{"report_id":"02c2979b-03d9-4eb9-b5b1-ff75ba49b663","version":6,"status":"done","tags":["phishing","credit_agricole","finacial","dyndns"],"date":"2026-04-03T20:18:14Z","url":{"schema":"http","addr":"chnsaulins.duckdns.org/","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":0,"asn":0,"as":"","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/clients/index.php","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"title":"Accès CR - Crédit Agricole","dom":{"size":401880,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (43020)","md5":"fd596bf9aed0f20eab892008130c111d","sha1":"7f0c29542eab397856887527a034c2a00e3f423e","sha256":"42fb97fe61424940af69eb914d6b45b6a5ea88332f31ed60d9d723faccbc72a5","sha512":"250e40c38922475295edb5a637d3eb9352c85860c6509801f3544945251f216c38ac21ef4894d82feb434de4f342ddffa8589e578492ab4d2ce28f3043e94ecf","ssdeep":"1536:E3iMzjhTNjnkZ2qU7310sElcGxPQJWL7TQ0hg0ZghTcUXA701W6jRZx69lgxEFy7:E3iMzjhTmAlRElblNL7ZejbQ9xy7","tlshash":"7d84c92450f72c3201b753e6a9ed7a066aa5d233c54a580cb5ef3f950ff2e899c07e19","dom_hash":"domhashdf3da2ff0ae7e11dedc7623c632a94a0","first_seen":"2026-03-10T10:17:21.680043Z","last_seen":"2026-04-03T20:18:19.068529Z","times_seen":5,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"chnsaulins.duckdns.org/","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":0,"asn":0,"as":"","country":"United States","country_code":"US"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-05-08T20:18:14Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":3,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-03","alert":"Phishing Block","trigger":"chnsaulins.duckdns.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Credit Agricole","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Credit Agricole phishing","tags":["phishing","credit_agricole","finacial"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]},"summary":[{"fqdn":"chnsaulins.duckdns.org","ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"domain_registered":"2013-04-12","domain_rank":0,"first_seen":"2026-03-10T10:15:32.681945Z","last_seen":"2026-04-03T20:18:00.247175Z","alert_count":246,"request_count":41,"received_data":4380477,"sent_data":22733,"comment":"","tags":null,"fingerprints":[{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Adobe Experience Manager","description":"Adobe Experience Manager (AEM) is a content management solution for building websites, mobile apps and forms.","website":"https://www.adobe.com/marketing/experience-manager.html","common_platform_enumeration":"cpe:2.3:a:adobe:experience_manager:*:*:*:*:*:*:*:*","icon":"Adobe Experience Platform.svg","categories":["CMS"]},{"name":"Java","description":"Java is a class-based, object-oriented programming language that is designed to have as few implementation dependencies as possible.","website":"https://java.com","common_platform_enumeration":"cpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*","icon":"Java.svg","categories":["Programming languages"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Bootstrap:1661914e05c676ce450674555cc1e5b0","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"Underscore.js","description":"Underscore.js is a JavaScript library which provides utility functions for common programming tasks. It is comparable to features provided by Prototype.js and the Ruby language, but opts for a functional programming design instead of extending object prototypes.","website":"https://underscorejs.org","common_platform_enumeration":"","icon":"Underscore.js.png","categories":["JavaScript libraries"]},{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}]},{"fqdn":"cdnstat.net","ip":{"addr":"195.177.94.253","port":443,"asn":7029,"as":"WINDSTREAM","country":"United States","country_code":"US"},"domain_registered":"2023-03-24","domain_rank":488849,"first_seen":"2018-07-13T21:37:08Z","last_seen":"2026-04-02T01:55:05.138846Z","alert_count":0,"request_count":1,"received_data":535,"sent_data":478,"comment":"","tags":null,"fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"PHP:8.2.1","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Credit Agricole","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Credit Agricole phishing","tags":["phishing","credit_agricole","finacial"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/clients/index.php","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"d19b903b17408d1a8ae8bc89a349e5da","sha1":"80ef72ab7dc8dce4bfa22a733f2c6292b552e45c","sha256":"8646d8bc3c49e3196721d72a237018d43bba109a0e961c8d501414e7c88aa160","sha512":"bb994ff566fb6476d57c97d27381a7ea7035989058f8637a50e0b0d3824f9f013940bfe3b151e72b3736ba6384908520b42d95b82afa1edddf209395611dc54b","ssdeep":"","tlshash":"3a614126f8f5004a07b6717577cbb024663142979188d6907d8c9b8a2fe0d804bfefe5","size":3198,"data":"","first_seen":"2025-08-13T12:19:29.360956Z","last_seen":"2026-04-03T20:18:19.095342Z","times_seen":9,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/clients/js/clientlibBoutonVertGeneralVitrine.min.003e4b1e4ae2a14a0a1c74025d0dc5b0.js","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"e82e00fa028bb4ce8384e2552c310c60","sha1":"21481c48e3b768f60317d82731170e4f8c7e385f","sha256":"c2fa6f61473e9b618ea4aa73cc6e8100d8e87a16e16f6f0d85cdf43665cc5259","sha512":"6d9497c822128d67db909bb2305318db731862ebd00255682542ded2ffe429eb7d3a48fd615bf0ccf7223d073c55cfa264d6d78e28c8cd0ef24fb895f8a40bb7","ssdeep":"1536:oBEQ4WuN8j77dSeMtLGkUBaf2ehq+LxNvvX5npA97AVIjVCcPldl5tda1pe+gnyQ:c4WljvdSeMtL5hqMz5npA97Cc50lhmp","tlshash":"cdf3ea8cfaa1a0b565d623e068cf020e61f3966ac81c7c91377d94d11dbce4c7976b3a","size":167545,"data":"","first_seen":"2023-12-18T03:32:46Z","last_seen":"2026-04-03T20:18:19.087549Z","times_seen":9,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/clients/index.php","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"domTimer","is_inline":false,"md5":"8a685ca3e68c02e6c48bf79c5118ca32","sha1":"3782b93338450d23d5a0f13b0f395d68db6567b0","sha256":"e6500a3152defe068445353b27a9ef54af8f5d52893dc7905aea08cb353472d6","sha512":"8a0737276599be8e79d2877c85929c8d1132c52c768a4bb17b4fc773b13992663f41c3c34ae709d5bf2024c722b77f99f0aa86fcc346815739431fb7741a1c02","ssdeep":"","tlshash":"0170002c2cc0880a0220802038a8a282830820202c828000838820022080280088b008","size":23,"data":"","first_seen":"2023-10-18T13:27:44Z","last_seen":"2026-04-03T20:18:19.096256Z","times_seen":10,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/clients/js/granite.min.579a107dd681c49bc61dae63734043cb.js","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"a25d5d8b01ddf23d6ed921e4b1336e7f","sha1":"cdb5d21fa964a36fae1b75bdbe988cb701642b1f","sha256":"25c41097b1b835706b8dc4993b76eb9b418fd5cc3dad3a89f33cd7a1fed99373","sha512":"13cd9068d311decff4d087ad6d406dd18578248715accb8dcac1449816b4b61367f71a771342645af5ebb276ee5e3947cbd167b5061c4b270891b9b71545b112","ssdeep":"","tlshash":"478172437d8430735be37078d8bf52069237942c7886c671b844daea2c7ed5e5227b6c","size":4025,"data":"","first_seen":"2023-12-18T03:32:46Z","last_seen":"2026-04-03T20:18:19.086892Z","times_seen":9,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/clients/js/clientlibStoreLocatorGeneral.min.589095941fdc97a6d45bcdbafc63b754.js","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"1f75c133e6f4470027baf6f973bd75a5","sha1":"49a593c72422f65a2ff97e6ecb99b60bc475f82a","sha256":"fdcc4095db03fc81777504993ad02ac00a44c9082488e1814742f8aa0039982a","sha512":"a63bcadeb4435f1888251197bec0355f3138505c7fff51f3865d4d43b3528eba4beacba47f91e62a8e29c99a84dec103f08c1c4d6c4d8a69810a507a8ceefb6e","ssdeep":"384:feESTuDbsuisvNnGWJCs7EH1Lm+7t6bU8idSDTlBZhdgSc+M6wVqze5nwavwL/Aw:feRKfsQlVC8EH1n7MbamTPySxrLPXjX","tlshash":"a782b94d7698b0f317a33526f02f6146b237689a951896407429d0f46c7eacd93b3f3e","size":18674,"data":"","first_seen":"2023-10-18T13:27:44Z","last_seen":"2026-04-03T20:18:19.077125Z","times_seen":10,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/clients/index.php","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"8a8964a518729f1145ed1caf9a352548","sha1":"c776c40383275cbeacc7882762f8d1cca0cbca7b","sha256":"482af8accf9e64094b63d0877a17af8438604845e3ee9f319cbf5bb3a05ceb4f","sha512":"99886b0431712c8334647ea43238bbd2e372bd8a7e7ae8328063121bf97d7888a9be33aae1073f9529d34b95c218c97f4dfd6bfef2efe985134b2305bfa12b45","ssdeep":"","tlshash":"2961ac6eb8a3756141b3307d6f6fd9187c2b300b214add00bd9c88dd0f9ea25c5a1e9e","size":3232,"data":"","first_seen":"2023-12-18T03:32:46Z","last_seen":"2026-04-03T20:18:19.097103Z","times_seen":13,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/clients/js/underscore.min.3d06cd4a72d11afe999ddcf4b36b7663.js","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"f24e300fa45339ec9468ba878c72355b","sha1":"a575c3c839f7396b49fbd07c80cbe3e4629bb2a5","sha256":"5b1260bd91752a24e703d93f1e8f58e0a60259cecbc220d056ff730792e23c6c","sha512":"9c058e4f920d9f7b3d1a8624f090a37c1999b0fe7a798ee5b22cd67dca86b6853cf28587a7123df26c79aca098cbf9a8b373c9bee7bb95ffb68dd73cb8000cbe","ssdeep":"192:s1mAgsh+Oqmaxvd/bdIQBbZeH/ZvUQFH+d2gHASTDeBvVMfBOQ+MMo5hoPSLq:s8Ah+BvbdIQ/92g9neB0OQxrXnq","tlshash":"62521dc835d2f0ea83e374b4047f448bf23aae55a8eca924d195e1d93c7890dd427f99","size":14138,"data":"","first_seen":"2023-10-18T13:27:44Z","last_seen":"2026-04-03T20:18:19.093044Z","times_seen":10,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/clients/index.php","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"658ee5ff66ce60c443f77e8a7b23e9b0","sha1":"8a114f3fe818f7f948bf748720767afeaaa59eb2","sha256":"6a3e973b825787809e175ad27dd6d043d0657c22087d80d08d446ebf963dabaf","sha512":"ff8e0b88512749716dd2be10eef5182712c8c25438a60a47d99b5f658d01617aaa545c11e6360b0d1c179bbfb24a0863dbb0296cc77943f82cc8d7a21d670843","ssdeep":"","tlshash":"9711680b3cf73081016360b82f6b651e342278074048f800fe8d949e0f9ed64e4e5fe8","size":969,"data":"","first_seen":"2023-12-18T03:32:46Z","last_seen":"2026-04-03T20:18:19.097933Z","times_seen":13,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/clients/js/tc_PortailClientCreditAgricole_2.js","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"5cfc9479d8c56988abe8e99ad795dc0f","sha1":"90e3076f631b9863fcb01c4574885389dc55c289","sha256":"f82ca001eaef3008aeffe3652bcf94f3ae3e7f7103aae48a249665ed3380d4c7","sha512":"83ab0856c39dbe35f784586a1e1f4031bb210c83e280e9cfaeba22608f072a8c98fa89278a5f5ebaf9aff59b7a6bc8d8f6f00d4018a83d3ead349d9dbd4210e4","ssdeep":"6144:S2M2IKJv8XIjWl3KQxwWK1uquzBLlKwedisQsiUbSE5rWlsQsik0iN:S2MRwWKh","tlshash":"dc442bdd30775c681aab727c6f2f1e42227ad126a808ccd4910acde614fcd4a619f7bd","size":265730,"data":"","first_seen":"2023-12-18T03:32:46Z","last_seen":"2026-04-03T20:18:19.077967Z","times_seen":9,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdnstat.net/get/script.js?referrer=https://chnsaulins.duckdns.org/clients/index.php","fqdn":"cdnstat.net","domain":"cdnstat.net","tld":"net"},"ip":{"addr":"195.177.94.253","port":443,"asn":7029,"as":"WINDSTREAM","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"f9cfcf8fa6b061acf946e44688f84187","sha1":"f98c865b09ab852ce2274e5d02f9fd70e6341cb9","sha256":"c59a3960888d96b3748601b9b77df171bafa3d53289ec4b8b6db3d474e9a39e1","sha512":"8490b542abb8f6cc619f018392baf5b55cf01f363e0a3b2edf0cdb1228502d0c40c2b74d4914a644e8d8908455b4b9d9dc8ccd0ce4298e17eddc79bc8aba7058","ssdeep":"","tlshash":"d2b09b154f1d8e75603641eebaf3c3dc593464e5751590065946d4f9549cdd30e81d80","size":129,"data":"","first_seen":"2023-06-10T20:46:14Z","last_seen":"2026-08-07T19:52:14.681208Z","times_seen":848,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/clients/js/clientlib-jquery-additional.min.69a2cd87a90a8bee86d80043790b6e24.js","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"69a2cd87a90a8bee86d80043790b6e24","sha1":"287c11c8a2c63736a24ce7cc56780efb14985f32","sha256":"8720c2af88865b055295da09d2f6142d18fd56806633bc63568491e23cfe21c9","sha512":"df56ba0d7373f6e0a9116fcd3b20c65e9b2344e83955be318fa4d8071e31549154e8121823f5b4ac2391519acc2e10e6764b17a76fe57a3aba1bee46d2bc3751","ssdeep":"1536:FFsrBkgN5U0NiqTMs9vFCEZOVvDDDYKeQW1jM0hmEmfmStfMOfKhCYhZnFmsX/im:srB7PiqFFCEZ6MOPefJG5vdo","tlshash":"19f3084a7600746e8aef71f5c09f4f0aa03649534588e474a438ddd52eb1ce662ffeac","size":165391,"data":"","first_seen":"2023-10-25T20:10:09Z","last_seen":"2026-04-03T20:18:19.082957Z","times_seen":34,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/clients/js/clientlib-npc-components.min.7cfc5fa697c76034e59d2011276d211e.js","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"72e287cbd699afb1cd85f6426f2dc636","sha1":"ecaa71fae08b32889542d10bb5f1b26a96fc4708","sha256":"95a865fafe6ee2b1f7c4dee0d393b38d3da8473b6d0af82bbcdbdebe0176d96a","sha512":"be1670246cd2b4c95f26d6ca05ae875acb6d8847a8e0fc66f5f06e241b8f80928c1de2ff2ccf6587157271ae6b24598d81cefba6fdae0cc18cb119427bff98f8","ssdeep":"12288:+mZHTn2UHL9Nua2kCJrqGvVZ9MwJevZ3/m5I:9JYkCJ2GtJJevZSI","tlshash":"b9c43a8d7340743543ab71b5206f160eb2372925a80ac058b57ae9da6cbcd8d327bf7d","size":577038,"data":"","first_seen":"2023-12-18T03:32:46Z","last_seen":"2026-04-03T20:18:19.073928Z","times_seen":9,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/clients/index.php","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"041c0d1934fa0faa73550ea17b14be98","sha1":"3112efbe9f88e2b3186ba37baae02cbc75928030","sha256":"f5c31ca5c2956a9d6eab9694c78664b4314b96c8aec706f4044783345c8f2245","sha512":"a28627264ec9937b43a80e9fcd1d1384fe1ac8348b539a7aea59e53d325c45a8d4f0ce9f7dc708e40b2370ea42ccde75bb79007e57e01c821e298dea23064142","ssdeep":"","tlshash":"d911400439e2117940eb307d0b9f5802a2325cdb600ed620bc1ee7c04ff0e9916aabcc","size":988,"data":"","first_seen":"2023-12-18T03:32:46Z","last_seen":"2026-04-03T20:18:19.098793Z","times_seen":13,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/clients/js/tc_PortailClientCreditAgricole_4.js","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"1066d8e441bc0d6f67f9f20d9a028f32","sha1":"63fb74078ad83d79773d5d87e947ffc56ca77d96","sha256":"638be48729432b387101dc8d0ff41662f5776dfbfbf7da750e3f9195036c7ea4","sha512":"60a9599add42c1c67f5787d4b58c22ad642916ddb057b0dfa7855d4b0bdf02564611c0353a3a7e3032ce61b4c2d0b742793f25b7873895c6715a832ccaa800ce","ssdeep":"1536:II2a0BLU41j8h7jQTHGcBVPXdCXc4avXSAI4av4ah4t4m4Bg:F2RBFJRdXXF","tlshash":"2b83947f31739c791aa2f3784f2e4f8576b5e017988acc64840ed6db19e5842818e3bd","size":81982,"data":"","first_seen":"2023-12-18T03:32:46Z","last_seen":"2026-04-03T20:18:19.088544Z","times_seen":9,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/clients/js/utils.min.423ec59365a85ebded314ad7311ef508.js","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"53e8e1fd7da77d9aeacd0094c941028b","sha1":"ceb9ba151b81fa79ac41efd14b26d2dc60737e38","sha256":"d55cb87000c5153ed2e3e5da605a94fa289c18a4002253b78bf544d94f16e16a","sha512":"b862deb79053a52a85932ec11f65bd861667185c4b4f0d06b29c221dc790f32a65c62770c3d92822471e5fa2d5b726447afc29a770a2734e2d7eb0a6d9792e3d","ssdeep":"192:TrUgRgprT1pNxIr2pTuD9RVONVYE/0rP5Gapf6hpP0APlErPBWre:TrerhruriuhRViX/0rPAjPKrPBWre","tlshash":"490208c631c6b4a703d7626116af690ab07795d8a50dd030d46acae0bcb1f9f8463ff9","size":8589,"data":"","first_seen":"2023-10-18T13:27:44Z","last_seen":"2026-04-03T20:18:19.086048Z","times_seen":10,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/clients/js/clientlib-bootstrap-jquery.min.1661914e05c676ce450674555cc1e5b0.js","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"49ec99bfd653f7e352dff804c4499bd2","sha1":"b998bf0b85dbb9ed1ec83e8447b7d0f5abbe013a","sha256":"8a64392a35282a369a93b17815c2e86a424c500caa0ff1954dfbbe05443b07d0","sha512":"5d1d4ca7b76d3d74f3a8398243db2a235d41ef90c09ee61fc0da6a162da22477b2398c683b2f1c1ab63a223a5b7cac2c5644046da6c7b5f531f0deb0839328fa","ssdeep":"6144:XNL1Hc08cLKRUyDUbb93gjB7iqTCEZ6MOPeRG5vdg67k:XF1T8cLKR3UbF8B7iqGnMOmRr","tlshash":"f2a4189a7601213e47ff71ba906f0b0eb13a9a6644489068f478c9e83db4c4561bff7d","size":479412,"data":"","first_seen":"2023-12-18T03:32:46Z","last_seen":"2026-04-03T20:18:19.092203Z","times_seen":9,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/clients/js/clientlib-megaMenu.min.ba7895b05be615c5c578c345e0696317.js","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"1786d8e1801e52a28f9cc84d9ebca6da","sha1":"6effbcae9fcd5a66e4068b5933cc1212ef30e569","sha256":"698b29596567c629e0de6b0baeae9f03d9e47413a3f34132763c6f2bf3ef1b46","sha512":"e5fb19220219c341876ed67a75c9ebddb2d63858e112c7fa0f2f0d33a2fc410428ad98eb4c9cf567aea5faba5d67ff53532eb1f5fb2ddf7ad4fd94c0251e3e56","ssdeep":"384:1TWGrt1cu+w3o76idE58t0Oe3hYahYTLhgWbzpN74KXjyNyrypy/RyXWmyFSy5dG:1TWGrt1cu347K58tHe3hYahYvhgWv74b","tlshash":"0d82856530d4613552de62d59a061828a333501ce90fa82c7cacddfb2c78c8637babfd","size":18189,"data":"","first_seen":"2023-12-18T03:32:46Z","last_seen":"2026-04-03T20:18:19.08378Z","times_seen":9,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/clients/index.php","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"3e6e551168b78071a80bfcd15b275129","sha1":"96b994e04259eeb5c040d6041593573eb905dae9","sha256":"1ef1b4b9398c8966398c0a1ebf64079dbc781baa39116b70a6c487afb81da1d9","sha512":"2dc76f4694bea22c0a90393f414e04c319c8071682cca1b2770c49a6823074a6bd87d09798db251b4ba137ccbc8eb75ddb2877d405cbf04b13656d1f98bb564d","ssdeep":"48:rwlJg0FyFa9lKF/hIlJylnElYlkl3kWIQjGRpVoBSwVO3uS9hXWO+ogD:8lJWFCle/ylJylnElYlu3kWxMvvhXOvD","tlshash":"86b1b90c806fa2d1e6dd24bfb21fd5586c36824391f9942af39d36c58f002c9cca5e9b","size":5554,"data":"","first_seen":"2023-12-18T03:32:46Z","last_seen":"2026-04-03T20:18:19.099578Z","times_seen":13,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/clients/index.php","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"34b956ee554660fbaac940b06d734bd6","sha1":"958df3b68602d72aacca6aaf54db1a9307f0d9d0","sha256":"ffa93f09d860807e80b1d80683ff85ea1dead3acb7ca14b43a06e2aeea4482a4","sha512":"443caf7a2662d50524d300e22e7118e85f194b5c3069858de0d2956d0649d1dc5d91c2e6326417ea8e8c21c8da435e4e711f057e27e8bd4919d0cda5296edea7","ssdeep":"","tlshash":"a20142bda415769e1573306f9efbc6847a1ad04bb000ad11796c448f4f6d5280fd7d48","size":724,"data":"","first_seen":"2023-12-18T03:32:46Z","last_seen":"2026-04-03T20:18:19.100233Z","times_seen":13,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/clients/index.php","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"8dee4120547c8a4baf8181eb2c7c2b6a","sha1":"0726904081d591683ebe0eff12c8181cab617e0f","sha256":"29e78eeb6d94ab14e279be1bd07e1d0f36778de1c7cf8d6426c219eb2d06f845","sha512":"26eebc35a498e4e738e4a366660a964d586d757733e226e5dab2bf5e518fb51ebb5dc8d886e27a2ee1cf9694a094aa4aa99d30c011a52b01636764a2acb6b882","ssdeep":"","tlshash":"419000acac2a2080288c002aa2aa222220e000a300e8c800b00cb0f80f002800c08cc0","size":43,"data":"","first_seen":"2023-03-07T12:33:51Z","last_seen":"2026-05-31T09:21:33.309784Z","times_seen":44,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/clients/js/jquery.min.3fa47a8976d292401e5e89639c528426.js","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"3fa47a8976d292401e5e89639c528426","sha1":"a98bcad2397e229e72874a80168f5ad75762b253","sha256":"8177840b502e6908014c6955695127284c51f7223c7c5af90a08140c10e1f26f","sha512":"2f326d10b92974542b7c5c2004932c72e79c683f61ed956f6bfb77bf79b572944add2d21772c58704fc6fa870d6921f318ef0fac2d9e685b04b68f7215099c8d","ssdeep":"3072:4iGBhDQvkuvd+89enli3o65ayUA3f+4Ude6em3Y6Cqaq7:4hhryUA3n6em3Yjq7","tlshash":"7de3faedba45207e93f731bbb47f4b1e753a966748188081e16898b83cb4d0450abf7d","size":151714,"data":"","first_seen":"2023-07-01T05:24:00Z","last_seen":"2026-06-30T07:10:04.656041Z","times_seen":437,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/clients/js/clientlibHeader.min.d60873be6e7b5a14dedf919ffe2b8041.js","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"3c19921d0000df2adf44d326be083b11","sha1":"e390e1115ecc9848ae5471e48cf0ae556a91829f","sha256":"4c1a340856aa33c5f1da0c0057aee87f1f8a66c7c9785d4db9f8aeb32285ade9","sha512":"e734c16b7cddafb7bb230a71bb524511162d5fa3a1dec48a8e009bcfe240ada485a5186866d2b4a8c93f795459969adc61d53374f6d18eee4246c8999233471f","ssdeep":"384:tATw07E5uUJaf1GZFPTSHiEA6F2CJ5ILjnkBwxxCx:tATw55ucU1GbaVoLjkBwqx","tlshash":"7c62e98d718d732183af216626af05296237b9212a444404e45accf62df4e4e63effad","size":15175,"data":"","first_seen":"2023-10-18T13:27:44Z","last_seen":"2026-04-03T20:18:19.078918Z","times_seen":10,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/clients/js/tc_PortailClientCreditAgricole_1.js","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"eaf9966faf3f57dd0dfe8db36f01d1dd","sha1":"629a6c78c0190f8b0aa694ab1bf3da549c823377","sha256":"dc505aa096a2f9b1c138c23b7ea2e75e4a40c178c919ac2e594f8418734d56a9","sha512":"53b96c3c1d6d396501889f355082eeda71a1288a6e677bf6276f66a3db64552e50de5fd1b6138952bacccc5b6e8fca91467e38da0bb76d8f70b3adb19f2ca603","ssdeep":"1536:a2B2gzY4CdCx6qH4N0tK9dzXM4aTX4AgTa/u0/EgUPsWyyXu9olqipei0x7oqauV:a2B29YSdqXOG/u0/UDqoCd8u0+GTizf","tlshash":"dd24fadd31a3f8791797b1394a3f190ab37ae406584ec820d405e5da3cb584b826bfbd","size":221726,"data":"","first_seen":"2023-12-18T03:32:46Z","last_seen":"2026-04-03T20:18:19.075386Z","times_seen":9,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/clients/index.php","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"4b0dd29350a58744fbc3c9e2fe50b166","sha1":"7afaef91eafdab1e6d94b7dbed3232d07cd90b90","sha256":"dc73a5434f7f5ae61540bd2adb1ac0469d05fa8d12277da2d7ddfdaaa09a0072","sha512":"01092485699d89d39ff9abb63d2e2dce893616886151a2b2bb422d9c4744a3fda305514e5733ff45b0c74b15aad71e816f2b8ecb20141e3880ece252b7bdc12f","ssdeep":"","tlshash":"df0178affbc345a80a463ab97859d30578b88103480980167cce26531f15e40d5aaef5","size":700,"data":"","first_seen":"2023-12-18T03:32:46Z","last_seen":"2026-04-03T20:18:19.101995Z","times_seen":13,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/clients/index.php","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-04-03T20:17:50.853Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"chnsaulins.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 17:21:24 GMT","end":"Tue, 02 Jun 2026 17:21:23 GMT"},"fingerprint":{"sha1":"BE:2A:CE:5C:5E:8E:D2:93:AA:76:2F:E7:24:5C:DD:1D:5E:42:BF:8C","sha256":"FA:C0:2A:2B:BF:94:B6:A8:79:9D:A8:1F:2B:56:A4:FD:99:88:7D:5D:73:22:C1:58:05:8C:FF:F9:1F:42:2B:13"}}},"request":{"raw":"GET /clients/index.php HTTP/1.1\r\nHost: chnsaulins.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nset-cookie: PHPSESSID=984kvauo734qp252tmms73gd9d; path=/\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-length: 23404\r\ncontent-type: text/html; charset=UTF-8\r\ndate: Fri, 03 Apr 2026 20:17:50 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Adobe Experience Manager","description":"Adobe Experience Manager (AEM) is a content management solution for building websites, mobile apps and forms.","website":"https://www.adobe.com/marketing/experience-manager.html","common_platform_enumeration":"cpe:2.3:a:adobe:experience_manager:*:*:*:*:*:*:*:*","icon":"Adobe Experience Platform.svg","categories":["CMS"]},{"name":"Java","description":"Java is a class-based, object-oriented programming language that is designed to have as few implementation dependencies as possible.","website":"https://java.com","common_platform_enumeration":"cpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*","icon":"Java.svg","categories":["Programming languages"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Bootstrap:1661914e05c676ce450674555cc1e5b0","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"Underscore.js","description":"Underscore.js is a JavaScript library which provides utility functions for common programming tasks. It is comparable to features provided by Prototype.js and the Ruby language, but opts for a functional programming design instead of extending object prototypes.","website":"https://underscorejs.org","common_platform_enumeration":"","icon":"Underscore.js.png","categories":["JavaScript libraries"]},{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":154222,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (459)","md5":"406e6c760f6ebcb471a7358fdf608e1f","sha1":"3900ba05e8e6da52a8e513ca0127e6a381a07033","sha256":"f68d2a5582095039f67d155537e48cc6e944f516a7ef20ea914e5cb09dc446c5","sha512":"cf7b533fd50e78384afc0f88a411b88ab1592a4a25e19bd78c85ca6bce9fa5d8a778ab9399cfecef0ec8517adf90db257fbcdb316d3fbdfce2c807550589c16d","ssdeep":"1536:P3iMzjhkjvUZ2qU7310sElcGxPQJWL7TQ0hgqT2r6D6xp7k1WWjRZx6clvK0FyF:P3iMzjhXAlRElblNL7ZFjbQchyF","tlshash":"18e3602560f5303202e791fabab65b17bea5d203c54a5d00b6ed0bd94fd2f89dc07a1e","first_seen":"2025-08-14T08:47:48.786167Z","last_seen":"2026-04-03T20:18:19.069341Z","times_seen":8,"resource_available":false,"data":null}},"time_used":86,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":84,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-03","alert":"Phishing Block","trigger":"chnsaulins.duckdns.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Credit Agricole","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Credit Agricole phishing","tags":["phishing","credit_agricole","finacial"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/clients/css/clientlibStoreLocatorPart.min.d0196ccb8ef0f95d3990b3da0665b235.css","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://chnsaulins.duckdns.org/clients/index.php","date":"2026-04-03T20:17:51.206Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"chnsaulins.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 17:21:24 GMT","end":"Tue, 02 Jun 2026 17:21:23 GMT"},"fingerprint":{"sha1":"BE:2A:CE:5C:5E:8E:D2:93:AA:76:2F:E7:24:5C:DD:1D:5E:42:BF:8C","sha256":"FA:C0:2A:2B:BF:94:B6:A8:79:9D:A8:1F:2B:56:A4:FD:99:88:7D:5D:73:22:C1:58:05:8C:FF:F9:1F:42:2B:13"}}},"request":{"raw":"GET /clients/css/clientlibStoreLocatorPart.min.d0196ccb8ef0f95d3990b3da0665b235.css HTTP/1.1\r\nHost: chnsaulins.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://chnsaulins.duckdns.org/clients/index.php\r\nCookie: PHPSESSID=984kvauo734qp252tmms73gd9d\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Wed, 16 Jul 2025 09:28:47 GMT\r\netag: \"31d9-63a08851291c0-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-length: 3506\r\ncontent-type: text/css\r\ndate: Fri, 03 Apr 2026 20:17:51 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":12761,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (1706)","md5":"d0196ccb8ef0f95d3990b3da0665b235","sha1":"130c25a6b65f0f3e73d3f06284394f1774b3c695","sha256":"0775513a58624d11e22cf814d9080e3d08d4b43885dc4ac2218a5c5229c281ee","sha512":"73caf55e4bde3c252f8ed12e936fc195a57cd098b8e7dbf17217e4194696f357b37b581e301bc1d0f0e73b3e2fd6bc0cc59b64a52fe9d7653e6a6565d59d214c","ssdeep":"384:LNxnCjZnCj1leR67SQgL6x2iLQ5DTtWVfbgbI88L:LNEo5lruQgL6ge","tlshash":"cc42d66b2641772970378d06fbc67521233c8423976b2ef9b9993a64c3c75e913272ce","first_seen":"2023-04-06T08:14:41Z","last_seen":"2026-06-30T07:10:04.646011Z","times_seen":437,"resource_available":false,"data":null}},"time_used":51,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":50,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-03","alert":"Phishing Block","trigger":"chnsaulins.duckdns.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Credit Agricole","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Credit Agricole phishing","tags":["phishing","credit_agricole","finacial"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/clients/contexthub","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://chnsaulins.duckdns.org/clients/index.php","date":"2026-04-03T20:17:51.219Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"chnsaulins.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 17:21:24 GMT","end":"Tue, 02 Jun 2026 17:21:23 GMT"},"fingerprint":{"sha1":"BE:2A:CE:5C:5E:8E:D2:93:AA:76:2F:E7:24:5C:DD:1D:5E:42:BF:8C","sha256":"FA:C0:2A:2B:BF:94:B6:A8:79:9D:A8:1F:2B:56:A4:FD:99:88:7D:5D:73:22:C1:58:05:8C:FF:F9:1F:42:2B:13"}}},"request":{"raw":"GET /clients/contexthub HTTP/1.1\r\nHost: chnsaulins.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://chnsaulins.duckdns.org/clients/index.php\r\nCookie: PHPSESSID=984kvauo734qp252tmms73gd9d\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\ncontent-length: 269\r\ncontent-type: text/html; charset=iso-8859-1\r\ndate: Fri, 03 Apr 2026 20:17:51 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":269,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"cf2a6e637bf9acb54bacd92d0445c1f1","sha1":"e29fbb1c521d486e3a62028314c8ca6eed15c123","sha256":"3529205ad726a7e218c06f08907610e568dca7949b26f4e4ccc16b08ae088a59","sha512":"18700fba56d815fc87648a3c03cf2e806cd7fb800cd336fe7782777a4e24f738ccba860527afdab15f8664130c7351f49cfc560694a4e9a7a739a8733e60ceb3","ssdeep":"","tlshash":"52d02b9e904333960d1224907dc211c223c913fb643981a86d86d847529853dcc8a6d9","first_seen":"2026-03-10T10:15:35.794448Z","last_seen":"2026-04-03T20:18:19.071291Z","times_seen":6,"resource_available":false,"data":null}},"time_used":72,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":72,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-03","alert":"Phishing Block","trigger":"chnsaulins.duckdns.