Report - plunderizerfunds.ddns.net/knet/PaymentID/?QRInfo=SEFTU0FOIE1PSEFNTUVEfiA1fkFCREVMSEFLSU0gSCBN

Report Overview

Submitted URL
plunderizerfunds.ddns.net/knet/PaymentID/?QRInfo=SEFTU0FOIE1PSEFNTUVEfiA1fkFCREVMSEFLSU0gSCBN
IP
37.49.228.184
ASN
#3920 ESTOXY OU
Submitted
2024-04-24 18:01:14
Access
public
Website Title
Al-Tijari - Commercial Bank of Kuwait
Final URL
plunderizerfunds.ddns.net/knet/PaymentID/?QRInfo=SEFTU0FOIE1PSEFNTUVEfiA1fkFCREVMSEFLSU0gSCBN
Tags
dyndns
urlquery detections
Suspicious - DynDNS domain

Detections

urlquery
8
Network Intrusion Detection
0
Threat Detection Systems
0

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
plunderizerfunds.ddns.net	unknown	unknown	No data	No data	3.7 kB	43 kB	37.49.228.184
cdnjs.cloudflare.com	235	2009-02-17	2015-04-17	2024-04-24	1.0 kB	171 kB	104.17.24.14
code.jquery.com	634	2005-12-10	2012-05-21	2024-04-23	455 B	87 kB	151.101.2.137
fonts.gstatic.com	unknown	2008-02-11	2014-09-09	2024-04-23	555 B	16 kB	216.58.207.227
fonts.googleapis.com	8877	2005-01-25	2013-06-10	2024-04-24	917 B	5.5 kB	142.250.74.170

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (1)

	URL	Size	First Seen	Last Seen
	code.jquery.com/jquery-3.6.4.js	292 kB	2023-03-29	2024-04-24
Pretty URL code.jquery.com/jquery-3.6.4.js IP 151.101.2.137 ASN #54113 FASTLY Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-29 22:35:35 Last Seen2024-04-24 20:01:21 Times Seen282 Hash 0208b96062ba59d07c4495115d2b42ce 611b7f56ab2146e1277e9258f15c55d50034dcef 6bd8c1051ca05f5061e65b7c1998d70f3c8e07e6d6bdef4488eeed44e52d8ff1 Loading...

HTTP Transactions (13)

URL IP Response Size

plunderizerfunds.ddns.net/knet/PaymentID/?QRInfo=SEFTU0FOIE1PSEFNTUVEfiA1fkFCREVMSEFLSU0gSCBN

37.49.228.184

200 OK

3.6 kB

URL User Request GET HTTP/1.1
plunderizerfunds.ddns.net/knet/PaymentID/?QRInfo=SEFTU0FOIE1PSEFNTUVEfiA1fkFCREVMSEFLSU0gSCBN
IP
37.49.228.184:443
ASN
#3920 ESTOXY OU

Certificate
IssuerLet's Encrypt
Subjectplunderizerfunds.ddns.net
FingerprintAB:73:05:A6:20:DF:D0:81:01:E1:78:CE:74:31:72:7E:51:2B:D6:43
ValidityWed, 24 Apr 2024 08:22:48 GMT - Tue, 23 Jul 2024 08:22:47 GMT

File type
HTML document, Unicode text, UTF-8 text, with CRLF line terminators
Size
3.6 kB (3581 bytes)
Hash
9bb4c9c789f85429fa86553a7a07dcde
fcb5dfd8c57477630aef3248cccbd30210ed99a0
aea294fa72dee6df432a06165d54ae702fd93165be2a1062a23c36799e622c01

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain

HTTP Headers

GET /knet/PaymentID/?QRInfo=SEFTU0FOIE1PSEFNTUVEfiA1fkFCREVMSEFLSU0gSCBN HTTP/1.1
Host: plunderizerfunds.ddns.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Wed, 24 Apr 2024 18:00:49 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25
X-Powered-By: PHP/8.1.25
Content-Length: 3581
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

plunderizerfunds.ddns.net/knet/PaymentID/css/style.css

37.49.228.184

200 OK

2.8 kB

URL GET HTTP/1.1
plunderizerfunds.ddns.net/knet/PaymentID/css/style.css
IP
37.49.228.184:443
ASN
#3920 ESTOXY OU

Requested by
https://plunderizerfunds.ddns.net/knet/PaymentID/?QRInfo=SEFTU0FOIE1PSEFNTUVEfiA1fkFCREVMSEFLSU0gSCBN
Certificate
IssuerLet's Encrypt
Subjectplunderizerfunds.ddns.net
FingerprintAB:73:05:A6:20:DF:D0:81:01:E1:78:CE:74:31:72:7E:51:2B:D6:43
ValidityWed, 24 Apr 2024 08:22:48 GMT - Tue, 23 Jul 2024 08:22:47 GMT

File type
assembler source, ASCII text, with CRLF line terminators
Size
2.8 kB (2801 bytes)
Hash
ff8c52fc27bf3c81a90a16dad7f1bdea
f29ddd6968766d6682770f8d5bd20094d61b090e
175b8dcbf1a0856d881569b6d84da45a4a2f3a74431466900077a2fb4ce29968

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain

HTTP Headers

GET /knet/PaymentID/css/style.css HTTP/1.1
Host: plunderizerfunds.ddns.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://plunderizerfunds.ddns.net/knet/PaymentID/?QRInfo=SEFTU0FOIE1PSEFNTUVEfiA1fkFCREVMSEFLSU0gSCBN
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Wed, 24 Apr 2024 18:00:49 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25
Last-Modified: Thu, 06 Jul 2023 13:57:45 GMT
ETag: "af1-5ffd1e6900840"
Accept-Ranges: bytes
Content-Length: 2801
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/css

cdnjs.cloudflare.com/ajax/libs/font-awesome/6.3.0/css/all.min.css

104.17.24.14

200 OK

19 kB

URL GET HTTP/2
cdnjs.cloudflare.com/ajax/libs/font-awesome/6.3.0/css/all.min.css
IP
104.17.24.14:443
ASN
#13335 CLOUDFLARENET

Requested by
https://plunderizerfunds.ddns.net/knet/PaymentID/?QRInfo=SEFTU0FOIE1PSEFNTUVEfiA1fkFCREVMSEFLSU0gSCBN
Certificate
IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint7A:EA:B9:09:71:70:6C:87:C9:D3:82:74:8A:7B:B4:60:E5:40:2D:8D
ValidityMon, 03 Jul 2023 00:00:00 GMT - Tue, 02 Jul 2024 23:59:59 GMT

File type
ASCII text, with very long lines (52276)
Size
19 kB (18765 bytes)
Hash
2fd961571c270c2d63b165a97488fe95
8922f78fc464d96eafb41f27916e97b9a12f5e37
ff8510712984ac3ccf08c022b8e8963d556c34ddacdd963f36c99735c8f42057

HTTP Headers

GET /ajax/libs/font-awesome/6.3.0/css/all.min.css HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://plunderizerfunds.ddns.net
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: style
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Wed, 24 Apr 2024 18:00:49 GMT
content-type: text/css; charset=utf-8
content-length: 18765
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "63e2af34-494d"
last-modified: Tue, 07 Feb 2023 20:06:12 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 1734795
expires: Mon, 14 Apr 2025 18:00:49 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HPW4T4o2zEAhxoLcJYFOKsnoPYeeEzBsPwbAeeKaE%2F9mvVcFUlpMn1f2GHgVaVrw5ewO9lBVcWpxE%2F%2FJdEARKYaKLWfTSaHXRIOyxZOObYun65uuW3MSprRTsbEzRPHhjgqWjvkV"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 8797febd2c9a0b51-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

code.jquery.com/jquery-3.6.4.js

151.101.2.137

200 OK

86 kB

URL GET HTTP/2
code.jquery.com/jquery-3.6.4.js
IP
151.101.2.137:443
ASN
#54113 FASTLY

Requested by
https://plunderizerfunds.ddns.net/knet/PaymentID/?QRInfo=SEFTU0FOIE1PSEFNTUVEfiA1fkFCREVMSEFLSU0gSCBN
Certificate
IssuerSectigo Limited
Subject*.jquery.com
FingerprintD2:19:0A:AD:CE:BB:9C:61:17:5D:29:4B:A2:54:E8:C6:91:B8:F9:8D
ValidityTue, 11 Jul 2023 00:00:00 GMT - Sun, 14 Jul 2024 23:59:59 GMT

File type
JavaScript source, ASCII text
Size
86 kB (86002 bytes)
Hash
0208b96062ba59d07c4495115d2b42ce
611b7f56ab2146e1277e9258f15c55d50034dcef
6bd8c1051ca05f5061e65b7c1998d70f3c8e07e6d6bdef4488eeed44e52d8ff1

HTTP Headers

GET /jquery-3.6.4.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://plunderizerfunds.ddns.net
DNT: 1
Connection: keep-alive
Referer: https://plunderizerfunds.ddns.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: W/"28feccc0-4766a"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Wed, 24 Apr 2024 18:00:49 GMT
age: 19179424
x-served-by: cache-lga21949-LGA, cache-hel1410020-HEL
x-cache: HIT, HIT
x-cache-hits: 5, 696
x-timer: S1713981650.516111,VS0,VE0
vary: Accept-Encoding
content-length: 86002
X-Firefox-Spdy: h2

plunderizerfunds.ddns.net/knet/PaymentID/image/CBK-Logo.png

37.49.228.184

200 OK

22 kB

URL GET HTTP/1.1
plunderizerfunds.ddns.net/knet/PaymentID/image/CBK-Logo.png
IP
37.49.228.184:443
ASN
#3920 ESTOXY OU

Requested by
https://plunderizerfunds.ddns.net/knet/PaymentID/?QRInfo=SEFTU0FOIE1PSEFNTUVEfiA1fkFCREVMSEFLSU0gSCBN
Certificate
IssuerLet's Encrypt
Subjectplunderizerfunds.ddns.net
FingerprintAB:73:05:A6:20:DF:D0:81:01:E1:78:CE:74:31:72:7E:51:2B:D6:43
ValidityWed, 24 Apr 2024 08:22:48 GMT - Tue, 23 Jul 2024 08:22:47 GMT

File type
PNG image data, 1560 x 425, 8-bit/color RGBA, non-interlaced
Size
22 kB (22051 bytes)
Hash
a165982990b151496705356300d2053f
1b5f0dac58491852fdf5e4dfc03e4c03dde57821
9fd47628ae15891372cd4c91f925f31fdc64c3f4a56a2a7d0eb4aa0cc69bcc78

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain

HTTP Headers

GET /knet/PaymentID/image/CBK-Logo.png HTTP/1.1
Host: plunderizerfunds.ddns.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://plunderizerfunds.ddns.net/knet/PaymentID/?QRInfo=SEFTU0FOIE1PSEFNTUVEfiA1fkFCREVMSEFLSU0gSCBN
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Wed, 24 Apr 2024 18:00:49 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25
Last-Modified: Thu, 06 Jul 2023 13:57:45 GMT
ETag: "5623-5ffd1e6900840"
Accept-Ranges: bytes
Content-Length: 22051
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: image/png

plunderizerfunds.ddns.net/knet/PaymentID/image/kfastsm.png

37.49.228.184

200 OK

3.9 kB

URL GET HTTP/1.1
plunderizerfunds.ddns.net/knet/PaymentID/image/kfastsm.png
IP
37.49.228.184:443
ASN
#3920 ESTOXY OU

Requested by
https://plunderizerfunds.ddns.net/knet/PaymentID/?QRInfo=SEFTU0FOIE1PSEFNTUVEfiA1fkFCREVMSEFLSU0gSCBN
Certificate
IssuerLet's Encrypt
Subjectplunderizerfunds.ddns.net
FingerprintAB:73:05:A6:20:DF:D0:81:01:E1:78:CE:74:31:72:7E:51:2B:D6:43
ValidityWed, 24 Apr 2024 08:22:48 GMT - Tue, 23 Jul 2024 08:22:47 GMT

File type
PNG image data, 49 x 34, 8-bit/color RGBA, non-interlaced
Size
3.9 kB (3909 bytes)
Hash
8e7f49fe5e0cc29199d1575a0300dc09
982509bd461ee8914981172ce31ee3c8dc494ead
e5f38c68c951bb1088f55e73f78b5a14500a04e9018943605805169c7ccaec1b

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain

HTTP Headers

GET /knet/PaymentID/image/kfastsm.png HTTP/1.1
Host: plunderizerfunds.ddns.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://plunderizerfunds.ddns.net/knet/PaymentID/?QRInfo=SEFTU0FOIE1PSEFNTUVEfiA1fkFCREVMSEFLSU0gSCBN
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Wed, 24 Apr 2024 18:00:49 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25
Last-Modified: Thu, 06 Jul 2023 13:57:45 GMT
ETag: "f45-5ffd1e6900840"
Accept-Ranges: bytes
Content-Length: 3909
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: image/png

plunderizerfunds.ddns.net/knet/PaymentID/image/tpay.png

37.49.228.184

200 OK

3.7 kB

URL GET HTTP/1.1
plunderizerfunds.ddns.net/knet/PaymentID/image/tpay.png
IP
37.49.228.184:443
ASN
#3920 ESTOXY OU

Requested by
https://plunderizerfunds.ddns.net/knet/PaymentID/?QRInfo=SEFTU0FOIE1PSEFNTUVEfiA1fkFCREVMSEFLSU0gSCBN
Certificate
IssuerLet's Encrypt
Subjectplunderizerfunds.ddns.net
FingerprintAB:73:05:A6:20:DF:D0:81:01:E1:78:CE:74:31:72:7E:51:2B:D6:43
ValidityWed, 24 Apr 2024 08:22:48 GMT - Tue, 23 Jul 2024 08:22:47 GMT

File type
PNG image data, 81 x 29, 8-bit/color RGB, non-interlaced
Size
3.7 kB (3734 bytes)
Hash
61cf7dbb023eaa309fda7b2d00294a2e
f696ba452c8cdc73d76a84ef701944e0ab95b58a
d3e4755ce9f0b92d871fbe2025f8ae6d93b3017c91b3dab2b2b112abcddafa3b

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain

HTTP Headers

GET /knet/PaymentID/image/tpay.png HTTP/1.1
Host: plunderizerfunds.ddns.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://plunderizerfunds.ddns.net/knet/PaymentID/?QRInfo=SEFTU0FOIE1PSEFNTUVEfiA1fkFCREVMSEFLSU0gSCBN
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Wed, 24 Apr 2024 18:00:49 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25
Last-Modified: Thu, 06 Jul 2023 13:57:45 GMT
ETag: "e96-5ffd1e6900840"
Accept-Ranges: bytes
Content-Length: 3734
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: image/png

plunderizerfunds.ddns.net/knet/PaymentID/image/knetpng.png

37.49.228.184

200 OK

3.6 kB

URL GET HTTP/1.1
plunderizerfunds.ddns.net/knet/PaymentID/image/knetpng.png
IP
37.49.228.184:443
ASN
#3920 ESTOXY OU

Requested by
https://plunderizerfunds.ddns.net/knet/PaymentID/?QRInfo=SEFTU0FOIE1PSEFNTUVEfiA1fkFCREVMSEFLSU0gSCBN
Certificate
IssuerLet's Encrypt
Subjectplunderizerfunds.ddns.net
FingerprintAB:73:05:A6:20:DF:D0:81:01:E1:78:CE:74:31:72:7E:51:2B:D6:43
ValidityWed, 24 Apr 2024 08:22:48 GMT - Tue, 23 Jul 2024 08:22:47 GMT

File type
PNG image data, 272 x 185, 8-bit colormap, non-interlaced
Size
3.6 kB (3570 bytes)
Hash
fbdf1fcb6bb7fc27dfd39556b66b4018
199beea7b3fbe85232387f444a6ca622de068319
917f158db9c8bb137612b13ea87aeebcb75c4f0f57d48c291b1dc898102cbe9a

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain

HTTP Headers

GET /knet/PaymentID/image/knetpng.png HTTP/1.1
Host: plunderizerfunds.ddns.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://plunderizerfunds.ddns.net/knet/PaymentID/?QRInfo=SEFTU0FOIE1PSEFNTUVEfiA1fkFCREVMSEFLSU0gSCBN
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Wed, 24 Apr 2024 18:00:49 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25
Last-Modified: Thu, 06 Jul 2023 13:57:45 GMT
ETag: "df2-5ffd1e6900840"
Accept-Ranges: bytes
Content-Length: 3570
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: image/png

plunderizerfunds.ddns.net/knet/PaymentID/image/favicon.png

37.49.228.184

200 OK

1.1 kB

URL GET HTTP/1.1
plunderizerfunds.ddns.net/knet/PaymentID/image/favicon.png
IP
37.49.228.184:443
ASN
#3920 ESTOXY OU

Requested by
https://plunderizerfunds.ddns.net/knet/PaymentID/?QRInfo=SEFTU0FOIE1PSEFNTUVEfiA1fkFCREVMSEFLSU0gSCBN
Certificate
IssuerLet's Encrypt
Subjectplunderizerfunds.ddns.net
FingerprintAB:73:05:A6:20:DF:D0:81:01:E1:78:CE:74:31:72:7E:51:2B:D6:43
ValidityWed, 24 Apr 2024 08:22:48 GMT - Tue, 23 Jul 2024 08:22:47 GMT

File type
PNG image data, 31 x 31, 8-bit/color RGBA, non-interlaced
Size
1.1 kB (1090 bytes)
Hash
d26bacd5617ed3c89109ea1f99062cca
488289633f3dcbefb6faaa01faa0b0af46c38259
b75d70c0f1c0637cf9e79bcd18ee94adffe8e9f627ea9682cbb6c826109c4422

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain

HTTP Headers

GET /knet/PaymentID/image/favicon.png HTTP/1.1
Host: plunderizerfunds.ddns.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://plunderizerfunds.ddns.net/knet/PaymentID/?QRInfo=SEFTU0FOIE1PSEFNTUVEfiA1fkFCREVMSEFLSU0gSCBN
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Wed, 24 Apr 2024 18:00:49 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25
Last-Modified: Thu, 06 Jul 2023 13:57:45 GMT
ETag: "442-5ffd1e6900840"
Accept-Ranges: bytes
Content-Length: 1090
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: image/png

cdnjs.cloudflare.com/ajax/libs/font-awesome/6.3.0/webfonts/fa-solid-900.woff2

104.17.24.14

200 OK

150 kB

URL GET HTTP/2
cdnjs.cloudflare.com/ajax/libs/font-awesome/6.3.0/webfonts/fa-solid-900.woff2
IP
104.17.24.14:443
ASN
#13335 CLOUDFLARENET

Requested by
https://plunderizerfunds.ddns.net/knet/PaymentID/?QRInfo=SEFTU0FOIE1PSEFNTUVEfiA1fkFCREVMSEFLSU0gSCBN
Certificate
IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint7A:EA:B9:09:71:70:6C:87:C9:D3:82:74:8A:7B:B4:60:E5:40:2D:8D
ValidityMon, 03 Jul 2023 00:00:00 GMT - Tue, 02 Jul 2024 23:59:59 GMT

File type
Web Open Font Format (Version 2), TrueType, length 149908, version 771.256
Size
150 kB (149908 bytes)
Hash
44f8148f80e6c3d60fa6425b0cbb862a
ec2f4e5f311462dce67b8f354e5bb9a68c12cf58
e2c5cf547e2e8d74a17d05c5ad9f1f593ca526452e228124294fa983b908ff82

HTTP Headers

GET /ajax/libs/font-awesome/6.3.0/webfonts/fa-solid-900.woff2 HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://plunderizerfunds.ddns.net
DNT: 1
Connection: keep-alive
Referer: https://cdnjs.cloudflare.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Wed, 24 Apr 2024 18:00:49 GMT
content-type: application/octet-stream; charset=utf-8
content-length: 149908
access-control-allow-origin: *
cache-control: public, max-age=30672000
etag: "63e2af35-24994"
last-modified: Tue, 07 Feb 2023 20:06:13 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 783809
expires: Mon, 14 Apr 2025 18:00:49 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1knzBwSysQRLDOXa79z%2BJpqG9jB2Zpf17f7hTbmRh7ER3br50cwXmZ%2F5Qlwu7GvEQGEk67IL%2FCP72NCYPRvWyJ8xAfBv%2F7W%2FbeSaM5EUCv7jKHWXXPuQ4zNFmfzzDmMkXrzhCmOY"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 8797febe9e510b51-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

fonts.gstatic.com/s/montserrat/v26/JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCtr6Hw5aXo.woff2

216.58.207.227

200 OK

15 kB

URL GET HTTP/2
fonts.gstatic.com/s/montserrat/v26/JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCtr6Hw5aXo.woff2
IP
216.58.207.227:443
ASN
#15169 GOOGLE

Requested by
https://plunderizerfunds.ddns.net/knet/PaymentID/?QRInfo=SEFTU0FOIE1PSEFNTUVEfiA1fkFCREVMSEFLSU0gSCBN
Certificate
IssuerGoogle Trust Services LLC
Subject*.gstatic.com
FingerprintF5:5C:D9:68:C6:5F:A3:33:5A:73:C3:79:B6:83:FE:44:2E:A4:83:74
ValidityMon, 18 Mar 2024 20:34:25 GMT - Mon, 10 Jun 2024 20:34:24 GMT

File type
Web Open Font Format (Version 2), TrueType, length 14940, version 1.0
Size
15 kB (14940 bytes)
Hash
a46fb7aae99225fdfd9d64b2b8b1063f
1ee50bf5985c1956dde1c06d9b1cec4645ddb92b
4b5816bbfc52587979139951355fe4048da02ce60e40cef8e4a1efb6cd396281

HTTP Headers

GET /s/montserrat/v26/JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCtr6Hw5aXo.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://plunderizerfunds.ddns.net
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 14940
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Mon, 22 Apr 2024 21:46:06 GMT
expires: Tue, 22 Apr 2025 21:46:06 GMT
cache-control: public, max-age=31536000
age: 159283
last-modified: Wed, 13 Sep 2023 22:46:07 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

fonts.googleapis.com/css2?family=Montserrat&display=swap

142.250.74.170

200 OK

1.9 kB

URL GET HTTP/2
fonts.googleapis.com/css2?family=Montserrat&display=swap
IP
142.250.74.170:443
ASN
#15169 GOOGLE

Requested by
https://plunderizerfunds.ddns.net/knet/PaymentID/?QRInfo=SEFTU0FOIE1PSEFNTUVEfiA1fkFCREVMSEFLSU0gSCBN
Certificate
IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
Fingerprint15:CB:F7:AC:18:3F:DC:1E:F9:4E:94:D1:98:40:40:61:53:17:28:F2
ValidityMon, 18 Mar 2024 20:35:28 GMT - Mon, 10 Jun 2024 20:35:27 GMT

File type
ASCII text, with very long lines (1964), with no line terminators
Size
1.9 kB (1919 bytes)
Hash
239a618ffafef4ef52b8420e3a840889
eb3c9591cf15cfbc0708770f3680d7ecf7a2029b
1a65d1c5600a83400ac4e08ed56f140e81590a6761a6cdc03187da69555196aa

HTTP Headers

GET /css2?family=Montserrat&display=swap HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://plunderizerfunds.ddns.net/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Wed, 24 Apr 2024 18:00:49 GMT
date: Wed, 24 Apr 2024 18:00:49 GMT
cache-control: private, max-age=86400
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

fonts.googleapis.com/css2?family=Roboto:wght@100&display=swap

142.250.74.170

200 OK

2.3 kB

URL GET HTTP/2
fonts.googleapis.com/css2?family=Roboto:wght@100&display=swap
IP
142.250.74.170:443
ASN
#15169 GOOGLE

Requested by
https://plunderizerfunds.ddns.net/knet/PaymentID/?QRInfo=SEFTU0FOIE1PSEFNTUVEfiA1fkFCREVMSEFLSU0gSCBN
Certificate
IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
Fingerprint15:CB:F7:AC:18:3F:DC:1E:F9:4E:94:D1:98:40:40:61:53:17:28:F2
ValidityMon, 18 Mar 2024 20:35:28 GMT - Mon, 10 Jun 2024 20:35:27 GMT

File type
ASCII text, with very long lines (2400), with no line terminators
Size
2.3 kB (2337 bytes)
Hash
18ba68e24f6c1ea80b2080965a10b6b6
490334c1aec50e80b5383eaa6d4265b6a817db1c
fef33f21b9056ba06848c7d9e8742d15e4d9f3595dc353ecadef90b5d273deb9

HTTP Headers

GET /css2?family=Roboto:wght@100&display=swap HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://plunderizerfunds.ddns.net/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Wed, 24 Apr 2024 18:00:49 GMT
date: Wed, 24 Apr 2024 18:00:49 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (1)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (13)

URL User Request GET HTTP/1.1

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections