{"report_id":"2d6d5bad-1058-48a7-bba3-e2cb25c4576d","version":6,"status":"done","tags":["dyndns"],"date":"2025-10-14T10:52:04Z","url":{"schema":"https","addr":"dnizinbanksii.duckdns.org/","fqdn":"dnizinbanksii.duckdns.org","domain":"dnizinbanksii.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"196.251.72.165","port":0,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"final":{"url":{"schema":"https","addr":"dnizinbanksii.duckdns.org/bireysel/","fqdn":"dnizinbanksii.duckdns.org","domain":"dnizinbanksii.duckdns.org","tld":"duckdns.org"},"title":"DenizBank İnternet Bankacılığı"},"submit":{"url":{"schema":"https","addr":"dnizinbanksii.duckdns.org/","fqdn":"dnizinbanksii.duckdns.org","domain":"dnizinbanksii.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"196.251.72.165","port":0,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-11-18T10:52:04Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":1,"urlquery":2,"analyzer":4}},"detection":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-14T10:51:38Z","timestamp":1760439098,"ip_dst":{"addr":"172.18.0.8","port":59562,"asn":0,"as":"","country":"","country_code":"zz"},"ip_src":{"addr":"196.251.72.165","port":443,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"severity":"medium","alert":"ET DROP Spamhaus DROP Listed Traffic Inbound group 45","source":"{\"timestamp\":\"2025-10-14T10:51:38.922419+0000\",\"flow_id\":994880507262544,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"196.251.72.165\",\"src_port\":443,\"dest_ip\":\"172.18.0.8\",\"dest_port\":59562,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.Evil\",\"ET.DROPIP\"]},\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2400044,\"rev\":4421,\"signature\":\"ET DROP Spamhaus DROP Listed Traffic Inbound group 45\",\"category\":\"Misc Attack\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Any\"],\"attack_target\":[\"Any\"],\"created_at\":[\"2010_12_30\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Minor\"],\"tag\":[\"Dshield\"],\"updated_at\":[\"2025_08_01\"]}},\"flow\":{\"pkts_toserver\":1,\"pkts_toclient\":1,\"bytes_toserver\":74,\"bytes_toclient\":74,\"start\":\"2025-10-14T10:51:38.898640+0000\"}}"}],"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]},"summary":[{"fqdn":"dnizinbanksii.duckdns.org","ip":{"addr":"196.251.72.165","port":443,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"domain_registered":"2013-04-12","domain_rank":0,"first_seen":"2025-10-14T02:51:57.675041Z","last_seen":"2025-10-14T02:51:57.675041Z","alert_count":218,"request_count":44,"received_data":1218480,"sent_data":25495,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:8.4.13","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"jQuery CDN","description":"jQuery CDN is a way to include jQuery in your website without actually downloading and keeping it your website's folder.","website":"https://code.jquery.com/","common_platform_enumeration":"","icon":"jQuery.svg","categories":["CDN"]},{"name":"jQuery:3.6.0","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}]},{"fqdn":"acikdeniz.denizbank.com","ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"1997-12-31","domain_rank":1036451,"first_seen":"2017-02-01T23:20:20Z","last_seen":"2025-10-14T02:51:58.187076Z","alert_count":0,"request_count":1,"received_data":0,"sent_data":474,"comment":"","tags":null,"fingerprints":null},{"fqdn":"code.jquery.com","ip":{"addr":"151.101.130.137","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"domain_registered":"2005-12-10","domain_rank":4915,"first_seen":"2012-05-21T17:28:02Z","last_seen":"2025-10-12T22:16:17.088796Z","alert_count":0,"request_count":1,"received_data":90137,"sent_data":433,"comment":"","tags":null,"fingerprints":[{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-14T10:51:38Z","timestamp":1760439098,"ip_dst":{"addr":"172.18.0.8","port":59562,"asn":0,"as":"","country":"","country_code":"zz"},"ip_src":{"addr":"196.251.72.165","port":443,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"severity":"medium","alert":"ET DROP Spamhaus DROP Listed Traffic Inbound group 45","source":"{\"timestamp\":\"2025-10-14T10:51:38.922419+0000\",\"flow_id\":994880507262544,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"196.251.72.165\",\"src_port\":443,\"dest_ip\":\"172.18.0.8\",\"dest_port\":59562,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.Evil\",\"ET.DROPIP\"]},\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2400044,\"rev\":4421,\"signature\":\"ET DROP Spamhaus DROP Listed Traffic Inbound group 45\",\"category\":\"Misc Attack\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Any\"],\"attack_target\":[\"Any\"],\"created_at\":[\"2010_12_30\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Minor\"],\"tag\":[\"Dshield\"],\"updated_at\":[\"2025_08_01\"]}},\"flow\":{\"pkts_toserver\":1,\"pkts_toclient\":1,\"bytes_toserver\":74,\"bytes_toclient\":74,\"start\":\"2025-10-14T10:51:38.898640+0000\"}}"}]}],"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"code.jquery.com/jquery-3.6.0.min.js","fqdn":"code.jquery.com","domain":"jquery.com","tld":"com"},"ip":{"addr":"151.101.130.137","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"8fb8fee4fcc3cc86ff6c724154c49c42","sha1":"b82d238d4e31fdf618bae8ac11a6c812c03dd0d4","sha256":"ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e","sha512":"f3de1813a4160f9239f4781938645e1589b876759cd50b7936dbd849a35c38ffaed53f6a61dbdd8a1cf43cf4a28aa9fffbfddeec9a3811a1bb4ee6df58652b31","ssdeep":"1536:DjExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdLiX4mQ1v9:DIh8GgP3hujzwbhd3XvSiDQ47GKn","tlshash":"069309ddb2c6702257a720ba007f510bf236199d6c4d8450f169d8eabc78a4e827bf7d","size":89501,"data":"","first_seen":"2023-03-07T01:02:13Z","last_seen":"2026-08-20T12:19:53.890007Z","times_seen":499165,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"dnizinbanksii.duckdns.org/bireysel/","fqdn":"dnizinbanksii.duckdns.org","domain":"dnizinbanksii.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"196.251.72.165","port":443,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"introduction_type":"scriptElement","is_inline":true,"md5":"3d0819667ca1b9ba860cef3e564ea1da","sha1":"3bfe66bc3d5bb214d7245ee12140c3ba2f4ed779","sha256":"180965357c08ad5fdafec260e7eef4517479660edcd1253653f5fdee62715efd","sha512":"b26e1990a71f3ffb594bc645b2063b4377a62e7d6f388d84fd5e5a65a76e36bb18dbdaef1406bfdc1d209724b370a10d358f91a6541562813aa9f8a9bbd17b9b","ssdeep":"","tlshash":"2071ec8d3af72820457b32ba5f8f9016762584137406de487c5c87906f40eed9afbbda","size":3637,"data":"","first_seen":"2025-09-25T21:27:16.532113Z","last_seen":"2025-10-14T10:52:07.163612Z","times_seen":10,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"dnizinbanksii.duckdns.org/bireysel/","fqdn":"dnizinbanksii.duckdns.org","domain":"dnizinbanksii.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"196.251.72.165","port":443,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"introduction_type":"scriptElement","is_inline":true,"md5":"5d2b5a4370a3181dd14c1287fad0aad5","sha1":"a703c95f5101eedf2c1dbd8a4659cb39b0878591","sha256":"7cf19fb237cc46b2c77030868adc4d2991feb8f677f3b168ed6b31af8694aa42","sha512":"8048e3b9d3d1116d39c10c758296640fe339a11d890ef80a02d13b5e78009ff149572137d8ace6c66155f0f247f0ea04077416925fe904c4e81608f2ea97db23","ssdeep":"","tlshash":"11f0971e29faa015ca2730fada9f24487422b043690dde017c0d83814f5863e852b3ee","size":618,"data":"","first_seen":"2025-09-24T01:33:00.416681Z","last_seen":"2025-10-14T10:52:07.164309Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"dnizinbanksii.duckdns.org/bireysel/","fqdn":"dnizinbanksii.duckdns.org","domain":"dnizinbanksii.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"196.251.72.165","port":443,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"introduction_type":"scriptElement","is_inline":true,"md5":"bb5eeaa9b1cd1828f4d8c14ffb2749bf","sha1":"ad6e0575da43e4aa35206467501f6436670a8b5d","sha256":"12abb18a264f7ff65e5abbd5c0f43f035b6cb922dd070d4fd4f613f34c8c5b29","sha512":"2ef231ff5633858e41ff43f6516bbc4a066502087ebb8116e18b96b5ccc8bae433fee6e8d4e1aa68ad66b503b64f6ff2b23e2985bde5bc9d2117da8260d99ae9","ssdeep":"","tlshash":"d00170df68b71524cb2770a4469b78482815b817220adf06791d52618f8c9bc45afa9e","size":805,"data":"","first_seen":"2025-09-25T21:27:16.536667Z","last_seen":"2025-10-14T10:52:07.165302Z","times_seen":10,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"dnizinbanksii.duckdns.org/","fqdn":"dnizinbanksii.duckdns.org","domain":"dnizinbanksii.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"196.251.72.165","port":443,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-10-14T10:51:38.776Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnizinbanksii.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 13 Oct 2025 14:07:42 GMT","end":"Sun, 11 Jan 2026 14:07:41 GMT"},"fingerprint":{"sha1":"EA:41:4A:8F:CF:7D:78:FC:5A:7C:3D:03:DA:2B:66:EC:89:F5:C6:76","sha256":"05:1A:F1:7D:61:5F:D6:22:66:E7:75:B3:19:7D:B5:3D:3F:53:0A:89:F8:3F:7C:82:25:D1:91:13:43:CC:38:60"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: dnizinbanksii.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Found\r\nServer: nginx\r\nDate: Tue, 14 Oct 2025 10:51:39 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Length: 0\r\nConnection: keep-alive\r\nLocation: /bireysel\r\nX-Powered-By: PHP/8.4.13, PleskLin\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:8.4.13","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":14831,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-20T12:30:42.528701Z","times_seen":17990481,"resource_available":true,"data":null}},"time_used":452,"timings":{"blocked":188,"dns":129,"connect":24,"send":0,"wait":70,"receive":0,"ssl":38},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"dnizinbanksii.duckdns.org/bireysel/world.svg","fqdn":"dnizinbanksii.duckdns.org","domain":"dnizinbanksii.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"196.251.72.165","port":443,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dnizinbanksii.duckdns.org/bireysel/","date":"2025-10-14T10:51:39.385Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnizinbanksii.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 13 Oct 2025 14:07:42 GMT","end":"Sun, 11 Jan 2026 14:07:41 GMT"},"fingerprint":{"sha1":"EA:41:4A:8F:CF:7D:78:FC:5A:7C:3D:03:DA:2B:66:EC:89:F5:C6:76","sha256":"05:1A:F1:7D:61:5F:D6:22:66:E7:75:B3:19:7D:B5:3D:3F:53:0A:89:F8:3F:7C:82:25:D1:91:13:43:CC:38:60"}}},"request":{"raw":"GET /bireysel/world.svg HTTP/1.1\r\nHost: dnizinbanksii.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://dnizinbanksii.duckdns.org/bireysel/\r\nCookie: PHPSESSID=5a118ff79cd8e2c90424eaf2ea68d949\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx\r\nDate: Tue, 14 Oct 2025 10:51:39 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Mon, 13 Oct 2025 15:04:58 GMT\r\nETag: W/\"328-6410b973e1a6b\"\r\nContent-Encoding: br\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-20T11:47:09.562203Z","times_seen":38907,"resource_available":true,"data":null}},"time_used":217,"timings":{"blocked":178,"dns":0,"connect":0,"send":0,"wait":39,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"acikdeniz.denizbank.com/_assets/img/login/bg/autumn.jpg","fqdn":"acikdeniz.denizbank.com","domain":"denizbank.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dnizinbanksii.duckdns.org/bireysel/","date":"2025-10-14T10:51:39.675Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /_assets/img/login/bg/autumn.jpg HTTP/1.1\r\nHost: acikdeniz.denizbank.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://dnizinbanksii.duckdns.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-20T12:30:42.528701Z","times_seen":17990481,"resource_available":true,"data":null}},"time_used":7226,"timings":{"blocked":7226,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"dnizinbanksii.duckdns.org/bireysel/assets/opensans-bold-webfont.c04f02eb3292e49d2d4e.woff","fqdn":"dnizinbanksii.duckdns.org","domain":"dnizinbanksii.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"196.251.72.165","port":443,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://dnizinbanksii.duckdns.org/bireysel/","date":"2025-10-14T10:51:39.803Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnizinbanksii.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 13 Oct 2025 14:07:42 GMT","end":"Sun, 11 Jan 2026 14:07:41 GMT"},"fingerprint":{"sha1":"EA:41:4A:8F:CF:7D:78:FC:5A:7C:3D:03:DA:2B:66:EC:89:F5:C6:76","sha256":"05:1A:F1:7D:61:5F:D6:22:66:E7:75:B3:19:7D:B5:3D:3F:53:0A:89:F8:3F:7C:82:25:D1:91:13:43:CC:38:60"}}},"request":{"raw":"GET /bireysel/assets/opensans-bold-webfont.c04f02eb3292e49d2d4e.woff HTTP/1.1\r\nHost: dnizinbanksii.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://dnizinbanksii.duckdns.org/bireysel/styles.607e0aa47fe465ab09bf.css\r\nCookie: PHPSESSID=5a118ff79cd8e2c90424eaf2ea68d949\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx\r\nDate: Tue, 14 Oct 2025 10:51:39 GMT\r\nContent-Type: text/html\r\nContent-Length: 808\r\nConnection: keep-alive\r\nLast-Modified: Mon, 13 Oct 2025 15:04:58 GMT\r\nETag: \"328-6410b973e1a6b\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-20T11:47:09.562203Z","times_seen":38907,"resource_available":true,"data":null}},"time_used":60,"timings":{"blocked":7,"dns":0,"connect":0,"send":0,"wait":53,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"dnizinbanksii.duckdns.org/favicon.ico","fqdn":"dnizinbanksii.duckdns.org","domain":"dnizinbanksii.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"196.251.72.165","port":443,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dnizinbanksii.duckdns.org/bireysel/","date":"2025-10-14T10:51:40.032Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnizinbanksii.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 13 Oct 2025 14:07:42 GMT","end":"Sun, 11 Jan 2026 14:07:41 GMT"},"fingerprint":{"sha1":"EA:41:4A:8F:CF:7D:78:FC:5A:7C:3D:03:DA:2B:66:EC:89:F5:C6:76","sha256":"05:1A:F1:7D:61:5F:D6:22:66:E7:75:B3:19:7D:B5:3D:3F:53:0A:89:F8:3F:7C:82:25:D1:91:13:43:CC:38:60"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: dnizinbanksii.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://dnizinbanksii.duckdns.org/bireysel/\r\nCookie: PHPSESSID=5a118ff79cd8e2c90424eaf2ea68d949\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx\r\nDate: Tue, 14 Oct 2025 10:51:40 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Mon, 13 Oct 2025 15:04:58 GMT\r\nETag: W/\"328-6410b973e1a6b\"\r\nContent-Encoding: br\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-20T11:47:09.562203Z","times_seen":38907,"resource_available":true,"data":null}},"time_used":44,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":44,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"dnizinbanksii.duckdns.org/bireysel/check_redirect.php","fqdn":"dnizinbanksii.duckdns.org","domain":"dnizinbanksii.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"196.251.72.165","port":443,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://dnizinbanksii.duckdns.org/bireysel/","date":"2025-10-14T10:51:47.820Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnizinbanksii.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 13 Oct 2025 14:07:42 GMT","end":"Sun, 11 Jan 2026 14:07:41 GMT"},"fingerprint":{"sha1":"EA:41:4A:8F:CF:7D:78:FC:5A:7C:3D:03:DA:2B:66:EC:89:F5:C6:76","sha256":"05:1A:F1:7D:61:5F:D6:22:66:E7:75:B3:19:7D:B5:3D:3F:53:0A:89:F8:3F:7C:82:25:D1:91:13:43:CC:38:60"}}},"request":{"raw":"GET /bireysel/check_redirect.php HTTP/1.1\r\nHost: dnizinbanksii.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/javascript, */*; q=0.01\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://dnizinbanksii.duckdns.org/bireysel/\r\nCookie: PHPSESSID=5a118ff79cd8e2c90424eaf2ea68d949\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 14 Oct 2025 10:51:47 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate\r\nPragma: no-cache\r\nX-Powered-By: PHP/8.4.13, PleskLin\r\nContent-Encoding: br\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:8.4.13","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":18,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"91c77473661b0e08b45770c3609d1d7b","sha1":"22eda263bbce6c53604f2a62d2f1072c1a383fae","sha256":"9eab495eb8b3e4644ce57aec5a13d4a074aad6301140e849845cb53ef8234ce2","sha512":"f44d42699a344009207672da697ca9adf73a397eba154c6710e9399e8b8fcb19b34e86e4a043eec495e90b41ba251346919cd07ae59f648bf030e00b74eeb814","ssdeep":"","tlshash":"f4700000208028882000008a02080e0202020000300c2028c00a0200288a0020008002","first_seen":"2024-09-19T20:50:52.38086Z","last_seen":"2026-08-18T23:25:15.406562Z","times_seen":183,"resource_available":false,"data":null}},"time_used":46,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":46,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"dnizinbanksii.duckdns.org/bireysel/check_redirect.php","fqdn":"dnizinbanksii.duckdns.org","domain":"dnizinbanksii.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"196.251.72.165","port":443,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://dnizinbanksii.duckdns.org/bireysel/","date":"2025-10-14T10:51:56.825Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnizinbanksii.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 13 Oct 2025 14:07:42 GMT","end":"Sun, 11 Jan 2026 14:07:41 GMT"},"fingerprint":{"sha1":"EA:41:4A:8F:CF:7D:78:FC:5A:7C:3D:03:DA:2B:66:EC:89:F5:C6:76","sha256":"05:1A:F1:7D:61:5F:D6:22:66:E7:75:B3:19:7D:B5:3D:3F:53:0A:89:F8:3F:7C:82:25:D1:91:13:43:CC:38:60"}}},"request":{"raw":"GET /bireysel/check_redirect.php HTTP/1.1\r\nHost: dnizinbanksii.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/javascript, */*; q=0.01\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://dnizinbanksii.duckdns.org/bireysel/\r\nCookie: PHPSESSID=5a118ff79cd8e2c90424eaf2ea68d949\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 14 Oct 2025 10:51:56 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate\r\nPragma: no-cache\r\nX-Powered-By: PHP/8.4.13, PleskLin\r\nContent-Encoding: br\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP:8.4.13","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":18,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"91c77473661b0e08b45770c3609d1d7b","sha1":"22eda263bbce6c53604f2a62d2f1072c1a383fae","sha256":"9eab495eb8b3e4644ce57aec5a13d4a074aad6301140e849845cb53ef8234ce2","sha512":"f44d42699a344009207672da697ca9adf73a397eba154c6710e9399e8b8fcb19b34e86e4a043eec495e90b41ba251346919cd07ae59f648bf030e00b74eeb814","ssdeep":"","tlshash":"f4700000208028882000008a02080e0202020000300c2028c00a0200288a0020008002","first_seen":"2024-09-19T20:50:52.38086Z","last_seen":"2026-08-18T23:25:15.406562Z","times_seen":183,"resource_available":false,"data":null}},"time_used":60,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":60,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"dnizinbanksii.duckdns.org/bireysel/check_redirect.php","fqdn":"dnizinbanksii.duckdns.org","domain":"dnizinbanksii.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"196.251.72.165","port":443,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://dnizinbanksii.duckdns.org/bireysel/","date":"2025-10-14T10:51:59.825Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnizinbanksii.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 13 Oct 2025 14:07:42 GMT","end":"Sun, 11 Jan 2026 14:07:41 GMT"},"fingerprint":{"sha1":"EA:41:4A:8F:CF:7D:78:FC:5A:7C:3D:03:DA:2B:66:EC:89:F5:C6:76","sha256":"05:1A:F1:7D:61:5F:D6:22:66:E7:75:B3:19:7D:B5:3D:3F:53:0A:89:F8:3F:7C:82:25:D1:91:13:43:CC:38:60"}}},"request":{"raw":"GET /bireysel/check_redirect.php HTTP/1.1\r\nHost: dnizinbanksii.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/javascript, */*; q=0.01\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://dnizinbanksii.duckdns.org/bireysel/\r\nCookie: PHPSESSID=5a118ff79cd8e2c90424eaf2ea68d949\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 14 Oct 2025 10:51:59 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate\r\nPragma: no-cache\r\nX-Powered-By: PHP/8.4.13, PleskLin\r\nContent-Encoding: br\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:8.4.13","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":18,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"91c77473661b0e08b45770c3609d1d7b","sha1":"22eda263bbce6c53604f2a62d2f1072c1a383fae","sha256":"9eab495eb8b3e4644ce57aec5a13d4a074aad6301140e849845cb53ef8234ce2","sha512":"f44d42699a344009207672da697ca9adf73a397eba154c6710e9399e8b8fcb19b34e86e4a043eec495e90b41ba251346919cd07ae59f648bf030e00b74eeb814","ssdeep":"","tlshash":"f4700000208028882000008a02080e0202020000300c2028c00a0200288a0020008002","first_seen":"2024-09-19T20:50:52.38086Z","last_seen":"2026-08-18T23:25:15.406562Z","times_seen":183,"resource_available":false,"data":null}},"time_used":75,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":75,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"dnizinbanksii.duckdns.org/bireysel/assets/opensans-bold-webfont.7b013a3110831768093f.woff2","fqdn":"dnizinbanksii.duckdns.org","domain":"dnizinbanksii.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"196.251.72.165","port":443,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://dnizinbanksii.duckdns.org/bireysel/","date":"2025-10-14T10:51:39.706Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnizinbanksii.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 13 Oct 2025 14:07:42 GMT","end":"Sun, 11 Jan 2026 14:07:41 GMT"},"fingerprint":{"sha1":"EA:41:4A:8F:CF:7D:78:FC:5A:7C:3D:03:DA:2B:66:EC:89:F5:C6:76","sha256":"05:1A:F1:7D:61:5F:D6:22:66:E7:75:B3:19:7D:B5:3D:3F:53:0A:89:F8:3F:7C:82:25:D1:91:13:43:CC:38:60"}}},"request":{"raw":"GET /bireysel/assets/opensans-bold-webfont.7b013a3110831768093f.woff2 HTTP/1.1\r\nHost: dnizinbanksii.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://dnizinbanksii.duckdns.org/bireysel/styles.607e0aa47fe465ab09bf.css\r\nCookie: PHPSESSID=5a118ff79cd8e2c90424eaf2ea68d949\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx\r\nDate: Tue, 14 Oct 2025 10:51:39 GMT\r\nContent-Type: text/html\r\nContent-Length: 808\r\nConnection: keep-alive\r\nLast-Modified: Mon, 13 Oct 2025 15:04:58 GMT\r\nETag: \"328-6410b973e1a6b\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-20T11:47:09.562203Z","times_seen":38907,"resource_available":true,"data":null}},"time_used":85,"timings":{"blocked":36,"dns":0,"connect":0,"send":0,"wait":49,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"dnizinbanksii.duckdns.org/bireysel/check_redirect.php","fqdn":"dnizinbanksii.duckdns.org","domain":"dnizinbanksii.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"196.251.72.165","port":443,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://dnizinbanksii.duckdns.org/bireysel/","date":"2025-10-14T10:51:45.817Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnizinbanksii.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 13 Oct 2025 14:07:42 GMT","end":"Sun, 11 Jan 2026 14:07:41 GMT"},"fingerprint":{"sha1":"EA:41:4A:8F:CF:7D:78:FC:5A:7C:3D:03:DA:2B:66:EC:89:F5:C6:76","sha256":"05:1A:F1:7D:61:5F:D6:22:66:E7:75:B3:19:7D:B5:3D:3F:53:0A:89:F8:3F:7C:82:25:D1:91:13:43:CC:38:60"}}},"request":{"raw":"GET /bireysel/check_redirect.php HTTP/1.1\r\nHost: dnizinbanksii.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/javascript, */*; q=0.01\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://dnizinbanksii.duckdns.org/bireysel/\r\nCookie: PHPSESSID=5a118ff79cd8e2c90424eaf2ea68d949\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 14 Oct 2025 10:51:45 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate\r\nPragma: no-cache\r\nX-Powered-By: PHP/8.4.13, PleskLin\r\nContent-Encoding: br\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP:8.4.13","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":18,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"91c77473661b0e08b45770c3609d1d7b","sha1":"22eda263bbce6c53604f2a62d2f1072c1a383fae","sha256":"9eab495eb8b3e4644ce57aec5a13d4a074aad6301140e849845cb53ef8234ce2","sha512":"f44d42699a344009207672da697ca9adf73a397eba154c6710e9399e8b8fcb19b34e86e4a043eec495e90b41ba251346919cd07ae59f648bf030e00b74eeb814","ssdeep":"","tlshash":"f4700000208028882000008a02080e0202020000300c2028c00a0200288a0020008002","first_seen":"2024-09-19T20:50:52.38086Z","last_seen":"2026-08-18T23:25:15.406562Z","times_seen":183,"resource_available":false,"data":null}},"time_used":57,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":57,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"dnizinbanksii.duckdns.org/bireysel/check_redirect.php","fqdn":"dnizinbanksii.duckdns.org","domain":"dnizinbanksii.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"196.251.72.165","port":443,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://dnizinbanksii.duckdns.org/bireysel/","date":"2025-10-14T10:51:57.824Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnizinbanksii.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 13 Oct 2025 14:07:42 GMT","end":"Sun, 11 Jan 2026 14:07:41 GMT"},"fingerprint":{"sha1":"EA:41:4A:8F:CF:7D:78:FC:5A:7C:3D:03:DA:2B:66:EC:89:F5:C6:76","sha256":"05:1A:F1:7D:61:5F:D6:22:66:E7:75:B3:19:7D:B5:3D:3F:53:0A:89:F8:3F:7C:82:25:D1:91:13:43:CC:38:60"}}},"request":{"raw":"GET /bireysel/check_redirect.php HTTP/1.1\r\nHost: dnizinbanksii.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/javascript, */*; q=0.01\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://dnizinbanksii.duckdns.org/bireysel/\r\nCookie: PHPSESSID=5a118ff79cd8e2c90424eaf2ea68d949\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 14 Oct 2025 10:51:57 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate\r\nPragma: no-cache\r\nX-Powered-By: PHP/8.4.13, PleskLin\r\nContent-Encoding: br\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP:8.4.13","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":18,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"91c77473661b0e08b45770c3609d1d7b","sha1":"22eda263bbce6c53604f2a62d2f1072c1a383fae","sha256":"9eab495eb8b3e4644ce57aec5a13d4a074aad6301140e849845cb53ef8234ce2","sha512":"f44d42699a344009207672da697ca9adf73a397eba154c6710e9399e8b8fcb19b34e86e4a043eec495e90b41ba251346919cd07ae59f648bf030e00b74eeb814","ssdeep":"","tlshash":"f4700000208028882000008a02080e0202020000300c2028c00a0200288a0020008002","first_seen":"2024-09-19T20:50:52.38086Z","last_seen":"2026-08-18T23:25:15.406562Z","times_seen":183,"resource_available":false,"data":null}},"time_used":70,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":70,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"dnizinbanksii.duckdns.org/bireysel/check_ban_status.php","fqdn":"dnizinbanksii.duckdns.org","domain":"dnizinbanksii.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"196.251.72.165","port":443,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://dnizinbanksii.duckdns.org/bireysel/","date":"2025-10-14T10:51:59.822Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnizinbanksii.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 13 Oct 2025 14:07:42 GMT","end":"Sun, 11 Jan 2026 14:07:41 GMT"},"fingerprint":{"sha1":"EA:41:4A:8F:CF:7D:78:FC:5A:7C:3D:03:DA:2B:66:EC:89:F5:C6:76","sha256":"05:1A:F1:7D:61:5F:D6:22:66:E7:75:B3:19:7D:B5:3D:3F:53:0A:89:F8:3F:7C:82:25:D1:91:13:43:CC:38:60"}}},"request":{"raw":"GET /bireysel/check_ban_status.php HTTP/1.1\r\nHost: dnizinbanksii.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/javascript, */*; q=0.01\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://dnizinbanksii.duckdns.org/bireysel/\r\nCookie: PHPSESSID=5a118ff79cd8e2c90424eaf2ea68d949\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 14 Oct 2025 10:51:59 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Length: 39\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\nX-Powered-By: PHP/8.4.13, PleskLin\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP:8.4.13","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":19,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"JSON text data","md5":"0ccc2622b6704ac5e940f7b96b5cb19b","sha1":"b04d957282d22596bc1a796c16e2affdc4838ed2","sha256":"ffcc9870a751a0241f5f2bdac8e6646c40b92bb226e8efc4af2e29cc242fc176","sha512":"d257e21c24aa9d6680847a712acc1c07a36bfc2393bbb9bb13b5da5127d6b9afe03db7701fb6bd1fc4338a333ee67d8041f1547b38e83c57acd9fde61478e915","ssdeep":"","tlshash":"da7000000000203008800808002000a02aa02ac0203a00e0380c00280a008c08008002","first_seen":"2023-06-27T00:24:01Z","last_seen":"2026-07-21T10:45:08.577048Z","times_seen":64,"resource_available":false,"data":null}},"time_used":62,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":62,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"dnizinbanksii.duckdns.org/bireysel/styles.607e0aa47fe465ab09bf.css","fqdn":"dnizinbanksii.duckdns.org","domain":"dnizinbanksii.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"196.251.72.165","port":443,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://dnizinbanksii.duckdns.org/bireysel/","date":"2025-10-14T10:51:39.378Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnizinbanksii.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 13 Oct 2025 14:07:42 GMT","end":"Sun, 11 Jan 2026 14:07:41 GMT"},"fingerprint":{"sha1":"EA:41:4A:8F:CF:7D:78:FC:5A:7C:3D:03:DA:2B:66:EC:89:F5:C6:76","sha256":"05:1A:F1:7D:61:5F:D6:22:66:E7:75:B3:19:7D:B5:3D:3F:53:0A:89:F8:3F:7C:82:25:D1:91:13:43:CC:38:60"}}},"request":{"raw":"GET /bireysel/styles.607e0aa47fe465ab09bf.css HTTP/1.1\r\nHost: dnizinbanksii.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://dnizinbanksii.duckdns.org/bireysel/\r\nCookie: PHPSESSID=5a118ff79cd8e2c90424eaf2ea68d949\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 14 Oct 2025 10:51:39 GMT\r\nContent-Type: text/css\r\nLast-Modified: Tue, 16 Sep 2025 19:14:43 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"68c9b723-ecf5a\"\r\nX-Powered-By: PleskLin\r\nContent-Encoding: br\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":970586,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (53143), with CRLF line terminators","md5":"cabc2147869fb668412b18c1cb50b21a","sha1":"c05a839f6b0b379742c9ddaa40921216266d1f58","sha256":"c719a0eefd017d4d547513fa258cef0677f7c0e337a5fc0573491ff81d86ab7d","sha512":"02cfc9aa786f57f632e1835b2c2ed9eeaf5f545da04b2fc2b7e2f7eb722c91b83e2c2ded5ff1496b6f55b9d521ca182fc7c700371827463662bb341c6369a7ab","ssdeep":"6144:/RTsyc/lK/q3SYiLENM6HN26rLr65TS0raXhpev333iaAKiX7apNBZvFU1yv4BBj:/RTsNRHiYTq0Q+QawedDPXCnK","tlshash":"3a25f872f664302db667c26ea490b7bd192ad051e7220ffef603a22887c55d70367e1d","first_seen":"2025-09-24T01:33:00.410488Z","last_seen":"2025-10-14T10:52:07.160527Z","times_seen":11,"resource_available":false,"data":null}},"time_used":189,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":138,"receive":51,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"dnizinbanksii.duckdns.org/bireysel/assets/opensans-regular-webfont.d389759376bc2ac55ee9.woff","fqdn":"dnizinbanksii.duckdns.org","domain":"dnizinbanksii.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"196.251.72.165","port":443,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://dnizinbanksii.duckdns.org/bireysel/","date":"2025-10-14T10:51:39.757Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnizinbanksii.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 13 Oct 2025 14:07:42 GMT","end":"Sun, 11 Jan 2026 14:07:41 GMT"},"fingerprint":{"sha1":"EA:41:4A:8F:CF:7D:78:FC:5A:7C:3D:03:DA:2B:66:EC:89:F5:C6:76","sha256":"05:1A:F1:7D:61:5F:D6:22:66:E7:75:B3:19:7D:B5:3D:3F:53:0A:89:F8:3F:7C:82:25:D1:91:13:43:CC:38:60"}}},"request":{"raw":"GET /bireysel/assets/opensans-regular-webfont.d389759376bc2ac55ee9.woff HTTP/1.1\r\nHost: dnizinbanksii.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://dnizinbanksii.duckdns.org/bireysel/styles.607e0aa47fe465ab09bf.css\r\nCookie: PHPSESSID=5a118ff79cd8e2c90424eaf2ea68d949\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx\r\nDate: Tue, 14 Oct 2025 10:51:39 GMT\r\nContent-Type: text/html\r\nContent-Length: 808\r\nConnection: keep-alive\r\nLast-Modified: Mon, 13 Oct 2025 15:04:58 GMT\r\nETag: \"328-6410b973e1a6b\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-20T11:47:09.562203Z","times_seen":38907,"resource_available":true,"data":null}},"time_used":55,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":55,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"dnizinbanksii.duckdns.org/bireysel/assets/opensans-semibold-webfont.ba28aba0329c0fc0e825.woff","fqdn":"dnizinbanksii.duckdns.org","domain":"dnizinbanksii.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"196.251.72.165","port":443,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://dnizinbanksii.duckdns.org/bireysel/","date":"2025-10-14T10:51:39.761Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnizinbanksii.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 13 Oct 2025 14:07:42 GMT","end":"Sun, 11 Jan 2026 14:07:41 GMT"},"fingerprint":{"sha1":"EA:41:4A:8F:CF:7D:78:FC:5A:7C:3D:03:DA:2B:66:EC:89:F5:C6:76","sha256":"05:1A:F1:7D:61:5F:D6:22:66:E7:75:B3:19:7D:B5:3D:3F:53:0A:89:F8:3F:7C:82:25:D1:91:13:43:CC:38:60"}}},"request":{"raw":"GET /bireysel/assets/opensans-semibold-webfont.ba28aba0329c0fc0e825.woff HTTP/1.1\r\nHost: dnizinbanksii.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://dnizinbanksii.duckdns.org/bireysel/styles.607e0aa47fe465ab09bf.css\r\nCookie: PHPSESSID=5a118ff79cd8e2c90424eaf2ea68d949\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx\r\nDate: Tue, 14 Oct 2025 10:51:39 GMT\r\nContent-Type: text/html\r\nContent-Length: 808\r\nConnection: keep-alive\r\nLast-Modified: Mon, 13 Oct 2025 15:04:58 GMT\r\nETag: \"328-6410b973e1a6b\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-20T11:47:09.562203Z","times_seen":38907,"resource_available":true,"data":null}},"time_used":72,"timings":{"blocked":19,"dns":0,"connect":0,"send":0,"wait":53,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"dnizinbanksii.duckdns.org/bireysel/check_ban_status.php","fqdn":"dnizinbanksii.duckdns.org","domain":"dnizinbanksii.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"196.251.72.165","port":443,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://dnizinbanksii.duckdns.org/bireysel/","date":"2025-10-14T10:51:44.820Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnizinbanksii.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 13 Oct 2025 14:07:42 GMT","end":"Sun, 11 Jan 2026 14:07:41 GMT"},"fingerprint":{"sha1":"EA:41:4A:8F:CF:7D:78:FC:5A:7C:3D:03:DA:2B:66:EC:89:F5:C6:76","sha256":"05:1A:F1:7D:61:5F:D6:22:66:E7:75:B3:19:7D:B5:3D:3F:53:0A:89:F8:3F:7C:82:25:D1:91:13:43:CC:38:60"}}},"request":{"raw":"GET /bireysel/check_ban_status.php HTTP/1.1\r\nHost: dnizinbanksii.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/javascript, */*; q=0.01\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://dnizinbanksii.duckdns.org/bireysel/\r\nCookie: PHPSESSID=5a118ff79cd8e2c90424eaf2ea68d949\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 14 Oct 2025 10:51:44 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Length: 39\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\nX-Powered-By: PHP/8.4.13, PleskLin\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP:8.4.13","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":19,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"JSON text data","md5":"0ccc2622b6704ac5e940f7b96b5cb19b","sha1":"b04d957282d22596bc1a796c16e2affdc4838ed2","sha256":"ffcc9870a751a0241f5f2bdac8e6646c40b92bb226e8efc4af2e29cc242fc176","sha512":"d257e21c24aa9d6680847a712acc1c07a36bfc2393bbb9bb13b5da5127d6b9afe03db7701fb6bd1fc4338a333ee67d8041f1547b38e83c57acd9fde61478e915","ssdeep":"","tlshash":"da7000000000203008800808002000a02aa02ac0203a00e0380c00280a008c08008002","first_seen":"2023-06-27T00:24:01Z","last_seen":"2026-07-21T10:45:08.577048Z","times_seen":64,"resource_available":false,"data":null}},"time_used":51,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":51,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"dnizinbanksii.duckdns.org/bireysel/check_redirect.php","fqdn":"dnizinbanksii.duckdns.org","domain":"dnizinbanksii.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"196.251.72.165","port":443,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://dnizinbanksii.duckdns.org/bireysel/","date":"2025-10-14T10:51:46.817Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnizinbanksii.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 13 Oct 2025 14:07:42 GMT","end":"Sun, 11 Jan 2026 14:07:41 GMT"},"fingerprint":{"sha1":"EA:41:4A:8F:CF:7D:78:FC:5A:7C:3D:03:DA:2B:66:EC:89:F5:C6:76","sha256":"05:1A:F1:7D:61:5F:D6:22:66:E7:75:B3:19:7D:B5:3D:3F:53:0A:89:F8:3F:7C:82:25:D1:91:13:43:CC:38:60"}}},"request":{"raw":"GET /bireysel/check_redirect.php HTTP/1.1\r\nHost: dnizinbanksii.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/javascript, */*; q=0.01\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://dnizinbanksii.duckdns.org/bireysel/\r\nCookie: PHPSESSID=5a118ff79cd8e2c90424eaf2ea68d949\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 14 Oct 2025 10:51:46 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate\r\nPragma: no-cache\r\nX-Powered-By: PHP/8.4.13, PleskLin\r\nContent-Encoding: br\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:8.4.13","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":18,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"91c77473661b0e08b45770c3609d1d7b","sha1":"22eda263bbce6c53604f2a62d2f1072c1a383fae","sha256":"9eab495eb8b3e4644ce57aec5a13d4a074aad6301140e849845cb53ef8234ce2","sha512":"f44d42699a344009207672da697ca9adf73a397eba154c6710e9399e8b8fcb19b34e86e4a043eec495e90b41ba251346919cd07ae59f648bf030e00b74eeb814","ssdeep":"","tlshash":"f4700000208028882000008a02080e0202020000300c2028c00a0200288a0020008002","first_seen":"2024-09-19T20:50:52.38086Z","last_seen":"2026-08-18T23:25:15.406562Z","times_seen":183,"resource_available":false,"data":null}},"time_used":56,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":56,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"dnizinbanksii.duckdns.org/bireysel/check_redirect.php","fqdn":"dnizinbanksii.duckdns.org","domain":"dnizinbanksii.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"196.251.72.165","port":443,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://dnizinbanksii.duckdns.org/bireysel/","date":"2025-10-14T10:52:00.825Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnizinbanksii.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 13 Oct 2025 14:07:42 GMT","end":"Sun, 11 Jan 2026 14:07:41 GMT"},"fingerprint":{"sha1":"EA:41:4A:8F:CF:7D:78:FC:5A:7C:3D:03:DA:2B:66:EC:89:F5:C6:76","sha256":"05:1A:F1:7D:61:5F:D6:22:66:E7:75:B3:19:7D:B5:3D:3F:53:0A:89:F8:3F:7C:82:25:D1:91:13:43:CC:38:60"}}},"request":{"raw":"GET /bireysel/check_redirect.php HTTP/1.1\r\nHost: dnizinbanksii.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/javascript, */*; q=0.01\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://dnizinbanksii.duckdns.org/bireysel/\r\nCookie: PHPSESSID=5a118ff79cd8e2c90424eaf2ea68d949\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 14 Oct 2025 10:52:00 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate\r\nPragma: no-cache\r\nX-Powered-By: PHP/8.4.13, PleskLin\r\nContent-Encoding: br\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:8.4.13","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":18,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"91c77473661b0e08b45770c3609d1d7b","sha1":"22eda263bbce6c53604f2a62d2f1072c1a383fae","sha256":"9eab495eb8b3e4644ce57aec5a13d4a074aad6301140e849845cb53ef8234ce2","sha512":"f44d42699a344009207672da697ca9adf73a397eba154c6710e9399e8b8fcb19b34e86e4a043eec495e90b41ba251346919cd07ae59f648bf030e00b74eeb814","ssdeep":"","tlshash":"f4700000208028882000008a02080e0202020000300c2028c00a0200288a0020008002","first_seen":"2024-09-19T20:50:52.38086Z","last_seen":"2026-08-18T23:25:15.406562Z","times_seen":183,"resource_available":false,"data":null}},"time_used":44,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":44,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"dnizinbanksii.duckdns.org/assets/script.js","fqdn":"dnizinbanksii.duckdns.org","domain":"dnizinbanksii.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"196.251.72.165","port":443,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://dnizinbanksii.duckdns.org/bireysel/","date":"2025-10-14T10:51:39.388Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnizinbanksii.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 13 Oct 2025 14:07:42 GMT","end":"Sun, 11 Jan 2026 14:07:41 GMT"},"fingerprint":{"sha1":"EA:41:4A:8F:CF:7D:78:FC:5A:7C:3D:03:DA:2B:66:EC:89:F5:C6:76","sha256":"05:1A:F1:7D:61:5F:D6:22:66:E7:75:B3:19:7D:B5:3D:3F:53:0A:89:F8:3F:7C:82:25:D1:91:13:43:CC:38:60"}}},"request":{"raw":"GET /assets/script.js HTTP/1.1\r\nHost: dnizinbanksii.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://dnizinbanksii.duckdns.org/bireysel/\r\nCookie: PHPSESSID=5a118ff79cd8e2c90424eaf2ea68d949\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx\r\nDate: Tue, 14 Oct 2025 10:51:39 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Mon, 13 Oct 2025 15:04:58 GMT\r\nETag: W/\"328-6410b973e1a6b\"\r\nContent-Encoding: br\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-20T11:47:09.562203Z","times_seen":38907,"resource_available":true,"data":null}},"time_used":184,"timings":{"blocked":48,"dns":1,"connect":24,"send":0,"wait":74,"receive":0,"ssl":35},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"dnizinbanksii.duckdns.org/bireysel/assets/icomoon.c45011277275449bebc0.woff?hblziw","fqdn":"dnizinbanksii.duckdns.org","domain":"dnizinbanksii.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"196.251.72.165","port":443,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://dnizinbanksii.duckdns.org/bireysel/","date":"2025-10-14T10:51:39.765Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnizinbanksii.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 13 Oct 2025 14:07:42 GMT","end":"Sun, 11 Jan 2026 14:07:41 GMT"},"fingerprint":{"sha1":"EA:41:4A:8F:CF:7D:78:FC:5A:7C:3D:03:DA:2B:66:EC:89:F5:C6:76","sha256":"05:1A:F1:7D:61:5F:D6:22:66:E7:75:B3:19:7D:B5:3D:3F:53:0A:89:F8:3F:7C:82:25:D1:91:13:43:CC:38:60"}}},"request":{"raw":"GET /bireysel/assets/icomoon.c45011277275449bebc0.woff?hblziw HTTP/1.1\r\nHost: dnizinbanksii.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://dnizinbanksii.duckdns.org/bireysel/styles.607e0aa47fe465ab09bf.css\r\nCookie: PHPSESSID=5a118ff79cd8e2c90424eaf2ea68d949\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx\r\nDate: Tue, 14 Oct 2025 10:51:39 GMT\r\nContent-Type: text/html\r\nContent-Length: 808\r\nConnection: keep-alive\r\nLast-Modified: Mon, 13 Oct 2025 15:04:58 GMT\r\nETag: \"328-6410b973e1a6b\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-20T11:47:09.562203Z","times_seen":38907,"resource_available":true,"data":null}},"time_used":77,"timings":{"blocked":26,"dns":0,"connect":0,"send":0,"wait":51,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"dnizinbanksii.duckdns.org/bireysel/check_redirect.php","fqdn":"dnizinbanksii.duckdns.org","domain":"dnizinbanksii.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"196.251.72.165","port":443,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://dnizinbanksii.duckdns.org/bireysel/","date":"2025-10-14T10:51:41.816Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnizinbanksii.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 13 Oct 2025 14:07:42 GMT","end":"Sun, 11 Jan 2026 14:07:41 GMT"},"fingerprint":{"sha1":"EA:41:4A:8F:CF:7D:78:FC:5A:7C:3D:03:DA:2B:66:EC:89:F5:C6:76","sha256":"05:1A:F1:7D:61:5F:D6:22:66:E7:75:B3:19:7D:B5:3D:3F:53:0A:89:F8:3F:7C:82:25:D1:91:13:43:CC:38:60"}}},"request":{"raw":"GET /bireysel/check_redirect.php HTTP/1.1\r\nHost: dnizinbanksii.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/javascript, */*; q=0.01\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://dnizinbanksii.duckdns.org/bireysel/\r\nCookie: PHPSESSID=5a118ff79cd8e2c90424eaf2ea68d949\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 14 Oct 2025 10:51:41 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate\r\nPragma: no-cache\r\nX-Powered-By: PHP/8.4.13, PleskLin\r\nContent-Encoding: br\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP:8.4.13","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":18,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"91c77473661b0e08b45770c3609d1d7b","sha1":"22eda263bbce6c53604f2a62d2f1072c1a383fae","sha256":"9eab495eb8b3e4644ce57aec5a13d4a074aad6301140e849845cb53ef8234ce2","sha512":"f44d42699a344009207672da697ca9adf73a397eba154c6710e9399e8b8fcb19b34e86e4a043eec495e90b41ba251346919cd07ae59f648bf030e00b74eeb814","ssdeep":"","tlshash":"f4700000208028882000008a02080e0202020000300c2028c00a0200288a0020008002","first_seen":"2024-09-19T20:50:52.38086Z","last_seen":"2026-08-18T23:25:15.406562Z","times_seen":183,"resource_available":false,"data":null}},"time_used":60,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":60,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"dnizinbanksii.duckdns.org/bireysel/check_redirect.php","fqdn":"dnizinbanksii.duckdns.org","domain":"dnizinbanksii.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"196.251.72.165","port":443,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://dnizinbanksii.duckdns.org/bireysel/","date":"2025-10-14T10:51:48.820Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnizinbanksii.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 13 Oct 2025 14:07:42 GMT","end":"Sun, 11 Jan 2026 14:07:41 GMT"},"fingerprint":{"sha1":"EA:41:4A:8F:CF:7D:78:FC:5A:7C:3D:03:DA:2B:66:EC:89:F5:C6:76","sha256":"05:1A:F1:7D:61:5F:D6:22:66:E7:75:B3:19:7D:B5:3D:3F:53:0A:89:F8:3F:7C:82:25:D1:91:13:43:CC:38:60"}}},"request":{"raw":"GET /bireysel/check_redirect.php HTTP/1.1\r\nHost: dnizinbanksii.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/javascript, */*; q=0.01\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://dnizinbanksii.duckdns.org/bireysel/\r\nCookie: PHPSESSID=5a118ff79cd8e2c90424eaf2ea68d949\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 14 Oct 2025 10:51:48 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate\r\nPragma: no-cache\r\nX-Powered-By: PHP/8.4.13, PleskLin\r\nContent-Encoding: br\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:8.4.13","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":18,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"91c77473661b0e08b45770c3609d1d7b","sha1":"22eda263bbce6c53604f2a62d2f1072c1a383fae","sha256":"9eab495eb8b3e4644ce57aec5a13d4a074aad6301140e849845cb53ef8234ce2","sha512":"f44d42699a344009207672da697ca9adf73a397eba154c6710e9399e8b8fcb19b34e86e4a043eec495e90b41ba251346919cd07ae59f648bf030e00b74eeb814","ssdeep":"","tlshash":"f4700000208028882000008a02080e0202020000300c2028c00a0200288a0020008002","first_seen":"2024-09-19T20:50:52.38086Z","last_seen":"2026-08-18T23:25:15.406562Z","times_seen":183,"resource_available":false,"data":null}},"time_used":46,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":46,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"dnizinbanksii.duckdns.org/bireysel/check_redirect.php","fqdn":"dnizinbanksii.duckdns.org","domain":"dnizinbanksii.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"196.251.72.165","port":443,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://dnizinbanksii.duckdns.org/bireysel/","date":"2025-10-14T10:51:49.826Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnizinbanksii.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 13 Oct 2025 14:07:42 GMT","end":"Sun, 11 Jan 2026 14:07:41 GMT"},"fingerprint":{"sha1":"EA:41:4A:8F:CF:7D:78:FC:5A:7C:3D:03:DA:2B:66:EC:89:F5:C6:76","sha256":"05:1A:F1:7D:61:5F:D6:22:66:E7:75:B3:19:7D:B5:3D:3F:53:0A:89:F8:3F:7C:82:25:D1:91:13:43:CC:38:60"}}},"request":{"raw":"GET /bireysel/check_redirect.php HTTP/1.1\r\nHost: dnizinbanksii.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/javascript, */*; q=0.01\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://dnizinbanksii.duckdns.org/bireysel/\r\nCookie: PHPSESSID=5a118ff79cd8e2c90424eaf2ea68d949\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 14 Oct 2025 10:51:49 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate\r\nPragma: no-cache\r\nX-Powered-By: PHP/8.4.13, PleskLin\r\nContent-Encoding: br\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:8.4.13","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":18,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"91c77473661b0e08b45770c3609d1d7b","sha1":"22eda263bbce6c53604f2a62d2f1072c1a383fae","sha256":"9eab495eb8b3e4644ce57aec5a13d4a074aad6301140e849845cb53ef8234ce2","sha512":"f44d42699a344009207672da697ca9adf73a397eba154c6710e9399e8b8fcb19b34e86e4a043eec495e90b41ba251346919cd07ae59f648bf030e00b74eeb814","ssdeep":"","tlshash":"f4700000208028882000008a02080e0202020000300c2028c00a0200288a0020008002","first_seen":"2024-09-19T20:50:52.38086Z","last_seen":"2026-08-18T23:25:15.406562Z","times_seen":183,"resource_available":false,"data":null}},"time_used":48,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":47,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"dnizinbanksii.duckdns.org/bireysel/check_redirect.php","fqdn":"dnizinbanksii.duckdns.org","domain":"dnizinbanksii.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"196.251.72.165","port":443,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://dnizinbanksii.duckdns.org/bireysel/","date":"2025-10-14T10:52:01.823Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnizinbanksii.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 13 Oct 2025 14:07:42 GMT","end":"Sun, 11 Jan 2026 14:07:41 GMT"},"fingerprint":{"sha1":"EA:41:4A:8F:CF:7D:78:FC:5A:7C:3D:03:DA:2B:66:EC:89:F5:C6:76","sha256":"05:1A:F1:7D:61:5F:D6:22:66:E7:75:B3:19:7D:B5:3D:3F:53:0A:89:F8:3F:7C:82:25:D1:91:13:43:CC:38:60"}}},"request":{"raw":"GET /bireysel/check_redirect.php HTTP/1.1\r\nHost: dnizinbanksii.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/javascript, */*; q=0.01\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://dnizinbanksii.duckdns.org/bireysel/\r\nCookie: PHPSESSID=5a118ff79cd8e2c90424eaf2ea68d949\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 14 Oct 2025 10:52:01 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate\r\nPragma: no-cache\r\nX-Powered-By: PHP/8.4.13, PleskLin\r\nContent-Encoding: br\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:8.4.13","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":18,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"91c77473661b0e08b45770c3609d1d7b","sha1":"22eda263bbce6c53604f2a62d2f1072c1a383fae","sha256":"9eab495eb8b3e4644ce57aec5a13d4a074aad6301140e849845cb53ef8234ce2","sha512":"f44d42699a344009207672da697ca9adf73a397eba154c6710e9399e8b8fcb19b34e86e4a043eec495e90b41ba251346919cd07ae59f648bf030e00b74eeb814","ssdeep":"","tlshash":"f4700000208028882000008a02080e0202020000300c2028c00a0200288a0020008002","first_seen":"2024-09-19T20:50:52.38086Z","last_seen":"2026-08-18T23:25:15.406562Z","times_seen":183,"resource_available":false,"data":null}},"time_used":47,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":46,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"dnizinbanksii.duckdns.org/bireysel/check_redirect.php","fqdn":"dnizinbanksii.duckdns.org","domain":"dnizinbanksii.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"196.251.72.165","port":443,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://dnizinbanksii.duckdns.org/bireysel/","date":"2025-10-14T10:51:43.815Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnizinbanksii.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 13 Oct 2025 14:07:42 GMT","end":"Sun, 11 Jan 2026 14:07:41 GMT"},"fingerprint":{"sha1":"EA:41:4A:8F:CF:7D:78:FC:5A:7C:3D:03:DA:2B:66:EC:89:F5:C6:76","sha256":"05:1A:F1:7D:61:5F:D6:22:66:E7:75:B3:19:7D:B5:3D:3F:53:0A:89:F8:3F:7C:82:25:D1:91:13:43:CC:38:60"}}},"request":{"raw":"GET /bireysel/check_redirect.php HTTP/1.1\r\nHost: dnizinbanksii.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/javascript, */*; q=0.01\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://dnizinbanksii.duckdns.org/bireysel/\r\nCookie: PHPSESSID=5a118ff79cd8e2c90424eaf2ea68d949\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 14 Oct 2025 10:51:43 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate\r\nPragma: no-cache\r\nX-Powered-By: PHP/8.4.13, PleskLin\r\nContent-Encoding: br\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:8.4.13","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":18,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"91c77473661b0e08b45770c3609d1d7b","sha1":"22eda263bbce6c53604f2a62d2f1072c1a383fae","sha256":"9eab495eb8b3e4644ce57aec5a13d4a074aad6301140e849845cb53ef8234ce2","sha512":"f44d42699a344009207672da697ca9adf73a397eba154c6710e9399e8b8fcb19b34e86e4a043eec495e90b41ba251346919cd07ae59f648bf030e00b74eeb814","ssdeep":"","tlshash":"f4700000208028882000008a02080e0202020000300c2028c00a0200288a0020008002","first_seen":"2024-09-19T20:50:52.38086Z","last_seen":"2026-08-18T23:25:15.406562Z","times_seen":183,"resource_available":false,"data":null}},"time_used":49,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":49,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"dnizinbanksii.duckdns.org/bireysel/assets/icomoon.dec58148a6d30404f2ff.ttf?hblziw","fqdn":"dnizinbanksii.duckdns.org","domain":"dnizinbanksii.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"196.251.72.165","port":443,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://dnizinbanksii.duckdns.org/bireysel/","date":"2025-10-14T10:51:39.697Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnizinbanksii.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 13 Oct 2025 14:07:42 GMT","end":"Sun, 11 Jan 2026 14:07:41 GMT"},"fingerprint":{"sha1":"EA:41:4A:8F:CF:7D:78:FC:5A:7C:3D:03:DA:2B:66:EC:89:F5:C6:76","sha256":"05:1A:F1:7D:61:5F:D6:22:66:E7:75:B3:19:7D:B5:3D:3F:53:0A:89:F8:3F:7C:82:25:D1:91:13:43:CC:38:60"}}},"request":{"raw":"GET /bireysel/assets/icomoon.dec58148a6d30404f2ff.ttf?hblziw HTTP/1.1\r\nHost: dnizinbanksii.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://dnizinbanksii.duckdns.org/bireysel/styles.607e0aa47fe465ab09bf.css\r\nCookie: PHPSESSID=5a118ff79cd8e2c90424eaf2ea68d949\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx\r\nDate: Tue, 14 Oct 2025 10:51:39 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Mon, 13 Oct 2025 15:04:58 GMT\r\nETag: W/\"328-6410b973e1a6b\"\r\nContent-Encoding: br\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-20T11:47:09.562203Z","times_seen":38907,"resource_available":true,"data":null}},"time_used":55,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":55,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"dnizinbanksii.duckdns.org/bireysel/img/logo-light.svg","fqdn":"dnizinbanksii.duckdns.org","domain":"dnizinbanksii.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"196.251.72.165","port":443,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://dnizinbanksii.duckdns.org/bireysel/","date":"2025-10-14T10:51:39.384Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnizinbanksii.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 13 Oct 2025 14:07:42 GMT","end":"Sun, 11 Jan 2026 14:07:41 GMT"},"fingerprint":{"sha1":"EA:41:4A:8F:CF:7D:78:FC:5A:7C:3D:03:DA:2B:66:EC:89:F5:C6:76","sha256":"05:1A:F1:7D:61:5F:D6:22:66:E7:75:B3:19:7D:B5:3D:3F:53:0A:89:F8:3F:7C:82:25:D1:91:13:43:CC:38:60"}}},"request":{"raw":"GET /bireysel/img/logo-light.svg HTTP/1.1\r\nHost: dnizinbanksii.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://dnizinbanksii.duckdns.org/bireysel/\r\nCookie: PHPSESSID=5a118ff79cd8e2c90424eaf2ea68d949\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 14 Oct 2025 10:51:39 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 180545\r\nLast-Modified: Tue, 16 Sep 2025 19:14:43 GMT\r\nConnection: keep-alive\r\nETag: \"68c9b723-2c141\"\r\nX-Powered-By: PleskLin\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":180545,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"3140e053e7a3dde67e7b2c81b23771d2","sha1":"5d0558f8da94ace88a622c70b8857bde38d7ba12","sha256":"3da913d79fff46cfe4d58d56e141cfcb31865606284507f7a530db69394330fb","sha512":"1b1a21016b9b99d5b58949777b260741fc9f2241ada76cc45482cb45b4f8a3ea32b6a4af53016bb2eb7b72ea3143e22826b366af723b37e383d1f4109eaaf2e5","ssdeep":"768:CvgpvgXvgdvgrvgRvgfvglvgTvg5vgnvgtvg7vgjvgJvg3vg9vgLvgxvg/vgFvgl:RJA3KuhQbJ","tlshash":"fc0457e31b60a25067d3e40eef61a5a4651be1f9d93382c6b2afc74957e3bc8f502d10","first_seen":"2023-05-01T10:01:38Z","last_seen":"2026-05-15T18:36:15.598199Z","times_seen":177,"resource_available":false,"data":null}},"time_used":295,"timings":{"blocked":179,"dns":0,"connect":0,"send":0,"wait":63,"receive":53,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"code.jquery.com/jquery-3.6.0.min.js","fqdn":"code.jquery.com","domain":"jquery.com","tld":"com"},"ip":{"addr":"151.101.130.137","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://dnizinbanksii.duckdns.org/bireysel/","date":"2025-10-14T10:51:39.387Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.jquery.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV E36","organization":"Sectigo Limited"},"validity":{"start":"Thu, 12 Jun 2025 00:00:00 GMT","end":"Fri, 26 Jun 2026 23:59:59 GMT"},"fingerprint":{"sha1":"56:36:FB:D3:E0:9E:71:88:98:A4:C9:34:94:9B:43:3A:C4:C5:1E:BE","sha256":"9A:64:20:6F:F5:DC:F1:8A:D6:B2:D0:93:C2:7E:62:86:0B:1A:D5:24:CF:CE:4A:9F:4C:0D:F1:FB:F2:A0:A8:1E"}}},"request":{"raw":"GET /jquery-3.6.0.min.js HTTP/1.1\r\nHost: code.jquery.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://dnizinbanksii.duckdns.org/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 18 Oct 1991 12:00:00 GMT\r\netag: W/\"28feccc0-15d9d\"\r\ncache-control: public, max-age=31536000, stale-while-revalidate=604800\r\naccess-control-allow-origin: *\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nvia: 1.1 varnish, 1.1 varnish\r\naccept-ranges: bytes\r\ndate: Tue, 14 Oct 2025 10:51:39 GMT\r\nage: 2428689\r\nx-served-by: cache-lga21931-LGA, cache-hel1410025-HEL\r\nx-cache: HIT, HIT\r\nx-cache-hits: 71, 652395\r\nx-timer: S1760439099.448298,VS0,VE0\r\nvary: Accept-Encoding\r\ncontent-length: 30875\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":89501,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65447)","md5":"8fb8fee4fcc3cc86ff6c724154c49c42","sha1":"b82d238d4e31fdf618bae8ac11a6c812c03dd0d4","sha256":"ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e","sha512":"f3de1813a4160f9239f4781938645e1589b876759cd50b7936dbd849a35c38ffaed53f6a61dbdd8a1cf43cf4a28aa9fffbfddeec9a3811a1bb4ee6df58652b31","ssdeep":"1536:DjExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdLiX4mQ1v9:DIh8GgP3hujzwbhd3XvSiDQ47GKn","tlshash":"069309ddb2c6702257a720ba007f510bf236199d6c4d8450f169d8eabc78a4e827bf7d","first_seen":"2023-03-07T01:02:13Z","last_seen":"2026-08-20T12:19:53.890007Z","times_seen":499165,"resource_available":true,"data":null}},"time_used":142,"timings":{"blocked":56,"dns":20,"connect":13,"send":0,"wait":14,"receive":4,"ssl":32},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"dnizinbanksii.duckdns.org/bireysel/assets/opensans-regular-webfont.a66a53e7f788b1ab7e41.woff2","fqdn":"dnizinbanksii.duckdns.org","domain":"dnizinbanksii.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"196.251.72.165","port":443,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://dnizinbanksii.duckdns.org/bireysel/","date":"2025-10-14T10:51:39.684Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnizinbanksii.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 13 Oct 2025 14:07:42 GMT","end":"Sun, 11 Jan 2026 14:07:41 GMT"},"fingerprint":{"sha1":"EA:41:4A:8F:CF:7D:78:FC:5A:7C:3D:03:DA:2B:66:EC:89:F5:C6:76","sha256":"05:1A:F1:7D:61:5F:D6:22:66:E7:75:B3:19:7D:B5:3D:3F:53:0A:89:F8:3F:7C:82:25:D1:91:13:43:CC:38:60"}}},"request":{"raw":"GET /bireysel/assets/opensans-regular-webfont.a66a53e7f788b1ab7e41.woff2 HTTP/1.1\r\nHost: dnizinbanksii.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://dnizinbanksii.duckdns.org/bireysel/styles.607e0aa47fe465ab09bf.css\r\nCookie: PHPSESSID=5a118ff79cd8e2c90424eaf2ea68d949\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx\r\nDate: Tue, 14 Oct 2025 10:51:39 GMT\r\nContent-Type: text/html\r\nContent-Length: 808\r\nConnection: keep-alive\r\nLast-Modified: Mon, 13 Oct 2025 15:04:58 GMT\r\nETag: \"328-6410b973e1a6b\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-20T11:47:09.562203Z","times_seen":38907,"resource_available":true,"data":null}},"time_used":47,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":47,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"dnizinbanksii.duckdns.org/bireysel/assets/opensans-semibold-webfont.1045337df148fc781940.woff2","fqdn":"dnizinbanksii.duckdns.org","domain":"dnizinbanksii.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"196.251.72.165","port":443,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://dnizinbanksii.duckdns.org/bireysel/","date":"2025-10-14T10:51:39.693Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnizinbanksii.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 13 Oct 2025 14:07:42 GMT","end":"Sun, 11 Jan 2026 14:07:41 GMT"},"fingerprint":{"sha1":"EA:41:4A:8F:CF:7D:78:FC:5A:7C:3D:03:DA:2B:66:EC:89:F5:C6:76","sha256":"05:1A:F1:7D:61:5F:D6:22:66:E7:75:B3:19:7D:B5:3D:3F:53:0A:89:F8:3F:7C:82:25:D1:91:13:43:CC:38:60"}}},"request":{"raw":"GET /bireysel/assets/opensans-semibold-webfont.1045337df148fc781940.woff2 HTTP/1.1\r\nHost: dnizinbanksii.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://dnizinbanksii.duckdns.org/bireysel/styles.607e0aa47fe465ab09bf.css\r\nCookie: PHPSESSID=5a118ff79cd8e2c90424eaf2ea68d949\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx\r\nDate: Tue, 14 Oct 2025 10:51:39 GMT\r\nContent-Type: text/html\r\nContent-Length: 808\r\nConnection: keep-alive\r\nLast-Modified: Mon, 13 Oct 2025 15:04:58 GMT\r\nETag: \"328-6410b973e1a6b\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-20T11:47:09.562203Z","times_seen":38907,"resource_available":true,"data":null}},"time_used":57,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":57,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"dnizinbanksii.duckdns.org/bireysel/check_redirect.php","fqdn":"dnizinbanksii.duckdns.org","domain":"dnizinbanksii.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"196.251.72.165","port":443,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://dnizinbanksii.duckdns.org/bireysel/","date":"2025-10-14T10:51:40.814Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnizinbanksii.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 13 Oct 2025 14:07:42 GMT","end":"Sun, 11 Jan 2026 14:07:41 GMT"},"fingerprint":{"sha1":"EA:41:4A:8F:CF:7D:78:FC:5A:7C:3D:03:DA:2B:66:EC:89:F5:C6:76","sha256":"05:1A:F1:7D:61:5F:D6:22:66:E7:75:B3:19:7D:B5:3D:3F:53:0A:89:F8:3F:7C:82:25:D1:91:13:43:CC:38:60"}}},"request":{"raw":"GET /bireysel/check_redirect.php HTTP/1.1\r\nHost: dnizinbanksii.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/javascript, */*; q=0.01\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://dnizinbanksii.duckdns.org/bireysel/\r\nCookie: PHPSESSID=5a118ff79cd8e2c90424eaf2ea68d949\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 14 Oct 2025 10:51:40 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate\r\nPragma: no-cache\r\nX-Powered-By: PHP/8.4.13, PleskLin\r\nContent-Encoding: br\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP:8.4.13","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":18,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"91c77473661b0e08b45770c3609d1d7b","sha1":"22eda263bbce6c53604f2a62d2f1072c1a383fae","sha256":"9eab495eb8b3e4644ce57aec5a13d4a074aad6301140e849845cb53ef8234ce2","sha512":"f44d42699a344009207672da697ca9adf73a397eba154c6710e9399e8b8fcb19b34e86e4a043eec495e90b41ba251346919cd07ae59f648bf030e00b74eeb814","ssdeep":"","tlshash":"f4700000208028882000008a02080e0202020000300c2028c00a0200288a0020008002","first_seen":"2024-09-19T20:50:52.38086Z","last_seen":"2026-08-18T23:25:15.406562Z","times_seen":183,"resource_available":false,"data":null}},"time_used":49,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":49,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"dnizinbanksii.duckdns.org/bireysel","fqdn":"dnizinbanksii.duckdns.org","domain":"dnizinbanksii.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"196.251.72.165","port":443,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-10-14T10:51:39.038Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnizinbanksii.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 13 Oct 2025 14:07:42 GMT","end":"Sun, 11 Jan 2026 14:07:41 GMT"},"fingerprint":{"sha1":"EA:41:4A:8F:CF:7D:78:FC:5A:7C:3D:03:DA:2B:66:EC:89:F5:C6:76","sha256":"05:1A:F1:7D:61:5F:D6:22:66:E7:75:B3:19:7D:B5:3D:3F:53:0A:89:F8:3F:7C:82:25:D1:91:13:43:CC:38:60"}}},"request":{"raw":"GET /bireysel HTTP/1.1\r\nHost: dnizinbanksii.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 301 Moved Permanently\r\nServer: nginx\r\nDate: Tue, 14 Oct 2025 10:51:39 GMT\r\nContent-Type: text/html; charset=iso-8859-1\r\nContent-Length: 327\r\nConnection: keep-alive\r\nLocation: https://dnizinbanksii.duckdns.org/bireysel/\r\nX-Powered-By: PleskLin\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":14831,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-20T12:30:42.528701Z","times_seen":17990481,"resource_available":true,"data":null}},"time_used":49,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":49,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"dnizinbanksii.duckdns.org/bireysel/","fqdn":"dnizinbanksii.duckdns.org","domain":"dnizinbanksii.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"196.251.72.165","port":443,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-10-14T10:51:39.101Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnizinbanksii.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 13 Oct 2025 14:07:42 GMT","end":"Sun, 11 Jan 2026 14:07:41 GMT"},"fingerprint":{"sha1":"EA:41:4A:8F:CF:7D:78:FC:5A:7C:3D:03:DA:2B:66:EC:89:F5:C6:76","sha256":"05:1A:F1:7D:61:5F:D6:22:66:E7:75:B3:19:7D:B5:3D:3F:53:0A:89:F8:3F:7C:82:25:D1:91:13:43:CC:38:60"}}},"request":{"raw":"GET /bireysel/ HTTP/1.1\r\nHost: dnizinbanksii.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 14 Oct 2025 10:51:39 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Length: 4025\r\nConnection: keep-alive\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate\r\nPragma: no-cache\r\nSet-Cookie: PHPSESSID=5a118ff79cd8e2c90424eaf2ea68d949; path=/\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\nX-Powered-By: PHP/8.4.13, PleskLin\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:8.4.13","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"jQuery CDN","description":"jQuery CDN is a way to include jQuery in your website without actually downloading and keeping it your website's folder.","website":"https://code.jquery.com/","common_platform_enumeration":"","icon":"jQuery.svg","categories":["CDN"]},{"name":"jQuery:3.6.0","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}],"data":{"size":14831,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (396), with CRLF line terminators","md5":"7af0f56efe6817edc4d6856ce3e8afdb","sha1":"878db984a9ead69102d95f78b56150659f9b6615","sha256":"40820d463d1b40b7a24e1d0e4339b41cf9fef2879009393ae3e7cb0c59fd17bd","sha512":"a9b434e9d4ab35afbd5acf6c528f884bdd136bd1e657c292ad1496029ec4f422a9a71af2ab59f5fe7a38c2ffb2f343d75035c764ffe163ccd54da4ca8164e746","ssdeep":"96:cP0h4FWUDz2d2PHCvqSrScTU6/jwXKEzXznQyAtdEwP3kkQXL5WsKOCd3P:cPsUDz2d2SqWScTJeK5JtmwP0hGB","tlshash":"8262a56434c514364173a3f99ea6aa19feaac113d707460878ac1b832ff3d55c9a7f88","first_seen":"2025-09-28T21:36:51.618984Z","last_seen":"2025-10-14T10:52:07.163Z","times_seen":3,"resource_available":false,"data":null}},"time_used":68,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":67,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"dnizinbanksii.duckdns.org/assets/script.js","fqdn":"dnizinbanksii.duckdns.org","domain":"dnizinbanksii.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"196.251.72.165","port":443,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://dnizinbanksii.duckdns.org/bireysel/","date":"2025-10-14T10:51:39.723Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnizinbanksii.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 13 Oct 2025 14:07:42 GMT","end":"Sun, 11 Jan 2026 14:07:41 GMT"},"fingerprint":{"sha1":"EA:41:4A:8F:CF:7D:78:FC:5A:7C:3D:03:DA:2B:66:EC:89:F5:C6:76","sha256":"05:1A:F1:7D:61:5F:D6:22:66:E7:75:B3:19:7D:B5:3D:3F:53:0A:89:F8:3F:7C:82:25:D1:91:13:43:CC:38:60"}}},"request":{"raw":"GET /assets/script.js HTTP/1.1\r\nHost: dnizinbanksii.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://dnizinbanksii.duckdns.org/bireysel/\r\nCookie: PHPSESSID=5a118ff79cd8e2c90424eaf2ea68d949\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx\r\nDate: Tue, 14 Oct 2025 10:51:39 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Mon, 13 Oct 2025 15:04:58 GMT\r\nETag: W/\"328-6410b973e1a6b\"\r\nContent-Encoding: br\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-20T11:47:09.562203Z","times_seen":38907,"resource_available":true,"data":null}},"time_used":57,"timings":{"blocked":6,"dns":0,"connect":0,"send":0,"wait":51,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"dnizinbanksii.duckdns.org/bireysel/check_redirect.php","fqdn":"dnizinbanksii.duckdns.org","domain":"dnizinbanksii.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"196.251.72.165","port":443,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://dnizinbanksii.duckdns.org/bireysel/","date":"2025-10-14T10:51:42.815Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnizinbanksii.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 13 Oct 2025 14:07:42 GMT","end":"Sun, 11 Jan 2026 14:07:41 GMT"},"fingerprint":{"sha1":"EA:41:4A:8F:CF:7D:78:FC:5A:7C:3D:03:DA:2B:66:EC:89:F5:C6:76","sha256":"05:1A:F1:7D:61:5F:D6:22:66:E7:75:B3:19:7D:B5:3D:3F:53:0A:89:F8:3F:7C:82:25:D1:91:13:43:CC:38:60"}}},"request":{"raw":"GET /bireysel/check_redirect.php HTTP/1.1\r\nHost: dnizinbanksii.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/javascript, */*; q=0.01\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://dnizinbanksii.duckdns.org/bireysel/\r\nCookie: PHPSESSID=5a118ff79cd8e2c90424eaf2ea68d949\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 14 Oct 2025 10:51:42 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate\r\nPragma: no-cache\r\nX-Powered-By: PHP/8.4.13, PleskLin\r\nContent-Encoding: br\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP:8.4.13","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":18,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"91c77473661b0e08b45770c3609d1d7b","sha1":"22eda263bbce6c53604f2a62d2f1072c1a383fae","sha256":"9eab495eb8b3e4644ce57aec5a13d4a074aad6301140e849845cb53ef8234ce2","sha512":"f44d42699a344009207672da697ca9adf73a397eba154c6710e9399e8b8fcb19b34e86e4a043eec495e90b41ba251346919cd07ae59f648bf030e00b74eeb814","ssdeep":"","tlshash":"f4700000208028882000008a02080e0202020000300c2028c00a0200288a0020008002","first_seen":"2024-09-19T20:50:52.38086Z","last_seen":"2026-08-18T23:25:15.406562Z","times_seen":183,"resource_available":false,"data":null}},"time_used":65,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":65,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"dnizinbanksii.duckdns.org/bireysel/check_redirect.php","fqdn":"dnizinbanksii.duckdns.org","domain":"dnizinbanksii.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"196.251.72.165","port":443,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://dnizinbanksii.duckdns.org/bireysel/","date":"2025-10-14T10:51:51.824Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnizinbanksii.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 13 Oct 2025 14:07:42 GMT","end":"Sun, 11 Jan 2026 14:07:41 GMT"},"fingerprint":{"sha1":"EA:41:4A:8F:CF:7D:78:FC:5A:7C:3D:03:DA:2B:66:EC:89:F5:C6:76","sha256":"05:1A:F1:7D:61:5F:D6:22:66:E7:75:B3:19:7D:B5:3D:3F:53:0A:89:F8:3F:7C:82:25:D1:91:13:43:CC:38:60"}}},"request":{"raw":"GET /bireysel/check_redirect.php HTTP/1.1\r\nHost: dnizinbanksii.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/javascript, */*; q=0.01\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://dnizinbanksii.duckdns.org/bireysel/\r\nCookie: PHPSESSID=5a118ff79cd8e2c90424eaf2ea68d949\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 14 Oct 2025 10:51:51 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate\r\nPragma: no-cache\r\nX-Powered-By: PHP/8.4.13, PleskLin\r\nContent-Encoding: br\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:8.4.13","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":18,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"91c77473661b0e08b45770c3609d1d7b","sha1":"22eda263bbce6c53604f2a62d2f1072c1a383fae","sha256":"9eab495eb8b3e4644ce57aec5a13d4a074aad6301140e849845cb53ef8234ce2","sha512":"f44d42699a344009207672da697ca9adf73a397eba154c6710e9399e8b8fcb19b34e86e4a043eec495e90b41ba251346919cd07ae59f648bf030e00b74eeb814","ssdeep":"","tlshash":"f4700000208028882000008a02080e0202020000300c2028c00a0200288a0020008002","first_seen":"2024-09-19T20:50:52.38086Z","last_seen":"2026-08-18T23:25:15.406562Z","times_seen":183,"resource_available":false,"data":null}},"time_used":58,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":58,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"dnizinbanksii.duckdns.org/bireysel/check_ban_status.php","fqdn":"dnizinbanksii.duckdns.org","domain":"dnizinbanksii.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"196.251.72.165","port":443,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://dnizinbanksii.duckdns.org/bireysel/","date":"2025-10-14T10:51:54.821Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnizinbanksii.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 13 Oct 2025 14:07:42 GMT","end":"Sun, 11 Jan 2026 14:07:41 GMT"},"fingerprint":{"sha1":"EA:41:4A:8F:CF:7D:78:FC:5A:7C:3D:03:DA:2B:66:EC:89:F5:C6:76","sha256":"05:1A:F1:7D:61:5F:D6:22:66:E7:75:B3:19:7D:B5:3D:3F:53:0A:89:F8:3F:7C:82:25:D1:91:13:43:CC:38:60"}}},"request":{"raw":"GET /bireysel/check_ban_status.php HTTP/1.1\r\nHost: dnizinbanksii.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/javascript, */*; q=0.01\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://dnizinbanksii.duckdns.org/bireysel/\r\nCookie: PHPSESSID=5a118ff79cd8e2c90424eaf2ea68d949\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 14 Oct 2025 10:51:54 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Length: 39\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\nX-Powered-By: PHP/8.4.13, PleskLin\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:8.4.13","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":19,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"JSON text data","md5":"0ccc2622b6704ac5e940f7b96b5cb19b","sha1":"b04d957282d22596bc1a796c16e2affdc4838ed2","sha256":"ffcc9870a751a0241f5f2bdac8e6646c40b92bb226e8efc4af2e29cc242fc176","sha512":"d257e21c24aa9d6680847a712acc1c07a36bfc2393bbb9bb13b5da5127d6b9afe03db7701fb6bd1fc4338a333ee67d8041f1547b38e83c57acd9fde61478e915","ssdeep":"","tlshash":"da7000000000203008800808002000a02aa02ac0203a00e0380c00280a008c08008002","first_seen":"2023-06-27T00:24:01Z","last_seen":"2026-07-21T10:45:08.577048Z","times_seen":64,"resource_available":false,"data":null}},"time_used":61,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":61,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"dnizinbanksii.duckdns.org/bireysel/check_redirect.php","fqdn":"dnizinbanksii.duckdns.org","domain":"dnizinbanksii.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"196.251.72.165","port":443,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://dnizinbanksii.duckdns.org/bireysel/","date":"2025-10-14T10:51:55.826Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnizinbanksii.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 13 Oct 2025 14:07:42 GMT","end":"Sun, 11 Jan 2026 14:07:41 GMT"},"fingerprint":{"sha1":"EA:41:4A:8F:CF:7D:78:FC:5A:7C:3D:03:DA:2B:66:EC:89:F5:C6:76","sha256":"05:1A:F1:7D:61:5F:D6:22:66:E7:75:B3:19:7D:B5:3D:3F:53:0A:89:F8:3F:7C:82:25:D1:91:13:43:CC:38:60"}}},"request":{"raw":"GET /bireysel/check_redirect.php HTTP/1.1\r\nHost: dnizinbanksii.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/javascript, */*; q=0.01\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://dnizinbanksii.duckdns.org/bireysel/\r\nCookie: PHPSESSID=5a118ff79cd8e2c90424eaf2ea68d949\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 14 Oct 2025 10:51:55 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate\r\nPragma: no-cache\r\nX-Powered-By: PHP/8.4.13, PleskLin\r\nContent-Encoding: br\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP:8.4.13","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":18,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"91c77473661b0e08b45770c3609d1d7b","sha1":"22eda263bbce6c53604f2a62d2f1072c1a383fae","sha256":"9eab495eb8b3e4644ce57aec5a13d4a074aad6301140e849845cb53ef8234ce2","sha512":"f44d42699a344009207672da697ca9adf73a397eba154c6710e9399e8b8fcb19b34e86e4a043eec495e90b41ba251346919cd07ae59f648bf030e00b74eeb814","ssdeep":"","tlshash":"f4700000208028882000008a02080e0202020000300c2028c00a0200288a0020008002","first_seen":"2024-09-19T20:50:52.38086Z","last_seen":"2026-08-18T23:25:15.406562Z","times_seen":183,"resource_available":false,"data":null}},"time_used":62,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":62,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"dnizinbanksii.duckdns.org/bireysel/check_redirect.php","fqdn":"dnizinbanksii.duckdns.org","domain":"dnizinbanksii.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"196.251.72.165","port":443,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://dnizinbanksii.duckdns.org/bireysel/","date":"2025-10-14T10:51:58.823Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnizinbanksii.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 13 Oct 2025 14:07:42 GMT","end":"Sun, 11 Jan 2026 14:07:41 GMT"},"fingerprint":{"sha1":"EA:41:4A:8F:CF:7D:78:FC:5A:7C:3D:03:DA:2B:66:EC:89:F5:C6:76","sha256":"05:1A:F1:7D:61:5F:D6:22:66:E7:75:B3:19:7D:B5:3D:3F:53:0A:89:F8:3F:7C:82:25:D1:91:13:43:CC:38:60"}}},"request":{"raw":"GET /bireysel/check_redirect.php HTTP/1.1\r\nHost: dnizinbanksii.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/javascript, */*; q=0.01\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://dnizinbanksii.duckdns.org/bireysel/\r\nCookie: PHPSESSID=5a118ff79cd8e2c90424eaf2ea68d949\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 14 Oct 2025 10:51:58 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate\r\nPragma: no-cache\r\nX-Powered-By: PHP/8.4.13, PleskLin\r\nContent-Encoding: br\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:8.4.13","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":18,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"91c77473661b0e08b45770c3609d1d7b","sha1":"22eda263bbce6c53604f2a62d2f1072c1a383fae","sha256":"9eab495eb8b3e4644ce57aec5a13d4a074aad6301140e849845cb53ef8234ce2","sha512":"f44d42699a344009207672da697ca9adf73a397eba154c6710e9399e8b8fcb19b34e86e4a043eec495e90b41ba251346919cd07ae59f648bf030e00b74eeb814","ssdeep":"","tlshash":"f4700000208028882000008a02080e0202020000300c2028c00a0200288a0020008002","first_seen":"2024-09-19T20:50:52.38086Z","last_seen":"2026-08-18T23:25:15.406562Z","times_seen":183,"resource_available":false,"data":null}},"time_used":55,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":55,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"dnizinbanksii.duckdns.org/bireysel/check_ban_status.php","fqdn":"dnizinbanksii.duckdns.org","domain":"dnizinbanksii.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"196.251.72.165","port":443,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://dnizinbanksii.duckdns.org/bireysel/","date":"2025-10-14T10:51:39.833Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnizinbanksii.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 13 Oct 2025 14:07:42 GMT","end":"Sun, 11 Jan 2026 14:07:41 GMT"},"fingerprint":{"sha1":"EA:41:4A:8F:CF:7D:78:FC:5A:7C:3D:03:DA:2B:66:EC:89:F5:C6:76","sha256":"05:1A:F1:7D:61:5F:D6:22:66:E7:75:B3:19:7D:B5:3D:3F:53:0A:89:F8:3F:7C:82:25:D1:91:13:43:CC:38:60"}}},"request":{"raw":"GET /bireysel/check_ban_status.php HTTP/1.1\r\nHost: dnizinbanksii.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/javascript, */*; q=0.01\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://dnizinbanksii.duckdns.org/bireysel/\r\nCookie: PHPSESSID=5a118ff79cd8e2c90424eaf2ea68d949\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 14 Oct 2025 10:51:39 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Length: 39\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\nX-Powered-By: PHP/8.4.13, PleskLin\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP:8.4.13","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":19,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"JSON text data","md5":"0ccc2622b6704ac5e940f7b96b5cb19b","sha1":"b04d957282d22596bc1a796c16e2affdc4838ed2","sha256":"ffcc9870a751a0241f5f2bdac8e6646c40b92bb226e8efc4af2e29cc242fc176","sha512":"d257e21c24aa9d6680847a712acc1c07a36bfc2393bbb9bb13b5da5127d6b9afe03db7701fb6bd1fc4338a333ee67d8041f1547b38e83c57acd9fde61478e915","ssdeep":"","tlshash":"da7000000000203008800808002000a02aa02ac0203a00e0380c00280a008c08008002","first_seen":"2023-06-27T00:24:01Z","last_seen":"2026-07-21T10:45:08.577048Z","times_seen":64,"resource_available":false,"data":null}},"time_used":90,"timings":{"blocked":1,"dns":0,"connect":0,"send":0,"wait":89,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"dnizinbanksii.duckdns.org/bireysel/check_ban_status.php","fqdn":"dnizinbanksii.duckdns.org","domain":"dnizinbanksii.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"196.251.72.165","port":443,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://dnizinbanksii.duckdns.org/bireysel/","date":"2025-10-14T10:51:49.821Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnizinbanksii.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 13 Oct 2025 14:07:42 GMT","end":"Sun, 11 Jan 2026 14:07:41 GMT"},"fingerprint":{"sha1":"EA:41:4A:8F:CF:7D:78:FC:5A:7C:3D:03:DA:2B:66:EC:89:F5:C6:76","sha256":"05:1A:F1:7D:61:5F:D6:22:66:E7:75:B3:19:7D:B5:3D:3F:53:0A:89:F8:3F:7C:82:25:D1:91:13:43:CC:38:60"}}},"request":{"raw":"GET /bireysel/check_ban_status.php HTTP/1.1\r\nHost: dnizinbanksii.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/javascript, */*; q=0.01\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://dnizinbanksii.duckdns.org/bireysel/\r\nCookie: PHPSESSID=5a118ff79cd8e2c90424eaf2ea68d949\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 14 Oct 2025 10:51:49 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Length: 39\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\nX-Powered-By: PHP/8.4.13, PleskLin\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP:8.4.13","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":19,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"JSON text data","md5":"0ccc2622b6704ac5e940f7b96b5cb19b","sha1":"b04d957282d22596bc1a796c16e2affdc4838ed2","sha256":"ffcc9870a751a0241f5f2bdac8e6646c40b92bb226e8efc4af2e29cc242fc176","sha512":"d257e21c24aa9d6680847a712acc1c07a36bfc2393bbb9bb13b5da5127d6b9afe03db7701fb6bd1fc4338a333ee67d8041f1547b38e83c57acd9fde61478e915","ssdeep":"","tlshash":"da7000000000203008800808002000a02aa02ac0203a00e0380c00280a008c08008002","first_seen":"2023-06-27T00:24:01Z","last_seen":"2026-07-21T10:45:08.577048Z","times_seen":64,"resource_available":false,"data":null}},"time_used":52,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":51,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"dnizinbanksii.duckdns.org/bireysel/check_redirect.php","fqdn":"dnizinbanksii.duckdns.org","domain":"dnizinbanksii.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"196.251.72.165","port":443,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://dnizinbanksii.duckdns.org/bireysel/","date":"2025-10-14T10:51:50.821Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnizinbanksii.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 13 Oct 2025 14:07:42 GMT","end":"Sun, 11 Jan 2026 14:07:41 GMT"},"fingerprint":{"sha1":"EA:41:4A:8F:CF:7D:78:FC:5A:7C:3D:03:DA:2B:66:EC:89:F5:C6:76","sha256":"05:1A:F1:7D:61:5F:D6:22:66:E7:75:B3:19:7D:B5:3D:3F:53:0A:89:F8:3F:7C:82:25:D1:91:13:43:CC:38:60"}}},"request":{"raw":"GET /bireysel/check_redirect.php HTTP/1.1\r\nHost: dnizinbanksii.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/javascript, */*; q=0.01\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://dnizinbanksii.duckdns.org/bireysel/\r\nCookie: PHPSESSID=5a118ff79cd8e2c90424eaf2ea68d949\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 14 Oct 2025 10:51:50 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate\r\nPragma: no-cache\r\nX-Powered-By: PHP/8.4.13, PleskLin\r\nContent-Encoding: br\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:8.4.13","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":18,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"91c77473661b0e08b45770c3609d1d7b","sha1":"22eda263bbce6c53604f2a62d2f1072c1a383fae","sha256":"9eab495eb8b3e4644ce57aec5a13d4a074aad6301140e849845cb53ef8234ce2","sha512":"f44d42699a344009207672da697ca9adf73a397eba154c6710e9399e8b8fcb19b34e86e4a043eec495e90b41ba251346919cd07ae59f648bf030e00b74eeb814","ssdeep":"","tlshash":"f4700000208028882000008a02080e0202020000300c2028c00a0200288a0020008002","first_seen":"2024-09-19T20:50:52.38086Z","last_seen":"2026-08-18T23:25:15.406562Z","times_seen":183,"resource_available":false,"data":null}},"time_used":59,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":59,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"dnizinbanksii.duckdns.org/bireysel/check_redirect.php","fqdn":"dnizinbanksii.duckdns.org","domain":"dnizinbanksii.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"196.251.72.165","port":443,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://dnizinbanksii.duckdns.org/bireysel/","date":"2025-10-14T10:51:44.817Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnizinbanksii.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 13 Oct 2025 14:07:42 GMT","end":"Sun, 11 Jan 2026 14:07:41 GMT"},"fingerprint":{"sha1":"EA:41:4A:8F:CF:7D:78:FC:5A:7C:3D:03:DA:2B:66:EC:89:F5:C6:76","sha256":"05:1A:F1:7D:61:5F:D6:22:66:E7:75:B3:19:7D:B5:3D:3F:53:0A:89:F8:3F:7C:82:25:D1:91:13:43:CC:38:60"}}},"request":{"raw":"GET /bireysel/check_redirect.php HTTP/1.1\r\nHost: dnizinbanksii.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/javascript, */*; q=0.01\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://dnizinbanksii.duckdns.org/bireysel/\r\nCookie: PHPSESSID=5a118ff79cd8e2c90424eaf2ea68d949\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 14 Oct 2025 10:51:44 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate\r\nPragma: no-cache\r\nX-Powered-By: PHP/8.4.13, PleskLin\r\nContent-Encoding: br\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:8.4.13","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":18,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"91c77473661b0e08b45770c3609d1d7b","sha1":"22eda263bbce6c53604f2a62d2f1072c1a383fae","sha256":"9eab495eb8b3e4644ce57aec5a13d4a074aad6301140e849845cb53ef8234ce2","sha512":"f44d42699a344009207672da697ca9adf73a397eba154c6710e9399e8b8fcb19b34e86e4a043eec495e90b41ba251346919cd07ae59f648bf030e00b74eeb814","ssdeep":"","tlshash":"f4700000208028882000008a02080e0202020000300c2028c00a0200288a0020008002","first_seen":"2024-09-19T20:50:52.38086Z","last_seen":"2026-08-18T23:25:15.406562Z","times_seen":183,"resource_available":false,"data":null}},"time_used":53,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":53,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"dnizinbanksii.duckdns.org/bireysel/check_redirect.php","fqdn":"dnizinbanksii.duckdns.org","domain":"dnizinbanksii.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"196.251.72.165","port":443,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://dnizinbanksii.duckdns.org/bireysel/","date":"2025-10-14T10:51:52.822Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnizinbanksii.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 13 Oct 2025 14:07:42 GMT","end":"Sun, 11 Jan 2026 14:07:41 GMT"},"fingerprint":{"sha1":"EA:41:4A:8F:CF:7D:78:FC:5A:7C:3D:03:DA:2B:66:EC:89:F5:C6:76","sha256":"05:1A:F1:7D:61:5F:D6:22:66:E7:75:B3:19:7D:B5:3D:3F:53:0A:89:F8:3F:7C:82:25:D1:91:13:43:CC:38:60"}}},"request":{"raw":"GET /bireysel/check_redirect.php HTTP/1.1\r\nHost: dnizinbanksii.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/javascript, */*; q=0.01\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://dnizinbanksii.duckdns.org/bireysel/\r\nCookie: PHPSESSID=5a118ff79cd8e2c90424eaf2ea68d949\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 14 Oct 2025 10:51:52 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate\r\nPragma: no-cache\r\nX-Powered-By: PHP/8.4.13, PleskLin\r\nContent-Encoding: br\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:8.4.13","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":18,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"91c77473661b0e08b45770c3609d1d7b","sha1":"22eda263bbce6c53604f2a62d2f1072c1a383fae","sha256":"9eab495eb8b3e4644ce57aec5a13d4a074aad6301140e849845cb53ef8234ce2","sha512":"f44d42699a344009207672da697ca9adf73a397eba154c6710e9399e8b8fcb19b34e86e4a043eec495e90b41ba251346919cd07ae59f648bf030e00b74eeb814","ssdeep":"","tlshash":"f4700000208028882000008a02080e0202020000300c2028c00a0200288a0020008002","first_seen":"2024-09-19T20:50:52.38086Z","last_seen":"2026-08-18T23:25:15.406562Z","times_seen":183,"resource_available":false,"data":null}},"time_used":59,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":59,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"dnizinbanksii.duckdns.org/bireysel/check_redirect.php","fqdn":"dnizinbanksii.duckdns.org","domain":"dnizinbanksii.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"196.251.72.165","port":443,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://dnizinbanksii.duckdns.org/bireysel/","date":"2025-10-14T10:51:53.824Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnizinbanksii.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 13 Oct 2025 14:07:42 GMT","end":"Sun, 11 Jan 2026 14:07:41 GMT"},"fingerprint":{"sha1":"EA:41:4A:8F:CF:7D:78:FC:5A:7C:3D:03:DA:2B:66:EC:89:F5:C6:76","sha256":"05:1A:F1:7D:61:5F:D6:22:66:E7:75:B3:19:7D:B5:3D:3F:53:0A:89:F8:3F:7C:82:25:D1:91:13:43:CC:38:60"}}},"request":{"raw":"GET /bireysel/check_redirect.php HTTP/1.1\r\nHost: dnizinbanksii.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/javascript, */*; q=0.01\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://dnizinbanksii.duckdns.org/bireysel/\r\nCookie: PHPSESSID=5a118ff79cd8e2c90424eaf2ea68d949\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 14 Oct 2025 10:51:53 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate\r\nPragma: no-cache\r\nX-Powered-By: PHP/8.4.13, PleskLin\r\nContent-Encoding: br\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:8.4.13","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":18,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"91c77473661b0e08b45770c3609d1d7b","sha1":"22eda263bbce6c53604f2a62d2f1072c1a383fae","sha256":"9eab495eb8b3e4644ce57aec5a13d4a074aad6301140e849845cb53ef8234ce2","sha512":"f44d42699a344009207672da697ca9adf73a397eba154c6710e9399e8b8fcb19b34e86e4a043eec495e90b41ba251346919cd07ae59f648bf030e00b74eeb814","ssdeep":"","tlshash":"f4700000208028882000008a02080e0202020000300c2028c00a0200288a0020008002","first_seen":"2024-09-19T20:50:52.38086Z","last_seen":"2026-08-18T23:25:15.406562Z","times_seen":183,"resource_available":false,"data":null}},"time_used":64,"timings":{"blocked":5,"dns":0,"connect":0,"send":0,"wait":59,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"dnizinbanksii.duckdns.org/bireysel/check_redirect.php","fqdn":"dnizinbanksii.duckdns.org","domain":"dnizinbanksii.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"196.251.72.165","port":443,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://dnizinbanksii.duckdns.org/bireysel/","date":"2025-10-14T10:51:54.829Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dnizinbanksii.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 13 Oct 2025 14:07:42 GMT","end":"Sun, 11 Jan 2026 14:07:41 GMT"},"fingerprint":{"sha1":"EA:41:4A:8F:CF:7D:78:FC:5A:7C:3D:03:DA:2B:66:EC:89:F5:C6:76","sha256":"05:1A:F1:7D:61:5F:D6:22:66:E7:75:B3:19:7D:B5:3D:3F:53:0A:89:F8:3F:7C:82:25:D1:91:13:43:CC:38:60"}}},"request":{"raw":"GET /bireysel/check_redirect.php HTTP/1.1\r\nHost: dnizinbanksii.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/javascript, */*; q=0.01\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://dnizinbanksii.duckdns.org/bireysel/\r\nCookie: PHPSESSID=5a118ff79cd8e2c90424eaf2ea68d949\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 14 Oct 2025 10:51:54 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate\r\nPragma: no-cache\r\nX-Powered-By: PHP/8.4.13, PleskLin\r\nContent-Encoding: br\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP:8.4.13","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":18,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"91c77473661b0e08b45770c3609d1d7b","sha1":"22eda263bbce6c53604f2a62d2f1072c1a383fae","sha256":"9eab495eb8b3e4644ce57aec5a13d4a074aad6301140e849845cb53ef8234ce2","sha512":"f44d42699a344009207672da697ca9adf73a397eba154c6710e9399e8b8fcb19b34e86e4a043eec495e90b41ba251346919cd07ae59f648bf030e00b74eeb814","ssdeep":"","tlshash":"f4700000208028882000008a02080e0202020000300c2028c00a0200288a0020008002","first_seen":"2024-09-19T20:50:52.38086Z","last_seen":"2026-08-18T23:25:15.406562Z","times_seen":183,"resource_available":false,"data":null}},"time_used":56,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":56,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-14","alert":"Sinkholed","trigger":"dnizinbanksii.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}}]}