jvqhpvsfyo.duckdns.org

Summary

This website contacted 3 IPs in 3 countries across 4 domains to perform 3 HTTP transactions. The main IP is 91.204.226.171, located in Seoul, Korea, Republic Of and belongs to KIDC HDTIDC LIMITED, HK. The main domain is jvqhpvsfyo.duckdns.org.
TLS certificate: Issued by E6 on November 21st 2024. Valid for: 3 months.

This is the only time jvqhpvsfyo.duckdns.org was scanned on urlscan.io!

urlscan.io Verdict: No classification

Downloads These files were downloaded by the website

Chrome_up1732156036126.apk 261 KB application/zip

SHA256: f0253ff3f4813c7bd55e48607d0d7573767366cdc23e70925914260537726e0a

MIME: Zip archive data, at least v2.0 to extract

Size: 261 KB (266920 bytes, 100% done)

Downloaded from: https://cvws.icloud-content.com/B/AXlaSNueQZPhMOThyaqspTZTOH1WAR_B9HflNSb4kfmHkMhwIYRD-TUA/Chrome_up1732156036126.apk?o=AmP0UxlFczKp3P-0FKAz_hI1TP-pR7AoUS2_PUnDjtyy&v=1&x=3&a=CAogKuhvbfmKeeMOYSUDpEXWsanFTzJ2NfcZLd55laW1OFcSaxD33YDxtDIY97rc8rQyIgEAUgRTOH1WWgRD-TUAaiW8L2bhWrsKEHVEJ1vmU74PmbJydnEqtePUyEZai-Y8phzBPojmciXHWJP6IR-2-ma6z4S9nR78n59jDzNUP6XX5WvHlhv7w7XqH4gQ&e=1732186152&fl=&r=83001335-b072-4c22-88a8-303b5de0b386-1&k=Sy-JMXDl-o0opCASG0j6iQ&ckc=com.apple.clouddocs&ckz=com.apple.CloudDocs&p=122&s=DLmX6ggwohhzInUc3uzGGcmOT5A

Domain & IP information

	IP Address	AS Autonomous System
1	162.159.140.229 162.159.140.229	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	91.204.226.166 91.204.226.166	205960 (KIDC HDTI...) (KIDC HDTIDC LIMITED)
1	91.204.226.171 91.204.226.171	205960 (KIDC HDTI...) (KIDC HDTIDC LIMITED)
1	2620:149:a41:... 2620:149:a41:280::1:8	714 (APPLE-ENG...) (APPLE-ENGINEERING)
3	3

1 162.159.140.229 (None, )

ASN13335 (CLOUDFLARENET, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 91.204.226.166 (Seoul, Korea, Republic Of) 1 redirects

ASN205960 (KIDC HDTIDC LIMITED, HK)

zmptwh.hvhrg.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 91.204.226.171 (Seoul, Korea, Republic Of)

ASN205960 (KIDC HDTIDC LIMITED, HK)

jvqhpvsfyo.duckdns.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:149:a41:280::1:8 (Secaucus, United States)

ASN714 (APPLE-ENGINEERING, US)

cvws.icloud-content.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
1	icloud-content.com cvws.icloud-content.com — Cisco Umbrella Rank: 25724
1	duckdns.org jvqhpvsfyo.duckdns.org	1 KB
1	hvhrg.xyz 1 redirects zmptwh.hvhrg.xyz	243 B
1	t.co t.co — Cisco Umbrella Rank: 904	984 B
3	4

	Domain	Requested by
1	cvws.icloud-content.com	t.co
1	jvqhpvsfyo.duckdns.org	t.co
1	zmptwh.hvhrg.xyz	1 redirects
1	t.co
3	4

This site contains no links.

Subject Issuer	Validity	Valid
t.co E5	`2024-09-28` - `2024-12-27`	3 months	crt.sh
jvqhpvsfyo.duckdns.org E6	`2024-11-21` - `2025-02-19`	3 months	crt.sh
cvws.icloud-content.com Apple Public Server RSA CA 1 - G1	`2024-11-11` - `2025-12-04`	a year	crt.sh

This page contains 1 frames:

Frame: https://cvws.icloud-content.com/B/AXlaSNueQZPhMOThyaqspTZTOH1WAR_B9HflNSb4kfmHkMhwIYRD-TUA/Chrome_up1732156036126.apk?o=AmP0UxlFczKp3P-0FKAz_hI1TP-pR7AoUS2_PUnDjtyy&v=1&x=3&a=CAogKuhvbfmKeeMOYSUDpEXWsanFTzJ2NfcZLd55laW1OFcSaxD33YDxtDIY97rc8rQyIgEAUgRTOH1WWgRD-TUAaiW8L2bhWrsKEHVEJ1vmU74PmbJydnEqtePUyEZai-Y8phzBPojmciXHWJP6IR-2-ma6z4S9nR78n59jDzNUP6XX5WvHlhv7w7XqH4gQ&e=1732186152&fl=&r=83001335-b072-4c22-88a8-303b5de0b386-1&k=Sy-JMXDl-o0opCASG0j6iQ&ckc=com.apple.clouddocs&ckz=com.apple.CloudDocs&p=122&s=DLmX6ggwohhzInUc3uzGGcmOT5A
Frame ID: A3D989886A0A9B461480F5AAB2A26F8A
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://t.co/MQN7PEGZn2 Page URL
http://zmptwh.hvhrg.xyz/?lHZrP HTTP 307
https://zmptwh.hvhrg.xyz/?lHZrP HTTP 307
http://zmptwh.hvhrg.xyz/?lHZrP HTTP 301
https://jvqhpvsfyo.duckdns.org/?cqmfme Page URL

Page Statistics

3
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

3
IPs

3
Countries

2 kB
Transfer

4 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://t.co/MQN7PEGZn2 Page URL
http://zmptwh.hvhrg.xyz/?lHZrP HTTP 307
https://zmptwh.hvhrg.xyz/?lHZrP HTTP 307
http://zmptwh.hvhrg.xyz/?lHZrP HTTP 301
https://jvqhpvsfyo.duckdns.org/?cqmfme Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 MQN7PEGZn2 Show response
t.co/ 284 B
984 B 235ms
221ms Document
text/html 162.159.140.229
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://t.co/MQN7PEGZn2

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

162.159.140.229 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare tsa_b /

Resource Hash

2999833a6fc11017c32e3eb100134061a5fbcf38e2628749fc8f0e407d14e205

Security Headers

Name	Value
Content-Security-Policy	referrer always;
Strict-Transport-Security	max-age=0
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36

Response headers

cache-control: private,max-age=300
cf-cache-status: DYNAMIC
cf-ray: 8e5fc5622b01438d-EWR
content-encoding: gzip
content-security-policy: referrer always;
content-type: text/html; charset=utf-8
date: Thu, 21 Nov 2024 09:49:39 GMT
expires: Thu, 21 Nov 2024 09:54:39 GMT
perf: 7402827104
referrer-policy: unsafe-url
server: cloudflare tsa_b
strict-transport-security: max-age=0
vary: Origin
x-connection-hash: ddc0088881437fdf8b58582dde77572131fdc359bd9597071d504aac5aa0c26c
x-response-time: 14
x-transaction-id: 6e260cdd6c8e7c9a
x-xss-protection: 0

GET
H2

200

Primary Request / Show response
jvqhpvsfyo.duckdns.org/
Redirect Chain

http://zmptwh.hvhrg.xyz/?lHZrP
https://zmptwh.hvhrg.xyz/?lHZrP
http://zmptwh.hvhrg.xyz/?lHZrP
https://jvqhpvsfyo.duckdns.org/?cqmfme

4 KB
1 KB

582ms
182ms

Document
text/html

91.204.226.171
KIDC HDTIDC LIMITED

General

Check archive.org

Show headers Download Go to

Full URL: https://jvqhpvsfyo.duckdns.org/?cqmfme
Requested by: Host: t.co
URL: https://t.co/MQN7PEGZn2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 91.204.226.171 Seoul, Korea, Republic Of, ASN205960 (KIDC HDTIDC LIMITED, HK),
Reverse DNS
Software: Caddy /
Resource Hash: e4a6f4f44cf4234357fbae76b7e34d388dfa1aa91d1c30ca89e44f1da8addf6b

Request headers

Referer: https://t.co/MQN7PEGZn2
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000
cache-control: no-store
content-encoding: gzip
content-length: 1218
content-type: text/html; charset=utf-8
date: Thu, 21 Nov 2024 09:49:41 GMT
server: Caddy
vary: Accept-Encoding

Redirect headers

Content-Encoding: gzip
Content-Length: 97
Content-Type: text/html; charset=utf-8
Date: Thu, 21 Nov 2024 09:49:40 GMT
Location: https://jvqhpvsfyo.duckdns.org/?cqmfme
Server: Caddy
Vary: Accept-Encoding

GET
H/1.1 200
OK Chrome_up1732156036126.apk
cvws.icloud-content.com/B/AXlaSNueQZPhMOThyaqspTZTOH1WAR_B9HflNSb4kfmHkMhwIYRD-TUA/ 0
0 233ms
189ms Document
application/octet-stream 2620:149:a41:280::1:8
APPLE-ENGINEERING

