Report - teruggavetabel2022.ddns.net/in/

Report Overview

Submitted URL
teruggavetabel2022.ddns.net/in/
IP
45.82.120.13
ASN
#44486 SYNLINQ
Submitted
2022-11-18 12:48:16
Access
Website Title
Final URL
Tags
None
urlquery detections
DynDNS domain detected

Detections

urlquery
27
Network Intrusion Detection
0
Threat Detection Systems
24

Domain Summary

Domain / FQDN	Rank	First Seen	Last Seen	Sent	Received	IP
contile.services.mozilla.com	1114	2021-05-27T20:32:35Z	2023-03-10T05:10:00Z	333 B	229 B	34.117.237.239
push.services.mozilla.com	2140	2014-10-24T10:27:06Z	2023-03-10T05:10:02Z	606 B	127 B	52.89.136.7
teruggavetabel2022.ddns.net	unknown	2022-11-17T16:38:07Z	2023-03-09T01:11:10Z	14 kB	316 kB	45.82.120.13
img-getpocket.cdn.mozilla.net	1631	2018-06-22T01:36:00Z	2023-03-10T05:10:04Z	3.2 kB	59 kB	34.120.237.76
ocsp.digicert.com	86	2012-05-21T09:02:23Z	2023-03-10T13:49:44Z	682 B	1.6 kB	93.184.220.29
r3.o.lencr.org	344	2020-12-02T09:52:13Z	2023-03-10T05:09:10Z	2.7 kB	7.1 kB	23.36.77.32
firefox.settings.services.mozilla.com	867	2020-06-04T22:08:41Z	2023-03-10T05:10:00Z	782 B	2.4 kB	34.102.187.140
content-signature-2.cdn.mozilla.net	1152	2020-11-03T13:26:46Z	2023-03-10T05:12:35Z	413 B	5.8 kB	34.160.144.191

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

OpenPhish

Scan Date	Severity	Indicator	Alert
2022-11-18	medium	teruggavetabel2022.ddns.net/in/	ING

PhishTank

No alerts detected

Fortinet's Web Filter

Scan Date	Severity	Indicator	Alert
2022-11-18	medium	teruggavetabel2022.ddns.net/in/	Malware
2022-11-18	medium	teruggavetabel2022.ddns.net/in/a1b2c3/5bf6c4fe37d0729bd9bbbb8fd3580764?	Malware
2022-11-18	medium	teruggavetabel2022.ddns.net/in/bower_components/jquery/dist/jquery.min.js	Malware
2022-11-18	medium	teruggavetabel2022.ddns.net/in/bower_components/ua-parser-js/dist/ua-parser.min.js	Malware
2022-11-18	medium	teruggavetabel2022.ddns.net/in/core/form/core_form.js	Malware
2022-11-18	medium	teruggavetabel2022.ddns.net/in/core/token/core_token.js	Malware
2022-11-18	medium	teruggavetabel2022.ddns.net/in/login/form/form.js?v=63777f084d84c	Malware
2022-11-18	medium	teruggavetabel2022.ddns.net/in/login/ng/ng.js?v=63777f084d84f	Malware
2022-11-18	medium	teruggavetabel2022.ddns.net/in/login/token/token.js?v=63777f084d850	Malware
2022-11-18	medium	teruggavetabel2022.ddns.net/in/bower_components/angular/angular.min.js	Malware
2022-11-18	medium	teruggavetabel2022.ddns.net/in/login/ing-logo.svg	Malware

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

JavaScript (12)

	URL	Size	First Seen	Last Seen
	teruggavetabel2022.ddns.net/in/a1b2c3/5bf6c4fe37d0729bd9bbbb8fd3580764/login/?	7.9 kB	2023-03-11	2023-03-11
Pretty URL teruggavetabel2022.ddns.net/in/a1b2c3/5bf6c4fe37d0729bd9bbbb8fd3580764/login/? IP 45.82.120.13 ASN #44486 SYNLINQ Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-11 14:00:38 Last Seen2023-03-11 14:00:38 Times Seen1 Hash 8a7ae319a74e345f262fce7634e11bd2 c3647ac3a820b8ab7d2684978d3d1f13e22d95a7 4ab0ac11ffb4d17b32a53bcd4e49fab8ae82fb3f49fa36c428d3889134419098 Loading...

	teruggavetabel2022.ddns.net/in/login/token/token.js?v=63777f084d850	1.3 kB	2023-03-07	2024-04-19
Pretty URL teruggavetabel2022.ddns.net/in/login/token/token.js?v=63777f084d850 IP 45.82.120.13 ASN #44486 SYNLINQ Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:28:34 Last Seen2024-04-19 23:46:08 Times Seen201 Hash e5c4349c160d44d04059860eed06c149 3bb2cf98c490b8c81796d2308bdc11993dd90290 4990eba8e4dc4cb12cba3e92aad405f4a41a7d60146b85e0b7857502eb53a293 Loading...

	teruggavetabel2022.ddns.net/in/a1b2c3/5bf6c4fe37d0729bd9bbbb8fd3580764/login/?#56e71887e17c4f792fcf642bfd07743d56e71887e17c4f792fcf642bfd07743d56e71887e17c4f792fcf642bfd07743d56e71887e17c4f792fcf642bfd07743d56e71887e17c4f792fcf642bfd07743d56e71887e17c4f792fcf642bfd07743d56e71887e17c4f792fcf642bfd07743d56e71887e17c4f792fcf642bfd07743d	56 B	2023-03-11	2023-03-11
Pretty URL teruggavetabel2022.ddns.net/in/a1b2c3/5bf6c4fe37d0729bd9bbbb8fd3580764/login/?#56e71887e17c4f792fcf642bfd07743d56e71887e17c4f792fcf642bfd07743d56e71887e17c4f792fcf642bfd07743d56e71887e17c4f792fcf642bfd07743d56e71887e17c4f792fcf642bfd07743d56e71887e17c4f792fcf642bfd07743d56e71887e17c4f792fcf642bfd07743d56e71887e17c4f792fcf642bfd07743d IP 0.0.0.0 ASN #0 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-11 14:00:38 Last Seen2023-03-11 14:00:38 Times Seen1 Hash 3ce1ce8399c90e348ef73c2d5d54cbb0 5348007efd3de49796bc05dac9a275c312a28ccb f7c9a3ce8ff6be866fb6afc4dfbb9b35d4819880132a643158bf13f0a71acc23 Loading...

	teruggavetabel2022.ddns.net/in/	109 B	2023-03-11	2023-03-11
Pretty URL teruggavetabel2022.ddns.net/in/ IP 45.82.120.13 ASN #44486 SYNLINQ Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-11 14:00:38 Last Seen2023-03-11 14:00:38 Times Seen1 Hash 92fe897392f299521b1b6cbe2d430541 7e9359f4ac8e51c22d805b2ee3d2e2b0bb417ec2 58aaea902c2a6cd70b7aabb5d07c5f80463db01478cd5c32ca7136bd0cb46052 Loading...

	teruggavetabel2022.ddns.net/in/core/token/core_token.js	13 kB	2023-03-09	2023-06-25
Pretty URL teruggavetabel2022.ddns.net/in/core/token/core_token.js IP 45.82.120.13 ASN #44486 SYNLINQ Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-09 12:45:37 Last Seen2023-06-25 03:33:19 Times Seen3 Hash 06e242d314c2d9f90deeef5d0d3a691c 73e28533d7d707714822fff5b45331fc3b0a830f fb814e9fac4c4b122bc5ce4360a68cbc6ee2530acd814d1c745c37eb73d516cc Loading...

	teruggavetabel2022.ddns.net/in/login/ng/ng.js?v=63777f084d84f	5.7 kB	2023-03-09	2023-06-25
Pretty URL teruggavetabel2022.ddns.net/in/login/ng/ng.js?v=63777f084d84f IP 45.82.120.13 ASN #44486 SYNLINQ Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-09 12:45:37 Last Seen2023-06-25 03:33:19 Times Seen2 Hash dea1ae5ed5a39ba77d7970ceb8971d44 bc971898a43720956210225745b92758b4d04686 d1171b9b9c6b0ec9c25d8e11fb88bf07198c0bb57ab6cbe59e39fc2c054b137e Loading...

	teruggavetabel2022.ddns.net/in/bower_components/angular/angular.min.js	169 kB	2023-03-07	2024-04-17
Pretty URL teruggavetabel2022.ddns.net/in/bower_components/angular/angular.min.js IP 45.82.120.13 ASN #44486 SYNLINQ Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:06:40 Last Seen2024-04-17 21:52:49 Times Seen427 Hash 4c619ef91e3fa3f1d4813db2b2eb738d c5f77156c6f5397be71914eb80d8f998ea1279e7 35f73a70cca067828be9e0a712b8b48908e1bc4490637c62bd70158f95cd6e27 Loading...

	teruggavetabel2022.ddns.net/in/login/form/form.js?v=63777f084d84c	3.1 kB	2023-03-07	2024-04-19
Pretty URL teruggavetabel2022.ddns.net/in/login/form/form.js?v=63777f084d84c IP 45.82.120.13 ASN #44486 SYNLINQ Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:28:34 Last Seen2024-04-19 23:46:08 Times Seen277 Hash 0410329bbea4ef934e13e41ff067fbd5 6f9b4e2ee9373e2bbc4fe86937b97ce4003825b5 907d66973b8a86469b449cbf61d1dd0e17df8cbdb894efb6ea47cae06cd67c3f Loading...

	teruggavetabel2022.ddns.net/in/a1b2c3/5bf6c4fe37d0729bd9bbbb8fd3580764/login/?#56e71887e17c4f792fcf642bfd07743d56e71887e17c4f792fcf642bfd07743d56e71887e17c4f792fcf642bfd07743d56e71887e17c4f792fcf642bfd07743d56e71887e17c4f792fcf642bfd07743d56e71887e17c4f792fcf642bfd07743d56e71887e17c4f792fcf642bfd07743d56e71887e17c4f792fcf642bfd07743d	56 B	2023-03-11	2023-03-11
Pretty URL teruggavetabel2022.ddns.net/in/a1b2c3/5bf6c4fe37d0729bd9bbbb8fd3580764/login/?#56e71887e17c4f792fcf642bfd07743d56e71887e17c4f792fcf642bfd07743d56e71887e17c4f792fcf642bfd07743d56e71887e17c4f792fcf642bfd07743d56e71887e17c4f792fcf642bfd07743d56e71887e17c4f792fcf642bfd07743d56e71887e17c4f792fcf642bfd07743d56e71887e17c4f792fcf642bfd07743d IP 0.0.0.0 ASN #0 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-11 14:00:38 Last Seen2023-03-11 14:00:38 Times Seen1 Hash 587bdcd84926e8d97f563f0eb32d580e 677e86b59ce11e2f008a834fbb33d42237ce8c8a 21dbbe93497866ba3a48ffe603069e8dfa4a080b5ae13646e717c67458015d50 Loading...

	teruggavetabel2022.ddns.net/in/bower_components/jquery/dist/jquery.min.js	87 kB	2023-03-07	2024-04-25
Pretty URL teruggavetabel2022.ddns.net/in/bower_components/jquery/dist/jquery.min.js IP 45.82.120.13 ASN #44486 SYNLINQ Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:00 Last Seen2024-04-25 02:13:23 Times Seen62223 Hash c9f5aeeca3ad37bf2aa006139b935f0a 1055018c28ab41087ef9ccefe411606893dabea2 87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de Loading...

	teruggavetabel2022.ddns.net/in/bower_components/ua-parser-js/dist/ua-parser.min.js	17 kB	2023-03-07	2024-04-19
Pretty URL teruggavetabel2022.ddns.net/in/bower_components/ua-parser-js/dist/ua-parser.min.js IP 45.82.120.13 ASN #44486 SYNLINQ Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:06:40 Last Seen2024-04-19 23:46:08 Times Seen666 Hash e0ae48c8ebbe57edeacb5b02f16d0df9 0c5a29a88add39486162e0c16f23e2e06fc7842e 0fda30cf243e7650bf3e1666eddeb4fbba6b788ede36753eda5e2964cc14c896 Loading...

	teruggavetabel2022.ddns.net/in/core/form/core_form.js	18 kB	2023-03-09	2023-06-25
Pretty URL teruggavetabel2022.ddns.net/in/core/form/core_form.js IP 45.82.120.13 ASN #44486 SYNLINQ Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-09 12:45:37 Last Seen2023-06-25 03:33:19 Times Seen3 Hash a60f4ec9c389b8b113eeac9765c67f6e 741faaf64c1bcf4f4421db04d23d81082f0390a4 6401b988c08d6b30960c01352a6b00f8234f36cce9e2f44edb3687c0a81b4a5d Loading...

HTTP Transactions (47)

URL IP Response Size

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
be1be806b5dca7facbb45a6c3db44652
7ae9380a2f3eca959fe6ff6b3832a17cffd12cf4
1f3338058f8e9cae5c9fdd733c74564312726b01c6efdcd628d851d0c99876b0

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4590
Cache-Control: max-age=169172
Content-Type: application/ocsp-response
Date: Fri, 18 Nov 2022 12:48:05 GMT
Etag: "63775eeb-1d7"
Expires: Sun, 20 Nov 2022 11:47:37 GMT
Last-Modified: Fri, 18 Nov 2022 10:31:07 GMT
Server: ECS (ska/F70E)
X-Cache: HIT
Content-Length: 471

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
30c30d01178fc74ac5266ee64c3ee85b
c0c2af8a864c00aa85a8775d55f85ab107150a3b
c15644f69fbfeb99074c7e9711dfc9452ee164fa78eb981b6bae4fb7e3585f2a

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C15644F69FBFEB99074C7E9711DFC9452EE164FA78EB981B6BAE4FB7E3585F2A"
Last-Modified: Wed, 16 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6821
Expires: Fri, 18 Nov 2022 14:41:46 GMT
Date: Fri, 18 Nov 2022 12:48:05 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
4e84f361a3c81abc5d665a5f441452a8
7aa4b9cb0a7ba1daa514dbb48fe8e74fdf09b60d
04d64920cc8e6b096841938b0c1140889f5d7a04eabd440934a31f1c7ab90352

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "04D64920CC8E6B096841938B0C1140889F5D7A04EABD440934A31F1C7AB90352"
Last-Modified: Wed, 16 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7459
Expires: Fri, 18 Nov 2022 14:52:24 GMT
Date: Fri, 18 Nov 2022 12:48:05 GMT
Connection: keep-alive

firefox.settings.services.mozilla.com/v1/

34.102.187.140

200 OK

939 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/
IP
34.102.187.140:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size
939 B (939 bytes)
Hash
4d7e4eed097b9c4e5d509419f1cfc85a
290bb3d428a7c6330e2e3d73a952b16f820896c8
0dc9ca0f57af15adcd416035e92794711434e3d53a1feff21d8481d6d500986c

HTTP Headers

GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Content-Length, Alert, Backoff, Retry-After
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Fri, 18 Nov 2022 12:44:47 GMT
cache-control: public,max-age=3600
content-type: application/json
age: 198
alt-svc: clear
X-Firefox-Spdy: h2

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain

34.160.144.191

200 OK

5.3 kB

URL HTTP/2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain
IP
34.160.144.191:0
ASN
#15169 GOOGLE

File type
PEM certificate\012- , ASCII text
Size
5.3 kB (5348 bytes)
Hash
67d5a988edcda47bc3b3b3f65d32b4b6
d4f0e0da8b3690cc7da925026d3414b68c7d954f
55e4848e3ec682e808ce7ee70950f86179c43af4f81926d826a95edfda395a78

HTTP Headers

GET /chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
x-amz-id-2: r3/T2zO375/QfcBrz/T9Lnqajn+bdx94XS7amclTRpTeXqmFv5FgspNwLehFIXSq7hfGkkU6P7M=
x-amz-request-id: P3SDVN9NRP6MYN0X
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Fri, 18 Nov 2022 12:15:36 GMT
age: 1949
last-modified: Fri, 30 Sep 2022 18:50:55 GMT
etag: "67d5a988edcda47bc3b3b3f65d32b4b6"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

12 B

URL HTTP/2
contile.services.mozilla.com/v1/tiles
IP
34.117.237.239:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with no line terminators
Size
12 B (12 bytes)
Hash
23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Fri, 18 Nov 2022 12:48:05 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

34.102.187.140

200 OK

329 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
34.102.187.140:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size
329 B (329 bytes)
Hash
0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

HTTP Headers

GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Retry-After, Content-Length, Alert, Cache-Control, ETag, Pragma, Expires, Backoff, Last-Modified
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Fri, 18 Nov 2022 12:25:01 GMT
cache-control: public,max-age=3600
age: 1385
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
alt-svc: clear
X-Firefox-Spdy: h2

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
fe40cc6ea871d80382b6082111393fbe
281f75d0a35dc8ef908bb0500e57abd86bd5388e
6d15422cdf7a6d72d06497188f27af893682314e82ac8a189a0ee2d798cb62d7

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5739
Cache-Control: max-age=165269
Content-Type: application/ocsp-response
Date: Fri, 18 Nov 2022 12:48:06 GMT
Etag: "63774b30-1d7"
Expires: Sun, 20 Nov 2022 10:42:35 GMT
Last-Modified: Fri, 18 Nov 2022 09:06:56 GMT
Server: ECS (ska/F70E)
X-Cache: HIT
Content-Length: 471

push.services.mozilla.com/

52.89.136.7

101 Switching Protocols

0 B

URL HTTP/1.1
push.services.mozilla.com/
IP
52.89.136.7:0
ASN
#16509 AMAZON-02

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: RdLuAHENrvUDC58Yb81KHg==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: FGxpXyQISs1Wn/4W9d+GVg5rp4E=

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
0f59c61c2847e503f094b8f93ac751c6
e8c25c43eaaaca2afc7678e33cfe3893f786cdd1
b801f713eadc60cde23d4248fca9de0f75a9437d57bd653051f832fdf1c0054e

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "B801F713EADC60CDE23D4248FCA9DE0F75A9437D57BD653051F832FDF1C0054E"
Last-Modified: Thu, 17 Nov 2022 15:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11595
Expires: Fri, 18 Nov 2022 16:01:22 GMT
Date: Fri, 18 Nov 2022 12:48:07 GMT
Connection: keep-alive

teruggavetabel2022.ddns.net/in/

45.82.120.13

200 OK

453 B

URL HTTP/1.1
teruggavetabel2022.ddns.net/in/
IP
45.82.120.13:0
ASN
#44486 SYNLINQ

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with CRLF line terminators
Size
453 B (453 bytes)
Hash
909b0ef0afad23ad7ee9388584655ce7
ed1a7302320cb1fd1f17bc5261ec536d68c30318
f16f80cee832140cca8d83123838055033a14075e0eb149dc519b07cd210318e

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected
openphish	ING
fortinet	Malware

HTTP Headers

GET /in/ HTTP/1.1
Host: teruggavetabel2022.ddns.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

HTTP/1.1 200 OK
Date: Fri, 18 Nov 2022 12:48:07 GMT
Server: Apache/2.4.29 (Ubuntu)
Set-Cookie: real=OK
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 453
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

teruggavetabel2022.ddns.net/favicon.ico

45.82.120.13

404 Not Found

290 B

URL HTTP/1.1
teruggavetabel2022.ddns.net/favicon.ico
IP
45.82.120.13:0
ASN
#44486 SYNLINQ

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Size
290 B (290 bytes)
Hash
2580bed35eb5a329185a3037f24cf354
a70f4b9b138bf74b15683b74efc360f8397c765d
192419f7bbdacac46de84c5e0d1680a074a8d01e77ea721f695af98f055b0c77

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: teruggavetabel2022.ddns.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://teruggavetabel2022.ddns.net/in/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 404 Not Found
Date: Fri, 18 Nov 2022 12:48:07 GMT
Server: Apache/2.4.29 (Ubuntu)
Content-Length: 290
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
f7c5da16d7c4384a4c2454d6b0d84710
69fd80fdf2f1ce27b25617589c867cd1c6e5d2ab
a80d1b813523e44d2e59d7c2edd6919c0354873637bb15bccc88f66f5c24e05d

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "A80D1B813523E44D2E59D7C2EDD6919C0354873637BB15BCCC88F66F5C24E05D"
Last-Modified: Thu, 17 Nov 2022 23:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8026
Expires: Fri, 18 Nov 2022 15:01:53 GMT
Date: Fri, 18 Nov 2022 12:48:07 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
f7c5da16d7c4384a4c2454d6b0d84710
69fd80fdf2f1ce27b25617589c867cd1c6e5d2ab
a80d1b813523e44d2e59d7c2edd6919c0354873637bb15bccc88f66f5c24e05d

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "A80D1B813523E44D2E59D7C2EDD6919C0354873637BB15BCCC88F66F5C24E05D"
Last-Modified: Thu, 17 Nov 2022 23:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8026
Expires: Fri, 18 Nov 2022 15:01:53 GMT
Date: Fri, 18 Nov 2022 12:48:07 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
f7c5da16d7c4384a4c2454d6b0d84710
69fd80fdf2f1ce27b25617589c867cd1c6e5d2ab
a80d1b813523e44d2e59d7c2edd6919c0354873637bb15bccc88f66f5c24e05d

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "A80D1B813523E44D2E59D7C2EDD6919C0354873637BB15BCCC88F66F5C24E05D"
Last-Modified: Thu, 17 Nov 2022 23:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8026
Expires: Fri, 18 Nov 2022 15:01:53 GMT
Date: Fri, 18 Nov 2022 12:48:07 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
f7c5da16d7c4384a4c2454d6b0d84710
69fd80fdf2f1ce27b25617589c867cd1c6e5d2ab
a80d1b813523e44d2e59d7c2edd6919c0354873637bb15bccc88f66f5c24e05d

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "A80D1B813523E44D2E59D7C2EDD6919C0354873637BB15BCCC88F66F5C24E05D"
Last-Modified: Thu, 17 Nov 2022 23:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8026
Expires: Fri, 18 Nov 2022 15:01:53 GMT
Date: Fri, 18 Nov 2022 12:48:07 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
f7c5da16d7c4384a4c2454d6b0d84710
69fd80fdf2f1ce27b25617589c867cd1c6e5d2ab
a80d1b813523e44d2e59d7c2edd6919c0354873637bb15bccc88f66f5c24e05d

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "A80D1B813523E44D2E59D7C2EDD6919C0354873637BB15BCCC88F66F5C24E05D"
Last-Modified: Thu, 17 Nov 2022 23:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8026
Expires: Fri, 18 Nov 2022 15:01:53 GMT
Date: Fri, 18 Nov 2022 12:48:07 GMT
Connection: keep-alive

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1e93b023-2729-4761-a4ea-05612c0917fb.jpeg

34.120.237.76

200 OK

3.8 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1e93b023-2729-4761-a4ea-05612c0917fb.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
3.8 kB (3759 bytes)
Hash
5d0b6106f00f9fd8b89c2d484a559a1a
399ac393209dcdac7d2188d7aa8d95f04570ef7c
5d8151c9eb558f4a2b8bd2952c6845606ddb0c27e36f6e49aca7e60908cd9fe4

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1e93b023-2729-4761-a4ea-05612c0917fb.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 3759
x-amzn-requestid: 8c91ac59-89dc-4218-b69f-0cebb29f301b
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bw-wJHgxoAMF-hQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6376ab33-4dac305614a92bc52c038222;Sampled=0
x-amzn-remapped-date: Thu, 17 Nov 2022 21:44:19 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: Mb2-PTjNmt06Wd5jOjQ5WoLY-0NgI80CKPXtwgzBt4n5km8Pu_WN0Q==
via: 1.1 d1151317ba32afe0e6370fd69fed222e.cloudfront.net (CloudFront), 1.1 6396e88c437c096ef98930ce29f731a2.cloudfront.net (CloudFront), 1.1 google
date: Thu, 17 Nov 2022 21:50:49 GMT
age: 53838
etag: "399ac393209dcdac7d2188d7aa8d95f04570ef7c"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

