{"report_id":"4576a14e-d1d0-4b01-8758-6ef328fa51c8","version":6,"status":"done","tags":["dyndns","suspicious","telegram_bot"],"date":"2026-05-15T07:04:26Z","url":{"schema":"http","addr":"maprim.duckdns.org/Docsign134.html","fqdn":"maprim.duckdns.org","domain":"maprim.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"185.80.128.26","port":0,"asn":61053,"as":"UAB ESNET","country":"Lithuania","country_code":"LT"},"final":{"url":{"schema":"https","addr":"maprim.duckdns.org/Docsign134.html","fqdn":"maprim.duckdns.org","domain":"maprim.duckdns.org","tld":"duckdns.org"},"title":"Connexion DocuSign","dom":{"size":8742,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"35bcdf7d6ac7fc5ff1caebadf1cc7694","sha1":"befed40e24d7e7dd77cf61845dad38af3b24d5c6","sha256":"c96f3a6399d3e939d8dd48fda0a021bf02f5a6f9c70d920cdb67d60f0c60d8f7","sha512":"618b5095a2c151adc34dfb6530cca8d6226693bf806ddea1b7bb5589dc39ddb157696b50bcbd1fb105ef3524438ad542607ceabb8322626cb2ab6dc649b3d29f","ssdeep":"192:crU0S1VgjpSzmCjbggF8fAVd6jHrChNF0iiepqkQ7kdrsJUa:crISSicbSLaNiiieAkdoX","tlshash":"8602816776f319256a43c0ac3be7a6453520c0079a0add487fac8659cfc6ed1a4b37dc","dom_hash":"domhash54e92db6d8ac865b059454ac4c200243","first_seen":"2026-05-15T07:04:28.102106Z","last_seen":"2026-05-15T07:04:28.102106Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"maprim.duckdns.org/Docsign134.html","fqdn":"maprim.duckdns.org","domain":"maprim.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"185.80.128.26","port":0,"asn":61053,"as":"UAB ESNET","country":"Lithuania","country_code":"LT"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-06-19T07:04:26Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":3,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-05-15","alert":"Detects file containing Telegram Bot API","trigger":"maprim.duckdns.org/Docsign134.html","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-14","alert":"Sinkholed","trigger":"www.zupimages.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-15","alert":"Sinkholed","trigger":"maprim.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-14","alert":"Sinkholed","trigger":"zupimages.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"summary":[{"fqdn":"www.zupimages.net","ip":{"addr":"172.67.134.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2009-03-28","domain_rank":476411,"first_seen":"2012-10-19T21:50:23Z","last_seen":"2026-05-12T02:50:04.261092Z","alert_count":3,"request_count":3,"received_data":83082,"sent_data":1341,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"maprim.duckdns.org","ip":{"addr":"185.80.128.26","port":443,"asn":61053,"as":"UAB ESNET","country":"Lithuania","country_code":"LT"},"domain_registered":"2013-04-12","domain_rank":0,"first_seen":"2026-05-15T00:23:14.169167Z","last_seen":"2026-05-15T00:23:14.169167Z","alert_count":6,"request_count":2,"received_data":10283,"sent_data":960,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}]},{"fqdn":"zupimages.net","ip":{"addr":"172.67.134.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2009-03-28","domain_rank":32352,"first_seen":"2012-08-24T16:06:23Z","last_seen":"2026-05-09T18:04:22.961242Z","alert_count":3,"request_count":3,"received_data":82572,"sent_data":1329,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":[{"url":{"schema":"https","addr":"maprim.duckdns.org/Docsign134.html","fqdn":"maprim.duckdns.org","domain":"maprim.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"185.80.128.26","port":443,"asn":61053,"as":"UAB ESNET","country":"Lithuania","country_code":"LT"},"md5":"bfc739061954e4a51032749a820885fc","sha1":"b4762f15b3cd0b9cc1dad298b06846d5229ac61c","sha256":"71d54aa7e7a454d3ddf0e1661f3253dde66d5eeb4af4c6072c0bea337b01b6af","sha512":"393d767717cddae48ebd77f9393d7a276ba86b4067baf2ba2b71677f92844c9156a5d0269aa38803e4e1cef155c3dcd678a452b3825c87e7a5586dfca08f566c","size":3034,"token":"6978326198:AAEdNRWWaTX0t9IxpoMYynYAwgnasviAnNE","is_revoked":false,"bot":{"token":"6978326198:AAEdNRWWaTX0t9IxpoMYynYAwgnasviAnNE","user_id":"6978326198","username":"coulc12_bot","first_name":"Soleysco_bot","last_name":"","chat":{"chat_id":"6354129546","title":"","type":"private","bot_is":"member","total_users":2,"active_members":null,"admins":null},"pending_messages":1}}],"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"maprim.duckdns.org/Docsign134.html","fqdn":"maprim.duckdns.org","domain":"maprim.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"185.80.128.26","port":443,"asn":61053,"as":"UAB ESNET","country":"Lithuania","country_code":"LT"},"introduction_type":"scriptElement","is_inline":true,"md5":"bfc739061954e4a51032749a820885fc","sha1":"b4762f15b3cd0b9cc1dad298b06846d5229ac61c","sha256":"71d54aa7e7a454d3ddf0e1661f3253dde66d5eeb4af4c6072c0bea337b01b6af","sha512":"393d767717cddae48ebd77f9393d7a276ba86b4067baf2ba2b71677f92844c9156a5d0269aa38803e4e1cef155c3dcd678a452b3825c87e7a5586dfca08f566c","ssdeep":"","tlshash":"1551311736b209305adbe16e32a39648312080173c02de497e7cc619cfd9e86b0f3bd9","size":3034,"data":"","first_seen":"2026-05-15T07:04:28.120683Z","last_seen":"2026-05-15T07:04:28.120683Z","times_seen":1,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-05-15","alert":"Detects file containing Telegram Bot API","trigger":"maprim.duckdns.org/Docsign134.html","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"www.zupimages.net/up/25/42/bdgy.png","fqdn":"www.zupimages.net","domain":"zupimages.net","tld":"net"},"ip":{"addr":"172.67.134.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://maprim.duckdns.org/Docsign134.html","date":"2026-05-15T07:04:05.383Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zupimages.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 23 Mar 2026 23:41:10 GMT","end":"Mon, 22 Jun 2026 00:38:52 GMT"},"fingerprint":{"sha1":"FE:0D:28:28:DD:89:56:7B:E4:18:E6:38:ED:EF:0C:5A:C4:17:FA:2D","sha256":"62:E4:AB:06:84:23:6F:33:C0:6D:56:46:80:52:47:12:F1:C3:7F:AC:BB:51:95:7A:87:D3:6C:29:8E:8F:C7:94"}}},"request":{"raw":"GET /up/25/42/bdgy.png HTTP/1.1\r\nHost: www.zupimages.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://maprim.duckdns.org/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 15 May 2026 07:04:05 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncontent-disposition: filename=\"bdgy.png\"\r\nstrict-transport-security: max-age=15768000\r\nx-xss-protection: 1; mode=block\r\nlast-modified: Fri, 15 May 2026 07:04:05 GMT\r\ncache-control: max-age=2678400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3q5XLSCPdSweRFQKJBtXmmnICdKkM13n%2BeMMyK9kTsjpLja3Kf8IqDkIEyJcNtGN%2FDX848WWIfGhv%2BAnmWz38xBbgWBVL3wzGa0IxEju3EJcgCk740nTNATw0fSmrYCFoY8CUw%3D%3D\"}]}\r\ncf-ray: 9fc04959ae89712b-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":34996,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1346 x 342, 8-bit/color RGBA, non-interlaced","md5":"cb63a237dfda7f82c6f332dab4207fcb","sha1":"6276fa647f1cb446a9c6cfac151474bef42eaaed","sha256":"399c7f07f6c36d4654e3d5a0fbcc069321edac0af9b1719fbcdb3122bc854438","sha512":"852b1f3016560c8c4bd404b6b732f20974aac8ef31c2cf320c01de4911697c752204f4b03a13316b39e015ff2997beee10f86dbf18b0025ebf0ffa95f8e92479","ssdeep":"768:L6caQ68mspBLPBShjV6na8skuzbAl3dAQE/8UCivHsLqO3g:768jzBYj4na8sBzguCivMr3g","tlshash":"7cf2bf75164bc866ce9fea7eb145f384291ea18b360585389ebd5dded023ff90c482a0","first_seen":"2026-03-04T07:20:01.285219Z","last_seen":"2026-08-05T15:28:04.192948Z","times_seen":4,"resource_available":false,"data":null}},"time_used":142,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":133,"receive":9,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-14","alert":"Sinkholed","trigger":"www.zupimages.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"maprim.duckdns.org/favicon.ico","fqdn":"maprim.duckdns.org","domain":"maprim.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"185.80.128.26","port":443,"asn":61053,"as":"UAB ESNET","country":"Lithuania","country_code":"LT"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://maprim.duckdns.org/Docsign134.html","date":"2026-05-15T07:04:05.659Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"maprim.duckdns.org","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 14 May 2026 00:24:07 GMT","end":"Wed, 12 Aug 2026 00:24:06 GMT"},"fingerprint":{"sha1":"1D:CB:1D:69:48:FF:30:41:5C:30:BA:4A:C7:13:9C:38:69:8F:FA:F7","sha256":"64:B1:5A:C6:D3:C0:11:94:74:B5:FC:BD:9F:3A:03:99:00:5B:A3:BD:7B:79:60:BB:3D:8F:6F:52:5F:5B:08:45"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: maprim.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://maprim.duckdns.org/Docsign134.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Fri, 15 May 2026 07:04:04 GMT\r\ncontent-type: text/html\r\nlast-modified: Thu, 14 May 2026 01:21:24 GMT\r\netag: W/\"328-651bcea2470cd\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-10T22:44:42.119625Z","times_seen":38782,"resource_available":true,"data":null}},"time_used":41,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":41,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-15","alert":"Sinkholed","trigger":"maprim.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"maprim.duckdns.org/Docsign134.html","fqdn":"maprim.duckdns.org","domain":"maprim.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"185.80.128.26","port":443,"asn":61053,"as":"UAB ESNET","country":"Lithuania","country_code":"LT"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-05-15T07:04:03.938Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"maprim.duckdns.org","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 14 May 2026 00:24:07 GMT","end":"Wed, 12 Aug 2026 00:24:06 GMT"},"fingerprint":{"sha1":"1D:CB:1D:69:48:FF:30:41:5C:30:BA:4A:C7:13:9C:38:69:8F:FA:F7","sha256":"64:B1:5A:C6:D3:C0:11:94:74:B5:FC:BD:9F:3A:03:99:00:5B:A3:BD:7B:79:60:BB:3D:8F:6F:52:5F:5B:08:45"}}},"request":{"raw":"GET /Docsign134.html HTTP/1.1\r\nHost: maprim.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 15 May 2026 07:04:04 GMT\r\ncontent-type: text/html\r\nlast-modified: Thu, 14 May 2026 01:52:00 GMT\r\netag: W/\"6a052ac0-2342\"\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9026,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with CRLF line terminators","md5":"58a460f0c52a0b2d7a145d2d67ed909c","sha1":"40bb9144137b43079d5e758bb56df5c23bbd57df","sha256":"89b33952fde58f3ef2040eb078c3805c40b1b7575f499fb818402fae6ac34762","sha512":"129765368bcaaa03832617f78ed13dd6e815d7700e85d68ed0ce62c4ca59e1efbb29e92ca4d2715f7f2e435846d51450ae451bd782d409d2200ca3b875abbdd8","ssdeep":"192:4c3svGFWdZdVGoJ9FjqAe0O/+toZyQwizOWo5+Gt4BgUSx:HqGuTVZVDXSZVwizgnt4BG","tlshash":"e4128227729219216573c2a8bfa3664cff61811347029a587eac935b9ff6d809173fcc","first_seen":"2026-05-15T07:04:28.110634Z","last_seen":"2026-05-15T07:04:28.110634Z","times_seen":1,"resource_available":false,"data":null}},"time_used":2443,"timings":{"blocked":1201,"dns":1117,"connect":39,"send":0,"wait":41,"receive":0,"ssl":43},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-05-15","alert":"Detects file containing Telegram Bot API","trigger":"maprim.duckdns.org/Docsign134.html","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-15","alert":"Sinkholed","trigger":"maprim.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]}},{"url":{"schema":"https","addr":"zupimages.net/up/25/37/iu3q.jpg","fqdn":"zupimages.net","domain":"zupimages.net","tld":"net"},"ip":{"addr":"172.67.134.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://maprim.duckdns.org/Docsign134.html","date":"2026-05-15T07:04:05.329Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zupimages.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 23 Mar 2026 23:41:10 GMT","end":"Mon, 22 Jun 2026 00:38:52 GMT"},"fingerprint":{"sha1":"FE:0D:28:28:DD:89:56:7B:E4:18:E6:38:ED:EF:0C:5A:C4:17:FA:2D","sha256":"62:E4:AB:06:84:23:6F:33:C0:6D:56:46:80:52:47:12:F1:C3:7F:AC:BB:51:95:7A:87:D3:6C:29:8E:8F:C7:94"}}},"request":{"raw":"GET /up/25/37/iu3q.jpg HTTP/1.1\r\nHost: zupimages.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://maprim.duckdns.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 301 Moved Permanently\r\ndate: Fri, 15 May 2026 07:04:05 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nlocation: https://www.zupimages.net/up/25/37/iu3q.jpg\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=wpBTVxQq%2BrLJwvcdtzz5CRbAxYb11hmoADY1KJ3BZv57k0%2FEPWzJ%2F%2B%2B%2FnSsAkpb%2BjlllAh4LuQaKPOUAXF6GiLUNEppc4oUWdZKR9mYzKYv3A60kpWhiTMyjnMlIvheM\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\ncf-ray: 9fc0495978343181-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":14013,"size_decoded":0,"mime_type":"image/jpeg","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-10T22:57:27.441562Z","times_seen":17826364,"resource_available":true,"data":null}},"time_used":64,"timings":{"blocked":27,"dns":5,"connect":1,"send":0,"wait":5,"receive":0,"ssl":24},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-14","alert":"Sinkholed","trigger":"zupimages.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zupimages.net/up/25/42/bdgy.png","fqdn":"zupimages.net","domain":"zupimages.net","tld":"net"},"ip":{"addr":"172.67.134.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://maprim.duckdns.org/Docsign134.html","date":"2026-05-15T07:04:05.331Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zupimages.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 23 Mar 2026 23:41:10 GMT","end":"Mon, 22 Jun 2026 00:38:52 GMT"},"fingerprint":{"sha1":"FE:0D:28:28:DD:89:56:7B:E4:18:E6:38:ED:EF:0C:5A:C4:17:FA:2D","sha256":"62:E4:AB:06:84:23:6F:33:C0:6D:56:46:80:52:47:12:F1:C3:7F:AC:BB:51:95:7A:87:D3:6C:29:8E:8F:C7:94"}}},"request":{"raw":"GET /up/25/42/bdgy.png HTTP/1.1\r\nHost: zupimages.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://maprim.duckdns.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 301 Moved Permanently\r\ndate: Fri, 15 May 2026 07:04:05 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nlocation: https://www.zupimages.net/up/25/42/bdgy.png\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mffxSQTBNf7E5RPYcfl3zuNu2dNgtCqH%2BGVCBM5Xnc2qckE3%2F6dT3YZEVhRtt6Vegz9zpnWQrcWnvBtdJb0bQn%2Fc1im1fjDdZcZ2GNMf3gnLZae%2FNfnDwKxqRz0I0Ue5\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\ncf-ray: 9fc04959783f3181-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":34996,"size_decoded":0,"mime_type":"image/png","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-10T22:57:27.441562Z","times_seen":17826364,"resource_available":true,"data":null}},"time_used":65,"timings":{"blocked":28,"dns":4,"connect":0,"send":0,"wait":4,"receive":0,"ssl":23},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-14","alert":"Sinkholed","trigger":"zupimages.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zupimages.net/up/25/37/j9ui.jpg","fqdn":"zupimages.net","domain":"zupimages.net","tld":"net"},"ip":{"addr":"172.67.134.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://maprim.duckdns.org/Docsign134.html","date":"2026-05-15T07:04:05.334Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zupimages.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 23 Mar 2026 23:41:10 GMT","end":"Mon, 22 Jun 2026 00:38:52 GMT"},"fingerprint":{"sha1":"FE:0D:28:28:DD:89:56:7B:E4:18:E6:38:ED:EF:0C:5A:C4:17:FA:2D","sha256":"62:E4:AB:06:84:23:6F:33:C0:6D:56:46:80:52:47:12:F1:C3:7F:AC:BB:51:95:7A:87:D3:6C:29:8E:8F:C7:94"}}},"request":{"raw":"GET /up/25/37/j9ui.jpg HTTP/1.1\r\nHost: zupimages.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://maprim.duckdns.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 301 Moved Permanently\r\ndate: Fri, 15 May 2026 07:04:05 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nlocation: https://www.zupimages.net/up/25/37/j9ui.jpg\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mlDWClycqf%2FCFtUttnsOgnFHYrmbrkUOkrj%2Bziw9cu4XJkGhl2twfYyTWqXis14jyoXO0VM0yqb%2B5Cm%2FxdD0JY2652hnD9Czvy2ZtR3veZFvqmlvZpDDU9F%2BcXLKeDTb\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\ncf-ray: 9fc04959783b3181-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":31806,"size_decoded":0,"mime_type":"image/jpeg","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-10T22:57:27.441562Z","times_seen":17826364,"resource_available":true,"data":null}},"time_used":60,"timings":{"blocked":24,"dns":4,"connect":3,"send":0,"wait":4,"receive":0,"ssl":20},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-14","alert":"Sinkholed","trigger":"zupimages.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.zupimages.net/up/25/37/iu3q.jpg","fqdn":"www.zupimages.net","domain":"zupimages.net","tld":"net"},"ip":{"addr":"172.67.134.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://maprim.duckdns.org/Docsign134.html","date":"2026-05-15T07:04:05.378Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zupimages.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 23 Mar 2026 23:41:10 GMT","end":"Mon, 22 Jun 2026 00:38:52 GMT"},"fingerprint":{"sha1":"FE:0D:28:28:DD:89:56:7B:E4:18:E6:38:ED:EF:0C:5A:C4:17:FA:2D","sha256":"62:E4:AB:06:84:23:6F:33:C0:6D:56:46:80:52:47:12:F1:C3:7F:AC:BB:51:95:7A:87:D3:6C:29:8E:8F:C7:94"}}},"request":{"raw":"GET /up/25/37/iu3q.jpg HTTP/1.1\r\nHost: www.zupimages.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://maprim.duckdns.org/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 15 May 2026 07:04:05 GMT\r\ncontent-type: image/jpeg\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncontent-disposition: filename=\"iu3q.jpg\"\r\nstrict-transport-security: max-age=15768000\r\nx-xss-protection: 1; mode=block\r\nlast-modified: Fri, 15 May 2026 07:04:05 GMT\r\ncache-control: max-age=2678400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zV6MWwvR1LL%2F6oXexf96TMy1kHQ5uO8FfsSHfLqtnet6JGnoy3ZscafokUU0P5yTmB17bc%2By%2BFo73flfvUmPWLG485rfbQIHDn6PFgJcYH4ARSQot0DNxQ8%2FugtKpF%2BeZuCunw%3D%3D\"}]}\r\ncf-ray: 9fc04959ae88712b-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":14013,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 723x233, components 3","md5":"db0e5f25a0adb3001b729d4ac2949a08","sha1":"54d80f78a84870606e9ae5314f175e0739e4b62c","sha256":"c1fd40c18ebb6855d650a9a107122a9349c9ddd8d6833385308de6e0ee40844f","sha512":"69af680b15d41e6e278cf7251ee079ab311b762bff88caa771fc2db59b593485ddc78702cc0a58366d25e886b430b316c668eddf7ee14fa6227e2ed9e38f99b3","ssdeep":"192:4IgIlS8itvbMLbgwJOzlfVJo0F2yp0Qgg0UA2o5PPSx65TnPxMkVlN:4IgoS8KbMfg3fwyp0fUA2OXSo5TnPqG","tlshash":"8652bf2da20f6117fff67abe50fa2dc6f198f012ab58e7421447fe525cb3a442450476","first_seen":"2026-03-04T07:20:01.278857Z","last_seen":"2026-08-05T15:28:04.198538Z","times_seen":4,"resource_available":false,"data":null}},"time_used":137,"timings":{"blocked":6,"dns":0,"connect":0,"send":0,"wait":129,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-14","alert":"Sinkholed","trigger":"www.zupimages.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.zupimages.net/up/25/37/j9ui.jpg","fqdn":"www.zupimages.net","domain":"zupimages.net","tld":"net"},"ip":{"addr":"172.67.134.122","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://maprim.duckdns.org/Docsign134.html","date":"2026-05-15T07:04:05.381Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zupimages.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 23 Mar 2026 23:41:10 GMT","end":"Mon, 22 Jun 2026 00:38:52 GMT"},"fingerprint":{"sha1":"FE:0D:28:28:DD:89:56:7B:E4:18:E6:38:ED:EF:0C:5A:C4:17:FA:2D","sha256":"62:E4:AB:06:84:23:6F:33:C0:6D:56:46:80:52:47:12:F1:C3:7F:AC:BB:51:95:7A:87:D3:6C:29:8E:8F:C7:94"}}},"request":{"raw":"GET /up/25/37/j9ui.jpg HTTP/1.1\r\nHost: www.zupimages.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://maprim.duckdns.org/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 15 May 2026 07:04:05 GMT\r\ncontent-type: image/jpeg\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncontent-disposition: filename=\"j9ui.jpg\"\r\nstrict-transport-security: max-age=15768000\r\nx-xss-protection: 1; mode=block\r\nlast-modified: Fri, 15 May 2026 07:04:05 GMT\r\ncache-control: max-age=2678400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=OS3XhQcqGpgqA05xOWKCKLP5AfaoE%2FkkRPHzb6PXOwQGTBH8mKxvKixe0A1lrL6Wr3AQGdMbuNOXC9s%2BRQW3%2BeiF6Btxg18qeFxjC8%2BW0BdliznuhoVtQVCJWJ73f9WYZTqL0Q%3D%3D\"}]}\r\ncf-ray: 9fc04959ae8a712b-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":31806,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 547x365, components 3","md5":"f2e19086e62de07cd2acf7a43f57a009","sha1":"8961f43e864dfc80d923cf986af87c0ced33149d","sha256":"ca6e714ae4302249e3f464a44b5f71dfbc137f68292022fb10a57134820b2e4a","sha512":"219869a65e9e9dba63ef84dbc3cadc1525fb98ea94ffef2088ca86f9f0ef38777dcbbc87fe78e37c2f124d98b317b061ae0ed1923e3a4dabee0e9ebb64524868","ssdeep":"768:ExMeNsENAB0kNh5mW0oOLcUjGZbpkdaW1:UeNPNeoKcUjgbpkIy","tlshash":"07e2e12dbec9510d794deeafe2d2d5156a1ce40c0c0becd6aa8426dc62c03b7d69c0dc","first_seen":"2026-03-04T07:20:01.282631Z","last_seen":"2026-08-05T15:28:04.195913Z","times_seen":4,"resource_available":false,"data":null}},"time_used":144,"timings":{"blocked":2,"dns":0,"connect":0,"send":0,"wait":136,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-14","alert":"Sinkholed","trigger":"www.zupimages.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}}]}