General

Check archive.org

Show headers Download Go to

Full URL: https://cvws.icloud-content.com/B/AXlaSNueQZPhMOThyaqspTZTOH1WAR_B9HflNSb4kfmHkMhwIYRD-TUA/Chrome_up1732156036126.apk?o=AmP0UxlFczKp3P-0FKAz_hI1TP-pR7AoUS2_PUnDjtyy&v=1&x=3&a=CAogKuhvbfmKeeMOYSUDpEXWsanFTzJ2NfcZLd55laW1OFcSaxD33YDxtDIY97rc8rQyIgEAUgRTOH1WWgRD-TUAaiW8L2bhWrsKEHVEJ1vmU74PmbJydnEqtePUyEZai-Y8phzBPojmciXHWJP6IR-2-ma6z4S9nR78n59jDzNUP6XX5WvHlhv7w7XqH4gQ&e=1732186152&fl=&r=83001335-b072-4c22-88a8-303b5de0b386-1&k=Sy-JMXDl-o0opCASG0j6iQ&ckc=com.apple.clouddocs&ckz=com.apple.CloudDocs&p=122&s=DLmX6ggwohhzInUc3uzGGcmOT5A
Requested by: Host: t.co
URL: https://t.co/MQN7PEGZn2
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:149:a41:280::1:8 Secaucus, United States, ASN714 (APPLE-ENGINEERING, US),
Reverse DNS
Software: AppleHttpServer/d2dcc6a0a5e3 /
Resource Hash

Request headers

Referer: https://jvqhpvsfyo.duckdns.org/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Credentials: false
Access-Control-Allow-Headers
Access-Control-Allow-Methods: GET,OPTIONS
Cache-Control: no-transform,private,max-age=2592000,s-maxage=2592000
Connection: keep-alive
Content-Disposition: attachment; filename="Chrome_up1732156036126.apk"
Content-Length: 266920
Content-Type: application/octet-stream
Date: Thu, 21 Nov 2024 09:49:42 GMT
Last-Modified: Thu, 21 Nov 2024 09:49:42 GMT
Server: AppleHttpServer/d2dcc6a0a5e3
X-Apple-Request-UUID: 83001335-b072-4c22-88a8-303b5de0b386-11732182582638
X-Responding-Instance: contentvendorws:212820002:ny05p14ic-qukt02012101:8402:2429B19:2429B19.0cacf06cc608

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| eisbtpfjzup number| xywdaarp number| xqmz

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.t.co/	1970-01-21 10:45:42	Name: muc Value: db195867-28e2-4971-892e-d95459e54229
.t.co/	1970-01-21 10:45:42	Name: muc_ads Value: db195867-28e2-4971-892e-d95459e54229
.t.co/	1970-01-21 01:09:44	Name: __cf_bm Value: TyskSVIL3jjWkmpFCR4.EbJBxCkkUppjXq5durGh4no-1732182579-1.0.1.1-a5kVGfUSZeAOywLBIDhuviIIUtGNXQUqAhzMcdsw9RsVRd2T4OmvNAppcr59BacGrZOYwKJZurHNHFhSTbV2kg

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://t.co/MQN7PEGZn2 Message: Unrecognized Content-Security-Policy directive 'referrer'.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	referrer always;
Strict-Transport-Security	max-age=0
X-Xss-Protection	0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cvws.icloud-content.com
jvqhpvsfyo.duckdns.org
t.co
zmptwh.hvhrg.xyz
162.159.140.229
2620:149:a41:280::1:8
91.204.226.166
91.204.226.171
2999833a6fc11017c32e3eb100134061a5fbcf38e2628749fc8f0e407d14e205
e4a6f4f44cf4234357fbae76b7e34d388dfa1aa91d1c30ca89e44f1da8addf6b

jvqhpvsfyo.duckdns.org Open in urlscan Pro 91.204.226.171 Public Scan

Summary

urlscan.io Verdict: No classification

Downloads These files were downloaded by the website

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

3 Requests

100 %HTTPS

25 %IPv6

4 Domains

4 Subdomains

3 IPs

3 Countries

2 kBTransfer

4 kBSize

3 Cookies

0 Outgoing links

Page URL History

Redirected requests

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

3 Cookies

1 Console Messages

Security Headers

Indicators

jvqhpvsfyo.duckdns.org Open in urlscan Pro
91.204.226.171 Public Scan

Screenshot
Live screenshot

Full Image

3
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

3
IPs

3
Countries

2 kB
Transfer

4 kB
Size

3
Cookies

3 HTTP transactions
0 data transactions