omeserv1.duckdns.org Open in urlscan Pro
62.4.23.112  Malicious Activity! Public Scan

2 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://omeserv.duckdns.org/ Page URL
2. https://omeserv1.duckdns.org/ Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	/ omeserv.duckdns.org/	203 B 340 B	3845ms 3707ms	Document text/html	62.4.23.112 Online SAS
General Check archive.org Show headers Download Go to Full URL https://omeserv.duckdns.org/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 62.4.23.112 Paray-Vieille-Poste, France, ASN12876 (Online SAS, FR), Reverse DNS Software Apache / Resource Hash Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 accept-language fr-FR,fr;q=0.9 Response headers cache-control no-store, no-cache, must-revalidate content-encoding gzip content-length 141 content-type text/html; charset=UTF-8 date Thu, 21 Dec 2023 20:29:32 GMT expires Thu, 19 Nov 1981 08:52:00 GMT pragma no-cache server Apache vary Accept-Encoding
GET H2	200	Primary Request / Show response omeserv1.duckdns.org/	191 KB 27 KB	422ms 285ms	Document text/html	62.4.23.112 Online SAS
General Check archive.org Show headers Download Go to Full URL https://omeserv1.duckdns.org/ Requested by Host: omeserv.duckdns.org URL: https://omeserv.duckdns.org/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 62.4.23.112 Paray-Vieille-Poste, France, ASN12876 (Online SAS, FR), Reverse DNS Software Apache / Resource Hash b82e976080152211ef2734eb2a05ae2cfa947c81b9fa0d977ea045e9bbcbebc9 Request headers Referer https://omeserv.duckdns.org/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 accept-language fr-FR,fr;q=0.9 Response headers cache-control no-store, no-cache, must-revalidate content-encoding gzip content-length 27260 content-type text/html; charset=UTF-8 date Thu, 21 Dec 2023 20:29:36 GMT expires Thu, 19 Nov 1981 08:52:00 GMT pragma no-cache server Apache vary Accept-Encoding
GET H2	200	microsoft_logo.svg secure.aadcdn.microsoftonline-p.com/ests/2.1.8148.16/content/images/	4 KB 2 KB	143ms 43ms	Image image/svg+xml	2620:1ec:46::45 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://secure.aadcdn.microsoftonline-p.com/ests/2.1.8148.16/content/images/microsoft_logo.svg?x=ee5c8d9fb6248c938fd0dc19370e90bd Requested by Host: omeserv1.duckdns.org URL: https://omeserv1.duckdns.org/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:46::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a Request headers accept-language fr-FR,fr;q=0.9 Referer https://omeserv1.duckdns.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers x-ms-lease-status unlocked x-ms-blob-type BlockBlob date Thu, 21 Dec 2023 20:29:37 GMT content-encoding gzip last-modified Sat, 18 May 2019 23:35:05 GMT etag 0x8D6DBE974E70D87 x-azure-ref 20231221T202936Z-70ynwardbp1f15ac3gvzgzhns000000002vg00000000nsfy x-cache TCP_HIT content-type image/svg+xml x-ms-request-id 658481aa-c01e-0081-6c0e-343161000000 cache-control public, max-age=604800 x-ms-version 2009-09-19 accept-ranges bytes content-length 1435
GET H2	200	jquery-3.3.1.min.js Show response code.jquery.com/	85 KB 30 KB	56ms 18ms	Script application/javascript	2a04:4e42:600::649 FASTLY
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.3.1.min.js Requested by Host: omeserv1.duckdns.org URL: https://omeserv1.duckdns.org/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:600::649 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef Request headers accept-language fr-FR,fr;q=0.9 Referer https://omeserv1.duckdns.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers date Thu, 21 Dec 2023 20:29:36 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish age 3920584 x-cache HIT, HIT content-length 30288 x-served-by cache-lga13622-LGA, cache-lcy-eglc8600022-LCY last-modified Fri, 18 Oct 1991 12:00:00 GMT server nginx x-timer S1703190577.926629,VS0,VE0 etag W/"28feccc0-1538f" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=604800 accept-ranges bytes x-cache-hits 19, 637462
GET H2	404	prefetch(1).html Show response omeserv1.duckdns.org/Sign%20in%20to%20your%20account_files/ Frame 05E2	267 B 317 B	19ms 19ms	Document text/html	62.4.23.112 Online SAS
General Check archive.org Show headers Download Go to Full URL https://omeserv1.duckdns.org/Sign%20in%20to%20your%20account_files/prefetch(1).html Requested by Host: omeserv1.duckdns.org URL: https://omeserv1.duckdns.org/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 62.4.23.112 Paray-Vieille-Poste, France, ASN12876 (Online SAS, FR), Reverse DNS Software Apache / Resource Hash eb5312e524654f1ff3b7453016a268d65f692c9ea11374df4a351b4ac4247c09 Request headers Referer https://omeserv1.duckdns.org/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 accept-language fr-FR,fr;q=0.9 Response headers content-length 267 content-type text/html; charset=iso-8859-1 date Thu, 21 Dec 2023 20:29:36 GMT server Apache
GET H2	200	2_bc3d32a696895f78c19df6c717586a5d.svg aadcdn.msauth.net/shared/1.0/content/images/backgrounds/	2 KB 1 KB	88ms 20ms	Image image/svg+xml	2620:1ec:bdf::45 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg Requested by Host: omeserv1.duckdns.org URL: https://omeserv1.duckdns.org/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:bdf::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68 Request headers accept-language fr-FR,fr;q=0.9 Referer https://omeserv1.duckdns.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Thu, 21 Dec 2023 20:29:36 GMT content-encoding gzip x-cache TCP_HIT content-length 673 x-ms-lease-status unlocked last-modified Wed, 12 Feb 2020 22:01:30 GMT etag 0x8D7B0071D86E386 x-azure-ref 20231221T202936Z-4p5qrae14h7rdcfh5ha9cd0ppn000000011000000000v9cb content-type image/svg+xml access-control-allow-origin * x-ms-request-id ea6f2bca-901e-0002-6404-346177000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| documentPictureInPicture function| $ function| jQuery function| goNext function| closeBox function| checkSubmit function| isEmail function| iserror function| isSuccess

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			omeserv.duckdns.org/	1969-12-31 23:59:59	Name: PHPSESSID Value: hjp2hrgjj2uu0gl643cngkpkdq
			omeserv1.duckdns.org/	1969-12-31 23:59:59	Name: PHPSESSID Value: s4msr0os1pajhj1m5djr2hd3m8

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://omeserv1.duckdns.org/Sign%20in%20to%20your%20account_files/prefetch(1).html Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aadcdn.msauth.net
code.jquery.com
omeserv.duckdns.org
omeserv1.duckdns.org
secure.aadcdn.microsoftonline-p.com
2620:1ec:46::45
2620:1ec:bdf::45
2a04:4e42:600::649
62.4.23.112
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
b82e976080152211ef2734eb2a05ae2cfa947c81b9fa0d977ea045e9bbcbebc9
eb5312e524654f1ff3b7453016a268d65f692c9ea11374df4a351b4ac4247c09