12129853477829292355.duckdns.org

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 5 HTTP transactions. The main IP is 103.250.11.87, located in Indonesia and belongs to CLOUDHOST-AS-AP Cloud Host Pte Ltd, SG. The main domain is 12129853477829292355.duckdns.org.

This is the only time 12129853477829292355.duckdns.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
4	103.250.11.87 103.250.11.87	138608 (CLOUDHOST...) (CLOUDHOST-AS-AP Cloud Host Pte Ltd)
1	2a03:2880:f17... 2a03:2880:f176:84:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
5	2

4 103.250.11.87 (Indonesia)

ASN138608 (CLOUDHOST-AS-AP Cloud Host Pte Ltd, SG)
PTR: ip103-250-11-87.cloudhost.web.id

12129853477829292355.duckdns.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f176:84:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	duckdns.org 12129853477829292355.duckdns.org	16 KB
1	facebook.com www.facebook.com — Cisco Umbrella Rank: 107	3 KB
5	2

	Domain	Requested by
4	12129853477829292355.duckdns.org	12129853477829292355.duckdns.org
1	www.facebook.com	12129853477829292355.duckdns.org
5	2

This site contains no links.

Subject Issuer	Validity	Valid
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-05-19` - `2023-08-17`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://12129853477829292355.duckdns.org/bdc28f3a14fa/notifiscation.htm
Frame ID: A10B5094D48C7EB11F7B573C8E2BA559
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Restrictions Information

Page Statistics

5
Requests

20 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

19 kB
Transfer

65 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request notifiscation.htm Show response
12129853477829292355.duckdns.org/bdc28f3a14fa/ 8 KB
4 KB 679ms
239ms Document
text/html 103.250.11.87
CLOUDHOST-AS-AP C...

General

Check archive.org

Show headers Download Go to

Full URL: http://12129853477829292355.duckdns.org/bdc28f3a14fa/notifiscation.htm
Protocol: HTTP/1.1
Server: 103.250.11.87 , Indonesia, ASN138608 (CLOUDHOST-AS-AP Cloud Host Pte Ltd, SG),
Reverse DNS: ip103-250-11-87.cloudhost.web.id
Software: LiteSpeed /
Resource Hash: 6c76be631ba4c9adca06c3647eccaa1be4bd95937b4fc16ad5b753012e075f56

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
connection: Keep-Alive
content-encoding: gzip
content-length: 3711
content-type: text/html
date: Thu, 10 Aug 2023 14:38:51 GMT
etag: "219d-6472adec-fc2fa;gz"
last-modified: Sun, 28 May 2023 01:27:08 GMT
server: LiteSpeed
vary: Accept-Encoding

GET
H/1.1 200
OK style-info.css
12129853477829292355.duckdns.org/bdc28f3a14fa/css/ 41 KB
9 KB 246ms
246ms Stylesheet
text/css 103.250.11.87
CLOUDHOST-AS-AP C...

General

Check archive.org

Show headers Download Go to

Full URL: http://12129853477829292355.duckdns.org/bdc28f3a14fa/css/style-info.css
Requested by: Host: 12129853477829292355.duckdns.org
URL: http://12129853477829292355.duckdns.org/bdc28f3a14fa/notifiscation.htm
Protocol: HTTP/1.1
Server: 103.250.11.87 , Indonesia, ASN138608 (CLOUDHOST-AS-AP Cloud Host Pte Ltd, SG),
Reverse DNS: ip103-250-11-87.cloudhost.web.id
Software: LiteSpeed /
Resource Hash: 385828ca3e917a8c7b8260fd3fd9751537800cd48a72976cdcd7117c72b61865

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://12129853477829292355.duckdns.org/bdc28f3a14fa/notifiscation.htm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Thu, 10 Aug 2023 14:38:51 GMT
content-encoding: gzip
last-modified: Sat, 27 May 2023 23:19:50 GMT
server: LiteSpeed
etag: "a585-64729016-fc2fe;gz"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
connection: Keep-Alive
accept-ranges: bytes
content-length: 8648
expires: Thu, 17 Aug 2023 14:38:51 GMT

GET
H/1.1 200
OK style-error.css
12129853477829292355.duckdns.org/bdc28f3a14fa/css/ 3 KB
1 KB 245ms
245ms Stylesheet
text/css 103.250.11.87
CLOUDHOST-AS-AP C...

