r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 9fbe85f42e8ae8ae41cc12df5f98b141
949fa36ff0f22f72565fd584bef094dd4de23037
184d3e4df4bce559b4d7c4836372f5fd2de9782a96b04d364230b7d695d737d8
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "184D3E4DF4BCE559B4D7C4836372F5FD2DE9782A96B04D364230B7D695D737D8"
Last-Modified: Thu, 26 Jan 2023 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8172
Expires: Thu, 26 Jan 2023 23:47:37 GMT
Date: Thu, 26 Jan 2023 21:31:25 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 58ffdcb539c3b250fdf31ed761627fc1
5b55b1522ef84c39b5c42f9bbfbc62b806c1269f
eb783cfa8c8544b0574b345abc0bf3c150979d4efce1a013f17b6cd48076fc63
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "EB783CFA8C8544B0574B345ABC0BF3C150979D4EFCE1A013F17B6CD48076FC63"
Last-Modified: Wed, 25 Jan 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2492
Expires: Thu, 26 Jan 2023 22:12:57 GMT
Date: Thu, 26 Jan 2023 21:31:25 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 69f73ac59327cd9ad7d99816ccfcc03e
c54844f82dbee0d5ee4c8ce344eb0139373e6c6b
e81c685b2d8f0e31b89e5cfc911a2c5a99a556646830ac5a8468d991b5e871a3
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "E81C685B2D8F0E31B89E5CFC911A2C5A99A556646830AC5A8468D991B5E871A3"
Last-Modified: Thu, 26 Jan 2023 04:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14714
Expires: Fri, 27 Jan 2023 01:36:39 GMT
Date: Thu, 26 Jan 2023 21:31:25 GMT
Connection: keep-alive
firefox.settings.services.mozilla.com/v1/
200 OK 939 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/
IP
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash dcd75ca6daca51c5e39d431468511793
07f76d3bf23d65c9110d810fa71a994e39e085d3
73672a816da4450fe2c938b08d7ae002d9ca29fdcbd3e29cc97084d826f8b459
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Alert, Retry-After, Content-Type, Content-Length, Backoff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Thu, 26 Jan 2023 20:42:56 GMT
content-type: application/json
age: 2909
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain
200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain
IP
File type PEM certificate\012- , ASCII text
Hash 7b922915ebf1fa3639b333f994c74f24
144a3f80b98fd0652d4614f24cf6cbbee40f8938
adbb3e06df0e870f5c7a9cb81e8979d4e92735853d75c9b779c06470d4db5d9c
GET /chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: cRBypmA5dfpuZIUsEspFHhddQ/9j/U6Ow3AawA+hRVNOVMQE4sxtS6M4SswMAmXAWyMmXlO3aVc=
x-amz-request-id: TJS8SC5PGNDPK8FG
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Thu, 26 Jan 2023 20:49:08 GMT
age: 2537
last-modified: Mon, 09 Jan 2023 18:04:21 GMT
etag: "7b922915ebf1fa3639b333f994c74f24"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
contile.services.mozilla.com/v1/tiles
200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Thu, 26 Jan 2023 21:31:25 GMT
content-type: application/json
content-length: 12
access-control-expose-headers: content-type
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 2ebcc7cd4c50e87a984668828c1e612e
f693d36335f333e3647f9fb2460e34dd73e17421
27f1d63422ccd02a6af514c2c0a36ac6f4e0d6f74ad6d9fc8c32e8ea487ffe15
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 26 Jan 2023 21:31:25 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 2ebcc7cd4c50e87a984668828c1e612e
f693d36335f333e3647f9fb2460e34dd73e17421
27f1d63422ccd02a6af514c2c0a36ac6f4e0d6f74ad6d9fc8c32e8ea487ffe15
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 26 Jan 2023 21:31:25 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 2ebcc7cd4c50e87a984668828c1e612e
f693d36335f333e3647f9fb2460e34dd73e17421
27f1d63422ccd02a6af514c2c0a36ac6f4e0d6f74ad6d9fc8c32e8ea487ffe15
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 26 Jan 2023 21:31:25 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
200 OK 329 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
File type JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Hash 0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Last-Modified, ETag, Expires, Backoff, Content-Length, Cache-Control, Alert, Retry-After, Pragma
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Thu, 26 Jan 2023 20:41:40 GMT
age: 2985
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash c398b6b39d11d25b8ae9bc5cd94a1c98
640aa8c399ced71d0c2a9f5a90fbaf091b01d642
a6f07f7c6a4746acc25457c726701df33120628dfb578bc4982448d8efee5855
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "A6F07F7C6A4746ACC25457C726701DF33120628DFB578BC4982448D8EFEE5855"
Last-Modified: Tue, 24 Jan 2023 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16327
Expires: Fri, 27 Jan 2023 02:03:33 GMT
Date: Thu, 26 Jan 2023 21:31:26 GMT
Connection: keep-alive
bysxkrqb-iidpiraxhp.duckdns.org/
200 OK 65 kB URL HTTP/1.1 bysxkrqb-iidpiraxhp.duckdns.org/
IP
ASN #136052 PT Cloud Hosting Indonesia
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with CRLF line terminators
Hash 76549e380699438da762d3b4fd2b923f
6681671a2a54ab19c81f3af657bacf7b32d2ac5f
b3916e7c795cfab396170dea2b98e2233e68c76059a48d7db6f46dcbd42cd8ab
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
fortinet Phishing
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
GET / HTTP/1.1
Host: bysxkrqb-iidpiraxhp.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Date: Thu, 26 Jan 2023 21:31:25 GMT
Transfer-Encoding: chunked
bysxkrqb-iidpiraxhp.duckdns.org/assets/css/magnific-popup.css
200 OK 7.0 kB URL HTTP/1.1 bysxkrqb-iidpiraxhp.duckdns.org/assets/css/magnific-popup.css
IP
ASN #136052 PT Cloud Hosting Indonesia
Hash 30b593b71d7672658f89bfea0ab360c9
d6963db6faa9294387bb3175813a61bc3f859437
45d1f5f6cf913746c45dd697b1a8f3b719c02d8b3f678dc7fc2766d54e1aaf6e
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
GET /assets/css/magnific-popup.css HTTP/1.1
Host: bysxkrqb-iidpiraxhp.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bysxkrqb-iidpiraxhp.duckdns.org/
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Length: 6951
Content-Type: text/css; charset=utf-8
Last-Modified: Thu, 26 Jan 2023 14:17:19 GMT
Date: Thu, 26 Jan 2023 21:31:26 GMT
push.services.mozilla.com/
101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: 7F3uhzRnOwmVb1y7u3tAnQ==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: PQHO+B5o3YL3fL/bagAl9zgOwvw=
bysxkrqb-iidpiraxhp.duckdns.org/assets/css/swiper.css
200 OK 22 kB URL HTTP/1.1 bysxkrqb-iidpiraxhp.duckdns.org/assets/css/swiper.css
IP
ASN #136052 PT Cloud Hosting Indonesia
File type ASCII text, with very long lines (1468)
Hash 1d814746f69121716ac9fefb559d7026
e3290a4fa0a8c274cbd4bb82e81ae1c4339ecbfa
e4ace9e73742cf9b354dd33704485f759d7a0ce9ba25e20c5401ab9af490d8a8
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
GET /assets/css/swiper.css HTTP/1.1
Host: bysxkrqb-iidpiraxhp.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bysxkrqb-iidpiraxhp.duckdns.org/
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Length: 22256
Content-Type: text/css; charset=utf-8
Last-Modified: Thu, 26 Jan 2023 14:17:19 GMT
Date: Thu, 26 Jan 2023 21:31:26 GMT
bysxkrqb-iidpiraxhp.duckdns.org/assets/css/fontawesome-all.css
200 OK 52 kB URL HTTP/1.1 bysxkrqb-iidpiraxhp.duckdns.org/assets/css/fontawesome-all.css
IP
ASN #136052 PT Cloud Hosting Indonesia
File type ASCII text, with very long lines (317)
Hash 0a2ed388e9c6ab831acb42c006aa91a3
a4c3b243e5c4952207fffbfaec2109646fd0238b
022726742abc2f7fe2465c44525098c41abe3f82b8084140bdc5ad477dcb5af1
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
GET /assets/css/fontawesome-all.css HTTP/1.1
Host: bysxkrqb-iidpiraxhp.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bysxkrqb-iidpiraxhp.duckdns.org/
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Length: 51609
Content-Type: text/css; charset=utf-8
Last-Modified: Thu, 26 Jan 2023 14:17:19 GMT
Date: Thu, 26 Jan 2023 21:31:25 GMT
bysxkrqb-iidpiraxhp.duckdns.org/assets/css/styles.css
200 OK 48 kB URL HTTP/1.1 bysxkrqb-iidpiraxhp.duckdns.org/assets/css/styles.css
IP
ASN #136052 PT Cloud Hosting Indonesia
File type ASCII text, with CRLF line terminators
Hash e02d259ab01f2ca4dca14c68d59f4f10
30c422199c583592a11a04dce052db6e6f7197c4
cd6d50893335a2a6d69cb428aed21940c33699cb44bd56e938327603292b104a
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
GET /assets/css/styles.css HTTP/1.1
Host: bysxkrqb-iidpiraxhp.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bysxkrqb-iidpiraxhp.duckdns.org/
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Length: 47527
Content-Type: text/css; charset=utf-8
Last-Modified: Thu, 26 Jan 2023 14:17:19 GMT
Date: Thu, 26 Jan 2023 21:31:26 GMT
bysxkrqb-iidpiraxhp.duckdns.org/assets/js/jquery.easing.min.js
200 OK 6.0 kB URL HTTP/1.1 bysxkrqb-iidpiraxhp.duckdns.org/assets/js/jquery.easing.min.js
IP
ASN #136052 PT Cloud Hosting Indonesia
File type Unicode text, UTF-8 text, with very long lines (4004)
Hash b62c744f5635480a0eabd225a04b7452
e1fd1d78867a8171c0f69148f350c098e4d4c8d0
f9b2277cb79f77cfa984fc713bda988da89f9699509a30eee234404efa79b32e
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
fortinet Phishing
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
GET /assets/js/jquery.easing.min.js HTTP/1.1
Host: bysxkrqb-iidpiraxhp.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bysxkrqb-iidpiraxhp.duckdns.org/
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Length: 5958
Content-Type: application/javascript
Last-Modified: Thu, 26 Jan 2023 14:17:19 GMT
Date: Thu, 26 Jan 2023 21:31:26 GMT
bysxkrqb-iidpiraxhp.duckdns.org/assets/js/jquery.magnific-popup.js
200 OK 22 kB URL HTTP/1.1 bysxkrqb-iidpiraxhp.duckdns.org/assets/js/jquery.magnific-popup.js
IP
ASN #136052 PT Cloud Hosting Indonesia
File type ASCII text, with very long lines (21547), with CRLF line terminators
Hash 21dfcde552b78840cf0f9960552c06ac
99d1d2aec86270a41802ee3197afe260c4dda7e5
43330aded0f4267f5ee70e20c6374ba6965a6367f8c0b15efcf4b9a4cfac986d
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
fortinet Phishing
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
GET /assets/js/jquery.magnific-popup.js HTTP/1.1
Host: bysxkrqb-iidpiraxhp.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bysxkrqb-iidpiraxhp.duckdns.org/
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Length: 21680
Content-Type: application/javascript
Last-Modified: Thu, 26 Jan 2023 14:17:19 GMT
Date: Thu, 26 Jan 2023 21:31:26 GMT
bysxkrqb-iidpiraxhp.duckdns.org/assets/js/popper.min.js
200 OK 21 kB URL HTTP/1.1 bysxkrqb-iidpiraxhp.duckdns.org/assets/js/popper.min.js
IP
ASN #136052 PT Cloud Hosting Indonesia
File type ASCII text, with very long lines (20831)
Hash 36affe2ca6cb85233ee7362c5d8b7893
42e3ca1212d825150c0f57f97dea8d9c0b0ce2a1
71ef7c16d75da75a5d417df75ed72144bc5ec65a9c0429b7dee0988adc3e8d29
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
fortinet Phishing
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
GET /assets/js/popper.min.js HTTP/1.1
Host: bysxkrqb-iidpiraxhp.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bysxkrqb-iidpiraxhp.duckdns.org/
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Length: 21003
Content-Type: application/javascript
Last-Modified: Thu, 26 Jan 2023 14:17:19 GMT
Date: Thu, 26 Jan 2023 21:31:26 GMT
bysxkrqb-iidpiraxhp.duckdns.org/assets/js/bootstrap.min.js
200 OK 58 kB URL HTTP/1.1 bysxkrqb-iidpiraxhp.duckdns.org/assets/js/bootstrap.min.js
IP
ASN #136052 PT Cloud Hosting Indonesia
File type ASCII text, with very long lines (57791)
Hash e1d98d47689e00f8ecbc5d9f61bdb42e
6778fed3cf095a318141a31f455c8f4663885bde
0a34a87842c539c1f4feec56bba982fd596b73500046a6e6fe38a22260c6577b
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
fortinet Phishing
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
GET /assets/js/bootstrap.min.js HTTP/1.1
Host: bysxkrqb-iidpiraxhp.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bysxkrqb-iidpiraxhp.duckdns.org/
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Length: 58072
Content-Type: application/javascript
Last-Modified: Thu, 26 Jan 2023 14:17:19 GMT
Date: Thu, 26 Jan 2023 21:31:26 GMT
bysxkrqb-iidpiraxhp.duckdns.org/assets/js/jquery.min.js
200 OK 87 kB URL HTTP/1.1 bysxkrqb-iidpiraxhp.duckdns.org/assets/js/jquery.min.js
IP
ASN #136052 PT Cloud Hosting Indonesia
File type ASCII text, with very long lines (65451)
Hash a09e13ee94d51c524b7e2a728c7d4039
0dc32db4aa9c5f03f3b38c47d883dbd4fed13aae
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
fortinet Phishing
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
GET /assets/js/jquery.min.js HTTP/1.1
Host: bysxkrqb-iidpiraxhp.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bysxkrqb-iidpiraxhp.duckdns.org/
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Length: 86927
Content-Type: application/javascript
Last-Modified: Thu, 26 Jan 2023 14:17:19 GMT
Date: Thu, 26 Jan 2023 21:31:26 GMT
bysxkrqb-iidpiraxhp.duckdns.org/assets/js/morphext.min.js
200 OK 1.0 kB URL HTTP/1.1 bysxkrqb-iidpiraxhp.duckdns.org/assets/js/morphext.min.js
IP
ASN #136052 PT Cloud Hosting Indonesia
File type ASCII text, with very long lines (1014), with no line terminators
Hash 6db5449e756b858fc376ea662aab817a
384a56b05af02a655286bd9f52a25653aed2a7ac
a86df3be0eff7f90991f057c21e6907c16391e6f8cd0a4773cc93d9401e9dfdb
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
fortinet Phishing
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
GET /assets/js/morphext.min.js HTTP/1.1
Host: bysxkrqb-iidpiraxhp.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bysxkrqb-iidpiraxhp.duckdns.org/
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Length: 1014
Content-Type: application/javascript
Last-Modified: Thu, 26 Jan 2023 14:17:19 GMT
Date: Thu, 26 Jan 2023 21:31:27 GMT
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash bd56ce22720c6e6072efdabae64669fd
29194390d12177fe0d88e1bd2fb4436509366a1c
c41996d83d942ca58a13e2d1adfd171cf26a84bc9b7fdbd1ca941eb0269b5404
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C41996D83D942CA58A13E2D1ADFD171CF26A84BC9B7FDBD1CA941EB0269B5404"
Last-Modified: Wed, 25 Jan 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9467
Expires: Fri, 27 Jan 2023 00:09:14 GMT
Date: Thu, 26 Jan 2023 21:31:27 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash bd56ce22720c6e6072efdabae64669fd
29194390d12177fe0d88e1bd2fb4436509366a1c
c41996d83d942ca58a13e2d1adfd171cf26a84bc9b7fdbd1ca941eb0269b5404
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C41996D83D942CA58A13E2D1ADFD171CF26A84BC9B7FDBD1CA941EB0269B5404"
Last-Modified: Wed, 25 Jan 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9467
Expires: Fri, 27 Jan 2023 00:09:14 GMT
Date: Thu, 26 Jan 2023 21:31:27 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash bd56ce22720c6e6072efdabae64669fd
29194390d12177fe0d88e1bd2fb4436509366a1c
c41996d83d942ca58a13e2d1adfd171cf26a84bc9b7fdbd1ca941eb0269b5404
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C41996D83D942CA58A13E2D1ADFD171CF26A84BC9B7FDBD1CA941EB0269B5404"
Last-Modified: Wed, 25 Jan 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9467
Expires: Fri, 27 Jan 2023 00:09:14 GMT
Date: Thu, 26 Jan 2023 21:31:27 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash bd56ce22720c6e6072efdabae64669fd
29194390d12177fe0d88e1bd2fb4436509366a1c
c41996d83d942ca58a13e2d1adfd171cf26a84bc9b7fdbd1ca941eb0269b5404
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C41996D83D942CA58A13E2D1ADFD171CF26A84BC9B7FDBD1CA941EB0269B5404"
Last-Modified: Wed, 25 Jan 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9467
Expires: Fri, 27 Jan 2023 00:09:14 GMT
Date: Thu, 26 Jan 2023 21:31:27 GMT
Connection: keep-alive
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F46a5d7d6-d259-4246-b28c-8e4355fbc747.jpeg
200 OK 6.6 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F46a5d7d6-d259-4246-b28c-8e4355fbc747.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash b242645f0cc22e3b12c132e6d03722ac
dec70f83182de58e03bfcb95fc240b7c33f20674
59a2d8c972d27598dfe38637197f90053186c4f68b80a5a90283cb11ddaf8a31
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F46a5d7d6-d259-4246-b28c-8e4355fbc747.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 6609
x-amzn-requestid: 129067f4-c79b-493d-8863-2eb6c1565ee6
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fSZABF4IIAMFsig=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d0d533-4908ab6e5c751213084de3c6;Sampled=0
x-amzn-remapped-date: Wed, 25 Jan 2023 07:07:31 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: CaxCPk4-9yhypamZa96f4IyujB3AMeGmpcYP1UmJtjp275dwFjVOcw==
via: 1.1 d83ae0e1ba84e92e58bc1efc23a0c652.cloudfront.net (CloudFront), 1.1 f9d716a351f14a0ac1fac2449734849a.cloudfront.net (CloudFront), 1.1 google
date: Thu, 26 Jan 2023 07:21:33 GMT
age: 50994
etag: "dec70f83182de58e03bfcb95fc240b7c33f20674"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
bysxkrqb-iidpiraxhp.duckdns.org/assets/js/validator.min.js
200 OK 9.0 kB URL HTTP/1.1 bysxkrqb-iidpiraxhp.duckdns.org/assets/js/validator.min.js
IP
ASN #136052 PT Cloud Hosting Indonesia
File type ASCII text, with very long lines (7453), with CRLF line terminators
Hash 6f0c261c06151bb9564dcff79baa1a5a
095b4e20e18cd54d793ae907e020ea6175d31d2e
8f0b7817088a6bdf13a43c49b6970236635411f5568534a8587ee3c188e719f6
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
fortinet Phishing
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
GET /assets/js/validator.min.js HTTP/1.1
Host: bysxkrqb-iidpiraxhp.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bysxkrqb-iidpiraxhp.duckdns.org/
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Length: 8953
Content-Type: application/javascript
Last-Modified: Thu, 26 Jan 2023 14:17:19 GMT
Date: Thu, 26 Jan 2023 21:31:27 GMT
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F8017df09-37d9-4c4b-9051-0442b3eb8fbf.jpeg
200 OK 9.3 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F8017df09-37d9-4c4b-9051-0442b3eb8fbf.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 17e1b6f3caa98b0e0972802408dd3f93
07e48bf3565e00d093d72dd4ada606f5d39a4838
7094ef64e04573bea7a81bbcc8ab59d721c5ef433e3fa9203e5861040ced549c
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F8017df09-37d9-4c4b-9051-0442b3eb8fbf.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 9285
x-amzn-requestid: 526bd945-31d8-490e-af9d-5e6fc6ea3561
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fUYT2HzvoAMFYYA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d1a0e5-6812fe4354bbdac4472e7e81;Sampled=0
x-amzn-remapped-date: Wed, 25 Jan 2023 21:36:37 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: QEH9CmjfV8QZFNxFz_tEk06i_ELUSNC2QjdTF4K3xc3vS651BZ3NlQ==
via: 1.1 5a1753718d8b33365e5f693dd338c510.cloudfront.net (CloudFront), 1.1 2bedbeaa49b4a77447d30097858cb81a.cloudfront.net (CloudFront), 1.1 google
date: Wed, 25 Jan 2023 21:52:28 GMT
age: 85139
etag: "07e48bf3565e00d093d72dd4ada606f5d39a4838"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F71e9b44e-6d59-411b-90e8-54e0efae62a5.jpeg
200 OK 7.4 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F71e9b44e-6d59-411b-90e8-54e0efae62a5.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 41fd0074a6ce752b1271302feade4cee
6311d1365504f06cb7516606c56c502d553c9d16
544c508899fe8855b0975a87cb0bf35663ab4ad0ec8fd057b3962d50cc001b8c
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F71e9b44e-6d59-411b-90e8-54e0efae62a5.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7365
x-amzn-requestid: c2a8ae3d-47f8-415f-bf08-78dd12ede3d1
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fUYRwEUbIAMFnag=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d1a0d7-38f72fec78120cf113c7a4f7;Sampled=0
x-amzn-remapped-date: Wed, 25 Jan 2023 21:36:23 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: rtbXkTvnYy-L9ludMO-LXo0lFghKSZeQ8UIGoaBHYlMIFGf0RR-zWA==
via: 1.1 112c6b3f9aea37a6cb00b7d933e5af6e.cloudfront.net (CloudFront), 1.1 d6b180eb367f7de26d67a9f3901b96a6.cloudfront.net (CloudFront), 1.1 google
date: Wed, 25 Jan 2023 21:49:02 GMT
age: 85345
etag: "6311d1365504f06cb7516606c56c502d553c9d16"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F09ccbe5e-77b1-4d6d-98f5-a477f3861d8c.jpeg
200 OK 13 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F09ccbe5e-77b1-4d6d-98f5-a477f3861d8c.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 7458f7a9b2070055df6f1d496794e43e
0f5d2a6d846f4f8f85dd7e8089e643cacc57d8a9
373097662c419eef9f4a19ce9f3bcead70f6eafbf0acf44806685eece43ce251
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F09ccbe5e-77b1-4d6d-98f5-a477f3861d8c.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 12758
x-amzn-requestid: c3540562-8c62-4957-9528-7ae952daebaa
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: e9gf1E87oAMFpsQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63c87acb-49fd3f78275937e24d23fca3;Sampled=0
x-amzn-remapped-date: Wed, 18 Jan 2023 23:03:39 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: mjK4GJ3UCEuHk4XqmXdZCWHTVvJeX8Z2HFaem2GYzqfqlPSd_h6DfA==
via: 1.1 0c96ded7ff282d2dbcf47c918b6bb500.cloudfront.net (CloudFront), 1.1 64f86ae1c24221f3a2e4d653d6dbc416.cloudfront.net (CloudFront), 1.1 google
date: Thu, 26 Jan 2023 05:14:39 GMT
age: 58608
etag: "0f5d2a6d846f4f8f85dd7e8089e643cacc57d8a9"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6418a71b-f89d-45d1-bc77-36d6312f560b.jpeg
200 OK 5.9 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6418a71b-f89d-45d1-bc77-36d6312f560b.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash ba0a42dadf6a976df148f652e9cc1844
4d825b74865effa4a858ddcad1d0969671facc07
7276a38c9ba6b13a06f24ab8b802f210f98c5541df53fbcd8e879a14d2957d95
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6418a71b-f89d-45d1-bc77-36d6312f560b.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 5943
x-amzn-requestid: 6774f4a4-ed83-49df-868f-4517c2af914b
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fUXxNF2UIAMFlYw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d1a007-75b1e8975c3f4b503e0a1c5b;Sampled=0
x-amzn-remapped-date: Wed, 25 Jan 2023 21:32:55 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: KY05WKpINERD5g9o2QLYdsNMSuuy_YKn2Tl7Qkn7YaAOaPTDfLteeA==
via: 1.1 00f0a41f749793b9dd653153037c957e.cloudfront.net (CloudFront), 1.1 570075675953459325e00b7bcd171df2.cloudfront.net (CloudFront), 1.1 google
date: Wed, 25 Jan 2023 21:49:40 GMT
etag: "4d825b74865effa4a858ddcad1d0969671facc07"
content-type: image/jpeg
age: 85307
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6a8a63ec-e0a4-4297-b143-649ad3968ae8.jpeg
200 OK 9.6 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6a8a63ec-e0a4-4297-b143-649ad3968ae8.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash f62e9b7bdca82d18c945851912d8fea8
a7ca44d337c43bc5c6145b26778661c71cc50484
5da02cc405c1cada55813ffe376844375f1d6ad222cbb63405348b1f5132a0b1
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6a8a63ec-e0a4-4297-b143-649ad3968ae8.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 9595
x-amzn-requestid: c257bfbe-1bd7-4540-bbfa-e4c49a2624a1
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fUXwfGigoAMFvBw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d1a002-226c08656eeefbfa3c2dddb6;Sampled=0
x-amzn-remapped-date: Wed, 25 Jan 2023 21:32:50 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: k9njnQmggD7UkVJzZqSzo90HJJjTjGK0QIoPU0HWYKrSstjM6s1rOw==
via: 1.1 a20e81b65d2465c729ce2f6bfe539dd0.cloudfront.net (CloudFront), 1.1 be082a2326b7d49643607b097f1e7180.cloudfront.net (CloudFront), 1.1 google
date: Wed, 25 Jan 2023 21:49:37 GMT
age: 85310
etag: "a7ca44d337c43bc5c6145b26778661c71cc50484"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
bysxkrqb-iidpiraxhp.duckdns.org/assets/js/scripts.js
200 OK 11 kB URL HTTP/1.1 bysxkrqb-iidpiraxhp.duckdns.org/assets/js/scripts.js
IP
ASN #136052 PT Cloud Hosting Indonesia
File type ASCII text, with CRLF line terminators
Hash 5993126f94e52f628f659785b71ea39c
2310e4a99a24e938d189d42168c939543648fe15
33f596d90adab57bfa28cff9fb915f1cf7b71891222750823557002ce1d551d2
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
fortinet Phishing
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
GET /assets/js/scripts.js HTTP/1.1
Host: bysxkrqb-iidpiraxhp.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bysxkrqb-iidpiraxhp.duckdns.org/
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Length: 10929
Content-Type: application/javascript
Last-Modified: Thu, 26 Jan 2023 14:17:19 GMT
Date: Thu, 26 Jan 2023 21:31:27 GMT
bysxkrqb-iidpiraxhp.duckdns.org/assets/js/isotope.pkgd.min.js
200 OK 35 kB URL HTTP/1.1 bysxkrqb-iidpiraxhp.duckdns.org/assets/js/isotope.pkgd.min.js
IP
ASN #136052 PT Cloud Hosting Indonesia
File type ASCII text, with very long lines (32019)
Hash 2afcff647ed260006faa71c8e779e8d4
c4e5994f24ee8c8d2cf2d6602f0b56b9096a2e98
081ae9baaacc857c1c2cb51de6dbd0e1eb811c2761ef01a50df373f2f6eefe22
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
fortinet Phishing
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
GET /assets/js/isotope.pkgd.min.js HTTP/1.1
Host: bysxkrqb-iidpiraxhp.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bysxkrqb-iidpiraxhp.duckdns.org/
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Length: 35445
Content-Type: application/javascript
Last-Modified: Thu, 26 Jan 2023 14:17:19 GMT
Date: Thu, 26 Jan 2023 21:31:27 GMT
bysxkrqb-iidpiraxhp.duckdns.org/assets/js/swiper.min.js
200 OK 126 kB URL HTTP/1.1 bysxkrqb-iidpiraxhp.duckdns.org/assets/js/swiper.min.js
IP
ASN #136052 PT Cloud Hosting Indonesia
File type ASCII text, with very long lines (65270)
Size 126 kB (125617 bytes)
Hash 74571ff9ea0f905f582197d9e94ab140
2a902def916331df8a60421561e5ed394f42fad9
765d1654297c8d730165fbe731eca09c1d3e6efaa9e7006aaa567c5a2f7994ba
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
fortinet Phishing
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
GET /assets/js/swiper.min.js HTTP/1.1
Host: bysxkrqb-iidpiraxhp.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bysxkrqb-iidpiraxhp.duckdns.org/
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Length: 125617
Content-Type: application/javascript
Last-Modified: Thu, 26 Jan 2023 14:17:19 GMT
Date: Thu, 26 Jan 2023 21:31:26 GMT
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash d9bf2793558044193d7e5d27708a9144
5a8f73462cfda6544cc3efe488854c3cd80bb0a7
e1db5ce5f130aa6d6a1bf18da60fee5c6bb76625a26aef0fee67702e7209ef7e
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 26 Jan 2023 21:31:28 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash d9bf2793558044193d7e5d27708a9144
5a8f73462cfda6544cc3efe488854c3cd80bb0a7
e1db5ce5f130aa6d6a1bf18da60fee5c6bb76625a26aef0fee67702e7209ef7e
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 26 Jan 2023 21:31:28 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash d9bf2793558044193d7e5d27708a9144
5a8f73462cfda6544cc3efe488854c3cd80bb0a7
e1db5ce5f130aa6d6a1bf18da60fee5c6bb76625a26aef0fee67702e7209ef7e
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 26 Jan 2023 21:31:28 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash d9bf2793558044193d7e5d27708a9144
5a8f73462cfda6544cc3efe488854c3cd80bb0a7
e1db5ce5f130aa6d6a1bf18da60fee5c6bb76625a26aef0fee67702e7209ef7e
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 26 Jan 2023 21:31:28 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
fonts.gstatic.com/s/montserrat/v25/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
200 OK 31 kB URL HTTP/2 fonts.gstatic.com/s/montserrat/v25/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 30928, version 1.0\012- data
Hash ac0d2859ea5f8fd6bcb3c305c08ec184
7f6c17e3e592cd8bd346b9cc261d8dd961b8aef7
ae919a7c9f25f0fd97fc18e398ae8e453fcaae487e4a4cb4f896e7fecde4a780
GET /s/montserrat/v25/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://bysxkrqb-iidpiraxhp.duckdns.org
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 30928
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 20 Jan 2023 07:08:09 GMT
expires: Sat, 20 Jan 2024 07:08:09 GMT
cache-control: public, max-age=31536000
age: 570199
last-modified: Mon, 11 Jul 2022 18:57:39 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
fonts.gstatic.com/s/opensans/v34/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
200 OK 45 kB URL HTTP/2 fonts.gstatic.com/s/opensans/v34/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 44856, version 1.0\012- data
Hash 565ce506190ad3af920b40baf1794cec
ad3cba5d06100e09449a864d3b5e58403b478b3d
8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db
GET /s/opensans/v34/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://bysxkrqb-iidpiraxhp.duckdns.org
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 44856
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Mon, 23 Jan 2023 18:52:41 GMT
expires: Tue, 23 Jan 2024 18:52:41 GMT
cache-control: public, max-age=31536000
age: 268727
last-modified: Mon, 15 Aug 2022 18:20:18 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
fonts.gstatic.com/s/opensans/v34/memQYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWq8tWZ0Pw86hd0Rk8ZkWVAewA.woff2
200 OK 18 kB URL HTTP/2 fonts.gstatic.com/s/opensans/v34/memQYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWq8tWZ0Pw86hd0Rk8ZkWVAewA.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 17820, version 1.0\012- data
Hash 3d5107abaf7bf4df5478bd04625c0929
b04d394caabf6ea3e500b74781dc2bfd54f3c18d
9ad0a22b0c58240a7a92b4c01aa31f39a5918dea6a8fdfa77e63042abc4fca31
GET /s/opensans/v34/memQYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWq8tWZ0Pw86hd0Rk8ZkWVAewA.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://bysxkrqb-iidpiraxhp.duckdns.org
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 17820
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Tue, 24 Jan 2023 18:04:34 GMT
expires: Wed, 24 Jan 2024 18:04:34 GMT
cache-control: public, max-age=31536000
age: 185214
last-modified: Mon, 15 Aug 2022 18:13:12 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash d9bf2793558044193d7e5d27708a9144
5a8f73462cfda6544cc3efe488854c3cd80bb0a7
e1db5ce5f130aa6d6a1bf18da60fee5c6bb76625a26aef0fee67702e7209ef7e
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 26 Jan 2023 21:31:28 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
bysxkrqb-iidpiraxhp.duckdns.org/assets/images/logo.svg
200 OK 3.9 kB URL HTTP/1.1 bysxkrqb-iidpiraxhp.duckdns.org/assets/images/logo.svg
IP
ASN #136052 PT Cloud Hosting Indonesia
File type SVG Scalable Vector Graphics image\012- XML 1.0 document text\012- XML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with CRLF line terminators
Hash 5d6dafbe74a3300734f40d785f9b8e45
588ccd0b714d30d33b07c2029b74188d36dcd02b
d19d102bf37b08e9fe6f67b43492f7eab072c16e1eb1bff4be06956cab8612a0
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
fortinet Phishing
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
GET /assets/images/logo.svg HTTP/1.1
Host: bysxkrqb-iidpiraxhp.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bysxkrqb-iidpiraxhp.duckdns.org/
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Length: 3858
Content-Type: image/svg+xml
Last-Modified: Thu, 26 Jan 2023 14:17:19 GMT
Date: Thu, 26 Jan 2023 21:31:28 GMT
bysxkrqb-iidpiraxhp.duckdns.org/assets/images/team-2.png
200 OK 19 kB URL HTTP/1.1 bysxkrqb-iidpiraxhp.duckdns.org/assets/images/team-2.png
IP
ASN #136052 PT Cloud Hosting Indonesia
File type PNG image data, 230 x 200, 8-bit colormap, non-interlaced\012- data
Hash 85c9a64b48c5f2f7628cf52d8e1dbd7b
4e80ebbf3fe19035ca0ce12993be801716224a82
e50f1cd75801973a226969e9acb7589f0274b4b3c46b33d8099604e135206a92
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
GET /assets/images/team-2.png HTTP/1.1
Host: bysxkrqb-iidpiraxhp.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bysxkrqb-iidpiraxhp.duckdns.org/
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Length: 18853
Content-Type: image/png
Last-Modified: Thu, 26 Jan 2023 14:17:19 GMT
Date: Thu, 26 Jan 2023 21:31:28 GMT
bysxkrqb-iidpiraxhp.duckdns.org/assets/images/team-1.png
200 OK 19 kB URL HTTP/1.1 bysxkrqb-iidpiraxhp.duckdns.org/assets/images/team-1.png
IP
ASN #136052 PT Cloud Hosting Indonesia
File type PNG image data, 230 x 200, 8-bit colormap, non-interlaced\012- data
Hash 70b05db7e49931d59fc896d03819b389
6396404d552743ce6473f2b0f421571ce84ff771
41768e8052de115958d44c3d2166e81d8977f445a4a11db90e2489ca215be4e4
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
GET /assets/images/team-1.png HTTP/1.1
Host: bysxkrqb-iidpiraxhp.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bysxkrqb-iidpiraxhp.duckdns.org/
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Length: 18874
Content-Type: image/png
Last-Modified: Thu, 26 Jan 2023 14:17:19 GMT
Date: Thu, 26 Jan 2023 21:31:28 GMT
bysxkrqb-iidpiraxhp.duckdns.org/assets/images/team-3.png
200 OK 20 kB URL HTTP/1.1 bysxkrqb-iidpiraxhp.duckdns.org/assets/images/team-3.png
IP
ASN #136052 PT Cloud Hosting Indonesia
File type PNG image data, 230 x 200, 8-bit colormap, non-interlaced\012- data
Hash f206425c2bbb0405083aba59953cf7a3
7eba037a3aab8e46d4b4b83de7e65650a7ba0a1c
dff9970b6cc442a8f9122317dab81495cc757d87e1e4cb683202946caacad22d
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
GET /assets/images/team-3.png HTTP/1.1
Host: bysxkrqb-iidpiraxhp.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bysxkrqb-iidpiraxhp.duckdns.org/
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Length: 20346
Content-Type: image/png
Last-Modified: Thu, 26 Jan 2023 14:17:19 GMT
Date: Thu, 26 Jan 2023 21:31:28 GMT
bysxkrqb-iidpiraxhp.duckdns.org/assets/images/hexagon-green.svg
200 OK 660 B URL HTTP/1.1 bysxkrqb-iidpiraxhp.duckdns.org/assets/images/hexagon-green.svg
IP
ASN #136052 PT Cloud Hosting Indonesia
File type SVG Scalable Vector Graphics image\012- XML 1.0 document text\012- XML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with CRLF line terminators
Hash f27e7b9f0fc0b37cd83161990a59560c
9a80b528822ea1286c34e497dd055af2782b858a
0053a159a618e45e96fb0c24b9efce0d9c29dd4016ad6e0c9ac6f1370c1e7ae4
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
fortinet Phishing
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
GET /assets/images/hexagon-green.svg HTTP/1.1
Host: bysxkrqb-iidpiraxhp.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bysxkrqb-iidpiraxhp.duckdns.org/assets/css/styles.css
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Length: 660
Content-Type: image/svg+xml
Last-Modified: Thu, 26 Jan 2023 14:17:19 GMT
Date: Thu, 26 Jan 2023 21:31:28 GMT
bysxkrqb-iidpiraxhp.duckdns.org/assets/images/project-8.jpg
200 OK 63 kB URL HTTP/1.1 bysxkrqb-iidpiraxhp.duckdns.org/assets/images/project-8.jpg
IP
ASN #136052 PT Cloud Hosting Indonesia
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 722x704, components 3\012- data
Hash d9e8a6245800b4ff6e6be1ab413be1d6
8b5d5afffe07477cf6d83661341bf9498f7734f6
1fa386b4ec95f717ccb6759e28f62f89a158c3a7a68aa88727c419ccfbfbe002
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
GET /assets/images/project-8.jpg HTTP/1.1
Host: bysxkrqb-iidpiraxhp.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bysxkrqb-iidpiraxhp.duckdns.org/
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Length: 63374
Content-Type: image/jpeg
Last-Modified: Thu, 26 Jan 2023 14:17:19 GMT
Date: Thu, 26 Jan 2023 21:31:28 GMT
bysxkrqb-iidpiraxhp.duckdns.org/assets/images/services-1.jpg
200 OK 18 kB URL HTTP/1.1 bysxkrqb-iidpiraxhp.duckdns.org/assets/images/services-1.jpg
IP
ASN #136052 PT Cloud Hosting Indonesia
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 690x398, components 3\012- data
Hash db7ef22712a4b475a426fab9ef5284d5
8a7a76a1ff31d09141f098737ee42ca13602d1cc
b5c5492eab1bb755646d9932666aaa755225d0b65932ba729bc126311dc12a1a
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
GET /assets/images/services-1.jpg HTTP/1.1
Host: bysxkrqb-iidpiraxhp.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bysxkrqb-iidpiraxhp.duckdns.org/
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Length: 18345
Content-Type: image/jpeg
Last-Modified: Thu, 26 Jan 2023 14:17:19 GMT
Date: Thu, 26 Jan 2023 21:31:28 GMT
bysxkrqb-iidpiraxhp.duckdns.org/assets/images/intro-office.jpg
200 OK 61 kB URL HTTP/1.1 bysxkrqb-iidpiraxhp.duckdns.org/assets/images/intro-office.jpg
IP
ASN #136052 PT Cloud Hosting Indonesia
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 690x446, components 3\012- data
Hash 5de0bc8c5e753e594f914e19e83da92e
0e2e2af37b9396640d160fd343c5ece976031bc6
c30423525c17a9b2e77636e6717a85e5f5916829e6044cc1876f4e347231bd54
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
GET /assets/images/intro-office.jpg HTTP/1.1
Host: bysxkrqb-iidpiraxhp.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bysxkrqb-iidpiraxhp.duckdns.org/
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Length: 60789
Content-Type: image/jpeg
Last-Modified: Thu, 26 Jan 2023 14:17:19 GMT
Date: Thu, 26 Jan 2023 21:31:28 GMT
bysxkrqb-iidpiraxhp.duckdns.org/assets/webfonts/fa-solid-900.woff2
200 OK 50 kB URL HTTP/1.1 bysxkrqb-iidpiraxhp.duckdns.org/assets/webfonts/fa-solid-900.woff2
IP
ASN #136052 PT Cloud Hosting Indonesia
File type Web Open Font Format (Version 2), TrueType, length 50372, version 1.0\012- data
Hash 8a8c0474283e0d9ef41743e5e486bf05
1ba4dd60af529d1a72d0e57467c3bc0bbb728a4d
cbbca7d9888b4a9eab7d479756d2924f9b067fd38dab376797029df741f96ee4
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
fortinet Phishing
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
GET /assets/webfonts/fa-solid-900.woff2 HTTP/1.1
Host: bysxkrqb-iidpiraxhp.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://bysxkrqb-iidpiraxhp.duckdns.org/assets/css/fontawesome-all.css
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Length: 50372
Content-Type: font/woff2
Last-Modified: Thu, 26 Jan 2023 14:17:19 GMT
Date: Thu, 26 Jan 2023 21:31:28 GMT
bysxkrqb-iidpiraxhp.duckdns.org/assets/images/services-2.jpg
200 OK 45 kB URL HTTP/1.1 bysxkrqb-iidpiraxhp.duckdns.org/assets/images/services-2.jpg
IP
ASN #136052 PT Cloud Hosting Indonesia
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 690x398, components 3\012- data
Hash e1449770bba52fee6b302a1c94bcdf3a
be8811435f3ebeb5509963c8b0f2711323069580
a2b8b9cda5cce1a1ca8be715802340efebf0f2d26e8a96e1c42e744b3e61653a
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
GET /assets/images/services-2.jpg HTTP/1.1
Host: bysxkrqb-iidpiraxhp.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bysxkrqb-iidpiraxhp.duckdns.org/
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Length: 45032
Content-Type: image/jpeg
Last-Modified: Thu, 26 Jan 2023 14:17:19 GMT
Date: Thu, 26 Jan 2023 21:31:28 GMT
bysxkrqb-iidpiraxhp.duckdns.org/assets/webfonts/fa-brands-400.woff2
200 OK 61 kB URL HTTP/1.1 bysxkrqb-iidpiraxhp.duckdns.org/assets/webfonts/fa-brands-400.woff2
IP
ASN #136052 PT Cloud Hosting Indonesia
File type Web Open Font Format (Version 2), TrueType, length 61336, version 1.0\012- data
Hash 3654744dc6d6c37c9b3582b57622df5e
0ec12ea1707f5bc812b627f41cccad2aff01e54b
1ddd3b7b68a96da02979f972e4e9a8b6af63b5a17c75d7c7e0e3901d9f3a729c
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
fortinet Phishing
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
GET /assets/webfonts/fa-brands-400.woff2 HTTP/1.1
Host: bysxkrqb-iidpiraxhp.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://bysxkrqb-iidpiraxhp.duckdns.org/assets/css/fontawesome-all.css
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Length: 61336
Content-Type: font/woff2
Last-Modified: Thu, 26 Jan 2023 14:17:19 GMT
Date: Thu, 26 Jan 2023 21:31:28 GMT
bysxkrqb-iidpiraxhp.duckdns.org/assets/images/services-3.jpg
200 OK 57 kB URL HTTP/1.1 bysxkrqb-iidpiraxhp.duckdns.org/assets/images/services-3.jpg
IP
ASN #136052 PT Cloud Hosting Indonesia
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 690x398, components 3\012- data
Hash 1bd32ec4abdc49741aa10cfeab1a0f08
51904dab31e181fa4251bcad0b174ab46b7bf5f0
f521db39fe23999740a52552dd3e32a1e42cfaef642db84a9b27dcf5823de5a4
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
GET /assets/images/services-3.jpg HTTP/1.1
Host: bysxkrqb-iidpiraxhp.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bysxkrqb-iidpiraxhp.duckdns.org/
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Length: 57316
Content-Type: image/jpeg
Last-Modified: Thu, 26 Jan 2023 14:17:19 GMT
Date: Thu, 26 Jan 2023 21:31:28 GMT
bysxkrqb-iidpiraxhp.duckdns.org/assets/images/project-1.jpg
200 OK 87 kB URL HTTP/1.1 bysxkrqb-iidpiraxhp.duckdns.org/assets/images/project-1.jpg
IP
ASN #136052 PT Cloud Hosting Indonesia
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 722x704, components 3\012- data
Hash 8d83fc8eea997b1fd0920d07fcdf6810
db2b919d36f05f9bf9b0eaa990adf504d7f9278c
c76560a63bd3583a15621130b806b15b55eeb23f5fed48e43f34ae5abf8ae29d
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
GET /assets/images/project-1.jpg HTTP/1.1
Host: bysxkrqb-iidpiraxhp.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bysxkrqb-iidpiraxhp.duckdns.org/
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Length: 87109
Content-Type: image/jpeg
Last-Modified: Thu, 26 Jan 2023 14:17:19 GMT
Date: Thu, 26 Jan 2023 21:31:29 GMT
bysxkrqb-iidpiraxhp.duckdns.org/assets/images/project-2.jpg
200 OK 129 kB URL HTTP/1.1 bysxkrqb-iidpiraxhp.duckdns.org/assets/images/project-2.jpg
IP
ASN #136052 PT Cloud Hosting Indonesia
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 722x704, components 3\012- data
Size 129 kB (128650 bytes)
Hash f467bd306a5e04910955f517d1b09b8c
a16db5a00108ee15b40e5e114fb1e25a562a386a
aa1fde15b335ca1f4076025f84a8371806e73a2b57afb24cf79015963264b03e
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
GET /assets/images/project-2.jpg HTTP/1.1
Host: bysxkrqb-iidpiraxhp.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bysxkrqb-iidpiraxhp.duckdns.org/
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Length: 128650
Content-Type: image/jpeg
Last-Modified: Thu, 26 Jan 2023 14:17:19 GMT
Date: Thu, 26 Jan 2023 21:31:29 GMT
fonts.googleapis.com/css?family=Open+Sans:400,400i,600&display=swap&subset=latin-ext
200 OK 122 kB URL HTTP/2 fonts.googleapis.com/css?family=Open+Sans:400,400i,600&display=swap&subset=latin-ext
IP
Size 122 kB (121876 bytes)
Hash eb30ad1075b7752967a5d23d45fb00de
d15b41b1e0fcb6c7f69c433f1ddfd44bf56fd20f
51d96cff7933a7309153f70ec295f1b18466fa40f419f76650d9a6ad57c807fd
GET /css?family=Open+Sans:400,400i,600&display=swap&subset=latin-ext HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://bysxkrqb-iidpiraxhp.duckdns.org/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Thu, 26 Jan 2023 21:31:25 GMT
date: Thu, 26 Jan 2023 21:31:25 GMT
cache-control: private, max-age=86400
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
fonts.googleapis.com/css?family=Montserrat:500,700&display=swap&subset=latin-ext
200 OK 80 kB URL HTTP/2 fonts.googleapis.com/css?family=Montserrat:500,700&display=swap&subset=latin-ext
IP
Hash d2cb0a6e2e8382856327bceb4c40ac83
c95c08b28c9b1db4cfe754527ef65bb0bde03c4e
d833cacf54316b411da0229c06574bc5aa6a8798863150f0f930d26e93b86f61
GET /css?family=Montserrat:500,700&display=swap&subset=latin-ext HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://bysxkrqb-iidpiraxhp.duckdns.org/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Thu, 26 Jan 2023 21:31:25 GMT
date: Thu, 26 Jan 2023 21:31:25 GMT
cache-control: private, max-age=86400
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
bysxkrqb-iidpiraxhp.duckdns.org/assets/images/project-5.jpg
200 OK 125 kB URL HTTP/1.1 bysxkrqb-iidpiraxhp.duckdns.org/assets/images/project-5.jpg
IP
ASN #136052 PT Cloud Hosting Indonesia
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 722x704, components 3\012- data
Size 125 kB (124818 bytes)
Hash b73472bd406efddaf305ccabf9ab5033
286d2bf013b7b873b8aeb5508ad2df12d93927da
47755114a55e973444289872432aca263671bdab8734917cf2a859bce782d8b4
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
GET /assets/images/project-5.jpg HTTP/1.1
Host: bysxkrqb-iidpiraxhp.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bysxkrqb-iidpiraxhp.duckdns.org/
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Length: 124818
Content-Type: image/jpeg
Last-Modified: Thu, 26 Jan 2023 14:17:19 GMT
Date: Thu, 26 Jan 2023 21:31:29 GMT
bysxkrqb-iidpiraxhp.duckdns.org/assets/images/team-4.png
200 OK 21 kB URL HTTP/1.1 bysxkrqb-iidpiraxhp.duckdns.org/assets/images/team-4.png
IP
ASN #136052 PT Cloud Hosting Indonesia
File type PNG image data, 230 x 200, 8-bit colormap, non-interlaced\012- data
Hash 8ce04d0e6177b0f95105b8928cfd7703
76c96b1a00c08e2d0d3c16051da8b0ecbb9f3716
9280453255d890fc4a3f75a3cff60434d7a137bb98fe0638637dce2e7f124594
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
GET /assets/images/team-4.png HTTP/1.1
Host: bysxkrqb-iidpiraxhp.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bysxkrqb-iidpiraxhp.duckdns.org/
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Length: 20795
Content-Type: image/png
Last-Modified: Thu, 26 Jan 2023 14:17:19 GMT
Date: Thu, 26 Jan 2023 21:31:30 GMT
bysxkrqb-iidpiraxhp.duckdns.org/assets/images/header-background.jpg
200 OK 466 kB URL HTTP/1.1 bysxkrqb-iidpiraxhp.duckdns.org/assets/images/header-background.jpg
IP
ASN #136052 PT Cloud Hosting Indonesia
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1920x1080, components 3\012- data
Size 466 kB (465922 bytes)
Hash e5707cb75d2a8df86739498f2f753d30
d5fe92366ca850696d85477f2fedaece50afdada
27104de3677856b3b8791f6635b38acb1b96e6b2e7a6daee1d6cedc833a082c6
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
GET /assets/images/header-background.jpg HTTP/1.1
Host: bysxkrqb-iidpiraxhp.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bysxkrqb-iidpiraxhp.duckdns.org/assets/css/styles.css
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Length: 465922
Content-Type: image/jpeg
Last-Modified: Thu, 26 Jan 2023 14:17:19 GMT
Date: Thu, 26 Jan 2023 21:31:28 GMT
bysxkrqb-iidpiraxhp.duckdns.org/assets/images/testimonial-1.jpg
200 OK 17 kB URL HTTP/1.1 bysxkrqb-iidpiraxhp.duckdns.org/assets/images/testimonial-1.jpg
IP
ASN #136052 PT Cloud Hosting Indonesia
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], progressive, precision 8, 150x150, components 3\012- data
Hash 5ece4f460ee903bc72b0363cb13dd1f8
6e8e641ad96fa7fc205f214f22d1f37f7e2188e6
4b20eb66552a80d8fb82f186813407d54b3a8494f028d07980c94709d9c22a0c
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
GET /assets/images/testimonial-1.jpg HTTP/1.1
Host: bysxkrqb-iidpiraxhp.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bysxkrqb-iidpiraxhp.duckdns.org/
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Length: 17153
Content-Type: image/jpeg
Last-Modified: Thu, 26 Jan 2023 14:17:19 GMT
Date: Thu, 26 Jan 2023 21:31:30 GMT
bysxkrqb-iidpiraxhp.duckdns.org/assets/images/project-7.jpg
200 OK 88 kB URL HTTP/1.1 bysxkrqb-iidpiraxhp.duckdns.org/assets/images/project-7.jpg
IP
ASN #136052 PT Cloud Hosting Indonesia
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 722x704, components 3\012- data
Hash f82f90a4b3d80d07d7fb0cd3294698fd
cb500daa0f90fa078efbedb7afbe558cdce56572
1d06ba5a80e1e1b693ffa33db2881fdff28aab1b18eeef30a4314554e0e31731
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
GET /assets/images/project-7.jpg HTTP/1.1
Host: bysxkrqb-iidpiraxhp.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bysxkrqb-iidpiraxhp.duckdns.org/
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Length: 87474
Content-Type: image/jpeg
Last-Modified: Thu, 26 Jan 2023 14:17:19 GMT
Date: Thu, 26 Jan 2023 21:31:30 GMT
bysxkrqb-iidpiraxhp.duckdns.org/assets/images/testimonial-2.jpg
200 OK 14 kB URL HTTP/1.1 bysxkrqb-iidpiraxhp.duckdns.org/assets/images/testimonial-2.jpg
IP
ASN #136052 PT Cloud Hosting Indonesia
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], progressive, precision 8, 150x150, components 3\012- data
Hash 3a53745caff42323a74d1c5da07e99b1
cbbda50a9e326934c1b6e5ede6bfb2988fdd1a5e
b9698e57d32c7c39d5194fd48fcecdef8e63192453250a85fefccad7acf8d0d3
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
GET /assets/images/testimonial-2.jpg HTTP/1.1
Host: bysxkrqb-iidpiraxhp.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bysxkrqb-iidpiraxhp.duckdns.org/
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Length: 14272
Content-Type: image/jpeg
Last-Modified: Thu, 26 Jan 2023 14:17:19 GMT
Date: Thu, 26 Jan 2023 21:31:30 GMT
bysxkrqb-iidpiraxhp.duckdns.org/assets/images/about.jpg
200 OK 41 kB URL HTTP/1.1 bysxkrqb-iidpiraxhp.duckdns.org/assets/images/about.jpg
IP
ASN #136052 PT Cloud Hosting Indonesia
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 690x468, components 3\012- data
Hash a7d9b9adeeb5ebe86ff84ea51e03fa18
93063c30e071ae7afae5dab38cc9800ecfd7a812
3a05c958e8105479cee704d83104aa74b6ff72b3397119839656cc4111a2fb6e
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
GET /assets/images/about.jpg HTTP/1.1
Host: bysxkrqb-iidpiraxhp.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bysxkrqb-iidpiraxhp.duckdns.org/
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Length: 41312
Content-Type: image/jpeg
Last-Modified: Thu, 26 Jan 2023 14:17:19 GMT
Date: Thu, 26 Jan 2023 21:31:30 GMT
bysxkrqb-iidpiraxhp.duckdns.org/assets/images/testimonial-3.jpg
200 OK 14 kB URL HTTP/1.1 bysxkrqb-iidpiraxhp.duckdns.org/assets/images/testimonial-3.jpg
IP
ASN #136052 PT Cloud Hosting Indonesia
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], progressive, precision 8, 150x150, components 3\012- data
Hash 871ee8f1618ac352b62a9cfa2a5fda0e
64e434579a08884ec14f377af987006e79985e5f
11969e798993d60ffdd246d2c3324ee3dcc66057d64bfcd3e75838c5860edf86
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
GET /assets/images/testimonial-3.jpg HTTP/1.1
Host: bysxkrqb-iidpiraxhp.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bysxkrqb-iidpiraxhp.duckdns.org/
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Length: 13659
Content-Type: image/jpeg
Last-Modified: Thu, 26 Jan 2023 14:17:19 GMT
Date: Thu, 26 Jan 2023 21:31:30 GMT
bysxkrqb-iidpiraxhp.duckdns.org/assets/images/testimonial-4.jpg
200 OK 12 kB URL HTTP/1.1 bysxkrqb-iidpiraxhp.duckdns.org/assets/images/testimonial-4.jpg
IP
ASN #136052 PT Cloud Hosting Indonesia
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], progressive, precision 8, 150x150, components 3\012- data
Hash c0f04dba079ee6b0ae25d2f52c48a0ef
813e6daeb0f616ed257f7f866ca149b271a213d1
bad7b03b84053c3be3d85fb317ce99cb079ed75d10bc34b0bc0f69e651160dec
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
GET /assets/images/testimonial-4.jpg HTTP/1.1
Host: bysxkrqb-iidpiraxhp.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bysxkrqb-iidpiraxhp.duckdns.org/
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Length: 12487
Content-Type: image/jpeg
Last-Modified: Thu, 26 Jan 2023 14:17:19 GMT
Date: Thu, 26 Jan 2023 21:31:30 GMT
bysxkrqb-iidpiraxhp.duckdns.org/assets/images/project-6.jpg
200 OK 91 kB URL HTTP/1.1 bysxkrqb-iidpiraxhp.duckdns.org/assets/images/project-6.jpg
IP
ASN #136052 PT Cloud Hosting Indonesia
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 722x704, components 3\012- data
Hash b76e3f7283ad38721d52bb0ad71d9640
5fb23a085252c2e82b43f672150ce75481a045f5
3238abc40cdd63aec6950309115c587ef43add82b45f4786713a8404c3be7454
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
GET /assets/images/project-6.jpg HTTP/1.1
Host: bysxkrqb-iidpiraxhp.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bysxkrqb-iidpiraxhp.duckdns.org/
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Length: 91029
Content-Type: image/jpeg
Last-Modified: Thu, 26 Jan 2023 14:17:19 GMT
Date: Thu, 26 Jan 2023 21:31:29 GMT
bysxkrqb-iidpiraxhp.duckdns.org/assets/images/testimonial-5.jpg
200 OK 14 kB URL HTTP/1.1 bysxkrqb-iidpiraxhp.duckdns.org/assets/images/testimonial-5.jpg
IP
ASN #136052 PT Cloud Hosting Indonesia
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], progressive, precision 8, 150x150, components 3\012- data
Hash 6cebd0233f08d00260cf1e24b5475222
630f683871c7d19edf6c5b888f473bc8746afc41
5eb925ae0a6b3b404347298ad85367f6b6ab506a58ba06721fc531f2b34d6b3c
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
GET /assets/images/testimonial-5.jpg HTTP/1.1
Host: bysxkrqb-iidpiraxhp.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bysxkrqb-iidpiraxhp.duckdns.org/
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Length: 14372
Content-Type: image/jpeg
Last-Modified: Thu, 26 Jan 2023 14:17:19 GMT
Date: Thu, 26 Jan 2023 21:31:30 GMT
bysxkrqb-iidpiraxhp.duckdns.org/assets/images/testimonial-6.jpg
200 OK 13 kB URL HTTP/1.1 bysxkrqb-iidpiraxhp.duckdns.org/assets/images/testimonial-6.jpg
IP
ASN #136052 PT Cloud Hosting Indonesia
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], progressive, precision 8, 150x150, components 3\012- data
Hash 4a330f5eb9a69543375211bf4b219f63
9762801ee93705a20e68178c44c7d8dba6fcdf1e
aaa9e8124ef1c1a9358e0bb16298880ec7bb2f33cf43605c1c8ed72687bfb13c
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
GET /assets/images/testimonial-6.jpg HTTP/1.1
Host: bysxkrqb-iidpiraxhp.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bysxkrqb-iidpiraxhp.duckdns.org/
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Length: 12698
Content-Type: image/jpeg
Last-Modified: Thu, 26 Jan 2023 14:17:19 GMT
Date: Thu, 26 Jan 2023 21:31:30 GMT
bysxkrqb-iidpiraxhp.duckdns.org/assets/images/down-arrow.png
200 OK 1.0 kB URL HTTP/1.1 bysxkrqb-iidpiraxhp.duckdns.org/assets/images/down-arrow.png
IP
ASN #136052 PT Cloud Hosting Indonesia
File type PNG image data, 14 x 9, 8-bit/color RGBA, non-interlaced\012- data
Hash ac6d4cdd83c10d04fa6d4d7034874957
4deb5b8010307fb0e0bade1ef1f860361bd05466
83f78eb5a5ef02c50d3d3f41ac156b070868698fd0083cfa7cf777bfaae44318
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
GET /assets/images/down-arrow.png HTTP/1.1
Host: bysxkrqb-iidpiraxhp.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bysxkrqb-iidpiraxhp.duckdns.org/assets/css/styles.css
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Length: 1044
Content-Type: image/png
Last-Modified: Thu, 26 Jan 2023 14:17:19 GMT
Date: Thu, 26 Jan 2023 21:31:30 GMT
bysxkrqb-iidpiraxhp.duckdns.org/assets/images/details-2-background.jpg
200 OK 192 kB URL HTTP/1.1 bysxkrqb-iidpiraxhp.duckdns.org/assets/images/details-2-background.jpg
IP
ASN #136052 PT Cloud Hosting Indonesia
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1200x800, components 3\012- data
Size 192 kB (192233 bytes)
Hash e41d1c0f17be353995a707436a279fa7
e4d7d8771bd6c89d2afed44fc5437fd837b3257e
a4da1c0e83ff93e75b870a001178275b84db4eb1989d64fc7bd1957a2d49c884
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
GET /assets/images/details-2-background.jpg HTTP/1.1
Host: bysxkrqb-iidpiraxhp.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bysxkrqb-iidpiraxhp.duckdns.org/assets/css/styles.css
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Length: 192233
Content-Type: image/jpeg
Last-Modified: Thu, 26 Jan 2023 14:17:19 GMT
Date: Thu, 26 Jan 2023 21:31:30 GMT
bysxkrqb-iidpiraxhp.duckdns.org/assets/images/favicon.png
200 OK 1.4 kB URL HTTP/1.1 bysxkrqb-iidpiraxhp.duckdns.org/assets/images/favicon.png
IP
ASN #136052 PT Cloud Hosting Indonesia
File type PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced\012- data
Hash c2195fb7d311a0c8de10b081d23e6b9a
1e2675f23b1a143d6c2caa8f8879ec98d7a2ba6a
b29b85173752c3c60bd5914e5eb98b1f79f143e3ff59c13c883bf59034697ab3
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
GET /assets/images/favicon.png HTTP/1.1
Host: bysxkrqb-iidpiraxhp.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bysxkrqb-iidpiraxhp.duckdns.org/
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Length: 1355
Content-Type: image/png
Last-Modified: Thu, 26 Jan 2023 14:17:19 GMT
Date: Thu, 26 Jan 2023 21:31:31 GMT
bysxkrqb-iidpiraxhp.duckdns.org/assets/images/details-1-background.jpg
200 OK 88 kB URL HTTP/1.1 bysxkrqb-iidpiraxhp.duckdns.org/assets/images/details-1-background.jpg
IP
ASN #136052 PT Cloud Hosting Indonesia
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1200x800, components 3\012- data
Hash fcf75aca7c554a0fe508f3c738d9c361
04eaa4da890a6e4a581ed1249623363c0516ed5f
e478f67a5616b44030a25b06ab8e37dce26dcfbfee6dcb71ad89b0fed951b7fa
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
GET /assets/images/details-1-background.jpg HTTP/1.1
Host: bysxkrqb-iidpiraxhp.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bysxkrqb-iidpiraxhp.duckdns.org/assets/css/styles.css
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Length: 87542
Content-Type: image/jpeg
Last-Modified: Thu, 26 Jan 2023 14:17:19 GMT
Date: Thu, 26 Jan 2023 21:31:30 GMT
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa3e6d9a5-dd7d-4337-a00f-a145350a1a29.jpeg
200 OK 10 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa3e6d9a5-dd7d-4337-a00f-a145350a1a29.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 653bf5a34e9f99c9eef73a21d98d792f
c70d46aa2210c4f7c397fa20e1225b7d0734ac35
9f928ec6f194340e5543a4bf757aac31d545def67a56ae804a2039a3effd3fe0
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa3e6d9a5-dd7d-4337-a00f-a145350a1a29.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
content-length: 10379
x-amzn-requestid: 77d12b56-c121-4d0a-9831-9de4151b65de
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fUY8_GVUIAMFmgA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d1a1ec-523a2d8b1028a4496a211030;Sampled=0
x-amzn-remapped-date: Wed, 25 Jan 2023 21:41:00 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: i_OHKx9OPaP8_2ydfgZwY4Dvbq208pXR2hwFTdUySwjsIwEIcv-M4g==
via: 1.1 1b0911478686968732f973d6e5e31d10.cloudfront.net (CloudFront), 1.1 981753271eb5b6d11bc29d52f173a5da.cloudfront.net (CloudFront), 1.1 google
date: Wed, 25 Jan 2023 21:49:18 GMT
age: 85336
etag: "c70d46aa2210c4f7c397fa20e1225b7d0734ac35"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
bysxkrqb-iidpiraxhp.duckdns.org/assets/css/bootstrap.css
200 OK 0 B URL HTTP/1.1 bysxkrqb-iidpiraxhp.duckdns.org/assets/css/bootstrap.css
IP
ASN #136052 PT Cloud Hosting Indonesia
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
GET /assets/css/bootstrap.css HTTP/1.1
Host: bysxkrqb-iidpiraxhp.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bysxkrqb-iidpiraxhp.duckdns.org/
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Length: 192348
Content-Type: text/css; charset=utf-8
Last-Modified: Thu, 26 Jan 2023 14:17:19 GMT
Date: Thu, 26 Jan 2023 21:31:25 GMT
103.174.114.243
52.12.67.61
23.36.77.32