Report - nkvstpvkvo.duckdns.org/

Report Overview

URL

nkvstpvkvo.duckdns.org/
IP

45.88.168.143

ASN

#35913 DEDIPATH-LLC
Submitted

2022-10-01T22:19:10Z

Access
Tags

None
urlquery detections

DynDNS domain detected

Detections

urlquery

11
Network Intrusion Detection

0
Threat Detection Systems

13

Domain Summary

Domain	Rank	First Seen	Last Seen	Sent	Received	IP
r3.o.lencr.org (5)	344	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	1630	4431	23.36.76.226
contile.services.mozilla.com (1)	1114	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	321	229	34.117.237.239
nkvstpvkvo.duckdns.org (10)	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	4667	334951	45.88.168.143
push.services.mozilla.com (1)	2140	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	594	127	54.149.28.179
js.users.51.la (1)	53024	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	356	2701	103.143.19.103
img-getpocket.cdn.mozilla.net (6)	1631	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	3174	61752	34.120.237.76
firefox.settings.services.mozilla.com (2)	867	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	758	2662	13.224.103.49
content-signature-2.cdn.mozilla.net (1)	1152	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	401	5846	13.224.103.45
ocsp.digicert.com (1)	86	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	329	737	93.184.220.29
ocsp.globalsign.com (3)	2075	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	1045	5682	104.18.20.226
www.nta.go.jp (1)	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	407	30437	13.224.103.94
ia.51.la (1)	59607	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	549	200	103.143.19.103

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

OpenPhish

Scan Date	Severity	Indicator	Alert
2022-10-01	medium	nkvstpvkvo.duckdns.org/	National Tax Agency JAPAN
2022-10-01	medium	nkvstpvkvo.duckdns.org/	National Tax Agency JAPAN
2022-10-01	medium	nkvstpvkvo.duckdns.org/	National Tax Agency JAPAN
2022-10-01	medium	nkvstpvkvo.duckdns.org/	National Tax Agency JAPAN
2022-10-01	medium	nkvstpvkvo.duckdns.org/	National Tax Agency JAPAN
2022-10-01	medium	nkvstpvkvo.duckdns.org/	National Tax Agency JAPAN
2022-10-01	medium	nkvstpvkvo.duckdns.org/	National Tax Agency JAPAN
2022-10-01	medium	nkvstpvkvo.duckdns.org/	National Tax Agency JAPAN
2022-10-01	medium	nkvstpvkvo.duckdns.org/	National Tax Agency JAPAN
2022-10-01	medium	nkvstpvkvo.duckdns.org/	National Tax Agency JAPAN

PhishTank

No alerts detected

Fortinet's Web Filter

Scan Date	Severity	Indicator	Alert
2022-10-01	medium	nkvstpvkvo.duckdns.org/static/js/jquery-3.3.1.min.js	Phishing
2022-10-01	medium	nkvstpvkvo.duckdns.org/static/js/jquery.cookie.js	Phishing
2022-10-01	medium	nkvstpvkvo.duckdns.org/	Phishing

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

JavaScript (6)

HTTP Transactions (33)

URL IP Response Size

r3.o.lencr.org/

23.36.76.226

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

23.36.76.226:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

dfd8e43e0c6342af076d8624458f2616

d130af83aa43ae23263e220d53d8fd1daead3cb8

5ae7a6b2908854a3ed78ef66e0ac90c4c00b1de6a9dd431c9ba238a013b308cf

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "5AE7A6B2908854A3ED78EF66E0AC90C4C00B1DE6A9DD431C9BA238A013B308CF"
Last-Modified: Sat, 01 Oct 2022 01:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=13024
Expires: Sun, 02 Oct 2022 01:56:03 GMT
Date: Sat, 01 Oct 2022 22:18:59 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

23.36.76.226:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

24cdc937930ac2ef9c8f46ba1deabcc5

397417929951bf20f235d5f91510163ac213dc71

eb128aec099dbf1919ee5d965221e904ad3a2162583683cec44518640b505447

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "EB128AEC099DBF1919EE5D965221E904AD3A2162583683CEC44518640B505447"
Last-Modified: Sat, 01 Oct 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2750
Expires: Sat, 01 Oct 2022 23:04:49 GMT
Date: Sat, 01 Oct 2022 22:18:59 GMT
Connection: keep-alive

firefox.settings.services.mozilla.com/v1/

13.224.103.49

200 OK

939

URL HTTP/1.1

firefox.settings.services.mozilla.com/v1/
IP

13.224.103.49:0
ASN

#16509 AMAZON-02

Magic

JSON data\012- , ASCII text, with very long lines (939), with no line terminators

Size

939
Hash

2d12f67fe57a87e7366b662d153a5582

d7b02d81cc74f24a251d9363e0f4b0a149264ec1

73c273c0b5a2de3cb970b8e8c187999d3b55e760dc7766dab4bb76428d19b551

HTTP Headers

                                        GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 939
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length, Backoff, Content-Type, Retry-After, Alert
Cache-Control: max-age=3600
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Date: Sat, 01 Oct 2022 21:59:10 GMT
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
Via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: ZRH50-C1
X-Amz-Cf-Id: 5-38WCRfA8O8Kd2gzi35OdJ6qErhUfXZm0SLS_hleekNyDsdBm4xxg==
Age: 1189

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-10-30-18-47-44.chain

13.224.103.45

200 OK

5348

URL HTTP/2

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-10-30-18-47-44.chain
IP

13.224.103.45:0
ASN

#16509 AMAZON-02

Magic

PEM certificate\012- , ASCII text

Size

5348
Hash

6113f8408c59aebe188d6af273b90743

7398873bf00f99944eaa77ad3ebc0d43c23dba6b

b6e0cc9ad68306208a160f3835fb8da76acc5a82d8fde1da5a98e1de1c11a770

HTTP Headers

                                        GET /chains/remote-settings.content-signature.mozilla.org-2022-10-30-18-47-44.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
content-type: binary/octet-stream
content-length: 5348
last-modified: Sat, 10 Sep 2022 18:47:45 GMT
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
date: Sat, 01 Oct 2022 05:28:28 GMT
etag: "6113f8408c59aebe188d6af273b90743"
x-cache: Hit from cloudfront
via: 1.1 d4ab4520827d99650a0d233539c37424.cloudfront.net (CloudFront)
x-amz-cf-pop: ZRH50-C1
x-amz-cf-id: BquJ2fE8moYfwV-rDw9BWdzcVQ6LOGdGgl44OuPdLmKSA6NEyndIHA==
age: 60632
X-Firefox-Spdy: h2

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

URL HTTP/2

contile.services.mozilla.com/v1/tiles
IP

34.117.237.239:0
ASN

#15169 GOOGLE

Magic

JSON data\012- , ASCII text, with no line terminators

Size

12
Hash

23e88fb7b99543fb33315b29b1fad9d6

a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce

7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

                                        GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
server: nginx
date: Sat, 01 Oct 2022 22:18:59 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

nkvstpvkvo.duckdns.org/static/gs_vk/reset.css

45.88.168.143

200 OK

884

URL HTTP/2

nkvstpvkvo.duckdns.org/static/gs_vk/reset.css
IP

45.88.168.143:0
ASN

#35913 DEDIPATH-LLC

Magic

CSV text\012- , ASCII text, with CRLF line terminators

Size

884
Hash

a77d6f26781539c015b1b1d84dac9c06

6f9e90a2e3c9f2bcb9337e577150bde1d3a29ccb

e0e6a4ef211b0c936b3a38abe91cda1ebbbcc4a3c2d8e706ef7a1dc2c55427c3

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected
openphish	National Tax Agency JAPAN

HTTP Headers

                                        GET /static/gs_vk/reset.css HTTP/1.1
Host: nkvstpvkvo.duckdns.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://nkvstpvkvo.duckdns.org/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        HTTP/2 200 OK
server: nginx
date: Sat, 01 Oct 2022 22:18:59 GMT
content-type: text/css
content-length: 884
last-modified: Tue, 09 Aug 2022 08:07:52 GMT
etag: "62f215d8-374"
expires: Sun, 02 Oct 2022 10:18:59 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2

nkvstpvkvo.duckdns.org/static/gs_vk/index.css

45.88.168.143

200 OK

748

URL HTTP/2

nkvstpvkvo.duckdns.org/static/gs_vk/index.css
IP

45.88.168.143:0
ASN

#35913 DEDIPATH-LLC

Magic

ASCII text

Size

748
Hash

91692497e479f6cc955e4de6d627a499

bb57de5c2d4dafee21f66645d776d3064f4b79bd

de36d3e9e989de40ae0bf5252af018ef55fdc0ed938042bdba11147f1127e431

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected
openphish	National Tax Agency JAPAN

HTTP Headers

                                        GET /static/gs_vk/index.css HTTP/1.1
Host: nkvstpvkvo.duckdns.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://nkvstpvkvo.duckdns.org/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        HTTP/2 200 OK
server: nginx
date: Sat, 01 Oct 2022 22:18:59 GMT
content-type: text/css
content-length: 748
last-modified: Tue, 09 Aug 2022 08:07:52 GMT
etag: "62f215d8-2ec"
expires: Sun, 02 Oct 2022 10:18:59 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

13.224.103.49

200 OK

329

URL HTTP/1.1

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP

13.224.103.49:0
ASN

#16509 AMAZON-02

Magic

JSON data\012- , ASCII text, with very long lines (329), with no line terminators

Size

329
Hash

0333b0655111aa68de771adfcc4db243

63f295a144ac87a7c8e23417626724eeca68a7eb

60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

HTTP Headers

                                        GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 329
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Pragma, Content-Length, Backoff, Last-Modified, Cache-Control, Content-Type, Retry-After, ETag, Expires, Alert
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Last-Modified: Fri, 25 Mar 2022 17:45:46 GMT
X-Content-Type-Options: nosniff
Cache-Control: max-age=3600, max-age=3600
Date: Sat, 01 Oct 2022 21:29:33 GMT
Expires: Sat, 01 Oct 2022 22:25:22 GMT
ETag: "1648230346554"
X-Cache: Hit from cloudfront
Via: 1.1 01ec1718bcc130455b377ec6b38ad50c.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: ZRH50-C1
X-Amz-Cf-Id: gZhSNV5BwfLcPxoKBtX37xHlpOf6ph_rIQEMkTjzTRi2AIoj2VEpMw==
Age: 2967

ocsp.digicert.com/

93.184.220.29

200 OK

471

URL HTTP/1.1

ocsp.digicert.com/
IP

93.184.220.29:0
ASN

#15133 EDGECAST

Magic

data

Size

471
Hash

829e839c217bf861b8cf90c8d636f510

459714fcf0d374bdc078ef59d122d59bf9312c5f

36282e09bb25caf3d7350c4bee485cb87947aabc7d7409169caf15c2e75d8b7d

HTTP Headers

                                        POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 3857
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Sat, 01 Oct 2022 22:19:00 GMT
Last-Modified: Sat, 01 Oct 2022 21:14:44 GMT
Server: ECS (ska/F70E)
X-Cache: HIT
Content-Length: 471

ocsp.globalsign.com/gsgccr3dvtlsca2020

104.18.20.226

200 OK

1414

URL HTTP/1.1

ocsp.globalsign.com/gsgccr3dvtlsca2020
IP

104.18.20.226:0
ASN

#13335 CLOUDFLARENET

Magic

data

Size

1414
Hash

c10f0b195485a82fc4a14aba20adb7ce

85f7dcfecca22b00d2298616b152b8951d7e86a0

40b530def758de3611bb1187fc814d3a53522d45aef3c5458c8f372612a0a19d

HTTP Headers

                                        POST /gsgccr3dvtlsca2020 HTTP/1.1
Host: ocsp.globalsign.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Date: Sat, 01 Oct 2022 22:19:00 GMT
Content-Type: application/ocsp-response
Content-Length: 1414
Connection: keep-alive
Expires: Wed, 05 Oct 2022 20:14:20 GMT
ETag: "85f7dcfecca22b00d2298616b152b8951d7e86a0"
Last-Modified: Sat, 01 Oct 2022 20:14:21 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: HIT
Age: 1559
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 753893d01fabb4fd-OSL

push.services.mozilla.com/

54.149.28.179

101 Switching Protocols

URL HTTP/1.1

push.services.mozilla.com/
IP

54.149.28.179:0
ASN

#16509 AMAZON-02

Magic

Size

0
Hash

d41d8cd98f00b204e9800998ecf8427e

da39a3ee5e6b4b0d3255bfef95601890afd80709

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

                                        GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: oLqX/aMfdoPPt1qmTmCtIA==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

                                        HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: Y53KrEt+9TxfGV+TKyH9QouOUwo=

js.users.51.la/21298305.js

103.143.19.103

200 OK

2310

URL HTTP/1.1

js.users.51.la/21298305.js
IP

103.143.19.103:0
ASN

#4837 CHINA UNICOM China169 Backbone

Magic

ASCII text, with very long lines (4898)

Size

2310
Hash

097392b4af4b906f08b9a1900af2a3d2

2afc7083c44b1dd721a26e31a055aa0a09a259a6

0ecd3dcd19492ba3f403c15549d48ebe658c0884ea6428e177a2926e50672adf

HTTP Headers

                                        GET /21298305.js HTTP/1.1
Host: js.users.51.la
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://nkvstpvkvo.duckdns.org/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        HTTP/1.1 200 OK
Server: CloudWAF
Date: Sat, 01 Oct 2022 22:19:00 GMT
Content-Type: application/javascript; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: HWWAFSESID=b64592537254bd6230d; path=/
HWWAFSESTIME=1664662738284; path=/
Cache-Control: max-age=360000
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Content-Encoding: gzip

nkvstpvkvo.duckdns.org/static/gs_vk/logo.png

45.88.168.143

200 OK

2973

URL HTTP/2

nkvstpvkvo.duckdns.org/static/gs_vk/logo.png
IP

45.88.168.143:0
ASN

#35913 DEDIPATH-LLC

Magic

PNG image data, 275 x 29, 8-bit/color RGBA, non-interlaced\012- data

Size

2973
Hash

c6d404ecaa7646ff497deaad55392996

1c66c5caf35e3e633d1cb1e09a334362ad11f5fb

bf1532dfb899554f52b0a98c2870c9a6f19e6abaf74288c6de321813fed91666

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected
openphish	National Tax Agency JAPAN

HTTP Headers

                                        GET /static/gs_vk/logo.png HTTP/1.1
Host: nkvstpvkvo.duckdns.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://nkvstpvkvo.duckdns.org/
Cookie: __tins__21298305=%7B%22sid%22%3A%201664662737406%2C%20%22vd%22%3A%201%2C%20%22expires%22%3A%201664664537406%7D; __51cke__=; __51laig__=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        HTTP/2 200 OK
server: nginx
date: Sat, 01 Oct 2022 22:19:01 GMT
content-type: image/png
content-length: 2973
last-modified: Tue, 09 Aug 2022 08:07:52 GMT
etag: "62f215d8-b9d"
expires: Mon, 31 Oct 2022 22:19:01 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2

ocsp.globalsign.com/gsrsaovsslca2018

104.18.20.226

200 OK

1432

URL HTTP/1.1

ocsp.globalsign.com/gsrsaovsslca2018
IP

104.18.20.226:0
ASN

#13335 CLOUDFLARENET

Magic

data

Size

1432
Hash

e46b247238f21320feb870ceffe90e90

4b4c85e13d281a12f5fbef493aa6ac356c7b4d1c

16ebf3e417211ea5548c8fb2097f881c046732c0fe0a7356908fc87fd501dbc7

HTTP Headers

                                        POST /gsrsaovsslca2018 HTTP/1.1
Host: ocsp.globalsign.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Date: Sat, 01 Oct 2022 22:19:01 GMT
Content-Type: application/ocsp-response
Content-Length: 1432
Connection: keep-alive
Expires: Wed, 05 Oct 2022 20:59:39 GMT
ETag: "4b4c85e13d281a12f5fbef493aa6ac356c7b4d1c"
Last-Modified: Sat, 01 Oct 2022 20:59:40 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: HIT
Age: 1559
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 753893d4bc6eb4fd-OSL

www.nta.go.jp/template/img/template/headerbackground.jpg

13.224.103.94

200 OK

29881

URL HTTP/2

www.nta.go.jp/template/img/template/headerbackground.jpg
IP

13.224.103.94:0
ASN

#16509 AMAZON-02

Magic

JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 980x113, components 3\012- data

Size

29881
Hash

e5e2087ec026ba50dceab21313cde200

32528b75731905a34f01e6b4cdf3937f72c4098f

9f7bcb50485acc2487f525f5d0d49bf0e3c239ee0150685a621b7e84d67818c7

HTTP Headers

                                        GET /template/img/template/headerbackground.jpg HTTP/1.1
Host: www.nta.go.jp
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://nkvstpvkvo.duckdns.org/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
content-type: image/jpeg
content-length: 29881
server: Apache
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
last-modified: Fri, 30 Mar 2018 05:48:34 GMT
accept-ranges: bytes
date: Sat, 01 Oct 2022 22:17:44 GMT
etag: "74b9-5689aca6dd080"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 4e0fd86f7afa735e772d6f7fe5e91f5a.cloudfront.net (CloudFront)
x-amz-cf-pop: ZRH50-C1
x-amz-cf-id: NI9YpMoRbWvZwqjbZuqb17Mq-BpleVjZru8mR2zkzsC6DKQFnBnyFQ==
age: 77
X-Firefox-Spdy: h2

ocsp.globalsign.com/gsgccr3dvtlsca2020

104.18.20.226

200 OK

1414

URL HTTP/1.1

ocsp.globalsign.com/gsgccr3dvtlsca2020
IP

104.18.20.226:0
ASN

#13335 CLOUDFLARENET

Magic

data

Size

1414
Hash

495a53cfdc7d1593cc894edf7799f66a

2ea288979ea7b0ba2f3cb2a9f2307d819441a59e

839f8c0a41e02da5e6d7132752e281c8b935635d716b0e36e8368c2a36083c6b

HTTP Headers

                                        POST /gsgccr3dvtlsca2020 HTTP/1.1
Host: ocsp.globalsign.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Date: Sat, 01 Oct 2022 22:19:01 GMT
Content-Type: application/ocsp-response
Content-Length: 1414
Connection: keep-alive
Expires: Wed, 05 Oct 2022 20:06:29 GMT
ETag: "2ea288979ea7b0ba2f3cb2a9f2307d819441a59e"
Last-Modified: Sat, 01 Oct 2022 20:06:30 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: HIT
Age: 3397
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 753893d76ee9b4fd-OSL

nkvstpvkvo.duckdns.org/static/gs_vk/syozai_icon.png

45.88.168.143

200 OK

1297

URL HTTP/2

nkvstpvkvo.duckdns.org/static/gs_vk/syozai_icon.png
IP

45.88.168.143:0
ASN

#35913 DEDIPATH-LLC

Magic

PNG image data, 15 x 24, 8-bit/color RGBA, non-interlaced\012- data

Size

1297
Hash

d038e6e8e4472bbcf6e5dac6a23d5a0e

fce966980cd73b2d732e0081b7e8dc9751db160d

5aa0964ac2cb5cbb5823d166f55495ac12747f3fbf2b56f7d290ac161eb2aead

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected
openphish	National Tax Agency JAPAN

HTTP Headers

                                        GET /static/gs_vk/syozai_icon.png HTTP/1.1
Host: nkvstpvkvo.duckdns.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://nkvstpvkvo.duckdns.org/
Cookie: __tins__21298305=%7B%22sid%22%3A%201664662737406%2C%20%22vd%22%3A%201%2C%20%22expires%22%3A%201664664537406%7D; __51cke__=; __51laig__=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        HTTP/2 200 OK
server: nginx
date: Sat, 01 Oct 2022 22:19:01 GMT
content-type: image/png
content-length: 1297
last-modified: Tue, 09 Aug 2022 08:07:52 GMT
etag: "62f215d8-511"
expires: Mon, 31 Oct 2022 22:19:01 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.76.226

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

23.36.76.226:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

f5e503471cc78b95c0a3e75785615e5f

145b1e4d850c145a78577b5d7d4fadae9658d7a4

61bf2bddece68c7876ab5481c14ed1b1879343e55c86ee013b4f3a8d3353e6b4

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "61BF2BDDECE68C7876AB5481C14ED1B1879343E55C86EE013B4F3A8D3353E6B4"
Last-Modified: Sat, 01 Oct 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8530
Expires: Sun, 02 Oct 2022 00:41:11 GMT
Date: Sat, 01 Oct 2022 22:19:01 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

23.36.76.226:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

f5e503471cc78b95c0a3e75785615e5f

145b1e4d850c145a78577b5d7d4fadae9658d7a4

61bf2bddece68c7876ab5481c14ed1b1879343e55c86ee013b4f3a8d3353e6b4

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "61BF2BDDECE68C7876AB5481C14ED1B1879343E55C86EE013B4F3A8D3353E6B4"
Last-Modified: Sat, 01 Oct 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8530
Expires: Sun, 02 Oct 2022 00:41:11 GMT
Date: Sat, 01 Oct 2022 22:19:01 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

23.36.76.226:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

f5e503471cc78b95c0a3e75785615e5f

145b1e4d850c145a78577b5d7d4fadae9658d7a4

61bf2bddece68c7876ab5481c14ed1b1879343e55c86ee013b4f3a8d3353e6b4

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "61BF2BDDECE68C7876AB5481C14ED1B1879343E55C86EE013B4F3A8D3353E6B4"
Last-Modified: Sat, 01 Oct 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8530
Expires: Sun, 02 Oct 2022 00:41:11 GMT
Date: Sat, 01 Oct 2022 22:19:01 GMT
Connection: keep-alive

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F61a78142-79d3-492f-a1bc-8f9016d71e67.jpeg

34.120.237.76

200 OK

15343

URL HTTP/2

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F61a78142-79d3-492f-a1bc-8f9016d71e67.jpeg
IP

34.120.237.76:0
ASN

#15169 GOOGLE

Magic

JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data

Size

15343
Hash

062b1abd4238d4d895b664802ab04547

0b6247645b3a1637717bb7ee83ce0771dce84546

b7565d1a9f6d33b9eb4be756b082a1e88995c52dfa21f275695dac19855031c7

HTTP Headers

                                        GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F61a78142-79d3-492f-a1bc-8f9016d71e67.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
server: nginx
content-length: 15343
x-amzn-requestid: e35696b7-7437-4e65-b85a-091af1ef744f
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZWDpnF7_IAMF29Q=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6338b30a-46f1951a226c39771f5fccb4;Sampled=0
x-amzn-remapped-date: Sat, 01 Oct 2022 21:37:14 GMT
x-amz-cf-pop: SEA73-P2, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: ootuzanDDyYWbZ9Vwsyn5G5r-4l59DJsqc0j2kHchPfuX2X6IEAqpQ==
via: 1.1 a8e5d5aeee6eacca5c379e5059b1f68c.cloudfront.net (CloudFront), 1.1 7eb3b782ab09047ce0d11ee03763894c.cloudfront.net (CloudFront), 1.1 google
date: Sat, 01 Oct 2022 21:47:13 GMT
age: 1908
etag: "0b6247645b3a1637717bb7ee83ce0771dce84546"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

6942

URL HTTP/2

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4230b0ca-f194-4ba4-bdd1-69ebd8421799.jpeg
IP

34.120.237.76:0
ASN

#15169 GOOGLE

Magic

JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data

Size

6942
Hash

91c3d94a9442b6a9c2103c8cda90ddcd

335a691d7ca92b74a69c349d7a25a8a15dbda5c8

38018ebad5d3ad8ad02c5bc732d0879a3275c28795e9dc141e35f673a03ce349

HTTP Headers

                                        GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4230b0ca-f194-4ba4-bdd1-69ebd8421799.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
server: nginx
content-length: 6942
x-amzn-requestid: 312f14b3-7734-4013-a652-1e0132f247eb
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZWDpnGewIAMF_1Q=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6338b30a-49ec997d74e55c63500e960f;Sampled=0
x-amzn-remapped-date: Sat, 01 Oct 2022 21:37:14 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: wowfOaUJdM-_XK1Tp8R6ItYDYUfRUmWLEyUhvfcLK6WHGzSw_1_vtw==
via: 1.1 efe54e8b68e074d39b2ecd249f85100a.cloudfront.net (CloudFront), 1.1 e95ec8f1dc02e32f0cb9e113963ceb4e.cloudfront.net (CloudFront), 1.1 google
date: Sat, 01 Oct 2022 21:52:27 GMT
age: 1594
etag: "335a691d7ca92b74a69c349d7a25a8a15dbda5c8"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

9600

URL HTTP/2

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F589e050c-3794-45f2-a218-269b944ae739.jpeg
IP

34.120.237.76:0
ASN

#15169 GOOGLE

Magic

JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data

Size

9600
Hash

11f2e40823827b62bca89d18ee279cb2

fa7e61b4f2864b8e51acb2cc887c15d5cb41ef38

c7811cb947483a033f31ff1e93b813f1bbc49b03ed78fcedab2090c71e5c4d1f

HTTP Headers

                                        GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F589e050c-3794-45f2-a218-269b944ae739.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
server: nginx
content-length: 9600
x-amzn-requestid: e83a86d3-f5ab-4645-92df-4b2da3d4afa3
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZWDgmFdlIAMFzQA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6338b2d0-48c3fa150800475c790b95bd;Sampled=0
x-amzn-remapped-date: Sat, 01 Oct 2022 21:36:16 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: f1aqkuvCub_vq9gBDgA4VL8hNf16FXzXhQjSHC1yDLISm85uOqJF9w==
via: 1.1 0c96ded7ff282d2dbcf47c918b6bb500.cloudfront.net (CloudFront), 1.1 6396e88c437c096ef98930ce29f731a2.cloudfront.net (CloudFront), 1.1 google
date: Sat, 01 Oct 2022 21:54:50 GMT
etag: "fa7e61b4f2864b8e51acb2cc887c15d5cb41ef38"
content-type: image/jpeg
age: 1451
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

11083

URL HTTP/2

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fccb5f775-a073-47ba-b076-ad1c96659b64.jpeg
IP

34.120.237.76:0
ASN

#15169 GOOGLE

Magic

JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data

Size

11083
Hash

edded48f558f739287a040151349ef67

d63b6ba630736d32c364b0e6a369274b2389b7ff

33b4a459df0ba7b36b907ba96d74e08660cc75640c42a5748b97d18ec2e9d533

HTTP Headers

                                        GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fccb5f775-a073-47ba-b076-ad1c96659b64.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
server: nginx
content-length: 11083
x-amzn-requestid: 53e2c961-bcc0-4977-8648-ee3c1aed9cde
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZWEHRFWfIAMFhlA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6338b3c7-070212d7386d5efa1b4aa8d3;Sampled=0
x-amzn-remapped-date: Sat, 01 Oct 2022 21:40:23 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: Z1KmxHJh9QNfg5x0enkqOjbmiqHvg7nlQiMnuDuCRNWQUBFEiKELbw==
via: 1.1 49b94a8674d6e86a841d6523f7dbaf14.cloudfront.net (CloudFront), 1.1 31119c39c5a6dc62dfa1fe940afd7be2.cloudfront.net (CloudFront), 1.1 google
date: Sat, 01 Oct 2022 21:53:35 GMT
etag: "d63b6ba630736d32c364b0e6a369274b2389b7ff"
content-type: image/jpeg
age: 1526
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

6315

URL HTTP/2

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F180dee10-1cde-4fbe-8a74-62b7b3bdb1e2.jpeg
IP

34.120.237.76:0
ASN

#15169 GOOGLE

Magic

JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data

Size

6315
Hash

206fb65e75dbadf119512f71e0b78402

58ff0bf8ce7528b303d28bab01a80ad721705569

56c8d5f3b3060ee54bf81995269b86c070855d8c33bf437161339a45b309703f

HTTP Headers

                                        GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F180dee10-1cde-4fbe-8a74-62b7b3bdb1e2.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
server: nginx
content-length: 6315
x-amzn-requestid: f0791b53-3c5f-4d94-954d-992a529ebb60
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZPnunF35oAMFYbg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63361ff6-2adb303349153ced73ccecf6;Sampled=0
x-amzn-remapped-date: Thu, 29 Sep 2022 22:45:10 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: F3fk5JnJ9ZFNPan-8DuLb4kuTiYKfniBar3qNlsuqd8a0saW3sEGvQ==
via: 1.1 470e3fe246a660ba6ace67a79f78d246.cloudfront.net (CloudFront), 1.1 1b74ccf4cb51eacf97a0e6d60ae46a3e.cloudfront.net (CloudFront), 1.1 google
date: Sat, 01 Oct 2022 04:41:31 GMT
age: 63450
etag: "58ff0bf8ce7528b303d28bab01a80ad721705569"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

6101

URL HTTP/2

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd7a6e7d5-efdf-4904-b660-ffb0d8ffd4d3.jpeg
IP

34.120.237.76:0
ASN

#15169 GOOGLE

Magic

JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data

Size

6101
Hash

e711c6bf0d0808f0b5c57b80916eba4d

36c8dcdfdc2c59246ba9d999ddffd5387f68155e

e252f3c857e18ddaea7059bfb19826ac5e47c694ce57068d85f60bd1ac5f6c25

HTTP Headers

                                        GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd7a6e7d5-efdf-4904-b660-ffb0d8ffd4d3.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
server: nginx
content-length: 6101
x-amzn-requestid: 0edbc5d1-324f-4b4f-a55c-b9333f2bb6a2
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZWDpnFumIAMFoEg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6338b30a-1422f70670e89174415c1aba;Sampled=0
x-amzn-remapped-date: Sat, 01 Oct 2022 21:37:14 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: hG5L6pTNHLcM-nBovmH6kFuFK5oXJuxVWsnaffj6L8bDlGnpFVJFKg==
via: 1.1 446313511980eb02f28ff5a9a4147c0a.cloudfront.net (CloudFront), 1.1 35575576af8067e30cfb17c6b9fde8e2.cloudfront.net (CloudFront), 1.1 google
date: Sat, 01 Oct 2022 21:55:55 GMT
age: 1386
etag: "36c8dcdfdc2c59246ba9d999ddffd5387f68155e"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

nkvstpvkvo.duckdns.org/static/gs_vk/banner.png

45.88.168.143

200 OK

220877

URL HTTP/2

nkvstpvkvo.duckdns.org/static/gs_vk/banner.png
IP

45.88.168.143:0
ASN

#35913 DEDIPATH-LLC

Magic

PNG image data, 670 x 238, 8-bit/color RGB, non-interlaced\012- data

Size

220877
Hash

2f987a1099c7a986fa860cf0e80d7b5d

0a3e6dfbf3b0e7d361ba9fc088e2ef7805ec0310

2fe3b5cadeb4ad9fec7ee39d1f2170c6bb656436597087aa9a582713e53bed75

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected
openphish	National Tax Agency JAPAN

HTTP Headers

                                        GET /static/gs_vk/banner.png HTTP/1.1
Host: nkvstpvkvo.duckdns.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://nkvstpvkvo.duckdns.org/
Cookie: __tins__21298305=%7B%22sid%22%3A%201664662737406%2C%20%22vd%22%3A%201%2C%20%22expires%22%3A%201664664537406%7D; __51cke__=; __51laig__=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        HTTP/2 200 OK
server: nginx
date: Sat, 01 Oct 2022 22:19:01 GMT
content-type: image/png
content-length: 220877
last-modified: Tue, 09 Aug 2022 08:07:52 GMT
etag: "62f215d8-35ecd"
expires: Mon, 31 Oct 2022 22:19:01 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2

nkvstpvkvo.duckdns.org/static/gs_vk/public.css

45.88.168.143

200 OK

104851

URL HTTP/2

nkvstpvkvo.duckdns.org/static/gs_vk/public.css
IP

45.88.168.143:0
ASN

#35913 DEDIPATH-LLC

Magic

data

Size

104851
Hash

712025314909ae6bb393c5056a20d2a7

27e3278b2711a316b4ed1bb5c189c9a88a35ab62

6d5e4d1db12268b5c9625fbe7ac5464e5bc23b4f04de30d84b46b7c9572671f4

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected
openphish	National Tax Agency JAPAN

HTTP Headers

                                        GET /static/gs_vk/public.css HTTP/1.1
Host: nkvstpvkvo.duckdns.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://nkvstpvkvo.duckdns.org/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        HTTP/2 200 OK
server: nginx
date: Sat, 01 Oct 2022 22:18:59 GMT
content-type: text/css
last-modified: Tue, 09 Aug 2022 08:07:52 GMT
vary: Accept-Encoding
etag: W/"62f215d8-818"
expires: Sun, 02 Oct 2022 10:18:59 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
content-encoding: gzip
X-Firefox-Spdy: h2

nkvstpvkvo.duckdns.org/favicon.ico

45.88.168.143

404 Not Found

146

URL HTTP/2

nkvstpvkvo.duckdns.org/favicon.ico
IP

45.88.168.143:0
ASN

#35913 DEDIPATH-LLC

Magic

HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators

Size

146
Hash

8eec510e57f5f732fd2cce73df7b73ef

3c0af39ecb3753c5fee3b53d063c7286019eac3b

55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected
openphish	National Tax Agency JAPAN

HTTP Headers

                                        GET /favicon.ico HTTP/1.1
Host: nkvstpvkvo.duckdns.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://nkvstpvkvo.duckdns.org/
Cookie: __tins__21298305=%7B%22sid%22%3A%201664662737406%2C%20%22vd%22%3A%201%2C%20%22expires%22%3A%201664664537406%7D; __51cke__=; __51laig__=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        HTTP/2 404 Not Found
server: nginx
date: Sat, 01 Oct 2022 22:19:01 GMT
content-type: text/html
content-length: 146
X-Firefox-Spdy: h2

ia.51.la/go1?id=21298305&rt=1664662737406&rl=1280*1024&lang=en-US&ct=unknow&pf=1&ins=1&vd=1&ce=1&cd=24&ds=&ing=1&ekc=&sid=1664662737406&tt=&kw=&cu=https%253A%252F%252Fnkvstpvkvo.duckdns.org%252F&pu=

103.143.19.103

200

URL HTTP/1.1

ia.51.la/go1?id=21298305&rt=1664662737406&rl=1280*1024&lang=en-US&ct=unknow&pf=1&ins=1&vd=1&ce=1&cd=24&ds=&ing=1&ekc=&sid=1664662737406&tt=&kw=&cu=https%253A%252F%252Fnkvstpvkvo.duckdns.org%252F&pu=
IP

103.143.19.103:0
ASN

#4837 CHINA UNICOM China169 Backbone

Magic

Size

0
Hash

d41d8cd98f00b204e9800998ecf8427e

da39a3ee5e6b4b0d3255bfef95601890afd80709

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

                                        GET /go1?id=21298305&rt=1664662737406&rl=1280*1024&lang=en-US&ct=unknow&pf=1&ins=1&vd=1&ce=1&cd=24&ds=&ing=1&ekc=&sid=1664662737406&tt=&kw=&cu=https%253A%252F%252Fnkvstpvkvo.duckdns.org%252F&pu= HTTP/1.1
Host: ia.51.la
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://nkvstpvkvo.duckdns.org/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        HTTP/1.1 200 
Server: CloudWAF
Date: Sat, 01 Oct 2022 22:19:02 GMT
Content-Length: 0
Connection: keep-alive
Set-Cookie: HWWAFSESID=9c990259529dc930377; path=/
HWWAFSESTIME=1664662740729; path=/

nkvstpvkvo.duckdns.org/static/js/jquery-3.3.1.min.js

45.88.168.143

200 OK

URL HTTP/2

nkvstpvkvo.duckdns.org/static/js/jquery-3.3.1.min.js
IP

45.88.168.143:0
ASN

#35913 DEDIPATH-LLC

Magic

Size

0
Hash

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected
openphish	National Tax Agency JAPAN
fortinet	Phishing

HTTP Headers

                                        GET /static/js/jquery-3.3.1.min.js HTTP/1.1
Host: nkvstpvkvo.duckdns.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://nkvstpvkvo.duckdns.org/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        HTTP/2 200 OK
server: nginx
date: Sat, 01 Oct 2022 22:18:59 GMT
content-type: application/javascript
last-modified: Thu, 17 Mar 2022 06:46:10 GMT
vary: Accept-Encoding
etag: W/"6232d932-1538f"
expires: Sun, 02 Oct 2022 10:18:59 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
content-encoding: gzip
X-Firefox-Spdy: h2

nkvstpvkvo.duckdns.org/static/js/jquery.cookie.js

45.88.168.143

200 OK

URL HTTP/2

nkvstpvkvo.duckdns.org/static/js/jquery.cookie.js
IP

45.88.168.143:0
ASN

#35913 DEDIPATH-LLC

Magic

Size

0
Hash

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected
openphish	National Tax Agency JAPAN
fortinet	Phishing

HTTP Headers

                                        GET /static/js/jquery.cookie.js HTTP/1.1
Host: nkvstpvkvo.duckdns.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://nkvstpvkvo.duckdns.org/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        HTTP/2 200 OK
server: nginx
date: Sat, 01 Oct 2022 22:18:59 GMT
content-type: application/javascript
last-modified: Thu, 17 Mar 2022 06:46:10 GMT
vary: Accept-Encoding
etag: W/"6232d932-c31"
expires: Sun, 02 Oct 2022 10:18:59 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
content-encoding: gzip
X-Firefox-Spdy: h2

nkvstpvkvo.duckdns.org/

45.88.168.143

200 OK

URL HTTP/2

nkvstpvkvo.duckdns.org/
IP

45.88.168.143:0
ASN

#35913 DEDIPATH-LLC

Magic

Size

0
Hash

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected
openphish	National Tax Agency JAPAN
fortinet	Phishing

HTTP Headers

                                        GET / HTTP/1.1
Host: nkvstpvkvo.duckdns.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

                                        HTTP/2 200 OK
server: nginx
date: Sat, 01 Oct 2022 22:18:59 GMT
content-type: text/html
last-modified: Tue, 13 Sep 2022 09:41:02 GMT
vary: Accept-Encoding
etag: W/"6320502e-1727"
strict-transport-security: max-age=31536000
content-encoding: gzip
X-Firefox-Spdy: h2

Report Overview

URL

IP

ASN

Submitted

Access

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

JavaScript (6)

#1 JS:Script (size: 86927)

#2 JS:Script (size: 3121)

#3 JS:Script (size: 4899)

#4 JS:Script (size: 4743)

#5 JS:Script (size: 230)

#1 JS:Write (size: 502)

HTTP Transactions (33)

URL HTTP/1.1

IP

ASN

Magic

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

Magic

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

Magic

Size

Hash

HTTP Headers

URL HTTP/2

IP

ASN

Magic

Size

Hash

HTTP Headers

URL HTTP/2

IP

ASN

Magic

Size

Hash

HTTP Headers

URL HTTP/2

IP

ASN

Magic

Size

Hash

Detections

HTTP Headers

URL HTTP/2

IP

ASN

Magic

Size

Hash

Detections