urlscan.io logo urlscan.io
SecurityTrails logo

coordinated-duck.surge.sh Open in urlscan Pro
188.166.132.94  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://bom.so/8fltGu
Effective URL: https://coordinated-duck.surge.sh/id.html/
Submission: On September 02 via api from GB — Scanned from GB
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 2 countries across 2 domains to perform 4 HTTP transactions. The main IP is 188.166.132.94, located in Amsterdam, Netherlands and belongs to DIGITALOCEAN-ASN, US. The main domain is coordinated-duck.surge.sh.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on April 19th 2024. Valid for: a year.
This is the only time coordinated-duck.surge.sh was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

IP Address AS Autonomous System
1 1 2606:4700:303... 13335 (CLOUDFLAR...)
1 5 188.166.132.94 14061 (DIGITALOC...)
4 1
Apex Domain
Subdomains		 Transfer
5 surge.sh
coordinated-duck.surge.sh
111 KB
1 bom.so
bom.so — Cisco Umbrella Rank: 664323
704 B
4 2
Domain Requested by
5 coordinated-duck.surge.sh 1 redirects coordinated-duck.surge.sh
1 bom.so 1 redirects
4 2

This site contains no links.

Subject Issuer Validity Valid
*.surge.sh
Sectigo RSA Domain Validation Secure Server CA		 2024-04-19 -
2025-05-18		 a year crt.sh

This page contains 1 frames:

Primary Page: https://coordinated-duck.surge.sh/id.html/
Frame ID: 3C6EE33E62F6BD58E40E3A3B22A6C03E
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Trang chủ

Page URL History Show full URLs

  1. https://bom.so/8fltGu HTTP 301
    https://coordinated-duck.surge.sh/id.html HTTP 301
    https://coordinated-duck.surge.sh/id.html/ Page URL

Page Statistics

4
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

1
IPs

2
Countries

111 kB
Transfer

294 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://bom.so/8fltGu HTTP 301
    https://coordinated-duck.surge.sh/id.html HTTP 301
    https://coordinated-duck.surge.sh/id.html/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
coordinated-duck.surge.sh/id.html/
Redirect Chain
  • https://bom.so/8fltGu
  • https://coordinated-duck.surge.sh/id.html
  • https://coordinated-duck.surge.sh/id.html/
947 B
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://coordinated-duck.surge.sh/id.html/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
188.166.132.94 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Surge /
Resource Hash
ddd22f2a9ae4438125e3d56ac41d96a102dab1d57f2dc100059c6e229a08aef0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Accept-Ranges
bytes
Age
1035218
Cache-Control
public, max-age=0, must-revalidate
Connection
close
Content-Length
947
Content-Type
text/html; charset=UTF-8
Date
Mon, 02 Sep 2024 16:35:08 GMT
ETag
"ddd22f2a9ae4438125e3d56ac41d96a102dab1d57f2dc100059c6e229a08aef0"
Response-Time
1ms
Server
Surge
Surge-Cache
HIT
Surge-Stamp
4633::1724905645524-5941b2d4d80e123adbf8311958be6758
Vary
Accept-Encoding

Redirect headers

Connection
close
Content-Length
0
Date
Mon, 02 Sep 2024 16:35:08 GMT
Location
/id.html/
Server
Surge
Surge-Cache
HIT
Surge-Stamp
980::1724905645524
Mate.mp4
coordinated-duck.surge.sh/img/ 		185 KB
0 		Media
General
Check archive.org
Download Go to
Full URL
https://coordinated-duck.surge.sh/img/Mate.mp4
Requested by
Host: coordinated-duck.surge.sh
URL: https://coordinated-duck.surge.sh/id.html/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
188.166.132.94 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Surge /
Resource Hash

Request headers

Referer
https://coordinated-duck.surge.sh/id.html/
Accept-Encoding
identity;q=1, *;q=0
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
Range
bytes=0-

Response headers

Date
Mon, 02 Sep 2024 16:35:09 GMT
Surge-Stamp
980::1724905645524-10b6a79b6905a100feb12b61fed435b8
Server
Surge
Age
1035216
ETag
"2fb6e516e0120a67c26d56cfc201f81f88eee2cd5df9bb5019fc79af6b5650a4"
Content-Type
video/mp4
Response-Time
1ms
Content-Range
bytes 0-292265/292266
Cache-Control
public, max-age=0, must-revalidate
Connection
close
Accept-Ranges
bytes
Content-Length
292266
Surge-Cache
HIT
favicon.ico
coordinated-duck.surge.sh/ 		8 KB
8 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://coordinated-duck.surge.sh/favicon.ico
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
188.166.132.94 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Surge /
Resource Hash
5d37f9379291a60f698c2ed035bf47041f32a53251424774300f079e73d33468

Request headers

Referer
https://coordinated-duck.surge.sh/id.html/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Date
Mon, 02 Sep 2024 16:35:09 GMT
Surge-Stamp
980::1724905645524
Server
Surge
ETag
W/"2037-Bpq88syl4OLNTwUiR08il4/lN+0"
Content-Type
text/html; charset=utf-8
Connection
close
Content-Length
8247
Surge-Cache
HIT
Mate.mp4
coordinated-duck.surge.sh/img/ 		101 KB
101 KB 		Media
General
Check archive.org
Download Go to
Full URL
https://coordinated-duck.surge.sh/img/Mate.mp4
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
188.166.132.94 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Surge /
Resource Hash
0da6c50d3fb07b4cf65c12fe5c6604880fe581783c44fea058e457b32a8e22d2

Request headers

Referer
https://coordinated-duck.surge.sh/id.html/
Accept-Encoding
identity;q=1, *;q=0
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
Range
bytes=189213-

Response headers

Date
Mon, 02 Sep 2024 16:35:10 GMT
Surge-Stamp
980::1724905645524-10b6a79b6905a100feb12b61fed435b8
Server
Surge
Age
1035217
ETag
"2fb6e516e0120a67c26d56cfc201f81f88eee2cd5df9bb5019fc79af6b5650a4"
Content-Type
video/mp4
Response-Time
1ms
Content-Range
bytes 189213-292265/292266
Cache-Control
public, max-age=0, must-revalidate
Accept-Ranges
bytes
Content-Length
103053
Surge-Cache
HIT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Domain/Path Name / Value
bom.so/ Name: PHPSESSID
Value: jp5p1o7uuem6fa4mmtgc2g71t0
bom.so/ Name: short_8fltGu
Value: 1

2 Console Messages

Source Level URL
Text
network error URL: https://coordinated-duck.surge.sh/img/Mate.mp4
Message:
Failed to load resource: net::ERR_CONTENT_LENGTH_MISMATCH
network error URL: https://coordinated-duck.surge.sh/favicon.ico
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bom.so
coordinated-duck.surge.sh
188.166.132.94
2606:4700:3035::ac43:a3b8
0da6c50d3fb07b4cf65c12fe5c6604880fe581783c44fea058e457b32a8e22d2
5d37f9379291a60f698c2ed035bf47041f32a53251424774300f079e73d33468
ddd22f2a9ae4438125e3d56ac41d96a102dab1d57f2dc100059c6e229a08aef0