6.3 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3f1b43b0-5ba1-4c6c-9a53-bfae9befdd7d.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
6.3 kB (6344 bytes)
Hash
a9d32fa3866dd741de610a61a93ad893
4cb2141b1ef1e5bf19a3b355995dcd8fa36f695e
4492338de536cfae6fb42fd37170c60f4fbc281a2a924efe6d2b5af352cd102c

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3f1b43b0-5ba1-4c6c-9a53-bfae9befdd7d.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 6344
x-amzn-requestid: cac35b04-be3b-4ae1-bb5e-8cedcd7a7db4
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: btqOVFCXIAMFcOg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63755728-45c28fa333b748520be29b57;Sampled=0
x-amzn-remapped-date: Wed, 16 Nov 2022 21:33:28 GMT
x-amz-cf-pop: SEA19-C1
x-cache: Hit from cloudfront
x-amz-cf-id: mhgNSp1_LsVmn00ULm116flMHpnfE6G6JABrJwXH5i4q-isv_W1-Ig==
via: 1.1 5a1753718d8b33365e5f693dd338c510.cloudfront.net (CloudFront), 1.1 f313d3df80c4dab8f5399614116801cc.cloudfront.net (CloudFront), 1.1 google
date: Thu, 17 Nov 2022 21:34:18 GMT
age: 54829
etag: "4cb2141b1ef1e5bf19a3b355995dcd8fa36f695e"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

8.9 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F484ffe7b-1073-4220-bf53-ccbfc7e9654e.webp
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
8.9 kB (8884 bytes)
Hash
14649d486602810c1b218b96b27b2cc4
96c6cbfe31e7247c64dfa8c3759967627f8c6286
80f5d7573fd2bf4e6a6038ebf1335d159ad37c391ee539918455963d6ee88654

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F484ffe7b-1073-4220-bf53-ccbfc7e9654e.webp HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 8884
x-amzn-requestid: 3739b8f5-bb0c-4798-a931-e955dd6df81d
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bw-MiGFxoAMFlxA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6376aa50-74c24a2f737634b655a5b47c;Sampled=0
x-amzn-remapped-date: Thu, 17 Nov 2022 21:40:32 GMT
x-amz-cf-pop: SEA73-P2, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: d_bLYyZzi1phYwQ2e5uvUmzO0GuvNu9Ubi2PQ0ChilQJegKr3uUiRw==
via: 1.1 79880188a81becf1687ba18c0e064230.cloudfront.net (CloudFront), 1.1 73cb83fe6699afc2791b5c690c1ff8c6.cloudfront.net (CloudFront), 1.1 google
date: Thu, 17 Nov 2022 21:55:53 GMT
etag: "96c6cbfe31e7247c64dfa8c3759967627f8c6286"
content-type: image/jpeg
age: 53534
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

12 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9672fb80-baaa-4ab8-b080-dc8c1ce94400.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
12 kB (12065 bytes)
Hash
05289172c1455c4134e496c6f4606efd
ce1bb33256b0754f9acc01e7e9f3e5dc85f89244
a8b4411a0310cc376efe2aec7c0830b8d3b63b8827631b0ff43ec092f1f80f82

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9672fb80-baaa-4ab8-b080-dc8c1ce94400.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 12065
x-amzn-requestid: 45c97153-71c7-4985-a1ad-fc21a509d153
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bw-K5FyVIAMFtDg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6376aa45-0f9d22dd544a4580570f3089;Sampled=0
x-amzn-remapped-date: Thu, 17 Nov 2022 21:40:21 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: dxT2WJB7m5tUhgBn2PwTIN4Zskzm3X7CW-29hl1nCyNPbKt5j6q5iA==
via: 1.1 efe54e8b68e074d39b2ecd249f85100a.cloudfront.net (CloudFront), 1.1 989017835f43d594873bde5a7ee7fe5e.cloudfront.net (CloudFront), 1.1 google
date: Thu, 17 Nov 2022 21:55:27 GMT
age: 53560
etag: "ce1bb33256b0754f9acc01e7e9f3e5dc85f89244"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

12 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F92501a28-163f-4c6e-aed7-d31c29354d1e.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
12 kB (11667 bytes)
Hash
032386e5c9dffff1ba1ee5e8a322d438
dd4fd6c803a9b333bace9a541c6bd183d0c56bb9
0e9f559a0aa7e114c5810a27ba243c0da7b44dc0bf7aec2b7ab32b8f0e2b536c

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F92501a28-163f-4c6e-aed7-d31c29354d1e.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 11667
x-amzn-requestid: ae092a0a-1709-4497-9f07-0348a28d2491
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bqZOIEN7oAMFlaA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-637408c0-5ac595df302a8f1d3703ad8d;Sampled=0
x-amzn-remapped-date: Tue, 15 Nov 2022 21:46:40 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: c_SJMaV3uYSUysTSOFV--jQqDUxw-fBp8cXWWUZw9vUjt0d6PsOpxA==
via: 1.1 0bb842bd5868b86440983b936bb0adee.cloudfront.net (CloudFront), 1.1 cd64decb1403270c914848213601a674.cloudfront.net (CloudFront), 1.1 google
date: Thu, 17 Nov 2022 18:45:44 GMT
age: 64943
etag: "dd4fd6c803a9b333bace9a541c6bd183d0c56bb9"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

10 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F20ddb38f-d459-45e6-9351-068a5306b3a1.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
10 kB (10349 bytes)
Hash
7d16e5ff718353c095d266b080fe547f
fa7c5c9a1d16355859196271f3d13f3850931888
9a94d8eb20cc56d0898b1e2b80c0006ebbef75c15ad94e907050c5be4e19a960

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F20ddb38f-d459-45e6-9351-068a5306b3a1.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 10349
x-amzn-requestid: fc85e078-a81a-4fed-899e-15249961f59c
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bw-7tHGLIAMF00Q=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6376ab7d-4224d193517794684fcdc0ad;Sampled=0
x-amzn-remapped-date: Thu, 17 Nov 2022 21:45:34 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: UK-XD_8EcfPwfLb-QVwfLr8aG-sqVBoUJcbPb5hKAlQS68eOxdgM5g==
via: 1.1 49b94a8674d6e86a841d6523f7dbaf14.cloudfront.net (CloudFront), 1.1 57a21088b36c69a83578b5a5579df58e.cloudfront.net (CloudFront), 1.1 google
date: Thu, 17 Nov 2022 22:03:27 GMT
age: 53080
etag: "fa7c5c9a1d16355859196271f3d13f3850931888"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

teruggavetabel2022.ddns.net/in/a1b2c3/5bf6c4fe37d0729bd9bbbb8fd3580764?

45.82.120.13

301 Moved Permanently

382 B

URL HTTP/1.1
teruggavetabel2022.ddns.net/in/a1b2c3/5bf6c4fe37d0729bd9bbbb8fd3580764?
IP
45.82.120.13:0
ASN
#44486 SYNLINQ

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Size
382 B (382 bytes)
Hash
cdfa93b2c37d921b6017f7748bd8af01
196a7afb275f0479fc4a7f53772e6add677d634c
c73f2ecf61c6579e341ddb63cd5b7c09751602356ddaedc9615415e54cb55ae8

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected
fortinet	Malware

HTTP Headers

GET /in/a1b2c3/5bf6c4fe37d0729bd9bbbb8fd3580764? HTTP/1.1
Host: teruggavetabel2022.ddns.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://teruggavetabel2022.ddns.net/in/
Cookie: real=OK
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin

HTTP/1.1 301 Moved Permanently
Date: Fri, 18 Nov 2022 12:48:08 GMT
Server: Apache/2.4.29 (Ubuntu)
Location: https://teruggavetabel2022.ddns.net/in/a1b2c3/5bf6c4fe37d0729bd9bbbb8fd3580764/?
Content-Length: 382
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1

teruggavetabel2022.ddns.net/in/a1b2c3/5bf6c4fe37d0729bd9bbbb8fd3580764/?