General

Check archive.org

Show headers Download Go to

Full URL: http://12129853477829292355.duckdns.org/bdc28f3a14fa/css/style-error.css
Requested by: Host: 12129853477829292355.duckdns.org
URL: http://12129853477829292355.duckdns.org/bdc28f3a14fa/notifiscation.htm
Protocol: HTTP/1.1
Server: 103.250.11.87 , Indonesia, ASN138608 (CLOUDHOST-AS-AP Cloud Host Pte Ltd, SG),
Reverse DNS: ip103-250-11-87.cloudhost.web.id
Software: LiteSpeed /
Resource Hash: 640dee4c9ce4ee5f3ac308e071b2a73720a77670fc7ac795158252de649a072e

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://12129853477829292355.duckdns.org/bdc28f3a14fa/notifiscation.htm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Thu, 10 Aug 2023 14:38:51 GMT
content-encoding: gzip
last-modified: Tue, 16 May 2023 22:09:16 GMT
server: LiteSpeed
etag: "a52-6463ff0c-fc2fd;gz"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
connection: Keep-Alive
accept-ranges: bytes
content-length: 782
expires: Thu, 17 Aug 2023 14:38:51 GMT

GET
H/1.1 200
OK interview.css
12129853477829292355.duckdns.org/bdc28f3a14fa/css/ 10 KB
2 KB 474ms
235ms Stylesheet
text/css 103.250.11.87
CLOUDHOST-AS-AP C...

General

Check archive.org

Show headers Download Go to

Full URL: http://12129853477829292355.duckdns.org/bdc28f3a14fa/css/interview.css
Requested by: Host: 12129853477829292355.duckdns.org
URL: http://12129853477829292355.duckdns.org/bdc28f3a14fa/notifiscation.htm
Protocol: HTTP/1.1
Server: 103.250.11.87 , Indonesia, ASN138608 (CLOUDHOST-AS-AP Cloud Host Pte Ltd, SG),
Reverse DNS: ip103-250-11-87.cloudhost.web.id
Software: LiteSpeed /
Resource Hash: 9912a9154c510429fa1b8087ed8b3ec90ef2c55b97a7dca6440e2a21789de740

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://12129853477829292355.duckdns.org/bdc28f3a14fa/notifiscation.htm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Thu, 10 Aug 2023 14:38:51 GMT
content-encoding: gzip
last-modified: Tue, 16 May 2023 21:02:34 GMT
server: LiteSpeed
etag: "291c-6463ef6a-fc2fc;gz"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
connection: Keep-Alive
accept-ranges: bytes
content-length: 1543
expires: Thu, 17 Aug 2023 14:38:51 GMT

GET
H2 200 fb_icon_325x325.png
www.facebook.com/images/ 3 KB
3 KB 26ms
8ms Image
image/png 2a03:2880:f176:84:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/images/fb_icon_325x325.png

Requested by

Host: 12129853477829292355.duckdns.org
URL: http://12129853477829292355.duckdns.org/bdc28f3a14fa/notifiscation.htm

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f176:84:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

/

Resource Hash

bc40d55fd8796c2bbd2693fd3fc4eb4ebdca9d6b02eb12b7e3efa7e53d4aaeb3

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://12129853477829292355.duckdns.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
date: Thu, 10 Aug 2023 03:09:05 GMT
x-content-type-options: nosniff
content-md5: GwcFNOsathlfT8cRjfyL5Q==
document-policy: force-load-at-top
edge-control: cache-maxage=86400s
cross-origin-resource-policy: cross-origin
content-length: 2613
reporting-endpoints: default="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-debug: LvlFZb/oEW3Q/5/NSnEiTnofWNJ/xwFLL19g3N5TlJn1v/WNim2bL1YS5Kh84FwtoFq3gEAExtGVCnVBuCZM8A==
cross-origin-opener-policy: same-origin-allow-popups
report-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}]}
content-type: image/png
access-control-allow-origin: *
origin-agent-cluster: ?0
cache-control: public,max-age=86400
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(self), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(self), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
timing-allow-origin: *
expires: Fri, 11 Aug 2023 03:09:05 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

12129853477829292355.duckdns.org
www.facebook.com
103.250.11.87
2a03:2880:f176:84:face:b00c:0:25de
385828ca3e917a8c7b8260fd3fd9751537800cd48a72976cdcd7117c72b61865
640dee4c9ce4ee5f3ac308e071b2a73720a77670fc7ac795158252de649a072e
6c76be631ba4c9adca06c3647eccaa1be4bd95937b4fc16ad5b753012e075f56
9912a9154c510429fa1b8087ed8b3ec90ef2c55b97a7dca6440e2a21789de740
bc40d55fd8796c2bbd2693fd3fc4eb4ebdca9d6b02eb12b7e3efa7e53d4aaeb3

12129853477829292355.duckdns.org Open in urlscan Pro 103.250.11.87 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

5 Requests

20 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

19 kBTransfer

65 kBSize

0 Cookies

0 Outgoing links

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

9 JavaScript Global Variables

0 Cookies

Indicators

12129853477829292355.duckdns.org Open in urlscan Pro
103.250.11.87 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

20 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

19 kB
Transfer

65 kB
Size

0
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!