Report - hnbhnbecubnkhld.duckdns.org/becu/gif/index.html?s2kHXBuJ5dikkq3fbXqtHEWQm8Y9pShePEqRpuHcVXjxsXMLC12STXwxjvbnSeqLb5ayxlFGK6WuqlzUSiKIO1kV621qU6kBJGmY5ZorkoYf1AsG9O5Tkdi3O5hm7Pi1cpxfr

Report Overview

Submitted URL
hnbhnbecubnkhld.duckdns.org/becu/gif/index.html?s2kHXBuJ5dikkq3fbXqtHEWQm8Y9pShePEqRpuHcVXjxsXMLC12STXwxjvbnSeqLb5ayxlFGK6WuqlzUSiKIO1kV621qU6kBJGmY5ZorkoYf1AsG9O5Tkdi3O5hm7Pi1cpxfr
IP
163.123.141.198
ASN
#213035 Des Capital B.V.
Submitted
2023-02-07 03:35:34
Access
Website Title
Final URL
Tags
dyndns
urlquery detections
Suspicious - DynDNS domain

Detections

urlquery
28
Network Intrusion Detection
31
Threat Detection Systems
28

Domain Summary

Domain / FQDN	Rank	First Seen	Last Seen	Sent	Received	IP
contile.services.mozilla.com	1114	2021-05-27T20:32:35Z	2023-03-13T05:09:13Z	333 B	391 B	34.117.237.239
push.services.mozilla.com	2140	2014-10-24T10:27:06Z	2023-03-13T05:09:14Z	606 B	127 B	54.149.129.99
img-getpocket.cdn.mozilla.net	1631	2018-06-22T01:36:00Z	2023-03-13T05:09:16Z	3.2 kB	58 kB	34.120.237.76
hnbhnbecubnkhld.duckdns.org	unknown	2023-02-06T20:55:19Z	2023-02-06T20:55:19Z	13 kB	234 kB	163.123.141.198
r3.o.lencr.org	344	2020-12-02T09:52:13Z	2023-03-13T05:09:07Z	2.4 kB	6.2 kB	95.101.11.115
firefox.settings.services.mozilla.com	867	2020-06-04T22:08:41Z	2023-03-13T05:09:10Z	782 B	2.4 kB	35.241.9.150
content-signature-2.cdn.mozilla.net	1152	2020-11-03T13:26:46Z	2023-03-13T05:09:35Z	413 B	5.9 kB	34.160.144.191

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-02-07 03:36:11	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain
2023-02-07 03:36:11	low	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
2023-02-07 03:36:11	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain
2023-02-07 03:36:11	low	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
2023-02-07 03:36:11	medium	Client IP	163.123.141.198	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
2023-02-07 03:36:11	medium	Client IP	163.123.141.198	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
2023-02-07 03:36:11	medium	Client IP	163.123.141.198	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
2023-02-07 03:36:12	medium	Client IP	163.123.141.198	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
2023-02-07 03:36:12	medium	Client IP	163.123.141.198	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
2023-02-07 03:36:12	medium	Client IP	163.123.141.198	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
2023-02-07 03:36:12	medium	Client IP	163.123.141.198	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
2023-02-07 03:36:12	medium	Client IP	163.123.141.198	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
2023-02-07 03:36:12	medium	Client IP	163.123.141.198	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
2023-02-07 03:36:12	medium	Client IP	163.123.141.198	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
2023-02-07 03:36:12	medium	Client IP	163.123.141.198	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
2023-02-07 03:36:12	medium	Client IP	163.123.141.198	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
2023-02-07 03:36:12	medium	Client IP	163.123.141.198	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
2023-02-07 03:36:12	medium	Client IP	163.123.141.198	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
2023-02-07 03:36:12	medium	Client IP	163.123.141.198	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
2023-02-07 03:36:12	medium	Client IP	163.123.141.198	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
2023-02-07 03:36:12	medium	Client IP	163.123.141.198	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
2023-02-07 03:36:12	medium	Client IP	163.123.141.198	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
2023-02-07 03:36:12	medium	Client IP	163.123.141.198	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
2023-02-07 03:36:12	medium	Client IP	163.123.141.198	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
2023-02-07 03:36:12	medium	Client IP	163.123.141.198	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
2023-02-07 03:36:12	medium	Client IP	163.123.141.198	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
2023-02-07 03:36:12	medium	Client IP	163.123.141.198	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
2023-02-07 03:36:12	medium	Client IP	163.123.141.198	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
2023-02-07 03:36:12	medium	Client IP	163.123.141.198	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
2023-02-07 03:36:12	medium	Client IP	163.123.141.198	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
2023-02-07 03:36:12	medium	Client IP	163.123.141.198	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain

Threat Detection Systems

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

Scan Date	Severity	Indicator	Alert
2023-02-07	medium	hnbhnbecubnkhld.duckdns.org/becu/gif/index_1.html	Phishing
2023-02-07	medium	hnbhnbecubnkhld.duckdns.org/becu/gif/Icon_YouTube.svg	Phishing
2023-02-07	medium	hnbhnbecubnkhld.duckdns.org/becu/gif/Icon_Twitter.svg	Phishing
2023-02-07	medium	hnbhnbecubnkhld.duckdns.org/becu/gif/Icon_Pinterest.svg	Phishing
2023-02-07	medium	hnbhnbecubnkhld.duckdns.org/becu/gif/Icon_Facebook.svg	Phishing
2023-02-07	medium	hnbhnbecubnkhld.duckdns.org/becu/gif/Icon_LinkedIn.svg	Phishing
2023-02-07	medium	hnbhnbecubnkhld.duckdns.org/becu/gif/Icon_Instagram.svg	Phishing
2023-02-07	medium	hnbhnbecubnkhld.duckdns.org/becu/gif/S6uyw4BMUTPHjx4wXiWtFCc.woff2	Phishing
2023-02-07	medium	hnbhnbecubnkhld.duckdns.org/becu/gif/becu-icons.woff	Phishing
2023-02-07	medium	hnbhnbecubnkhld.duckdns.org/becu/gif/S6u9w4BMUTPHh6UVSwiPGQ3q5d0.woff2	Phishing
2023-02-07	medium	hnbhnbecubnkhld.duckdns.org/becu/gif/358A1A_9_0.woff2	Phishing
2023-02-07	medium	hnbhnbecubnkhld.duckdns.org/becu/gif/358A1A_1_0.woff2	Phishing
2023-02-07	medium	hnbhnbecubnkhld.duckdns.org/becu/gif/358A1A_3_0.woff2	Phishing
2023-02-07	medium	hnbhnbecubnkhld.duckdns.org/becu/gif/358A1A_0_0.woff2	Phishing

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (0)

HTTP Transactions (45)

URL IP Response Size

hnbhnbecubnkhld.duckdns.org/becu/gif/index.html?s2kHXBuJ5dikkq3fbXqtHEWQm8Y9pShePEqRpuHcVXjxsXMLC12STXwxjvbnSeqLb5ayxlFGK6WuqlzUSiKIO1kV621qU6kBJGmY5ZorkoYf1AsG9O5Tkdi3O5hm7Pi1cpxfr

163.123.141.198

200 OK

11 kB

URL HTTP/1.1
hnbhnbecubnkhld.duckdns.org/becu/gif/index.html?s2kHXBuJ5dikkq3fbXqtHEWQm8Y9pShePEqRpuHcVXjxsXMLC12STXwxjvbnSeqLb5ayxlFGK6WuqlzUSiKIO1kV621qU6kBJGmY5ZorkoYf1AsG9O5Tkdi3O5hm7Pi1cpxfr
IP
163.123.141.198:0
ASN
#213035 Des Capital B.V.

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (5978)
Size
11 kB (10591 bytes)
Hash
d4f36dc2bdb6bc72952cb69aa777457d
71da03cd61c91ea5c0182b668ac2629dba1b0afb
8721668af0c7fe2da6490d998d803f58fdac0dcacc1804c41e620137c08954ce

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain

NIDS	Severity	Alert
suricata	medium	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain

HTTP Headers

GET /becu/gif/index.html?s2kHXBuJ5dikkq3fbXqtHEWQm8Y9pShePEqRpuHcVXjxsXMLC12STXwxjvbnSeqLb5ayxlFGK6WuqlzUSiKIO1kV621qU6kBJGmY5ZorkoYf1AsG9O5Tkdi3O5hm7Pi1cpxfr HTTP/1.1
Host: hnbhnbecubnkhld.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 07 Feb 2023 03:35:23 GMT
Content-Type: text/html
Last-Modified: Mon, 06 Feb 2023 20:19:20 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=60
Vary: Accept-Encoding
ETag: W/"63e160c8-74c3"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Content-Encoding: gzip

r3.o.lencr.org/

95.101.11.115

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
95.101.11.115:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
c21ba65e44ac95470c314e068e49a9eb
17a13b13738993d889d4afa3d848dc63bf6eba64
9bd0795b30e84ce63b6e2a365ca91bbffc395dd955e112152066c31e63a4ab66

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "9BD0795B30E84CE63B6E2A365CA91BBFFC395DD955E112152066C31E63A4AB66"
Last-Modified: Sat, 04 Feb 2023 11:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4376
Expires: Tue, 07 Feb 2023 04:48:19 GMT
Date: Tue, 07 Feb 2023 03:35:23 GMT
Connection: keep-alive

r3.o.lencr.org/

95.101.11.115

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
95.101.11.115:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
dca68db7aea32f6683ce8d542c078f04
19c495238df74fca680e21f18627ff94de5dd2e5
35cab3987fc0e4a41b305cb208c1e33fa38ce8bdfd9f386c3dc0411dd4d5ac61

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "35CAB3987FC0E4A41B305CB208C1E33FA38CE8BDFD9F386C3DC0411DD4D5AC61"
Last-Modified: Mon, 06 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3051
Expires: Tue, 07 Feb 2023 04:26:14 GMT
Date: Tue, 07 Feb 2023 03:35:23 GMT
Connection: keep-alive

firefox.settings.services.mozilla.com/v1/

35.241.9.150

200 OK

939 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size
939 B (939 bytes)
Hash
ff250d3ef3fa45322bf05039a0122a9f
b3e7a2c383bce1bab807dbe1a03c375258b51f1d
d07f109a96e0ae6ec7b1d46ce8761b3f06fe845769ce65d69e053dd40aa561ba

HTTP Headers

GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Retry-After, Content-Length, Content-Type, Alert, Backoff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Tue, 07 Feb 2023 03:34:06 GMT
content-type: application/json
age: 77
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

95.101.11.115

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
95.101.11.115:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
cc14b0d2f7c451f6431dc87ba54d1d60
bab8bfda6fa3e2f17125353f5147211787dc25d0
b58fe18a5cc8fe5aaf49ba7eadd0ef34692892e68e9c52eb5bb56ea27e1300ad

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "B58FE18A5CC8FE5AAF49BA7EADD0EF34692892E68E9C52EB5BB56EA27E1300AD"
Last-Modified: Mon, 06 Feb 2023 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12052
Expires: Tue, 07 Feb 2023 06:56:15 GMT
Date: Tue, 07 Feb 2023 03:35:23 GMT
Connection: keep-alive

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-03-20-18-44-46.chain

34.160.144.191

200 OK

5.3 kB

URL HTTP/2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-03-20-18-44-46.chain
IP
34.160.144.191:0
ASN
#15169 GOOGLE

File type
PEM certificate\012- , ASCII text
Size
5.3 kB (5348 bytes)
Hash
e76071a28ee566dababb3834f46d68ed
aebb4e68c1ba2de0f90025283e8ed8470944fde0
78b6df2627172e5b35476bc31020f02898cdc412aaf4337af2c3b049a60912b6

HTTP Headers

GET /chains/remote-settings.content-signature.mozilla.org-2023-03-20-18-44-46.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
x-amz-id-2: LqfzeB5WTmTB7YMVpTT3cgT7AxCg2qNr5FaOZFyTyUlr1NDQ5eBb53P2CEPSWCHTEQoUU0NjQNtBseaxQXWSqg==
x-amz-request-id: 4N6ANXH68BMJ6ZWD
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Tue, 07 Feb 2023 02:45:24 GMT
age: 2999
last-modified: Sun, 29 Jan 2023 18:44:47 GMT
etag: "e76071a28ee566dababb3834f46d68ed"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

12 B

URL HTTP/2
contile.services.mozilla.com/v1/tiles
IP
34.117.237.239:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with no line terminators
Size
12 B (12 bytes)
Hash
23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Tue, 07 Feb 2023 03:35:23 GMT
content-type: application/json
content-length: 12
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-expose-headers: content-type
access-control-allow-credentials: true
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

hnbhnbecubnkhld.duckdns.org/becu/gif/index_1.html

163.123.141.198

200 OK

97 B

URL HTTP/1.1
hnbhnbecubnkhld.duckdns.org/becu/gif/index_1.html
IP
163.123.141.198:0
ASN
#213035 Des Capital B.V.

File type
HTML document text\012- HTML document, ASCII text, with no line terminators
Size
97 B (97 bytes)
Hash
948c3b0b89a440438cb10c44dfb25fba
e4d35e5e283c4cfea043a022a3b06f0e85d231eb
3de2c358acd98dd93f54af55a7d89ae64cca5757d76fb95ae74db8bd63389bdd

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain
fortinet	Phishing

NIDS	Severity	Alert
suricata	medium	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain

HTTP Headers

GET /becu/gif/index_1.html HTTP/1.1
Host: hnbhnbecubnkhld.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://hnbhnbecubnkhld.duckdns.org/becu/gif/index.html?s2kHXBuJ5dikkq3fbXqtHEWQm8Y9pShePEqRpuHcVXjxsXMLC12STXwxjvbnSeqLb5ayxlFGK6WuqlzUSiKIO1kV621qU6kBJGmY5ZorkoYf1AsG9O5Tkdi3O5hm7Pi1cpxfr
Upgrade-Insecure-Requests: 1

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 07 Feb 2023 03:35:23 GMT
Content-Type: text/html
Content-Length: 97
Last-Modified: Mon, 06 Feb 2023 20:19:24 GMT
Connection: keep-alive
Keep-Alive: timeout=60
ETag: "63e160cc-61"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Accept-Ranges: bytes

hnbhnbecubnkhld.duckdns.org/becu/gif/DESGetFiles.aspx.css

163.123.141.198

200 OK

371 B

URL HTTP/1.1
hnbhnbecubnkhld.duckdns.org/becu/gif/DESGetFiles.aspx.css
IP
163.123.141.198:0
ASN
#213035 Des Capital B.V.

File type
ASCII text
Size
371 B (371 bytes)
Hash
5aeb71e86c717c654826517af44a1d6a
10fae29b4b505a1a6af1c784358c5d5e67e87aa1
e5f446831de9af326e0ec3890db4429abba96d0d47b6675bc819ed13e0dcf320

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain

NIDS	Severity	Alert
suricata	medium	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain

HTTP Headers

GET /becu/gif/DESGetFiles.aspx.css HTTP/1.1
Host: hnbhnbecubnkhld.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://hnbhnbecubnkhld.duckdns.org/becu/gif/index.html?s2kHXBuJ5dikkq3fbXqtHEWQm8Y9pShePEqRpuHcVXjxsXMLC12STXwxjvbnSeqLb5ayxlFGK6WuqlzUSiKIO1kV621qU6kBJGmY5ZorkoYf1AsG9O5Tkdi3O5hm7Pi1cpxfr

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 07 Feb 2023 03:35:24 GMT
Content-Type: text/css
Last-Modified: Mon, 06 Feb 2023 20:19:27 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=60
Vary: Accept-Encoding
ETag: W/"63e160cf-46d"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Content-Encoding: gzip

hnbhnbecubnkhld.duckdns.org/becu/gif/BECU_MuseoSans_webfontKit02.css

163.123.141.198

200 OK

713 B

URL HTTP/1.1
hnbhnbecubnkhld.duckdns.org/becu/gif/BECU_MuseoSans_webfontKit02.css
IP
163.123.141.198:0
ASN
#213035 Des Capital B.V.

File type
Unicode text, UTF-8 text
Size
713 B (713 bytes)
Hash
77b19ccc64f9236dcecb0c8aedc193e0
06860485fa60395a373489ce6feee6fb0a2d64a1
79751e5d0581ab178ce9b3259ea6114626875b94cac4100da2d0dbd175dbb07b

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain

NIDS	Severity	Alert
suricata	medium	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain

HTTP Headers

GET /becu/gif/BECU_MuseoSans_webfontKit02.css HTTP/1.1
Host: hnbhnbecubnkhld.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://hnbhnbecubnkhld.duckdns.org/becu/gif/index.html?s2kHXBuJ5dikkq3fbXqtHEWQm8Y9pShePEqRpuHcVXjxsXMLC12STXwxjvbnSeqLb5ayxlFGK6WuqlzUSiKIO1kV621qU6kBJGmY5ZorkoYf1AsG9O5Tkdi3O5hm7Pi1cpxfr

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 07 Feb 2023 03:35:24 GMT
Content-Type: text/css
Last-Modified: Mon, 06 Feb 2023 20:19:35 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=60
Vary: Accept-Encoding
ETag: W/"63e160d7-f96"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Content-Encoding: gzip

hnbhnbecubnkhld.duckdns.org/becu/gif/becu-olb.min.css

163.123.141.198

200 OK

39 kB

URL HTTP/1.1
hnbhnbecubnkhld.duckdns.org/becu/gif/becu-olb.min.css
IP
163.123.141.198:0
ASN
#213035 Des Capital B.V.

File type
Unicode text, UTF-8 (with BOM) text, with very long lines (62958)
Size
39 kB (38612 bytes)
Hash
d2e08ce381a19cce0a4a825251e8d0af
93f9971d43fd402de19ea64ba4a4e49098694a72
1d01066800f527ed8d3c9c376dca956e720e101c753f0a17cf1de16446aadbdf

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain

NIDS	Severity	Alert
suricata	medium	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain

HTTP Headers

GET /becu/gif/becu-olb.min.css HTTP/1.1
Host: hnbhnbecubnkhld.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://hnbhnbecubnkhld.duckdns.org/becu/gif/index.html?s2kHXBuJ5dikkq3fbXqtHEWQm8Y9pShePEqRpuHcVXjxsXMLC12STXwxjvbnSeqLb5ayxlFGK6WuqlzUSiKIO1kV621qU6kBJGmY5ZorkoYf1AsG9O5Tkdi3O5hm7Pi1cpxfr

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 07 Feb 2023 03:35:23 GMT
Content-Type: text/css
Last-Modified: Mon, 06 Feb 2023 20:19:17 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=60
Vary: Accept-Encoding
ETag: W/"63e160c5-3ab6f"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Content-Encoding: gzip

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

35.241.9.150

200 OK

329 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size
329 B (329 bytes)
Hash
0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

HTTP Headers

GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Expires, Retry-After, Content-Length, Content-Type, ETag, Cache-Control, Alert, Pragma, Backoff, Last-Modified
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Tue, 07 Feb 2023 02:51:19 GMT
age: 2645
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

hnbhnbecubnkhld.duckdns.org/becu/gif/becu-logo-desktop.png

163.123.141.198

200 OK

3.3 kB

URL HTTP/1.1
hnbhnbecubnkhld.duckdns.org/becu/gif/becu-logo-desktop.png
IP
163.123.141.198:0
ASN
#213035 Des Capital B.V.

File type
PNG image data, 175 x 55, 8-bit/color RGBA, non-interlaced\012- data
Size
3.3 kB (3289 bytes)
Hash
20f678e721980236a84726cff4fc2992
249a2742d92b9192bd94f35b95b034587f6470c7
c25e1eb12d082ca91060a9f463cad441e8efe5687ecb0b6d946219eb683ce42a

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain

NIDS	Severity	Alert
suricata	medium	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain

HTTP Headers

GET /becu/gif/becu-logo-desktop.png HTTP/1.1
Host: hnbhnbecubnkhld.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://hnbhnbecubnkhld.duckdns.org/becu/gif/index.html?s2kHXBuJ5dikkq3fbXqtHEWQm8Y9pShePEqRpuHcVXjxsXMLC12STXwxjvbnSeqLb5ayxlFGK6WuqlzUSiKIO1kV621qU6kBJGmY5ZorkoYf1AsG9O5Tkdi3O5hm7Pi1cpxfr

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 07 Feb 2023 03:35:24 GMT
Content-Type: image/png
Content-Length: 3289
Last-Modified: Mon, 06 Feb 2023 20:19:20 GMT
Connection: keep-alive
Keep-Alive: timeout=60
ETag: "63e160c8-cd9"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Accept-Ranges: bytes

hnbhnbecubnkhld.duckdns.org/becu/gif/becu-logo-tablet.png

163.123.141.198

200 OK

2.3 kB

URL HTTP/1.1
hnbhnbecubnkhld.duckdns.org/becu/gif/becu-logo-tablet.png
IP
163.123.141.198:0
ASN
#213035 Des Capital B.V.

File type
PNG image data, 120 x 38, 8-bit/color RGBA, non-interlaced\012- data
Size
2.3 kB (2324 bytes)
Hash
067dce671072a4f71212d7f732b4834b
92692bb8c9dfa84d8e2592c33d9bc5f2f4dbd0d1
8278a26d76affc3ec5de77cb8c69af07fe5efd2d52ee0c048f4a8649b627f804

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain

NIDS	Severity	Alert
suricata	medium	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain

HTTP Headers

GET /becu/gif/becu-logo-tablet.png HTTP/1.1
Host: hnbhnbecubnkhld.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://hnbhnbecubnkhld.duckdns.org/becu/gif/index.html?s2kHXBuJ5dikkq3fbXqtHEWQm8Y9pShePEqRpuHcVXjxsXMLC12STXwxjvbnSeqLb5ayxlFGK6WuqlzUSiKIO1kV621qU6kBJGmY5ZorkoYf1AsG9O5Tkdi3O5hm7Pi1cpxfr

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 07 Feb 2023 03:35:24 GMT
Content-Type: image/png
Content-Length: 2324
Last-Modified: Mon, 06 Feb 2023 20:19:34 GMT
Connection: keep-alive
Keep-Alive: timeout=60
ETag: "63e160d6-914"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Accept-Ranges: bytes

hnbhnbecubnkhld.duckdns.org/becu/gif/Icon_YouTube.svg

163.123.141.198

200 OK

357 B

URL HTTP/1.1
hnbhnbecubnkhld.duckdns.org/becu/gif/Icon_YouTube.svg
IP
163.123.141.198:0
ASN
#213035 Des Capital B.V.

File type
SVG Scalable Vector Graphics image\012- HTML document text\012- HTML document, ASCII text, with very long lines (556), with no line terminators
Size
357 B (357 bytes)
Hash
f0bedac98929a4a458e687b09788bc85
cf53b3fd09130ea079bf5c18947b1d6f4bd4a9f2
df410faa1948035f9fa362015e9fa34c3f18dc92bc216b9a75d7e7cb72cf7eb7

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain
fortinet	Phishing

NIDS	Severity	Alert
suricata	medium	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain

HTTP Headers

GET /becu/gif/Icon_YouTube.svg HTTP/1.1
Host: hnbhnbecubnkhld.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://hnbhnbecubnkhld.duckdns.org/becu/gif/index.html?s2kHXBuJ5dikkq3fbXqtHEWQm8Y9pShePEqRpuHcVXjxsXMLC12STXwxjvbnSeqLb5ayxlFGK6WuqlzUSiKIO1kV621qU6kBJGmY5ZorkoYf1AsG9O5Tkdi3O5hm7Pi1cpxfr

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 07 Feb 2023 03:35:24 GMT
Content-Type: image/svg+xml
Last-Modified: Mon, 06 Feb 2023 20:19:15 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=60
Vary: Accept-Encoding
ETag: W/"63e160c3-22c"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Content-Encoding: gzip

hnbhnbecubnkhld.duckdns.org/becu/gif/Icon_Twitter.svg

163.123.141.198

200 OK

400 B

URL HTTP/1.1
hnbhnbecubnkhld.duckdns.org/becu/gif/Icon_Twitter.svg
IP
163.123.141.198:0
ASN
#213035 Des Capital B.V.

File type
SVG Scalable Vector Graphics image\012- HTML document text\012- HTML document, ASCII text, with very long lines (712), with no line terminators
Size
400 B (400 bytes)
Hash
6f925743dca959af80a15b16ac9f81b6
beb5d158ef333a203cf455ebfc0b67a59b62f395
a1136a65ddaf77634706ce647c843160ea0a20fe20c1324028777b6dce00a9ba

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain
fortinet	Phishing

NIDS	Severity	Alert
suricata	medium	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain

HTTP Headers

GET /becu/gif/Icon_Twitter.svg HTTP/1.1
Host: hnbhnbecubnkhld.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://hnbhnbecubnkhld.duckdns.org/becu/gif/index.html?s2kHXBuJ5dikkq3fbXqtHEWQm8Y9pShePEqRpuHcVXjxsXMLC12STXwxjvbnSeqLb5ayxlFGK6WuqlzUSiKIO1kV621qU6kBJGmY5ZorkoYf1AsG9O5Tkdi3O5hm7Pi1cpxfr

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 07 Feb 2023 03:35:24 GMT
Content-Type: image/svg+xml
Last-Modified: Mon, 06 Feb 2023 20:19:28 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=60
Vary: Accept-Encoding
ETag: W/"63e160d0-2c8"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Content-Encoding: gzip

hnbhnbecubnkhld.duckdns.org/becu/gif/Icon_Pinterest.svg

163.123.141.198

200 OK

539 B

URL HTTP/1.1
hnbhnbecubnkhld.duckdns.org/becu/gif/Icon_Pinterest.svg
IP
163.123.141.198:0
ASN
#213035 Des Capital B.V.

File type
SVG Scalable Vector Graphics image\012- HTML document text\012- HTML document, ASCII text, with very long lines (950), with no line terminators
Size
539 B (539 bytes)
Hash
678bee99f99e76ed80238c8cac6d0515
b0b5c77fd5e6f7b2421513faee74535c8b5ca731
c600fbc38e1ace35466f31e7b1ece9b2b8322585fba0ee2c145b661f46e9074c

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain
fortinet	Phishing

NIDS	Severity	Alert
suricata	medium	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain

HTTP Headers

GET /becu/gif/Icon_Pinterest.svg HTTP/1.1
Host: hnbhnbecubnkhld.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://hnbhnbecubnkhld.duckdns.org/becu/gif/index.html?s2kHXBuJ5dikkq3fbXqtHEWQm8Y9pShePEqRpuHcVXjxsXMLC12STXwxjvbnSeqLb5ayxlFGK6WuqlzUSiKIO1kV621qU6kBJGmY5ZorkoYf1AsG9O5Tkdi3O5hm7Pi1cpxfr

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 07 Feb 2023 03:35:24 GMT
Content-Type: image/svg+xml
Last-Modified: Mon, 06 Feb 2023 20:19:49 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=60
Vary: Accept-Encoding
ETag: W/"63e160e5-3b6"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Content-Encoding: gzip

hnbhnbecubnkhld.duckdns.org/becu/gif/Icon_Facebook.svg

163.123.141.198

200 OK

483 B

URL HTTP/1.1
hnbhnbecubnkhld.duckdns.org/becu/gif/Icon_Facebook.svg
IP
163.123.141.198:0
ASN
#213035 Des Capital B.V.

File type
SVG Scalable Vector Graphics image\012- HTML document text\012- HTML document, ASCII text, with very long lines (483), with no line terminators
Size
483 B (483 bytes)
Hash
a7b892ad939b7053428c0fe6131b0295
5c32c4a862310dec2455c519e01cb444f9188e77
1e554c21fc3503f9d06cba399b2627da518c93115e0701472dbca76f82de6fd8

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain
fortinet	Phishing

NIDS	Severity	Alert
suricata	medium	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain

HTTP Headers

GET /becu/gif/Icon_Facebook.svg HTTP/1.1
Host: hnbhnbecubnkhld.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://hnbhnbecubnkhld.duckdns.org/becu/gif/index.html?s2kHXBuJ5dikkq3fbXqtHEWQm8Y9pShePEqRpuHcVXjxsXMLC12STXwxjvbnSeqLb5ayxlFGK6WuqlzUSiKIO1kV621qU6kBJGmY5ZorkoYf1AsG9O5Tkdi3O5hm7Pi1cpxfr

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 07 Feb 2023 03:35:24 GMT
Content-Type: image/svg+xml
Content-Length: 483
Last-Modified: Mon, 06 Feb 2023 20:19:33 GMT
Connection: keep-alive
Keep-Alive: timeout=60
ETag: "63e160d5-1e3"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Accept-Ranges: bytes

hnbhnbecubnkhld.duckdns.org/becu/gif/css.css

163.123.141.198

200 OK

455 B

URL HTTP/1.1
hnbhnbecubnkhld.duckdns.org/becu/gif/css.css
IP
163.123.141.198:0
ASN
#213035 Des Capital B.V.

File type
ASCII text
Size
455 B (455 bytes)
Hash
d1d616551a71bf205ef9b0677cfa931e
7a58e1feb0a4761bcf9f2e09e1433221a4349d44
160a0e593e6b69819655c322ef2f4d3d55fd6a9eac00125a741e0a085b253d95

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain

NIDS	Severity	Alert
suricata	medium	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain

HTTP Headers

GET /becu/gif/css.css HTTP/1.1
Host: hnbhnbecubnkhld.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://hnbhnbecubnkhld.duckdns.org/becu/gif/becu-olb.min.css

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 07 Feb 2023 03:35:24 GMT
Content-Type: text/css
Last-Modified: Mon, 06 Feb 2023 20:19:36 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=60
Vary: Accept-Encoding
ETag: W/"63e160d8-e58"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Content-Encoding: gzip

r3.o.lencr.org/

95.101.11.115

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
95.101.11.115:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
9b88bae61bca33aba8aa99f6128db8d9
a07b61fb2458917699613fcae68710941b595416
54915c2f79822732e06a592d027da421ad1e7a6458c545f98333db25612b3dea

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "54915C2F79822732E06A592D027DA421AD1E7A6458C545F98333DB25612B3DEA"
Last-Modified: Mon, 06 Feb 2023 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=18694
Expires: Tue, 07 Feb 2023 08:46:58 GMT
Date: Tue, 07 Feb 2023 03:35:24 GMT
Connection: keep-alive

hnbhnbecubnkhld.duckdns.org/becu/gif/Icon_LinkedIn.svg

163.123.141.198

200 OK

363 B

URL HTTP/1.1
hnbhnbecubnkhld.duckdns.org/becu/gif/Icon_LinkedIn.svg
IP
163.123.141.198:0
ASN
#213035 Des Capital B.V.

File type
SVG Scalable Vector Graphics image\012- HTML document text\012- HTML document, ASCII text, with very long lines (558), with no line terminators
Size
363 B (363 bytes)
Hash
a21be877b36a6c56a626e03a860bd243
8aad8e675a822d6ce0126d81592fbd8ae3293e73
7396cb00fbfab078ea906d122ca2f36fc74e2373b5446a0a8f8faca40b28ea81

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain
fortinet	Phishing

NIDS	Severity	Alert
suricata	medium	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain

HTTP Headers

GET /becu/gif/Icon_LinkedIn.svg HTTP/1.1
Host: hnbhnbecubnkhld.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://hnbhnbecubnkhld.duckdns.org/becu/gif/index.html?s2kHXBuJ5dikkq3fbXqtHEWQm8Y9pShePEqRpuHcVXjxsXMLC12STXwxjvbnSeqLb5ayxlFGK6WuqlzUSiKIO1kV621qU6kBJGmY5ZorkoYf1AsG9O5Tkdi3O5hm7Pi1cpxfr

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 07 Feb 2023 03:35:24 GMT
Content-Type: image/svg+xml
Last-Modified: Mon, 06 Feb 2023 20:19:46 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=60
Vary: Accept-Encoding
ETag: W/"63e160e2-22e"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Content-Encoding: gzip

hnbhnbecubnkhld.duckdns.org/becu/gif/track_page_view.gif

163.123.141.198

200 OK

43 B

URL HTTP/1.1
hnbhnbecubnkhld.duckdns.org/becu/gif/track_page_view.gif
IP
163.123.141.198:0
ASN
#213035 Des Capital B.V.

File type
GIF image data, version 89a, 1 x 1\012- data
Size
43 B (43 bytes)
Hash
db04c7b378cb2db912c3ba8a5a774ee3
dee34bd86c3484d31002182aa2b7caa4699126b8
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain

NIDS	Severity	Alert
suricata	medium	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain

HTTP Headers

GET /becu/gif/track_page_view.gif HTTP/1.1
Host: hnbhnbecubnkhld.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://hnbhnbecubnkhld.duckdns.org/becu/gif/index.html?s2kHXBuJ5dikkq3fbXqtHEWQm8Y9pShePEqRpuHcVXjxsXMLC12STXwxjvbnSeqLb5ayxlFGK6WuqlzUSiKIO1kV621qU6kBJGmY5ZorkoYf1AsG9O5Tkdi3O5hm7Pi1cpxfr

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 07 Feb 2023 03:35:24 GMT
Content-Type: image/gif
Content-Length: 43
Last-Modified: Mon, 06 Feb 2023 20:19:31 GMT
Connection: keep-alive
Keep-Alive: timeout=60
ETag: "63e160d3-2b"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Accept-Ranges: bytes

hnbhnbecubnkhld.duckdns.org/becu/gif/Icon_Instagram.svg

163.123.141.198

200 OK

591 B

URL HTTP/1.1
hnbhnbecubnkhld.duckdns.org/becu/gif/Icon_Instagram.svg
IP
163.123.141.198:0
ASN
#213035 Des Capital B.V.

File type
SVG Scalable Vector Graphics image\012- HTML document text\012- HTML document, ASCII text, with very long lines (1124), with no line terminators
Size
591 B (591 bytes)
Hash
a9414f188762e434d45c855e8a333c1e
c28386edf51f7ef0327be805433e48781d2a34d2
a4a8a00bdd2ccccf848d263b595d6d9b67ea342af8cb30c95170cf0313c538dd

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain
fortinet	Phishing

NIDS	Severity	Alert
suricata	medium	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain

HTTP Headers

GET /becu/gif/Icon_Instagram.svg HTTP/1.1
Host: hnbhnbecubnkhld.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://hnbhnbecubnkhld.duckdns.org/becu/gif/index.html?s2kHXBuJ5dikkq3fbXqtHEWQm8Y9pShePEqRpuHcVXjxsXMLC12STXwxjvbnSeqLb5ayxlFGK6WuqlzUSiKIO1kV621qU6kBJGmY5ZorkoYf1AsG9O5Tkdi3O5hm7Pi1cpxfr

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 07 Feb 2023 03:35:24 GMT
Content-Type: image/svg+xml
Last-Modified: Mon, 06 Feb 2023 20:19:23 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=60
Vary: Accept-Encoding
ETag: W/"63e160cb-464"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Content-Encoding: gzip

hnbhnbecubnkhld.duckdns.org/becu/gif/Icon_NCUA.png

163.123.141.198

200 OK

7.5 kB

URL HTTP/1.1
hnbhnbecubnkhld.duckdns.org/becu/gif/Icon_NCUA.png
IP
163.123.141.198:0
ASN
#213035 Des Capital B.V.

File type
PNG image data, 544 x 255, 8-bit colormap, non-interlaced\012- data
Size
7.5 kB (7540 bytes)
Hash
c1517a5ec75cf8cb54b9d814209193d2
825d25cf351bd96d577196914a8c66aab3e74a71
88670f18763ad6b0a9c935368618718668149f7b196213daa8caa078453876bc

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain

NIDS	Severity	Alert
suricata	medium	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain

HTTP Headers

GET /becu/gif/Icon_NCUA.png HTTP/1.1
Host: hnbhnbecubnkhld.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://hnbhnbecubnkhld.duckdns.org/becu/gif/index.html?s2kHXBuJ5dikkq3fbXqtHEWQm8Y9pShePEqRpuHcVXjxsXMLC12STXwxjvbnSeqLb5ayxlFGK6WuqlzUSiKIO1kV621qU6kBJGmY5ZorkoYf1AsG9O5Tkdi3O5hm7Pi1cpxfr

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 07 Feb 2023 03:35:24 GMT
Content-Type: image/png
Content-Length: 7540
Last-Modified: Mon, 06 Feb 2023 20:19:18 GMT
Connection: keep-alive
Keep-Alive: timeout=60
ETag: "63e160c6-1d74"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Accept-Ranges: bytes

hnbhnbecubnkhld.duckdns.org/becu/gif/becu-logo-mobile.png

163.123.141.198

200 OK

1.9 kB

URL HTTP/1.1
hnbhnbecubnkhld.duckdns.org/becu/gif/becu-logo-mobile.png
IP
163.123.141.198:0
ASN
#213035 Des Capital B.V.

File type
PNG image data, 81 x 25, 8-bit/color RGBA, non-interlaced\012- data
Size
1.9 kB (1927 bytes)
Hash
e11b33e62339585e285cac82331ce814
3684c6ab46a28bb3769a45140b39634913e0de01
37d7cfe6df3b924bfaf33320ffd526cc558d3c693f63241d90bde8133f8105a7

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain

NIDS	Severity	Alert
suricata	medium	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain

HTTP Headers

GET /becu/gif/becu-logo-mobile.png HTTP/1.1
Host: hnbhnbecubnkhld.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://hnbhnbecubnkhld.duckdns.org/becu/gif/index.html?s2kHXBuJ5dikkq3fbXqtHEWQm8Y9pShePEqRpuHcVXjxsXMLC12STXwxjvbnSeqLb5ayxlFGK6WuqlzUSiKIO1kV621qU6kBJGmY5ZorkoYf1AsG9O5Tkdi3O5hm7Pi1cpxfr

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 07 Feb 2023 03:35:24 GMT
Content-Type: image/png
Content-Length: 1927
Last-Modified: Mon, 06 Feb 2023 20:19:45 GMT
Connection: keep-alive
Keep-Alive: timeout=60
ETag: "63e160e1-787"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Accept-Ranges: bytes

hnbhnbecubnkhld.duckdns.org/becu/gif/ico-closed-eye-new.png

163.123.141.198

200 OK

691 B

URL HTTP/1.1
hnbhnbecubnkhld.duckdns.org/becu/gif/ico-closed-eye-new.png
IP
163.123.141.198:0
ASN
#213035 Des Capital B.V.

File type
PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced\012- data
Size
691 B (691 bytes)
Hash
48f94f58ce088074cda3f8f91485a073
a0d70eefc6cc5dee1ef9bfdf93becb461cf9c9d9
517ccec038ddf888146f0508f7eac214cbbf1a133701fc208ea0328b1bff9944

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain

NIDS	Severity	Alert
suricata	medium	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain

HTTP Headers

GET /becu/gif/ico-closed-eye-new.png HTTP/1.1
Host: hnbhnbecubnkhld.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://hnbhnbecubnkhld.duckdns.org/becu/gif/index.html?s2kHXBuJ5dikkq3fbXqtHEWQm8Y9pShePEqRpuHcVXjxsXMLC12STXwxjvbnSeqLb5ayxlFGK6WuqlzUSiKIO1kV621qU6kBJGmY5ZorkoYf1AsG9O5Tkdi3O5hm7Pi1cpxfr

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 07 Feb 2023 03:35:24 GMT
Content-Type: image/png
Content-Length: 691
Last-Modified: Mon, 06 Feb 2023 20:19:37 GMT
Connection: keep-alive
Keep-Alive: timeout=60
ETag: "63e160d9-2b3"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Accept-Ranges: bytes

hnbhnbecubnkhld.duckdns.org/becu/gif/S6uyw4BMUTPHjx4wXiWtFCc.woff2

163.123.141.198

200 OK

14 kB

URL HTTP/1.1
hnbhnbecubnkhld.duckdns.org/becu/gif/S6uyw4BMUTPHjx4wXiWtFCc.woff2
IP
163.123.141.198:0
ASN
#213035 Des Capital B.V.

File type
Web Open Font Format (Version 2), TrueType, length 13976, version 1.0\012- data
Size
14 kB (13976 bytes)
Hash
e7e52c955aa33e618baf437a16539524
13ecb55bb760d6980a1b1331085630ef5ed84e9f
07c94892c3e0ac93d2bcb3a9cb88aa67ea47b3d1aa89bc39dfcc2b025dcd8988

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain
fortinet	Phishing

NIDS	Severity	Alert
suricata	medium	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain

HTTP Headers

GET /becu/gif/S6uyw4BMUTPHjx4wXiWtFCc.woff2 HTTP/1.1
Host: hnbhnbecubnkhld.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://hnbhnbecubnkhld.duckdns.org/becu/gif/css.css

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 07 Feb 2023 03:35:24 GMT
Content-Length: 13976
Connection: keep-alive
Keep-Alive: timeout=60
Last-Modified: Mon, 06 Feb 2023 20:19:32 GMT
ETag: "3698-5f40dbfbfab97"
Accept-Ranges: bytes

hnbhnbecubnkhld.duckdns.org/becu/gif/becu-icons.woff

163.123.141.198

200 OK

3.4 kB

URL HTTP/1.1
hnbhnbecubnkhld.duckdns.org/becu/gif/becu-icons.woff
IP
163.123.141.198:0
ASN
#213035 Des Capital B.V.

File type
Web Open Font Format, CFF, length 3400, version 1.0\012- data
Size
3.4 kB (3400 bytes)
Hash
0732f5f3d6d512db810a244afdd7fa0f
d040945eacf67d85eed477c2c0cbc5c4af961bdf
a47ebd1a4c87da626d6ce831a4a319a0e242130f646d9b4bbdedf073d6e79c1e

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain
fortinet	Phishing

NIDS	Severity	Alert
suricata	medium	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain

HTTP Headers

GET /becu/gif/becu-icons.woff HTTP/1.1
Host: hnbhnbecubnkhld.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://hnbhnbecubnkhld.duckdns.org/becu/gif/becu-olb.min.css

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 07 Feb 2023 03:35:24 GMT
Content-Type: font/woff
Content-Length: 3400
Last-Modified: Mon, 06 Feb 2023 20:19:50 GMT
Connection: keep-alive
Keep-Alive: timeout=60
ETag: "63e160e6-d48"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Accept-Ranges: bytes

hnbhnbecubnkhld.duckdns.org/becu/gif/S6u9w4BMUTPHh6UVSwiPGQ3q5d0.woff2

163.123.141.198

200 OK

14 kB

URL HTTP/1.1
hnbhnbecubnkhld.duckdns.org/becu/gif/S6u9w4BMUTPHh6UVSwiPGQ3q5d0.woff2
IP
163.123.141.198:0
ASN
#213035 Des Capital B.V.

File type
Web Open Font Format (Version 2), TrueType, length 14148, version 1.0\012- data
Size
14 kB (14148 bytes)
Hash
69b28056044be6438ce7e5214c66ba82
39ee8d4427a6062f942513b5b219a320068c7ae7
b8e094ad64704c2e4836153e641e432b22159b03d5b240b6dd303461be83f542

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain
fortinet	Phishing

NIDS	Severity	Alert
suricata	medium	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain

HTTP Headers

GET /becu/gif/S6u9w4BMUTPHh6UVSwiPGQ3q5d0.woff2 HTTP/1.1
Host: hnbhnbecubnkhld.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://hnbhnbecubnkhld.duckdns.org/becu/gif/css.css

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 07 Feb 2023 03:35:24 GMT
Content-Length: 14148
Connection: keep-alive
Keep-Alive: timeout=60
Last-Modified: Mon, 06 Feb 2023 20:19:39 GMT
ETag: "3744-5f40dc0319f68"
Accept-Ranges: bytes

hnbhnbecubnkhld.duckdns.org/becu/gif/Icon_EHOL.png

163.123.141.198

200 OK

6.1 kB

URL HTTP/1.1
hnbhnbecubnkhld.duckdns.org/becu/gif/Icon_EHOL.png
IP
163.123.141.198:0
ASN
#213035 Des Capital B.V.

File type
PNG image data, 271 x 289, 8-bit colormap, non-interlaced\012- data
Size
6.1 kB (6099 bytes)
Hash
976273f8b065ba38edb8de09b2e6fbad
91ad6dec2558e1eada674f2af43d2c4f555ddeb4
7e2f8c0c858a03425096e2158d00ea6f8965cbdd36bc40bc51b7862f85f8558e

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain

NIDS	Severity	Alert
suricata	medium	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain

HTTP Headers

GET /becu/gif/Icon_EHOL.png HTTP/1.1
Host: hnbhnbecubnkhld.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://hnbhnbecubnkhld.duckdns.org/becu/gif/index.html?s2kHXBuJ5dikkq3fbXqtHEWQm8Y9pShePEqRpuHcVXjxsXMLC12STXwxjvbnSeqLb5ayxlFGK6WuqlzUSiKIO1kV621qU6kBJGmY5ZorkoYf1AsG9O5Tkdi3O5hm7Pi1cpxfr

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 07 Feb 2023 03:35:24 GMT
Content-Type: image/png
Content-Length: 6099
Last-Modified: Mon, 06 Feb 2023 20:19:26 GMT
Connection: keep-alive
Keep-Alive: timeout=60
ETag: "63e160ce-17d3"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Accept-Ranges: bytes

hnbhnbecubnkhld.duckdns.org/becu/gif/358A1A_9_0.woff2

163.123.141.198

200 OK

26 kB

URL HTTP/1.1
hnbhnbecubnkhld.duckdns.org/becu/gif/358A1A_9_0.woff2
IP
163.123.141.198:0
ASN
#213035 Des Capital B.V.

File type
Web Open Font Format (Version 2), TrueType, length 25780, version 1.65\012- data
Size
26 kB (25780 bytes)
Hash
839b13563ab175c2679f1d63911e5864
9ba953cfa73614d208cef4947baf9cf8633bd016
64e53f6c8bf8d9ba3c3a9faacd81359fea26cdb8a1d8a055a1d4a32b0e10b304

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain
fortinet	Phishing

NIDS	Severity	Alert
suricata	medium	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain

HTTP Headers

GET /becu/gif/358A1A_9_0.woff2 HTTP/1.1
Host: hnbhnbecubnkhld.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://hnbhnbecubnkhld.duckdns.org/becu/gif/BECU_MuseoSans_webfontKit02.css

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 07 Feb 2023 03:35:24 GMT
Content-Length: 25780
Connection: keep-alive
Keep-Alive: timeout=60
Last-Modified: Mon, 06 Feb 2023 20:19:58 GMT
ETag: "64b4-5f40dc14d38d4"
Accept-Ranges: bytes

hnbhnbecubnkhld.duckdns.org/becu/gif/358A1A_1_0.woff2

163.123.141.198

200 OK

26 kB

URL HTTP/1.1
hnbhnbecubnkhld.duckdns.org/becu/gif/358A1A_1_0.woff2
IP
163.123.141.198:0
ASN
#213035 Des Capital B.V.

File type
Web Open Font Format (Version 2), TrueType, length 25586, version 1.65\012- data
Size
26 kB (25586 bytes)
Hash
759aec1613aa3abaf5027d81f7e31dc8
4d037daf9f4052d4e93f8dc1dde5adb015aecd9e
b6eae3e90ad1462fae1618ce2b2e164c8d8150dcdfa63a8fa9467df614737be5

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain
fortinet	Phishing

NIDS	Severity	Alert
suricata	medium	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain

HTTP Headers

GET /becu/gif/358A1A_1_0.woff2 HTTP/1.1
Host: hnbhnbecubnkhld.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://hnbhnbecubnkhld.duckdns.org/becu/gif/BECU_MuseoSans_webfontKit02.css

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 07 Feb 2023 03:35:24 GMT
Content-Length: 25586
Connection: keep-alive
Keep-Alive: timeout=60
Last-Modified: Mon, 06 Feb 2023 20:19:51 GMT
ETag: "63f2-5f40dc0e79559"
Accept-Ranges: bytes

hnbhnbecubnkhld.duckdns.org/becu/gif/358A1A_3_0.woff2

163.123.141.198

200 OK

26 kB

URL HTTP/1.1
hnbhnbecubnkhld.duckdns.org/becu/gif/358A1A_3_0.woff2
IP
163.123.141.198:0
ASN
#213035 Des Capital B.V.

File type
Web Open Font Format (Version 2), TrueType, length 26026, version 1.65\012- data
Size
26 kB (26026 bytes)
Hash
eb2307f07b0d8e44d486eb070a349764
8564f6f87bf83c32c4e1e7a1e27c616475fce28b
03d75d59501832eeb78012ed3238b1ff8eb6c26406275a22b5e108e0377c4070

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain
fortinet	Phishing

NIDS	Severity	Alert
suricata	medium	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain

HTTP Headers

GET /becu/gif/358A1A_3_0.woff2 HTTP/1.1
Host: hnbhnbecubnkhld.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://hnbhnbecubnkhld.duckdns.org/becu/gif/BECU_MuseoSans_webfontKit02.css

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 07 Feb 2023 03:35:24 GMT
Content-Length: 26026
Connection: keep-alive
Keep-Alive: timeout=60
Last-Modified: Mon, 06 Feb 2023 20:19:46 GMT
ETag: "65aa-5f40dc09f68d2"
Accept-Ranges: bytes

hnbhnbecubnkhld.duckdns.org/becu/gif/358A1A_0_0.woff2

163.123.141.198

200 OK

26 kB

URL HTTP/1.1
hnbhnbecubnkhld.duckdns.org/becu/gif/358A1A_0_0.woff2
IP
163.123.141.198:0
ASN
#213035 Des Capital B.V.

File type
Web Open Font Format (Version 2), TrueType, length 26298, version 1.65\012- data
Size
26 kB (26298 bytes)
Hash
247eaa9a8067b809010b90cda88c6a66
a1a8f4b3ad1a3bf1034a0c8961c8a832789a70ad
6afb03ccb758fb7a42ada96a544bc8f76f42973cc8e8c2c8d611b88bfb585b8d

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain
fortinet	Phishing

NIDS	Severity	Alert
suricata	medium	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain

HTTP Headers

GET /becu/gif/358A1A_0_0.woff2 HTTP/1.1
Host: hnbhnbecubnkhld.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://hnbhnbecubnkhld.duckdns.org/becu/gif/BECU_MuseoSans_webfontKit02.css

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 07 Feb 2023 03:35:24 GMT
Content-Length: 26298
Connection: keep-alive
Keep-Alive: timeout=60
Last-Modified: Mon, 06 Feb 2023 20:19:55 GMT
ETag: "66ba-5f40dc11b1cba"
Accept-Ranges: bytes

push.services.mozilla.com/

54.149.129.99

101 Switching Protocols

0 B

URL HTTP/1.1
push.services.mozilla.com/
IP
54.149.129.99:0
ASN
#16509 AMAZON-02

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: OMboWgD6mjPBQhR9w9QlXQ==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: hkcBrBakB4Ef3pdlhuiwAi+9Ats=

hnbhnbecubnkhld.duckdns.org/becu/gif/favicon-32x32.png

163.123.141.198

200 OK

15 kB

URL HTTP/1.1
hnbhnbecubnkhld.duckdns.org/becu/gif/favicon-32x32.png
IP
163.123.141.198:0
ASN
#213035 Des Capital B.V.

File type
MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel\012- data
Size
15 kB (15086 bytes)
Hash
4ec97a47f760361d8993dcd20c851fd2
209b253e348a92643a9469ed3429bb5f4f1584d2
03716691a80664c3ddcd13d7afbb1c5b171b8e441cce2f2dc5af6cf927f88f90

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain

NIDS	Severity	Alert
suricata	medium	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain

HTTP Headers

GET /becu/gif/favicon-32x32.png HTTP/1.1
Host: hnbhnbecubnkhld.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://hnbhnbecubnkhld.duckdns.org/becu/gif/index.html?s2kHXBuJ5dikkq3fbXqtHEWQm8Y9pShePEqRpuHcVXjxsXMLC12STXwxjvbnSeqLb5ayxlFGK6WuqlzUSiKIO1kV621qU6kBJGmY5ZorkoYf1AsG9O5Tkdi3O5hm7Pi1cpxfr

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 07 Feb 2023 03:35:24 GMT
Content-Type: image/png
Content-Length: 15086
Last-Modified: Mon, 06 Feb 2023 20:19:56 GMT
Connection: keep-alive
Keep-Alive: timeout=60
ETag: "63e160ec-3aee"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Accept-Ranges: bytes

r3.o.lencr.org/

95.101.11.115

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
95.101.11.115:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
68273225f74fbf7493f395610d7a73fc
5a8779ef5656aeeba23b365aad60b7901c5dd7fc
c83f285a1f3df0f7ac758a68ee95cc3d2671f80264c2e143cc0561cc574e3f19

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C83F285A1F3DF0F7AC758A68EE95CC3D2671F80264C2E143CC0561CC574E3F19"
Last-Modified: Mon, 06 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7772
Expires: Tue, 07 Feb 2023 05:44:57 GMT
Date: Tue, 07 Feb 2023 03:35:25 GMT
Connection: keep-alive

r3.o.lencr.org/

95.101.11.115

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
95.101.11.115:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
68273225f74fbf7493f395610d7a73fc
5a8779ef5656aeeba23b365aad60b7901c5dd7fc
c83f285a1f3df0f7ac758a68ee95cc3d2671f80264c2e143cc0561cc574e3f19

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C83F285A1F3DF0F7AC758A68EE95CC3D2671F80264C2E143CC0561CC574E3F19"
Last-Modified: Mon, 06 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7772
Expires: Tue, 07 Feb 2023 05:44:57 GMT
Date: Tue, 07 Feb 2023 03:35:25 GMT
Connection: keep-alive

r3.o.lencr.org/

95.101.11.115

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
95.101.11.115:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
68273225f74fbf7493f395610d7a73fc
5a8779ef5656aeeba23b365aad60b7901c5dd7fc
c83f285a1f3df0f7ac758a68ee95cc3d2671f80264c2e143cc0561cc574e3f19

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C83F285A1F3DF0F7AC758A68EE95CC3D2671F80264C2E143CC0561CC574E3F19"
Last-Modified: Mon, 06 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7772
Expires: Tue, 07 Feb 2023 05:44:57 GMT
Date: Tue, 07 Feb 2023 03:35:25 GMT
Connection: keep-alive

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3c86a61b-07c3-45f6-b564-e556eb788d04.jpeg

34.120.237.76

200 OK

13 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3c86a61b-07c3-45f6-b564-e556eb788d04.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
13 kB (12682 bytes)
Hash
59419fb1cf4689bed183d0e9a6aed782
47d4a4bb26fafff0c6aebfe3dc7ddfa4970f8e9a
e6009407bd61bee1ae16ec30ea5914be77c56ee65dfb30595b10a1cedc6798c9

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3c86a61b-07c3-45f6-b564-e556eb788d04.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 12682
x-amzn-requestid: d858d90a-b1ca-401c-8e00-8ccd9c0a7504
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: f78mUEsfIAMFreg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63e1748e-2783de3e3de9c520246bf06e;Sampled=0
x-amzn-remapped-date: Mon, 06 Feb 2023 21:43:42 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: eq8Kle9uYWJ3vmaJD50r-oaTb_O2ObQgLNlTcYn9XQoHCyAO3isqyQ==
via: 1.1 00f0a41f749793b9dd653153037c957e.cloudfront.net (CloudFront), 1.1 4f3feb5c4393987d42d1971d404d7cea.cloudfront.net (CloudFront), 1.1 google
date: Mon, 06 Feb 2023 21:44:49 GMT
age: 21036
etag: "47d4a4bb26fafff0c6aebfe3dc7ddfa4970f8e9a"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

6.4 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F09bdaec3-9afd-4cea-87ec-6adabc28a3e8.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
6.4 kB (6384 bytes)
Hash
88178e0f623494e30ece4da4eed04d60
7f016d87157a577e4ad4e4cf6c854a0489f8571a
e5658ac599ca37e797637a596ca9b65c80c1053b2ce5dacc667ae3b8b1ce54a3

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F09bdaec3-9afd-4cea-87ec-6adabc28a3e8.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 6384
x-amzn-requestid: 5f91a438-31d9-42ca-96b4-71344cc736c6
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: f77IcE2-oAMFbZA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63e17235-1ce1ebfa4e9ae6053434c48d;Sampled=0
x-amzn-remapped-date: Mon, 06 Feb 2023 21:33:41 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: ee3lrCu0ZcpPQ-tQiF3j59bjY0W_zFOKl2H__y_twSGGESxmir3JHg==
via: 1.1 efe54e8b68e074d39b2ecd249f85100a.cloudfront.net (CloudFront), 1.1 6a9b42e38e76b7d4a4044ebe0e0eca08.cloudfront.net (CloudFront), 1.1 google
date: Mon, 06 Feb 2023 21:46:30 GMT
age: 20935
etag: "7f016d87157a577e4ad4e4cf6c854a0489f8571a"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

5.6 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7926951f-dd16-4029-a877-933fa5d3c0f5.png
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
5.6 kB (5634 bytes)
Hash
cf292b03a5db7eb8e0660a518f41233c
8fa486cdecffff8a663da2df88227ee784c298a2
cfc5efb92068bdeeda5c95f9851213b14afa76776486d0493cf4c05b30453cf0

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7926951f-dd16-4029-a877-933fa5d3c0f5.png HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 5634
x-amzn-requestid: 7bdbf988-0527-447e-8f45-2b0c6f402167
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fpc79HRToAMFXog=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63da0eb2-1266524745b61f19576657d3;Sampled=0
x-amzn-remapped-date: Wed, 01 Feb 2023 07:03:14 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: 92IMfX0PuSwMkTWbFqUONr2B9lUgz3V_-VtdWnDQiWAlcNptmHF6Ug==
via: 1.1 eece508272520f70691e4eebdc5a6dea.cloudfront.net (CloudFront), 1.1 32c16f33c8f5601364fa8229b0d74dc2.cloudfront.net (CloudFront), 1.1 google
date: Tue, 07 Feb 2023 03:26:47 GMT
etag: "8fa486cdecffff8a663da2df88227ee784c298a2"
content-type: image/jpeg
age: 518
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

7.2 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd09b3928-4257-4aee-9978-7c13c20b5a23.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
7.2 kB (7183 bytes)
Hash
92008e687831334af1cdbf4b8a57579f
e6ff750f12836637adf5b253d64c2102fdf3c180
39af3e630e0271b54139849c1b596efbdc69a23ce943e5330341d49f77798c7c

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd09b3928-4257-4aee-9978-7c13c20b5a23.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 7183
x-amzn-requestid: 02695a8d-2ab8-4d77-bfbe-f99418d8ef00
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: f78YOGsyoAMF5wA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63e17434-2614cef4059e7fd5009cb46d;Sampled=0
x-amzn-remapped-date: Mon, 06 Feb 2023 21:42:12 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 5wy_7Z30HRIcZufSPCTKu9UoJD1o_NDlhuyL5bvidDwbqC_3p99yYA==
via: 1.1 23206a1c229d8877bdd053c4b05f9d12.cloudfront.net (CloudFront), 1.1 6a9b42e38e76b7d4a4044ebe0e0eca08.cloudfront.net (CloudFront), 1.1 google
date: Mon, 06 Feb 2023 21:44:57 GMT
age: 21028
etag: "e6ff750f12836637adf5b253d64c2102fdf3c180"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

13 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe4252883-1cf4-4e4a-98fa-fee2d1bd1a6c.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
13 kB (13371 bytes)
Hash
298eca3ae092fd28108db52acaa59545
ee865a4919befec21c73f7a1cf0c2405c34743b7
d490b601b1dc9e89392b902b7b7376815c81019ef53ab06aa27ed563600bb1a3

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe4252883-1cf4-4e4a-98fa-fee2d1bd1a6c.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 13371
x-amzn-requestid: 2fd56339-7b32-4058-8eea-8565cae3037c
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: f2opoHjGoAMFsMw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63df54a3-5b0bd42e1e21d7d65ac7c7f1;Sampled=0
x-amzn-remapped-date: Sun, 05 Feb 2023 07:02:59 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: OFvC4LzVa3dpU90Gi7rJGXAAwjst4G2Fr-GWg7MkSk48d85rWUdvPA==
via: 1.1 4dde8ec6d6c12741888c2d3a059d4a2e.cloudfront.net (CloudFront), 1.1 981753271eb5b6d11bc29d52f173a5da.cloudfront.net (CloudFront), 1.1 google
date: Mon, 06 Feb 2023 10:03:27 GMT
age: 63118
etag: "ee865a4919befec21c73f7a1cf0c2405c34743b7"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

6.3 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F32cb7a16-13bc-4d42-8e17-7be2a40cfc82.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
6.3 kB (6316 bytes)
Hash
c3cd20c6639e2b0d996fbbd7df2d4f47
2e54c22fb83981e2690161cd521e4fc3998e9c16
9b2b1f3e062fca74341d09540e44d2a02ec451b8349440ed5917073e8fab988d

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F32cb7a16-13bc-4d42-8e17-7be2a40cfc82.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 6316
x-amzn-requestid: 1988058c-5aee-4964-9046-83a5f14a927d
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fwhjnFdxoAMFgpQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63dce2e3-5ec35d0d6bef4d4944c629c0;Sampled=0
x-amzn-remapped-date: Fri, 03 Feb 2023 10:33:07 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: Z9b1A_GpinQXvbA-g2PoKhVSNVd5gMrId0WUTmKSCkg-YAan1dtp-w==
via: 1.1 49b94a8674d6e86a841d6523f7dbaf14.cloudfront.net (CloudFront), 1.1 e4d3d5aafc7d7d582423c073065ab562.cloudfront.net (CloudFront), 1.1 google
date: Mon, 06 Feb 2023 22:21:35 GMT
age: 18830
etag: "2e54c22fb83981e2690161cd521e4fc3998e9c16"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (0)

HTTP Transactions (45)

URL HTTP/1.1

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/2

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/2

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/2

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN