Security Scan Report: securetransfer-x9hs6dlg4jzk.duckdns.org

Submitted: Completed: publiccompleted
This website contacted 8 IPs in 2 countries across 5 domains to perform 11 HTTP transactions. The main domain is duckdns.org and was registered 13 years ago.

Submitted URL: https://securetransfer-x9hs6dlg4jzk.duckdns.org/captcha.php

The Cisco Umbrella rank of the primary domain is #76,811 of the top 1 million websites

AI Security Verdict

High Risk

Confidence: 88%

8
Risk Score

Fake Desjardins AccèsD security-check page on a throwaway duckdns.org subdomain, wearing the bank's branding and assets behind a captcha gate to funnel victims to credential theft. Do not enter any information.

Risk Factors (5)
Impersonation of a different entity's brand (Desjardins) on a non-official domain
Free dynamic-DNS subdomain with a random identifier, unsuited to a real bank and unauditable for age
Captcha-gate landing page structured as the entry step of a credential phishing chain
Captcha configuration error on screen revealing an unregistered/cloned deployment
Dynamic DNS usage flagged by network IDS alerts
Domain age information unavailable

Details

Page Title

AccèsD — Vérification de sécurité

Scan Type

public

Domain Name Analysis

Within the non-profit oriented generic top-level domain (.org), 'securetransfer-x9hs6dlg4jzk.duckdns.org' is registered; it also runs on subdomain 'securetransfer-x9hs6dlg4jzk'. Its registrable label 'duckdns' stretches across 7 characters split between one vowel and 6 consonants. Splitting it apart reveals two words: duck, dns. Median word length comes out to 3.5 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://securetransfer-x9hs6dlg4jzk.duckdns.org/captcha.php

Page Load Overview

1.53s
Total Load Time
842 KB
Total Size

Language Analysis

Primary Language

🇫🇷French
Code: fr
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:fr
Text Length:204 chars
Detector Agreement:100%

Website Classification

Primary Category

finance banking71% confidence
Type: static
Method: ml+structural

All Detected Categories

finance banking
71%
government public service
31%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
4198.44.111.68Los Angeles, California, United States
AS36352HostPapa
1142.251.155.119Google · CDNUnited States
AS15169Google LLC
1104.82.102.17Akamai · CDNHamburg, Free and Hanseatic City of Hamburg, Germany
AS16625Akamai Technologies, Inc.
1142.250.154.94Google · CDNUnited States
AS15169Google LLC
1142.251.151.119Google · CDNUnited States
AS15169Google LLC
123.67.132.14Akamai · CDNFrankfurt am Main, Hesse, Germany
AS16625Akamai Technologies, Inc.
1142.251.14.94Google · CDNUnited States
AS15169Google LLC
1142.251.152.119Google · CDNUnited States
AS15169Google LLC
118--

Detected Technologies5

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T16142E673988C3436A73D5FFAE1DA6B4A71A9E501FC834950ECAD4D6481CDE59328B38C

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

192:3sbEgk2BZsLt5OkxW9yNAKFfkchd9pFifbfFxQ:3sbE0BZe5IcPMchd9pF6bFxQ

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:12156:CgAGRzRkII6gQArgIAAPyIRlRnEQH2ARmBgQlKMIQBQOA8Ba4UGACCbBhip0IQhUEgBcUMWlgMYILIZgSAEcaYEQQkEAFpCL

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ffffdf0000ffffff
Perceptual Hash:b838cec64739b8b8
Difference Hash:34a41810a0000000
Wavelet Hash:ff50000000ff0000
Color Hash:#40acbf

Scan History

Scan history not available

Unable to load historical scan data