{"report_id":"0dfc1f7c-8d29-497e-ac02-53808aa869c4","version":6,"status":"done","tags":["dyndns"],"date":"2025-10-14T16:11:03Z","url":{"schema":"http","addr":"gxrxntifirxsxtlxrri.duckdns.org","fqdn":"gxrxntifirxsxtlxrri.duckdns.org","domain":"gxrxntifirxsxtlxrri.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"78.159.156.48","port":0,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"final":{"url":{"schema":"https","addr":"gxrxntifirxsxtlxrri.duckdns.org/","fqdn":"gxrxntifirxsxtlxrri.duckdns.org","domain":"gxrxntifirxsxtlxrri.duckdns.org","tld":"duckdns.org"},"title":"İnternet Bankacılığı - Garanti"},"submit":{"url":{"schema":"http","addr":"gxrxntifirxsxtlxrri.duckdns.org","fqdn":"gxrxntifirxsxtlxrri.duckdns.org","domain":"gxrxntifirxsxtlxrri.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"78.159.156.48","port":0,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"tags":null,"meta":null,"user":{"user_id":"akbkyowd9geqr98"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-11-18T16:11:03Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":1,"urlquery":2,"analyzer":4}},"detection":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-14T16:10:44Z","timestamp":1760458244,"ip_dst":{"addr":"172.18.0.24","port":44850,"asn":0,"as":"","country":"","country_code":"zz"},"ip_src":{"addr":"78.159.156.48","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"severity":"medium","alert":"ET DROP Spamhaus DROP Listed Traffic Inbound group 10","source":"{\"timestamp\":\"2025-10-14T16:10:44.338933+0000\",\"flow_id\":1677510979141782,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"78.159.156.48\",\"src_port\":443,\"dest_ip\":\"172.18.0.24\",\"dest_port\":44850,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.Evil\",\"ET.DROPIP\"]},\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2400009,\"rev\":4421,\"signature\":\"ET DROP Spamhaus DROP Listed Traffic Inbound group 10\",\"category\":\"Misc Attack\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Any\"],\"attack_target\":[\"Any\"],\"created_at\":[\"2010_12_30\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Minor\"],\"tag\":[\"Dshield\"],\"updated_at\":[\"2025_08_01\"]}},\"flow\":{\"pkts_toserver\":1,\"pkts_toclient\":1,\"bytes_toserver\":74,\"bytes_toclient\":74,\"start\":\"2025-10-14T16:10:44.245910+0000\"}}"}],"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"gxrxntifirxsxtlxrri.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"gxrxntifirxsxtlxrri.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"gxrxntifirxsxtlxrri.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"gxrxntifirxsxtlxrri.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]},"summary":[{"fqdn":"cdn.jsdelivr.net","ip":{"addr":"151.101.129.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"domain_registered":"2012-05-16","domain_rank":1678,"first_seen":"2012-09-30T00:15:09Z","last_seen":"2025-10-12T22:16:17.945241Z","alert_count":0,"request_count":1,"received_data":233692,"sent_data":527,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"gxrxntifirxsxtlxrri.duckdns.org","ip":{"addr":"78.159.156.48","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"domain_registered":"2013-04-12","domain_rank":0,"first_seen":"2025-10-14T03:25:10.056455Z","last_seen":"2025-10-14T03:25:10.056455Z","alert_count":70,"request_count":14,"received_data":211392,"sent_data":8521,"comment":"","tags":null,"fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"PHP:8.3.26","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"cdnjs","description":"cdnjs is a free distributed JS library delivery service.","website":"https://cdnjs.com","common_platform_enumeration":"","icon":"cdnjs.svg","categories":["CDN"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Bootstrap:5.3.0","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"jQuery:3.5.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"jQuery CDN","description":"jQuery CDN is a way to include jQuery in your website without actually downloading and keeping it your website's folder.","website":"https://code.jquery.com/","common_platform_enumeration":"","icon":"jQuery.svg","categories":["CDN"]}]},{"fqdn":"code.jquery.com","ip":{"addr":"151.101.66.137","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"domain_registered":"2005-12-10","domain_rank":4915,"first_seen":"2012-05-21T17:28:02Z","last_seen":"2025-10-12T22:16:17.088796Z","alert_count":0,"request_count":2,"received_data":180134,"sent_data":878,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]}]},{"fqdn":"cdnjs.cloudflare.com","ip":{"addr":"104.17.25.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2009-02-17","domain_rank":1222,"first_seen":"2012-05-23T12:49:49Z","last_seen":"2025-10-12T22:15:22.841346Z","alert_count":0,"request_count":1,"received_data":4814,"sent_data":471,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-14T16:10:44Z","timestamp":1760458244,"ip_dst":{"addr":"172.18.0.24","port":44850,"asn":0,"as":"","country":"","country_code":"zz"},"ip_src":{"addr":"78.159.156.48","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"severity":"medium","alert":"ET DROP Spamhaus DROP Listed Traffic Inbound group 10","source":"{\"timestamp\":\"2025-10-14T16:10:44.338933+0000\",\"flow_id\":1677510979141782,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"78.159.156.48\",\"src_port\":443,\"dest_ip\":\"172.18.0.24\",\"dest_port\":44850,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.Evil\",\"ET.DROPIP\"]},\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2400009,\"rev\":4421,\"signature\":\"ET DROP Spamhaus DROP Listed Traffic Inbound group 10\",\"category\":\"Misc Attack\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Any\"],\"attack_target\":[\"Any\"],\"created_at\":[\"2010_12_30\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Minor\"],\"tag\":[\"Dshield\"],\"updated_at\":[\"2025_08_01\"]}},\"flow\":{\"pkts_toserver\":1,\"pkts_toclient\":1,\"bytes_toserver\":74,\"bytes_toclient\":74,\"start\":\"2025-10-14T16:10:44.245910+0000\"}}"}]}],"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/jquery.mask/0.9.0/jquery.mask.min.js","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.25.