logindaily.duckdns.org Open in urlscan Pro
40.85.185.94 Malicious Activity! Public Scan

URL:
http://logindaily.duckdns.org/
Submission: On June 18 via api (June 18th 2021, 8:37:23 am UTC) from PH

Summary HTTP 16 Redirects Behaviour Indicators

Summary

This website contacted 9 IPs in 4 countries across 8 domains to perform 16 HTTP transactions. The main IP is 40.85.185.94, located in Washington, United States and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is logindaily.duckdns.org.

This is the only time logindaily.duckdns.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Gaming (Entertainment)

Domain & IP information

	IP Address	AS Autonomous System
9	40.85.185.94 40.85.185.94	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2a02:26f0:710... 2a02:26f0:7100:184::1931	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	103.247.207.173 103.247.207.173	58521 (GARENA-SG...) (GARENA-SG Garena Online Pte Ltd)
1	2001:4de0:ac1... 2001:4de0:ac18::1:a:3a	20446 (HIGHWINDS3) (HIGHWINDS3)
1	99.86.242.42 99.86.242.42	16509 (AMAZON-02) (AMAZON-02)
1	2.16.107.74 2.16.107.74	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2.16.107.121 2.16.107.121	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2a00:1450:400... 2a00:1450:4001:827::2003	15169 (GOOGLE) (GOOGLE)
16	9

9 40.85.185.94 (Washington, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

logindaily.duckdns.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:7100:184::1931 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

i.pinimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 103.247.207.173 (Singapore)

ASN58521 (GARENA-SG Garena Online Pte Ltd, SG)

codm.garena.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac18::1:a:3a (Netherlands)

ASN20446 (HIGHWINDS3, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 99.86.242.42 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-86-242-42.vie50.r.cloudfront.net

api.pubgameshowtime.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.16.107.74 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-16-107-74.deploy.static.akamaitechnologies.com

cdngarenanow-a.akamaihd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.16.107.121 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-16-107-121.deploy.static.akamaitechnologies.com

dl.dir.freefiremobile.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:827::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	duckdns.org logindaily.duckdns.org	5 MB
1	gstatic.com fonts.gstatic.com	13 KB
1	freefiremobile.com dl.dir.freefiremobile.com	4 KB
1	akamaihd.net cdngarenanow-a.akamaihd.net	109 KB
1	pubgameshowtime.com api.pubgameshowtime.com	426 B
1	jquery.com code.jquery.com	30 KB
1	garena.com codm.garena.com	161 KB
1	pinimg.com i.pinimg.com	26 KB
16	8

	Domain	Requested by
9	logindaily.duckdns.org	logindaily.duckdns.org
1	fonts.gstatic.com	logindaily.duckdns.org
1	dl.dir.freefiremobile.com	logindaily.duckdns.org
1	cdngarenanow-a.akamaihd.net	logindaily.duckdns.org
1	api.pubgameshowtime.com	code.jquery.com
1	code.jquery.com	logindaily.duckdns.org
1	codm.garena.com	logindaily.duckdns.org
1	i.pinimg.com	logindaily.duckdns.org
16	8

This site contains no links.

Subject Issuer	Validity	Valid
*.pinterest.com DigiCert SHA2 High Assurance Server CA	`2020-07-16` - `2021-08-04`	a year	crt.sh
*.garena.com R3	`2021-06-14` - `2021-09-12`	3 months	crt.sh
jquery.org Sectigo RSA Domain Validation Secure Server CA	`2020-10-06` - `2021-10-16`	a year	crt.sh
api.pubgameshowtime.com Amazon	`2020-04-17` - `2021-05-17`	a year	crt.sh
a248.e.akamai.net DigiCert Secure Site ECC CA-1	`2020-07-15` - `2021-09-13`	a year	crt.sh
dl.kgtw.garenanow.com R3	`2021-04-08` - `2021-07-07`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2021-05-24` - `2021-08-16`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://logindaily.duckdns.org/
Frame ID: 394D7B0629A692A7CB7A6B19D1B69389
Requests: 18 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

16
Requests

38 %
HTTPS

38 %
IPv6

8
Domains

8
Subdomains

9
IPs

4
Countries

5674 kB
Transfer

5739 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
logindaily.duckdns.org/ 24 KB
24 KB 347ms
179ms Document
text/html 40.85.185.94
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: http://logindaily.duckdns.org/
Protocol: HTTP/1.1
Server: 40.85.185.94 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: 581f822d9ef6e25ec1211e186b5d1ec9c22bd2c026bd082a37d517a1e4b1bfd8

Request headers

Host: logindaily.duckdns.org
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 18 Jun 2021 08:37:04 GMT
Server: Apache
Last-Modified: Fri, 18 Jun 2021 01:12:08 GMT
Accept-Ranges: bytes
Content-Length: 24599
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html

GET
H/1.1 200
OK style.css
logindaily.duckdns.org/css/ 12 KB
13 KB 186ms
179ms Stylesheet
text/css 40.85.185.94
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: http://logindaily.duckdns.org/css/style.css
Requested by: Host: logindaily.duckdns.org
URL: http://logindaily.duckdns.org/
Protocol: HTTP/1.1
Server: 40.85.185.94 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: bf3c4aea91455160fe2a4fd64d2e94d890322ac11108bc02b910ad90276107e0

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: logindaily.duckdns.org
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://logindaily.duckdns.org/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://logindaily.duckdns.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 18 Jun 2021 08:37:04 GMT
Last-Modified: Tue, 15 Jun 2021 02:07:27 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 12602

GET
H/1.1 200
OK facebook.css
logindaily.duckdns.org/css/ 4 KB
4 KB 183ms
177ms Stylesheet
text/css 40.85.185.94
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: http://logindaily.duckdns.org/css/facebook.css
Requested by: Host: logindaily.duckdns.org
URL: http://logindaily.duckdns.org/
Protocol: HTTP/1.1
Server: 40.85.185.94 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: 7c03eb33850dff116e50288b6aed9ff84fc17624a3b6e9ee2ab968b37b266d4b

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: logindaily.duckdns.org
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://logindaily.duckdns.org/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://logindaily.duckdns.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 18 Jun 2021 08:37:04 GMT
Last-Modified: Tue, 15 Jun 2021 02:30:21 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 4071

GET
H2 200 675666d840a9c8fa1c61eaf584ff2a50.gif
i.pinimg.com/originals/67/56/66/ 25 KB
26 KB 173ms
156ms Image
image/gif 2a02:26f0:7100:184::1931
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.pinimg.com/originals/67/56/66/675666d840a9c8fa1c61eaf584ff2a50.gif
Requested by: Host: logindaily.duckdns.org
URL: http://logindaily.duckdns.org/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:7100:184::1931 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 654cb99fb0cdc3b32bf8efbd77c8171f09580840dbd8084e3dbd2427210a9b9e

Request headers

Referer: http://logindaily.duckdns.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-edgeconnect-origin-mex-latency: 67
x-cdn: akamai
cache-miss-to-origin: YES
x-edgeconnect-midmile-rtt: 2
etag: "58c7f1e8e4bfaadbcbd8ccc470e363cb"
vary: Origin
content-type: image/gif
cache-control: immutable, max-age=31536000
accept-ranges: bytes
content-length: 26108

GET
H2 200 main-kv.jpg
codm.garena.com/static/images/Main-page/P1/ 160 KB
161 KB 577ms
186ms Image
image/jpeg 103.247.207.173
GARENA-SG Garena ...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://codm.garena.com/static/images/Main-page/P1/main-kv.jpg
Requested by: Host: logindaily.duckdns.org
URL: http://logindaily.duckdns.org/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 103.247.207.173 , Singapore, ASN58521 (GARENA-SG Garena Online Pte Ltd, SG),
Reverse DNS
Software: openresty /
Resource Hash: fa7c0cc2d1f3c09bd2f57007e2c36bfe42ef307580af3ec1f9cc1bbe00bef788

Request headers

Referer: http://logindaily.duckdns.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 18 Jun 2021 08:37:05 GMT
last-modified: Wed, 19 May 2021 09:27:02 GMT
server: openresty
accept-ranges: bytes
etag: "60a4d9e6-28154"
content-length: 164180
content-type: image/jpeg

GET
H/1.1 200
OK spin.png
logindaily.duckdns.org/img/ 30 KB
30 KB 183ms
177ms Image
image/png 40.85.185.94
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://logindaily.duckdns.org/img/spin.png
Requested by: Host: logindaily.duckdns.org
URL: http://logindaily.duckdns.org/
Protocol: HTTP/1.1
Server: 40.85.185.94 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: da3aeee9796d89ab5d3977018bf6270a4ce1c11ea818b7a78d9fc48f8987d52b

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: logindaily.duckdns.org
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://logindaily.duckdns.org/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://logindaily.duckdns.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 18 Jun 2021 08:37:04 GMT
Last-Modified: Wed, 21 Apr 2021 21:12:04 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 30347

GET
H/1.1 200
OK facebook_text.png
logindaily.duckdns.org/img/ 28 KB
28 KB 184ms
179ms Image
image/png 40.85.185.94
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://logindaily.duckdns.org/img/facebook_text.png
Requested by: Host: logindaily.duckdns.org
URL: http://logindaily.duckdns.org/
Protocol: HTTP/1.1
Server: 40.85.185.94 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: 092a3cd5f86b3f039feefdeb86694cd16ae545af214cfda614bdbbe2d1bde401

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: logindaily.duckdns.org
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://logindaily.duckdns.org/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://logindaily.duckdns.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 18 Jun 2021 08:37:04 GMT
Last-Modified: Wed, 21 Apr 2021 21:12:04 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 28789

GET
DATA 200
OK truncated
/ 4 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a0152e2f2cd8d929e0b02a827bfaefb48709e5673f7b9f56c27c5a5d473fc57b

Request headers

Referer: http://logindaily.duckdns.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 jquery-3.6.0.min.js Show response
code.jquery.com/ 87 KB
30 KB 24ms
9ms Script
application/javascript 2001:4de0:ac18::1:a:3a
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.6.0.min.js
Requested by: Host: logindaily.duckdns.org
URL: http://logindaily.duckdns.org/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:3a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Request headers

Referer: http://logindaily.duckdns.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 18 Jun 2021 08:37:04 GMT
content-encoding: gzip
last-modified: Tue, 02 Mar 2021 17:27:20 GMT
server: nginx
etag: W/"603e7578-15d9d"
vary: Accept-Encoding
x-hw: 1624005424.dop218.fr8.t,1624005424.cds260.fr8.hn,1624005424.cds144.fr8.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 30875

GET
DATA 200
OK truncated
/ 8 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e698fdda84c73757b5c9a7844b50cfa157b3fd881b9633462196edffe3f8414a

Request headers

Referer: http://logindaily.duckdns.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
H2 200 getcountry Show response
api.pubgameshowtime.com/ip/ 59 B
426 B 937ms
715ms XHR
application/json 99.86.242.42
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.pubgameshowtime.com/ip/getcountry
Requested by: Host: code.jquery.com
URL: https://code.jquery.com/jquery-3.6.0.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.242.42 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-242-42.vie50.r.cloudfront.net
Software: /
Resource Hash: 0049b9a15baf6c004335090dc5b2d564b1823f8054a6dc6b9b8d04214af28907

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: http://logindaily.duckdns.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 18 Jun 2021 08:37:05 GMT
via: 1.1 e6726d8c260dc6d0bdf74050840f4b1b.cloudfront.net (CloudFront)
x-amz-cf-pop: VIE50-C1
x-amzn-requestid: abcfefcb-384f-418e-8826-9da1c8e1c444
x-cache: Miss from cloudfront
content-type: application/json
access-control-allow-origin: *
x-amzn-trace-id: Root=1-60cc5b31-27171d4633b7466d4915acc5;Sampled=0
x-amz-apigw-id: BHMvxEp2SK4FSsg=
content-length: 59
x-amz-cf-id: rwHb3MA9cBDCqNNN5y5-sKbkdY5Xx6O4j_eMETOGtrM2SBUPcCOmZw==

GET
H/1.1 200
OK bg.jpg
logindaily.duckdns.org/img/ 708 KB
708 KB 93ms
93ms Image
image/jpeg 40.85.185.94
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://logindaily.duckdns.org/img/bg.jpg
Requested by: Host: logindaily.duckdns.org
URL: http://logindaily.duckdns.org/css/style.css
Protocol: HTTP/1.1
Server: 40.85.185.94 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: 4bbbce261e63e97fb75920e5c9e220d46c2719541cfece6191de4f9d63928d55

