kajab.duckdns.org Open in urlscan Pro
165.227.115.195 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://kajab.duckdns.org/
Submission: On December 30 via api (December 30th 2024, 6:17:32 pm UTC) from US — Scanned from DE

Summary HTTP 16 Redirects Behaviour Indicators

Summary

This website contacted 9 IPs in 4 countries across 7 domains to perform 16 HTTP transactions. The main IP is 165.227.115.195, located in Clifton, United States and belongs to DIGITALOCEAN-ASN, US. The main domain is kajab.duckdns.org.
TLS certificate: Issued by R10 on December 30th 2024. Valid for: 3 months.

This is the only time kajab.duckdns.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DANA (Financial)

Domain & IP information

	IP Address	AS Autonomous System
1	165.227.115.195 165.227.115.195	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
2	2a00:1450:400... 2a00:1450:4001:801::200a	15169 (GOOGLE) (GOOGLE)
1	172.67.69.29 172.67.69.29	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2404:2280:1bf... 2404:2280:1bf:0:3::7ea	24429 (TAOBAO Zh...) (TAOBAO Zhejiang Taobao Network Co.)
2	104.17.24.14 104.17.24.14	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a04:4e42:200... 2a04:4e42:200::649	54113 (FASTLY) (FASTLY)
3	2a00:1450:400... 2a00:1450:4001:812::200a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:81c::200e	15169 (GOOGLE) (GOOGLE)
1	172.217.18.3 172.217.18.3	15169 (GOOGLE) (GOOGLE)
16	9

1 165.227.115.195 (Clifton, United States)

ASN14061 (DIGITALOCEAN-ASN, US)

kajab.duckdns.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:801::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.67.69.29 (United States)

ASN13335 (CLOUDFLARENET, US)

code.ionicframework.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2404:2280:1bf:0:3::7ea (Singapore)

ASN24429 (TAOBAO Zhejiang Taobao Network Co.,Ltd, CN)

a.m.dana.id	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.17.24.14 (None, )

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a04:4e42:200::649 (United States)

ASN54113 (FASTLY, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:812::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81c::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

encrypted-tbn0.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.18.3 (United States)

ASN15169 (GOOGLE, US)
PTR: fra15s28-in-f3.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 29 ajax.googleapis.com — Cisco Umbrella Rank: 415	91 KB
3	dana.id a.m.dana.id — Cisco Umbrella Rank: 63240	300 KB
2	gstatic.com encrypted-tbn0.gstatic.com fonts.gstatic.com	30 KB
2	jquery.com code.jquery.com — Cisco Umbrella Rank: 847	63 KB
2	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 225	55 KB
1	ionicframework.com code.ionicframework.com — Cisco Umbrella Rank: 22236	9 KB
1	duckdns.org kajab.duckdns.org	39 KB
16	7

	Domain	Requested by
3	ajax.googleapis.com	kajab.duckdns.org
3	a.m.dana.id	kajab.duckdns.org
2	code.jquery.com	kajab.duckdns.org
2	cdnjs.cloudflare.com	kajab.duckdns.org
2	fonts.googleapis.com	kajab.duckdns.org client
1	fonts.gstatic.com	fonts.googleapis.com
1	encrypted-tbn0.gstatic.com
1	code.ionicframework.com	kajab.duckdns.org
1	kajab.duckdns.org
16	9

This site contains no links.

Subject Issuer	Validity	Valid
cpcontacts.kajab.duckdns.org R10	`2024-12-30` - `2025-03-30`	3 months	crt.sh
upload.video.google.com WR2	`2024-12-02` - `2025-02-24`	3 months	crt.sh
ionicframework.com WE1	`2024-11-08` - `2025-02-06`	3 months	crt.sh
*.m.dana.id DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-03-05` - `2025-03-20`	a year	crt.sh
cdnjs.cloudflare.com WE1	`2024-11-26` - `2025-02-24`	3 months	crt.sh
*.jquery.com Sectigo ECC Domain Validation Secure Server CA	`2024-06-25` - `2025-06-25`	a year	crt.sh
*.gstatic.com WR2	`2024-12-02` - `2025-02-24`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://kajab.duckdns.org/
Frame ID: 10EC039408749C0CACA0F38568E4AE41
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

DANA - Apa pun transaksinya selalu ada DANA

Detected technologies

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Ionicons (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+ionicons(?:\.min)?\.css

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

16
Requests

100 %
HTTPS

56 %
IPv6

7
Domains

9
Subdomains

9
IPs

4
Countries

587 kB
Transfer

1071 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
kajab.duckdns.org/ 39 KB
39 KB 442ms
95ms Document
text/html 165.227.115.195
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://kajab.duckdns.org/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 165.227.115.195 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache /
Resource Hash: 187eb20185457f74f4ba2658ba52bb43ee02dce1c53dc2099b175df9c79eb33b

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

Accept-Ranges: bytes
Connection: Keep-Alive
Content-Length: 40083
Content-Type: text/html
Date: Mon, 30 Dec 2024 18:17:27 GMT
Keep-Alive: timeout=5, max=100
Last-Modified: Wed, 03 Jul 2024 14:06:18 GMT
Server: Apache

GET
H2 200 css2
fonts.googleapis.com/ 696 B
909 B 59ms
22ms Stylesheet
text/css 2a00:1450:4001:801::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Material%20Symbols%20Outlined:opsz,wght,FILL,GRAD@48,400,0,0

Requested by

Host: kajab.duckdns.org
URL: https://kajab.duckdns.org/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

dade0cb2438796c022edd04afbeb35d51b7616909c1ba37e42a2b9fd6935052c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://kajab.duckdns.org/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 30 Dec 2024 18:17:27 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 30 Dec 2024 18:17:27 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Mon, 30 Dec 2024 18:17:27 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H3 200 ionicons.min.css
code.ionicframework.com/ionicons/2.0.1/css/ 50 KB
9 KB 38ms
14ms Stylesheet
text/css 172.67.69.29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://code.ionicframework.com/ionicons/2.0.1/css/ionicons.min.css

Requested by

Host: kajab.duckdns.org
URL: https://kajab.duckdns.org/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.69.29 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

92ac508220f5bb60ec94e07650528eb66625f82a4740ada068cde05365781286

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://kajab.duckdns.org/

Response headers

x-fastly-request-id: f36727168d5e86943a5cbc774aad7409021e0b09
content-encoding: gzip
cf-cache-status: HIT
etag: W/"64382bc3-c854"
age: 562905
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4R3JpgMI0AF4In8I1DDozNcsZnor1GnT1GDFsgzt5NAeEe%2BzwY0z298ZbH1wDOSxhKGkmF5WqmBPwY8lOBSjH03lcL4JW%2BmK%2FrQrnFCJPtcdevGUpZZmht6u4WuF5y0td1l6yop4EHBw"}],"group":"cf-nel","max_age":604800}
x-github-request-id: 844A:1E1DEE:5E13A60:5EFB2E2:6760EEB4
x-content-type-options: nosniff
expires: Tue, 17 Dec 2024 03:33:32 GMT
x-proxy-cache: MISS
alt-svc: h3=":443"; ma=86400
x-cache: HIT
server-timing: cfL4;desc="?proto=QUIC&rtt=7107&min_rtt=6627&rtt_var=1783&sent=12&recv=9&lost=0&retrans=0&sent_bytes=4301&recv_bytes=4384&delivery_rate=95064&cwnd=12000&unsent_bytes=0&cid=adb4538498e17095&ts=19&x=1", cfExtPri, cfHdrFlush;dur=0
date: Mon, 30 Dec 2024 18:17:27 GMT
content-type: text/css; charset=utf-8
x-served-by: cache-fra-eddf8230136-FRA
x-cache-hits: 1
last-modified: Thu, 13 Apr 2023 16:20:19 GMT
vary: Accept-Encoding
priority: u=0,i=?0
strict-transport-security: max-age=15552000
cache-control: max-age=31536000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-timer: S1735019742.263092,VS0,VE1
via: 1.1 varnish
cf-ray: 8fa406d8697edc79-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 8313
x-origin-cache: HIT
server: cloudflare

GET
H2 200 css2
fonts.googleapis.com/ 2 KB
636 B 22ms
21ms Stylesheet
text/css 2a00:1450:4001:801::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Nunito:wght@800&display=swap

Requested by

Host: client
URL: about:client

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

344e98921d499fc4d96eb207bb24bff4513aa69150042bde6dd83642a351e0ac

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://kajab.duckdns.org/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 30 Dec 2024 18:17:27 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 30 Dec 2024 18:17:27 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Mon, 30 Dec 2024 18:17:27 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 hero-personal-tagline.svg
a.m.dana.id/resource/danaweb-v2/ 90 KB
42 KB 85ms
36ms Image
image/svg+xml 2404:2280:1bf:0:3::7ea
TAOBAO Zhejiang T...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://a.m.dana.id/resource/danaweb-v2/hero-personal-tagline.svg

Requested by

Host: kajab.duckdns.org
URL: https://kajab.duckdns.org/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:2280:1bf:0:3::7ea , Singapore, ASN24429 (TAOBAO Zhejiang Taobao Network Co.,Ltd, CN),

Reverse DNS

Software

Tengine /

Resource Hash

dce11da6f6b83fec7440a62f6e39151c8ff41c6f357978df2e042be1f219b7f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://kajab.duckdns.org/

Response headers

x-oss-cdn-auth: success
content-md5: HppoFhARMEYQNg3xV5f0pw==
x-oss-storage-class: Standard
content-encoding: br
etag: W/"1E9A68161011304610360DF15797F4A7"
age: 1822411
x-oss-object-type: Normal
access-control-allow-methods: GET
x-cache: HIT TCP_MEM_HIT dirn:-2:-2
date: Mon, 09 Dec 2024 16:03:56 GMT
x-oss-server-time: 20
content-type: image/svg+xml
vary: Accept-Encoding, Origin
last-modified: Fri, 01 Sep 2023 18:42:06 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-swift-cachetime: 1111777
timing-allow-origin: *
x-oss-hash-crc64ecma: 13363304510984115832
via: ens-cache8.l2de3[0,22,200-0,H], ens-cache9.l2de3[23,0], ens-cache4.de7[0,0,200-0,H], ens-cache7.de7[7,0]
ali-swift-global-savetime: 1733760236
x-swift-savetime: Thu, 26 Dec 2024 19:14:19 GMT
access-control-allow-origin: *
eagleid: a3b5839b17355826472842644e
x-oss-request-id: 675714EC13185C31334E9F84
server: Tengine

GET
H2 200 DANA-Logo-white.svg
a.m.dana.id/danaweb/v3/ 2 KB
1 KB 64ms
15ms Image
image/svg+xml 2404:2280:1bf:0:3::7ea
TAOBAO Zhejiang T...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://a.m.dana.id/danaweb/v3/DANA-Logo-white.svg

Requested by

Host: kajab.duckdns.org
URL: https://kajab.duckdns.org/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:2280:1bf:0:3::7ea , Singapore, ASN24429 (TAOBAO Zhejiang Taobao Network Co.,Ltd, CN),

Reverse DNS

Software

Tengine /

Resource Hash

b09dfa361390133435ab4a630122aebb35aa244da863a11006b3777e85ac6f47

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://kajab.duckdns.org/

Response headers

x-oss-cdn-auth: success
content-md5: NUrwPSOCXA9+q5Srz/V02Q==
x-oss-storage-class: Standard
content-encoding: br
etag: W/"354AF03D23825C0F7EAB94ABCFF574D9"
age: 1822365
x-oss-object-type: Normal
access-control-allow-methods: GET
x-cache: HIT TCP_HIT dirn:11:730707979
date: Mon, 09 Dec 2024 16:04:41 GMT
x-oss-server-time: 2
content-type: image/svg+xml
vary: Accept-Encoding, Origin
last-modified: Thu, 03 Nov 2022 07:49:13 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-swift-cachetime: 855382
timing-allow-origin: *
x-oss-hash-crc64ecma: 4940295184111390406
via: cache12.l2fr1[0,0,200-0,H], cache7.l2fr1[1,0], ens-cache6.de7[0,0,200-0,H], ens-cache7.de7[4,0]
ali-swift-global-savetime: 1733760282
x-swift-savetime: Sun, 29 Dec 2024 18:28:20 GMT
access-control-allow-origin: *
eagleid: a3b5839b17355826472842639e
x-oss-request-id: 6757151913185C31338C0F85
server: Tengine

GET
H3 200 jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/2.2.2/ 84 KB
27 KB 57ms
20ms Script
application/javascript 104.17.24.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/2.2.2/jquery.min.js

Requested by

Host: kajab.duckdns.org
URL: https://kajab.duckdns.org/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dfa729d82a3effadab1000181cb99108f232721e3b0af74cfae4c12704b35a32

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://kajab.duckdns.org/

Response headers

cf-cdnjs-via: cfworker/kv
content-encoding: br
cf-cache-status: HIT
etag: "5eb03ec4-14e98"
age: 563015
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6kgnuXsZsnDZeKIMh7YTTsHRLRqQokwxF9A%2FZ5yiaoXxgtT6kqCn%2Fr1JaIyU%2Bu0aaVmP1aUf40ArQdOeP0aIKS161SkETUVS7cbaZjNC%2BQuufuUBJ2B0NcTE9r%2FjQvjPYB78Y5O4"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Sat, 20 Dec 2025 18:17:27 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Mon, 30 Dec 2024 18:17:27 GMT
content-type: application/javascript; charset=utf-8
last-modified: Mon, 04 May 2020 16:11:48 GMT
vary: Accept-Encoding
priority: u=1,i=?0
strict-transport-security: max-age=15780000
cache-control: public, max-age=30672000
timing-allow-origin: *
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy: cross-origin
cf-ray: 8fa406d97ecf1ad4-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 27010
server: cloudflare

GET
H2 200 jquery-3.5.1.min.js Show response
code.jquery.com/ 87 KB
30 KB 471ms
56ms Script
application/javascript 2a04:4e42:200::649
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.5.1.min.js
Requested by: Host: kajab.duckdns.org
URL: https://kajab.duckdns.org/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://kajab.duckdns.org/

Response headers

content-encoding: gzip
etag: W/"28feccc0-15d84"
age: 4957323
x-cache: HIT, HIT
date: Mon, 30 Dec 2024 18:17:27 GMT
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
x-cache-hits: 357994, 465364
x-served-by: cache-lga21981-LGA, cache-mad2200114-MAD
vary: Accept-Encoding
cache-control: public, max-age=31536000, stale-while-revalidate=604800
x-timer: S1735582648.669597,VS0,VE0
cross-origin-resource-policy: cross-origin
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 30879
server: nginx

GET
H2 200 jquery-1.10.2.min.js Show response
code.jquery.com/ 91 KB
32 KB 462ms
47ms Script
application/javascript 2a04:4e42:200::649
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-1.10.2.min.js
Requested by: Host: kajab.duckdns.org
URL: https://kajab.duckdns.org/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 0ba081f546084bd5097aa8a73c75931d5aa1fc4d6e846e53c21f98e6a1509988

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://kajab.duckdns.org/

Response headers

content-encoding: gzip
etag: W/"28feccc0-16bb3"
age: 4167692
x-cache: HIT, HIT
date: Mon, 30 Dec 2024 18:17:27 GMT
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
x-cache-hits: 8113, 2781170
x-served-by: cache-lga21955-LGA, cache-mad2200114-MAD
vary: Accept-Encoding
cache-control: public, max-age=31536000, stale-while-revalidate=604800
x-timer: S1735582648.669311,VS0,VE0
cross-origin-resource-policy: cross-origin
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 32788
server: nginx

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/2.1.1/ 82 KB
29 KB 477ms
72ms Script
text/javascript 2a00:1450:4001:812::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/2.1.1/jquery.min.js

Requested by

Host: kajab.duckdns.org
URL: https://kajab.duckdns.org/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

874706b2b1311a0719b5267f7d1cf803057e367e94ae1ff7bf78c5450d30f5d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://kajab.duckdns.org/

Response headers

content-encoding: gzip
age: 551324
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
x-content-type-options: nosniff
expires: Wed, 24 Dec 2025 09:08:43 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 24 Dec 2024 09:08:43 GMT
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
accept-ranges: bytes
access-control-allow-origin: *
content-length: 29671
x-xss-protection: 0
server: sffe

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/2.1.3/ 82 KB
30 KB 439ms
56ms Script
text/javascript 2a00:1450:4001:812::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/2.1.3/jquery.min.js

Requested by

Host: kajab.duckdns.org
URL: https://kajab.duckdns.org/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8af93bd675e1cfd9ecc850e862819fdac6e3ad1f5d761f970e409c7d9c63bdc3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://kajab.duckdns.org/

Response headers

content-encoding: gzip
age: 221141
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
x-content-type-options: nosniff
expires: Sun, 28 Dec 2025 04:51:46 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 28 Dec 2024 04:51:46 GMT
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
accept-ranges: bytes
access-control-allow-origin: *
content-length: 29707
x-xss-protection: 0
server: sffe

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.5.1/ 87 KB
30 KB 438ms
55ms Script
text/javascript 2a00:1450:4001:812::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js

Requested by

Host: kajab.duckdns.org
URL: https://kajab.duckdns.org/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://kajab.duckdns.org/

Response headers

content-encoding: gzip
age: 279883
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
x-content-type-options: nosniff
expires: Sat, 27 Dec 2025 12:32:44 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 27 Dec 2024 12:32:44 GMT
last-modified: Fri, 08 May 2020 07:05:03 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
accept-ranges: bytes
access-control-allow-origin: *
content-length: 31021
x-xss-protection: 0
server: sffe

GET
H3 200 jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/ 87 KB
28 KB 31ms
18ms Script
application/javascript 104.17.24.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js

Requested by

Host: kajab.duckdns.org
URL: https://kajab.duckdns.org/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://kajab.duckdns.org
Referer

Response headers

cf-cdnjs-via: cfworker/kv
content-encoding: br
cf-cache-status: HIT
etag: "603e8adc-15d9d"
age: 556143
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sCCmxzV8b19dyniL%2FG7QUupZuTaFF5uEwgPTmPYyuqUWnX5oPTFWiiXICfavu8Ie3F%2Bsw7c5AA1hNJ%2Br2kkxq8bHkjB7%2BXDeZt4PKxCCg5g62j9JTFkteQePya9boVxWt4M3YEk5"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Sat, 20 Dec 2025 18:17:27 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Mon, 30 Dec 2024 18:17:27 GMT
content-type: application/javascript; charset=utf-8
last-modified: Tue, 02 Mar 2021 18:58:36 GMT
vary: Accept-Encoding
priority: u=2,i=?0
strict-transport-security: max-age=15780000
cache-control: public, max-age=30672000
timing-allow-origin: *
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy: cross-origin
cf-ray: 8fa406d979f7d392-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 27938
server: cloudflare

GET
H2 200 hero-personal-bg-back.png
a.m.dana.id/resource/danaweb-v2/ 257 KB
257 KB 34ms
12ms Image
image/png 2404:2280:1bf:0:3::7ea
TAOBAO Zhejiang T...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://a.m.dana.id/resource/danaweb-v2/hero-personal-bg-back.png

Requested by

Host: kajab.duckdns.org
URL: https://kajab.duckdns.org/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:2280:1bf:0:3::7ea , Singapore, ASN24429 (TAOBAO Zhejiang Taobao Network Co.,Ltd, CN),

Reverse DNS

Software

Tengine /

Resource Hash

8d7aef89df5aa26fab6f1049d29067638b044525ff6738d4b5893b814129b162

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://kajab.duckdns.org/

Response headers

x-oss-cdn-auth: success
content-md5: iJfNaQpFbUdylpxFbEs2GA==
x-oss-storage-class: Standard
etag: "8897CD690A456D4772969C456C4B3618"
age: 1822413
x-oss-object-type: Normal
access-control-allow-methods: GET
x-cache: HIT TCP_HIT dirn:11:742454452
date: Mon, 09 Dec 2024 16:03:53 GMT
x-oss-server-time: 17
content-type: image/png
vary: Origin
last-modified: Mon, 04 Sep 2023 05:09:04 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-swift-cachetime: 2592000
timing-allow-origin: *
x-oss-hash-crc64ecma: 16645004155246917065
via: ens-cache5.l2de3[972,972,200-0,M], ens-cache11.l2de3[974,0], ens-cache1.de7[0,0,200-0,H], ens-cache7.de7[4,0]
ali-swift-global-savetime: 1733760234
x-swift-savetime: Mon, 09 Dec 2024 16:03:54 GMT
accept-ranges: bytes
access-control-allow-origin: *
eagleid: a3b5839b17355826472842637e
content-length: 262679
x-oss-request-id: 675714E913185C39334E9884
server: Tengine

GET
H2 200 images
encrypted-tbn0.gstatic.com/ 13 KB
13 KB 68ms
15ms Other
image/jpeg 2a00:1450:4001:81c::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcSs6SVMoCfFl4DRjEi8Y5UnuOoHLe1lLbgfJw&usqp=CAU

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b642164e80a515edbc7efe4447d685cb3e17abb23e21446732fc7b69b2689b1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://kajab.duckdns.org/

Response headers

age: 66108
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
x-content-type-options: nosniff
expires: Mon, 29 Dec 2025 23:55:39 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 29 Dec 2024 23:55:39 GMT
last-modified: Wed, 27 Oct 2021 08:06:45 GMT
content-type: image/jpeg
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
content-length: 13179
x-xss-protection: 0
server: sffe

GET
H3 200 XRXI3I6Li01BKofiOc5wtlZ2di8HDDsmdTQ3jw.woff2
fonts.gstatic.com/s/nunito/v26/ 16 KB
16 KB 604ms
15ms Font
font/woff2 172.217.18.3
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/nunito/v26/XRXI3I6Li01BKofiOc5wtlZ2di8HDDsmdTQ3jw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Nunito:wght@800&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.3 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s28-in-f3.1e100.net

Software

sffe /

Resource Hash

5b6eb685c75677d9dab957b198d7f19ec9a1d34b378fbd440885c080a5ca6b53

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://kajab.duckdns.org
Referer: https://fonts.googleapis.com/

Response headers

age: 441187
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Thu, 25 Dec 2025 15:44:22 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 25 Dec 2024 15:44:22 GMT
last-modified: Thu, 14 Sep 2023 00:41:54 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 16488
x-xss-protection: 0
server: sffe

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DANA (Financial)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://kajab.duckdns.org/ Message: Error parsing 'integrity' attribute ('sha512-894YE6QWD5I59HgZOGReFYm4dnWc1Qt5NtvYSaNcOP u1T9qYdvdihz0PPSiiqn/ /3e7Jo4EaG7TubfWGUrMQ=='). The hash algorithm must be one of 'sha256', 'sha384', or 'sha512', followed by a '-' character.
security	error	URL: https://kajab.duckdns.org/ Message: Error parsing 'integrity' attribute ('sha512-894YE6QWD5I59HgZOGReFYm4dnWc1Qt5NtvYSaNcOP u1T9qYdvdihz0PPSiiqn/ /3e7Jo4EaG7TubfWGUrMQ=='). The hash algorithm must be one of 'sha256', 'sha384', or 'sha512', followed by a '-' character.
security	error	URL: https://kajab.duckdns.org/ Message: Failed to find a valid digest in the 'integrity' attribute for resource 'https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js' with computed SHA-512 integrity '894YE6QWD5I59HgZOGReFYm4dnWc1Qt5NtvYSaNcOP+u1T9qYdvdihz0PPSiiqn/+/3e7Jo4EaG7TubfWGUrMQ=='. The resource has been blocked.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.m.dana.id
ajax.googleapis.com
cdnjs.cloudflare.com
code.ionicframework.com
code.jquery.com
encrypted-tbn0.gstatic.com
fonts.googleapis.com
fonts.gstatic.com
kajab.duckdns.org
104.17.24.14
165.227.115.195
172.217.18.3
172.67.69.29
2404:2280:1bf:0:3::7ea
2a00:1450:4001:801::200a
2a00:1450:4001:812::200a
2a00:1450:4001:81c::200e
2a04:4e42:200::649
0ba081f546084bd5097aa8a73c75931d5aa1fc4d6e846e53c21f98e6a1509988
187eb20185457f74f4ba2658ba52bb43ee02dce1c53dc2099b175df9c79eb33b
344e98921d499fc4d96eb207bb24bff4513aa69150042bde6dd83642a351e0ac
5b6eb685c75677d9dab957b198d7f19ec9a1d34b378fbd440885c080a5ca6b53
874706b2b1311a0719b5267f7d1cf803057e367e94ae1ff7bf78c5450d30f5d4
8af93bd675e1cfd9ecc850e862819fdac6e3ad1f5d761f970e409c7d9c63bdc3
8d7aef89df5aa26fab6f1049d29067638b044525ff6738d4b5893b814129b162
92ac508220f5bb60ec94e07650528eb66625f82a4740ada068cde05365781286
b09dfa361390133435ab4a630122aebb35aa244da863a11006b3777e85ac6f47
b642164e80a515edbc7efe4447d685cb3e17abb23e21446732fc7b69b2689b1d
dade0cb2438796c022edd04afbeb35d51b7616909c1ba37e42a2b9fd6935052c
dce11da6f6b83fec7440a62f6e39151c8ff41c6f357978df2e042be1f219b7f1
dfa729d82a3effadab1000181cb99108f232721e3b0af74cfae4c12704b35a32
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

kajab.duckdns.org Open in urlscan Pro 165.227.115.195 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

16 Requests

100 %HTTPS

56 %IPv6

7 Domains

9 Subdomains

9 IPs

4 Countries

587 kBTransfer

1071 kBSize

0 Cookies

0 Outgoing links

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

0 Cookies

3 Console Messages

Indicators

kajab.duckdns.org Open in urlscan Pro
165.227.115.195 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

100 %
HTTPS

56 %
IPv6

7
Domains

9
Subdomains

9
IPs

4
Countries

587 kB
Transfer

1071 kB
Size

0
Cookies

16 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!