Report - ihkgpjvgdy.duckdns.org/step2.html

Report Overview

Submitted URL
ihkgpjvgdy.duckdns.org/step2.html
IP
212.103.61.97
ASN
#35913 DEDIPATH-LLC
Submitted
2022-10-05 17:05:15
Access
Website Title
Final URL
Tags
None
urlquery detections
DynDNS domain detected

Detections

urlquery
16
Network Intrusion Detection
0
Threat Detection Systems
68

Domain Summary

Domain / FQDN	Rank	First Seen	Last Seen	Sent	Received	IP
www.nta.go.jp	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	407 B	30 kB	54.230.111.62
content-signature-2.cdn.mozilla.net	1152	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	401 B	5.8 kB	34.160.144.191
contile.services.mozilla.com	1114	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	321 B	229 B	34.117.237.239
ihkgpjvgdy.duckdns.org	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	6.4 kB	67 kB	212.103.61.97
ocsp.digicert.com	86	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	329 B	737 B	93.184.220.29
push.services.mozilla.com	2140	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	594 B	127 B	35.160.51.228
ocsp.globalsign.com	2075	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	347 B	1.9 kB	104.18.20.226
img-getpocket.cdn.mozilla.net	1631	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	2.6 kB	44 kB	34.120.237.76
firefox.settings.services.mozilla.com	867	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	758 B	2.7 kB	54.230.111.65
r3.o.lencr.org	344	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	2.9 kB	8.0 kB	23.36.77.32

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

OpenPhish

Scan Date	Severity	Indicator	Alert
2022-09-23	medium	ihkgpjvgdy.duckdns.org/	National Tax Agency JAPAN
2022-09-23	medium	ihkgpjvgdy.duckdns.org/	National Tax Agency JAPAN
2022-09-23	medium	ihkgpjvgdy.duckdns.org/	National Tax Agency JAPAN
2022-09-23	medium	ihkgpjvgdy.duckdns.org/	National Tax Agency JAPAN
2022-09-23	medium	ihkgpjvgdy.duckdns.org/	National Tax Agency JAPAN
2022-09-23	medium	ihkgpjvgdy.duckdns.org/	National Tax Agency JAPAN
2022-09-23	medium	ihkgpjvgdy.duckdns.org/	National Tax Agency JAPAN
2022-09-23	medium	ihkgpjvgdy.duckdns.org/	National Tax Agency JAPAN
2022-09-23	medium	ihkgpjvgdy.duckdns.org/	National Tax Agency JAPAN
2022-09-23	medium	ihkgpjvgdy.duckdns.org/	National Tax Agency JAPAN
2022-09-23	medium	ihkgpjvgdy.duckdns.org/	National Tax Agency JAPAN
2022-09-23	medium	ihkgpjvgdy.duckdns.org/	National Tax Agency JAPAN
2022-10-04	medium	ihkgpjvgdy.duckdns.org/step2.html	National Tax Agency JAPAN
2022-09-23	medium	ihkgpjvgdy.duckdns.org/	National Tax Agency JAPAN
2022-09-23	medium	ihkgpjvgdy.duckdns.org/	National Tax Agency JAPAN

PhishTank

No alerts detected

Fortinet's Web Filter

Scan Date	Severity	Indicator	Alert
2022-10-05	medium	ihkgpjvgdy.duckdns.org/static/au_order/vcard.jpeg	Phishing
2022-10-05	medium	ihkgpjvgdy.duckdns.org/static/js/jquery.cookie.js	Phishing
2022-10-05	medium	ihkgpjvgdy.duckdns.org/step2.html	Phishing
2022-10-05	medium	ihkgpjvgdy.duckdns.org/static/js/jquery-3.3.1.min.js	Phishing

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2022-10-05	medium	ihkgpjvgdy.duckdns.org	Sinkholed
2022-10-05	medium	ihkgpjvgdy.duckdns.org	Sinkholed
2022-10-05	medium	ihkgpjvgdy.duckdns.org	Sinkholed
2022-10-05	medium	ihkgpjvgdy.duckdns.org	Sinkholed
2022-10-05	medium	ihkgpjvgdy.duckdns.org	Sinkholed
2022-10-05	medium	ihkgpjvgdy.duckdns.org	Sinkholed
2022-10-05	medium	ihkgpjvgdy.duckdns.org	Sinkholed
2022-10-05	medium	ihkgpjvgdy.duckdns.org	Sinkholed
2022-10-05	medium	ihkgpjvgdy.duckdns.org	Sinkholed
2022-10-05	medium	ihkgpjvgdy.duckdns.org	Sinkholed
2022-10-05	medium	ihkgpjvgdy.duckdns.org	Sinkholed
2022-10-05	medium	ihkgpjvgdy.duckdns.org	Sinkholed
2022-10-05	medium	ihkgpjvgdy.duckdns.org	Sinkholed
2022-10-05	medium	ihkgpjvgdy.duckdns.org	Sinkholed
2022-10-05	medium	ihkgpjvgdy.duckdns.org	Sinkholed

JavaScript (4)

	URL	Size	First Seen	Last Seen
	ihkgpjvgdy.duckdns.org/static/js/jquery-3.3.1.min.js	87 kB	2023-03-07	2024-05-11
Pretty URL ihkgpjvgdy.duckdns.org/static/js/jquery-3.3.1.min.js IP 212.103.61.97 ASN #35913 DEDIPATH-LLC Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:02 Last Seen2024-05-11 03:57:32 Times Seen110624 Hash a09e13ee94d51c524b7e2a728c7d4039 0dc32db4aa9c5f03f3b38c47d883dbd4fed13aae 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef Loading...

	ihkgpjvgdy.duckdns.org/static/js/jquery.cookie.js	3.1 kB	2023-03-07	2024-05-10
Pretty URL ihkgpjvgdy.duckdns.org/static/js/jquery.cookie.js IP 212.103.61.97 ASN #35913 DEDIPATH-LLC Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:06:39 Last Seen2024-05-10 23:11:42 Times Seen9356 Hash d5528dde0006c78be04817327c2f9b6f 31e1bcc4cf805a2c2fee21f48ded1e598f64a2a8 b84161c9fbf7520cd14e7019f92120bd87a928a074156e91a992eba9fc9436e8 Loading...

	ihkgpjvgdy.duckdns.org/step2.html	319 B	2023-03-07	2023-03-08
Pretty URL ihkgpjvgdy.duckdns.org/step2.html IP 212.103.61.97 ASN #35913 DEDIPATH-LLC Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 23:37:31 Last Seen2023-03-08 12:18:23 Times Seen1 Hash 1b05cbef7d07712e76b031b4404b9efc 784daa226ac009211795c4d3d6e3a1bcbee25419 2f05ee0e5f7990d5ba476abf225b699efefb59db26acd69acea6890213ff56bf Loading...

	ihkgpjvgdy.duckdns.org/step2.html	1.7 kB	2023-03-08	2023-03-08
Pretty URL ihkgpjvgdy.duckdns.org/step2.html IP 212.103.61.97 ASN #35913 DEDIPATH-LLC Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-08 06:21:10 Last Seen2023-03-08 06:21:10 Times Seen1 Hash 362677564f4c5e3f71734f1872cd15e8 0bf13d44653bc811898398a5a5bbca8596545609 ecf7c84409e03dd25ba1d96eaec6d9b5459dd599c674d0ab7164cf8d51b4c424 Loading...

HTTP Transactions (37)

URL IP Response Size

firefox.settings.services.mozilla.com/v1/

54.230.111.65

200 OK

939 B

URL HTTP/1.1
firefox.settings.services.mozilla.com/v1/
IP
54.230.111.65:0
ASN
#16509 AMAZON-02

File type
JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size
939 B (939 bytes)
Hash
2d12f67fe57a87e7366b662d153a5582
d7b02d81cc74f24a251d9363e0f4b0a149264ec1
73c273c0b5a2de3cb970b8e8c187999d3b55e760dc7766dab4bb76428d19b551

HTTP Headers

GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 939
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length, Backoff, Content-Type, Retry-After, Alert
Cache-Control: max-age=259200
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Date: Wed, 05 Oct 2022 15:47:18 GMT
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
Via: 1.1 ee04daa979e7a02cc5ca472521bc18a6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: loXIiQMNPDGBPEoMKhM4r23U4Ei8TYuuCYryyAtzWLMl4SwgfmqIeQ==
Age: 4666

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
eabb7d9ffae717f7305d63c057755470
3b7f0baccfdbb8d9ffefa4a2215d4d6094be454a
ab48f17e54075e1ecf034278e82bcacd2e3689773186cc84fba9b79aac907294

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "AB48F17E54075E1ECF034278E82BCACD2E3689773186CC84FBA9B79AAC907294"
Last-Modified: Tue, 04 Oct 2022 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12025
Expires: Wed, 05 Oct 2022 20:25:29 GMT
Date: Wed, 05 Oct 2022 17:05:04 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
4ab7d8709d334de0e46dcb86aabfbff1
f221138a8ad9d0bfa3c054370dcdb363a67dc310
b91d37f606eaf448b9c7dfc05566a11de004ce44503409e1a776288ee2622805

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "B91D37F606EAF448B9C7DFC05566A11DE004CE44503409E1A776288EE2622805"
Last-Modified: Wed, 05 Oct 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14283
Expires: Wed, 05 Oct 2022 21:03:07 GMT
Date: Wed, 05 Oct 2022 17:05:04 GMT
Connection: keep-alive

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain

34.160.144.191

200 OK

5.3 kB

URL HTTP/2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain
IP
34.160.144.191:0
ASN
#15169 GOOGLE

File type
PEM certificate\012- , ASCII text
Size
5.3 kB (5348 bytes)
Hash
67d5a988edcda47bc3b3b3f65d32b4b6
d4f0e0da8b3690cc7da925026d3414b68c7d954f
55e4848e3ec682e808ce7ee70950f86179c43af4f81926d826a95edfda395a78

HTTP Headers

GET /chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
x-amz-id-2: uyZJ2lbm/ryc3pXhM5LtBsEUTdjSQzLBSEl+7zUm/PM6MqaW/cOM74ViNsAyt8Utd7RBWHTJQl0=
x-amz-request-id: HSG476YHDCHJZXHY
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Wed, 05 Oct 2022 16:58:22 GMT
age: 402
last-modified: Fri, 30 Sep 2022 18:50:55 GMT
etag: "67d5a988edcda47bc3b3b3f65d32b4b6"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

12 B

URL HTTP/2
contile.services.mozilla.com/v1/tiles
IP
34.117.237.239:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with no line terminators
Size
12 B (12 bytes)
Hash
23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Wed, 05 Oct 2022 17:05:04 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
d87396919ec00d1c0ba6a8f25c30744f
bf653124f11aa2f43b76ce77cddaaea7fbcb4f8b
f1e8ec4d050661e0a4e931585ca2c5109625e8f8caedfaf17a5648a1a745f825

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "F1E8EC4D050661E0A4E931585CA2C5109625E8F8CAEDFAF17A5648A1A745F825"
Last-Modified: Tue, 04 Oct 2022 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=21600
Expires: Wed, 05 Oct 2022 23:05:04 GMT
Date: Wed, 05 Oct 2022 17:05:04 GMT
Connection: keep-alive

ihkgpjvgdy.duckdns.org/static/gs_vk/reset.css

212.103.61.97

200 OK

884 B

URL HTTP/2
ihkgpjvgdy.duckdns.org/static/gs_vk/reset.css
IP
212.103.61.97:0
ASN
#35913 DEDIPATH-LLC

File type
CSV text\012- , ASCII text, with CRLF line terminators
Size
884 B (884 bytes)
Hash
a77d6f26781539c015b1b1d84dac9c06
6f9e90a2e3c9f2bcb9337e577150bde1d3a29ccb
e0e6a4ef211b0c936b3a38abe91cda1ebbbcc4a3c2d8e706ef7a1dc2c55427c3

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected
openphish	National Tax Agency JAPAN
quad9	Sinkholed

HTTP Headers

GET /static/gs_vk/reset.css HTTP/1.1
Host: ihkgpjvgdy.duckdns.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ihkgpjvgdy.duckdns.org/step2.html
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx
date: Wed, 05 Oct 2022 17:05:05 GMT
content-type: text/css
content-length: 884
last-modified: Tue, 09 Aug 2022 08:07:52 GMT
etag: "62f215d8-374"
expires: Thu, 06 Oct 2022 05:05:05 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2

ihkgpjvgdy.duckdns.org/static/gs_vk/payment.css

212.103.61.97

200 OK

314 B

URL HTTP/2
ihkgpjvgdy.duckdns.org/static/gs_vk/payment.css
IP
212.103.61.97:0
ASN
#35913 DEDIPATH-LLC

File type
ASCII text
Size
314 B (314 bytes)
Hash
46ed104ebad73339bba55438b7208106
9ee20c10996dd6c0168b9ab59340a6b09688292e
d6b2444c90793280c26a9f831d99757781798d302bc14852042338923647b890

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected
openphish	National Tax Agency JAPAN
quad9	Sinkholed

HTTP Headers

GET /static/gs_vk/payment.css HTTP/1.1
Host: ihkgpjvgdy.duckdns.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ihkgpjvgdy.duckdns.org/step2.html
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx
date: Wed, 05 Oct 2022 17:05:05 GMT
content-type: text/css
content-length: 314
last-modified: Tue, 09 Aug 2022 08:08:32 GMT
etag: "62f21600-13a"
expires: Thu, 06 Oct 2022 05:05:05 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

54.230.111.65

200 OK

329 B

URL HTTP/1.1
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
54.230.111.65:0
ASN
#16509 AMAZON-02

File type
JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size
329 B (329 bytes)
Hash
0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

HTTP Headers

GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 329
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Pragma, Content-Length, Backoff, Last-Modified, Cache-Control, Content-Type, Retry-After, ETag, Expires, Alert
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Last-Modified: Fri, 25 Mar 2022 17:45:46 GMT
X-Content-Type-Options: nosniff
Cache-Control: max-age=3600, max-age=3600
Date: Wed, 05 Oct 2022 16:29:33 GMT
Expires: Wed, 05 Oct 2022 16:46:31 GMT
ETag: "1648230346554"
X-Cache: Hit from cloudfront
Via: 1.1 2d5cbe05385a7f3bbffc8a562b8711f6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: KAYF-mgHEWIXEHHbjUxqnXbQpmUFi6GzjvRhC7dcZhgWQPdZEggiRA==
Age: 2132

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
1561c6be7c89d1357a80d12de47b6e74
9a705277922ecca583c867af58b3efce099f83bd
e33dc034dbf4b3b627cd3c1af2d942e2ca5704ec9a4aad5c46ad39eb070e82ab

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 2145
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Wed, 05 Oct 2022 17:05:05 GMT
Last-Modified: Wed, 05 Oct 2022 16:29:20 GMT
Server: ECS (ska/F6FD)
X-Cache: HIT
Content-Length: 471

ihkgpjvgdy.duckdns.org/static/gs_vk/logo.png

212.103.61.97

200 OK

3.0 kB

URL HTTP/2
ihkgpjvgdy.duckdns.org/static/gs_vk/logo.png
IP
212.103.61.97:0
ASN
#35913 DEDIPATH-LLC

File type
PNG image data, 275 x 29, 8-bit/color RGBA, non-interlaced\012- data
Size
3.0 kB (2973 bytes)
Hash
c6d404ecaa7646ff497deaad55392996
1c66c5caf35e3e633d1cb1e09a334362ad11f5fb
bf1532dfb899554f52b0a98c2870c9a6f19e6abaf74288c6de321813fed91666

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected
openphish	National Tax Agency JAPAN
quad9	Sinkholed

HTTP Headers

GET /static/gs_vk/logo.png HTTP/1.1
Host: ihkgpjvgdy.duckdns.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ihkgpjvgdy.duckdns.org/step2.html
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx
date: Wed, 05 Oct 2022 17:05:05 GMT
content-type: image/png
content-length: 2973
last-modified: Tue, 09 Aug 2022 08:07:52 GMT
etag: "62f215d8-b9d"
expires: Fri, 04 Nov 2022 17:05:05 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2

ihkgpjvgdy.duckdns.org/static/au_order/vcard.jpeg

212.103.61.97

200 OK

33 kB

URL HTTP/2
ihkgpjvgdy.duckdns.org/static/au_order/vcard.jpeg
IP
212.103.61.97:0
ASN
#35913 DEDIPATH-LLC

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 485x485, components 3\012- data
Size
33 kB (32796 bytes)
Hash
9d9bea80f7bf8d900c0b172e8c3bc553
8ffd779d3177165fe79bfe08768f577d5466bb30
30ac02f2f32bd6449033baedc40fe40ed9019dcebc63b514fdb6e32dfeba0758

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected
openphish	National Tax Agency JAPAN
fortinet	Phishing
quad9	Sinkholed

HTTP Headers

GET /static/au_order/vcard.jpeg HTTP/1.1
Host: ihkgpjvgdy.duckdns.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ihkgpjvgdy.duckdns.org/step2.html
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx
date: Wed, 05 Oct 2022 17:05:05 GMT
content-type: image/jpeg
content-length: 32796
last-modified: Thu, 17 Mar 2022 06:44:22 GMT
etag: "6232d8c6-801c"
expires: Fri, 04 Nov 2022 17:05:05 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2

ihkgpjvgdy.duckdns.org/static/au_order/fig_cc-01.png

212.103.61.97

200 OK

1.7 kB

URL HTTP/2
ihkgpjvgdy.duckdns.org/static/au_order/fig_cc-01.png
IP
212.103.61.97:0
ASN
#35913 DEDIPATH-LLC

File type
PNG image data, 102 x 24, 8-bit colormap, non-interlaced\012- data
Size
1.7 kB (1741 bytes)
Hash
de11b8799850438173d4fbb88d9f8670
c1d52f71b8501a4aed0892ff0bdb166f47423924
ca12241ddbe5e9e4c018782bfe45123e61348371e32f60d3a5abd2019e1197c9

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected
openphish	National Tax Agency JAPAN
quad9	Sinkholed

HTTP Headers

GET /static/au_order/fig_cc-01.png HTTP/1.1
Host: ihkgpjvgdy.duckdns.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ihkgpjvgdy.duckdns.org/step2.html
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx
date: Wed, 05 Oct 2022 17:05:05 GMT
content-type: image/png
content-length: 1741
last-modified: Wed, 20 Jul 2022 07:54:14 GMT
etag: "62d7b4a6-6cd"
expires: Fri, 04 Nov 2022 17:05:05 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2

ihkgpjvgdy.duckdns.org/static/au_order/icon_seven.png

212.103.61.97

200 OK

2.1 kB

URL HTTP/2
ihkgpjvgdy.duckdns.org/static/au_order/icon_seven.png
IP
212.103.61.97:0
ASN
#35913 DEDIPATH-LLC

File type
PNG image data, 33 x 33, 8-bit/color RGBA, non-interlaced\012- data
Size
2.1 kB (2116 bytes)
Hash
2c0b47b6d78982d38a578c71eb4de310
9b319d1acba2751fd81b4b8c9695ad9d1462c84e
f4c13cfc9310805af5435b0d5f04960dcae82109c7aa89389bd04d8fe5d26896

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected
openphish	National Tax Agency JAPAN
quad9	Sinkholed

HTTP Headers

GET /static/au_order/icon_seven.png HTTP/1.1
Host: ihkgpjvgdy.duckdns.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ihkgpjvgdy.duckdns.org/step2.html
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx
date: Wed, 05 Oct 2022 17:05:05 GMT
content-type: image/png
content-length: 2116
last-modified: Thu, 17 Mar 2022 06:44:18 GMT
etag: "6232d8c2-844"
expires: Fri, 04 Nov 2022 17:05:05 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2

ihkgpjvgdy.duckdns.org/static/au_order/icon_lawson.png

212.103.61.97

200 OK

1.4 kB

URL HTTP/2
ihkgpjvgdy.duckdns.org/static/au_order/icon_lawson.png
IP
212.103.61.97:0
ASN
#35913 DEDIPATH-LLC

File type
PNG image data, 98 x 33, 8-bit colormap, non-interlaced\012- data
Size
1.4 kB (1379 bytes)
Hash
effd82254b0545b83f298b3ba9657542
765f2d9f069ad0490235ce6f850dbf37426d75cf
c1a87c4599f42a2cc86ec8e78d0f6ef3b02a1ecd41a6bff8f1d9050c9490a936

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected
openphish	National Tax Agency JAPAN
quad9	Sinkholed

HTTP Headers

GET /static/au_order/icon_lawson.png HTTP/1.1
Host: ihkgpjvgdy.duckdns.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ihkgpjvgdy.duckdns.org/step2.html
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx
date: Wed, 05 Oct 2022 17:05:05 GMT
content-type: image/png
content-length: 1379
last-modified: Thu, 17 Mar 2022 06:44:18 GMT
etag: "6232d8c2-563"
expires: Fri, 04 Nov 2022 17:05:05 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2

ihkgpjvgdy.duckdns.org/static/au_order/icon_ministop.png

212.103.61.97

200 OK

1.3 kB

URL HTTP/2
ihkgpjvgdy.duckdns.org/static/au_order/icon_ministop.png
IP
212.103.61.97:0
ASN
#35913 DEDIPATH-LLC

File type
PNG image data, 48 x 33, 8-bit colormap, non-interlaced\012- data
Size
1.3 kB (1259 bytes)
Hash
4b30b024eb7e8a81c25e451193794dad
89a3f4f691c2f192cc16fa51f368c89916b96ddc
c46abe457820829f581a15b2b25baa925fc78d6aa7c1989503b47859d0569b6e

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected
openphish	National Tax Agency JAPAN
quad9	Sinkholed

HTTP Headers

GET /static/au_order/icon_ministop.png HTTP/1.1
Host: ihkgpjvgdy.duckdns.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ihkgpjvgdy.duckdns.org/step2.html
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx
date: Wed, 05 Oct 2022 17:05:05 GMT
content-type: image/png
content-length: 1259
last-modified: Thu, 17 Mar 2022 06:44:18 GMT
etag: "6232d8c2-4eb"
expires: Fri, 04 Nov 2022 17:05:05 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2

ihkgpjvgdy.duckdns.org/static/au_order/icon_seicomart.png

212.103.61.97

200 OK

3.5 kB

URL HTTP/2
ihkgpjvgdy.duckdns.org/static/au_order/icon_seicomart.png
IP
212.103.61.97:0
ASN
#35913 DEDIPATH-LLC

File type
PNG image data, 132 x 33, 8-bit/color RGB, non-interlaced\012- data
Size
3.5 kB (3525 bytes)
Hash
d83ece24ee999c79c8cd467b3a45c570
4b431c5a7c9d34581a92f6b92977441cb7546b20
b0baf30a5d52de6372685e6c3935205b7f38433ba114332de655de078c64d8d0

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected
openphish	National Tax Agency JAPAN
quad9	Sinkholed

HTTP Headers

GET /static/au_order/icon_seicomart.png HTTP/1.1
Host: ihkgpjvgdy.duckdns.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ihkgpjvgdy.duckdns.org/step2.html
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx
date: Wed, 05 Oct 2022 17:05:05 GMT
content-type: image/png
content-length: 3525
last-modified: Thu, 17 Mar 2022 06:44:18 GMT
etag: "6232d8c2-dc5"
expires: Fri, 04 Nov 2022 17:05:05 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2

ihkgpjvgdy.duckdns.org/static/au_order/pay-easy_logo.png

212.103.61.97

200 OK

6.3 kB

URL HTTP/2
ihkgpjvgdy.duckdns.org/static/au_order/pay-easy_logo.png
IP
212.103.61.97:0
ASN
#35913 DEDIPATH-LLC

File type
PNG image data, 94 x 70, 8-bit/color RGBA, non-interlaced\012- data
Size
6.3 kB (6283 bytes)
Hash
dc0d30d43624fd17db9d5fc0c1624433
0351f0a7049430bf21c18646e9ad3eb938e2dfee
6b316bfcffb7626a3033f21238e0b93ee714d4f614eae8a0894ad9e7faab99bd

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected
openphish	National Tax Agency JAPAN
quad9	Sinkholed

HTTP Headers

GET /static/au_order/pay-easy_logo.png HTTP/1.1
Host: ihkgpjvgdy.duckdns.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ihkgpjvgdy.duckdns.org/step2.html
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx
date: Wed, 05 Oct 2022 17:05:05 GMT
content-type: image/png
content-length: 6283
last-modified: Thu, 17 Mar 2022 06:44:20 GMT
etag: "6232d8c4-188b"
expires: Fri, 04 Nov 2022 17:05:05 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2

ihkgpjvgdy.duckdns.org/static/gs_vk/syozai_icon.png

212.103.61.97

200 OK

1.3 kB

URL HTTP/2
ihkgpjvgdy.duckdns.org/static/gs_vk/syozai_icon.png
IP
212.103.61.97:0
ASN
#35913 DEDIPATH-LLC

File type
PNG image data, 15 x 24, 8-bit/color RGBA, non-interlaced\012- data
Size
1.3 kB (1297 bytes)
Hash
d038e6e8e4472bbcf6e5dac6a23d5a0e
fce966980cd73b2d732e0081b7e8dc9751db160d
5aa0964ac2cb5cbb5823d166f55495ac12747f3fbf2b56f7d290ac161eb2aead

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected
openphish	National Tax Agency JAPAN
quad9	Sinkholed

HTTP Headers

GET /static/gs_vk/syozai_icon.png HTTP/1.1
Host: ihkgpjvgdy.duckdns.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ihkgpjvgdy.duckdns.org/step2.html
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx
date: Wed, 05 Oct 2022 17:05:05 GMT
content-type: image/png
content-length: 1297
last-modified: Tue, 09 Aug 2022 08:07:52 GMT
etag: "62f215d8-511"
expires: Fri, 04 Nov 2022 17:05:05 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2

push.services.mozilla.com/

35.160.51.228

101 Switching Protocols

0 B

URL HTTP/1.1
push.services.mozilla.com/
IP
35.160.51.228:0
ASN
#16509 AMAZON-02

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: fxglLZeg+4erYRBn8jH0gg==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: onl44Cxui60uusiRmL+8OJuG9DU=

ocsp.globalsign.com/gsrsaovsslca2018

104.18.20.226

200 OK

1.4 kB

URL HTTP/1.1
ocsp.globalsign.com/gsrsaovsslca2018
IP
104.18.20.226:0
ASN
#13335 CLOUDFLARENET

File type
data
Size
1.4 kB (1432 bytes)
Hash
40527bb7327ec5bfbd9c0a0798ae34fc
d7bfbc58a9581d72ed9c7b047fa3ca6b72e41555
08cf156e74edc53c4d8410f55574ca363e7f6542c06931b7cfb17e381b2078a9

HTTP Headers

POST /gsrsaovsslca2018 HTTP/1.1
Host: ocsp.globalsign.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Wed, 05 Oct 2022 17:05:05 GMT
Content-Type: application/ocsp-response
Content-Length: 1432
Connection: keep-alive
Expires: Sun, 09 Oct 2022 15:56:06 GMT
ETag: "d7bfbc58a9581d72ed9c7b047fa3ca6b72e41555"
Last-Modified: Wed, 05 Oct 2022 15:56:07 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: HIT
Age: 2923
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7557bd7abf210b51-OSL

www.nta.go.jp/template/img/template/headerbackground.jpg

54.230.111.62

200 OK

30 kB

URL HTTP/2
www.nta.go.jp/template/img/template/headerbackground.jpg
IP
54.230.111.62:0
ASN
#16509 AMAZON-02

File type
JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 980x113, components 3\012- data
Size
30 kB (29881 bytes)
Hash
e5e2087ec026ba50dceab21313cde200
32528b75731905a34f01e6b4cdf3937f72c4098f
9f7bcb50485acc2487f525f5d0d49bf0e3c239ee0150685a621b7e84d67818c7

HTTP Headers

GET /template/img/template/headerbackground.jpg HTTP/1.1
Host: www.nta.go.jp
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ihkgpjvgdy.duckdns.org/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
content-type: image/jpeg
content-length: 29881
server: Apache
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
last-modified: Fri, 30 Mar 2018 05:48:34 GMT
accept-ranges: bytes
date: Wed, 05 Oct 2022 17:05:05 GMT
etag: "74b9-5689aca6dd080"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 6259d2cd8a5947ad41a420527bbed7a6.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: gxRhKNPCvRzicLml4umaau4iQOsOJIb-GeBb4MBplPDQd3sK5edG5Q==
age: 185
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
f6721b36776c90c1b66ea529be15480c
2f4bc2da72b0cebd5474a034eba65ff42d8de751
34f761e1aba602ce27b240e1e6b038f318cb9a5fb1f4c783ae04c515c023324b

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "34F761E1ABA602CE27B240E1E6B038F318CB9A5FB1F4C783AE04C515C023324B"
Last-Modified: Wed, 05 Oct 2022 10:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=21561
Expires: Wed, 05 Oct 2022 23:04:27 GMT
Date: Wed, 05 Oct 2022 17:05:06 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
55331c1dc7e7ebbf456220986278469d
d69a62ee47b03fde68db666512417dda2ae5ad13
a09c835aa140c7b4220194e940f54de09ca3b7ea470feb7c4c5be574643086d5

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "A09C835AA140C7B4220194E940F54DE09CA3B7EA470FEB7C4C5BE574643086D5"
Last-Modified: Tue, 04 Oct 2022 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3871
Expires: Wed, 05 Oct 2022 18:09:38 GMT
Date: Wed, 05 Oct 2022 17:05:07 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
55331c1dc7e7ebbf456220986278469d
d69a62ee47b03fde68db666512417dda2ae5ad13
a09c835aa140c7b4220194e940f54de09ca3b7ea470feb7c4c5be574643086d5

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "A09C835AA140C7B4220194E940F54DE09CA3B7EA470FEB7C4C5BE574643086D5"
Last-Modified: Tue, 04 Oct 2022 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3871
Expires: Wed, 05 Oct 2022 18:09:38 GMT
Date: Wed, 05 Oct 2022 17:05:07 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
55331c1dc7e7ebbf456220986278469d
d69a62ee47b03fde68db666512417dda2ae5ad13
a09c835aa140c7b4220194e940f54de09ca3b7ea470feb7c4c5be574643086d5

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "A09C835AA140C7B4220194E940F54DE09CA3B7EA470FEB7C4C5BE574643086D5"
Last-Modified: Tue, 04 Oct 2022 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3871
Expires: Wed, 05 Oct 2022 18:09:38 GMT
Date: Wed, 05 Oct 2022 17:05:07 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
55331c1dc7e7ebbf456220986278469d
d69a62ee47b03fde68db666512417dda2ae5ad13
a09c835aa140c7b4220194e940f54de09ca3b7ea470feb7c4c5be574643086d5

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "A09C835AA140C7B4220194E940F54DE09CA3B7EA470FEB7C4C5BE574643086D5"
Last-Modified: Tue, 04 Oct 2022 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3871
Expires: Wed, 05 Oct 2022 18:09:38 GMT
Date: Wed, 05 Oct 2022 17:05:07 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
55331c1dc7e7ebbf456220986278469d
d69a62ee47b03fde68db666512417dda2ae5ad13
a09c835aa140c7b4220194e940f54de09ca3b7ea470feb7c4c5be574643086d5

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "A09C835AA140C7B4220194E940F54DE09CA3B7EA470FEB7C4C5BE574643086D5"
Last-Modified: Tue, 04 Oct 2022 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3871
Expires: Wed, 05 Oct 2022 18:09:38 GMT
Date: Wed, 05 Oct 2022 17:05:07 GMT
Connection: keep-alive

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F78bf691d-76e8-4176-884d-dbc06604dded.jpeg

34.120.237.76

200 OK

8.8 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F78bf691d-76e8-4176-884d-dbc06604dded.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
8.8 kB (8816 bytes)
Hash
100559d746bedd7c3802661c875c35ee
5261a6c2ee6d6cc87e91ee82e32d8be234db393e
ff06f31267ddcc9a0d84ddc68932872bfed29d072783c3a1dd3790d41c280aec

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F78bf691d-76e8-4176-884d-dbc06604dded.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 8816
x-amzn-requestid: b9f3ec8a-f478-4405-b275-e21f2d7d89d4
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZKK7gFPJIAMF-7Q=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6333f1e3-250348e6140f3c74762263ea;Sampled=0
x-amzn-remapped-date: Wed, 28 Sep 2022 07:04:03 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: F1ZWwxLKhRC6oSh6gnUxEm5AnYcY-mezJw9mNJ8GmNWnATAKx1JxSg==
via: 1.1 7f5e0d3b9ea85d0d75063a66c0ebc840.cloudfront.net (CloudFront), 1.1 73cb83fe6699afc2791b5c690c1ff8c6.cloudfront.net (CloudFront), 1.1 google
date: Tue, 04 Oct 2022 22:42:26 GMT
age: 66161
etag: "5261a6c2ee6d6cc87e91ee82e32d8be234db393e"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

7.0 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe8857940-5ca2-44ba-8a66-f396a605d5b4.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
7.0 kB (7021 bytes)
Hash
229c99cfb655a8c9f1a22de69fdff73c
6b5db8fbfb56f083d54b13e7660d0e4bc866aa00
f4099e9153c3dc481add95b0f24dbb8f6d65cc74ad5631d9cb6c6f2a0351843d

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe8857940-5ca2-44ba-8a66-f396a605d5b4.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 7021
x-amzn-requestid: 2e30bdac-360e-4d0a-8bb7-c3144e074abe
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: Zf8ucHb1oAMFjYw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-633ca7f5-18ba6bc50cb32b1e14c882bd;Sampled=0
x-amzn-remapped-date: Tue, 04 Oct 2022 21:39:01 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: Sd2_YDHr3j7ym7wfFyQh9kg8FP-Et2nJUOo1v_TNbI3PvpzEY5KJ2Q==
via: 1.1 efe54e8b68e074d39b2ecd249f85100a.cloudfront.net (CloudFront), 1.1 476c2ba6d9f6cd69dbcedbd65688cbc0.cloudfront.net (CloudFront), 1.1 google
date: Tue, 04 Oct 2022 22:07:19 GMT
age: 68268
etag: "6b5db8fbfb56f083d54b13e7660d0e4bc866aa00"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

ihkgpjvgdy.duckdns.org/static/js/jquery.cookie.js

212.103.61.97

200 OK

7.3 kB

URL HTTP/2
ihkgpjvgdy.duckdns.org/static/js/jquery.cookie.js
IP
212.103.61.97:0
ASN
#35913 DEDIPATH-LLC

File type
data
Size
7.3 kB (7253 bytes)
Hash
018c4599b1d941e5ffd40ec451c77776
3ee2f69166407245109686dc52a2acf6bf7e4730
7fa2e59ddfc03f5e1c34e2919173eab84bc4e8191748f920fd197b350c2c5395

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected
openphish	National Tax Agency JAPAN
fortinet	Phishing
quad9	Sinkholed

HTTP Headers

GET /static/js/jquery.cookie.js HTTP/1.1
Host: ihkgpjvgdy.duckdns.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ihkgpjvgdy.duckdns.org/step2.html
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx
date: Wed, 05 Oct 2022 17:05:05 GMT
content-type: application/javascript
last-modified: Thu, 17 Mar 2022 06:46:10 GMT
vary: Accept-Encoding
etag: W/"6232d932-c31"
expires: Thu, 06 Oct 2022 05:05:05 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
content-encoding: gzip
X-Firefox-Spdy: h2

34.120.237.76

200 OK

8.9 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5704624d-eb81-4a5b-bcb7-08db5681c677.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
8.9 kB (8926 bytes)
Hash
1de7c17a0ba9295135e7f8b490b6a8d3
70e8d1589f3daf71378965dd197934e220fb6aa4
ee559ce3166479e2b930be7d18525f5c2d164aed8ca005302ddaf3bfe37eec24

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5704624d-eb81-4a5b-bcb7-08db5681c677.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 8926
x-amzn-requestid: 27fc8976-af8d-40a3-b701-0642fa135ec4
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: Zf8s1GSbIAMFTiw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-633ca7eb-4d4c7837576e0fdb5828fe3b;Sampled=0
x-amzn-remapped-date: Tue, 04 Oct 2022 21:38:51 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: YzVofPSJC-YVU1Q1V9AnjNeQTa1BQEh6ZiH2HjSeeX5RygysFP7oAA==
via: 1.1 9c60d6224ac0b44e908b5c9dcf70e9a4.cloudfront.net (CloudFront), 1.1 aef00f14752da9aa504d392fd46eff94.cloudfront.net (CloudFront), 1.1 google
date: Tue, 04 Oct 2022 21:42:34 GMT
age: 69753
etag: "70e8d1589f3daf71378965dd197934e220fb6aa4"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

10 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1ca20164-9b52-49c5-9e63-1fc0ae719f45.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
10 kB (10158 bytes)
Hash
4fc2ddd86450d64d3fb659ab4e78be58
bbe71936b78a8c34d03ab87948dc840b35c6948f
84a760397a5912bd05f61bc8a953c13a88a677e2d17fbbf74bdf7d7ff4d3942f

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1ca20164-9b52-49c5-9e63-1fc0ae719f45.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 10158
x-amzn-requestid: def1fc7e-8008-466f-9271-20fa1ab0fa5a
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZaqZCH7doAMFcPQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-633a8aa0-7fd2fb1249366f2277d719d6;Sampled=0
x-amzn-remapped-date: Mon, 03 Oct 2022 07:09:20 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: szhtD9f4RuQaDKXe7LElSR0yOKo9cYa1i2YMeG3eSpBXP8ePcdzQig==
via: 1.1 00f0a41f749793b9dd653153037c957e.cloudfront.net (CloudFront), 1.1 68fadeb91f97256bb67b03bfca74d830.cloudfront.net (CloudFront), 1.1 google
date: Wed, 05 Oct 2022 07:29:32 GMT
age: 34535
etag: "bbe71936b78a8c34d03ab87948dc840b35c6948f"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

3.6 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fbb178720-854c-4c9e-85c1-58cb5419ca69.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
3.6 kB (3585 bytes)
Hash
5d7d7df8d4c440f9db445c3d99e818d6
612b6dbd4ba895c167964ff7e6d9263013b52b0a
bf527a814c78f9e010cce4ba593c9146d54a2137d1f147f7a6250fbad81956ac

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fbb178720-854c-4c9e-85c1-58cb5419ca69.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 3585
x-amzn-requestid: ccb6f0c8-4d9b-48b8-aaf6-16781dc4c86b
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZaHFlEcFoAMFS3g=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-633a5223-5c9276c873efee993ba54667;Sampled=0
x-amzn-remapped-date: Mon, 03 Oct 2022 03:08:19 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: T8m1q2L45TWDVRBa-R2W70yq9BauBK3G4IX54AGIxdRhG736T974kg==
via: 1.1 0aebf3fe433ff96e68d785fad4ea4c0e.cloudfront.net (CloudFront), 1.1 32d624dbeb2a8b7f24dbe49007e37c90.cloudfront.net (CloudFront), 1.1 google
date: Wed, 05 Oct 2022 04:05:29 GMT
age: 46778
etag: "612b6dbd4ba895c167964ff7e6d9263013b52b0a"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

ihkgpjvgdy.duckdns.org/step2.html

212.103.61.97

200 OK

0 B

URL HTTP/2
ihkgpjvgdy.duckdns.org/step2.html
IP
212.103.61.97:0
ASN
#35913 DEDIPATH-LLC

File type

Size
0 B (0 bytes)
Hash

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected
openphish	National Tax Agency JAPAN
fortinet	Phishing
quad9	Sinkholed

HTTP Headers

GET /step2.html HTTP/1.1
Host: ihkgpjvgdy.duckdns.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

HTTP/2 200 OK
server: nginx
date: Wed, 05 Oct 2022 17:05:04 GMT
content-type: text/html
last-modified: Fri, 23 Sep 2022 09:03:05 GMT
vary: Accept-Encoding
etag: W/"632d7649-2abb"
strict-transport-security: max-age=31536000
content-encoding: gzip
X-Firefox-Spdy: h2

ihkgpjvgdy.duckdns.org/static/au_order/new1.css

212.103.61.97

200 OK

0 B

URL HTTP/2
ihkgpjvgdy.duckdns.org/static/au_order/new1.css
IP
212.103.61.97:0
ASN
#35913 DEDIPATH-LLC

File type

Size
0 B (0 bytes)
Hash

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected
openphish	National Tax Agency JAPAN
quad9	Sinkholed

HTTP Headers

GET /static/au_order/new1.css HTTP/1.1
Host: ihkgpjvgdy.duckdns.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ihkgpjvgdy.duckdns.org/step2.html
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx
date: Wed, 05 Oct 2022 17:05:05 GMT
content-type: text/css
last-modified: Wed, 20 Jul 2022 08:12:58 GMT
vary: Accept-Encoding
etag: W/"62d7b90a-11b7"
expires: Thu, 06 Oct 2022 05:05:05 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
content-encoding: gzip
X-Firefox-Spdy: h2

ihkgpjvgdy.duckdns.org/static/js/jquery-3.3.1.min.js

212.103.61.97

200 OK

0 B

URL HTTP/2
ihkgpjvgdy.duckdns.org/static/js/jquery-3.3.1.min.js
IP
212.103.61.97:0
ASN
#35913 DEDIPATH-LLC

File type

Size
0 B (0 bytes)
Hash

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected
openphish	National Tax Agency JAPAN
fortinet	Phishing
quad9	Sinkholed

HTTP Headers

GET /static/js/jquery-3.3.1.min.js HTTP/1.1
Host: ihkgpjvgdy.duckdns.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ihkgpjvgdy.duckdns.org/step2.html
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx
date: Wed, 05 Oct 2022 17:05:05 GMT
content-type: application/javascript
last-modified: Thu, 17 Mar 2022 06:46:10 GMT
vary: Accept-Encoding
etag: W/"6232d932-1538f"
expires: Thu, 06 Oct 2022 05:05:05 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
content-encoding: gzip
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

JavaScript (4)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (37)

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/2

IP

ASN

File type

Size