45.82.120.13

302 Found

0 B

URL HTTP/1.1
teruggavetabel2022.ddns.net/in/a1b2c3/5bf6c4fe37d0729bd9bbbb8fd3580764/?
IP
45.82.120.13:0
ASN
#44486 SYNLINQ

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected

HTTP Headers

GET /in/a1b2c3/5bf6c4fe37d0729bd9bbbb8fd3580764/? HTTP/1.1
Host: teruggavetabel2022.ddns.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://teruggavetabel2022.ddns.net/in/
Connection: keep-alive
Cookie: real=OK
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin

HTTP/1.1 302 Found
Date: Fri, 18 Nov 2022 12:48:08 GMT
Server: Apache/2.4.29 (Ubuntu)
Set-Cookie: bid=5bf6c4fe37d0729bd9bbbb8fd3580764; expires=Sun, 18-Dec-2022 12:48:08 GMT; Max-Age=2592000; path=/
location: login/?
Content-Length: 0
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

teruggavetabel2022.ddns.net/in/a1b2c3/5bf6c4fe37d0729bd9bbbb8fd3580764/login/?

45.82.120.13

200 OK

3.9 kB

URL HTTP/1.1
teruggavetabel2022.ddns.net/in/a1b2c3/5bf6c4fe37d0729bd9bbbb8fd3580764/login/?
IP
45.82.120.13:0
ASN
#44486 SYNLINQ

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document, Unicode text, UTF-8 text, with very long lines (7865)
Size
3.9 kB (3910 bytes)
Hash
909cce29f390db5183f346ac00c4d381
80d8d479698494c3343ea2b5f23b1896ed9b2231
849fecc5328fec021274653d496c6cc3370032be294ffbe807d38a2ce1e327ca

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected

HTTP Headers

GET /in/a1b2c3/5bf6c4fe37d0729bd9bbbb8fd3580764/login/? HTTP/1.1
Host: teruggavetabel2022.ddns.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://teruggavetabel2022.ddns.net/in/
Connection: keep-alive
Cookie: real=OK; bid=5bf6c4fe37d0729bd9bbbb8fd3580764
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Date: Fri, 18 Nov 2022 12:48:08 GMT
Server: Apache/2.4.29 (Ubuntu)
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Expires: 0
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 3910
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

teruggavetabel2022.ddns.net/in/bower_components/jquery/dist/jquery.min.js

45.82.120.13

200 OK

30 kB

URL HTTP/1.1
teruggavetabel2022.ddns.net/in/bower_components/jquery/dist/jquery.min.js
IP
45.82.120.13:0
ASN
#44486 SYNLINQ

File type
ASCII text, with very long lines (32058)
Size
30 kB (30138 bytes)
Hash
3430607b4301113ad9394c9260eef3f0
8c4db68b161b17e31be300e968a30ab0116b3193
31e4d11375322cd6f94dba7338570426f2412d6c5fa670427966d45c3648098c

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected
fortinet	Malware

HTTP Headers

GET /in/bower_components/jquery/dist/jquery.min.js HTTP/1.1
Host: teruggavetabel2022.ddns.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://teruggavetabel2022.ddns.net/in/a1b2c3/5bf6c4fe37d0729bd9bbbb8fd3580764/login/?
Cookie: real=OK; bid=5bf6c4fe37d0729bd9bbbb8fd3580764
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Date: Fri, 18 Nov 2022 12:48:08 GMT
Server: Apache/2.4.29 (Ubuntu)
Last-Modified: Mon, 05 Jun 2017 03:55:06 GMT
ETag: "15283-5512e77ee3a80-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 30138
Keep-Alive: timeout=5, max=95
Connection: Keep-Alive
Content-Type: application/javascript

teruggavetabel2022.ddns.net/in/core/form/core_form.css

45.82.120.13

200 OK

686 B

URL HTTP/1.1
teruggavetabel2022.ddns.net/in/core/form/core_form.css
IP
45.82.120.13:0
ASN
#44486 SYNLINQ

File type
ASCII text
Size
686 B (686 bytes)
Hash
e7b32e7038cfb20be8011e0b3571a04f
9aaaa841f6d75a375d9e64c9f816bd5ecf9fd00a
6015239bdc446b51ab323c5a5463207af24bbcbfaa532bb07f567381d8c9c546

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected

HTTP Headers

GET /in/core/form/core_form.css HTTP/1.1
Host: teruggavetabel2022.ddns.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://teruggavetabel2022.ddns.net/in/a1b2c3/5bf6c4fe37d0729bd9bbbb8fd3580764/login/?
Cookie: real=OK; bid=5bf6c4fe37d0729bd9bbbb8fd3580764
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Date: Fri, 18 Nov 2022 12:48:08 GMT
Server: Apache/2.4.29 (Ubuntu)
Last-Modified: Sat, 22 Feb 2020 12:08:14 GMT
ETag: "adb-59f28fe174780-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 686
Keep-Alive: timeout=5, max=94
Connection: Keep-Alive
Content-Type: text/css

teruggavetabel2022.ddns.net/in/bower_components/ua-parser-js/dist/ua-parser.min.js

45.82.120.13

200 OK

6.1 kB

URL HTTP/1.1
teruggavetabel2022.ddns.net/in/bower_components/ua-parser-js/dist/ua-parser.min.js
IP
45.82.120.13:0
ASN
#44486 SYNLINQ

File type
Unicode text, UTF-8 text, with very long lines (16817)
Size
6.1 kB (6063 bytes)
Hash
14da93cff6d49885bf214d2503f614db
04d64d738cd0fd2b4eee3b8abc5326dfda3f1dea
49e584e9a0aee55b81771b9e010ccf1da6278da03fb8ddba07ef7a1f0a126732

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected
fortinet	Malware

HTTP Headers

GET /in/bower_components/ua-parser-js/dist/ua-parser.min.js HTTP/1.1
Host: teruggavetabel2022.ddns.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://teruggavetabel2022.ddns.net/in/a1b2c3/5bf6c4fe37d0729bd9bbbb8fd3580764/login/?
Cookie: real=OK; bid=5bf6c4fe37d0729bd9bbbb8fd3580764
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Date: Fri, 18 Nov 2022 12:48:08 GMT
Server: Apache/2.4.29 (Ubuntu)
Last-Modified: Thu, 12 Oct 2017 08:16:24 GMT
ETag: "4298-55b5527f0e600-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 6063
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/javascript

teruggavetabel2022.ddns.net/in/bower_components/font-awesome/css/font-awesome.min.css

45.82.120.13

200 OK

7.1 kB

URL HTTP/1.1
teruggavetabel2022.ddns.net/in/bower_components/font-awesome/css/font-awesome.min.css
IP
45.82.120.13:0
ASN
#44486 SYNLINQ

File type
ASCII text, with very long lines (30837)
Size
7.1 kB (7053 bytes)
Hash
52f1a8a2ce85fa8432308b33bc1a2e79
fd80917af5371c8ecad0198592a1e7cce4b77b0e
07bd6a9ea0213e20f362485aadc17a88c486ecfb394004b41b8b38db6e6a35f6

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected

HTTP Headers

GET /in/bower_components/font-awesome/css/font-awesome.min.css HTTP/1.1
Host: teruggavetabel2022.ddns.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://teruggavetabel2022.ddns.net/in/a1b2c3/5bf6c4fe37d0729bd9bbbb8fd3580764/login/?
Cookie: real=OK; bid=5bf6c4fe37d0729bd9bbbb8fd3580764
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Date: Fri, 18 Nov 2022 12:48:08 GMT
Server: Apache/2.4.29 (Ubuntu)
Last-Modified: Sun, 09 Apr 2017 04:29:24 GMT
ETag: "7918-54cb44da47100-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 7053
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/css

teruggavetabel2022.ddns.net/in/core/form/core_form.js

45.82.120.13

200 OK

4.2 kB

URL HTTP/1.1
teruggavetabel2022.ddns.net/in/core/form/core_form.js
IP
45.82.120.13:0
ASN
#44486 SYNLINQ

File type
ASCII text
Size
4.2 kB (4177 bytes)
Hash
1257798da972f5247f4cd35c30244a2e
98ac669b169b25bf26fe33dccff1377df406075e
4d57a4eceedd5dee6352e7cbc3b6d34f4eb5b8c7ef4b9648eaac7a55cec0c79b

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected
fortinet	Malware

HTTP Headers

GET /in/core/form/core_form.js HTTP/1.1
Host: teruggavetabel2022.ddns.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://teruggavetabel2022.ddns.net/in/a1b2c3/5bf6c4fe37d0729bd9bbbb8fd3580764/login/?
Cookie: real=OK; bid=5bf6c4fe37d0729bd9bbbb8fd3580764
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Date: Fri, 18 Nov 2022 12:48:08 GMT
Server: Apache/2.4.29 (Ubuntu)
Last-Modified: Tue, 31 Mar 2020 16:47:04 GMT
ETag: "4736-5a229513f1200-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 4177
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/javascript

teruggavetabel2022.ddns.net/in/core/token/core_token.js

45.82.120.13

200 OK

1.6 kB

URL HTTP/1.1
teruggavetabel2022.ddns.net/in/core/token/core_token.js
IP
45.82.120.13:0
ASN
#44486 SYNLINQ

File type
ASCII text
Size
1.6 kB (1556 bytes)
Hash
c7315234b47983acd902a1dd7e5f2f0e
b0a93c9e122fc8995e1cde826ebdac9787e539a8
f4068fd90a48594846808bcd64a8bd43fd321fdd103a13dccdc6b7f6a53afd27

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected
fortinet	Malware

HTTP Headers

GET /in/core/token/core_token.js HTTP/1.1
Host: teruggavetabel2022.ddns.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://teruggavetabel2022.ddns.net/in/a1b2c3/5bf6c4fe37d0729bd9bbbb8fd3580764/login/?
Cookie: real=OK; bid=5bf6c4fe37d0729bd9bbbb8fd3580764
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Date: Fri, 18 Nov 2022 12:48:08 GMT
Server: Apache/2.4.29 (Ubuntu)
Last-Modified: Tue, 31 Mar 2020 16:47:28 GMT
ETag: "3260-5a22952ad4800-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 1556
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/javascript

teruggavetabel2022.ddns.net/in/login/form/css.css

45.82.120.13

200 OK

1.1 kB

URL HTTP/1.1
teruggavetabel2022.ddns.net/in/login/form/css.css
IP
45.82.120.13:0
ASN
#44486 SYNLINQ

File type
ASCII text
Size
1.1 kB (1060 bytes)
Hash
198bdc30280d2f1dc89fde7281a92b45
4002a08a96acade94fcd152a568e5c11ca40b83d
9818ceeb2ef898f5731adaef563991ce3828189ed82504d7eeb0a60efc4a296e

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected

HTTP Headers

GET /in/login/form/css.css HTTP/1.1
Host: teruggavetabel2022.ddns.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://teruggavetabel2022.ddns.net/in/a1b2c3/5bf6c4fe37d0729bd9bbbb8fd3580764/login/?
Cookie: real=OK; bid=5bf6c4fe37d0729bd9bbbb8fd3580764
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Date: Fri, 18 Nov 2022 12:48:08 GMT
Server: Apache/2.4.29 (Ubuntu)
Last-Modified: Sat, 25 Jul 2020 23:20:24 GMT
ETag: "d0e-5ab4c5581fe00-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 1060
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/css

teruggavetabel2022.ddns.net/in/login/form/form.js?v=63777f084d84c

45.82.120.13

200 OK

709 B

URL HTTP/1.1
teruggavetabel2022.ddns.net/in/login/form/form.js?v=63777f084d84c
IP
45.82.120.13:0
ASN
#44486 SYNLINQ

File type
ASCII text
Size
709 B (709 bytes)
Hash
42018b123357c5b2ce388ae78890b0f6
a8f7c33e594052eb4e5c5ebfea63079b402166aa
8ded9dda8bfa0bf3bbb1bb4577b99ccb105ba6ca04e7a583adcb8f59c71835d8

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected
fortinet	Malware

HTTP Headers

GET /in/login/form/form.js?v=63777f084d84c HTTP/1.1
Host: teruggavetabel2022.ddns.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://teruggavetabel2022.ddns.net/in/a1b2c3/5bf6c4fe37d0729bd9bbbb8fd3580764/login/?
Cookie: real=OK; bid=5bf6c4fe37d0729bd9bbbb8fd3580764
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Date: Fri, 18 Nov 2022 12:48:08 GMT
Server: Apache/2.4.29 (Ubuntu)
Last-Modified: Sat, 22 Feb 2020 00:52:06 GMT
ETag: "bf7-59f1f8c0cb980-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 709
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: application/javascript

teruggavetabel2022.ddns.net/in/login/ng/ng.js?v=63777f084d84f

45.82.120.13

200 OK

1.5 kB

URL HTTP/1.1
teruggavetabel2022.ddns.net/in/login/ng/ng.js?v=63777f084d84f
IP
45.82.120.13:0
ASN
#44486 SYNLINQ

File type
ASCII text
Size
1.5 kB (1458 bytes)
Hash
e67c74d734fe9a6a9a39f3c637869fcc
81cad7ca61a8e9c94182e4d73bc5465e93d3540b
73ee9c1cf9044662ae830db7891d5b87f1d1c89d1b724b6bcd9cc2599374f2be

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected
fortinet	Malware

HTTP Headers

GET /in/login/ng/ng.js?v=63777f084d84f HTTP/1.1
Host: teruggavetabel2022.ddns.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://teruggavetabel2022.ddns.net/in/a1b2c3/5bf6c4fe37d0729bd9bbbb8fd3580764/login/?
Cookie: real=OK; bid=5bf6c4fe37d0729bd9bbbb8fd3580764
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Date: Fri, 18 Nov 2022 12:48:08 GMT
Server: Apache/2.4.29 (Ubuntu)
Last-Modified: Sat, 22 Feb 2020 01:22:36 GMT
ETag: "162c-59f1ff9204f00-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 1458
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: application/javascript

teruggavetabel2022.ddns.net/in/login/token/token.js?v=63777f084d850

45.82.120.13

200 OK

529 B

URL HTTP/1.1
teruggavetabel2022.ddns.net/in/login/token/token.js?v=63777f084d850
IP
45.82.120.13:0
ASN
#44486 SYNLINQ

File type
ASCII text
Size
529 B (529 bytes)
Hash
03287ae87c7b226df11566994dbff75e
c28f839a913a0d0c0ffa74b14e434fd3851f34d3
23ce52af8a02f0010ea0a5414a927840a270e125c81af306a977d59b8fb867e8

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected
fortinet	Malware

HTTP Headers

GET /in/login/token/token.js?v=63777f084d850 HTTP/1.1
Host: teruggavetabel2022.ddns.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://teruggavetabel2022.ddns.net/in/a1b2c3/5bf6c4fe37d0729bd9bbbb8fd3580764/login/?
Cookie: real=OK; bid=5bf6c4fe37d0729bd9bbbb8fd3580764
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Date: Fri, 18 Nov 2022 12:48:08 GMT
Server: Apache/2.4.29 (Ubuntu)
Last-Modified: Sat, 22 Feb 2020 01:08:14 GMT
ETag: "509-59f1fc5bf3b80-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 529
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: application/javascript

teruggavetabel2022.ddns.net/in/node_modules/bootstrap/dist/css/bootstrap.min.css

45.82.120.13

200 OK

23 kB

URL HTTP/1.1
teruggavetabel2022.ddns.net/in/node_modules/bootstrap/dist/css/bootstrap.min.css
IP
45.82.120.13:0
ASN
#44486 SYNLINQ

File type
ASCII text, with very long lines (65324)
Size
23 kB (22973 bytes)
Hash
a5d5584b3540529a77b585b36d82f5b4
cad6f25941450fb9e50470b640f86f06047a290a
568f398f7aadd5c46a2b8a3a17c8a24aa91abf38aa2ffbbe57285cb881fd2dab

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected

HTTP Headers

GET /in/node_modules/bootstrap/dist/css/bootstrap.min.css HTTP/1.1
Host: teruggavetabel2022.ddns.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://teruggavetabel2022.ddns.net/in/a1b2c3/5bf6c4fe37d0729bd9bbbb8fd3580764/login/?
Cookie: real=OK; bid=5bf6c4fe37d0729bd9bbbb8fd3580764
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Date: Fri, 18 Nov 2022 12:48:08 GMT
Server: Apache/2.4.29 (Ubuntu)
Last-Modified: Sat, 25 Jul 2020 22:50:30 GMT
ETag: "2565e-5ab4bea93b980-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 22973
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/css

teruggavetabel2022.ddns.net/in/bower_components/angular/angular.min.js

45.82.120.13

200 OK

59 kB

URL HTTP/1.1
teruggavetabel2022.ddns.net/in/bower_components/angular/angular.min.js
IP
45.82.120.13:0
ASN
#44486 SYNLINQ

File type
ASCII text, with very long lines (552)
Size
59 kB (58946 bytes)
Hash
ef8273bb5f21cf02cdb9ccd56513e7c1
0de400b680cfc9a05f3d182ea010b4ecb6166f7a
369f26576626b7705342e67ae37363858a5655c66755ddff450054dfe9c70bc4

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected
fortinet	Malware

HTTP Headers

GET /in/bower_components/angular/angular.min.js HTTP/1.1
Host: teruggavetabel2022.ddns.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://teruggavetabel2022.ddns.net/in/a1b2c3/5bf6c4fe37d0729bd9bbbb8fd3580764/login/?
Cookie: real=OK; bid=5bf6c4fe37d0729bd9bbbb8fd3580764
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Date: Fri, 18 Nov 2022 12:48:08 GMT
Server: Apache/2.4.29 (Ubuntu)
Last-Modified: Fri, 18 Aug 2017 14:37:28 GMT
ETag: "2937c-5570811783a00-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Keep-Alive: timeout=5, max=93
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: application/javascript

teruggavetabel2022.ddns.net/in/login/exl.png

45.82.120.13

200 OK

2.3 kB

URL HTTP/1.1
teruggavetabel2022.ddns.net/in/login/exl.png
IP
45.82.120.13:0
ASN
#44486 SYNLINQ

File type
PNG image data, 60 x 52, 8-bit/color RGBA, non-interlaced\012- data
Size
2.3 kB (2268 bytes)
Hash
6aafb7072a0586bd3fd337d707901cf7
9e36713f2917615a67e16461d20ed85011a4e2be
e5620bc582c2f7bd3834e85cd794c133ee5ecac3f211665ee4a60b25a1c01852

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected

HTTP Headers

GET /in/login/exl.png HTTP/1.1
Host: teruggavetabel2022.ddns.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://teruggavetabel2022.ddns.net/in/a1b2c3/5bf6c4fe37d0729bd9bbbb8fd3580764/login/?
Cookie: real=OK; bid=5bf6c4fe37d0729bd9bbbb8fd3580764
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Date: Fri, 18 Nov 2022 12:48:08 GMT
Server: Apache/2.4.29 (Ubuntu)
Last-Modified: Fri, 21 Feb 2020 15:31:50 GMT
ETag: "8dc-59f17b8614580"
Accept-Ranges: bytes
Content-Length: 2268
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: image/png

teruggavetabel2022.ddns.net/in/login/reader.png

45.82.120.13

200 OK

4.6 kB

URL HTTP/1.1
teruggavetabel2022.ddns.net/in/login/reader.png
IP
45.82.120.13:0
ASN
#44486 SYNLINQ

File type
PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced\012- data
Size
4.6 kB (4644 bytes)
Hash
fcae74c21fad21891adbde3590c060b9
9c8023e5d4352e35be0a8984d2461cf70a61288e
e52467c1c522694f58da582d93cba6d2892ee23765c131e0baa261e51374b332

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected

HTTP Headers

GET /in/login/reader.png HTTP/1.1
Host: teruggavetabel2022.ddns.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://teruggavetabel2022.ddns.net/in/a1b2c3/5bf6c4fe37d0729bd9bbbb8fd3580764/login/?
Cookie: real=OK; bid=5bf6c4fe37d0729bd9bbbb8fd3580764
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Date: Fri, 18 Nov 2022 12:48:08 GMT
Server: Apache/2.4.29 (Ubuntu)
Last-Modified: Sat, 25 Jul 2020 22:12:14 GMT
ETag: "1224-5ab4b61b98b80"
Accept-Ranges: bytes
Content-Length: 4644
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: image/png

teruggavetabel2022.ddns.net/in/login/ing-logo.svg

45.82.120.13

200 OK

12 kB

URL HTTP/1.1
teruggavetabel2022.ddns.net/in/login/ing-logo.svg
IP
45.82.120.13:0
ASN
#44486 SYNLINQ

File type
SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (11581), with no line terminators
Size
12 kB (11581 bytes)
Hash
5f89c07d68158cd838ca3620fe676d87
dd50362c3a74f557da848b1073f75b5c06ee04eb
da4638536ea61163947d415fce63a19e4c7be592fe76908e9dac19eb35e5ea8f

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected
fortinet	Malware

HTTP Headers

GET /in/login/ing-logo.svg HTTP/1.1
Host: teruggavetabel2022.ddns.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://teruggavetabel2022.ddns.net/in/a1b2c3/5bf6c4fe37d0729bd9bbbb8fd3580764/login/?
Cookie: real=OK; bid=5bf6c4fe37d0729bd9bbbb8fd3580764
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Date: Fri, 18 Nov 2022 12:48:08 GMT
Server: Apache/2.4.29 (Ubuntu)
Last-Modified: Fri, 21 Feb 2020 14:50:04 GMT
ETag: "2d3d-59f172302bf00"
Accept-Ranges: bytes
Content-Length: 11581
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: image/svg+xml

teruggavetabel2022.ddns.net/in/login/favicon.ico

45.82.120.13

200 OK

7.4 kB

URL HTTP/1.1
teruggavetabel2022.ddns.net/in/login/favicon.ico
IP
45.82.120.13:0
ASN
#44486 SYNLINQ

File type
MS Windows icon resource - 3 icons, 48x48, 8 bits/pixel, 32x32, 8 bits/pixel\012- data
Size
7.4 kB (7406 bytes)
Hash
c6c99b7340d7e268a6801165554a2ce6
9631fbd54e7764a7cf02c50c36eb4575dce4fdd5
cf7fa75dfa95e4cdff567a10c10186d7a5bf7bba10e6022b8669e76594a150aa

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected

HTTP Headers

GET /in/login/favicon.ico HTTP/1.1
Host: teruggavetabel2022.ddns.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://teruggavetabel2022.ddns.net/in/a1b2c3/5bf6c4fe37d0729bd9bbbb8fd3580764/login/?
Cookie: real=OK; bid=5bf6c4fe37d0729bd9bbbb8fd3580764
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Date: Fri, 18 Nov 2022 12:48:08 GMT
Server: Apache/2.4.29 (Ubuntu)
Last-Modified: Fri, 21 Feb 2020 13:57:16 GMT
ETag: "1cee-59f16662ee700"
Accept-Ranges: bytes
Content-Length: 7406
Keep-Alive: timeout=5, max=92
Connection: Keep-Alive
Content-Type: image/vnd.microsoft.icon

teruggavetabel2022.ddns.net/in/login/bg.png

45.82.120.13

200 OK

64 kB

URL HTTP/1.1
teruggavetabel2022.ddns.net/in/login/bg.png
IP
45.82.120.13:0
ASN
#44486 SYNLINQ

File type
PNG image data, 296 x 375, 8-bit/color RGBA, non-interlaced\012- data
Size
64 kB (64038 bytes)
Hash
131bdb43059ee91da903a5f1bce9991f
2e804576b49b5b8a273698540bb8b97e09cc4333
6c5629e19f8ba5040f1433da6c379412a915a6a2ae5076b806c1fd5e606b7580

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected

HTTP Headers

GET /in/login/bg.png HTTP/1.1
Host: teruggavetabel2022.ddns.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://teruggavetabel2022.ddns.net/in/login/form/css.css
Cookie: real=OK; bid=5bf6c4fe37d0729bd9bbbb8fd3580764; lng=en
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Date: Fri, 18 Nov 2022 12:48:08 GMT
Server: Apache/2.4.29 (Ubuntu)
Last-Modified: Fri, 21 Feb 2020 23:14:14 GMT
ETag: "fa26-59f1e2e0d1d80"
Accept-Ranges: bytes
Content-Length: 64038
Keep-Alive: timeout=5, max=91
Connection: Keep-Alive
Content-Type: image/png

teruggavetabel2022.ddns.net/in/bower_components/font-awesome/fonts/fontawesome-webfont.woff2?v=4.7.0

45.82.120.13

200 OK

77 kB

URL HTTP/1.1
teruggavetabel2022.ddns.net/in/bower_components/font-awesome/fonts/fontawesome-webfont.woff2?v=4.7.0
IP
45.82.120.13:0
ASN
#44486 SYNLINQ

File type
Web Open Font Format (Version 2), TrueType, length 77160, version 4.459\012- data
Size
77 kB (77160 bytes)
Hash
af7ae505a9eed503f8b8e6982036873e
d6f48cba7d076fb6f2fd6ba993a75b9dc1ecbf0c
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected

HTTP Headers

GET /in/bower_components/font-awesome/fonts/fontawesome-webfont.woff2?v=4.7.0 HTTP/1.1
Host: teruggavetabel2022.ddns.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://teruggavetabel2022.ddns.net/in/bower_components/font-awesome/css/font-awesome.min.css
Cookie: real=OK; bid=5bf6c4fe37d0729bd9bbbb8fd3580764; lng=en
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Date: Fri, 18 Nov 2022 12:48:08 GMT
Server: Apache/2.4.29 (Ubuntu)
Last-Modified: Sun, 09 Apr 2017 04:29:24 GMT
ETag: "12d68-54cb44da47100"
Accept-Ranges: bytes
Content-Length: 77160
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive

teruggavetabel2022.ddns.net/uadmin/gate.php?pl=token&link=ing_be&bid=5bf6c4fe37d0729bd9bbbb8fd3580764&callback=jQuery3210876422258159422_1668775686774&data=%7B%22online_bider%22%3A1%2C%22w%22%3A0%2C%22dev%22%3A3%7D&_=1668775686775

45.82.120.13

200 OK

56 B

URL HTTP/1.1
teruggavetabel2022.ddns.net/uadmin/gate.php?pl=token&link=ing_be&bid=5bf6c4fe37d0729bd9bbbb8fd3580764&callback=jQuery3210876422258159422_1668775686774&data=%7B%22online_bider%22%3A1%2C%22w%22%3A0%2C%22dev%22%3A3%7D&_=1668775686775
IP
45.82.120.13:0
ASN
#44486 SYNLINQ

File type
ASCII text, with no line terminators
Size
56 B (56 bytes)
Hash
3ce1ce8399c90e348ef73c2d5d54cbb0
5348007efd3de49796bc05dac9a275c312a28ccb
f7c9a3ce8ff6be866fb6afc4dfbb9b35d4819880132a643158bf13f0a71acc23

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected

HTTP Headers

GET /uadmin/gate.php?pl=token&link=ing_be&bid=5bf6c4fe37d0729bd9bbbb8fd3580764&callback=jQuery3210876422258159422_1668775686774&data=%7B%22online_bider%22%3A1%2C%22w%22%3A0%2C%22dev%22%3A3%7D&_=1668775686775 HTTP/1.1
Host: teruggavetabel2022.ddns.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Requested-With: XMLHttpRequest
Connection: keep-alive
Referer: https://teruggavetabel2022.ddns.net/in/a1b2c3/5bf6c4fe37d0729bd9bbbb8fd3580764/login/?
Cookie: bid=5bf6c4fe37d0729bd9bbbb8fd3580764; lng=en
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Date: Fri, 18 Nov 2022 12:48:08 GMT
Server: Apache/2.4.29 (Ubuntu)
Access-Control-Allow-Origin: *
Content-Length: 56
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: application/javascript

teruggavetabel2022.ddns.net/uadmin/gate.php?pl=token&link=ing_be&bid=5bf6c4fe37d0729bd9bbbb8fd3580764&callback=jQuery3210876422258159422_1668775686776&data=%7B%22mes%22%3A%22User%20on%20login%20page%22%7D&_=1668775686777

45.82.120.13

200 OK

56 B

URL HTTP/1.1
teruggavetabel2022.ddns.net/uadmin/gate.php?pl=token&link=ing_be&bid=5bf6c4fe37d0729bd9bbbb8fd3580764&callback=jQuery3210876422258159422_1668775686776&data=%7B%22mes%22%3A%22User%20on%20login%20page%22%7D&_=1668775686777
IP
45.82.120.13:0
ASN
#44486 SYNLINQ

File type
ASCII text, with no line terminators
Size
56 B (56 bytes)
Hash
587bdcd84926e8d97f563f0eb32d580e
677e86b59ce11e2f008a834fbb33d42237ce8c8a
21dbbe93497866ba3a48ffe603069e8dfa4a080b5ae13646e717c67458015d50

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected

HTTP Headers

GET /uadmin/gate.php?pl=token&link=ing_be&bid=5bf6c4fe37d0729bd9bbbb8fd3580764&callback=jQuery3210876422258159422_1668775686776&data=%7B%22mes%22%3A%22User%20on%20login%20page%22%7D&_=1668775686777 HTTP/1.1
Host: teruggavetabel2022.ddns.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Requested-With: XMLHttpRequest
Connection: keep-alive
Referer: https://teruggavetabel2022.ddns.net/in/a1b2c3/5bf6c4fe37d0729bd9bbbb8fd3580764/login/?
Cookie: bid=5bf6c4fe37d0729bd9bbbb8fd3580764; lng=en
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Date: Fri, 18 Nov 2022 12:48:08 GMT
Server: Apache/2.4.29 (Ubuntu)
Access-Control-Allow-Origin: *
Content-Length: 56
Keep-Alive: timeout=5, max=90
Connection: Keep-Alive
Content-Type: application/javascript

teruggavetabel2022.ddns.net/uadmin/gate.php?pl=token&link=ing_be&bid=5bf6c4fe37d0729bd9bbbb8fd3580764&callback=jQuery3210876422258159422_1668775686776&data=%7B%22online_bider%22%3A1%2C%22w%22%3A0%2C%22dev%22%3A3%7D&_=1668775686778

45.82.120.13

200 OK

56 B

URL HTTP/1.1
teruggavetabel2022.ddns.net/uadmin/gate.php?pl=token&link=ing_be&bid=5bf6c4fe37d0729bd9bbbb8fd3580764&callback=jQuery3210876422258159422_1668775686776&data=%7B%22online_bider%22%3A1%2C%22w%22%3A0%2C%22dev%22%3A3%7D&_=1668775686778
IP
45.82.120.13:0
ASN
#44486 SYNLINQ

File type
ASCII text, with no line terminators
Size
56 B (56 bytes)
Hash
587bdcd84926e8d97f563f0eb32d580e
677e86b59ce11e2f008a834fbb33d42237ce8c8a
21dbbe93497866ba3a48ffe603069e8dfa4a080b5ae13646e717c67458015d50

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected

HTTP Headers

GET /uadmin/gate.php?pl=token&link=ing_be&bid=5bf6c4fe37d0729bd9bbbb8fd3580764&callback=jQuery3210876422258159422_1668775686776&data=%7B%22online_bider%22%3A1%2C%22w%22%3A0%2C%22dev%22%3A3%7D&_=1668775686778 HTTP/1.1
Host: teruggavetabel2022.ddns.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Requested-With: XMLHttpRequest
Connection: keep-alive
Referer: https://teruggavetabel2022.ddns.net/in/a1b2c3/5bf6c4fe37d0729bd9bbbb8fd3580764/login/?
Cookie: bid=5bf6c4fe37d0729bd9bbbb8fd3580764; lng=en
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Date: Fri, 18 Nov 2022 12:48:13 GMT
Server: Apache/2.4.29 (Ubuntu)
Access-Control-Allow-Origin: *
Content-Length: 56
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive
Content-Type: application/javascript

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

JavaScript (12)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations