{"report_id":"6e266439-4b93-4bc9-a013-0a3b107abed1","version":6,"status":"done","tags":["dyndns"],"date":"2026-04-26T13:12:25Z","url":{"schema":"https","addr":"sucursalvrtla.duckdns.org","fqdn":"sucursalvrtla.duckdns.org","domain":"sucursalvrtla.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"18.217.130.149","port":0,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"sucursalvrtla.duckdns.org/login.html","fqdn":"sucursalvrtla.duckdns.org","domain":"sucursalvrtla.duckdns.org","tld":"duckdns.org"},"title":"Sucursal Virtual Personas - Bancolombia","dom":{"size":4548,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"0741d5052f8601348f4ce905e467fd69","sha1":"2318105afc2c3944889ca92b280a84152da95037","sha256":"4ff62c57c062faf82c3ef635dba31f5d9877dd95a018ab7bdb52ae49e4c9a66c","sha512":"91b067a6b32411c7db0c06d3cbf77a679795d9f18debef6915cdca02a0724f86cfbe660ba53c9f34da2069e0f10055224c91eb69dbc381c7f4d99aa92292d5f0","ssdeep":"48:Pup++lzYSpRNJMDJ/CrN+8Uz8H2GHOPBOaNk/+ujpRDsjlEpWj:PuUuzHRNmDhCrAr8WBcaNk2+XYm8j","tlshash":"5a911420a4f58027615b81c86fe2bb3b6e91c943e905445cb2fc0b999fd6dc7cc53968","dom_hash":"domhash9441f809c6a8562153d5948721497410","first_seen":"2026-04-26T13:12:34.285864Z","last_seen":"2026-04-26T13:12:34.285864Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"sucursalvrtla.duckdns.org","fqdn":"sucursalvrtla.duckdns.org","domain":"sucursalvrtla.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"18.217.130.149","port":0,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"tags":null,"meta":null,"user":{"user_id":"akbkyowd9geqr98"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-05-31T13:12:25Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":1,"urlquery":2,"analyzer":3}},"detection":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-04-26T13:12:04Z","timestamp":1777209124,"ip_dst":{"addr":"172.67.74.152","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"Client IP","port":42422,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI","source":"{\"timestamp\":\"2026-04-26T13:12:04.383366+0000\",\"flow_id\":855214142046917,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.9\",\"src_port\":42422,\"dest_ip\":\"172.67.74.152\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2047703,\"rev\":1,\"signature\":\"ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Any\"],\"attack_target\":[\"Client_and_Server\"],\"confidence\":[\"High\"],\"created_at\":[\"2023_08_22\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"reviewed_at\":[\"2023_08_22\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"External_IP_Lookup\"],\"updated_at\":[\"2023_08_22\"]}},\"tls\":{\"sni\":\"api.ipify.org\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":915,\"bytes_toclient\":1654,\"start\":\"2026-04-26T13:12:04.377541+0000\"}}"}],"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-26","alert":"Phishing Block","trigger":"sucursalvrtla.duckdns.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-26","alert":"Sinkholed","trigger":"sucursalvrtla.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-26","alert":"Sinkholed","trigger":"sucursalvrtla.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]},"summary":[{"fqdn":"sucursalvrtla.duckdns.org","ip":{"addr":"18.217.130.149","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"2013-04-12","domain_rank":0,"first_seen":"2026-04-25T20:45:01.143671Z","last_seen":"2026-04-25T20:45:01.143671Z","alert_count":52,"request_count":13,"received_data":299578,"sent_data":6284,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.18.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Socket.io","description":"","website":"https://socket.io","common_platform_enumeration":"","icon":"Socket.io.svg","categories":["JavaScript frameworks"]}]},{"fqdn":"api.ipify.org","ip":{"addr":"172.67.74.152","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2014-01-05","domain_rank":8166,"first_seen":"2014-10-06T12:38:43Z","last_seen":"2026-04-20T12:19:36.258607Z","alert_count":0,"request_count":1,"received_data":269,"sent_data":463,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"sucursalvrtla.duckdns.org/login.html","fqdn":"sucursalvrtla.duckdns.org","domain":"sucursalvrtla.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"18.217.130.149","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"d58a3bfa1b2dcd8c95a21eb9966a4114","sha1":"475b9d696640722560d83c21996f3eecdccb326a","sha256":"20fd143e7747d3893de1fd745b88e24f79283ac856191a2dc61f46c22b426b41","sha512":"719d776248220daaa8b3cbcf4227b6e6a46a8bb9f0fb630f93f21155e402b94b4c1b91da53c2ccf1fc2e126ce7f1ce9fc820b0b31fd69c2cc8019720c670457d","ssdeep":"","tlshash":"54c08ca8032f980030ac1106ef47fb433102883f8100d900f42feb84af38703c0022c3","size":190,"data":"","first_seen":"2026-04-26T02:45:26.170275Z","last_seen":"2026-04-26T13:12:34.320917Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sucursalvrtla.duckdns.org/script_new.js?v=6","fqdn":"sucursalvrtla.duckdns.org","domain":"sucursalvrtla.