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Credit Agricole","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Credit Agricole phishing","tags":["phishing","credit_agricole","finacial"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/clients/images/NPC-logo_Agir_chaque_jour_CA_H_Desktop-1.svg","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://chnsaulins.duckdns.org/clients/index.php","date":"2026-04-03T20:17:51.220Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"chnsaulins.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 17:21:24 GMT","end":"Tue, 02 Jun 2026 17:21:23 GMT"},"fingerprint":{"sha1":"BE:2A:CE:5C:5E:8E:D2:93:AA:76:2F:E7:24:5C:DD:1D:5E:42:BF:8C","sha256":"FA:C0:2A:2B:BF:94:B6:A8:79:9D:A8:1F:2B:56:A4:FD:99:88:7D:5D:73:22:C1:58:05:8C:FF:F9:1F:42:2B:13"}}},"request":{"raw":"GET /clients/images/NPC-logo_Agir_chaque_jour_CA_H_Desktop-1.svg HTTP/1.1\r\nHost: chnsaulins.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://chnsaulins.duckdns.org/clients/index.php\r\nCookie: PHPSESSID=984kvauo734qp252tmms73gd9d\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Wed, 16 Jul 2025 09:28:48 GMT\r\netag: \"5714-63a088521d400-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-length: 6242\r\ncontent-type: image/svg+xml\r\ndate: Fri, 03 Apr 2026 20:17:51 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":22292,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"4afe8351310049851b41d3c5d055a9a9","sha1":"5609ba854c319ec2a4a433bcb7315b8171a67e7e","sha256":"eb1dedf64e9e60c0e67a595382e622c7fa7d6c8a705091ed5c78ebe16fd48c5d","sha512":"78d45d7357ff0005a5730c056c55331f06eacea6934953109e93018b57f74f4642816de3b5d50e0f66e4e60f678f4a24eb465601475f2c98d6821272cdda3a4c","ssdeep":"384:+++JkLZX6YztBYZcXTKYA3PSEazRRe5GnQaLeNsXTJ:j+mdSBcRC0QEOsXTJ","tlshash":"65a2f0570308ebfaada5065cdb29249175da9c9bd074f1c0babf1806d05ccd4e89cbee","first_seen":"2023-09-30T14:11:50Z","last_seen":"2026-07-27T00:25:30.838802Z","times_seen":30,"resource_available":false,"data":null}},"time_used":79,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":72,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-03","alert":"Phishing Block","trigger":"chnsaulins.duckdns.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Credit Agricole","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Credit Agricole phishing","tags":["phishing","credit_agricole","finacial"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/libs/granite/csrf/token.json","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://chnsaulins.duckdns.org/clients/index.php","date":"2026-04-03T20:17:51.651Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"chnsaulins.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 17:21:24 GMT","end":"Tue, 02 Jun 2026 17:21:23 GMT"},"fingerprint":{"sha1":"BE:2A:CE:5C:5E:8E:D2:93:AA:76:2F:E7:24:5C:DD:1D:5E:42:BF:8C","sha256":"FA:C0:2A:2B:BF:94:B6:A8:79:9D:A8:1F:2B:56:A4:FD:99:88:7D:5D:73:22:C1:58:05:8C:FF:F9:1F:42:2B:13"}}},"request":{"raw":"GET /libs/granite/csrf/token.json HTTP/1.1\r\nHost: chnsaulins.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://chnsaulins.duckdns.org/clients/index.php\r\nCookie: PHPSESSID=984kvauo734qp252tmms73gd9d\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\ncontent-length: 269\r\ncontent-type: text/html; charset=iso-8859-1\r\ndate: Fri, 03 Apr 2026 20:17:51 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":269,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"cf2a6e637bf9acb54bacd92d0445c1f1","sha1":"e29fbb1c521d486e3a62028314c8ca6eed15c123","sha256":"3529205ad726a7e218c06f08907610e568dca7949b26f4e4ccc16b08ae088a59","sha512":"18700fba56d815fc87648a3c03cf2e806cd7fb800cd336fe7782777a4e24f738ccba860527afdab15f8664130c7351f49cfc560694a4e9a7a739a8733e60ceb3","ssdeep":"","tlshash":"52d02b9e904333960d1224907dc211c223c913fb643981a86d86d847529853dcc8a6d9","first_seen":"2026-03-10T10:15:35.794448Z","last_seen":"2026-04-03T20:18:19.071291Z","times_seen":6,"resource_available":false,"data":null}},"time_used":34,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":33,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-03","alert":"Phishing Block","trigger":"chnsaulins.duckdns.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Credit Agricole","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Credit Agricole phishing","tags":["phishing","credit_agricole","finacial"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/clients/undefined","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://chnsaulins.duckdns.org/clients/index.php","date":"2026-04-03T20:17:52.042Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"chnsaulins.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 17:21:24 GMT","end":"Tue, 02 Jun 2026 17:21:23 GMT"},"fingerprint":{"sha1":"BE:2A:CE:5C:5E:8E:D2:93:AA:76:2F:E7:24:5C:DD:1D:5E:42:BF:8C","sha256":"FA:C0:2A:2B:BF:94:B6:A8:79:9D:A8:1F:2B:56:A4:FD:99:88:7D:5D:73:22:C1:58:05:8C:FF:F9:1F:42:2B:13"}}},"request":{"raw":"GET /clients/undefined HTTP/1.1\r\nHost: chnsaulins.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://chnsaulins.duckdns.org/clients/index.php\r\nCookie: PHPREFS=full; PHPSESSID=984kvauo734qp252tmms73gd9d\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\ncontent-length: 269\r\ncontent-type: text/html; charset=iso-8859-1\r\ndate: Fri, 03 Apr 2026 20:17:52 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":269,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"cf2a6e637bf9acb54bacd92d0445c1f1","sha1":"e29fbb1c521d486e3a62028314c8ca6eed15c123","sha256":"3529205ad726a7e218c06f08907610e568dca7949b26f4e4ccc16b08ae088a59","sha512":"18700fba56d815fc87648a3c03cf2e806cd7fb800cd336fe7782777a4e24f738ccba860527afdab15f8664130c7351f49cfc560694a4e9a7a739a8733e60ceb3","ssdeep":"","tlshash":"52d02b9e904333960d1224907dc211c223c913fb643981a86d86d847529853dcc8a6d9","first_seen":"2026-03-10T10:15:35.794448Z","last_seen":"2026-04-03T20:18:19.071291Z","times_seen":6,"resource_available":false,"data":null}},"time_used":42,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":42,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-03","alert":"Phishing Block","trigger":"chnsaulins.duckdns.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Credit Agricole","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Credit Agricole phishing","tags":["phishing","credit_agricole","finacial"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/clients/contexthub","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://chnsaulins.duckdns.org/clients/index.php","date":"2026-04-03T20:17:51.686Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"chnsaulins.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 17:21:24 GMT","end":"Tue, 02 Jun 2026 17:21:23 GMT"},"fingerprint":{"sha1":"BE:2A:CE:5C:5E:8E:D2:93:AA:76:2F:E7:24:5C:DD:1D:5E:42:BF:8C","sha256":"FA:C0:2A:2B:BF:94:B6:A8:79:9D:A8:1F:2B:56:A4:FD:99:88:7D:5D:73:22:C1:58:05:8C:FF:F9:1F:42:2B:13"}}},"request":{"raw":"GET /clients/contexthub HTTP/1.1\r\nHost: chnsaulins.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://chnsaulins.duckdns.org/clients/index.php\r\nCookie: PHPREFS=full; PHPSESSID=984kvauo734qp252tmms73gd9d\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\ncontent-length: 269\r\ncontent-type: text/html; charset=iso-8859-1\r\ndate: Fri, 03 Apr 2026 20:17:51 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":269,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"cf2a6e637bf9acb54bacd92d0445c1f1","sha1":"e29fbb1c521d486e3a62028314c8ca6eed15c123","sha256":"3529205ad726a7e218c06f08907610e568dca7949b26f4e4ccc16b08ae088a59","sha512":"18700fba56d815fc87648a3c03cf2e806cd7fb800cd336fe7782777a4e24f738ccba860527afdab15f8664130c7351f49cfc560694a4e9a7a739a8733e60ceb3","ssdeep":"","tlshash":"52d02b9e904333960d1224907dc211c223c913fb643981a86d86d847529853dcc8a6d9","first_seen":"2026-03-10T10:15:35.794448Z","last_seen":"2026-04-03T20:18:19.071291Z","times_seen":6,"resource_available":false,"data":null}},"time_used":33,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":33,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-03","alert":"Phishing Block","trigger":"chnsaulins.duckdns.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Credit Agricole","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Credit Agricole phishing","tags":["phishing","credit_agricole","finacial"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/clients/images/logo_ca.png","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://chnsaulins.duckdns.org/clients/index.php","date":"2026-04-03T20:17:51.233Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"chnsaulins.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 17:21:24 GMT","end":"Tue, 02 Jun 2026 17:21:23 GMT"},"fingerprint":{"sha1":"BE:2A:CE:5C:5E:8E:D2:93:AA:76:2F:E7:24:5C:DD:1D:5E:42:BF:8C","sha256":"FA:C0:2A:2B:BF:94:B6:A8:79:9D:A8:1F:2B:56:A4:FD:99:88:7D:5D:73:22:C1:58:05:8C:FF:F9:1F:42:2B:13"}}},"request":{"raw":"GET /clients/images/logo_ca.png HTTP/1.1\r\nHost: chnsaulins.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://chnsaulins.duckdns.org/clients/index.php\r\nCookie: PHPSESSID=984kvauo734qp252tmms73gd9d\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Wed, 16 Jul 2025 09:28:48 GMT\r\netag: \"7f5-63a088521d400\"\r\naccept-ranges: bytes\r\ncontent-length: 2037\r\ncontent-type: image/png\r\ndate: Fri, 03 Apr 2026 20:17:51 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":2037,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 83 x 64, 8-bit/color RGB, non-interlaced","md5":"a5777291aa794d7d07285c839571662a","sha1":"284f3d6b64462c946a640072bb57e512307bf8ab","sha256":"1c8399c9f4f09feb8f95fe39465cc7e70597b0097ad92da954db82646ec68dc3","sha512":"5b0fd3527b820fb9f9fe008fffd0b2a6b69114ea51ece155aa47dedf9fa3097fc3eb1e8a0a24e19b1c92b9607a7b8dac4e732739930106822063b7c8048b0585","ssdeep":"","tlshash":"a0411addbc7e4ad8c683d0b585d0115f67a042165a91bbdca70f012a4ced722b0ea96e","first_seen":"2023-05-11T22:53:36Z","last_seen":"2026-08-04T14:22:57.752493Z","times_seen":769,"resource_available":false,"data":null}},"time_used":59,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":59,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-03","alert":"Phishing Block","trigger":"chnsaulins.duckdns.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Credit Agricole","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Credit Agricole phishing","tags":["phishing","credit_agricole","finacial"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/clients/js/clientlib-npc-components.min.7cfc5fa697c76034e59d2011276d211e.js","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://chnsaulins.duckdns.org/clients/index.php","date":"2026-04-03T20:17:51.237Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"chnsaulins.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 17:21:24 GMT","end":"Tue, 02 Jun 2026 17:21:23 GMT"},"fingerprint":{"sha1":"BE:2A:CE:5C:5E:8E:D2:93:AA:76:2F:E7:24:5C:DD:1D:5E:42:BF:8C","sha256":"FA:C0:2A:2B:BF:94:B6:A8:79:9D:A8:1F:2B:56:A4:FD:99:88:7D:5D:73:22:C1:58:05:8C:FF:F9:1F:42:2B:13"}}},"request":{"raw":"GET /clients/js/clientlib-npc-components.min.7cfc5fa697c76034e59d2011276d211e.js HTTP/1.1\r\nHost: chnsaulins.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://chnsaulins.duckdns.org/clients/index.php\r\nCookie: PHPSESSID=984kvauo734qp252tmms73gd9d\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Wed, 16 Jul 2025 09:28:48 GMT\r\netag: \"8ce0e-63a088521d400-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-type: text/javascript\r\ndate: Fri, 03 Apr 2026 20:17:51 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":577038,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65517), with no line terminators","md5":"72e287cbd699afb1cd85f6426f2dc636","sha1":"ecaa71fae08b32889542d10bb5f1b26a96fc4708","sha256":"95a865fafe6ee2b1f7c4dee0d393b38d3da8473b6d0af82bbcdbdebe0176d96a","sha512":"be1670246cd2b4c95f26d6ca05ae875acb6d8847a8e0fc66f5f06e241b8f80928c1de2ff2ccf6587157271ae6b24598d81cefba6fdae0cc18cb119427bff98f8","ssdeep":"12288:+mZHTn2UHL9Nua2kCJrqGvVZ9MwJevZ3/m5I:9JYkCJ2GtJJevZSI","tlshash":"b9c43a8d7340743543ab71b5206f160eb2372925a80ac058b57ae9da6cbcd8d327bf7d","first_seen":"2023-12-18T03:32:46Z","last_seen":"2026-04-03T20:18:19.073928Z","times_seen":9,"resource_available":true,"data":null}},"time_used":179,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":179,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-03","alert":"Phishing Block","trigger":"chnsaulins.duckdns.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Credit Agricole","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Credit Agricole phishing","tags":["phishing","credit_agricole","finacial"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/clients/images/icone_ca_pwa.png","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://chnsaulins.duckdns.org/clients/index.php","date":"2026-04-03T20:17:51.995Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"chnsaulins.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 17:21:24 GMT","end":"Tue, 02 Jun 2026 17:21:23 GMT"},"fingerprint":{"sha1":"BE:2A:CE:5C:5E:8E:D2:93:AA:76:2F:E7:24:5C:DD:1D:5E:42:BF:8C","sha256":"FA:C0:2A:2B:BF:94:B6:A8:79:9D:A8:1F:2B:56:A4:FD:99:88:7D:5D:73:22:C1:58:05:8C:FF:F9:1F:42:2B:13"}}},"request":{"raw":"GET /clients/images/icone_ca_pwa.png HTTP/1.1\r\nHost: chnsaulins.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://chnsaulins.duckdns.org/clients/index.php\r\nCookie: PHPREFS=full; PHPSESSID=984kvauo734qp252tmms73gd9d\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Wed, 16 Jul 2025 09:28:48 GMT\r\netag: \"2d1a-63a088521d400\"\r\naccept-ranges: bytes\r\ncontent-length: 11546\r\ncontent-type: image/png\r\ndate: Fri, 03 Apr 2026 20:17:52 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":11546,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced","md5":"1672798339d9857c71d319a441c13ece","sha1":"ba562e9eb51185f653d43093a285c78d34bdc346","sha256":"3358b6f2d9351fd1fec303210400a4514cc55a851ad97d202cfc0f840e3f54a7","sha512":"f20faf492e686e02ff0139f59511b7a6583d47e61003700a80607d5f585f7121bfdb7955abb988723ccc1e9ce8ad69eb322f4225739aa433781394150ee2f6ee","ssdeep":"192:bhkNfsCxwlNenbnSbGvDSpcHXgf1hSOqgs8vVJKui32ycCO+DIvwVmvzNGtANur7:b6RQceSHXQ1o62H3ATwWHurpsCjt","tlshash":"0932bf8c977552f0930d66b9d2ba86e9893576090b81270bb5a818bdef4dc24b044aff","first_seen":"2023-07-01T05:24:01Z","last_seen":"2026-07-24T21:41:02.757611Z","times_seen":125,"resource_available":false,"data":null}},"time_used":41,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":40,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-03","alert":"Phishing Block","trigger":"chnsaulins.duckdns.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Credit Agricole","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Credit Agricole phishing","tags":["phishing","credit_agricole","finacial"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/clients/js/tc_PortailClientCreditAgricole_1.js","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://chnsaulins.duckdns.org/clients/index.php","date":"2026-04-03T20:17:51.218Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"chnsaulins.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 17:21:24 GMT","end":"Tue, 02 Jun 2026 17:21:23 GMT"},"fingerprint":{"sha1":"BE:2A:CE:5C:5E:8E:D2:93:AA:76:2F:E7:24:5C:DD:1D:5E:42:BF:8C","sha256":"FA:C0:2A:2B:BF:94:B6:A8:79:9D:A8:1F:2B:56:A4:FD:99:88:7D:5D:73:22:C1:58:05:8C:FF:F9:1F:42:2B:13"}}},"request":{"raw":"GET /clients/js/tc_PortailClientCreditAgricole_1.js HTTP/1.1\r\nHost: chnsaulins.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://chnsaulins.duckdns.org/clients/index.php\r\nCookie: PHPSESSID=984kvauo734qp252tmms73gd9d\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Wed, 16 Jul 2025 09:28:48 GMT\r\netag: \"3621e-63a088521d400-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-type: text/javascript\r\ndate: Fri, 03 Apr 2026 20:17:51 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":221726,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65526), with no line terminators","md5":"eaf9966faf3f57dd0dfe8db36f01d1dd","sha1":"629a6c78c0190f8b0aa694ab1bf3da549c823377","sha256":"dc505aa096a2f9b1c138c23b7ea2e75e4a40c178c919ac2e594f8418734d56a9","sha512":"53b96c3c1d6d396501889f355082eeda71a1288a6e677bf6276f66a3db64552e50de5fd1b6138952bacccc5b6e8fca91467e38da0bb76d8f70b3adb19f2ca603","ssdeep":"1536:a2B2gzY4CdCx6qH4N0tK9dzXM4aTX4AgTa/u0/EgUPsWyyXu9olqipei0x7oqauV:a2B29YSdqXOG/u0/UDqoCd8u0+GTizf","tlshash":"dd24fadd31a3f8791797b1394a3f190ab37ae406584ec820d405e5da3cb584b826bfbd","first_seen":"2023-12-18T03:32:46Z","last_seen":"2026-04-03T20:18:19.075386Z","times_seen":9,"resource_available":true,"data":null}},"time_used":150,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":150,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-03","alert":"Phishing Block","trigger":"chnsaulins.duckdns.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Credit Agricole","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Credit Agricole phishing","tags":["phishing","credit_agricole","finacial"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/clients/css/clientlib-part.min.bf09c4d0412c08be7d1dd5b8db85356f.css","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://chnsaulins.duckdns.org/clients/index.php","date":"2026-04-03T20:17:51.194Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"chnsaulins.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 17:21:24 GMT","end":"Tue, 02 Jun 2026 17:21:23 GMT"},"fingerprint":{"sha1":"BE:2A:CE:5C:5E:8E:D2:93:AA:76:2F:E7:24:5C:DD:1D:5E:42:BF:8C","sha256":"FA:C0:2A:2B:BF:94:B6:A8:79:9D:A8:1F:2B:56:A4:FD:99:88:7D:5D:73:22:C1:58:05:8C:FF:F9:1F:42:2B:13"}}},"request":{"raw":"GET /clients/css/clientlib-part.min.bf09c4d0412c08be7d1dd5b8db85356f.css HTTP/1.1\r\nHost: chnsaulins.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://chnsaulins.duckdns.org/clients/index.php\r\nCookie: PHPSESSID=984kvauo734qp252tmms73gd9d\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Wed, 16 Jul 2025 09:28:47 GMT\r\netag: \"178d43-63a08851291c0-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-type: text/css\r\ndate: Fri, 03 Apr 2026 20:17:51 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":1543491,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (14675)","md5":"15213e147acd53e8fa7da9fe0658259c","sha1":"407d3c4f6469e4fab1ec36fc6c39beab31353f0f","sha256":"3ff3e940c36d502e1d8fab9809a851bac95f6a21f825ea125f0f17d086ac2966","sha512":"9ef3b7aefee77e6ae527044d0e4d8ef7c983fee7bbc41b7a3a13f2d945f5be12d8cbbce84b6429565fcc608c29cd80d1da19bce7256c189916fffb4f1230bf95","ssdeep":"1536:tBQz/rlOT4YzhkF9o4qLlOGSjFa5h/gP20PDqgZkI6ZYain/lSeDujzYd1T2QXBE:AROT43cOGSAWmI6T+GWI6b7OO+","tlshash":"b025e8e9711032d9677fcc25a598aa939314d117c4261efbfb7b00ad83ce1c60663e7a","first_seen":"2025-08-13T12:19:29.32377Z","last_seen":"2026-04-03T20:18:19.076278Z","times_seen":6,"resource_available":false,"data":null}},"time_used":228,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":228,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-03","alert":"Phishing Block","trigger":"chnsaulins.duckdns.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Credit Agricole","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Credit Agricole phishing","tags":["phishing","credit_agricole","finacial"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/clients/js/clientlibStoreLocatorGeneral.min.589095941fdc97a6d45bcdbafc63b754.js","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://chnsaulins.duckdns.org/clients/index.php","date":"2026-04-03T20:17:51.235Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"chnsaulins.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 17:21:24 GMT","end":"Tue, 02 Jun 2026 17:21:23 GMT"},"fingerprint":{"sha1":"BE:2A:CE:5C:5E:8E:D2:93:AA:76:2F:E7:24:5C:DD:1D:5E:42:BF:8C","sha256":"FA:C0:2A:2B:BF:94:B6:A8:79:9D:A8:1F:2B:56:A4:FD:99:88:7D:5D:73:22:C1:58:05:8C:FF:F9:1F:42:2B:13"}}},"request":{"raw":"GET /clients/js/clientlibStoreLocatorGeneral.min.589095941fdc97a6d45bcdbafc63b754.js HTTP/1.1\r\nHost: chnsaulins.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://chnsaulins.duckdns.org/clients/index.php\r\nCookie: PHPSESSID=984kvauo734qp252tmms73gd9d\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Wed, 16 Jul 2025 09:28:48 GMT\r\netag: \"48f3-63a088521d400-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-length: 5775\r\ncontent-type: text/javascript\r\ndate: Fri, 03 Apr 2026 20:17:51 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":18675,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (18673), with no line terminators","md5":"1f75c133e6f4470027baf6f973bd75a5","sha1":"49a593c72422f65a2ff97e6ecb99b60bc475f82a","sha256":"fdcc4095db03fc81777504993ad02ac00a44c9082488e1814742f8aa0039982a","sha512":"a63bcadeb4435f1888251197bec0355f3138505c7fff51f3865d4d43b3528eba4beacba47f91e62a8e29c99a84dec103f08c1c4d6c4d8a69810a507a8ceefb6e","ssdeep":"384:feESTuDbsuisvNnGWJCs7EH1Lm+7t6bU8idSDTlBZhdgSc+M6wVqze5nwavwL/Aw:feRKfsQlVC8EH1n7MbamTPySxrLPXjX","tlshash":"a782b94d7698b0f317a33526f02f6146b237689a951896407429d0f46c7eacd93b3f3e","first_seen":"2023-10-18T13:27:44Z","last_seen":"2026-04-03T20:18:19.077125Z","times_seen":10,"resource_available":true,"data":null}},"time_used":73,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":73,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-03","alert":"Phishing Block","trigger":"chnsaulins.duckdns.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Credit Agricole","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Credit Agricole phishing","tags":["phishing","credit_agricole","finacial"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/clients/js/tc_PortailClientCreditAgricole_2.js","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://chnsaulins.duckdns.org/clients/index.php","date":"2026-04-03T20:17:51.242Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"chnsaulins.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 17:21:24 GMT","end":"Tue, 02 Jun 2026 17:21:23 GMT"},"fingerprint":{"sha1":"BE:2A:CE:5C:5E:8E:D2:93:AA:76:2F:E7:24:5C:DD:1D:5E:42:BF:8C","sha256":"FA:C0:2A:2B:BF:94:B6:A8:79:9D:A8:1F:2B:56:A4:FD:99:88:7D:5D:73:22:C1:58:05:8C:FF:F9:1F:42:2B:13"}}},"request":{"raw":"GET /clients/js/tc_PortailClientCreditAgricole_2.js HTTP/1.1\r\nHost: chnsaulins.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://chnsaulins.duckdns.org/clients/index.php\r\nCookie: PHPSESSID=984kvauo734qp252tmms73gd9d\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Wed, 16 Jul 2025 09:28:48 GMT\r\netag: \"40e02-63a088521d400-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-type: text/javascript\r\ndate: Fri, 03 Apr 2026 20:17:51 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":265730,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65524), with no line terminators","md5":"5cfc9479d8c56988abe8e99ad795dc0f","sha1":"90e3076f631b9863fcb01c4574885389dc55c289","sha256":"f82ca001eaef3008aeffe3652bcf94f3ae3e7f7103aae48a249665ed3380d4c7","sha512":"83ab0856c39dbe35f784586a1e1f4031bb210c83e280e9cfaeba22608f072a8c98fa89278a5f5ebaf9aff59b7a6bc8d8f6f00d4018a83d3ead349d9dbd4210e4","ssdeep":"6144:S2M2IKJv8XIjWl3KQxwWK1uquzBLlKwedisQsiUbSE5rWlsQsik0iN:S2MRwWKh","tlshash":"dc442bdd30775c681aab727c6f2f1e42227ad126a808ccd4910acde614fcd4a619f7bd","first_seen":"2023-12-18T03:32:46Z","last_seen":"2026-04-03T20:18:19.077967Z","times_seen":9,"resource_available":true,"data":null}},"time_used":146,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":146,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-03","alert":"Phishing Block","trigger":"chnsaulins.duckdns.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Credit Agricole","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Credit Agricole phishing","tags":["phishing","credit_agricole","finacial"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/clients/images/acces_cr_part_carre.jpg","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://chnsaulins.duckdns.org/clients/index.php","date":"2026-04-03T20:17:51.768Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"chnsaulins.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 17:21:24 GMT","end":"Tue, 02 Jun 2026 17:21:23 GMT"},"fingerprint":{"sha1":"BE:2A:CE:5C:5E:8E:D2:93:AA:76:2F:E7:24:5C:DD:1D:5E:42:BF:8C","sha256":"FA:C0:2A:2B:BF:94:B6:A8:79:9D:A8:1F:2B:56:A4:FD:99:88:7D:5D:73:22:C1:58:05:8C:FF:F9:1F:42:2B:13"}}},"request":{"raw":"GET /clients/images/acces_cr_part_carre.jpg HTTP/1.1\r\nHost: chnsaulins.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://chnsaulins.duckdns.org/clients/index.php\r\nCookie: PHPREFS=full; PHPSESSID=984kvauo734qp252tmms73gd9d\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\ncontent-length: 269\r\ncontent-type: text/html; charset=iso-8859-1\r\ndate: Fri, 03 Apr 2026 20:17:51 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":269,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"cf2a6e637bf9acb54bacd92d0445c1f1","sha1":"e29fbb1c521d486e3a62028314c8ca6eed15c123","sha256":"3529205ad726a7e218c06f08907610e568dca7949b26f4e4ccc16b08ae088a59","sha512":"18700fba56d815fc87648a3c03cf2e806cd7fb800cd336fe7782777a4e24f738ccba860527afdab15f8664130c7351f49cfc560694a4e9a7a739a8733e60ceb3","ssdeep":"","tlshash":"52d02b9e904333960d1224907dc211c223c913fb643981a86d86d847529853dcc8a6d9","first_seen":"2026-03-10T10:15:35.794448Z","last_seen":"2026-04-03T20:18:19.071291Z","times_seen":6,"resource_available":false,"data":null}},"time_used":35,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":34,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-03","alert":"Phishing Block","trigger":"chnsaulins.duckdns.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Credit Agricole","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Credit Agricole phishing","tags":["phishing","credit_agricole","finacial"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/clients/js/clientlibHeader.min.d60873be6e7b5a14dedf919ffe2b8041.js","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://chnsaulins.duckdns.org/clients/index.php","date":"2026-04-03T20:17:51.217Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"chnsaulins.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 17:21:24 GMT","end":"Tue, 02 Jun 2026 17:21:23 GMT"},"fingerprint":{"sha1":"BE:2A:CE:5C:5E:8E:D2:93:AA:76:2F:E7:24:5C:DD:1D:5E:42:BF:8C","sha256":"FA:C0:2A:2B:BF:94:B6:A8:79:9D:A8:1F:2B:56:A4:FD:99:88:7D:5D:73:22:C1:58:05:8C:FF:F9:1F:42:2B:13"}}},"request":{"raw":"GET /clients/js/clientlibHeader.min.d60873be6e7b5a14dedf919ffe2b8041.js HTTP/1.1\r\nHost: chnsaulins.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://chnsaulins.duckdns.org/clients/index.php\r\nCookie: PHPSESSID=984kvauo734qp252tmms73gd9d\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Wed, 16 Jul 2025 09:28:48 GMT\r\netag: \"3b47-63a088521d400-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-length: 5566\r\ncontent-type: text/javascript\r\ndate: Fri, 03 Apr 2026 20:17:51 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":15175,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (15168), with no line terminators","md5":"3c19921d0000df2adf44d326be083b11","sha1":"e390e1115ecc9848ae5471e48cf0ae556a91829f","sha256":"4c1a340856aa33c5f1da0c0057aee87f1f8a66c7c9785d4db9f8aeb32285ade9","sha512":"e734c16b7cddafb7bb230a71bb524511162d5fa3a1dec48a8e009bcfe240ada485a5186866d2b4a8c93f795459969adc61d53374f6d18eee4246c8999233471f","ssdeep":"384:tATw07E5uUJaf1GZFPTSHiEA6F2CJ5ILjnkBwxxCx:tATw55ucU1GbaVoLjkBwqx","tlshash":"7c62e98d718d732183af216626af05296237b9212a444404e45accf62df4e4e63effad","first_seen":"2023-10-18T13:27:44Z","last_seen":"2026-04-03T20:18:19.078918Z","times_seen":10,"resource_available":true,"data":null}},"time_used":82,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":74,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-03","alert":"Phishing Block","trigger":"chnsaulins.duckdns.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Credit Agricole","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Credit Agricole phishing","tags":["phishing","credit_agricole","finacial"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/clients/fonts/Gotham-Bold.woff2","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://chnsaulins.duckdns.org/clients/index.php","date":"2026-04-03T20:17:51.775Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"chnsaulins.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 17:21:24 GMT","end":"Tue, 02 Jun 2026 17:21:23 GMT"},"fingerprint":{"sha1":"BE:2A:CE:5C:5E:8E:D2:93:AA:76:2F:E7:24:5C:DD:1D:5E:42:BF:8C","sha256":"FA:C0:2A:2B:BF:94:B6:A8:79:9D:A8:1F:2B:56:A4:FD:99:88:7D:5D:73:22:C1:58:05:8C:FF:F9:1F:42:2B:13"}}},"request":{"raw":"GET /clients/fonts/Gotham-Bold.woff2 HTTP/1.1\r\nHost: chnsaulins.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://chnsaulins.duckdns.org/clients/css/clientlib-part.min.bf09c4d0412c08be7d1dd5b8db85356f.css\r\nCookie: PHPREFS=full; PHPSESSID=984kvauo734qp252tmms73gd9d\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Wed, 16 Jul 2025 09:28:47 GMT\r\netag: \"9960-63a08851291c0\"\r\naccept-ranges: bytes\r\ncontent-length: 39264\r\nvary: Accept-Encoding\r\ncontent-type: font/woff2\r\ndate: Fri, 03 Apr 2026 20:17:51 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":39264,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 39264, version 3.19726","md5":"003e90cf8cb3f8b4bef30d6764da18ed","sha1":"512e44f40b54d0e5e081dda9fd5ea8a4429a508c","sha256":"319881caca6f5f0d1e8e24040579d93386008e39dee1045965124b86303143e1","sha512":"cfc48f671555841551e36445bb1e5fa3cd0232c853b24da0a7dafe5c251981a6ec4cb29ff4adf3ed612988249d8ba74246859683eb9302f7056bd92c88b85fa0","ssdeep":"768:PV7oXjYFCWB07dZORB0aJ8UqAZp+ZNhoagVgvCqYNvfSVLRo3nd:PBocFxq7f0x8UfZp+ZNCDmxYNvqVFo3d","tlshash":"1b03f12fd482a371c9cfcea5e9759506cb9079d1b02eb8374bd419cd7e25c8e91822b4","first_seen":"2023-04-06T18:48:56Z","last_seen":"2026-08-11T20:15:00.871077Z","times_seen":1116,"resource_available":false,"data":null}},"time_used":38,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":37,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-03","alert":"Phishing Block","trigger":"chnsaulins.duckdns.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Credit Agricole","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Credit Agricole phishing","tags":["phishing","credit_agricole","finacial"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"cdnstat.net/get/script.js?referrer=https://chnsaulins.duckdns.org/clients/index.php","fqdn":"cdnstat.net","domain":"cdnstat.net","tld":"net"},"ip":{"addr":"195.177.94.253","port":443,"asn":7029,"as":"WINDSTREAM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://chnsaulins.duckdns.org/clients/index.php","date":"2026-04-03T20:17:52.672Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnstat.net","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Tue, 03 Mar 2026 18:42:10 GMT","end":"Mon, 01 Jun 2026 18:42:09 GMT"},"fingerprint":{"sha1":"DB:39:9E:49:9A:15:DC:30:E4:94:92:E6:41:D2:9F:70:82:2E:0E:80","sha256":"29:BC:BC:10:4D:7F:8E:3F:81:B6:93:AF:80:BA:44:1B:82:1A:83:EC:C6:4A:AD:B7:16:6C:B1:20:9F:D5:23:3D"}}},"request":{"raw":"GET /get/script.js?referrer=https://chnsaulins.duckdns.org/clients/index.php HTTP/1.1\r\nHost: cdnstat.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://chnsaulins.duckdns.org/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Fri, 03 Apr 2026 20:17:52 GMT\r\nContent-Type: text/javascript; charset=utf-8\r\nContent-Length: 129\r\nConnection: keep-alive\r\nX-Powered-By: PHP/8.2.1\r\nAccess-Control-Allow-Origin: https://chnsaulins.duckdns.org\r\nAccess-Control-Allow-Methods: GET, POST\r\nAccess-Control-Allow-Headers: X-Requested-With,content-type\r\nAccess-Control-Allow-Credentials: true\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"PHP:8.2.1","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":129,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"ASCII text, with no line terminators","md5":"f9cfcf8fa6b061acf946e44688f84187","sha1":"f98c865b09ab852ce2274e5d02f9fd70e6341cb9","sha256":"c59a3960888d96b3748601b9b77df171bafa3d53289ec4b8b6db3d474e9a39e1","sha512":"8490b542abb8f6cc619f018392baf5b55cf01f363e0a3b2edf0cdb1228502d0c40c2b74d4914a644e8d8908455b4b9d9dc8ccd0ce4298e17eddc79bc8aba7058","ssdeep":"","tlshash":"d2b09b154f1d8e75603641eebaf3c3dc593464e5751590065946d4f9549cdd30e81d80","first_seen":"2023-06-10T20:46:14Z","last_seen":"2026-08-07T19:52:14.681208Z","times_seen":848,"resource_available":true,"data":null}},"time_used":359,"timings":{"blocked":110,"dns":1,"connect":49,"send":0,"wait":138,"receive":0,"ssl":58},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-04-03T20:17:50.728Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"chnsaulins.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 17:21:24 GMT","end":"Tue, 02 Jun 2026 17:21:23 GMT"},"fingerprint":{"sha1":"BE:2A:CE:5C:5E:8E:D2:93:AA:76:2F:E7:24:5C:DD:1D:5E:42:BF:8C","sha256":"FA:C0:2A:2B:BF:94:B6:A8:79:9D:A8:1F:2B:56:A4:FD:99:88:7D:5D:73:22:C1:58:05:8C:FF:F9:1F:42:2B:13"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: chnsaulins.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 Found\r\nlocation: clients/index.php\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-length: 248\r\ncontent-type: text/html; charset=UTF-8\r\ndate: Fri, 03 Apr 2026 20:17:50 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":154222,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-16T22:46:45.121255Z","times_seen":17925805,"resource_available":true,"data":null}},"time_used":194,"timings":{"blocked":76,"dns":0,"connect":33,"send":0,"wait":42,"receive":0,"ssl":40},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-03","alert":"Phishing Block","trigger":"chnsaulins.duckdns.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Credit Agricole","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Credit Agricole phishing","tags":["phishing","credit_agricole","finacial"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/clients/css/clientlibStoreLocatorT34Part.min.7ea3f7a5c9fe1b9202898c63b19c6204.css","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://chnsaulins.duckdns.org/clients/index.php","date":"2026-04-03T20:17:51.200Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"chnsaulins.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 17:21:24 GMT","end":"Tue, 02 Jun 2026 17:21:23 GMT"},"fingerprint":{"sha1":"BE:2A:CE:5C:5E:8E:D2:93:AA:76:2F:E7:24:5C:DD:1D:5E:42:BF:8C","sha256":"FA:C0:2A:2B:BF:94:B6:A8:79:9D:A8:1F:2B:56:A4:FD:99:88:7D:5D:73:22:C1:58:05:8C:FF:F9:1F:42:2B:13"}}},"request":{"raw":"GET /clients/css/clientlibStoreLocatorT34Part.min.7ea3f7a5c9fe1b9202898c63b19c6204.css HTTP/1.1\r\nHost: chnsaulins.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://chnsaulins.duckdns.org/clients/index.php\r\nCookie: PHPSESSID=984kvauo734qp252tmms73gd9d\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Wed, 16 Jul 2025 09:28:47 GMT\r\netag: \"54e6-63a08851291c0-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-length: 5005\r\ncontent-type: text/css\r\ndate: Fri, 03 Apr 2026 20:17:51 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":21734,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (1706)","md5":"62fe663b4fa3e9b08ca975cdfbd8fe4c","sha1":"7af2ed45bb599b014914539be0109aefa9e76628","sha256":"214f59bf3836eb7db5a4779814171bd28f3863d36a8864df41f08ad20904c719","sha512":"bc4a16bc09d6cc43d3b4d0b4880618ce805d8cb06189d17256a1a995259e3d84ffdfd48418caf684d79ba55936abe3c90a1b1d4b8147a4924be78e15ba805091","ssdeep":"384:9NxnCjZnCj1leR67SQgL6x2iLQ5DQBDpXgoJYWYGOuT:9NEo5lruQgL6gmHUWYGOuT","tlshash":"5ea2872b5255236bb0239c16f7c666273228d82393662ffda54a3974c7c76e9131338f","first_seen":"2025-08-13T12:19:29.336202Z","last_seen":"2026-04-03T20:18:19.082128Z","times_seen":6,"resource_available":false,"data":null}},"time_used":84,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":83,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-03","alert":"Phishing Block","trigger":"chnsaulins.duckdns.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Credit Agricole","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Credit Agricole phishing","tags":["phishing","credit_agricole","finacial"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/clients/js/clientlib-jquery-additional.min.69a2cd87a90a8bee86d80043790b6e24.js","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://chnsaulins.duckdns.org/clients/index.php","date":"2026-04-03T20:17:51.229Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"chnsaulins.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 17:21:24 GMT","end":"Tue, 02 Jun 2026 17:21:23 GMT"},"fingerprint":{"sha1":"BE:2A:CE:5C:5E:8E:D2:93:AA:76:2F:E7:24:5C:DD:1D:5E:42:BF:8C","sha256":"FA:C0:2A:2B:BF:94:B6:A8:79:9D:A8:1F:2B:56:A4:FD:99:88:7D:5D:73:22:C1:58:05:8C:FF:F9:1F:42:2B:13"}}},"request":{"raw":"GET /clients/js/clientlib-jquery-additional.min.69a2cd87a90a8bee86d80043790b6e24.js HTTP/1.1\r\nHost: chnsaulins.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://chnsaulins.duckdns.org/clients/index.php\r\nCookie: PHPSESSID=984kvauo734qp252tmms73gd9d\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Wed, 16 Jul 2025 09:28:48 GMT\r\netag: \"2860f-63a088521d400-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-length: 44304\r\ncontent-type: text/javascript\r\ndate: Fri, 03 Apr 2026 20:17:51 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":165391,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (567)","md5":"69a2cd87a90a8bee86d80043790b6e24","sha1":"287c11c8a2c63736a24ce7cc56780efb14985f32","sha256":"8720c2af88865b055295da09d2f6142d18fd56806633bc63568491e23cfe21c9","sha512":"df56ba0d7373f6e0a9116fcd3b20c65e9b2344e83955be318fa4d8071e31549154e8121823f5b4ac2391519acc2e10e6764b17a76fe57a3aba1bee46d2bc3751","ssdeep":"1536:FFsrBkgN5U0NiqTMs9vFCEZOVvDDDYKeQW1jM0hmEmfmStfMOfKhCYhZnFmsX/im:srB7PiqFFCEZ6MOPefJG5vdo","tlshash":"19f3084a7600746e8aef71f5c09f4f0aa03649534588e474a438ddd52eb1ce662ffeac","first_seen":"2023-10-25T20:10:09Z","last_seen":"2026-04-03T20:18:19.082957Z","times_seen":34,"resource_available":true,"data":null}},"time_used":166,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":158,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-03","alert":"Phishing Block","trigger":"chnsaulins.duckdns.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Credit Agricole","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Credit Agricole phishing","tags":["phishing","credit_agricole","finacial"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/clients/js/clientlib-megaMenu.min.ba7895b05be615c5c578c345e0696317.js","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://chnsaulins.duckdns.org/clients/index.php","date":"2026-04-03T20:17:51.231Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"chnsaulins.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 17:21:24 GMT","end":"Tue, 02 Jun 2026 17:21:23 GMT"},"fingerprint":{"sha1":"BE:2A:CE:5C:5E:8E:D2:93:AA:76:2F:E7:24:5C:DD:1D:5E:42:BF:8C","sha256":"FA:C0:2A:2B:BF:94:B6:A8:79:9D:A8:1F:2B:56:A4:FD:99:88:7D:5D:73:22:C1:58:05:8C:FF:F9:1F:42:2B:13"}}},"request":{"raw":"GET /clients/js/clientlib-megaMenu.min.ba7895b05be615c5c578c345e0696317.js HTTP/1.1\r\nHost: chnsaulins.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://chnsaulins.duckdns.org/clients/index.php\r\nCookie: PHPSESSID=984kvauo734qp252tmms73gd9d\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Wed, 16 Jul 2025 09:28:48 GMT\r\netag: \"470d-63a088521d400-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-length: 4452\r\ncontent-type: text/javascript\r\ndate: Fri, 03 Apr 2026 20:17:51 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":18189,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (18189), with no line terminators","md5":"1786d8e1801e52a28f9cc84d9ebca6da","sha1":"6effbcae9fcd5a66e4068b5933cc1212ef30e569","sha256":"698b29596567c629e0de6b0baeae9f03d9e47413a3f34132763c6f2bf3ef1b46","sha512":"e5fb19220219c341876ed67a75c9ebddb2d63858e112c7fa0f2f0d33a2fc410428ad98eb4c9cf567aea5faba5d67ff53532eb1f5fb2ddf7ad4fd94c0251e3e56","ssdeep":"384:1TWGrt1cu+w3o76idE58t0Oe3hYahYTLhgWbzpN74KXjyNyrypy/RyXWmyFSy5dG:1TWGrt1cu347K58tHe3hYahYvhgWv74b","tlshash":"0d82856530d4613552de62d59a061828a333501ce90fa82c7cacddfb2c78c8637babfd","first_seen":"2023-12-18T03:32:46Z","last_seen":"2026-04-03T20:18:19.08378Z","times_seen":9,"resource_available":true,"data":null}},"time_used":59,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":59,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-03","alert":"Phishing Block","trigger":"chnsaulins.duckdns.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Credit Agricole","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Credit Agricole phishing","tags":["phishing","credit_agricole","finacial"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/clients/images/NPC-logo_Agir_chaque_jour_CA_H_Desktop-1.svg","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://chnsaulins.duckdns.org/clients/index.php","date":"2026-04-03T20:17:52.074Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"chnsaulins.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 17:21:24 GMT","end":"Tue, 02 Jun 2026 17:21:23 GMT"},"fingerprint":{"sha1":"BE:2A:CE:5C:5E:8E:D2:93:AA:76:2F:E7:24:5C:DD:1D:5E:42:BF:8C","sha256":"FA:C0:2A:2B:BF:94:B6:A8:79:9D:A8:1F:2B:56:A4:FD:99:88:7D:5D:73:22:C1:58:05:8C:FF:F9:1F:42:2B:13"}}},"request":{"raw":"GET /clients/images/NPC-logo_Agir_chaque_jour_CA_H_Desktop-1.svg HTTP/1.1\r\nHost: chnsaulins.