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"82505c3840658919ab56dd3c80204919","sha1":"53ac516b948804bf2ee7582c9a2ea6fc93367eaa","sha256":"41193718966d1acdb3072ba605cd4e775270c903bfbbcb4d6abd81f878c23155","sha512":"a0909ae854b6fb33b7122b544a3fb17a210df544ebf808ea94164ee7c38f69d6f645fab0c47a634d4f1c9080bc1789cabe89bb8abbb6b3c270768f99f339b456","ssdeep":"","tlshash":"fd71a665b3c171892333607c466f825731be5e8539fa8565f690d4e29c34e8e01bbe3d","size":3796,"data":"","first_seen":"2023-03-26T05:42:25Z","last_seen":"2026-08-21T19:11:56.862036Z","times_seen":258,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"code.jquery.com/jquery-3.5.1.min.js","fqdn":"code.jquery.com","domain":"jquery.com","tld":"com"},"ip":{"addr":"151.101.66.137","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"dc5e7f18c8d36ac1d3d4753a87c98d0a","sha1":"c8e1c8b386dc5b7a9184c763c88d19a346eb3342","sha256":"f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d","sha512":"6cb4f4426f559c06190df97229c05a436820d21498350ac9f118a5625758435171418a022ed523bae46e668f9f8ea871feab6aff58ad2740b67a30f196d65516","ssdeep":"1536:AjExXUqrnxDjoXEZxkMV4SYSt0zvDD6ip3h8cApwEjOPrBeU6QLiTFbc0QlQvakF:AYh8eip3huuf6IidlrvakdtQ47GK1","tlshash":"a993f9ddb2c6702257a720ba007f510bf236199d6c4d8450f265d8e9bcb8a4e827bf7d","size":89476,"data":"","first_seen":"2023-03-07T01:02:01Z","last_seen":"2026-08-22T23:27:36.310347Z","times_seen":268257,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gxrxntifirxsxtlxrri.duckdns.org/","fqdn":"gxrxntifirxsxtlxrri.duckdns.org","domain":"gxrxntifirxsxtlxrri.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"78.159.156.48","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"introduction_type":"scriptElement","is_inline":true,"md5":"2077154294c25c06b0b5e01ba4252f37","sha1":"9bc96aab69e141ec70c7b91cd63fa1f93d383cca","sha256":"6ab4202a505927d77d4f486337df4a61a0bba845bee44cc2c2d95a4f48787a8b","sha512":"c2c458f770294e11db53bf4b846ee809fe6534c27d7f1ac38bb3aeb4274b8717c63b9032cea8063d7aa852ec61f99b65a5272162747323bf5dc300f8d13c054d","ssdeep":"","tlshash":"b9f026ae28f6304016b3306a99dfd809242395171a0abf203f8c95908f2df7dd18376c","size":478,"data":"","first_seen":"2023-09-03T02:03:13Z","last_seen":"2026-06-01T00:45:05.352219Z","times_seen":153,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gxrxntifirxsxtlxrri.duckdns.org/","fqdn":"gxrxntifirxsxtlxrri.duckdns.org","domain":"gxrxntifirxsxtlxrri.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"78.159.156.48","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"introduction_type":"scriptElement","is_inline":true,"md5":"35b1298b348a00bdadf36a5bced93947","sha1":"ae91bc85cfefdb5fadb987e845876e6b9c764a91","sha256":"651b2233aaa5d1a64e9f8fc0468f6b561c0c7670746c7c9e111c658ae8262000","sha512":"2ba7fe8432c935de8c43e65f6f4b060bc7f3f54953704eb3fa51d912a98dfea9079a5476d286207d30424d51d79ce31eaab75beabd956b5f2507e4409f8bead9","ssdeep":"","tlshash":"ebb0023461111811d5629898287434256854b12a93d6ad05397e69c82bf56218614a0a","size":113,"data":"","first_seen":"2025-04-21T10:45:11.09986Z","last_seen":"2026-06-01T00:45:05.352995Z","times_seen":57,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"code.jquery.com/jquery-3.5.1.min.js","fqdn":"code.jquery.com","domain":"jquery.com","tld":"com"},"ip":{"addr":"151.101.66.137","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"dc5e7f18c8d36ac1d3d4753a87c98d0a","sha1":"c8e1c8b386dc5b7a9184c763c88d19a346eb3342","sha256":"f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d","sha512":"6cb4f4426f559c06190df97229c05a436820d21498350ac9f118a5625758435171418a022ed523bae46e668f9f8ea871feab6aff58ad2740b67a30f196d65516","ssdeep":"1536:AjExXUqrnxDjoXEZxkMV4SYSt0zvDD6ip3h8cApwEjOPrBeU6QLiTFbc0QlQvakF:AYh8eip3huuf6IidlrvakdtQ47GK1","tlshash":"a993f9ddb2c6702257a720ba007f510bf236199d6c4d8450f265d8e9bcb8a4e827bf7d","size":89476,"data":"","first_seen":"2023-03-07T01:02:01Z","last_seen":"2026-08-22T23:27:36.310347Z","times_seen":268257,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"gxrxntifirxsxtlxrri.duckdns.org/assets/css/ajax.css","fqdn":"gxrxntifirxsxtlxrri.duckdns.org","domain":"gxrxntifirxsxtlxrri.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"78.159.156.48","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://gxrxntifirxsxtlxrri.duckdns.org/","date":"2025-10-14T16:10:44.694Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_CHACHA20_POLY1305_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gxrxntifirxsxtlxrri.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 10 Oct 2025 09:47:09 GMT","end":"Thu, 08 Jan 2026 09:47:08 GMT"},"fingerprint":{"sha1":"43:F8:76:E8:7C:67:49:E0:65:A3:62:7A:AA:2C:F2:E4:F8:62:C5:45","sha256":"7F:ED:73:31:27:D5:92:DB:80:49:7E:0A:4C:39:73:D2:D4:37:F8:8D:12:FB:A3:28:19:41:C4:9E:0F:7E:F8:88"}}},"request":{"raw":"GET /assets/css/ajax.css HTTP/1.1\r\nHost: gxrxntifirxsxtlxrri.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://gxrxntifirxsxtlxrri.duckdns.org/\r\nCookie: PHPSESSID=te0faqaaji8q7e99l3fc5blsig\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Tue, 21 Oct 2025 16:10:44 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 19 Apr 2024 14:11:38 GMT\r\netag: \"e4d-66227b9a-69294ee43f4c4916;br\"\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 1010\r\ndate: Tue, 14 Oct 2025 16:10:44 GMT\r\nx-powered-by: PleskLin\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000, h3-Q050=\":443\"; ma=2592000, h3-Q046=\":443\"; ma=2592000, h3-Q043=\":443\"; ma=2592000, quic=\":443\"; ma=2592000; v=\"43,46\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":3661,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"9510b798e76cd2350cb1e72844cf1538","sha1":"aed4536054d2785f571343b5aaac59436428673f","sha256":"9b8e4bb5656ac7b1f0d1b03796bc3974bff07d5f5c772574e3b59db46685445e","sha512":"f657754a8d677dd2f7d62b0e2b3e9be91ad20d3b04234c133a7b6e4bc307eb9b5f773aa3ae0cdea6c68b4d1ec91149397969deba6ba2c995fe483b8e1ff71862","ssdeep":"","tlshash":"12711229d6051206a373da98fba11755fb49442b870741be7ee8a344cff946887e1fcc","first_seen":"2024-08-19T15:32:49.480255Z","last_seen":"2026-08-10T04:18:49.311695Z","times_seen":53,"resource_available":false,"data":null}},"time_used":84,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":84,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"gxrxntifirxsxtlxrri.