-Web-aeabadfcbec89b7a55d9a65893d93f275b406984811f8236b60bc9d9a7653360.woff2

Domain: wefckushgkurs-wkehgfmvrhkdtgret.duckdns.org
URL: https://wefckushgkurs-wkehgfmvrhkdtgret.duckdns.org/assets/app/icon-visible-active-402d81fd99fe281230bdf39a8bf63c1d3012f790fb521b1c1f0624296eac4be7.svg

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Coinbase (Crypto Exchange)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onsecuritypolicyviolation object| onslotchange function| $ function| jQuery

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			wefckushgkurs-wkehgfmvrhkdtgret.duckdns.org/	1970-01-19 23:58:44	Name: ci_session Value: 2b0483c4375a32165e0da7717b279d6190921be9

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://wefckushgkurs-wkehgfmvrhkdtgret.duckdns.org/assets/graphik/Graphik-Medium-Web-da9a70ddd8603cbd79019518639c58f289f6ce194204496523c1dab3e9e47d6a.woff2 Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

wefckushgkurs-wkehgfmvrhkdtgret.duckdns.org
wefckushgkurs-wkehgfmvrhkdtgret.duckdns.org
162.240.42.244
465af1e16966f18866fe01296d1d44c211cea6dd584790562e1d3bedc03374d9
65257f38fa7d7c3c4e47cf1ef8d3a03ceb327cb688a5984697d04e92073f6807
6fb3bc07c4579ed6fb74eaefcd44a524914500b54ab1e647a51f8337a863b475
8ae849895d0a3f39fcfe845a6f7cf4133566e682c530b414e7471cd11ed8f9fc

wefckushgkurs-wkehgfmvrhkdtgret.duckdns.org Open in urlscan Pro 162.240.42.244 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

8 Requests

63 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

758 kBTransfer

765 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

wefckushgkurs-wkehgfmvrhkdtgret.duckdns.org Open in urlscan Pro
162.240.42.244 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

63 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

758 kB
Transfer

765 kB
Size

1
Cookies

8 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!