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/xml, text/xml, */*; q=0.01\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://chnsaulins.duckdns.org/clients/index.php\r\nCookie: PHPREFS=full; PHPSESSID=984kvauo734qp252tmms73gd9d\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Wed, 16 Jul 2025 09:28:48 GMT\r\netag: \"5714-63a088521d400-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-length: 6242\r\ncontent-type: image/svg+xml\r\ndate: Fri, 03 Apr 2026 20:17:52 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":22292,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"4afe8351310049851b41d3c5d055a9a9","sha1":"5609ba854c319ec2a4a433bcb7315b8171a67e7e","sha256":"eb1dedf64e9e60c0e67a595382e622c7fa7d6c8a705091ed5c78ebe16fd48c5d","sha512":"78d45d7357ff0005a5730c056c55331f06eacea6934953109e93018b57f74f4642816de3b5d50e0f66e4e60f678f4a24eb465601475f2c98d6821272cdda3a4c","ssdeep":"384:+++JkLZX6YztBYZcXTKYA3PSEazRRe5GnQaLeNsXTJ:j+mdSBcRC0QEOsXTJ","tlshash":"65a2f0570308ebfaada5065cdb29249175da9c9bd074f1c0babf1806d05ccd4e89cbee","first_seen":"2023-09-30T14:11:50Z","last_seen":"2026-07-27T00:25:30.838802Z","times_seen":30,"resource_available":false,"data":null}},"time_used":49,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":49,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-03","alert":"Phishing Block","trigger":"chnsaulins.duckdns.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Credit Agricole","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Credit Agricole phishing","tags":["phishing","credit_agricole","finacial"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/clients/images/CA_Logo_seul-1.svg","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://chnsaulins.duckdns.org/clients/index.php","date":"2026-04-03T20:17:52.078Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"chnsaulins.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 17:21:24 GMT","end":"Tue, 02 Jun 2026 17:21:23 GMT"},"fingerprint":{"sha1":"BE:2A:CE:5C:5E:8E:D2:93:AA:76:2F:E7:24:5C:DD:1D:5E:42:BF:8C","sha256":"FA:C0:2A:2B:BF:94:B6:A8:79:9D:A8:1F:2B:56:A4:FD:99:88:7D:5D:73:22:C1:58:05:8C:FF:F9:1F:42:2B:13"}}},"request":{"raw":"GET /clients/images/CA_Logo_seul-1.svg HTTP/1.1\r\nHost: chnsaulins.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/xml, text/xml, */*; q=0.01\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://chnsaulins.duckdns.org/clients/index.php\r\nCookie: PHPREFS=full; PHPSESSID=984kvauo734qp252tmms73gd9d\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Wed, 16 Jul 2025 09:28:48 GMT\r\netag: \"3edf-63a088521d400-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-length: 4726\r\ncontent-type: image/svg+xml\r\ndate: Fri, 03 Apr 2026 20:17:52 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":16095,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"5429a16eae896b66f847006e87353fd1","sha1":"15d5e9d659c036f6174c991a39957de5091e49b4","sha256":"abbc6793e25015a9238e795ea4ddec56e306fb23e2b813d7f0fce7cac5ba5805","sha512":"d9eac9425e6b45fdaa8f9ae2d8b68a49149d788a757e0cee3e11d18fc65af096eba87a5c9dbba0d3fb5645cc7412a684b5a28779b807ad474a19e48bc51e818f","ssdeep":"384:+aiWG5fcJDSNcvJ8yeQtu5+MtBLcB1nna/WjrJpaCu5twQ3wOJ+:dit0JKA8tQ/MzShnaSzaR5twQvJ+","tlshash":"f0720142c26597b69c83432ec2a42c9938d69cfbb470f3b868af1547d55ccd4829c6fb","first_seen":"2023-09-30T14:11:50Z","last_seen":"2026-07-27T00:25:30.84557Z","times_seen":41,"resource_available":false,"data":null}},"time_used":54,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":54,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-03","alert":"Phishing Block","trigger":"chnsaulins.duckdns.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Credit Agricole","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Credit Agricole phishing","tags":["phishing","credit_agricole","finacial"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/clients/css/clientlibStoreLocatorAccesCRPart.min.ddd3469fd6c3f8f331e0d3b3d56134c3.css","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://chnsaulins.duckdns.org/clients/index.php","date":"2026-04-03T20:17:51.208Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"chnsaulins.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 17:21:24 GMT","end":"Tue, 02 Jun 2026 17:21:23 GMT"},"fingerprint":{"sha1":"BE:2A:CE:5C:5E:8E:D2:93:AA:76:2F:E7:24:5C:DD:1D:5E:42:BF:8C","sha256":"FA:C0:2A:2B:BF:94:B6:A8:79:9D:A8:1F:2B:56:A4:FD:99:88:7D:5D:73:22:C1:58:05:8C:FF:F9:1F:42:2B:13"}}},"request":{"raw":"GET /clients/css/clientlibStoreLocatorAccesCRPart.min.ddd3469fd6c3f8f331e0d3b3d56134c3.css HTTP/1.1\r\nHost: chnsaulins.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://chnsaulins.duckdns.org/clients/index.php\r\nCookie: PHPSESSID=984kvauo734qp252tmms73gd9d\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Wed, 16 Jul 2025 09:28:47 GMT\r\netag: \"2fad-63a08851291c0-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-length: 3313\r\ncontent-type: text/css\r\ndate: Fri, 03 Apr 2026 20:17:51 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":12205,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (1706)","md5":"ddd3469fd6c3f8f331e0d3b3d56134c3","sha1":"31b1197a10cb180c43e06f0aaf3f0e3e0000338d","sha256":"90e31a25b6f4ca04108ac1524e62193688d25bb6fa277e48f1ad31179760534b","sha512":"4a8a08758d8e5b7f8a62fcaba0e94a7405a64d5f37b19488fa778a9f784d2c34f6e4b323d4687b4dc2fbfce3826f3c1977ac47e05d4da42e503ef1ab25ee50bc","ssdeep":"192:LNxnCjZnCjrZleRuT7GrAoRQgL6J+aWziLQ5zHtHDx3tnYA71YMHzQW:LNxnCjZnCj1leR67SQgL6x2iLQ5D9j","tlshash":"4742a56b0181772c70378d15abd67521232cc473e75b2af9a9853e64c3c7aa8132b2cb","first_seen":"2023-04-06T08:14:41Z","last_seen":"2026-06-30T07:10:04.629307Z","times_seen":438,"resource_available":false,"data":null}},"time_used":54,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":54,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-03","alert":"Phishing Block","trigger":"chnsaulins.duckdns.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Credit Agricole","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Credit Agricole phishing","tags":["phishing","credit_agricole","finacial"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/clients/js/utils.min.423ec59365a85ebded314ad7311ef508.js","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://chnsaulins.duckdns.org/clients/index.php","date":"2026-04-03T20:17:51.212Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"chnsaulins.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 17:21:24 GMT","end":"Tue, 02 Jun 2026 17:21:23 GMT"},"fingerprint":{"sha1":"BE:2A:CE:5C:5E:8E:D2:93:AA:76:2F:E7:24:5C:DD:1D:5E:42:BF:8C","sha256":"FA:C0:2A:2B:BF:94:B6:A8:79:9D:A8:1F:2B:56:A4:FD:99:88:7D:5D:73:22:C1:58:05:8C:FF:F9:1F:42:2B:13"}}},"request":{"raw":"GET /clients/js/utils.min.423ec59365a85ebded314ad7311ef508.js HTTP/1.1\r\nHost: chnsaulins.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://chnsaulins.duckdns.org/clients/index.php\r\nCookie: PHPSESSID=984kvauo734qp252tmms73gd9d\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Wed, 16 Jul 2025 09:28:48 GMT\r\netag: \"218d-63a088521d400-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-length: 3330\r\ncontent-type: text/javascript\r\ndate: Fri, 03 Apr 2026 20:17:51 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":8589,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (8589), with no line terminators","md5":"53e8e1fd7da77d9aeacd0094c941028b","sha1":"ceb9ba151b81fa79ac41efd14b26d2dc60737e38","sha256":"d55cb87000c5153ed2e3e5da605a94fa289c18a4002253b78bf544d94f16e16a","sha512":"b862deb79053a52a85932ec11f65bd861667185c4b4f0d06b29c221dc790f32a65c62770c3d92822471e5fa2d5b726447afc29a770a2734e2d7eb0a6d9792e3d","ssdeep":"192:TrUgRgprT1pNxIr2pTuD9RVONVYE/0rP5Gapf6hpP0APlErPBWre:TrerhruriuhRViX/0rPAjPKrPBWre","tlshash":"490208c631c6b4a703d7626116af690ab07795d8a50dd030d46acae0bcb1f9f8463ff9","first_seen":"2023-10-18T13:27:44Z","last_seen":"2026-04-03T20:18:19.086048Z","times_seen":10,"resource_available":true,"data":null}},"time_used":52,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":52,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-03","alert":"Phishing Block","trigger":"chnsaulins.duckdns.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Credit Agricole","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Credit Agricole phishing","tags":["phishing","credit_agricole","finacial"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/clients/js/granite.min.579a107dd681c49bc61dae63734043cb.js","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://chnsaulins.duckdns.org/clients/index.php","date":"2026-04-03T20:17:51.213Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"chnsaulins.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 17:21:24 GMT","end":"Tue, 02 Jun 2026 17:21:23 GMT"},"fingerprint":{"sha1":"BE:2A:CE:5C:5E:8E:D2:93:AA:76:2F:E7:24:5C:DD:1D:5E:42:BF:8C","sha256":"FA:C0:2A:2B:BF:94:B6:A8:79:9D:A8:1F:2B:56:A4:FD:99:88:7D:5D:73:22:C1:58:05:8C:FF:F9:1F:42:2B:13"}}},"request":{"raw":"GET /clients/js/granite.min.579a107dd681c49bc61dae63734043cb.js HTTP/1.1\r\nHost: chnsaulins.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://chnsaulins.duckdns.org/clients/index.php\r\nCookie: PHPSESSID=984kvauo734qp252tmms73gd9d\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Wed, 16 Jul 2025 09:28:48 GMT\r\netag: \"fb9-63a088521d400-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-length: 1687\r\ncontent-type: text/javascript\r\ndate: Fri, 03 Apr 2026 20:17:51 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":4025,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (4025), with no line terminators","md5":"a25d5d8b01ddf23d6ed921e4b1336e7f","sha1":"cdb5d21fa964a36fae1b75bdbe988cb701642b1f","sha256":"25c41097b1b835706b8dc4993b76eb9b418fd5cc3dad3a89f33cd7a1fed99373","sha512":"13cd9068d311decff4d087ad6d406dd18578248715accb8dcac1449816b4b61367f71a771342645af5ebb276ee5e3947cbd167b5061c4b270891b9b71545b112","ssdeep":"","tlshash":"478172437d8430735be37078d8bf52069237942c7886c671b844daea2c7ed5e5227b6c","first_seen":"2023-12-18T03:32:46Z","last_seen":"2026-04-03T20:18:19.086892Z","times_seen":9,"resource_available":true,"data":null}},"time_used":51,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":51,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-03","alert":"Phishing Block","trigger":"chnsaulins.duckdns.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Credit Agricole","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Credit Agricole phishing","tags":["phishing","credit_agricole","finacial"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/clients/js/clientlibBoutonVertGeneralVitrine.min.003e4b1e4ae2a14a0a1c74025d0dc5b0.js","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://chnsaulins.duckdns.org/clients/index.php","date":"2026-04-03T20:17:51.238Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"chnsaulins.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 17:21:24 GMT","end":"Tue, 02 Jun 2026 17:21:23 GMT"},"fingerprint":{"sha1":"BE:2A:CE:5C:5E:8E:D2:93:AA:76:2F:E7:24:5C:DD:1D:5E:42:BF:8C","sha256":"FA:C0:2A:2B:BF:94:B6:A8:79:9D:A8:1F:2B:56:A4:FD:99:88:7D:5D:73:22:C1:58:05:8C:FF:F9:1F:42:2B:13"}}},"request":{"raw":"GET /clients/js/clientlibBoutonVertGeneralVitrine.min.003e4b1e4ae2a14a0a1c74025d0dc5b0.js HTTP/1.1\r\nHost: chnsaulins.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://chnsaulins.duckdns.org/clients/index.php\r\nCookie: PHPSESSID=984kvauo734qp252tmms73gd9d\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Wed, 16 Jul 2025 09:28:48 GMT\r\netag: \"28e79-63a088521d400-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-length: 40587\r\ncontent-type: text/javascript\r\ndate: Fri, 03 Apr 2026 20:17:51 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":167545,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65499), with no line terminators","md5":"e82e00fa028bb4ce8384e2552c310c60","sha1":"21481c48e3b768f60317d82731170e4f8c7e385f","sha256":"c2fa6f61473e9b618ea4aa73cc6e8100d8e87a16e16f6f0d85cdf43665cc5259","sha512":"6d9497c822128d67db909bb2305318db731862ebd00255682542ded2ffe429eb7d3a48fd615bf0ccf7223d073c55cfa264d6d78e28c8cd0ef24fb895f8a40bb7","ssdeep":"1536:oBEQ4WuN8j77dSeMtLGkUBaf2ehq+LxNvvX5npA97AVIjVCcPldl5tda1pe+gnyQ:c4WljvdSeMtL5hqMz5npA97Cc50lhmp","tlshash":"cdf3ea8cfaa1a0b565d623e068cf020e61f3966ac81c7c91377d94d11dbce4c7976b3a","first_seen":"2023-12-18T03:32:46Z","last_seen":"2026-04-03T20:18:19.087549Z","times_seen":9,"resource_available":true,"data":null}},"time_used":122,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":120,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-03","alert":"Phishing Block","trigger":"chnsaulins.duckdns.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Credit Agricole","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Credit Agricole phishing","tags":["phishing","credit_agricole","finacial"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/clients/js/tc_PortailClientCreditAgricole_4.js","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://chnsaulins.duckdns.org/clients/index.php","date":"2026-04-03T20:17:51.247Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"chnsaulins.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 17:21:24 GMT","end":"Tue, 02 Jun 2026 17:21:23 GMT"},"fingerprint":{"sha1":"BE:2A:CE:5C:5E:8E:D2:93:AA:76:2F:E7:24:5C:DD:1D:5E:42:BF:8C","sha256":"FA:C0:2A:2B:BF:94:B6:A8:79:9D:A8:1F:2B:56:A4:FD:99:88:7D:5D:73:22:C1:58:05:8C:FF:F9:1F:42:2B:13"}}},"request":{"raw":"GET /clients/js/tc_PortailClientCreditAgricole_4.js HTTP/1.1\r\nHost: chnsaulins.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://chnsaulins.duckdns.org/clients/index.php\r\nCookie: PHPSESSID=984kvauo734qp252tmms73gd9d\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Wed, 16 Jul 2025 09:28:48 GMT\r\netag: \"1403e-63a088521d400-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-length: 20774\r\ncontent-type: text/javascript\r\ndate: Fri, 03 Apr 2026 20:17:51 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":81982,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65526), with no line terminators","md5":"1066d8e441bc0d6f67f9f20d9a028f32","sha1":"63fb74078ad83d79773d5d87e947ffc56ca77d96","sha256":"638be48729432b387101dc8d0ff41662f5776dfbfbf7da750e3f9195036c7ea4","sha512":"60a9599add42c1c67f5787d4b58c22ad642916ddb057b0dfa7855d4b0bdf02564611c0353a3a7e3032ce61b4c2d0b742793f25b7873895c6715a832ccaa800ce","ssdeep":"1536:II2a0BLU41j8h7jQTHGcBVPXdCXc4avXSAI4av4ah4t4m4Bg:F2RBFJRdXXF","tlshash":"2b83947f31739c791aa2f3784f2e4f8576b5e017988acc64840ed6db19e5842818e3bd","first_seen":"2023-12-18T03:32:46Z","last_seen":"2026-04-03T20:18:19.088544Z","times_seen":9,"resource_available":true,"data":null}},"time_used":82,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":81,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-03","alert":"Phishing Block","trigger":"chnsaulins.duckdns.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Credit Agricole","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Credit Agricole phishing","tags":["phishing","credit_agricole","finacial"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/clients/fonts/Gotham-Book.woff2","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://chnsaulins.duckdns.org/clients/index.php","date":"2026-04-03T20:17:51.773Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"chnsaulins.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 17:21:24 GMT","end":"Tue, 02 Jun 2026 17:21:23 GMT"},"fingerprint":{"sha1":"BE:2A:CE:5C:5E:8E:D2:93:AA:76:2F:E7:24:5C:DD:1D:5E:42:BF:8C","sha256":"FA:C0:2A:2B:BF:94:B6:A8:79:9D:A8:1F:2B:56:A4:FD:99:88:7D:5D:73:22:C1:58:05:8C:FF:F9:1F:42:2B:13"}}},"request":{"raw":"GET /clients/fonts/Gotham-Book.woff2 HTTP/1.1\r\nHost: chnsaulins.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://chnsaulins.duckdns.org/clients/css/clientlib-part.min.bf09c4d0412c08be7d1dd5b8db85356f.css\r\nCookie: PHPREFS=full; PHPSESSID=984kvauo734qp252tmms73gd9d\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Wed, 16 Jul 2025 09:28:47 GMT\r\netag: \"a300-63a08851291c0\"\r\naccept-ranges: bytes\r\ncontent-length: 41728\r\nvary: Accept-Encoding\r\ncontent-type: font/woff2\r\ndate: Fri, 03 Apr 2026 20:17:51 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":41728,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 41728, version 3.19726","md5":"d838b98f75e3cb9574f9b8b796eb1e8f","sha1":"fcdf131af872ce9ecda9a437cdf67d23c5940d97","sha256":"3f51250e2d3ef478f59bc89cb67681b5ed423f8f8dc22062fb49e101e5032a2e","sha512":"b9a5cb0b79a3cc3d36cb024499b50fbc9832052108bf68952939cb752c7419a5db73d9dc57642d4a01c5c3b576e8c9f2e4010674208ec577ab809f9ee371a5dc","ssdeep":"768:Xa5GO9xigWhvCgoEhnnTNsLRd/ToK+gIDJJaRYq4vWmTet+C:XxOKVaQhnRW3oK+gIlJaRYqSWmPC","tlshash":"a813f1220c6cef5d9a4d22a9b7597ac6d55f7e3d08aac1c122e2a09f913307bd00b57d","first_seen":"2023-04-06T18:48:56Z","last_seen":"2026-08-11T20:15:00.838163Z","times_seen":1067,"resource_available":false,"data":null}},"time_used":37,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":34,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-03","alert":"Phishing Block","trigger":"chnsaulins.duckdns.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Credit Agricole","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Credit Agricole phishing","tags":["phishing","credit_agricole","finacial"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/clients/fonts/Gotham-Medium.woff2","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://chnsaulins.duckdns.org/clients/index.php","date":"2026-04-03T20:17:51.781Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"chnsaulins.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 17:21:24 GMT","end":"Tue, 02 Jun 2026 17:21:23 GMT"},"fingerprint":{"sha1":"BE:2A:CE:5C:5E:8E:D2:93:AA:76:2F:E7:24:5C:DD:1D:5E:42:BF:8C","sha256":"FA:C0:2A:2B:BF:94:B6:A8:79:9D:A8:1F:2B:56:A4:FD:99:88:7D:5D:73:22:C1:58:05:8C:FF:F9:1F:42:2B:13"}}},"request":{"raw":"GET /clients/fonts/Gotham-Medium.woff2 HTTP/1.1\r\nHost: chnsaulins.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://chnsaulins.duckdns.org/clients/css/clientlib-part.min.bf09c4d0412c08be7d1dd5b8db85356f.css\r\nCookie: PHPREFS=full; PHPSESSID=984kvauo734qp252tmms73gd9d\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Wed, 16 Jul 2025 09:28:47 GMT\r\netag: \"a210-63a08851291c0\"\r\naccept-ranges: bytes\r\ncontent-length: 41488\r\nvary: Accept-Encoding\r\ncontent-type: font/woff2\r\ndate: Fri, 03 Apr 2026 20:17:51 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":41488,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 41488, version 3.19726","md5":"68ce85d44fef05344ea74f94f3e6b472","sha1":"3a380914e04ef35820bbe619e1f902d4b250a997","sha256":"ba17f8257b1f710aa0e7136f4bd4b91a9a7db4f9cac2c409caf8708a64787303","sha512":"ff213babdf48ac24b85053181efd7fe5013b8af7dd9c7d8ad8475082db563f41782bc917961d46b782094fe01eaa3b5799bd340ae1a601fd609df19b6ae1f60f","ssdeep":"768:GDuHbmD3ZxCJt8vX6+vWwXVBUFSKQ05L1c34rIZTvxZRDM9d2Vn7Egwb0oP:GoarZxCJto6qXVCFS+RrIxvxZRY9d2W9","tlshash":"2f13f1ae59638030ad6f9c1f47b574ad0345e862df5cfc65bf4208a369f450617b0d9c","first_seen":"2023-04-06T18:48:56Z","last_seen":"2026-08-11T20:15:00.837448Z","times_seen":1001,"resource_available":false,"data":null}},"time_used":35,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":34,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-03","alert":"Phishing Block","trigger":"chnsaulins.duckdns.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Credit Agricole","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Credit Agricole phishing","tags":["phishing","credit_agricole","finacial"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/clients/fonts/npcicons-crunchy-r2303.woff2","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://chnsaulins.duckdns.org/clients/index.php","date":"2026-04-03T20:17:51.786Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"chnsaulins.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 17:21:24 GMT","end":"Tue, 02 Jun 2026 17:21:23 GMT"},"fingerprint":{"sha1":"BE:2A:CE:5C:5E:8E:D2:93:AA:76:2F:E7:24:5C:DD:1D:5E:42:BF:8C","sha256":"FA:C0:2A:2B:BF:94:B6:A8:79:9D:A8:1F:2B:56:A4:FD:99:88:7D:5D:73:22:C1:58:05:8C:FF:F9:1F:42:2B:13"}}},"request":{"raw":"GET /clients/fonts/npcicons-crunchy-r2303.woff2 HTTP/1.1\r\nHost: chnsaulins.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://chnsaulins.duckdns.org/clients/css/clientlib-part.min.bf09c4d0412c08be7d1dd5b8db85356f.css\r\nCookie: PHPREFS=full; PHPSESSID=984kvauo734qp252tmms73gd9d\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Wed, 16 Jul 2025 09:28:47 GMT\r\netag: \"86e4-63a08851291c0\"\r\naccept-ranges: bytes\r\ncontent-length: 34532\r\nvary: Accept-Encoding\r\ncontent-type: font/woff2\r\ndate: Fri, 03 Apr 2026 20:17:51 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":34532,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 34532, version 1.0","md5":"d54a2ccf7f8726e6631cccd8761284c5","sha1":"72ed5897c9f86a6b4c0a5850f70038983c5309b8","sha256":"33638f17581a03a3fa7ec1d929d2f0ac175c9154c27cc05b93babb24a8554c00","sha512":"e79325e89346e8dbdc20d45fa72d6344886df01586473d4c6c6515a4d429e81152a68fb6ff94595fa2bed41f6e119b29184f783f29e6fbcb00e235a7fee278e1","ssdeep":"768:EtXvMbjtXDzhHC0pdJufLKkCn5LF4Svmar8MDRkyCkC3kTeUv:ERGXDzYIdJufj+LF42nkyCkBTeUv","tlshash":"d6f2f15baec37b03bae05e7f463271fc5c5a4ad42f060a3ae57264b8c45416ece1c476","first_seen":"2023-10-25T20:10:10Z","last_seen":"2026-04-03T20:18:19.090576Z","times_seen":14,"resource_available":false,"data":null}},"time_used":35,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":34,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-03","alert":"Phishing Block","trigger":"chnsaulins.duckdns.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Credit Agricole","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Credit Agricole phishing","tags":["phishing","credit_agricole","finacial"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/clients/css/clientlibBoutonVertPart.min.d41d8cd98f00b204e9800998ecf8427e.css","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://chnsaulins.duckdns.org/clients/index.php","date":"2026-04-03T20:17:51.203Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"chnsaulins.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 17:21:24 GMT","end":"Tue, 02 Jun 2026 17:21:23 GMT"},"fingerprint":{"sha1":"BE:2A:CE:5C:5E:8E:D2:93:AA:76:2F:E7:24:5C:DD:1D:5E:42:BF:8C","sha256":"FA:C0:2A:2B:BF:94:B6:A8:79:9D:A8:1F:2B:56:A4:FD:99:88:7D:5D:73:22:C1:58:05:8C:FF:F9:1F:42:2B:13"}}},"request":{"raw":"GET /clients/css/clientlibBoutonVertPart.min.d41d8cd98f00b204e9800998ecf8427e.css HTTP/1.1\r\nHost: chnsaulins.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://chnsaulins.duckdns.org/clients/index.php\r\nCookie: PHPSESSID=984kvauo734qp252tmms73gd9d\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Wed, 16 Jul 2025 09:28:47 GMT\r\netag: \"0-63a08851291c0\"\r\naccept-ranges: bytes\r\ncontent-length: 0\r\ncontent-type: text/css\r\ndate: Fri, 03 Apr 2026 20:17:51 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/css","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-16T22:46:45.121255Z","times_seen":17925805,"resource_available":true,"data":null}},"time_used":49,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":48,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-03","alert":"Phishing Block","trigger":"chnsaulins.duckdns.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Credit Agricole","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Credit Agricole phishing","tags":["phishing","credit_agricole","finacial"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/clients/js/jquery.min.3fa47a8976d292401e5e89639c528426.js","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://chnsaulins.duckdns.org/clients/index.php","date":"2026-04-03T20:17:51.209Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"chnsaulins.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 17:21:24 GMT","end":"Tue, 02 Jun 2026 17:21:23 GMT"},"fingerprint":{"sha1":"BE:2A:CE:5C:5E:8E:D2:93:AA:76:2F:E7:24:5C:DD:1D:5E:42:BF:8C","sha256":"FA:C0:2A:2B:BF:94:B6:A8:79:9D:A8:1F:2B:56:A4:FD:99:88:7D:5D:73:22:C1:58:05:8C:FF:F9:1F:42:2B:13"}}},"request":{"raw":"GET /clients/js/jquery.min.3fa47a8976d292401e5e89639c528426.js HTTP/1.1\r\nHost: chnsaulins.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://chnsaulins.duckdns.org/clients/index.php\r\nCookie: PHPSESSID=984kvauo734qp252tmms73gd9d\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Wed, 16 Jul 2025 09:28:48 GMT\r\netag: \"250a2-63a088521d400-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-length: 43408\r\ncontent-type: text/javascript\r\ndate: Fri, 03 Apr 2026 20:17:51 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":151714,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (585)","md5":"3fa47a8976d292401e5e89639c528426","sha1":"a98bcad2397e229e72874a80168f5ad75762b253","sha256":"8177840b502e6908014c6955695127284c51f7223c7c5af90a08140c10e1f26f","sha512":"2f326d10b92974542b7c5c2004932c72e79c683f61ed956f6bfb77bf79b572944add2d21772c58704fc6fa870d6921f318ef0fac2d9e685b04b68f7215099c8d","ssdeep":"3072:4iGBhDQvkuvd+89enli3o65ayUA3f+4Ude6em3Y6Cqaq7:4hhryUA3n6em3Yjq7","tlshash":"7de3faedba45207e93f731bbb47f4b1e753a966748188081e16898b83cb4d0450abf7d","first_seen":"2023-07-01T05:24:00Z","last_seen":"2026-06-30T07:10:04.656041Z","times_seen":437,"resource_available":true,"data":null}},"time_used":192,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":190,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-03","alert":"Phishing Block","trigger":"chnsaulins.duckdns.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Credit Agricole","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Credit Agricole phishing","tags":["phishing","credit_agricole","finacial"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/clients/js/clientlib-bootstrap-jquery.min.1661914e05c676ce450674555cc1e5b0.js","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://chnsaulins.duckdns.org/clients/index.php","date":"2026-04-03T20:17:51.215Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"chnsaulins.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 17:21:24 GMT","end":"Tue, 02 Jun 2026 17:21:23 GMT"},"fingerprint":{"sha1":"BE:2A:CE:5C:5E:8E:D2:93:AA:76:2F:E7:24:5C:DD:1D:5E:42:BF:8C","sha256":"FA:C0:2A:2B:BF:94:B6:A8:79:9D:A8:1F:2B:56:A4:FD:99:88:7D:5D:73:22:C1:58:05:8C:FF:F9:1F:42:2B:13"}}},"request":{"raw":"GET /clients/js/clientlib-bootstrap-jquery.min.1661914e05c676ce450674555cc1e5b0.js HTTP/1.1\r\nHost: chnsaulins.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://chnsaulins.duckdns.org/clients/index.php\r\nCookie: PHPSESSID=984kvauo734qp252tmms73gd9d\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Wed, 16 Jul 2025 09:28:48 GMT\r\netag: \"750b4-63a088521d400-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-type: text/javascript\r\ndate: Fri, 03 Apr 2026 20:17:51 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":479412,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (567)","md5":"49ec99bfd653f7e352dff804c4499bd2","sha1":"b998bf0b85dbb9ed1ec83e8447b7d0f5abbe013a","sha256":"8a64392a35282a369a93b17815c2e86a424c500caa0ff1954dfbbe05443b07d0","sha512":"5d1d4ca7b76d3d74f3a8398243db2a235d41ef90c09ee61fc0da6a162da22477b2398c683b2f1c1ab63a223a5b7cac2c5644046da6c7b5f531f0deb0839328fa","ssdeep":"6144:XNL1Hc08cLKRUyDUbb93gjB7iqTCEZ6MOPeRG5vdg67k:XF1T8cLKR3UbF8B7iqGnMOmRr","tlshash":"f2a4189a7601213e47ff71ba906f0b0eb13a9a6644489068f478c9e83db4c4561bff7d","first_seen":"2023-12-18T03:32:46Z","last_seen":"2026-04-03T20:18:19.092203Z","times_seen":9,"resource_available":true,"data":null}},"time_used":186,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":186,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-03","alert":"Phishing Block","trigger":"chnsaulins.duckdns.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Credit Agricole","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Credit Agricole phishing","tags":["phishing","credit_agricole","finacial"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/clients/js/underscore.min.3d06cd4a72d11afe999ddcf4b36b7663.js","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://chnsaulins.duckdns.org/clients/index.php","date":"2026-04-03T20:17:51.236Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"chnsaulins.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 17:21:24 GMT","end":"Tue, 02 Jun 2026 17:21:23 GMT"},"fingerprint":{"sha1":"BE:2A:CE:5C:5E:8E:D2:93:AA:76:2F:E7:24:5C:DD:1D:5E:42:BF:8C","sha256":"FA:C0:2A:2B:BF:94:B6:A8:79:9D:A8:1F:2B:56:A4:FD:99:88:7D:5D:73:22:C1:58:05:8C:FF:F9:1F:42:2B:13"}}},"request":{"raw":"GET /clients/js/underscore.min.3d06cd4a72d11afe999ddcf4b36b7663.js HTTP/1.1\r\nHost: chnsaulins.