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"gxrxntifirxsxtlxrri.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"gxrxntifirxsxtlxrri.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"gxrxntifirxsxtlxrri.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"code.jquery.com/jquery-3.5.1.min.js","fqdn":"code.jquery.com","domain":"jquery.com","tld":"com"},"ip":{"addr":"151.101.66.137","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://gxrxntifirxsxtlxrri.duckdns.org/","date":"2025-10-14T16:10:44.872Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.jquery.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV E36","organization":"Sectigo Limited"},"validity":{"start":"Thu, 12 Jun 2025 00:00:00 GMT","end":"Fri, 26 Jun 2026 23:59:59 GMT"},"fingerprint":{"sha1":"56:36:FB:D3:E0:9E:71:88:98:A4:C9:34:94:9B:43:3A:C4:C5:1E:BE","sha256":"9A:64:20:6F:F5:DC:F1:8A:D6:B2:D0:93:C2:7E:62:86:0B:1A:D5:24:CF:CE:4A:9F:4C:0D:F1:FB:F2:A0:A8:1E"}}},"request":{"raw":"GET /jquery-3.5.1.min.js HTTP/1.1\r\nHost: code.jquery.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://gxrxntifirxsxtlxrri.duckdns.org/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 18 Oct 1991 12:00:00 GMT\r\netag: W/\"28feccc0-15d84\"\r\ncache-control: public, max-age=31536000, stale-while-revalidate=604800\r\naccess-control-allow-origin: *\r\ncontent-encoding: gzip\r\nvia: 1.1 varnish, 1.1 varnish\r\naccept-ranges: bytes\r\ndate: Tue, 14 Oct 2025 16:10:44 GMT\r\nage: 1063531\r\nx-served-by: cache-lga21981-LGA, cache-hel1410027-HEL\r\nx-cache: HIT, HIT\r\nx-cache-hits: 64, 22538\r\nx-timer: S1760458245.878260,VS0,VE0\r\nvary: Accept-Encoding\r\ncontent-length: 30879\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]}],"data":{"size":89476,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65451)","md5":"dc5e7f18c8d36ac1d3d4753a87c98d0a","sha1":"c8e1c8b386dc5b7a9184c763c88d19a346eb3342","sha256":"f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d","sha512":"6cb4f4426f559c06190df97229c05a436820d21498350ac9f118a5625758435171418a022ed523bae46e668f9f8ea871feab6aff58ad2740b67a30f196d65516","ssdeep":"1536:AjExXUqrnxDjoXEZxkMV4SYSt0zvDD6ip3h8cApwEjOPrBeU6QLiTFbc0QlQvakF:AYh8eip3huuf6IidlrvakdtQ47GK1","tlshash":"a993f9ddb2c6702257a720ba007f510bf236199d6c4d8450f265d8e9bcb8a4e827bf7d","first_seen":"2023-03-07T01:02:01Z","last_seen":"2026-08-22T23:27:36.310347Z","times_seen":268257,"resource_available":true,"data":null}},"time_used":18,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":15,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gxrxntifirxsxtlxrri.duckdns.org/process","fqdn":"gxrxntifirxsxtlxrri.duckdns.org","domain":"gxrxntifirxsxtlxrri.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"78.159.156.48","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxrxntifirxsxtlxrri.duckdns.org/","date":"2025-10-14T16:10:44.941Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_CHACHA20_POLY1305_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gxrxntifirxsxtlxrri.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 10 Oct 2025 09:47:09 GMT","end":"Thu, 08 Jan 2026 09:47:08 GMT"},"fingerprint":{"sha1":"43:F8:76:E8:7C:67:49:E0:65:A3:62:7A:AA:2C:F2:E4:F8:62:C5:45","sha256":"7F:ED:73:31:27:D5:92:DB:80:49:7E:0A:4C:39:73:D2:D4:37:F8:8D:12:FB:A3:28:19:41:C4:9E:0F:7E:F8:88"}}},"request":{"raw":"POST /process HTTP/1.1\r\nHost: gxrxntifirxsxtlxrri.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 43\r\nOrigin: https://gxrxntifirxsxtlxrri.duckdns.org\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://gxrxntifirxsxtlxrri.duckdns.org/\r\nCookie: PHPSESSID=te0faqaaji8q7e99l3fc5blsig\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 200 OK\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 0\r\ndate: Tue, 14 Oct 2025 16:10:44 GMT\r\nx-powered-by: PHP/8.3.26, PleskLin\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP:8.3.26","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-22T23:26:51.564587Z","times_seen":18044534,"resource_available":true,"data":null}},"time_used":111,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":111,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"gxrxntifirxsxtlxrri.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"gxrxntifirxsxtlxrri.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"gxrxntifirxsxtlxrri.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"gxrxntifirxsxtlxrri.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"gxrxntifirxsxtlxrri.duckdns.org/favicon.ico","fqdn":"gxrxntifirxsxtlxrri.duckdns.org","domain":"gxrxntifirxsxtlxrri.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"78.159.156.48","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gxrxntifirxsxtlxrri.duckdns.org/","date":"2025-10-14T16:10:45.057Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_CHACHA20_POLY1305_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gxrxntifirxsxtlxrri.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 10 Oct 2025 09:47:09 GMT","end":"Thu, 08 Jan 2026 09:47:08 GMT"},"fingerprint":{"sha1":"43:F8:76:E8:7C:67:49:E0:65:A3:62:7A:AA:2C:F2:E4:F8:62:C5:45","sha256":"7F:ED:73:31:27:D5:92:DB:80:49:7E:0A:4C:39:73:D2:D4:37:F8:8D:12:FB:A3:28:19:41:C4:9E:0F:7E:F8:88"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: gxrxntifirxsxtlxrri.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://gxrxntifirxsxtlxrri.duckdns.org/\r\nCookie: PHPSESSID=te0faqaaji8q7e99l3fc5blsig\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 Not Found\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 1135\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ndate: Tue, 14 Oct 2025 16:10:45 GMT\r\nx-powered-by: PHP/8.3.26, PleskLin\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"PHP:8.3.26","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":3067,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"JavaScript source, Unicode text, UTF-8 text, with CRLF line terminators","md5":"1e336b65c878113431769756a97dab3f","sha1":"ab10497363dd7ede115a7ee9217861284a9c6400","sha256":"eaf5722f8c09ea221c6c0caf26a69d1adf42605c598358fc378ad001b67dcf8f","sha512":"a670e23ebcc067565f717055a3a30fa2ce7da537a81300161a654b843b87f3644798a1e86b3999860e4768cc9fa5083d87f067955bd6bb15bb3849fde6a7ea65","ssdeep":"","tlshash":"6951101628c1881a41b3d59999b2fe2dfc92e227d247994439fc27a71ff2f59cc43a14","first_seen":"2024-08-19T15:32:49.476334Z","last_seen":"2026-03-01T07:39:36.794878Z","times_seen":27,"resource_available":false,"data":null}},"time_used":88,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":88,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"gxrxntifirxsxtlxrri.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"gxrxntifirxsxtlxrri.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"gxrxntifirxsxtlxrri.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"gxrxntifirxsxtlxrri.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"gxrxntifirxsxtlxrri.duckdns.org/process","fqdn":"gxrxntifirxsxtlxrri.duckdns.org","domain":"gxrxntifirxsxtlxrri.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"78.159.156.48","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxrxntifirxsxtlxrri.duckdns.org/","date":"2025-10-14T16:10:46.942Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_CHACHA20_POLY1305_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gxrxntifirxsxtlxrri.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 10 Oct 2025 09:47:09 GMT","end":"Thu, 08 Jan 2026 09:47:08 GMT"},"fingerprint":{"sha1":"43:F8:76:E8:7C:67:49:E0:65:A3:62:7A:AA:2C:F2:E4:F8:62:C5:45","sha256":"7F:ED:73:31:27:D5:92:DB:80:49:7E:0A:4C:39:73:D2:D4:37:F8:8D:12:FB:A3:28:19:41:C4:9E:0F:7E:F8:88"}}},"request":{"raw":"POST /process HTTP/1.1\r\nHost: gxrxntifirxsxtlxrri.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 43\r\nOrigin: https://gxrxntifirxsxtlxrri.duckdns.org\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://gxrxntifirxsxtlxrri.duckdns.org/\r\nCookie: PHPSESSID=te0faqaaji8q7e99l3fc5blsig\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 200 OK\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 0\r\ndate: Tue, 14 Oct 2025 16:10:46 GMT\r\nx-powered-by: PHP/8.3.26, PleskLin\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP:8.3.26","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-22T23:26:51.564587Z","times_seen":18044534,"resource_available":true,"data":null}},"time_used":97,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":96,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"gxrxntifirxsxtlxrri.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"gxrxntifirxsxtlxrri.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"gxrxntifirxsxtlxrri.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"gxrxntifirxsxtlxrri.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"gxrxntifirxsxtlxrri.duckdns.org/process","fqdn":"gxrxntifirxsxtlxrri.duckdns.org","domain":"gxrxntifirxsxtlxrri.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"78.159.156.48","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxrxntifirxsxtlxrri.duckdns.org/","date":"2025-10-14T16:11:00.944Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_CHACHA20_POLY1305_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gxrxntifirxsxtlxrri.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 10 Oct 2025 09:47:09 GMT","end":"Thu, 08 Jan 2026 09:47:08 GMT"},"fingerprint":{"sha1":"43:F8:76:E8:7C:67:49:E0:65:A3:62:7A:AA:2C:F2:E4:F8:62:C5:45","sha256":"7F:ED:73:31:27:D5:92:DB:80:49:7E:0A:4C:39:73:D2:D4:37:F8:8D:12:FB:A3:28:19:41:C4:9E:0F:7E:F8:88"}}},"request":{"raw":"POST /process HTTP/1.1\r\nHost: gxrxntifirxsxtlxrri.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 43\r\nOrigin: https://gxrxntifirxsxtlxrri.duckdns.org\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://gxrxntifirxsxtlxrri.duckdns.org/\r\nCookie: PHPSESSID=te0faqaaji8q7e99l3fc5blsig\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 200 OK\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 0\r\ndate: Tue, 14 Oct 2025 16:11:00 GMT\r\nx-powered-by: PHP/8.3.26, PleskLin\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP:8.3.26","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-22T23:26:51.564587Z","times_seen":18044534,"resource_available":true,"data":null}},"time_used":107,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":107,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"gxrxntifirxsxtlxrri.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"gxrxntifirxsxtlxrri.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"gxrxntifirxsxtlxrri.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"gxrxntifirxsxtlxrri.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/jquery.mask/0.9.0/jquery.mask.min.js","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.25.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://gxrxntifirxsxtlxrri.duckdns.org/","date":"2025-10-14T16:10:44.712Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 17 Sep 2025 19:09:23 GMT","end":"Tue, 16 Dec 2025 20:08:48 GMT"},"fingerprint":{"sha1":"E5:FA:6E:21:DA:AB:92:8F:E0:CB:31:C2:87:D4:E2:CE:9F:23:BF:C1","sha256":"E8:C7:D4:A8:29:E6:45:C0:C5:E3:AD:6A:90:36:30:4A:D7:2E:7C:F7:8F:57:44:E8:3B:2D:AF:F6:80:F7:4B:46"}}},"request":{"raw":"GET /ajax/libs/jquery.mask/0.9.0/jquery.mask.min.js HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://gxrxntifirxsxtlxrri.duckdns.org/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 14 Oct 2025 16:10:44 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-length: 1423\r\ncf-ray: 98e8593d6cda3181-OSL\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=30672000\r\ncontent-encoding: br\r\netag: \"5eb03ec3-ed4\"\r\nlast-modified: Mon, 04 May 2020 16:11:47 GMT\r\ncf-cdnjs-via: cfworker/kv\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\nvary: Accept-Encoding\r\ncf-cache-status: HIT\r\nage: 3737949\r\nexpires: Sun, 04 Oct 2026 16:10:44 GMT\r\naccept-ranges: bytes\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=6L9LvE0E6V8nIUx%2FApiW4MsW7GkbHg4KUs9dCUx3%2Fvm3XVxUKY4JWCCCyy%2BVviyYzisPndu2PwbI15y1J7aPyCT41W6VNRDVtDZEtgcE%2BYur0Y5GV1J08OdWiZ1Qm5LgMLeB4z7L\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nstrict-transport-security: max-age=15780000\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3796,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (547)","md5":"82505c3840658919ab56dd3c80204919","sha1":"53ac516b948804bf2ee7582c9a2ea6fc93367eaa","sha256":"41193718966d1acdb3072ba605cd4e775270c903bfbbcb4d6abd81f878c23155","sha512":"a0909ae854b6fb33b7122b544a3fb17a210df544ebf808ea94164ee7c38f69d6f645fab0c47a634d4f1c9080bc1789cabe89bb8abbb6b3c270768f99f339b456","ssdeep":"","tlshash":"fd71a665b3c171892333607c466f825731be5e8539fa8565f690d4e29c34e8e01bbe3d","first_seen":"2023-03-26T05:42:25Z","last_seen":"2026-08-21T19:11:56.862036Z","times_seen":258,"resource_available":true,"data":null}},"time_used":29,"timings":{"blocked":-1,"dns":0,"connect":1,"send":0,"wait":12,"receive":1,"ssl":13},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"code.jquery.com/jquery-3.5.1.min.js","fqdn":"code.jquery.com","domain":"jquery.com","tld":"com"},"ip":{"addr":"151.101.66.137","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://gxrxntifirxsxtlxrri.duckdns.org/","date":"2025-10-14T16:10:44.709Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.jquery.