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: logindaily.duckdns.org
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://logindaily.duckdns.org/css/style.css
Connection: keep-alive
Cache-Control: no-cache
Referer: http://logindaily.duckdns.org/css/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 18 Jun 2021 08:37:05 GMT
Last-Modified: Wed, 21 Apr 2021 21:12:04 GMT
Server: Apache
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 724953

GET
H2 200 title.png
cdngarenanow-a.akamaihd.net/webid/FF/summerswordsman/ 109 KB
109 KB 41ms
12ms Image
image/png 2.16.107.74
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdngarenanow-a.akamaihd.net/webid/FF/summerswordsman/title.png
Requested by: Host: logindaily.duckdns.org
URL: http://logindaily.duckdns.org/css/style.css
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2.16.107.74 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-16-107-74.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 3e8105879b4f8772c788c175266496a4c4e948e0ea8ee6074bd7d3e03bc01ecd

Request headers

Referer: http://logindaily.duckdns.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 18 Jun 2021 08:37:05 GMT
content-encoding: gzip
last-modified: Mon, 12 Apr 2021 07:29:07 GMT
server: AkamaiNetStorage
etag: "7bb8b83f363830ea46ce5a2cc47183b2:1618212611.782993"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
accept-ranges: bytes
content-length: 111211

GET
H/1.1 200
OK banner.png
logindaily.duckdns.org/img/ 869 B
1 KB 92ms
91ms Image
image/png 40.85.185.94
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://logindaily.duckdns.org/img/banner.png
Requested by: Host: logindaily.duckdns.org
URL: http://logindaily.duckdns.org/css/style.css
Protocol: HTTP/1.1
Server: 40.85.185.94 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: b174ce8b9631902747d99171e5789af992975b0b8aa6fbaa1036236994a0ba4b

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: logindaily.duckdns.org
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://logindaily.duckdns.org/css/style.css
Connection: keep-alive
Cache-Control: no-cache
Referer: http://logindaily.duckdns.org/css/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 18 Jun 2021 08:37:05 GMT
Last-Modified: Wed, 21 Apr 2021 21:12:04 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 869

GET
H/1.1 200
OK spin.png
logindaily.duckdns.org/css/ 30 KB
30 KB 93ms
92ms Image
image/png 40.85.185.94
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://logindaily.duckdns.org/css/spin.png
Requested by: Host: logindaily.duckdns.org
URL: http://logindaily.duckdns.org/css/style.css
Protocol: HTTP/1.1
Server: 40.85.185.94 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: da3aeee9796d89ab5d3977018bf6270a4ce1c11ea818b7a78d9fc48f8987d52b

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: logindaily.duckdns.org
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://logindaily.duckdns.org/css/style.css
Connection: keep-alive
Cache-Control: no-cache
Referer: http://logindaily.duckdns.org/css/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 18 Jun 2021 08:37:05 GMT
Last-Modified: Tue, 15 Jun 2021 03:52:34 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 30347

GET
H/1.1 200
OK turntable.png
logindaily.duckdns.org/css/ 4 MB
4 MB 93ms
92ms Image
image/png 40.85.185.94
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://logindaily.duckdns.org/css/turntable.png
Requested by: Host: logindaily.duckdns.org
URL: http://logindaily.duckdns.org/css/style.css
Protocol: HTTP/1.1
Server: 40.85.185.94 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: 4d3b6eca4ddbf7cd1cec98f956d19d49581917a34936553a73092b0d39ecafcb

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: logindaily.duckdns.org
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://logindaily.duckdns.org/css/style.css
Connection: keep-alive
Cache-Control: no-cache
Referer: http://logindaily.duckdns.org/css/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 18 Jun 2021 08:37:05 GMT
Last-Modified: Tue, 15 Jun 2021 03:52:34 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 4600358

GET
H/1.1 200
OK spin_btn.png
dl.dir.freefiremobile.com/common/web_event/summerspin2remake/images/ 3 KB
4 KB 31ms
9ms Image
image/png 2.16.107.121
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dl.dir.freefiremobile.com/common/web_event/summerspin2remake/images/spin_btn.png
Requested by: Host: logindaily.duckdns.org
URL: http://logindaily.duckdns.org/css/style.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2.16.107.121 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-16-107-121.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 1237f45379ffea3903da13ea019662005759393ca9fe8cdbdc87e990b3d2098c

Request headers

Referer: http://logindaily.duckdns.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 18 Jun 2021 08:37:05 GMT
Last-Modified: Fri, 16 Apr 2021 06:55:08 GMT
Server: AkamaiNetStorage
ETag: "51d34bbe8a963fecbafa2db1be42859b:1618556583.943304"
Content-Type: image/png
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3549

GET
H2 200 JTUSjIg69CK48gW7PXoo9Wlhyw.woff2
fonts.gstatic.com/s/bebasneue/v2/ 13 KB
13 KB 28ms
7ms Font
font/woff2 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/bebasneue/v2/JTUSjIg69CK48gW7PXoo9Wlhyw.woff2

Requested by

Host: logindaily.duckdns.org
URL: http://logindaily.duckdns.org/css/style.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dab7290ebc90b7ed3068b2921bf51e026225ad48e7b398b12321d036d340a458

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: http://logindaily.duckdns.org
Referer: http://logindaily.duckdns.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 12 Jun 2021 06:07:17 GMT
x-content-type-options: nosniff
age: 527388
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13092
x-xss-protection: 0
last-modified: Thu, 10 Sep 2020 17:05:42 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 12 Jun 2022 06:07:17 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Gaming (Entertainment)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.pubgameshowtime.com
cdngarenanow-a.akamaihd.net
code.jquery.com
codm.garena.com
dl.dir.freefiremobile.com
fonts.gstatic.com
i.pinimg.com
logindaily.duckdns.org
103.247.207.173
2.16.107.121
2.16.107.74
2001:4de0:ac18::1:a:3a
2a00:1450:4001:827::2003
2a02:26f0:7100:184::1931
40.85.185.94
99.86.242.42
0049b9a15baf6c004335090dc5b2d564b1823f8054a6dc6b9b8d04214af28907
092a3cd5f86b3f039feefdeb86694cd16ae545af214cfda614bdbbe2d1bde401
1237f45379ffea3903da13ea019662005759393ca9fe8cdbdc87e990b3d2098c
3e8105879b4f8772c788c175266496a4c4e948e0ea8ee6074bd7d3e03bc01ecd
4bbbce261e63e97fb75920e5c9e220d46c2719541cfece6191de4f9d63928d55
4d3b6eca4ddbf7cd1cec98f956d19d49581917a34936553a73092b0d39ecafcb
581f822d9ef6e25ec1211e186b5d1ec9c22bd2c026bd082a37d517a1e4b1bfd8
654cb99fb0cdc3b32bf8efbd77c8171f09580840dbd8084e3dbd2427210a9b9e
7c03eb33850dff116e50288b6aed9ff84fc17624a3b6e9ee2ab968b37b266d4b
a0152e2f2cd8d929e0b02a827bfaefb48709e5673f7b9f56c27c5a5d473fc57b
b174ce8b9631902747d99171e5789af992975b0b8aa6fbaa1036236994a0ba4b
bf3c4aea91455160fe2a4fd64d2e94d890322ac11108bc02b910ad90276107e0
da3aeee9796d89ab5d3977018bf6270a4ce1c11ea818b7a78d9fc48f8987d52b
dab7290ebc90b7ed3068b2921bf51e026225ad48e7b398b12321d036d340a458
e698fdda84c73757b5c9a7844b50cfa157b3fd881b9633462196edffe3f8414a
fa7c0cc2d1f3c09bd2f57007e2c36bfe42ef307580af3ec1f9cc1bbe00bef788
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

logindaily.duckdns.org Open in urlscan Pro 40.85.185.94 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

16 Requests

38 %HTTPS

38 %IPv6

8 Domains

8 Subdomains

9 IPs

4 Countries

5674 kBTransfer

5739 kBSize

0 Cookies

0 Outgoing links

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

13 JavaScript Global Variables

0 Cookies

Indicators

logindaily.duckdns.org Open in urlscan Pro
40.85.185.94 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

38 %
HTTPS

38 %
IPv6

8
Domains

8
Subdomains

9
IPs

4
Countries

5674 kB
Transfer

5739 kB
Size

0
Cookies

16 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!