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://chnsaulins.duckdns.org/clients/index.php\r\nCookie: PHPSESSID=984kvauo734qp252tmms73gd9d\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Wed, 16 Jul 2025 09:28:48 GMT\r\netag: \"373a-63a088521d400-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-length: 4800\r\ncontent-type: text/javascript\r\ndate: Fri, 03 Apr 2026 20:17:51 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":14138,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (14138), with no line terminators","md5":"f24e300fa45339ec9468ba878c72355b","sha1":"a575c3c839f7396b49fbd07c80cbe3e4629bb2a5","sha256":"5b1260bd91752a24e703d93f1e8f58e0a60259cecbc220d056ff730792e23c6c","sha512":"9c058e4f920d9f7b3d1a8624f090a37c1999b0fe7a798ee5b22cd67dca86b6853cf28587a7123df26c79aca098cbf9a8b373c9bee7bb95ffb68dd73cb8000cbe","ssdeep":"192:s1mAgsh+Oqmaxvd/bdIQBbZeH/ZvUQFH+d2gHASTDeBvVMfBOQ+MMo5hoPSLq:s8Ah+BvbdIQ/92g9neB0OQxrXnq","tlshash":"62521dc835d2f0ea83e374b4047f448bf23aae55a8eca924d195e1d93c7890dd427f99","first_seen":"2023-10-18T13:27:44Z","last_seen":"2026-04-03T20:18:19.093044Z","times_seen":10,"resource_available":true,"data":null}},"time_used":73,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":72,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-03","alert":"Phishing Block","trigger":"chnsaulins.duckdns.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Credit Agricole","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Credit Agricole phishing","tags":["phishing","credit_agricole","finacial"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/clients/undefinedjsonp/inbenta.js","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://chnsaulins.duckdns.org/clients/index.php","date":"2026-04-03T20:17:52.046Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"chnsaulins.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 17:21:24 GMT","end":"Tue, 02 Jun 2026 17:21:23 GMT"},"fingerprint":{"sha1":"BE:2A:CE:5C:5E:8E:D2:93:AA:76:2F:E7:24:5C:DD:1D:5E:42:BF:8C","sha256":"FA:C0:2A:2B:BF:94:B6:A8:79:9D:A8:1F:2B:56:A4:FD:99:88:7D:5D:73:22:C1:58:05:8C:FF:F9:1F:42:2B:13"}}},"request":{"raw":"GET /clients/undefinedjsonp/inbenta.js HTTP/1.1\r\nHost: chnsaulins.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://chnsaulins.duckdns.org/clients/index.php\r\nCookie: PHPREFS=full; PHPSESSID=984kvauo734qp252tmms73gd9d\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\ncontent-length: 269\r\ncontent-type: text/html; charset=iso-8859-1\r\ndate: Fri, 03 Apr 2026 20:17:52 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":269,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"cf2a6e637bf9acb54bacd92d0445c1f1","sha1":"e29fbb1c521d486e3a62028314c8ca6eed15c123","sha256":"3529205ad726a7e218c06f08907610e568dca7949b26f4e4ccc16b08ae088a59","sha512":"18700fba56d815fc87648a3c03cf2e806cd7fb800cd336fe7782777a4e24f738ccba860527afdab15f8664130c7351f49cfc560694a4e9a7a739a8733e60ceb3","ssdeep":"","tlshash":"52d02b9e904333960d1224907dc211c223c913fb643981a86d86d847529853dcc8a6d9","first_seen":"2026-03-10T10:15:35.794448Z","last_seen":"2026-04-03T20:18:19.071291Z","times_seen":6,"resource_available":false,"data":null}},"time_used":42,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":42,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-03","alert":"Phishing Block","trigger":"chnsaulins.duckdns.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Credit Agricole","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Credit Agricole phishing","tags":["phishing","credit_agricole","finacial"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/clients/images/CA_Logo_seul-1.svg","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://chnsaulins.duckdns.org/clients/index.php","date":"2026-04-03T20:17:52.077Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"chnsaulins.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 17:21:24 GMT","end":"Tue, 02 Jun 2026 17:21:23 GMT"},"fingerprint":{"sha1":"BE:2A:CE:5C:5E:8E:D2:93:AA:76:2F:E7:24:5C:DD:1D:5E:42:BF:8C","sha256":"FA:C0:2A:2B:BF:94:B6:A8:79:9D:A8:1F:2B:56:A4:FD:99:88:7D:5D:73:22:C1:58:05:8C:FF:F9:1F:42:2B:13"}}},"request":{"raw":"GET /clients/images/CA_Logo_seul-1.svg HTTP/1.1\r\nHost: chnsaulins.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/xml, text/xml, */*; q=0.01\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://chnsaulins.duckdns.org/clients/index.php\r\nCookie: PHPREFS=full; PHPSESSID=984kvauo734qp252tmms73gd9d\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Wed, 16 Jul 2025 09:28:48 GMT\r\netag: \"3edf-63a088521d400-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-length: 4726\r\ncontent-type: image/svg+xml\r\ndate: Fri, 03 Apr 2026 20:17:52 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":16095,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"5429a16eae896b66f847006e87353fd1","sha1":"15d5e9d659c036f6174c991a39957de5091e49b4","sha256":"abbc6793e25015a9238e795ea4ddec56e306fb23e2b813d7f0fce7cac5ba5805","sha512":"d9eac9425e6b45fdaa8f9ae2d8b68a49149d788a757e0cee3e11d18fc65af096eba87a5c9dbba0d3fb5645cc7412a684b5a28779b807ad474a19e48bc51e818f","ssdeep":"384:+aiWG5fcJDSNcvJ8yeQtu5+MtBLcB1nna/WjrJpaCu5twQ3wOJ+:dit0JKA8tQ/MzShnaSzaR5twQvJ+","tlshash":"f0720142c26597b69c83432ec2a42c9938d69cfbb470f3b868af1547d55ccd4829c6fb","first_seen":"2023-09-30T14:11:50Z","last_seen":"2026-07-27T00:25:30.84557Z","times_seen":41,"resource_available":false,"data":null}},"time_used":46,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":46,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-03","alert":"Phishing Block","trigger":"chnsaulins.duckdns.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Credit Agricole","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Credit Agricole phishing","tags":["phishing","credit_agricole","finacial"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/clients/css/clientlibStoreLocatorT33Part.min.27c9ca15efdde5687957d25efe1b8663.css","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://chnsaulins.duckdns.org/clients/index.php","date":"2026-04-03T20:17:51.197Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"chnsaulins.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 17:21:24 GMT","end":"Tue, 02 Jun 2026 17:21:23 GMT"},"fingerprint":{"sha1":"BE:2A:CE:5C:5E:8E:D2:93:AA:76:2F:E7:24:5C:DD:1D:5E:42:BF:8C","sha256":"FA:C0:2A:2B:BF:94:B6:A8:79:9D:A8:1F:2B:56:A4:FD:99:88:7D:5D:73:22:C1:58:05:8C:FF:F9:1F:42:2B:13"}}},"request":{"raw":"GET /clients/css/clientlibStoreLocatorT33Part.min.27c9ca15efdde5687957d25efe1b8663.css HTTP/1.1\r\nHost: chnsaulins.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://chnsaulins.duckdns.org/clients/index.php\r\nCookie: PHPSESSID=984kvauo734qp252tmms73gd9d\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Wed, 16 Jul 2025 09:28:47 GMT\r\netag: \"402d-63a08851291c0-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-length: 4217\r\ncontent-type: text/css\r\ndate: Fri, 03 Apr 2026 20:17:51 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":16429,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (1706)","md5":"7b553535e85b9fd6b4d25f192d6049ab","sha1":"ecd07e997a74093082deed32827fd0d0387c781a","sha256":"b82d6e7bcc6fd5214bc1adfca25e8c4b8abb13ecbdfc2d74bf08e237314ac38d","sha512":"e6a3816b67a5409dcc29d7cf09cb48593ffe003323aff326a100467c9e50bba0ff065ba6c8bb208c253dfb1b6a797d6feb7477a504d5dce86ce70ce0d501615c","ssdeep":"384:VNxnCjZnCj1leR67SQgL6x2iLQ5DZkjLwxvLMVnTaOfQ:VNEo5lruQgL6gz9AVnTaOI","tlshash":"dc72c62b11d1737d70278d27a6d67525333c8422535b2bfea9962aa4c3c72e913273ce","first_seen":"2025-08-13T12:19:29.342374Z","last_seen":"2026-04-03T20:18:19.094066Z","times_seen":6,"resource_available":false,"data":null}},"time_used":85,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":84,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-03","alert":"Phishing Block","trigger":"chnsaulins.duckdns.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Credit Agricole","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Credit Agricole phishing","tags":["phishing","credit_agricole","finacial"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/clients/images/CA_Logo_seul-1.svg","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://chnsaulins.duckdns.org/clients/index.php","date":"2026-04-03T20:17:51.222Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"chnsaulins.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 17:21:24 GMT","end":"Tue, 02 Jun 2026 17:21:23 GMT"},"fingerprint":{"sha1":"BE:2A:CE:5C:5E:8E:D2:93:AA:76:2F:E7:24:5C:DD:1D:5E:42:BF:8C","sha256":"FA:C0:2A:2B:BF:94:B6:A8:79:9D:A8:1F:2B:56:A4:FD:99:88:7D:5D:73:22:C1:58:05:8C:FF:F9:1F:42:2B:13"}}},"request":{"raw":"GET /clients/images/CA_Logo_seul-1.svg HTTP/1.1\r\nHost: chnsaulins.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://chnsaulins.duckdns.org/clients/index.php\r\nCookie: PHPSESSID=984kvauo734qp252tmms73gd9d\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Wed, 16 Jul 2025 09:28:48 GMT\r\netag: \"3edf-63a088521d400-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-length: 4726\r\ncontent-type: image/svg+xml\r\ndate: Fri, 03 Apr 2026 20:17:51 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":16095,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"5429a16eae896b66f847006e87353fd1","sha1":"15d5e9d659c036f6174c991a39957de5091e49b4","sha256":"abbc6793e25015a9238e795ea4ddec56e306fb23e2b813d7f0fce7cac5ba5805","sha512":"d9eac9425e6b45fdaa8f9ae2d8b68a49149d788a757e0cee3e11d18fc65af096eba87a5c9dbba0d3fb5645cc7412a684b5a28779b807ad474a19e48bc51e818f","ssdeep":"384:+aiWG5fcJDSNcvJ8yeQtu5+MtBLcB1nna/WjrJpaCu5twQ3wOJ+:dit0JKA8tQ/MzShnaSzaR5twQvJ+","tlshash":"f0720142c26597b69c83432ec2a42c9938d69cfbb470f3b868af1547d55ccd4829c6fb","first_seen":"2023-09-30T14:11:50Z","last_seen":"2026-07-27T00:25:30.84557Z","times_seen":41,"resource_available":false,"data":null}},"time_used":79,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":79,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-03","alert":"Phishing Block","trigger":"chnsaulins.duckdns.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Credit Agricole","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Credit Agricole phishing","tags":["phishing","credit_agricole","finacial"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/favicon.ico","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://chnsaulins.duckdns.org/clients/index.php","date":"2026-04-03T20:17:51.997Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"chnsaulins.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 17:21:24 GMT","end":"Tue, 02 Jun 2026 17:21:23 GMT"},"fingerprint":{"sha1":"BE:2A:CE:5C:5E:8E:D2:93:AA:76:2F:E7:24:5C:DD:1D:5E:42:BF:8C","sha256":"FA:C0:2A:2B:BF:94:B6:A8:79:9D:A8:1F:2B:56:A4:FD:99:88:7D:5D:73:22:C1:58:05:8C:FF:F9:1F:42:2B:13"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: chnsaulins.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://chnsaulins.duckdns.org/clients/index.php\r\nCookie: PHPSESSID=984kvauo734qp252tmms73gd9d\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\ncontent-length: 269\r\ncontent-type: text/html; charset=iso-8859-1\r\ndate: Fri, 03 Apr 2026 20:17:52 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":269,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"cf2a6e637bf9acb54bacd92d0445c1f1","sha1":"e29fbb1c521d486e3a62028314c8ca6eed15c123","sha256":"3529205ad726a7e218c06f08907610e568dca7949b26f4e4ccc16b08ae088a59","sha512":"18700fba56d815fc87648a3c03cf2e806cd7fb800cd336fe7782777a4e24f738ccba860527afdab15f8664130c7351f49cfc560694a4e9a7a739a8733e60ceb3","ssdeep":"","tlshash":"52d02b9e904333960d1224907dc211c223c913fb643981a86d86d847529853dcc8a6d9","first_seen":"2026-03-10T10:15:35.794448Z","last_seen":"2026-04-03T20:18:19.071291Z","times_seen":6,"resource_available":false,"data":null}},"time_used":42,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":42,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-03","alert":"Phishing Block","trigger":"chnsaulins.duckdns.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Credit Agricole","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Credit Agricole phishing","tags":["phishing","credit_agricole","finacial"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"chnsaulins.duckdns.org/clients/undefined","fqdn":"chnsaulins.duckdns.org","domain":"chnsaulins.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"64.89.160.102","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://chnsaulins.duckdns.org/clients/index.php","date":"2026-04-03T20:17:52.080Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"chnsaulins.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 04 Mar 2026 17:21:24 GMT","end":"Tue, 02 Jun 2026 17:21:23 GMT"},"fingerprint":{"sha1":"BE:2A:CE:5C:5E:8E:D2:93:AA:76:2F:E7:24:5C:DD:1D:5E:42:BF:8C","sha256":"FA:C0:2A:2B:BF:94:B6:A8:79:9D:A8:1F:2B:56:A4:FD:99:88:7D:5D:73:22:C1:58:05:8C:FF:F9:1F:42:2B:13"}}},"request":{"raw":"GET /clients/undefined HTTP/1.1\r\nHost: chnsaulins.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://chnsaulins.duckdns.org/clients/index.php\r\nCookie: PHPREFS=full; PHPSESSID=984kvauo734qp252tmms73gd9d\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\ncontent-length: 269\r\ncontent-type: text/html; charset=iso-8859-1\r\ndate: Fri, 03 Apr 2026 20:17:52 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":269,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"cf2a6e637bf9acb54bacd92d0445c1f1","sha1":"e29fbb1c521d486e3a62028314c8ca6eed15c123","sha256":"3529205ad726a7e218c06f08907610e568dca7949b26f4e4ccc16b08ae088a59","sha512":"18700fba56d815fc87648a3c03cf2e806cd7fb800cd336fe7782777a4e24f738ccba860527afdab15f8664130c7351f49cfc560694a4e9a7a739a8733e60ceb3","ssdeep":"","tlshash":"52d02b9e904333960d1224907dc211c223c913fb643981a86d86d847529853dcc8a6d9","first_seen":"2026-03-10T10:15:35.794448Z","last_seen":"2026-04-03T20:18:19.071291Z","times_seen":6,"resource_available":false,"data":null}},"time_used":53,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":47,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-03","alert":"Phishing Block","trigger":"chnsaulins.duckdns.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-03","alert":"Sinkholed","trigger":"chnsaulins.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Credit Agricole","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Credit Agricole phishing","tags":["phishing","credit_agricole","finacial"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}}]}