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV E36","organization":"Sectigo Limited"},"validity":{"start":"Thu, 12 Jun 2025 00:00:00 GMT","end":"Fri, 26 Jun 2026 23:59:59 GMT"},"fingerprint":{"sha1":"56:36:FB:D3:E0:9E:71:88:98:A4:C9:34:94:9B:43:3A:C4:C5:1E:BE","sha256":"9A:64:20:6F:F5:DC:F1:8A:D6:B2:D0:93:C2:7E:62:86:0B:1A:D5:24:CF:CE:4A:9F:4C:0D:F1:FB:F2:A0:A8:1E"}}},"request":{"raw":"GET /jquery-3.5.1.min.js HTTP/1.1\r\nHost: code.jquery.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://gxrxntifirxsxtlxrri.duckdns.org/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 18 Oct 1991 12:00:00 GMT\r\netag: W/\"28feccc0-15d84\"\r\ncache-control: public, max-age=31536000, stale-while-revalidate=604800\r\naccess-control-allow-origin: *\r\ncontent-encoding: gzip\r\nvia: 1.1 varnish, 1.1 varnish\r\naccept-ranges: bytes\r\ndate: Tue, 14 Oct 2025 16:10:44 GMT\r\nage: 1063531\r\nx-served-by: cache-lga21981-LGA, cache-hel1410027-HEL\r\nx-cache: HIT, HIT\r\nx-cache-hits: 64, 22537\r\nx-timer: S1760458245.759055,VS0,VE0\r\nvary: Accept-Encoding\r\ncontent-length: 30879\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":89476,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65451)","md5":"dc5e7f18c8d36ac1d3d4753a87c98d0a","sha1":"c8e1c8b386dc5b7a9184c763c88d19a346eb3342","sha256":"f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d","sha512":"6cb4f4426f559c06190df97229c05a436820d21498350ac9f118a5625758435171418a022ed523bae46e668f9f8ea871feab6aff58ad2740b67a30f196d65516","ssdeep":"1536:AjExXUqrnxDjoXEZxkMV4SYSt0zvDD6ip3h8cApwEjOPrBeU6QLiTFbc0QlQvakF:AYh8eip3huuf6IidlrvakdtQ47GK1","tlshash":"a993f9ddb2c6702257a720ba007f510bf236199d6c4d8450f265d8e9bcb8a4e827bf7d","first_seen":"2023-03-07T01:02:01Z","last_seen":"2026-08-22T23:27:36.310347Z","times_seen":268257,"resource_available":true,"data":null}},"time_used":127,"timings":{"blocked":45,"dns":19,"connect":13,"send":0,"wait":14,"receive":4,"ssl":29},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gxrxntifirxsxtlxrri.duckdns.org/process","fqdn":"gxrxntifirxsxtlxrri.duckdns.org","domain":"gxrxntifirxsxtlxrri.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"78.159.156.48","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxrxntifirxsxtlxrri.duckdns.org/","date":"2025-10-14T16:10:56.946Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_CHACHA20_POLY1305_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gxrxntifirxsxtlxrri.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 10 Oct 2025 09:47:09 GMT","end":"Thu, 08 Jan 2026 09:47:08 GMT"},"fingerprint":{"sha1":"43:F8:76:E8:7C:67:49:E0:65:A3:62:7A:AA:2C:F2:E4:F8:62:C5:45","sha256":"7F:ED:73:31:27:D5:92:DB:80:49:7E:0A:4C:39:73:D2:D4:37:F8:8D:12:FB:A3:28:19:41:C4:9E:0F:7E:F8:88"}}},"request":{"raw":"POST /process HTTP/1.1\r\nHost: gxrxntifirxsxtlxrri.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 43\r\nOrigin: https://gxrxntifirxsxtlxrri.duckdns.org\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://gxrxntifirxsxtlxrri.duckdns.org/\r\nCookie: PHPSESSID=te0faqaaji8q7e99l3fc5blsig\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 200 OK\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 0\r\ndate: Tue, 14 Oct 2025 16:10:56 GMT\r\nx-powered-by: PHP/8.3.26, PleskLin\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP:8.3.26","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-22T23:26:51.564587Z","times_seen":18044534,"resource_available":true,"data":null}},"time_used":107,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":107,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"gxrxntifirxsxtlxrri.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"gxrxntifirxsxtlxrri.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"gxrxntifirxsxtlxrri.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"gxrxntifirxsxtlxrri.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/css/bootstrap.min.css","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.129.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://gxrxntifirxsxtlxrri.duckdns.org/","date":"2025-10-14T16:10:44.693Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"jsdelivr.net","organization":""},"issuer":{"commonName":"GlobalSign Atlas R3 DV TLS CA 2025 Q2","organization":"GlobalSign nv-sa"},"validity":{"start":"Mon, 02 Jun 2025 15:43:52 GMT","end":"Sat, 04 Jul 2026 15:43:51 GMT"},"fingerprint":{"sha1":"21:17:81:78:41:C6:8F:86:D6:CF:8D:98:CC:74:A8:F1:03:F8:C9:D4","sha256":"D0:E6:8D:08:11:05:7E:0C:2A:0D:C7:E0:ED:AE:9E:18:C8:74:32:12:3D:56:43:98:62:CD:A2:08:6F:64:5B:B0"}}},"request":{"raw":"GET /npm/bootstrap@5.3.0/dist/css/bootstrap.min.css HTTP/1.1\r\nHost: cdn.jsdelivr.