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"18.217.130.149","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"9fb813101c180ba8285d7efd1a2310af","sha1":"27923f7fdea8701b1aaeab9cdb79515a412ff997","sha256":"ab3750c9b577e89d2bfdcb7668243189709ccf317fec4c2774882b4773db2084","sha512":"fe9b6847d877197384a9d5a23760536c2e96f9850477aae12b18098e36073b34fa6a4a068f8c790fc4fee7e6de75890796b222ba24c195389247fdc90badb461","ssdeep":"96:pelq6jGyB02MNRlHgcPWx0lMaT9ze3tL3CE3XU3pS73CxLHnID:pmZFTMNLHz+kMYK3R3CE3XU3Y73YLHn8","tlshash":"51c17358a2b725386d7364bd47df9206752450033589dc98be2e9b400fc2f94a5e37fa","size":5848,"data":"","first_seen":"2026-04-26T02:45:26.162346Z","last_seen":"2026-04-26T13:12:34.306616Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sucursalvrtla.duckdns.org/shared-optimized.js?v=6","fqdn":"sucursalvrtla.duckdns.org","domain":"sucursalvrtla.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"18.217.130.149","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"10c243963744cf382876893ead7e36cd","sha1":"3c47d98d0b43d9a56c8753bf592a2ef10e2cfcb7","sha256":"9c15ab34c7e81776ce35456a5fa0c68aa7ea5e1d8e51adff84f1fad049568488","sha512":"daf29002edda0e88923c74448beba2bf54bc69ac8fdea935caf48d91a817f3b1beec379eeade87398035772692915cbd50d7787959747415478a330a78f163b9","ssdeep":"","tlshash":"b661ee8d33f632399eb351968b9ba018b12569572064bc587e6c83412f501f9abf2fc4","size":3279,"data":"","first_seen":"2026-04-26T02:45:26.168117Z","last_seen":"2026-04-26T13:12:34.300188Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sucursalvrtla.duckdns.org/js/banco-utils.js?v=6","fqdn":"sucursalvrtla.duckdns.org","domain":"sucursalvrtla.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"18.217.130.149","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"179152f6c68d97c01e6381f59bc3e971","sha1":"5806629733a772c7eb4c2a7b26ec2a9f0e383d21","sha256":"57369cb8a2d063b2c234381289fad8dbd052bc9a47a72d81a50f6bea40b148cc","sha512":"1b5ba946e2458b6a9b513f3af9f69ad907e032560a1acb0bd6209daae13a960c3ffa57864d5b877b2e892b6c5a74747bd004b23d596730f50b04af0d1c1ba936","ssdeep":"192:faWuq8vmfYuWRVI31prWty731FSKM/yGEMUVmv57msN3UcxC:4RoH3LAI3gQo7D3TxC","tlshash":"a8121705b8f31026a2b3a16e0b97a009332551032785da89bf7d47b16f96ba8d3f17dd","size":9472,"data":"","first_seen":"2026-04-26T02:45:26.16131Z","last_seen":"2026-04-26T13:12:34.292511Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sucursalvrtla.duckdns.org/socket.io/socket.io.js","fqdn":"sucursalvrtla.duckdns.org","domain":"sucursalvrtla.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"18.217.130.149","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"ec127053f9c5cbfeeefd263b4b23bc0a","sha1":"11c08d7468ffe8980b0f862280c0c371776938a8","sha256":"bc425714aa8f2547d6939e3721ebafd3830a7562a1f6cb08acc1e794bd707954","sha512":"81ec905226bb2b6632f968b204f873331a4a75f24c0f27d50bb5ea930bec797a7c201eed1eaf1a9ef06cbbe923a722bb54fdcbf2be7147eea00d77a80565a39e","ssdeep":"3072:zLTygH4CO2KsFpWw0axS8RZIXyR7dSGg18FEEaLH32emV/Tfkmh0KbhEGtkSWq:zLTy7X1sFpWw0aTRrgaEEaLH32emV/D5","tlshash":"6ce35f49aaf72051917330398bafa045f239d01b620acd443d1cd7f49f65b3897aafe9","size":155836,"data":"","first_seen":"2026-01-01T23:52:44.961231Z","last_seen":"2026-08-16T15:00:19.836145Z","times_seen":382,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"sucursalvrtla.duckdns.org/socket.io/socket.io.js","fqdn":"sucursalvrtla.duckdns.org","domain":"sucursalvrtla.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"18.217.130.149","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sucursalvrtla.duckdns.org/login.html","date":"2026-04-26T13:12:03.838Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sucursalvrtla.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 24 Apr 2026 19:11:43 GMT","end":"Thu, 23 Jul 2026 19:11:42 GMT"},"fingerprint":{"sha1":"BF:CB:7E:A4:5F:DD:13:05:55:C9:2D:41:F2:4E:2E:46:8B:D8:F0:8F","sha256":"CA:14:B2:A0:96:D4:7F:9F:CA:80:A1:60:10:48:98:33:F7:67:FD:F8:D2:98:F3:C9:BD:41:5E:D4:56:E2:B6:F7"}}},"request":{"raw":"GET /socket.io/socket.io.js HTTP/1.1\r\nHost: sucursalvrtla.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://sucursalvrtla.duckdns.org/login.html\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.18.0 (Ubuntu)\r\nDate: Sun, 26 Apr 2026 13:12:04 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: public, max-age=0\r\nETag: \"4.8.3\"\r\ncontent-encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.18.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":155836,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text","md5":"ec127053f9c5cbfeeefd263b4b23bc0a","sha1":"11c08d7468ffe8980b0f862280c0c371776938a8","sha256":"bc425714aa8f2547d6939e3721ebafd3830a7562a1f6cb08acc1e794bd707954","sha512":"81ec905226bb2b6632f968b204f873331a4a75f24c0f27d50bb5ea930bec797a7c201eed1eaf1a9ef06cbbe923a722bb54fdcbf2be7147eea00d77a80565a39e","ssdeep":"3072:zLTygH4CO2KsFpWw0axS8RZIXyR7dSGg18FEEaLH32emV/Tfkmh0KbhEGtkSWq:zLTy7X1sFpWw0aTRrgaEEaLH32emV/D5","tlshash":"6ce35f49aaf72051917330398bafa045f239d01b620acd443d1cd7f49f65b3897aafe9","first_seen":"2026-01-01T23:52:44.961231Z","last_seen":"2026-08-16T15:00:19.836145Z","times_seen":382,"resource_available":true,"data":null}},"time_used":644,"timings":{"blocked":208,"dns":1,"connect":104,"send":0,"wait":209,"receive":8,"ssl":110},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-26","alert":"Phishing Block","trigger":"sucursalvrtla.duckdns.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-26","alert":"Sinkholed","trigger":"sucursalvrtla.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-26","alert":"Sinkholed","trigger":"sucursalvrtla.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"sucursalvrtla.duckdns.org/img/SFC_NEGRO_1_1.png","fqdn":"sucursalvrtla.duckdns.org","domain":"sucursalvrtla.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"18.217.130.149","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sucursalvrtla.duckdns.org/login.html","date":"2026-04-26T13:12:03.863Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sucursalvrtla.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 24 Apr 2026 19:11:43 GMT","end":"Thu, 23 Jul 2026 19:11:42 GMT"},"fingerprint":{"sha1":"BF:CB:7E:A4:5F:DD:13:05:55:C9:2D:41:F2:4E:2E:46:8B:D8:F0:8F","sha256":"CA:14:B2:A0:96:D4:7F:9F:CA:80:A1:60:10:48:98:33:F7:67:FD:F8:D2:98:F3:C9:BD:41:5E:D4:56:E2:B6:F7"}}},"request":{"raw":"GET /img/SFC_NEGRO_1_1.png HTTP/1.1\r\nHost: sucursalvrtla.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://sucursalvrtla.duckdns.org/login.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.18.0 (Ubuntu)\r\nDate: Sun, 26 Apr 2026 13:12:04 GMT\r\nContent-Type: image/png\r\nContent-Length: 64255\r\nConnection: keep-alive\r\nX-Powered-By: Express\r\nCache-Control: no-store, no-cache, must-revalidate, private\r\nAccept-Ranges: bytes\r\nLast-Modified: Fri, 24 Apr 2026 20:00:30 GMT\r\nETag: W/\"faff-19dc1145d5c\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.18.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":64255,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1284 x 237, 8-bit/color RGBA, non-interlaced","md5":"5a917055968f4a457923a0ee6f8635eb","sha1":"e2a0d857032c21d2242d2a3dde4fcc5fb2163631","sha256":"ed6d9c181ecd1f2554b67d15dbbb514871577614f4d54d2c288ad6855472332d","sha512":"97bbca5a037d60a8ca0b48da41c61878716e4cb7c0362ca437f47b19a2790fb89fedb95f0af29aa78227020c39c086f73c5fa8b8eae946787d625cfba1ce3276","ssdeep":"1536:vMajcU1xuJ4CHZth5J2CObxBNbSgdx5kd1:0Z8xuGk1X8pbfdDc","tlshash":"3753e0434839d921c7606120875b64b13fb9a7b0399838bc13b0a9fb15a16bc9fb7dd9","first_seen":"2026-04-26T02:45:26.164345Z","last_seen":"2026-04-26T13:12:34.289186Z","times_seen":2,"resource_available":false,"data":null}},"time_used":621,"timings":{"blocked":401,"dns":0,"connect":0,"send":0,"wait":112,"receive":108,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-26","alert":"Phishing Block","trigger":"sucursalvrtla.duckdns.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-26","alert":"Sinkholed","trigger":"sucursalvrtla.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-26","alert":"Sinkholed","trigger":"sucursalvrtla.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"wss","addr":"sucursalvrtla.duckdns.org/socket.io/?EIO=4\u0026transport=websocket","fqdn":"sucursalvrtla.duckdns.org","domain":"sucursalvrtla.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"18.217.130.149","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"websocket","requested_by":"https://sucursalvrtla.duckdns.org/login.html","date":"2026-04-26T13:12:04.297Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sucursalvrtla.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 24 Apr 2026 19:11:43 GMT","end":"Thu, 23 Jul 2026 19:11:42 GMT"},"fingerprint":{"sha1":"BF:CB:7E:A4:5F:DD:13:05:55:C9:2D:41:F2:4E:2E:46:8B:D8:F0:8F","sha256":"CA:14:B2:A0:96:D4:7F:9F:CA:80:A1:60:10:48:98:33:F7:67:FD:F8:D2:98:F3:C9:BD:41:5E:D4:56:E2:B6:F7"}}},"request":{"raw":"GET /socket.io/?EIO=4\u0026transport=websocket HTTP/1.1\r\nHost: sucursalvrtla.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nSec-WebSocket-Version: 13\r\nOrigin: https://sucursalvrtla.duckdns.org\r\nSec-WebSocket-Extensions: permessage-deflate\r\nSec-WebSocket-Key: 0QflveFiUe5QOVhYKLLMbw==\r\nDNT: 1\r\nConnection: keep-alive, Upgrade\r\nSec-Fetch-Dest: websocket\r\nSec-Fetch-Mode: websocket\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade: websocket\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 101 Switching Protocols\r\nServer: nginx/1.18.0 (Ubuntu)\r\nDate: Sun, 26 Apr 2026 13:12:04 GMT\r\nConnection: upgrade\r\nUpgrade: websocket\r\nSec-WebSocket-Accept: FWjQho3rg+gml/p57GvnLcVbpTA=\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"101","status_text":"Switching Protocols","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.18.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-16T19:35:55.306911Z","times_seen":17923256,"resource_available":true,"data":null}},"time_used":337,"timings":{"blocked":0,"dns":1,"connect":108,"send":0,"wait":107,"receive":0,"ssl":117},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-26","alert":"Sinkholed","trigger":"sucursalvrtla.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-26","alert":"Sinkholed","trigger":"sucursalvrtla.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-26","alert":"Phishing Block","trigger":"sucursalvrtla.duckdns.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"api.ipify.org/?format=json","fqdn":"api.ipify.org","domain":"ipify.org","tld":"org"},"ip":{"addr":"172.67.74.152","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://sucursalvrtla.duckdns.org/login.html","date":"2026-04-26T13:12:04.376Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ipify.org","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 01 Mar 2026 16:45:18 GMT","end":"Sat, 30 May 2026 17:45:14 GMT"},"fingerprint":{"sha1":"EF:8D:ED:C7:B3:46:8A:91:47:71:92:F2:D9:B0:67:EA:C1:FC:5B:89","sha256":"01:CA:DB:EB:79:61:2D:B3:FE:2B:09:FE:44:84:EA:5B:6E:C1:3B:81:A1:0F:8C:9F:DE:2E:16:1E:59:45:06:D9"}}},"request":{"raw":"GET /?format=json HTTP/1.1\r\nHost: api.ipify.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sucursalvrtla.duckdns.org/\r\nOrigin: https://sucursalvrtla.duckdns.org\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 26 Apr 2026 13:12:04 GMT\r\ncontent-type: application/json\r\ncontent-length: 21\r\nserver: cloudflare\r\naccess-control-allow-origin: *\r\nvary: Origin\r\ncf-cache-status: DYNAMIC\r\ncf-ray: 9f25d64398b70afe-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":21,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"7d69c71af0f191e9a72db6153f8018d1","sha1":"f67c5f2887bc05654b47f76e9621e53a4091aed1","sha256":"5bac6e06cf0e1ad38c55f9f9d12122272bf4b8157877629fe68cd33fe2133c65","sha512":"fdf43a8f3d843fe9008949d6709c8e2a5cd640f6101522319745f0a829f21dc8f4bd4d70ff3e2f6e1fd53ca0d2dd872bf3588c593a403071102ab28763cbdba5","ssdeep":"","tlshash":"b8700022000000208c80800eca0a032223a0000ac20a00088e800b2288a0b380282032","first_seen":"2023-04-05T02:54:03Z","last_seen":"2026-06-07T07:51:18.251001Z","times_seen":93313,"resource_available":false,"data":null}},"time_used":179,"timings":{"blocked":41,"dns":5,"connect":1,"send":0,"wait":93,"receive":0,"ssl":35},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sucursalvrtla.duckdns.org/js/banco-utils.js?v=6","fqdn":"sucursalvrtla.duckdns.org","domain":"sucursalvrtla.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"18.217.130.149","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sucursalvrtla.duckdns.org/login.html","date":"2026-04-26T13:12:03.839Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sucursalvrtla.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 24 Apr 2026 19:11:43 GMT","end":"Thu, 23 Jul 2026 19:11:42 GMT"},"fingerprint":{"sha1":"BF:CB:7E:A4:5F:DD:13:05:55:C9:2D:41:F2:4E:2E:46:8B:D8:F0:8F","sha256":"CA:14:B2:A0:96:D4:7F:9F:CA:80:A1:60:10:48:98:33:F7:67:FD:F8:D2:98:F3:C9:BD:41:5E:D4:56:E2:B6:F7"}}},"request":{"raw":"GET /js/banco-utils.js?v=6 HTTP/1.1\r\nHost: sucursalvrtla.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://sucursalvrtla.duckdns.org/login.html\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.18.0 (Ubuntu)\r\nDate: Sun, 26 Apr 2026 13:12:04 GMT\r\nContent-Type: text/javascript; charset=utf-8\r\nContent-Length: 9472\r\nConnection: keep-alive\r\nX-Powered-By: Express\r\nCache-Control: no-store, no-cache, must-revalidate, private\r\nAccept-Ranges: bytes\r\nLast-Modified: Fri, 24 Apr 2026 20:00:30 GMT\r\nETag: W/\"2500-19dc1145edb\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.18.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":9472,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"179152f6c68d97c01e6381f59bc3e971","sha1":"5806629733a772c7eb4c2a7b26ec2a9f0e383d21","sha256":"57369cb8a2d063b2c234381289fad8dbd052bc9a47a72d81a50f6bea40b148cc","sha512":"1b5ba946e2458b6a9b513f3af9f69ad907e032560a1acb0bd6209daae13a960c3ffa57864d5b877b2e892b6c5a74747bd004b23d596730f50b04af0d1c1ba936","ssdeep":"192:faWuq8vmfYuWRVI31prWty731FSKM/yGEMUVmv57msN3UcxC:4RoH3LAI3gQo7D3TxC","tlshash":"a8121705b8f31026a2b3a16e0b97a009332551032785da89bf7d47b16f96ba8d3f17dd","first_seen":"2026-04-26T02:45:26.16131Z","last_seen":"2026-04-26T13:12:34.292511Z","times_seen":2,"resource_available":true,"data":null}},"time_used":553,"timings":{"blocked":213,"dns":1,"connect":109,"send":0,"wait":110,"receive":3,"ssl":113},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-26","alert":"Sinkholed","trigger":"sucursalvrtla.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-26","alert":"Phishing Block","trigger":"sucursalvrtla.duckdns.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-26","alert":"Sinkholed","trigger":"sucursalvrtla.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"sucursalvrtla.duckdns.org/img/LogoBancolombia.png","fqdn":"sucursalvrtla.duckdns.org","domain":"sucursalvrtla.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"18.217.130.149","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sucursalvrtla.duckdns.org/login.html","date":"2026-04-26T13:12:03.866Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sucursalvrtla.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 24 Apr 2026 19:11:43 GMT","end":"Thu, 23 Jul 2026 19:11:42 GMT"},"fingerprint":{"sha1":"BF:CB:7E:A4:5F:DD:13:05:55:C9:2D:41:F2:4E:2E:46:8B:D8:F0:8F","sha256":"CA:14:B2:A0:96:D4:7F:9F:CA:80:A1:60:10:48:98:33:F7:67:FD:F8:D2:98:F3:C9:BD:41:5E:D4:56:E2:B6:F7"}}},"request":{"raw":"GET /img/LogoBancolombia.png HTTP/1.1\r\nHost: sucursalvrtla.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://sucursalvrtla.duckdns.org/login.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.18.0 (Ubuntu)\r\nDate: Sun, 26 Apr 2026 13:12:04 GMT\r\nContent-Type: image/png\r\nContent-Length: 28777\r\nConnection: keep-alive\r\nX-Powered-By: Express\r\nCache-Control: no-store, no-cache, must-revalidate, private\r\nAccept-Ranges: bytes\r\nLast-Modified: Fri, 24 Apr 2026 20:00:30 GMT\r\nETag: W/\"7069-19dc1145c9d\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.18.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":28777,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1000 x 1000, 8-bit/color RGBA, non-interlaced","md5":"e8ba114121c8940c63a7d74990483cb0","sha1":"3f58fc5cbdfce2b5388a9a714944f6777cf42748","sha256":"9302d8af98d9882b99e9576d801cecdf5ca1c2cc5276f62c0edc6cc93331b571","sha512":"0ed13907c5cb0153a56529f4181047f09d611f733e393ca09af26c4b5c1d11e2121d3726ae9f3ed01648134a24026ef5e28463dbb51146ca77f91ab49acc7d41","ssdeep":"768:8J3OnHbb+r72Ox8s5KvdHxbXSNaJGePR/Iw5AzaVMyDByc:8oH3+r72bs5GdEaUeP+M/xd5","tlshash":"1fd2f20c1ca17cb8d1c58e78ac20d8e5661e9b745d7efb16ae8c77685253e285c0fb24","first_seen":"2023-05-02T16:27:44Z","last_seen":"2026-08-16T15:19:38.840941Z","times_seen":142,"resource_available":false,"data":null}},"time_used":615,"timings":{"blocked":399,"dns":0,"connect":0,"send":0,"wait":109,"receive":107,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-26","alert":"Sinkholed","trigger":"sucursalvrtla.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-26","alert":"Phishing Block","trigger":"sucursalvrtla.duckdns.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-26","alert":"Sinkholed","trigger":"sucursalvrtla.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"sucursalvrtla.duckdns.org/img/auth-trazo.svg","fqdn":"sucursalvrtla.duckdns.org","domain":"sucursalvrtla.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"18.217.130.149","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sucursalvrtla.duckdns.org/login.html","date":"2026-04-26T13:12:04.301Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sucursalvrtla.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 24 Apr 2026 19:11:43 GMT","end":"Thu, 23 Jul 2026 19:11:42 GMT"},"fingerprint":{"sha1":"BF:CB:7E:A4:5F:DD:13:05:55:C9:2D:41:F2:4E:2E:46:8B:D8:F0:8F","sha256":"CA:14:B2:A0:96:D4:7F:9F:CA:80:A1:60:10:48:98:33:F7:67:FD:F8:D2:98:F3:C9:BD:41:5E:D4:56:E2:B6:F7"}}},"request":{"raw":"GET /img/auth-trazo.svg HTTP/1.1\r\nHost: sucursalvrtla.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://sucursalvrtla.duckdns.org/styles_new.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.18.0 (Ubuntu)\r\nDate: Sun, 26 Apr 2026 13:12:04 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 2983\r\nConnection: keep-alive\r\nX-Powered-By: Express\r\nCache-Control: no-store, no-cache, must-revalidate, private\r\nAccept-Ranges: bytes\r\nLast-Modified: Fri, 24 Apr 2026 20:00:30 GMT\r\nETag: W/\"ba7-19dc1145b66\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.18.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2983,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"8c4e5ff874276305c253a61512604968","sha1":"16d513985b8dad433049d1ce13fe2dd257828385","sha256":"9db5b4f7e116131cce5d7f70df9d9a67e41b1b3515c08a5eef62352f4654a155","sha512":"1c1745a526c4564ad0f4de2d053412608373d138bddb4dc59ce2f3036eeeabc941870860b0f847d7304891ddbd3aa51294d06773501db843432b3e7f1c3fc813","ssdeep":"","tlshash":"3c51b7cd7b319dd899d48ae5fb4061bc3c2b11731a8b5654c009abb12055d0eee7bdc9","first_seen":"2025-04-07T10:58:13.200067Z","last_seen":"2026-08-16T13:21:10.145946Z","times_seen":190,"resource_available":false,"data":null}},"time_used":107,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":105,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-26","alert":"Sinkholed","trigger":"sucursalvrtla.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-26","alert":"Sinkholed","trigger":"sucursalvrtla.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-26","alert":"Phishing Block","trigger":"sucursalvrtla.duckdns.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"sucursalvrtla.duckdns.org/shared-optimized.js?v=6","fqdn":"sucursalvrtla.duckdns.org","domain":"sucursalvrtla.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"18.217.130.149","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sucursalvrtla.duckdns.org/login.html","date":"2026-04-26T13:12:03.841Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sucursalvrtla.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 24 Apr 2026 19:11:43 GMT","end":"Thu, 23 Jul 2026 19:11:42 GMT"},"fingerprint":{"sha1":"BF:CB:7E:A4:5F:DD:13:05:55:C9:2D:41:F2:4E:2E:46:8B:D8:F0:8F","sha256":"CA:14:B2:A0:96:D4:7F:9F:CA:80:A1:60:10:48:98:33:F7:67:FD:F8:D2:98:F3:C9:BD:41:5E:D4:56:E2:B6:F7"}}},"request":{"raw":"GET /shared-optimized.js?v=6 HTTP/1.1\r\nHost: sucursalvrtla.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://sucursalvrtla.duckdns.org/login.html\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.18.0 (Ubuntu)\r\nDate: Sun, 26 Apr 2026 13:12:04 GMT\r\nContent-Type: text/javascript; charset=utf-8\r\nContent-Length: 3279\r\nConnection: keep-alive\r\nX-Powered-By: Express\r\nCache-Control: no-store, no-cache, must-revalidate, private\r\nAccept-Ranges: bytes\r\nLast-Modified: Fri, 24 Apr 2026 20:00:31 GMT\r\nETag: W/\"ccf-19dc114620b\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.18.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":3279,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"10c243963744cf382876893ead7e36cd","sha1":"3c47d98d0b43d9a56c8753bf592a2ef10e2cfcb7","sha256":"9c15ab34c7e81776ce35456a5fa0c68aa7ea5e1d8e51adff84f1fad049568488","sha512":"daf29002edda0e88923c74448beba2bf54bc69ac8fdea935caf48d91a817f3b1beec379eeade87398035772692915cbd50d7787959747415478a330a78f163b9","ssdeep":"","tlshash":"b661ee8d33f632399eb351968b9ba018b12569572064bc587e6c83412f501f9abf2fc4","first_seen":"2026-04-26T02:45:26.168117Z","last_seen":"2026-04-26T13:12:34.300188Z","times_seen":2,"resource_available":true,"data":null}},"time_used":571,"timings":{"blocked":223,"dns":1,"connect":106,"send":0,"wait":107,"receive":6,"ssl":121},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-26","alert":"Phishing Block","trigger":"sucursalvrtla.duckdns.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-26","alert":"Sinkholed","trigger":"sucursalvrtla.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-26","alert":"Sinkholed","trigger":"sucursalvrtla.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"sucursalvrtla.duckdns.org/login.html","fqdn":"sucursalvrtla.duckdns.org","domain":"sucursalvrtla.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"18.217.130.149","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-04-26T13:12:03.635Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sucursalvrtla.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 24 Apr 2026 19:11:43 GMT","end":"Thu, 23 Jul 2026 19:11:42 GMT"},"fingerprint":{"sha1":"BF:CB:7E:A4:5F:DD:13:05:55:C9:2D:41:F2:4E:2E:46:8B:D8:F0:8F","sha256":"CA:14:B2:A0:96:D4:7F:9F:CA:80:A1:60:10:48:98:33:F7:67:FD:F8:D2:98:F3:C9:BD:41:5E:D4:56:E2:B6:F7"}}},"request":{"raw":"GET /login.html HTTP/1.1\r\nHost: sucursalvrtla.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.18.0 (Ubuntu)\r\nDate: Sun, 26 Apr 2026 13:12:03 GMT\r\nContent-Type: text/html; charset=utf-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nX-Powered-By: Express\r\nCache-Control: no-store, no-cache, must-revalidate, private\r\nLast-Modified: Fri, 24 Apr 2026 20:00:31 GMT\r\nETag: W/\"12de-19dc1145fa7\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.18.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Socket.io","description":"","website":"https://socket.io","common_platform_enumeration":"","icon":"Socket.io.svg","categories":["JavaScript frameworks"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":4830,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with CRLF line terminators","md5":"314783c1f1636df59423e922e1a8c881","sha1":"3d734e9f594c3a588b32a32a278d84c4b4b14bfa","sha256":"30d707e31e6e928fc316e38449012a8338aed01cc7f932da40fc896ad1f383f2","sha512":"01113fcd639aa78c033ec4bd0b96cc79a163ae26377fdb752ed9b060c0809dd77b1ab80e21d130fbe6db75fa1f4e2edcefffbed519964dc824af329f78b25719","ssdeep":"96:muFODSq/06IDhCfT1xZcp4Qq5aNK2JgUxmA/JWm:UW+1wpXxs2Pl3","tlshash":"20a15230a8c48416517bc1c94fa2eb6efe91c543ea05444db2fc2b8b6fb2d47cc439a4","first_seen":"2026-04-26T02:45:26.159876Z","last_seen":"2026-04-26T13:12:34.302606Z","times_seen":2,"resource_available":false,"data":null}},"time_used":107,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":107,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-26","alert":"Sinkholed","trigger":"sucursalvrtla.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-26","alert":"Sinkholed","trigger":"sucursalvrtla.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-26","alert":"Phishing Block","trigger":"sucursalvrtla.duckdns.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"sucursalvrtla.duckdns.org/styles_new.css","fqdn":"sucursalvrtla.duckdns.org","domain":"sucursalvrtla.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"18.217.130.149","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://sucursalvrtla.duckdns.org/login.html","date":"2026-04-26T13:12:03.836Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sucursalvrtla.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 24 Apr 2026 19:11:43 GMT","end":"Thu, 23 Jul 2026 19:11:42 GMT"},"fingerprint":{"sha1":"BF:CB:7E:A4:5F:DD:13:05:55:C9:2D:41:F2:4E:2E:46:8B:D8:F0:8F","sha256":"CA:14:B2:A0:96:D4:7F:9F:CA:80:A1:60:10:48:98:33:F7:67:FD:F8:D2:98:F3:C9:BD:41:5E:D4:56:E2:B6:F7"}}},"request":{"raw":"GET /styles_new.css HTTP/1.1\r\nHost: sucursalvrtla.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://sucursalvrtla.duckdns.org/login.html\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.18.0 (Ubuntu)\r\nDate: Sun, 26 Apr 2026 13:12:03 GMT\r\nContent-Type: text/css; charset=utf-8\r\nContent-Length: 14570\r\nConnection: keep-alive\r\nX-Powered-By: Express\r\nCache-Control: no-store, no-cache, must-revalidate, private\r\nAccept-Ranges: bytes\r\nLast-Modified: Fri, 24 Apr 2026 20:00:31 GMT\r\nETag: W/\"38ea-19dc11462a4\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.18.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":14570,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"Unicode text, UTF-8 text","md5":"13d305ac5a49f6f95214a1aa0dceb103","sha1":"4a56b83f2fb0a7f1321dc8b2d4c4d34f5fba1ff7","sha256":"e95e8c538e6f334f4cf1b8b01df6e63346714044a994b6db071742fb65ba800f","sha512":"0d4d8698b283ef883d9f3efdc902f3b7fd09abfb4d75af7c2d8674f27793706abae9639143036c4d66aa067e8e02ca7a179cf1547389f1159574899302373ea8","ssdeep":"192:qUrx4fXj/gMM7+Iex+vNBARrFOxhfyh4FYzbmqLFXiUd1aiwze+fCsNcW6afd+qP:qVDUrXwFd4E314xgkFV","tlshash":"e562639b57a32559701bd66c1feb974933788043910edd6d3acc33888f4a3e86263b8d","first_seen":"2026-04-26T02:45:26.163285Z","last_seen":"2026-04-26T13:12:34.304543Z","times_seen":2,"resource_available":false,"data":null}},"time_used":214,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":213,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-26","alert":"Sinkholed","trigger":"sucursalvrtla.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-26","alert":"Phishing Block","trigger":"sucursalvrtla.duckdns.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-26","alert":"Sinkholed","trigger":"sucursalvrtla.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"sucursalvrtla.duckdns.org/script_new.js?v=6","fqdn":"sucursalvrtla.duckdns.org","domain":"sucursalvrtla.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"18.217.130.149","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sucursalvrtla.duckdns.org/login.html","date":"2026-04-26T13:12:03.841Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sucursalvrtla.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 24 Apr 2026 19:11:43 GMT","end":"Thu, 23 Jul 2026 19:11:42 GMT"},"fingerprint":{"sha1":"BF:CB:7E:A4:5F:DD:13:05:55:C9:2D:41:F2:4E:2E:46:8B:D8:F0:8F","sha256":"CA:14:B2:A0:96:D4:7F:9F:CA:80:A1:60:10:48:98:33:F7:67:FD:F8:D2:98:F3:C9:BD:41:5E:D4:56:E2:B6:F7"}}},"request":{"raw":"GET /script_new.js?v=6 HTTP/1.1\r\nHost: sucursalvrtla.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://sucursalvrtla.duckdns.org/login.html\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.18.0 (Ubuntu)\r\nDate: Sun, 26 Apr 2026 13:12:04 GMT\r\nContent-Type: text/javascript; charset=utf-8\r\nContent-Length: 5848\r\nConnection: keep-alive\r\nX-Powered-By: Express\r\nCache-Control: no-store, no-cache, must-revalidate, private\r\nAccept-Ranges: bytes\r\nLast-Modified: Fri, 24 Apr 2026 20:00:31 GMT\r\nETag: W/\"16d8-19dc1146172\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.18.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":5848,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"Unicode text, UTF-8 text","md5":"9fb813101c180ba8285d7efd1a2310af","sha1":"27923f7fdea8701b1aaeab9cdb79515a412ff997","sha256":"ab3750c9b577e89d2bfdcb7668243189709ccf317fec4c2774882b4773db2084","sha512":"fe9b6847d877197384a9d5a23760536c2e96f9850477aae12b18098e36073b34fa6a4a068f8c790fc4fee7e6de75890796b222ba24c195389247fdc90badb461","ssdeep":"96:pelq6jGyB02MNRlHgcPWx0lMaT9ze3tL3CE3XU3pS73CxLHnID:pmZFTMNLHz+kMYK3R3CE3XU3Y73YLHn8","tlshash":"51c17358a2b725386d7364bd47df9206752450033589dc98be2e9b400fc2f94a5e37fa","first_seen":"2026-04-26T02:45:26.162346Z","last_seen":"2026-04-26T13:12:34.306616Z","times_seen":2,"resource_available":true,"data":null}},"time_used":572,"timings":{"blocked":225,"dns":1,"connect":111,"send":0,"wait":110,"receive":1,"ssl":120},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-26","alert":"Sinkholed","trigger":"sucursalvrtla.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-26","alert":"Sinkholed","trigger":"sucursalvrtla.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-26","alert":"Phishing Block","trigger":"sucursalvrtla.duckdns.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"sucursalvrtla.duckdns.org/img/logo-bancolombia-blanco.png","fqdn":"sucursalvrtla.duckdns.org","domain":"sucursalvrtla.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"18.217.130.149","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sucursalvrtla.duckdns.org/login.html","date":"2026-04-26T13:12:03.862Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sucursalvrtla.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 24 Apr 2026 19:11:43 GMT","end":"Thu, 23 Jul 2026 19:11:42 GMT"},"fingerprint":{"sha1":"BF:CB:7E:A4:5F:DD:13:05:55:C9:2D:41:F2:4E:2E:46:8B:D8:F0:8F","sha256":"CA:14:B2:A0:96:D4:7F:9F:CA:80:A1:60:10:48:98:33:F7:67:FD:F8:D2:98:F3:C9:BD:41:5E:D4:56:E2:B6:F7"}}},"request":{"raw":"GET /img/logo-bancolombia-blanco.png HTTP/1.1\r\nHost: sucursalvrtla.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://sucursalvrtla.duckdns.org/login.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.18.0 (Ubuntu)\r\nDate: Sun, 26 Apr 2026 13:12:04 GMT\r\nContent-Type: image/png\r\nContent-Length: 5266\r\nConnection: keep-alive\r\nX-Powered-By: Express\r\nCache-Control: no-store, no-cache, must-revalidate, private\r\nAccept-Ranges: bytes\r\nLast-Modified: Fri, 24 Apr 2026 20:00:30 GMT\r\nETag: W/\"1492-19dc1145c02\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.18.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":5266,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1008 x 280, 8-bit colormap, non-interlaced","md5":"7f263e0f077274830ad08949402c9290","sha1":"01bec219501c3783f7330cf009b3bcd256d11dc5","sha256":"360bee5df5ce2953c7c5a9336ab053b2ecb9cb700be67d11696135005ae86ac1","sha512":"c946d6b3e49efa06216b7c038d4514385c0c445c1c9b5c326dbda03303fbfb41dee7c0b90a175ec85d07fa2cff8ec56a94a0e89b8f0306b6ac2cb3ae1e0b0573","ssdeep":"96:AQX/dy4mEmILWBPipKOz0/YNmskaZdkDZjUwuBAlVj+qeIs1:AQvd5mErLe40/UkaZCDZ/uB6j+qU1","tlshash":"9db17d672ac99e84cc085a72016708744ba34d1b3f13bb495ab7b775b574341e2a0b5c","first_seen":"2026-04-26T02:45:26.169104Z","last_seen":"2026-04-26T13:12:34.313434Z","times_seen":2,"resource_available":false,"data":null}},"time_used":515,"timings":{"blocked":403,"dns":0,"connect":0,"send":0,"wait":111,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-26","alert":"Sinkholed","trigger":"sucursalvrtla.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-26","alert":"Phishing Block","trigger":"sucursalvrtla.duckdns.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-26","alert":"Sinkholed","trigger":"sucursalvrtla.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"sucursalvrtla.duckdns.org/favicon.ico","fqdn":"sucursalvrtla.duckdns.org","domain":"sucursalvrtla.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"18.217.130.149","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sucursalvrtla.duckdns.org/login.html","date":"2026-04-26T13:12:04.564Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sucursalvrtla.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 24 Apr 2026 19:11:43 GMT","end":"Thu, 23 Jul 2026 19:11:42 GMT"},"fingerprint":{"sha1":"BF:CB:7E:A4:5F:DD:13:05:55:C9:2D:41:F2:4E:2E:46:8B:D8:F0:8F","sha256":"CA:14:B2:A0:96:D4:7F:9F:CA:80:A1:60:10:48:98:33:F7:67:FD:F8:D2:98:F3:C9:BD:41:5E:D4:56:E2:B6:F7"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: sucursalvrtla.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://sucursalvrtla.duckdns.org/login.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 204 No Content\r\nServer: nginx/1.18.0 (Ubuntu)\r\nDate: Sun, 26 Apr 2026 13:12:04 GMT\r\nConnection: keep-alive\r\nX-Powered-By: Express\r\nCache-Control: no-store, no-cache, must-revalidate, private\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.18.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/x-icon","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-16T19:35:55.306911Z","times_seen":17923256,"resource_available":true,"data":null}},"time_used":107,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":107,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-26","alert":"Sinkholed","trigger":"sucursalvrtla.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-26","alert":"Phishing Block","trigger":"sucursalvrtla.duckdns.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-26","alert":"Sinkholed","trigger":"sucursalvrtla.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"sucursalvrtla.duckdns.org/","fqdn":"sucursalvrtla.duckdns.org","domain":"sucursalvrtla.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"18.217.130.149","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-04-26T13:12:02.916Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sucursalvrtla.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 24 Apr 2026 19:11:43 GMT","end":"Thu, 23 Jul 2026 19:11:42 GMT"},"fingerprint":{"sha1":"BF:CB:7E:A4:5F:DD:13:05:55:C9:2D:41:F2:4E:2E:46:8B:D8:F0:8F","sha256":"CA:14:B2:A0:96:D4:7F:9F:CA:80:A1:60:10:48:98:33:F7:67:FD:F8:D2:98:F3:C9:BD:41:5E:D4:56:E2:B6:F7"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: sucursalvrtla.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.18.0 (Ubuntu)\r\nDate: Sun, 26 Apr 2026 13:12:03 GMT\r\nContent-Type: text/html; charset=utf-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nX-Powered-By: Express\r\nCache-Control: no-store, no-cache, must-revalidate, private\r\nLast-Modified: Fri, 24 Apr 2026 20:19:03 GMT\r\nETag: W/\"e3-19dc1255804\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.18.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":227,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"256d52d80ea5733feb37e9dbb594bb89","sha1":"37e2671b24b08c52b11420e7c9f023da83b82985","sha256":"c76c6e3a33ee4fd35d9dc8df7a308601f06e98ec8dc4f069abb5080f4c8f698f","sha512":"02844b826eae1b9dd9ff0acd82b81642486dd92089f916f115e59e6cb99112205b1758491213cb9f253367699c7ea130a8062b3eb77da3248f78495bd900389c","ssdeep":"","tlshash":"5cd0224e00a601030270a310aed1f2a12ca64b92b9caca60f7e5f0594ff6f01c8c7298","first_seen":"2026-04-26T02:45:26.167318Z","last_seen":"2026-04-26T13:12:34.318643Z","times_seen":2,"resource_available":false,"data":null}},"time_used":797,"timings":{"blocked":342,"dns":127,"connect":106,"send":0,"wait":107,"receive":0,"ssl":112},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-26","alert":"Phishing Block","trigger":"sucursalvrtla.duckdns.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-26","alert":"Sinkholed","trigger":"sucursalvrtla.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-04-26","alert":"Sinkholed","trigger":"sucursalvrtla.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}}]}