4acc0unt-r3c0v3ry.duckdns.org Open in urlscan Pro
103.52.114.106  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request or.html Show response 4acc0unt-r3c0v3ry.duckdns.org/	3 KB 1 KB	1389ms 92ms	Document text/html	103.52.114.106 IDNIC-IDCLOUDHOST...
General Check archive.org Show headers Download Go to Full URL http://4acc0unt-r3c0v3ry.duckdns.org/or.html Protocol HTTP/1.1 Server 103.52.114.106 , Indonesia, ASN136052 (IDNIC-IDCLOUDHOST-AS-ID PT Cloud Hosting Indonesia, ID), Reverse DNS serverph.petasite.my.id Software LiteSpeed / Resource Hash 6f863cfa5164c29c5c6632b6926e41da9748cb00c6a7c8ea099524fb90171b0c Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 accept-language jp-JP,jp;q=0.9 Response headers Connection Keep-Alive Keep-Alive timeout=5, max=100 accept-ranges bytes content-encoding gzip content-length 1210 content-type text/html date Sun, 02 Jul 2023 11:03:05 GMT last-modified Sat, 01 Jul 2023 11:41:48 GMT server LiteSpeed vary Accept-Encoding
GET H2	200	bootstrap.min.css stackpath.bootstrapcdn.com/bootstrap/4.5.2/css/	157 KB 25 KB	22ms 11ms	Stylesheet text/css	2606:4700::6812:bcf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/css/bootstrap.min.css Requested by Host: 4acc0unt-r3c0v3ry.duckdns.org URL: http://4acc0unt-r3c0v3ry.duckdns.org/or.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5b0fbe5b7ad705f6a937c4998ad02f73d8f0d976fe231b74aef0ec996990c93a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer http://4acc0unt-r3c0v3ry.duckdns.org/ Origin http://4acc0unt-r3c0v3ry.duckdns.org accept-language jp-JP,jp;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Sun, 02 Jul 2023 11:03:05 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT content-encoding br cdn-edgestorageid 995 age 1800 cdn-cachedat 09/25/2022 20:57:45 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 last-modified Mon, 25 Jan 2021 22:04:11 GMT cdn-proxyver 1.02 cdn-requestpullcode 200 server cloudflare etag W/"816af0eddd3b4822c2756227c7e7b7ee" vary Accept-Encoding content-type text/css; charset=utf-8 access-control-allow-origin * cdn-cache HIT cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cache-control public, max-age=31919000 cdn-requestid 6ca3c072e62d6c29059fbccb86a1f7aa timing-allow-origin * cdn-requestcountrycode US cdn-status 200 cf-ray 7e066672c87a261d-NRT cdn-requestpullsuccess True
GET H/1.1	200 OK	styel.css 4acc0unt-r3c0v3ry.duckdns.org/css/	855 B 735 B	94ms 93ms	Stylesheet text/css	103.52.114.106 IDNIC-IDCLOUDHOST...
General Check archive.org Show headers Download Go to Full URL http://4acc0unt-r3c0v3ry.duckdns.org/css/styel.css Requested by Host: 4acc0unt-r3c0v3ry.duckdns.org URL: http://4acc0unt-r3c0v3ry.duckdns.org/or.html Protocol HTTP/1.1 Server 103.52.114.106 , Indonesia, ASN136052 (IDNIC-IDCLOUDHOST-AS-ID PT Cloud Hosting Indonesia, ID), Reverse DNS serverph.petasite.my.id Software LiteSpeed / Resource Hash 0c4007f08084fd9075d30dac082a481e260e864535d51a94731a23d9531ea06f Request headers accept-language jp-JP,jp;q=0.9 Referer http://4acc0unt-r3c0v3ry.duckdns.org/or.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Sun, 02 Jul 2023 11:03:05 GMT content-encoding gzip last-modified Sat, 01 Jul 2023 11:42:06 GMT server LiteSpeed vary Accept-Encoding content-type text/css cache-control public, max-age=604800 Connection Keep-Alive accept-ranges bytes Keep-Alive timeout=5, max=100 content-length 365 expires Sun, 09 Jul 2023 11:03:05 GMT
GET H/1.1	200 OK	Meta-Logo-Facebook-The-Apple-Post.jpeg 4acc0unt-r3c0v3ry.duckdns.org/	25 KB 25 KB	93ms 92ms	Image image/jpeg	103.52.114.106 IDNIC-IDCLOUDHOST...
General Check archive.org Show headers Download Go to Show image Full URL http://4acc0unt-r3c0v3ry.duckdns.org/Meta-Logo-Facebook-The-Apple-Post.jpeg Requested by Host: 4acc0unt-r3c0v3ry.duckdns.org URL: http://4acc0unt-r3c0v3ry.duckdns.org/or.html Protocol HTTP/1.1 Server 103.52.114.106 , Indonesia, ASN136052 (IDNIC-IDCLOUDHOST-AS-ID PT Cloud Hosting Indonesia, ID), Reverse DNS serverph.petasite.my.id Software LiteSpeed / Resource Hash 19385cf17bbefbf0d6b5fcde99e2782b9043a673a959ef761a9c3cc4c9a2d5cd Request headers accept-language jp-JP,jp;q=0.9 Referer http://4acc0unt-r3c0v3ry.duckdns.org/or.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Sun, 02 Jul 2023 11:03:05 GMT last-modified Sat, 01 Jul 2023 11:41:46 GMT server LiteSpeed content-type image/jpeg cache-control public, max-age=604800 Connection Keep-Alive accept-ranges bytes Keep-Alive timeout=5, max=100 content-length 25727 expires Sun, 09 Jul 2023 11:03:05 GMT
GET H2	200	jquery-3.5.1.slim.min.js Show response code.jquery.com/	71 KB 24 KB	345ms 111ms	Script application/javascript	2001:4de0:ac18::1:a:2b STACKPATH-CDN
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.5.1.slim.min.js Requested by Host: 4acc0unt-r3c0v3ry.duckdns.org URL: http://4acc0unt-r3c0v3ry.duckdns.org/or.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac18::1:a:2b , Netherlands, ASN20446 (STACKPATH-CDN, US), Reverse DNS Software nginx / Resource Hash e3e5f35d586c0e6a9a9d7187687be087580c40a5f8d0e52f0c4053bbc25c98db Request headers Referer http://4acc0unt-r3c0v3ry.duckdns.org/ Origin http://4acc0unt-r3c0v3ry.duckdns.org accept-language jp-JP,jp;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Sun, 02 Jul 2023 11:03:05 GMT content-encoding gzip last-modified Fri, 20 Aug 2021 17:47:53 GMT server nginx etag W/"611feac9-11abc" vary Accept-Encoding x-hw 1688295785.dop206.sj3.t,1688295785.cds008.sj3.hn,1688295785.cds102.sj3.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 24606
GET H2	200	popper.min.js Show response cdn.jsdelivr.net/npm/popper.js@1.16.1/dist/umd/	21 KB 8 KB	19ms 3ms	Script application/javascript	2a04:4e42:600::485 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/popper.js@1.16.1/dist/umd/popper.min.js Requested by Host: 4acc0unt-r3c0v3ry.duckdns.org URL: http://4acc0unt-r3c0v3ry.duckdns.org/or.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash fe28dc38bc057f6eb11180235bbe458b3295a39b674d889075d3d9a0b5071d9f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer http://4acc0unt-r3c0v3ry.duckdns.org/ Origin http://4acc0unt-r3c0v3ry.duckdns.org accept-language jp-JP,jp;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains; preload date Sun, 02 Jul 2023 11:03:05 GMT x-content-type-options nosniff content-encoding br age 9410601 x-jsd-version 1.16.1 x-cache HIT, HIT cross-origin-resource-policy cross-origin alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 content-length 7831 x-served-by cache-fra-eddf8230124-FRA, cache-tyo11927-TYO x-jsd-version-type version etag W/"52f1-MTeJyg4xtlR4TbuosPg/Nk+Gg7Q" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=31536000, s-maxage=31536000, immutable accept-ranges bytes timing-allow-origin *
GET H2	200	bootstrap.min.js Show response stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/	59 KB 16 KB	17ms 11ms	Script application/javascript	2606:4700::6812:bcf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/bootstrap.min.js Requested by Host: 4acc0unt-r3c0v3ry.duckdns.org URL: http://4acc0unt-r3c0v3ry.duckdns.org/or.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 79c599dd760cec0c1621a1af49d9a2a49da5d45e1b37d4575bace0a5e0226582 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer http://4acc0unt-r3c0v3ry.duckdns.org/ Origin http://4acc0unt-r3c0v3ry.duckdns.org accept-language jp-JP,jp;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Sun, 02 Jul 2023 11:03:05 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT content-encoding br cdn-edgestorageid 994 age 1800 cdn-cachedat 09/24/2022 22:11:19 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 last-modified Mon, 25 Jan 2021 22:04:11 GMT cdn-proxyver 1.02 cdn-requestpullcode 200 server cloudflare etag W/"02d223393e00c273efdcb1ade8f4f8b1" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cdn-cache HIT cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cache-control public, max-age=31919000 cdn-requestid 9c6d98ff2a5b4d85ee46c3fe5f3b2c5a timing-allow-origin * cdn-requestcountrycode US cdn-status 200 cf-ray 7e066672c87c261d-NRT cdn-requestpullsuccess True

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| onbeforetoggle object| onscrollend function| $ function| jQuery function| Popper object| bootstrap

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

4acc0unt-r3c0v3ry.duckdns.org
cdn.jsdelivr.net
code.jquery.com
stackpath.bootstrapcdn.com
103.52.114.106
2001:4de0:ac18::1:a:2b
2606:4700::6812:bcf
2a04:4e42:600::485
0c4007f08084fd9075d30dac082a481e260e864535d51a94731a23d9531ea06f
19385cf17bbefbf0d6b5fcde99e2782b9043a673a959ef761a9c3cc4c9a2d5cd
5b0fbe5b7ad705f6a937c4998ad02f73d8f0d976fe231b74aef0ec996990c93a
6f863cfa5164c29c5c6632b6926e41da9748cb00c6a7c8ea099524fb90171b0c
79c599dd760cec0c1621a1af49d9a2a49da5d45e1b37d4575bace0a5e0226582
e3e5f35d586c0e6a9a9d7187687be087580c40a5f8d0e52f0c4053bbc25c98db
fe28dc38bc057f6eb11180235bbe458b3295a39b674d889075d3d9a0b5071d9f