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://gxrxntifirxsxtlxrri.duckdns.org\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://gxrxntifirxsxtlxrri.duckdns.org/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: *\r\ntiming-allow-origin: *\r\ncache-control: public, max-age=31536000, s-maxage=31536000, immutable\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncontent-type: text/css; charset=utf-8\r\nx-jsd-version: 5.3.0\r\nx-jsd-version-type: version\r\netag: W/\"38dd2-sjFlHg/Wi72HWBifvTZCxGLTT6Y\"\r\ncontent-encoding: br\r\naccept-ranges: bytes\r\ndate: Tue, 14 Oct 2025 16:10:44 GMT\r\nage: 1431861\r\nx-served-by: cache-fra-etou8220062-FRA, cache-hel1410025-HEL\r\nx-cache: HIT, HIT\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\";ma=86400,h3-29=\":443\";ma=86400,h3-27=\":443\";ma=86400\r\ncontent-length: 33205\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":232914,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"Unicode text, UTF-8 text, with very long lines (65342)","md5":"fe7fdfec700d100dc745dc64d3600cb2","sha1":"b231651e0fd68bbd8758189fbd3642c462d34fa6","sha256":"7f1d37f0d90b6385354c2ac10e2bb91563c46bd7a266ed351222ebcac8496c2a","sha512":"b7819649564ed5e0bc04cdf7f5777b529870e6cd7b6bcead219223f2a4718672ae6fa5a8ca19ebc5e08831e02a04f81d646942706d8fad98cc73e5abefcfb95e","ssdeep":"1536:VYutjsbf98fOdBfvO5wlP7Qy9A374298wsY/ElV6V6pz600I41r:ntj898fo298uI6V6pz600I41r","tlshash":"383481d6f590317d9ca7c1499681fefd896fa985cb120aa6f003776807cabd30962dcc","first_seen":"2023-06-08T14:47:00Z","last_seen":"2026-08-22T22:25:45.003953Z","times_seen":25538,"resource_available":false,"data":null}},"time_used":93,"timings":{"blocked":31,"dns":0,"connect":13,"send":0,"wait":22,"receive":5,"ssl":19},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gxrxntifirxsxtlxrri.duckdns.org/logosFibaBig.png","fqdn":"gxrxntifirxsxtlxrri.duckdns.org","domain":"gxrxntifirxsxtlxrri.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"78.159.156.48","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://gxrxntifirxsxtlxrri.duckdns.org/","date":"2025-10-14T16:10:44.695Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_CHACHA20_POLY1305_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gxrxntifirxsxtlxrri.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 10 Oct 2025 09:47:09 GMT","end":"Thu, 08 Jan 2026 09:47:08 GMT"},"fingerprint":{"sha1":"43:F8:76:E8:7C:67:49:E0:65:A3:62:7A:AA:2C:F2:E4:F8:62:C5:45","sha256":"7F:ED:73:31:27:D5:92:DB:80:49:7E:0A:4C:39:73:D2:D4:37:F8:8D:12:FB:A3:28:19:41:C4:9E:0F:7E:F8:88"}}},"request":{"raw":"GET /logosFibaBig.png HTTP/1.1\r\nHost: gxrxntifirxsxtlxrri.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://gxrxntifirxsxtlxrri.duckdns.org/\r\nCookie: PHPSESSID=te0faqaaji8q7e99l3fc5blsig\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Tue, 21 Oct 2025 16:10:44 GMT\r\ncontent-type: image/png\r\nlast-modified: Fri, 19 Apr 2024 14:12:26 GMT\r\netag: \"1e831-66227bca-a6fb2944692bf442;;;\"\r\naccept-ranges: bytes\r\ncontent-length: 124977\r\ndate: Tue, 14 Oct 2025 16:10:44 GMT\r\nx-powered-by: PleskLin\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":124977,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1024 x 416, 8-bit/color RGBA, non-interlaced","md5":"338b88297c0b0a063b6f73442087c5de","sha1":"918e1a681efcc38782a870682a2040f0c2cf19c9","sha256":"9917449cee69f5732c4d476e832e78ea28ed8961cab315bff6cce62187d40038","sha512":"0415b985df72b04251912fafd4f7778eff92d30ccde93d68880f0437f12322645e54d917572760ea6ed636582daa5d3ca32bfa79e3a0445a3c6c3d46d157550c","ssdeep":"3072:ixYwaAF/LOSsP2UoZ+yKXXHT4ho2/4Zv6X4VRdqtBfO:ixfLLsuUVV3TIZOSuefO","tlshash":"0bc31289f742cc6a9e48b57244c7a8c28727358a5058c23cdbf7e4acf5cd7932ca7528","first_seen":"2024-08-19T15:32:49.481791Z","last_seen":"2026-08-10T04:18:49.304792Z","times_seen":96,"resource_available":false,"data":null}},"time_used":236,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":84,"receive":152,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"gxrxntifirxsxtlxrri.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"gxrxntifirxsxtlxrri.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"gxrxntifirxsxtlxrri.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"gxrxntifirxsxtlxrri.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"gxrxntifirxsxtlxrri.duckdns.org/process","fqdn":"gxrxntifirxsxtlxrri.duckdns.org","domain":"gxrxntifirxsxtlxrri.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"78.159.156.48","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxrxntifirxsxtlxrri.duckdns.org/","date":"2025-10-14T16:10:48.945Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_CHACHA20_POLY1305_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gxrxntifirxsxtlxrri.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 10 Oct 2025 09:47:09 GMT","end":"Thu, 08 Jan 2026 09:47:08 GMT"},"fingerprint":{"sha1":"43:F8:76:E8:7C:67:49:E0:65:A3:62:7A:AA:2C:F2:E4:F8:62:C5:45","sha256":"7F:ED:73:31:27:D5:92:DB:80:49:7E:0A:4C:39:73:D2:D4:37:F8:8D:12:FB:A3:28:19:41:C4:9E:0F:7E:F8:88"}}},"request":{"raw":"POST /process HTTP/1.1\r\nHost: gxrxntifirxsxtlxrri.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 43\r\nOrigin: https://gxrxntifirxsxtlxrri.duckdns.org\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://gxrxntifirxsxtlxrri.duckdns.org/\r\nCookie: PHPSESSID=te0faqaaji8q7e99l3fc5blsig\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 200 OK\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 0\r\ndate: Tue, 14 Oct 2025 16:10:48 GMT\r\nx-powered-by: PHP/8.3.26, PleskLin\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP:8.3.26","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-22T23:26:51.564587Z","times_seen":18044534,"resource_available":true,"data":null}},"time_used":96,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":96,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"gxrxntifirxsxtlxrri.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"gxrxntifirxsxtlxrri.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"gxrxntifirxsxtlxrri.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"gxrxntifirxsxtlxrri.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"gxrxntifirxsxtlxrri.duckdns.org/process","fqdn":"gxrxntifirxsxtlxrri.duckdns.org","domain":"gxrxntifirxsxtlxrri.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"78.159.156.48","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxrxntifirxsxtlxrri.duckdns.org/","date":"2025-10-14T16:10:54.944Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_CHACHA20_POLY1305_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gxrxntifirxsxtlxrri.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 10 Oct 2025 09:47:09 GMT","end":"Thu, 08 Jan 2026 09:47:08 GMT"},"fingerprint":{"sha1":"43:F8:76:E8:7C:67:49:E0:65:A3:62:7A:AA:2C:F2:E4:F8:62:C5:45","sha256":"7F:ED:73:31:27:D5:92:DB:80:49:7E:0A:4C:39:73:D2:D4:37:F8:8D:12:FB:A3:28:19:41:C4:9E:0F:7E:F8:88"}}},"request":{"raw":"POST /process HTTP/1.1\r\nHost: gxrxntifirxsxtlxrri.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 43\r\nOrigin: https://gxrxntifirxsxtlxrri.duckdns.org\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://gxrxntifirxsxtlxrri.duckdns.org/\r\nCookie: PHPSESSID=te0faqaaji8q7e99l3fc5blsig\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 200 OK\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 0\r\ndate: Tue, 14 Oct 2025 16:10:54 GMT\r\nx-powered-by: PHP/8.3.26, PleskLin\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP:8.3.26","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-22T23:26:51.564587Z","times_seen":18044534,"resource_available":true,"data":null}},"time_used":93,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":93,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"gxrxntifirxsxtlxrri.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"gxrxntifirxsxtlxrri.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"gxrxntifirxsxtlxrri.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"gxrxntifirxsxtlxrri.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"gxrxntifirxsxtlxrri.duckdns.org/","fqdn":"gxrxntifirxsxtlxrri.duckdns.org","domain":"gxrxntifirxsxtlxrri.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"78.159.156.48","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-10-14T16:10:42.435Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_CHACHA20_POLY1305_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gxrxntifirxsxtlxrri.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 10 Oct 2025 09:47:09 GMT","end":"Thu, 08 Jan 2026 09:47:08 GMT"},"fingerprint":{"sha1":"43:F8:76:E8:7C:67:49:E0:65:A3:62:7A:AA:2C:F2:E4:F8:62:C5:45","sha256":"7F:ED:73:31:27:D5:92:DB:80:49:7E:0A:4C:39:73:D2:D4:37:F8:8D:12:FB:A3:28:19:41:C4:9E:0F:7E:F8:88"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: gxrxntifirxsxtlxrri.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nset-cookie: PHPSESSID=te0faqaaji8q7e99l3fc5blsig; path=/; secure\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 1135\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ndate: Tue, 14 Oct 2025 16:10:44 GMT\r\nx-powered-by: PHP/8.3.26, PleskLin\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000, h3-Q050=\":443\"; ma=2592000, h3-Q046=\":443\"; ma=2592000, h3-Q043=\":443\"; ma=2592000, quic=\":443\"; ma=2592000; v=\"43,46\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"cdnjs","description":"cdnjs is a free distributed JS library delivery service.","website":"https://cdnjs.com","common_platform_enumeration":"","icon":"cdnjs.svg","categories":["CDN"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Bootstrap:5.3.0","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"jQuery:3.5.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"PHP:8.3.26","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"jQuery CDN","description":"jQuery CDN is a way to include jQuery in your website without actually downloading and keeping it your website's folder.","website":"https://code.jquery.com/","common_platform_enumeration":"","icon":"jQuery.svg","categories":["CDN"]}],"data":{"size":3067,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"JavaScript source, Unicode text, UTF-8 text, with CRLF line terminators","md5":"1e336b65c878113431769756a97dab3f","sha1":"ab10497363dd7ede115a7ee9217861284a9c6400","sha256":"eaf5722f8c09ea221c6c0caf26a69d1adf42605c598358fc378ad001b67dcf8f","sha512":"a670e23ebcc067565f717055a3a30fa2ce7da537a81300161a654b843b87f3644798a1e86b3999860e4768cc9fa5083d87f067955bd6bb15bb3849fde6a7ea65","ssdeep":"","tlshash":"6951101628c1881a41b3d59999b2fe2dfc92e227d247994439fc27a71ff2f59cc43a14","first_seen":"2024-08-19T15:32:49.476334Z","last_seen":"2026-03-01T07:39:36.794878Z","times_seen":27,"resource_available":false,"data":null}},"time_used":4099,"timings":{"blocked":2000,"dns":1811,"connect":93,"send":0,"wait":99,"receive":0,"ssl":92},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"gxrxntifirxsxtlxrri.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"gxrxntifirxsxtlxrri.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"gxrxntifirxsxtlxrri.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"gxrxntifirxsxtlxrri.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"gxrxntifirxsxtlxrri.duckdns.org/SommetRoundedRegular.otf","fqdn":"gxrxntifirxsxtlxrri.duckdns.org","domain":"gxrxntifirxsxtlxrri.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"78.159.156.48","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://gxrxntifirxsxtlxrri.duckdns.org/","date":"2025-10-14T16:10:44.843Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_CHACHA20_POLY1305_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gxrxntifirxsxtlxrri.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 10 Oct 2025 09:47:09 GMT","end":"Thu, 08 Jan 2026 09:47:08 GMT"},"fingerprint":{"sha1":"43:F8:76:E8:7C:67:49:E0:65:A3:62:7A:AA:2C:F2:E4:F8:62:C5:45","sha256":"7F:ED:73:31:27:D5:92:DB:80:49:7E:0A:4C:39:73:D2:D4:37:F8:8D:12:FB:A3:28:19:41:C4:9E:0F:7E:F8:88"}}},"request":{"raw":"GET /SommetRoundedRegular.otf HTTP/1.1\r\nHost: gxrxntifirxsxtlxrri.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://gxrxntifirxsxtlxrri.duckdns.org/assets/css/ajax.css\r\nCookie: PHPSESSID=te0faqaaji8q7e99l3fc5blsig\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: font/otf\r\nlast-modified: Fri, 19 Apr 2024 14:12:26 GMT\r\netag: \"11a4c-66227bca-27f54283bf952af8;br\"\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 36210\r\ndate: Tue, 14 Oct 2025 16:10:44 GMT\r\nx-powered-by: PleskLin\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":72268,"size_decoded":0,"mime_type":"font/otf","magic":"OpenType font data","md5":"50ae5c9423469b05b0648bd9625975d1","sha1":"eafbb1e309ec069c12f64059b6c978baa9a5a61d","sha256":"ef3f9f286f49ab0155ee0801a85f65acf7736354419e2afdc4fdbeef8fb7b89b","sha512":"ec8280266514b2ca45ea76002a5151530b6c97046fc5597794d3b4c7b82817dd0aa6677c590794180f9b9ba2dd69e6a09f341febe5216236730e8994c92ad885","ssdeep":"1536:CTcMcabJmpwJ4dH/lsebCsWU/vuh+L/3Hof:M45/2ebCw/vuh+ra","tlshash":"0c633a96b2f62301f7bb7f3459b802106db2bd02ec75e58d12334a5e7eba6009cb5716","first_seen":"2024-07-27T23:16:38Z","last_seen":"2026-08-18T12:29:14.671867Z","times_seen":127,"resource_available":false,"data":null}},"time_used":129,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":89,"receive":40,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"gxrxntifirxsxtlxrri.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"gxrxntifirxsxtlxrri.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"gxrxntifirxsxtlxrri.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"gxrxntifirxsxtlxrri.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"gxrxntifirxsxtlxrri.duckdns.org/process","fqdn":"gxrxntifirxsxtlxrri.duckdns.org","domain":"gxrxntifirxsxtlxrri.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"78.159.156.48","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxrxntifirxsxtlxrri.duckdns.org/","date":"2025-10-14T16:10:50.942Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_CHACHA20_POLY1305_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gxrxntifirxsxtlxrri.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 10 Oct 2025 09:47:09 GMT","end":"Thu, 08 Jan 2026 09:47:08 GMT"},"fingerprint":{"sha1":"43:F8:76:E8:7C:67:49:E0:65:A3:62:7A:AA:2C:F2:E4:F8:62:C5:45","sha256":"7F:ED:73:31:27:D5:92:DB:80:49:7E:0A:4C:39:73:D2:D4:37:F8:8D:12:FB:A3:28:19:41:C4:9E:0F:7E:F8:88"}}},"request":{"raw":"POST /process HTTP/1.1\r\nHost: gxrxntifirxsxtlxrri.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 43\r\nOrigin: https://gxrxntifirxsxtlxrri.duckdns.org\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://gxrxntifirxsxtlxrri.duckdns.org/\r\nCookie: PHPSESSID=te0faqaaji8q7e99l3fc5blsig\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 200 OK\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 0\r\ndate: Tue, 14 Oct 2025 16:10:50 GMT\r\nx-powered-by: PHP/8.3.26, PleskLin\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP:8.3.26","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-22T23:26:51.564587Z","times_seen":18044534,"resource_available":true,"data":null}},"time_used":94,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":94,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"gxrxntifirxsxtlxrri.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"gxrxntifirxsxtlxrri.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"gxrxntifirxsxtlxrri.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"gxrxntifirxsxtlxrri.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"gxrxntifirxsxtlxrri.duckdns.org/process","fqdn":"gxrxntifirxsxtlxrri.duckdns.org","domain":"gxrxntifirxsxtlxrri.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"78.159.156.48","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxrxntifirxsxtlxrri.duckdns.org/","date":"2025-10-14T16:10:52.944Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_CHACHA20_POLY1305_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gxrxntifirxsxtlxrri.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 10 Oct 2025 09:47:09 GMT","end":"Thu, 08 Jan 2026 09:47:08 GMT"},"fingerprint":{"sha1":"43:F8:76:E8:7C:67:49:E0:65:A3:62:7A:AA:2C:F2:E4:F8:62:C5:45","sha256":"7F:ED:73:31:27:D5:92:DB:80:49:7E:0A:4C:39:73:D2:D4:37:F8:8D:12:FB:A3:28:19:41:C4:9E:0F:7E:F8:88"}}},"request":{"raw":"POST /process HTTP/1.1\r\nHost: gxrxntifirxsxtlxrri.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 43\r\nOrigin: https://gxrxntifirxsxtlxrri.duckdns.org\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://gxrxntifirxsxtlxrri.duckdns.org/\r\nCookie: PHPSESSID=te0faqaaji8q7e99l3fc5blsig\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 200 OK\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 0\r\ndate: Tue, 14 Oct 2025 16:10:52 GMT\r\nx-powered-by: PHP/8.3.26, PleskLin\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP:8.3.26","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-22T23:26:51.564587Z","times_seen":18044534,"resource_available":true,"data":null}},"time_used":96,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":96,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"gxrxntifirxsxtlxrri.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"gxrxntifirxsxtlxrri.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"gxrxntifirxsxtlxrri.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"gxrxntifirxsxtlxrri.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"gxrxntifirxsxtlxrri.duckdns.org/process","fqdn":"gxrxntifirxsxtlxrri.duckdns.org","domain":"gxrxntifirxsxtlxrri.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"78.159.156.48","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxrxntifirxsxtlxrri.duckdns.org/","date":"2025-10-14T16:10:58.944Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_CHACHA20_POLY1305_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gxrxntifirxsxtlxrri.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 10 Oct 2025 09:47:09 GMT","end":"Thu, 08 Jan 2026 09:47:08 GMT"},"fingerprint":{"sha1":"43:F8:76:E8:7C:67:49:E0:65:A3:62:7A:AA:2C:F2:E4:F8:62:C5:45","sha256":"7F:ED:73:31:27:D5:92:DB:80:49:7E:0A:4C:39:73:D2:D4:37:F8:8D:12:FB:A3:28:19:41:C4:9E:0F:7E:F8:88"}}},"request":{"raw":"POST /process HTTP/1.1\r\nHost: gxrxntifirxsxtlxrri.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 43\r\nOrigin: https://gxrxntifirxsxtlxrri.duckdns.org\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://gxrxntifirxsxtlxrri.duckdns.org/\r\nCookie: PHPSESSID=te0faqaaji8q7e99l3fc5blsig\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 200 OK\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 0\r\ndate: Tue, 14 Oct 2025 16:10:58 GMT\r\nx-powered-by: PHP/8.3.26, PleskLin\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP:8.3.26","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-22T23:26:51.564587Z","times_seen":18044534,"resource_available":true,"data":null}},"time_used":95,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":95,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"gxrxntifirxsxtlxrri.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"gxrxntifirxsxtlxrri.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"gxrxntifirxsxtlxrri.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"gxrxntifirxsxtlxrri.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}}]}