u.to/5N74Hw?/violation-informations
195.216.243.155302 Found 242 B URL User Request GET HTTP/1.1 u.to/5N74Hw?/violation-informations
IP 195.216.243.155:443
Certificate IssuerGoGetSSL
Subjectu.to
FingerprintAE:B3:A4:D5:8B:EF:73:5A:18:AF:3D:0A:F0:C2:AF:8A:E6:E0:7C:D6
ValidityThu, 29 Sep 2022 00:00:00 GMT - Sun, 29 Oct 2023 23:59:59 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash 1ec663103ec417dc03ca3be77c423ca0
6dba0e69fed5a2004e0d1fa26954958472971c01
99ceec3288566a515972342cfd0003b3350b3ec5e10486234b805edd7e2594d7
GET /5N74Hw?/violation-informations HTTP/1.1
Host: u.to
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Server: nginx/1.8.0
Date: Sun, 24 Sep 2023 18:39:37 GMT
Content-Type: text/html; charset=iso-8859-1
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=15
Set-Cookie: lng=en; path=/; expires=Mon, 23-Sep-2024 18:39:37 GMT; domain=.u.to;
Location: http://50959650468548845458.duckdns.org/8d955a1378ac/index.htm
50959650468548845458.duckdns.org/8d955a1378ac/index.htm
103.187.146.12200 OK 3.7 kB URL User Request GET HTTP/1.1 50959650468548845458.duckdns.org/8d955a1378ac/index.htm
IP 103.187.146.12:80
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document, Unicode text, UTF-8 text, with very long lines (1877), with CRLF line terminators
Hash a2a32be6f9b916b56068fb038e1aad17
0d918d4c5a056615ebef3631c892fff455203350
7ca9498afce3e74c8bb41dc6fe8c194d27bc6fa819017510fbf2d4fe7a7b2a04
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
Quad9 DNS malicious Sinkholed
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
GET /8d955a1378ac/index.htm HTTP/1.1
Host: 50959650468548845458.duckdns.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
etag: "20f2-6472ade0-fc841;gz"
last-modified: Sun, 28 May 2023 01:26:56 GMT
content-type: text/html
content-length: 3666
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
date: Sun, 24 Sep 2023 18:52:49 GMT
server: LiteSpeed
connection: Keep-Alive
50959650468548845458.duckdns.org/8d955a1378ac/css/style-info.css
103.187.146.12200 OK 8.6 kB URL GET HTTP/1.1 50959650468548845458.duckdns.org/8d955a1378ac/css/style-info.css
IP 103.187.146.12:80
Requested by http://50959650468548845458.duckdns.org/8d955a1378ac/index.htm
File type ASCII text, with very long lines (1496), with CRLF line terminators
Hash 9e289fd301d73e3dcc97513fe15089ae
e7b88c0fdf570b2494504610512d8f985c1fee12
385828ca3e917a8c7b8260fd3fd9751537800cd48a72976cdcd7117c72b61865
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
Quad9 DNS malicious Sinkholed
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
GET /8d955a1378ac/css/style-info.css HTTP/1.1
Host: 50959650468548845458.duckdns.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://50959650468548845458.duckdns.org/8d955a1378ac/index.htm
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
cache-control: public, max-age=604800
expires: Sun, 01 Oct 2023 18:52:50 GMT
etag: "a585-64729016-fc846;gz"
last-modified: Sat, 27 May 2023 23:19:50 GMT
content-type: text/css
content-length: 8648
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
date: Sun, 24 Sep 2023 18:52:50 GMT
server: LiteSpeed
connection: Keep-Alive
50959650468548845458.duckdns.org/8d955a1378ac/css/interview.css
103.187.146.12200 OK 1.5 kB URL GET HTTP/1.1 50959650468548845458.duckdns.org/8d955a1378ac/css/interview.css
IP 103.187.146.12:80
Requested by http://50959650468548845458.duckdns.org/8d955a1378ac/index.htm
File type ASCII text, with CRLF line terminators
Hash aab5f9814db3000574b097ca983780d8
3603a9c4b5927d1cfacce04307ece30ef529d3f2
9912a9154c510429fa1b8087ed8b3ec90ef2c55b97a7dca6440e2a21789de740
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
Quad9 DNS malicious Sinkholed
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
GET /8d955a1378ac/css/interview.css HTTP/1.1
Host: 50959650468548845458.duckdns.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://50959650468548845458.duckdns.org/8d955a1378ac/index.htm
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
cache-control: public, max-age=604800
expires: Sun, 01 Oct 2023 18:52:50 GMT
etag: "291c-6463ef6a-fc844;gz"
last-modified: Tue, 16 May 2023 21:02:34 GMT
content-type: text/css
content-length: 1543
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
date: Sun, 24 Sep 2023 18:52:50 GMT
server: LiteSpeed
connection: Keep-Alive
50959650468548845458.duckdns.org/8d955a1378ac/css/style-info.css
103.187.146.12200 OK 8.6 kB URL GET HTTP/1.1 50959650468548845458.duckdns.org/8d955a1378ac/css/style-info.css
IP 103.187.146.12:80
Requested by http://50959650468548845458.duckdns.org/8d955a1378ac/index.htm
File type ASCII text, with very long lines (1496), with CRLF line terminators
Hash 9e289fd301d73e3dcc97513fe15089ae
e7b88c0fdf570b2494504610512d8f985c1fee12
385828ca3e917a8c7b8260fd3fd9751537800cd48a72976cdcd7117c72b61865
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
Quad9 DNS malicious Sinkholed
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
GET /8d955a1378ac/css/style-info.css HTTP/1.1
Host: 50959650468548845458.duckdns.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://50959650468548845458.duckdns.org/8d955a1378ac/index.htm
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
cache-control: public, max-age=604800
expires: Sun, 01 Oct 2023 18:52:50 GMT
etag: "a585-64729016-fc846;gz"
last-modified: Sat, 27 May 2023 23:19:50 GMT
content-type: text/css
content-length: 8648
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
date: Sun, 24 Sep 2023 18:52:50 GMT
server: LiteSpeed
connection: Keep-Alive
50959650468548845458.duckdns.org/8d955a1378ac/css/interview.css
103.187.146.12200 OK 1.5 kB URL GET HTTP/1.1 50959650468548845458.duckdns.org/8d955a1378ac/css/interview.css
IP 103.187.146.12:80
Requested by http://50959650468548845458.duckdns.org/8d955a1378ac/index.htm
File type ASCII text, with CRLF line terminators
Hash aab5f9814db3000574b097ca983780d8
3603a9c4b5927d1cfacce04307ece30ef529d3f2
9912a9154c510429fa1b8087ed8b3ec90ef2c55b97a7dca6440e2a21789de740
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
Quad9 DNS malicious Sinkholed
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
GET /8d955a1378ac/css/interview.css HTTP/1.1
Host: 50959650468548845458.duckdns.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://50959650468548845458.duckdns.org/8d955a1378ac/index.htm
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
cache-control: public, max-age=604800
expires: Sun, 01 Oct 2023 18:52:50 GMT
etag: "291c-6463ef6a-fc844;gz"
last-modified: Tue, 16 May 2023 21:02:34 GMT
content-type: text/css
content-length: 1543
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
date: Sun, 24 Sep 2023 18:52:50 GMT
server: LiteSpeed
connection: Keep-Alive
50959650468548845458.duckdns.org/8d955a1378ac/favicon.ico
103.187.146.12200 OK 2.7 kB URL GET HTTP/1.1 50959650468548845458.duckdns.org/8d955a1378ac/favicon.ico
IP 103.187.146.12:80
Requested by http://50959650468548845458.duckdns.org/8d955a1378ac/index.htm
File type MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel\012- data
Hash 56e694e5801d3079ba8000cb72d2ec4d
bc53db17bf877caf3c5facc0d3d3ef9e90c4fcb5
d908f696300de4fcf823a50e31172343e4a70ee27c3e0987e2dd88ebff39aa62
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
Quad9 DNS malicious Sinkholed
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
GET /8d955a1378ac/favicon.ico HTTP/1.1
Host: 50959650468548845458.duckdns.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://50959650468548845458.duckdns.org/8d955a1378ac/index.htm
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
cache-control: public, max-age=604800
expires: Sun, 01 Oct 2023 18:52:51 GMT
etag: "3c2e-64724bc8-fc83f;gz"
last-modified: Sat, 27 May 2023 18:28:24 GMT
content-type: image/x-icon
content-length: 2700
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
date: Sun, 24 Sep 2023 18:52:51 GMT
server: LiteSpeed
connection: Keep-Alive