urlscan.io logo urlscan.io
SecurityTrails logo

dukanwalay.com Open in urlscan Pro
89.23.113.76  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://dukanwalay.com/?cost=0.048&currency=usd&external_id=P3tkeH56fHl9f3h9e316e2R-ZHh4cX1xZHh9eX9-fX9kKnF7eHh7fnFkfix...
Submission: On December 25 via api from RU — Scanned from IL
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 9 HTTP transactions. The main IP is 89.23.113.76, located in Russian Federation and belongs to GIR-AS GLOBAL INTERNET SOLUTIONS LLC, RU. The main domain is dukanwalay.com.
TLS certificate: Issued by R11 on December 23rd 2024. Valid for: 3 months.
This is the only time dukanwalay.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: WhatsApp (Instant Messenger)

Domain & IP information

IP Address AS Autonomous System
9 89.23.113.76 207713 (GIR-AS GL...)
9 1
Apex Domain
Subdomains		 Transfer
9 dukanwalay.com
dukanwalay.com
531 KB
9 1
Domain Requested by
9 dukanwalay.com dukanwalay.com
9 1

This site contains no links.

Subject Issuer Validity Valid
dukanwalay.com
R11		 2024-12-23 -
2025-03-23		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://dukanwalay.com/?cost=0.048&currency=usd&external_id=P3tkeH56fHl9f3h9e316e2R-ZHh4cX1xZHh9eX9-fX9kKnF7eHh7fnFkfixwKmQof3x_ZHtwcHxkf38sLHl4fih_LS1x&creative_id=3508485&ad_campaign_id=15&source=responsible-another-traffic-quiet-taste&campaign_name=roi-22039735&publisher_id=flaky-another-traffic
Frame ID: 636C28B190DF4E9AD03B8FE9425104F5
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Главная

Detected technologies

Overall confidence: 100%
Detected patterns
  • <[^>]+\sdata-v(?:ue)?-

Page Statistics

9
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

531 kB
Transfer

528 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
dukanwalay.com/ 		355 B
758 B 		Document
General
Check archive.org
Download Go to
Full URL
https://dukanwalay.com/?cost=0.048&currency=usd&external_id=P3tkeH56fHl9f3h9e316e2R-ZHh4cX1xZHh9eX9-fX9kKnF7eHh7fnFkfixwKmQof3x_ZHtwcHxkf38sLHl4fih_LS1x&creative_id=3508485&ad_campaign_id=15&source=responsible-another-traffic-quiet-taste&campaign_name=roi-22039735&publisher_id=flaky-another-traffic
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
89.23.113.76 , Russian Federation, ASN207713 (GIR-AS GLOBAL INTERNET SOLUTIONS LLC, RU),
Reverse DNS
47446.ip-ptr.tech
Software
stormwall /
Resource Hash
f1f447cb3bcc1183c55145353acf2c753b83d4b729002008164543daf3b235b6

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, JSNLog-RequestId, activityId, applicationId, applicationUserId, channelId, senderId, sessionId
access-control-allow-methods
GET, DELETE, OPTIONS, POST, PUT
access-control-allow-origin
*
access-control-max-age
3628800
cache-control
public, max-age=0
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Wed, 25 Dec 2024 12:33:29 GMT
etag
W/"163-193b23349f0"
last-modified
Tue, 10 Dec 2024 20:12:06 GMT
server
stormwall
index-70e25d6e.js
dukanwalay.com/assets/ 		325 KB
326 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://dukanwalay.com/assets/index-70e25d6e.js
Requested by
Host: dukanwalay.com
URL: https://dukanwalay.com/?cost=0.048&currency=usd&external_id=P3tkeH56fHl9f3h9e316e2R-ZHh4cX1xZHh9eX9-fX9kKnF7eHh7fnFkfixwKmQof3x_ZHtwcHxkf38sLHl4fih_LS1x&creative_id=3508485&ad_campaign_id=15&source=responsible-another-traffic-quiet-taste&campaign_name=roi-22039735&publisher_id=flaky-another-traffic
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
89.23.113.76 , Russian Federation, ASN207713 (GIR-AS GLOBAL INTERNET SOLUTIONS LLC, RU),
Reverse DNS
47446.ip-ptr.tech
Software
stormwall /
Resource Hash
4ad15ac2fced09aa85d7e32f7a721b4023357064fcff03e75be85b2030ce85bb

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin
https://dukanwalay.com
Referer
https://dukanwalay.com/?cost=0.048&currency=usd&external_id=P3tkeH56fHl9f3h9e316e2R-ZHh4cX1xZHh9eX9-fX9kKnF7eHh7fnFkfixwKmQof3x_ZHtwcHxkf38sLHl4fih_LS1x&creative_id=3508485&ad_campaign_id=15&source=responsible-another-traffic-quiet-taste&campaign_name=roi-22039735&publisher_id=flaky-another-traffic

Response headers

access-control-max-age
3628800
cache-control
public, max-age=0
etag
W/"514a6-193b23349f0"
access-control-allow-methods
GET, DELETE, OPTIONS, POST, PUT
accept-ranges
bytes
access-control-allow-origin
*
content-length
332966
date
Wed, 25 Dec 2024 12:33:29 GMT
content-type
application/javascript; charset=UTF-8
last-modified
Tue, 10 Dec 2024 20:12:06 GMT
server
stormwall
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, JSNLog-RequestId, activityId, applicationId, applicationUserId, channelId, senderId, sessionId
index-71dfebed.css
dukanwalay.com/assets/ 		202 KB
202 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://dukanwalay.com/assets/index-71dfebed.css
Requested by
Host: dukanwalay.com
URL: https://dukanwalay.com/?cost=0.048&currency=usd&external_id=P3tkeH56fHl9f3h9e316e2R-ZHh4cX1xZHh9eX9-fX9kKnF7eHh7fnFkfixwKmQof3x_ZHtwcHxkf38sLHl4fih_LS1x&creative_id=3508485&ad_campaign_id=15&source=responsible-another-traffic-quiet-taste&campaign_name=roi-22039735&publisher_id=flaky-another-traffic
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
89.23.113.76 , Russian Federation, ASN207713 (GIR-AS GLOBAL INTERNET SOLUTIONS LLC, RU),
Reverse DNS
47446.ip-ptr.tech
Software
stormwall /
Resource Hash
71dfebed968020cc23d2d85b75c40db01d6e96b7e62d7e7369ff573aab984366

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://dukanwalay.com/?cost=0.048&currency=usd&external_id=P3tkeH56fHl9f3h9e316e2R-ZHh4cX1xZHh9eX9-fX9kKnF7eHh7fnFkfixwKmQof3x_ZHtwcHxkf38sLHl4fih_LS1x&creative_id=3508485&ad_campaign_id=15&source=responsible-another-traffic-quiet-taste&campaign_name=roi-22039735&publisher_id=flaky-another-traffic

Response headers

access-control-max-age
3628800
cache-control
public, max-age=0
etag
W/"3271d-193b23349f0"
access-control-allow-methods
GET, DELETE, OPTIONS, POST, PUT
accept-ranges
bytes
access-control-allow-origin
*
content-length
206621
date
Wed, 25 Dec 2024 12:33:29 GMT
content-type
text/css; charset=UTF-8
last-modified
Tue, 10 Dec 2024 20:12:06 GMT
server
stormwall
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, JSNLog-RequestId, activityId, applicationId, applicationUserId, channelId, senderId, sessionId
/
dukanwalay.com/socket.io/ 		118 B
468 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://dukanwalay.com/socket.io/?path=%2F&EIO=4&transport=polling&t=PFzpjCz
Requested by
Host: dukanwalay.com
URL: https://dukanwalay.com/assets/index-70e25d6e.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
89.23.113.76 , Russian Federation, ASN207713 (GIR-AS GLOBAL INTERNET SOLUTIONS LLC, RU),
Reverse DNS
47446.ip-ptr.tech
Software
stormwall /
Resource Hash
27e0bbb5c16c7b2502c843de712426a3ac60b4cf602f376776d3c475c5b8af5b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Accept
*/*
Referer
https://dukanwalay.com/?cost=0.048&currency=usd&external_id=P3tkeH56fHl9f3h9e316e2R-ZHh4cX1xZHh9eX9-fX9kKnF7eHh7fnFkfixwKmQof3x_ZHtwcHxkf38sLHl4fih_LS1x&creative_id=3508485&ad_campaign_id=15&source=responsible-another-traffic-quiet-taste&campaign_name=roi-22039735&publisher_id=flaky-another-traffic

Response headers

access-control-max-age
3628800
cache-control
no-store
access-control-allow-methods
GET, DELETE, OPTIONS, POST, PUT
access-control-allow-origin
*
content-length
118
date
Wed, 25 Dec 2024 12:33:30 GMT
content-type
text/plain; charset=UTF-8
vary
Origin
server
stormwall
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, JSNLog-RequestId, activityId, applicationId, applicationUserId, channelId, senderId, sessionId
config
dukanwalay.com/ 		561 B
264 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://dukanwalay.com/config
Requested by
Host: dukanwalay.com
URL: https://dukanwalay.com/assets/index-70e25d6e.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
89.23.113.76 , Russian Federation, ASN207713 (GIR-AS GLOBAL INTERNET SOLUTIONS LLC, RU),
Reverse DNS
47446.ip-ptr.tech
Software
stormwall /
Resource Hash
bd9b8dc5e4936e1d19cb5095a9a6de3cf82859cc2ff7bbbf561a8b5290a7f745

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Accept
application/json, text/plain, */*
Referer
https://dukanwalay.com/?cost=0.048&currency=usd&external_id=P3tkeH56fHl9f3h9e316e2R-ZHh4cX1xZHh9eX9-fX9kKnF7eHh7fnFkfixwKmQof3x_ZHtwcHxkf38sLHl4fih_LS1x&creative_id=3508485&ad_campaign_id=15&source=responsible-another-traffic-quiet-taste&campaign_name=roi-22039735&publisher_id=flaky-another-traffic

Response headers

content-encoding
gzip
date
Wed, 25 Dec 2024 12:33:30 GMT
content-type
text/html
server
stormwall
favicon.ico
dukanwalay.com/ 		150 B
525 B 		Other
General
Check archive.org
Download Go to
Full URL
https://dukanwalay.com/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
89.23.113.76 , Russian Federation, ASN207713 (GIR-AS GLOBAL INTERNET SOLUTIONS LLC, RU),
Reverse DNS
47446.ip-ptr.tech
Software
stormwall /
Resource Hash
6e21162bc64073fe9e3d3d6375ca24d04fed1912a5b7716aac0cb0f2d16fae7c
Security Headers
Name Value
Content-Security-Policy default-src 'none'
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://dukanwalay.com/?cost=0.048&currency=usd&external_id=P3tkeH56fHl9f3h9e316e2R-ZHh4cX1xZHh9eX9-fX9kKnF7eHh7fnFkfixwKmQof3x_ZHtwcHxkf38sLHl4fih_LS1x&creative_id=3508485&ad_campaign_id=15&source=responsible-another-traffic-quiet-taste&campaign_name=roi-22039735&publisher_id=flaky-another-traffic

Response headers

access-control-max-age
3628800
content-security-policy
default-src 'none'
content-encoding
gzip
access-control-allow-methods
GET, DELETE, OPTIONS, POST, PUT
x-content-type-options
nosniff
access-control-allow-origin
*
date
Wed, 25 Dec 2024 12:33:30 GMT
content-type
text/html; charset=utf-8
server
stormwall
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, JSNLog-RequestId, activityId, applicationId, applicationUserId, channelId, senderId, sessionId
/
dukanwalay.com/socket.io/ 		2 B
338 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://dukanwalay.com/socket.io/?path=%2F&EIO=4&transport=polling&t=PFzpjHk&sid=4cwQOAL-johCOgEiAD0Q
Requested by
Host: dukanwalay.com
URL: https://dukanwalay.com/assets/index-70e25d6e.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
89.23.113.76 , Russian Federation, ASN207713 (GIR-AS GLOBAL INTERNET SOLUTIONS LLC, RU),
Reverse DNS
47446.ip-ptr.tech
Software
stormwall /
Resource Hash
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer
https://dukanwalay.com/?cost=0.048&currency=usd&external_id=P3tkeH56fHl9f3h9e316e2R-ZHh4cX1xZHh9eX9-fX9kKnF7eHh7fnFkfixwKmQof3x_ZHtwcHxkf38sLHl4fih_LS1x&creative_id=3508485&ad_campaign_id=15&source=responsible-another-traffic-quiet-taste&campaign_name=roi-22039735&publisher_id=flaky-another-traffic
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Accept
*/*
Content-type
text/plain;charset=UTF-8

Response headers

access-control-max-age
3628800
cache-control
no-store
access-control-allow-methods
GET, DELETE, OPTIONS, POST, PUT
access-control-allow-origin
*
content-length
2
date
Wed, 25 Dec 2024 12:33:30 GMT
content-type
text/html
vary
Origin
server
stormwall
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, JSNLog-RequestId, activityId, applicationId, applicationUserId, channelId, senderId, sessionId
/
dukanwalay.com/socket.io/ 		32 B
381 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://dukanwalay.com/socket.io/?path=%2F&EIO=4&transport=polling&t=PFzpjHl&sid=4cwQOAL-johCOgEiAD0Q
Requested by
Host: dukanwalay.com
URL: https://dukanwalay.com/assets/index-70e25d6e.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
89.23.113.76 , Russian Federation, ASN207713 (GIR-AS GLOBAL INTERNET SOLUTIONS LLC, RU),
Reverse DNS
47446.ip-ptr.tech
Software
stormwall /
Resource Hash
d91d005be86294f3d220373462bd76de49c0d28d235b4106388124022c220703

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Accept
*/*
Referer
https://dukanwalay.com/?cost=0.048&currency=usd&external_id=P3tkeH56fHl9f3h9e316e2R-ZHh4cX1xZHh9eX9-fX9kKnF7eHh7fnFkfixwKmQof3x_ZHtwcHxkf38sLHl4fih_LS1x&creative_id=3508485&ad_campaign_id=15&source=responsible-another-traffic-quiet-taste&campaign_name=roi-22039735&publisher_id=flaky-another-traffic

Response headers

access-control-max-age
3628800
cache-control
no-store
access-control-allow-methods
GET, DELETE, OPTIONS, POST, PUT
access-control-allow-origin
*
content-length
32
date
Wed, 25 Dec 2024 12:33:30 GMT
content-type
text/plain; charset=UTF-8
vary
Origin
server
stormwall
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, JSNLog-RequestId, activityId, applicationId, applicationUserId, channelId, senderId, sessionId
/
dukanwalay.com/socket.io/ 		1 B
349 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://dukanwalay.com/socket.io/?path=%2F&EIO=4&transport=polling&t=PFzpjMb&sid=4cwQOAL-johCOgEiAD0Q
Requested by
Host: dukanwalay.com
URL: https://dukanwalay.com/assets/index-70e25d6e.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
89.23.113.76 , Russian Federation, ASN207713 (GIR-AS GLOBAL INTERNET SOLUTIONS LLC, RU),
Reverse DNS
47446.ip-ptr.tech
Software
stormwall /
Resource Hash
e7f6c011776e8db7cd330b54174fd76f7d0216b612387a5ffcfb81e6f0919683

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Accept
*/*
Referer
https://dukanwalay.com/?cost=0.048&currency=usd&external_id=P3tkeH56fHl9f3h9e316e2R-ZHh4cX1xZHh9eX9-fX9kKnF7eHh7fnFkfixwKmQof3x_ZHtwcHxkf38sLHl4fih_LS1x&creative_id=3508485&ad_campaign_id=15&source=responsible-another-traffic-quiet-taste&campaign_name=roi-22039735&publisher_id=flaky-another-traffic

Response headers

access-control-max-age
3628800
cache-control
no-store
access-control-allow-methods
GET, DELETE, OPTIONS, POST, PUT
access-control-allow-origin
*
content-length
1
date
Wed, 25 Dec 2024 12:33:31 GMT
content-type
text/plain; charset=UTF-8
vary
Origin
server
stormwall
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, JSNLog-RequestId, activityId, applicationId, applicationUserId, channelId, senderId, sessionId

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: WhatsApp (Instant Messenger)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| __VUE__

1 Cookies

Domain/Path Name / Value
dukanwalay.com/ Name: Auth
Value: 8bc76d6e8f66bc35d50923285977e414

2 Console Messages

Source Level URL
Text
network error URL: https://dukanwalay.com/config
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://dukanwalay.com/favicon.ico
Message:
Failed to load resource: the server responded with a status of 404 ()