Report - mabanque-message-agricole.duckdns.org/

Report Overview

Visited public
2023-09-24 12:02:14
Tags
dyndns
URL
mabanque-message-agricole.duckdns.org/
Finishing URL
mabanque-message-agricole.duckdns.org/
IP / ASN
185.220.113.208
#0
Title
Web Server's Default Page
Suspicious - DynDNS domain

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
mabanque-message-agricole.duckdns.org	unknown	2013-04-12	2023-09-23 18:20:09	2023-09-24 00:09:16	799 B	1.9 kB	185.220.113.208
assets.plesk.com	120376	1999-06-13	2016-07-25 15:41:51	2023-09-23 16:07:01	4.1 kB	593 kB	185.76.9.17
firehose.us-west-2.amazonaws.com	5730	2005-08-18	2017-01-30 11:07:36	2023-09-24 00:29:43	1.7 kB	1.2 kB	35.89.72.88

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-09-24 12:01:56	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain
2023-09-24 12:01:56	low	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
2023-09-24 12:01:56	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain
2023-09-24 12:01:56	low	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
2023-09-24 12:01:56	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain
2023-09-24 12:01:56	low	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
2023-09-24 12:01:57	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain
2023-09-24 12:01:57	low	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
2023-09-24 12:01:57	medium	Client IP	185.220.113.208	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
2023-09-24 12:01:58	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain
2023-09-24 12:01:58	low	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
2023-09-24 12:01:58	medium	Client IP	185.220.113.208	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2023-09-23	medium	mabanque-message-agricole.duckdns.org/	Credit Agricole S.A.
2023-09-23	medium	mabanque-message-agricole.duckdns.org/	Credit Agricole S.A.

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2023-09-24	medium	mabanque-message-agricole.duckdns.org	Sinkholed
2023-09-24	medium	mabanque-message-agricole.duckdns.org	Sinkholed

ThreatFox

No alerts detected

JavaScript (3)

	URL	From	Size	First Seen	Last Seen
	assets.plesk.com/static/default-website-content/public/default-server-index.js	ScriptElement	28 kB	2023-08-03	2023-11-13
Pretty URL assets.plesk.com/static/default-website-content/public/default-server-index.js IP 185.76.9.17 ASN #60068 Datacamp Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-08-03 16:42 Last Seen2023-11-13 09:33 Times Seen538 Hash 7c9a893bea30bd09c2c016089792500f 21667ff22d56be1667e03980743395232caf2eaf 1ab248995d6d189a05942bd1809faece642f7a4103ada8ebf4e08801062b57cf Loading...

	assets.plesk.com/static/default-website-content/public/bundle.js	ScriptElement	295 kB	2023-03-26	2023-11-13
Pretty URL assets.plesk.com/static/default-website-content/public/bundle.js IP 185.76.9.17 ASN #60068 Datacamp Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-26 08:06 Last Seen2023-11-13 09:33 Times Seen712 Hash 26c98df9bcdad657b5165c13f7bf206e 4447bc2d08af637b3b74bea3cc74ce036616f81e f98c1f60e8868b1864ea53f7065ce6c0844bb1d0f069e0fb3cb5c86796264463 Loading...

		Size	First Seen	Last Seen
	#1 Write - dae053188d70bfa225b3c9876c1b6f40	18 kB	2024-08-21 05:52	2024-08-21 05:52
Pretty Observations First Seen2024-08-21 05:52 Last Seen2024-08-21 05:52 Times Seen1 Hash dae053188d70bfa225b3c9876c1b6f40 767295de5fc0e4cf6a955ec82bad5093731ddc3d b7f7c890572d2983fff39f72d70a0119457cbcf7207c6d051dae4ab49c183870 Loading...

HTTP Transactions (12)

URL IP Response Size

mabanque-message-agricole.duckdns.org/

185.220.113.208

1.7 kB

URL User Request GET
mabanque-message-agricole.duckdns.org/
IP
185.220.113.208:0
ASN
#0

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (406)
Size
1.7 kB (1656 bytes)
Hash
e5ae5cc4947c5673e19b23644b294ff5
a5013b662d080984de58db35bb65a799b96dc594
c423e10e0d1b635bc93c397a9eb45c05fc52ce2568d88aa36d5a9af3b5e4ba40

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain
OpenPhish	phishing	Credit Agricole S.A.
Quad9 DNS	malicious	Sinkholed

NIDS	Severity	Alert
suricata	medium	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain

HTTP Headers

GET / HTTP/1.1
Host: mabanque-message-agricole.duckdns.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Sun, 24 Sep 2023 12:01:57 GMT
Content-Type: text/html
Content-Length: 1656
Connection: keep-alive
Last-Modified: Wed, 16 Aug 2023 12:17:23 GMT
ETag: "678-60309471dfac0"
Accept-Ranges: bytes

assets.plesk.com/static/default-website-content/public/fonts/inter-v12-latin-regular-be7cb1.woff2

185.76.9.17

200 OK

17 kB

URL GET HTTP/2
assets.plesk.com/static/default-website-content/public/fonts/inter-v12-latin-regular-be7cb1.woff2
IP
185.76.9.17:443
ASN
#60068 Datacamp Limited

Requested by
http://mabanque-message-agricole.duckdns.org/
Certificate
IssuerLet's Encrypt
Subject1226552209.rsc.cdn77.org
FingerprintE9:CA:2C:47:A3:A9:5F:E5:6D:55:12:6A:2D:DA:17:45:DA:4E:90:49
ValidityFri, 21 Jul 2023 10:51:34 GMT - Thu, 19 Oct 2023 10:51:33 GMT

File type
Web Open Font Format (Version 2), TrueType, length 16708, version 1.0\012- data
Size
17 kB (16708 bytes)
Hash
68c477c4c76baab3a8d1ef6a55aa986f
4af50379e13514558dd53d123db8ea101ec5e24c
0364d368abf457d4e70dbc7a7a360f3486eaea2837b194915b23d4398bee91ac

HTTP Headers

GET /static/default-website-content/public/fonts/inter-v12-latin-regular-be7cb1.woff2 HTTP/1.1
Host: assets.plesk.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://mabanque-message-agricole.duckdns.org/
Origin: http://mabanque-message-agricole.duckdns.org
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sun, 24 Sep 2023 12:01:57 GMT
content-type: font/woff2
content-length: 16708
permissions-policy: interest-cohort=()
x-origin-cache: HIT
last-modified: Thu, 03 Aug 2023 13:17:57 GMT
access-control-allow-origin: *
etag: "64cba905-4144"
expires: Thu, 03 Aug 2023 13:31:33 GMT
cache-control: max-age=600
x-proxy-cache: HIT
x-github-request-id: 9E72:5D33:30CE02:31E9C0:64CBAA4E
via: 1.1 varnish
age: 260
x-served-by: cache-fra-eddf8230034-FRA
x-cache-hits: 1
x-timer: S1691069267.291293,VS0,VE1
vary: Accept-Encoding
x-fastly-request-id: d7912c61a51c9b908da6ec235d7cec4dd27c6249
server: CDN77-Turbo
x-77-nzt: AblMCQ1maMT/RgEAAA
x-77-nzt-ray: c0a4cc2819e27f2a35251065227d6037
x-accel-expires: @1695557191
x-accel-date: 1695556591
x-cache: HIT
x-age: 326
x-77-pop: stockholmSE
x-77-cache: HIT
x-77-age: 326
accept-ranges: bytes
X-Firefox-Spdy: h2

assets.plesk.com/static/default-website-content/public/fonts/inter-v12-latin-700-54321e.woff2

185.76.9.17

200 OK

18 kB

URL GET HTTP/2
assets.plesk.com/static/default-website-content/public/fonts/inter-v12-latin-700-54321e.woff2
IP
185.76.9.17:443
ASN
#60068 Datacamp Limited

Requested by
http://mabanque-message-agricole.duckdns.org/
Certificate
IssuerLet's Encrypt
Subject1226552209.rsc.cdn77.org
FingerprintE9:CA:2C:47:A3:A9:5F:E5:6D:55:12:6A:2D:DA:17:45:DA:4E:90:49
ValidityFri, 21 Jul 2023 10:51:34 GMT - Thu, 19 Oct 2023 10:51:33 GMT

File type
Web Open Font Format (Version 2), TrueType, length 17784, version 1.0\012- data
Size
18 kB (17784 bytes)
Hash
8d7a3f034881d1712b3325cc71425c10
9594f24367800a20297a96c2d4f957e62c63e207
ced2d8e02e2fbf08d2edec9b5f13648ed8348588a05f7181632f3c1dd6e1f5c3

HTTP Headers

GET /static/default-website-content/public/fonts/inter-v12-latin-700-54321e.woff2 HTTP/1.1
Host: assets.plesk.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://mabanque-message-agricole.duckdns.org
DNT: 1
Connection: keep-alive
Referer: http://mabanque-message-agricole.duckdns.org/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Sun, 24 Sep 2023 12:01:57 GMT
content-type: font/woff2
content-length: 17784
permissions-policy: interest-cohort=()
last-modified: Thu, 03 Aug 2023 13:17:57 GMT
access-control-allow-origin: *
etag: "64cba905-4578"
expires: Thu, 03 Aug 2023 13:32:48 GMT
cache-control: max-age=600
x-proxy-cache: MISS
x-github-request-id: 86BC:C20A:31BBB1:32D755:64CBAA27
via: 1.1 varnish
age: 299
x-served-by: cache-fra-eddf8230044-FRA
x-cache-hits: 1
x-timer: S1691069267.314760,VS0,VE2
vary: Accept-Encoding
x-fastly-request-id: a08838d1666c0348bca40d39ff1607d231148e8b
server: CDN77-Turbo
x-77-nzt: AblMCQ23B4v/dAAAAA
x-77-nzt-ray: c0a4cc2819e27f2a35251065f50f0e39
x-accel-expires: @1695557401
x-accel-date: 1695556801
x-cache: HIT
x-age: 116
x-77-pop: stockholmSE
x-77-cache: HIT
x-77-age: 116
accept-ranges: bytes
X-Firefox-Spdy: h2

assets.plesk.com/static/default-website-content/public/favicon-2d0e10.ico

185.76.9.17

200 OK

114 kB

URL GET HTTP/2
assets.plesk.com/static/default-website-content/public/favicon-2d0e10.ico
IP
185.76.9.17:443
ASN
#60068 Datacamp Limited

Requested by
http://mabanque-message-agricole.duckdns.org/
Certificate
IssuerLet's Encrypt
Subject1226552209.rsc.cdn77.org
FingerprintE9:CA:2C:47:A3:A9:5F:E5:6D:55:12:6A:2D:DA:17:45:DA:4E:90:49
ValidityFri, 21 Jul 2023 10:51:34 GMT - Thu, 19 Oct 2023 10:51:33 GMT

File type
MS Windows icon resource - 7 icons, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, -128x-128, 32 bits/pixel\012- data
Size
114 kB (113459 bytes)
Hash
1db747255c64a30f9236e9d929e986ca
384023452346aa087d40c93c23ca2f5e32ff1b1f
88baf40feb43463a8f6aa6543e88bdbe33f0db9a317486e786eee1e5c76a9544

HTTP Headers

GET /static/default-website-content/public/favicon-2d0e10.ico HTTP/1.1
Host: assets.plesk.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://mabanque-message-agricole.duckdns.org/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Sun, 24 Sep 2023 12:01:58 GMT
content-type: image/vnd.microsoft.icon
content-length: 113459
permissions-policy: interest-cohort=()
x-origin-cache: HIT
last-modified: Thu, 03 Aug 2023 13:17:57 GMT
access-control-allow-origin: *
etag: "64cba905-1bb33"
expires: Thu, 03 Aug 2023 13:31:19 GMT
cache-control: max-age=600
x-proxy-cache: MISS
x-github-request-id: 4844:020F:31BD65:32D788:64CBA9CB
via: 1.1 varnish
age: 95
x-served-by: cache-fra-eddf8230044-FRA
x-cache-hits: 1
x-timer: S1691068974.301899,VS0,VE2
vary: Accept-Encoding
x-fastly-request-id: 61e1c59e69ae54c2f1e88d19c9890e665845a44f
server: CDN77-Turbo
x-77-nzt: AblMCQ3uiwD/BgAAAA
x-77-nzt-ray: c0a4cc289bf3f0263625106576c7d100
x-accel-expires: @1695557512
x-accel-date: 1695556912
x-cache: HIT
x-age: 6
x-77-pop: stockholmSE
x-77-cache: HIT
x-77-age: 6
accept-ranges: bytes
X-Firefox-Spdy: h2

firehose.us-west-2.amazonaws.com/

35.89.72.88

200 OK

20 B

URL POST HTTP/1.1
firehose.us-west-2.amazonaws.com/
IP
35.89.72.88:443
ASN
#16509 AMAZON-02

Requested by
http://mabanque-message-agricole.duckdns.org/
Certificate
IssuerAmazon
Subjectfirehose.us-west-2.amazonaws.com
Fingerprint33:FD:78:B1:20:8F:6F:DC:AD:63:CA:90:DB:65:81:6C:6B:52:01:BB
ValidityWed, 01 Mar 2023 00:00:00 GMT - Thu, 29 Feb 2024 23:59:59 GMT

File type
gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)\012- data
Size
20 B (20 bytes)
Hash
3970e82605c7d109bb348fc94e9eecc0
e03849ea786b9f7b28a35c17949e85a93eb1cff1
f5d031af01f137ae07fa71720fab94d16cc8a2a59868766002918b7c240f3967

HTTP Headers

OPTIONS / HTTP/1.1
Host: firehose.us-west-2.amazonaws.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: authorization,content-type,x-amz-content-sha256,x-amz-date,x-amz-target,x-amz-user-agent
Referer: http://mabanque-message-agricole.duckdns.org/
Origin: http://mabanque-message-agricole.duckdns.org
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
x-amzn-RequestId: ff4d4332-202d-0b2e-a2c7-64443018ab73
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Access-Control-Allow-Headers: authorization,content-type,x-amz-content-sha256,x-amz-date,x-amz-target,x-amz-user-agent
Access-Control-Allow-Methods: POST
Access-Control-Expose-Headers: x-amzn-RequestId,x-amzn-ErrorType,x-amz-request-id,x-amz-id-2,x-amzn-ErrorMessage,Date
Access-Control-Max-Age: 172800
Content-Length: 20
Date: Sun, 24 Sep 2023 12:01:58 GMT

firehose.us-west-2.amazonaws.com/

35.89.72.88

200 OK

246 B

URL POST HTTP/1.1
firehose.us-west-2.amazonaws.com/
IP
35.89.72.88:443
ASN
#16509 AMAZON-02

Requested by
http://mabanque-message-agricole.duckdns.org/
Certificate
IssuerAmazon
Subjectfirehose.us-west-2.amazonaws.com
Fingerprint33:FD:78:B1:20:8F:6F:DC:AD:63:CA:90:DB:65:81:6C:6B:52:01:BB
ValidityWed, 01 Mar 2023 00:00:00 GMT - Thu, 29 Feb 2024 23:59:59 GMT

File type
JSON data\012- , ASCII text, with no line terminators
Size
246 B (246 bytes)
Hash
6b6c051b2efaee0394744d9ac9db35ee
755bb2b1235b1ddd3942451297dbf01fd313cf56
80f307ab08d6dfcaf6e357cff951c12fad661c56627d3034fe11a100878a95d2

HTTP Headers

POST / HTTP/1.1
Host: firehose.us-west-2.amazonaws.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Amz-User-Agent: aws-sdk-js/2.1335.0 callback
Content-Type: application/x-amz-json-1.1
X-Amz-Target: Firehose_20150804.PutRecord
X-Amz-Content-Sha256: 01d26238a6f4c551e2b325f6aa47db2dfd2c6beaa3d18e9fc261982af999ac57
X-Amz-Date: 20230924T120158Z
Authorization: AWS4-HMAC-SHA256 Credential=AKIAR4YEYRJL6JKBNRGP/20230924/us-west-2/firehose/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date;x-amz-target;x-amz-user-agent, Signature=3c03dbd45786a143242ffadb6cb9d63983a68c4a2bfef5021f7f696541ecb133
Content-Length: 108
Origin: http://mabanque-message-agricole.duckdns.org
DNT: 1
Connection: keep-alive
Referer: http://mabanque-message-agricole.duckdns.org/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
x-amzn-RequestId: c189d262-4650-0c2d-9c03-f5145665ac70
Access-Control-Allow-Origin: *
Content-Encoding: gzip
x-amz-id-2: pLoxKnx4PkwFzYghUQk+cOY0nWP5RI5//6ISwEQhueV/tJG77WfxNakHa5FbjZRslEZYNqrFwsFxqod3d/lsq6Uco7X6hhLl
Access-Control-Expose-Headers: x-amzn-RequestId,x-amzn-ErrorType,x-amz-request-id,x-amz-id-2,x-amzn-ErrorMessage,Date
Content-Type: application/x-amz-json-1.1
Content-Length: 246
Date: Sun, 24 Sep 2023 12:01:58 GMT

assets.plesk.com/static/default-website-content/public/default-server-index.js

185.76.9.17

200 OK

28 kB

URL GET HTTP/2
assets.plesk.com/static/default-website-content/public/default-server-index.js
IP
185.76.9.17:443
ASN
#60068 Datacamp Limited

Requested by
http://mabanque-message-agricole.duckdns.org/
Certificate
IssuerLet's Encrypt
Subject1226552209.rsc.cdn77.org
FingerprintE9:CA:2C:47:A3:A9:5F:E5:6D:55:12:6A:2D:DA:17:45:DA:4E:90:49
ValidityFri, 21 Jul 2023 10:51:34 GMT - Thu, 19 Oct 2023 10:51:33 GMT

File type
ASCII text, with very long lines (27343)
Size
28 kB (27524 bytes)
Hash
7c9a893bea30bd09c2c016089792500f
21667ff22d56be1667e03980743395232caf2eaf
1ab248995d6d189a05942bd1809faece642f7a4103ada8ebf4e08801062b57cf

HTTP Headers

GET /static/default-website-content/public/default-server-index.js HTTP/1.1
Host: assets.plesk.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://mabanque-message-agricole.duckdns.org/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sun, 24 Sep 2023 12:01:57 GMT
content-type: application/javascript; charset=utf-8
permissions-policy: interest-cohort=()
x-origin-cache: HIT
last-modified: Thu, 03 Aug 2023 13:17:57 GMT
access-control-allow-origin: *
etag: W/"64cba905-6b84"
expires: Thu, 03 Aug 2023 13:31:36 GMT
cache-control: max-age=600
x-proxy-cache: MISS
x-github-request-id: B816:9725:2F723B:308A84:64CBA9E0
via: 1.1 varnish
age: 233
x-served-by: cache-fra-eddf8230100-FRA
x-cache-hits: 1
x-timer: S1691069130.309655,VS0,VE1
vary: Accept-Encoding, Accept-Encoding
x-fastly-request-id: 7c9ccbb6766db54244494c23d28adadb204cb60c
server: CDN77-Turbo
x-77-nzt: AblMCQ05ETf/RwEAAA
x-77-nzt-ray: c0a4cc289bf3f0263525106555c92128
x-accel-expires: @1695557190
x-accel-date: 1695556590
x-cache: HIT
x-age: 327
x-77-pop: stockholmSE
x-77-cache: HIT
x-77-age: 327
content-encoding: gzip
X-Firefox-Spdy: h2

mabanque-message-agricole.duckdns.org/favicon.ico

0.0.0.0

0 B

URL GET
mabanque-message-agricole.duckdns.org/favicon.ico
IP
0.0.0.0:0
ASN
#0

Requested by
http://mabanque-message-agricole.duckdns.org/

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain
OpenPhish	phishing	Credit Agricole S.A.
Quad9 DNS	malicious	Sinkholed

NIDS	Severity	Alert
suricata	medium	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: mabanque-message-agricole.duckdns.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://mabanque-message-agricole.duckdns.org/
Pragma: no-cache
Cache-Control: no-cache

assets.plesk.com/static/default-website-content/public/bundle.js

185.76.9.17

200 OK

295 kB

URL GET HTTP/2
assets.plesk.com/static/default-website-content/public/bundle.js
IP
185.76.9.17:443
ASN
#60068 Datacamp Limited

Requested by
http://mabanque-message-agricole.duckdns.org/
Certificate
IssuerLet's Encrypt
Subject1226552209.rsc.cdn77.org
FingerprintE9:CA:2C:47:A3:A9:5F:E5:6D:55:12:6A:2D:DA:17:45:DA:4E:90:49
ValidityFri, 21 Jul 2023 10:51:34 GMT - Thu, 19 Oct 2023 10:51:33 GMT

File type
ASCII text, with very long lines (65536), with no line terminators
Size
295 kB (295320 bytes)
Hash
26c98df9bcdad657b5165c13f7bf206e
4447bc2d08af637b3b74bea3cc74ce036616f81e
f98c1f60e8868b1864ea53f7065ce6c0844bb1d0f069e0fb3cb5c86796264463

HTTP Headers

GET /static/default-website-content/public/bundle.js HTTP/1.1
Host: assets.plesk.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://mabanque-message-agricole.duckdns.org/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sun, 24 Sep 2023 12:01:57 GMT
content-type: application/javascript; charset=utf-8
permissions-policy: interest-cohort=()
last-modified: Thu, 03 Aug 2023 13:17:57 GMT
access-control-allow-origin: *
etag: W/"64cba905-48198"
expires: Thu, 03 Aug 2023 13:31:29 GMT
cache-control: max-age=600
x-proxy-cache: MISS
x-github-request-id: 3010:9725:2F6C62:30849E:64CBA9D9
via: 1.1 varnish
age: 43
x-served-by: cache-fra-eddf8230025-FRA
x-cache-hits: 1
x-timer: S1691068933.603092,VS0,VE2
vary: Accept-Encoding, Accept-Encoding
x-fastly-request-id: c90b6e0ca9e9c0b81fb8dddd2d1e8ce8930a6f4b
server: CDN77-Turbo
x-77-nzt: AblMCQ3sITz/RgEAAA
x-77-nzt-ray: c0a4cc289bf3f0263525106556409a35
x-accel-expires: @1695557191
x-accel-date: 1695556591
x-cache: HIT
x-age: 326
x-77-pop: stockholmSE
x-77-cache: HIT
x-77-age: 326
content-encoding: gzip
X-Firefox-Spdy: h2

assets.plesk.com/static/default-website-content/public/img/logo-81ca7a.svg

185.76.9.17

200 OK

2.1 kB

URL GET HTTP/2
assets.plesk.com/static/default-website-content/public/img/logo-81ca7a.svg
IP
185.76.9.17:443
ASN
#60068 Datacamp Limited

Requested by
http://mabanque-message-agricole.duckdns.org/
Certificate
IssuerLet's Encrypt
Subject1226552209.rsc.cdn77.org
FingerprintE9:CA:2C:47:A3:A9:5F:E5:6D:55:12:6A:2D:DA:17:45:DA:4E:90:49
ValidityFri, 21 Jul 2023 10:51:34 GMT - Thu, 19 Oct 2023 10:51:33 GMT

File type
SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (2118), with no line terminators
Size
2.1 kB (2099 bytes)
Hash
f9feb5d64f4aa6ef9441952f93004e90
94b804495ac52b65261f53f1dd97c0d0691a7ac5
024d3703031d890a8de7c855c2fdbe295daf1b803f828f4e7f225f75d0897941

HTTP Headers

GET /static/default-website-content/public/img/logo-81ca7a.svg HTTP/1.1
Host: assets.plesk.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://mabanque-message-agricole.duckdns.org/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sun, 24 Sep 2023 12:01:57 GMT
content-type: image/svg+xml
permissions-policy: interest-cohort=()
last-modified: Thu, 03 Aug 2023 13:17:57 GMT
access-control-allow-origin: *
etag: W/"64cba905-833"
expires: Thu, 03 Aug 2023 13:32:12 GMT
cache-control: max-age=600
x-proxy-cache: MISS
x-github-request-id: 97B8:5D33:309E7E:31B923:64CBAA03
via: 1.1 varnish
age: 0
x-served-by: cache-fra-eddf8230041-FRA
x-cache-hits: 0
x-timer: S1691068933.579820,VS0,VE101
vary: Accept-Encoding, Accept-Encoding
x-fastly-request-id: 4d5068bd31011f87349851a65a101406e17960b5
server: CDN77-Turbo
x-77-nzt: AblMCQ05/eD/EQAAAA
x-77-nzt-ray: c0a4cc289bf3f02635251065c6687e35
x-accel-expires: @1695557500
x-accel-date: 1695556900
x-cache: HIT
x-age: 17
x-77-pop: stockholmSE
x-77-cache: HIT
x-77-age: 17
content-encoding: gzip
X-Firefox-Spdy: h2

assets.plesk.com/static/default-website-content/public/img/stars-fb15b6.svg

185.76.9.17

200 OK

24 kB

URL GET HTTP/2
assets.plesk.com/static/default-website-content/public/img/stars-fb15b6.svg
IP
185.76.9.17:443
ASN
#60068 Datacamp Limited

Requested by
http://mabanque-message-agricole.duckdns.org/
Certificate
IssuerLet's Encrypt
Subject1226552209.rsc.cdn77.org
FingerprintE9:CA:2C:47:A3:A9:5F:E5:6D:55:12:6A:2D:DA:17:45:DA:4E:90:49
ValidityFri, 21 Jul 2023 10:51:34 GMT - Thu, 19 Oct 2023 10:51:33 GMT

File type
SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (23586)
Size
24 kB (23587 bytes)
Hash
18aa9407cb97208391f24bcef249457f
c76eef71591d7d92fb30f51b49dadf16ae600a05
30628c4c5254e81ed7f953bd449c6976ce87210089c4b221f00c3a7a5d597736

HTTP Headers

GET /static/default-website-content/public/img/stars-fb15b6.svg HTTP/1.1
Host: assets.plesk.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://mabanque-message-agricole.duckdns.org/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sun, 24 Sep 2023 12:01:57 GMT
content-type: image/svg+xml
permissions-policy: interest-cohort=()
x-origin-cache: HIT
last-modified: Thu, 03 Aug 2023 13:17:57 GMT
access-control-allow-origin: *
etag: W/"64cba905-5c23"
expires: Thu, 03 Aug 2023 13:31:43 GMT
cache-control: max-age=600
x-proxy-cache: HIT
x-github-request-id: 106E:C20A:31A0E0:32BC02:64CBAA03
via: 1.1 varnish
age: 0
x-served-by: cache-fra-eddf8230021-FRA
x-cache-hits: 0
x-timer: S1691068933.602554,VS0,VE100
vary: Accept-Encoding, Accept-Encoding
x-fastly-request-id: 930f082c51162b6db23a8ebda8568662519d12d9
server: CDN77-Turbo
x-77-nzt: AblMCQ1NQJ//EQAAAA
x-77-nzt-ray: c0a4cc289bf3f0263525106511763e37
x-accel-expires: @1695557500
x-accel-date: 1695556900
x-cache: HIT
x-age: 17
x-77-pop: stockholmSE
x-77-cache: HIT
x-77-age: 17
content-encoding: gzip
X-Firefox-Spdy: h2

assets.plesk.com/static/default-website-content/public/img/robot-4b152c.svg

185.76.9.17

200 OK

89 kB

URL GET HTTP/2
assets.plesk.com/static/default-website-content/public/img/robot-4b152c.svg
IP
185.76.9.17:443
ASN
#60068 Datacamp Limited

Requested by
http://mabanque-message-agricole.duckdns.org/
Certificate
IssuerLet's Encrypt
Subject1226552209.rsc.cdn77.org
FingerprintE9:CA:2C:47:A3:A9:5F:E5:6D:55:12:6A:2D:DA:17:45:DA:4E:90:49
ValidityFri, 21 Jul 2023 10:51:34 GMT - Thu, 19 Oct 2023 10:51:33 GMT

File type
SVG Scalable Vector Graphics image\012- HTML document, ASCII text, with very long lines (65536), with no line terminators
Size
89 kB (89014 bytes)
Hash
a11790af7b8e734f7391d2695e96bfc8
af73e0993f9a486721d75bc21d6eb6e17104ece9
01084e18312cb2af2d6b89b7348a7f1e5ae8faf10c0bd9ce478dd38adb2955a3

HTTP Headers

GET /static/default-website-content/public/img/robot-4b152c.svg HTTP/1.1
Host: assets.plesk.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://mabanque-message-agricole.duckdns.org/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sun, 24 Sep 2023 12:01:57 GMT
content-type: image/svg+xml
permissions-policy: interest-cohort=()
x-origin-cache: HIT
last-modified: Thu, 03 Aug 2023 13:17:57 GMT
access-control-allow-origin: *
etag: W/"64cba905-15bb6"
expires: Thu, 03 Aug 2023 13:31:16 GMT
cache-control: max-age=600
x-proxy-cache: HIT
x-github-request-id: 75F0:F91E:32408E:335B38:64CBA9E9
via: 1.1 varnish
age: 89
x-served-by: cache-fra-eddf8230097-FRA
x-cache-hits: 1
x-timer: S1691068995.229327,VS0,VE1
vary: Accept-Encoding, Accept-Encoding
x-fastly-request-id: 782f02a5a32f62385f7cefff2f7f4d012ca08a52
server: CDN77-Turbo
x-77-nzt: AblMCQ0HiBn/RgEAAA
x-77-nzt-ray: c0a4cc289bf3f02635251065170dde37
x-accel-expires: @1695557191
x-accel-date: 1695556591
x-cache: HIT
x-age: 326
x-77-pop: stockholmSE
x-77-cache: HIT
x-77-age: 326
content-encoding: gzip
X-Firefox-Spdy: h2

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (3)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Observations

Hash

HTTP Transactions (12)

URL User Request GET

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL POST HTTP/1.1

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL POST HTTP/1.1

IP

ASN

Requested by

Certificate

File type