bem7z6en6zj.duckdns.org Open in urlscan Pro
51.20.82.91  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request apredstion1.php Show response bem7z6en6zj.duckdns.org/	8 KB 4 KB	376ms 163ms	Document text/html	51.20.82.91 AMAZON-02
General Check archive.org Show headers Download Go to Full URL http://bem7z6en6zj.duckdns.org/apredstion1.php Protocol HTTP/1.1 Server 51.20.82.91 Stockholm, Sweden, ASN16509 (AMAZON-02, US), Reverse DNS ec2-51-20-82-91.eu-north-1.compute.amazonaws.com Software LiteSpeed / Resource Hash cc5dcf19b43196e5353ce1195dc059cd1a618d4741f6ed506ff85754da1c6a2f Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 accept-language en-US,en;q=0.9 Response headers connection Keep-Alive content-encoding gzip content-length 3612 content-type text/html; charset=UTF-8 date Sat, 07 Oct 2023 03:48:06 GMT server LiteSpeed vary Accept-Encoding
GET H/1.1	200 OK	style-info.css bem7z6en6zj.duckdns.org/css/	41 KB 9 KB	162ms 161ms	Stylesheet text/css	51.20.82.91 AMAZON-02
General Check archive.org Show headers Download Go to Full URL http://bem7z6en6zj.duckdns.org/css/style-info.css Requested by Host: bem7z6en6zj.duckdns.org URL: http://bem7z6en6zj.duckdns.org/apredstion1.php Protocol HTTP/1.1 Server 51.20.82.91 Stockholm, Sweden, ASN16509 (AMAZON-02, US), Reverse DNS ec2-51-20-82-91.eu-north-1.compute.amazonaws.com Software LiteSpeed / Resource Hash e99cf1780b3373410b90c7bc7d9b487158a6b9cd92c29c3c1d6025a8df1577a9 Request headers accept-language en-US,en;q=0.9 Referer http://bem7z6en6zj.duckdns.org/apredstion1.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 03:48:07 GMT content-encoding gzip last-modified Sun, 01 Oct 2023 03:20:26 GMT server LiteSpeed etag "a38d-6518e57a-10ab4c;gz" vary Accept-Encoding content-type text/css cache-control public, max-age=604800 connection Keep-Alive accept-ranges bytes content-length 8543 expires Sat, 14 Oct 2023 03:48:07 GMT
GET H/1.1	200 OK	interview.css bem7z6en6zj.duckdns.org/css/	10 KB 2 KB	323ms 161ms	Stylesheet text/css	51.20.82.91 AMAZON-02
General Check archive.org Show headers Download Go to Full URL http://bem7z6en6zj.duckdns.org/css/interview.css Requested by Host: bem7z6en6zj.duckdns.org URL: http://bem7z6en6zj.duckdns.org/apredstion1.php Protocol HTTP/1.1 Server 51.20.82.91 Stockholm, Sweden, ASN16509 (AMAZON-02, US), Reverse DNS ec2-51-20-82-91.eu-north-1.compute.amazonaws.com Software LiteSpeed / Resource Hash 9912a9154c510429fa1b8087ed8b3ec90ef2c55b97a7dca6440e2a21789de740 Request headers accept-language en-US,en;q=0.9 Referer http://bem7z6en6zj.duckdns.org/apredstion1.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 03:48:07 GMT content-encoding gzip last-modified Sun, 01 Oct 2023 03:20:20 GMT server LiteSpeed etag "291c-6518e574-10ab4b;gz" vary Accept-Encoding content-type text/css cache-control public, max-age=604800 connection Keep-Alive accept-ranges bytes content-length 1543 expires Sat, 14 Oct 2023 03:48:07 GMT
GET H2	200	fb_icon_325x325.png www.facebook.com/images/	3 KB 3 KB	264ms 53ms	Image image/png	2a03:2880:f103:83:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/images/fb_icon_325x325.png Requested by Host: bem7z6en6zj.duckdns.org URL: http://bem7z6en6zj.duckdns.org/apredstion1.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f103:83:face:b00c:0:25de Ashburn, United States, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash bc40d55fd8796c2bbd2693fd3fc4eb4ebdca9d6b02eb12b7e3efa7e53d4aaeb3 Security Headers Name Value Strict-Transport-Security max-age=15552000; preload X-Content-Type-Options nosniff Request headers accept-language en-US,en;q=0.9 Referer http://bem7z6en6zj.duckdns.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers strict-transport-security max-age=15552000; preload date Fri, 06 Oct 2023 10:19:34 GMT x-content-type-options nosniff content-md5 GwcFNOsathlfT8cRjfyL5Q== document-policy force-load-at-top edge-control cache-maxage=86400s cross-origin-resource-policy cross-origin content-length 2613 x-fb-debug LYV+yMPC8X3KA6cKleREN07gH0GrqWfc3UbUpCxYYqQI7p5sgFeL1uMKSMqdm+xtDlYcGqKYFcWogDeEmwXoLA== cross-origin-opener-policy same-origin-allow-popups report-to {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]} content-type image/png access-control-allow-origin * cache-control public,max-age=86400 permissions-policy accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(self), geolocation=(self), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(self), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=() timing-allow-origin * expires Sat, 07 Oct 2023 10:19:34 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

string| tanggallengkap object| namahari object| namabulan object| tgl number| hari number| tanggal number| bulan number| tahun function| mousedwn

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bem7z6en6zj.duckdns.org
www.facebook.com
2a03:2880:f103:83:face:b00c:0:25de
51.20.82.91
9912a9154c510429fa1b8087ed8b3ec90ef2c55b97a7dca6440e2a21789de740
bc40d55fd8796c2bbd2693fd3fc4eb4ebdca9d6b02eb12b7e3efa7e53d4aaeb3
cc5dcf19b43196e5353ce1195dc059cd1a618d4741f6ed506ff85754da1c6a2f
e99cf1780b3373410b90c7bc7d9b487158a6b9cd92c29c3c1d6025a8df1577a9