Report - uspostal-portal30.dynnamn.ru/

Report Overview

Visited public
2023-10-18 01:45:52
Tags
dyndns
URL
uspostal-portal30.dynnamn.ru/
Finishing URL
uspostal-portal30.dynnamn.ru/landing.php
IP / ASN
165.227.180.255
#14061 DIGITALOCEAN-ASN
Title
Notice
Suspicious - DynDNS domain

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
media.istockphoto.com	10706	2000-01-06	2018-11-13 22:06:51	2023-10-17 20:22:58	583 B	18 kB	143.204.55.50
uspostal-portal30.dynnamn.ru	unknown	2019-09-16	2023-10-13 15:21:47	2023-10-17 03:45:51	1.6 kB	44 kB	165.227.180.255

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-10-18 01:45:35	low	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to dynnamn .ru Domain
2023-10-18 01:45:35	low	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to dynnamn .ru Domain
2023-10-18 01:45:35	low	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to dynnamn .ru Domain
2023-10-18 01:45:35	low	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to dynnamn .ru Domain
2023-10-18 01:45:36	low	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to dynnamn .ru Domain
2023-10-18 01:45:36	low	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to dynnamn .ru Domain

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2023-10-17	medium	uspostal-portal30.dynnamn.ru/	United States Postal Service
2023-10-17	medium	uspostal-portal30.dynnamn.ru/	United States Postal Service
2023-10-17	medium	uspostal-portal30.dynnamn.ru/	United States Postal Service

PhishTank

Scan Date	Severity	Indicator	Alert
2023-10-17	medium	uspostal-portal30.dynnamn.ru/landing.php	Other
2023-10-17	medium	uspostal-portal30.dynnamn.ru/favicon.ico	Other
2023-10-17	medium	uspostal-portal30.dynnamn.ru/	Other

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2023-10-18	medium	dynnamn.ru	Sinkholed
2023-10-18	medium	dynnamn.ru	Sinkholed
2023-10-18	medium	dynnamn.ru	Sinkholed

ThreatFox

No alerts detected

JavaScript (0)

HTTP Transactions (4)

URL IP Response Size

uspostal-portal30.dynnamn.ru/landing.php

165.227.180.255

200 OK

32 kB

URL User Request GET HTTP/2
uspostal-portal30.dynnamn.ru/landing.php
IP
165.227.180.255:443
ASN
#14061 DIGITALOCEAN-ASN

Certificate
IssuerLet's Encrypt
Subjectuspostal-portal30.dynnamn.ru
Fingerprint3A:C6:20:82:C0:5D:E1:0A:CB:CE:FA:0F:42:2A:27:73:A9:A6:BB:94
ValidityFri, 13 Oct 2023 12:20:53 GMT - Thu, 11 Jan 2024 12:20:52 GMT

File type
gzip compressed data, from Unix\012- data
Size
32 kB (31530 bytes)
Hash
38914c483eeefb0de7de15cff6d27e40
104e84b383651d204b26be6545e4619391eef8fe
b4a00037439f063fd10d63cb39b3611676814f8dcc6dd566891bc12574448d79

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain
OpenPhish	phishing	United States Postal Service
PhishTank	phishing	Other
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /landing.php HTTP/1.1
Host: uspostal-portal30.dynnamn.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: PHPSESSID=f3sg87tgebl8odsve0fkefcmet
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Wed, 18 Oct 2023 01:45:35 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
strict-transport-security: max-age=31536000
content-encoding: gzip
X-Firefox-Spdy: h2

media.istockphoto.com/id/1282219840/photo/cardboard-box-isolated-on-white-background-with-clipping-path.jpg?s=612x612&w=0&k=20&c=1pBj9xJxvRblZ6_B4_d1BW-WosAS6-ouYShB46Fpusc=

143.204.55.50

200 OK

18 kB

URL GET HTTP/1.1
media.istockphoto.com/id/1282219840/photo/cardboard-box-isolated-on-white-background-with-clipping-path.jpg?s=612x612&w=0&k=20&c=1pBj9xJxvRblZ6_B4_d1BW-WosAS6-ouYShB46Fpusc=
IP
143.204.55.50:443
ASN
#16509 AMAZON-02

Requested by
https://uspostal-portal30.dynnamn.ru/landing.php
Certificate
IssuerAmazon
Subjectmedia.gettyimages.com
Fingerprint59:7E:5E:D5:03:E0:F6:B7:A8:16:2A:7F:78:0B:60:CE:DF:B7:20:10
ValidityFri, 10 Feb 2023 00:00:00 GMT - Sun, 10 Mar 2024 23:59:59 GMT

File type
JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=1, description=Cardboard box isolated on white background with clipping path\377\341\005^http://ns.adobe.com/xap/1.0/], progressive, precision 8, 612x553, components 3\012- data
Size
18 kB (17589 bytes)
Hash
e1737869d09662514c315536386c0bed
4ea2853ceb20dbde440ebc519863b0c35484120a
839d83a68d1efd17893d9bea516449fc816b9b1337e05dff6b95f55d2af2b1f9

HTTP Headers

GET /id/1282219840/photo/cardboard-box-isolated-on-white-background-with-clipping-path.jpg?s=612x612&w=0&k=20&c=1pBj9xJxvRblZ6_B4_d1BW-WosAS6-ouYShB46Fpusc= HTTP/1.1
Host: media.istockphoto.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://uspostal-portal30.dynnamn.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: image/jpeg
Content-Length: 17589
Connection: keep-alive
Date: Mon, 28 Aug 2023 04:57:30 GMT
Server: Kestrel
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=7776000
Last-Modified: Mon, 28 Aug 2023 04:57:30 GMT
Content-Disposition: inline; filename=istockphoto-1282219840-612x612.jpg
X-Cache: Hit from cloudfront
Via: 1.1 e49f22f18c16784c0f42291e768d1daa.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
Alt-Svc: h3=":443"; ma=86400
X-Amz-Cf-Id: Q0zvcy0I0J4xFNG6TDGRroC6yOAskVPbzaI5CF_v_r9h0wj2cbnEOg==
Age: 4394885

uspostal-portal30.dynnamn.ru/favicon.ico

165.227.180.255

404 Not Found

146 B

URL GET HTTP/2
uspostal-portal30.dynnamn.ru/favicon.ico
IP
165.227.180.255:443
ASN
#14061 DIGITALOCEAN-ASN

Requested by
https://uspostal-portal30.dynnamn.ru/landing.php
Certificate
IssuerLet's Encrypt
Subjectuspostal-portal30.dynnamn.ru
Fingerprint3A:C6:20:82:C0:5D:E1:0A:CB:CE:FA:0F:42:2A:27:73:A9:A6:BB:94
ValidityFri, 13 Oct 2023 12:20:53 GMT - Thu, 11 Jan 2024 12:20:52 GMT

File type
HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Size
146 B (146 bytes)
Hash
8eec510e57f5f732fd2cce73df7b73ef
3c0af39ecb3753c5fee3b53d063c7286019eac3b
55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain
OpenPhish	phishing	United States Postal Service
PhishTank	phishing	Other
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: uspostal-portal30.dynnamn.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://uspostal-portal30.dynnamn.ru/landing.php
Cookie: PHPSESSID=f3sg87tgebl8odsve0fkefcmet
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 404 Not Found
server: nginx
date: Wed, 18 Oct 2023 01:45:35 GMT
content-type: text/html
content-length: 146
X-Firefox-Spdy: h2

uspostal-portal30.dynnamn.ru/

165.227.180.255

302 Found

12 kB

URL User Request GET HTTP/2
uspostal-portal30.dynnamn.ru/
IP
165.227.180.255:443
ASN
#14061 DIGITALOCEAN-ASN

Certificate
IssuerLet's Encrypt
Subjectuspostal-portal30.dynnamn.ru
Fingerprint3A:C6:20:82:C0:5D:E1:0A:CB:CE:FA:0F:42:2A:27:73:A9:A6:BB:94
ValidityFri, 13 Oct 2023 12:20:53 GMT - Thu, 11 Jan 2024 12:20:52 GMT

File type

Size
12 kB (11723 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain
OpenPhish	phishing	United States Postal Service
PhishTank	phishing	Other
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET / HTTP/1.1
Host: uspostal-portal30.dynnamn.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
server: nginx
date: Wed, 18 Oct 2023 01:45:35 GMT
content-type: text/html; charset=UTF-8
location: ./landing.php
set-cookie: PHPSESSID=f3sg87tgebl8odsve0fkefcmet; path=/
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (0)

HTTP Transactions (4)

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers