{"report_id":"90b2bbb6-0a32-4d86-b895-fd1b8f01d56f","version":6,"status":"done","tags":["dyndns"],"date":"2026-01-09T18:45:13Z","url":{"schema":"https","addr":"prmsynbsvr2026.duckdns.org/","fqdn":"prmsynbsvr2026.duckdns.org","domain":"prmsynbsvr2026.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"167.99.38.75","port":0,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"final":{"url":{"schema":"https","addr":"prmsynbsvr2026.duckdns.org/","fqdn":"prmsynbsvr2026.duckdns.org","domain":"prmsynbsvr2026.duckdns.org","tld":"duckdns.org"},"title":"QNB Giriş","dom":{"size":9076,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"9ae7701b73664da946a45929cb110e92","sha1":"9fcdb8d55c8cadf1246dbb3a53f15d94932b3b1e","sha256":"37f465e32bf83d97b5313fa2a3ba7bb7b6443af9fe183430f9e6ee7a247cbf85","sha512":"e577b4a430f2c3918eb361c423926078df0dd3e245b51630988fbabb641bc241aa02d7cf0d242e3932c8d84ce63c4507c930088a623383ad70fe64828fd909f1","ssdeep":"96:2TgoKqxHrzLmqB3BP+9Zhbq8Rl1S6WYjqSY/E3BPakqoSTH:2Tf9rzLDB3khWs1SRYOwBcH","tlshash":"dc12652090f80c2b515280d4f7da6e063ddde217cb0a9154b6bd2ab6efcbd429cb719d","dom_hash":"domhash412aa6a31b17e1df6946524e68e77103","first_seen":"2026-01-09T18:05:42.955433Z","last_seen":"2026-01-09T18:45:17.169364Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"prmsynbsvr2026.duckdns.org/","fqdn":"prmsynbsvr2026.duckdns.org","domain":"prmsynbsvr2026.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"167.99.38.75","port":0,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-02-13T18:45:13Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-09","alert":"Sinkholed","trigger":"prmsynbsvr2026.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-09","alert":"Phishing Block","trigger":"prmsynbsvr2026.duckdns.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-09","alert":"Sinkholed","trigger":"prmsynbsvr2026.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-09","alert":"Sinkholed","trigger":"prmsynbsvr2026.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]},"summary":[{"fqdn":"prmsynbsvr2026.duckdns.org","ip":{"addr":"167.99.38.75","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"domain_registered":"2013-04-12","domain_rank":0,"first_seen":"2026-01-09T18:45:13.561089Z","last_seen":"2026-01-09T18:45:13.561089Z","alert_count":30,"request_count":6,"received_data":716710,"sent_data":2788,"comment":"","tags":null,"fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"prmsynbsvr2026.duckdns.org/logo.png","fqdn":"prmsynbsvr2026.duckdns.org","domain":"prmsynbsvr2026.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"167.99.38.75","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://prmsynbsvr2026.duckdns.org/","date":"2026-01-09T18:44:51.333Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"prmsynbsvr2026.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 08 Jan 2026 21:26:50 GMT","end":"Wed, 08 Apr 2026 21:26:49 GMT"},"fingerprint":{"sha1":"BB:E3:67:B9:D6:F0:DF:FC:DB:D2:94:EA:4B:2A:CB:B0:CC:5C:75:6B","sha256":"1C:D0:9A:A5:55:14:05:2B:37:D2:B3:76:D8:CE:41:86:FC:47:9A:CA:60:6A:08:80:53:5C:CC:4A:A9:CF:73:5C"}}},"request":{"raw":"GET /logo.png HTTP/1.1\r\nHost: prmsynbsvr2026.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://prmsynbsvr2026.duckdns.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 09 Jan 2026 18:44:51 GMT\r\ncontent-type: image/png\r\ncontent-length: 33376\r\nlast-modified: Thu, 08 Jan 2026 14:16:50 GMT\r\netag: \"695fbc52-8260\"\r\nx-powered-by: PleskLin\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":33376,"size_decoded":0,"mime_type":"image/png","magic":"RIFF (little-endian) data, Web/P image","md5":"d80d6d5f07ed91454f778cd926c48722","sha1":"b802641d081f171c95676e9734e2d051c4ba1768","sha256":"b326b4c3099cd3d8524857255694b61973eead44f42aad9fd4751c0bc80e7d66","sha512":"fa8dc903d51667e626b6d016e001b4f768b7d6ee84a7df36f8d5ecaafaf38efa57a11d40d352e341219fe641c744eb6c4993aef0f68d2b8fdc311a3ccb18342e","ssdeep":"768:L0mgbekrInuvah2IEOICq4FbaQC7lJBnDNp1k:6bek02y+Oxq+bPMl/xp1k","tlshash":"cce2f2a6a91d6d2e18911aa370bed5e13d782723cafb62c7cf431143970dd9ee94c309","first_seen":"2025-06-29T16:10:01.764758Z","last_seen":"2026-07-13T10:48:28.083731Z","times_seen":97,"resource_available":false,"data":null}},"time_used":113,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":88,"receive":25,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-09","alert":"Sinkholed","trigger":"prmsynbsvr2026.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-09","alert":"Phishing Block","trigger":"prmsynbsvr2026.duckdns.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-09","alert":"Sinkholed","trigger":"prmsynbsvr2026.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-09","alert":"Sinkholed","trigger":"prmsynbsvr2026.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"prmsynbsvr2026.duckdns.org/","fqdn":"prmsynbsvr2026.duckdns.org","domain":"prmsynbsvr2026.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"167.99.38.75","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-09T18:44:50.820Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"prmsynbsvr2026.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 08 Jan 2026 21:26:50 GMT","end":"Wed, 08 Apr 2026 21:26:49 GMT"},"fingerprint":{"sha1":"BB:E3:67:B9:D6:F0:DF:FC:DB:D2:94:EA:4B:2A:CB:B0:CC:5C:75:6B","sha256":"1C:D0:9A:A5:55:14:05:2B:37:D2:B3:76:D8:CE:41:86:FC:47:9A:CA:60:6A:08:80:53:5C:CC:4A:A9:CF:73:5C"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: prmsynbsvr2026.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 09 Jan 2026 18:44:51 GMT\r\ncontent-type: text/html\r\nlast-modified: Thu, 08 Jan 2026 14:16:51 GMT\r\netag: W/\"695fbc53-2383\"\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9091,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"e96ac03570f58bb9ad086830d04d3139","sha1":"78e3d9fdcce5bc36711d638407904e881a9d94dd","sha256":"7aa7e56c6080fc2b2445b1d667a0005198b53b17e315b7f5160a91fc38d24a0f","sha512":"abb5cf41a0766e83a7763bc0519e7937c53cd422d1125d976fa2438393f755f49157f906e6377311d4c9de5e45ed1525d699726df7110fd20016c43de18f276a","ssdeep":"96:qTgoKqxHrzLmqB3BP+9Zhbq8Rl1S6WYjqSY/E3BPakqoSTH:qTf9rzLDB3khWs1SRYOwBcH","tlshash":"6712662090f80c2b515280d4f7da6e063ddde217cb0a9154b6bd2ab6efcbd429c7719d","first_seen":"2026-01-09T18:05:42.969313Z","last_seen":"2026-01-09T18:45:17.170896Z","times_seen":2,"resource_available":false,"data":null}},"time_used":385,"timings":{"blocked":177,"dns":127,"connect":22,"send":0,"wait":30,"receive":0,"ssl":26},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-09","alert":"Phishing Block","trigger":"prmsynbsvr2026.duckdns.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-09","alert":"Sinkholed","trigger":"prmsynbsvr2026.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-09","alert":"Sinkholed","trigger":"prmsynbsvr2026.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-09","alert":"Sinkholed","trigger":"prmsynbsvr2026.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"prmsynbsvr2026.duckdns.org/style.css","fqdn":"prmsynbsvr2026.duckdns.org","domain":"prmsynbsvr2026.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"167.99.38.75","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://prmsynbsvr2026.duckdns.org/","date":"2026-01-09T18:44:51.325Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"prmsynbsvr2026.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 08 Jan 2026 21:26:50 GMT","end":"Wed, 08 Apr 2026 21:26:49 GMT"},"fingerprint":{"sha1":"BB:E3:67:B9:D6:F0:DF:FC:DB:D2:94:EA:4B:2A:CB:B0:CC:5C:75:6B","sha256":"1C:D0:9A:A5:55:14:05:2B:37:D2:B3:76:D8:CE:41:86:FC:47:9A:CA:60:6A:08:80:53:5C:CC:4A:A9:CF:73:5C"}}},"request":{"raw":"GET /style.css HTTP/1.1\r\nHost: prmsynbsvr2026.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://prmsynbsvr2026.duckdns.org/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 09 Jan 2026 18:44:51 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 08 Jan 2026 14:16:50 GMT\r\netag: W/\"695fbc52-9eed\"\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":40685,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with CRLF line terminators","md5":"871e7abd899601a76481913936aaf948","sha1":"32a8cad190d299cb224190964913b79a208069bc","sha256":"7d794ae563603fee2cfedcdc486027ffbf612a71bcd623284c40706837280655","sha512":"c82430dcf97b9547b8a18b19a8e607b8cdf18a742b626479650f9c00e2c222d8b7bb1abf89c052fbb2b9f5240f84c4342f8643ff104015cf2c33843f0ed5830f","ssdeep":"192:1sh2O+DTLeEwyVPbjo3q6wevBWbxJ6wsDyk/vEqjeh3ZaSHOQutuhAixaEhZgT/P:1DC/vEBUEh6TYX8yOrLp","tlshash":"e903ccf9a54209ea03334b3457ed18c0fe400273cf2baa15f6ea8565bf65eb815d1dac","first_seen":"2025-07-29T05:04:56.843833Z","last_seen":"2026-04-05T10:06:59.077378Z","times_seen":17,"resource_available":false,"data":null}},"time_used":92,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":92,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-09","alert":"Sinkholed","trigger":"prmsynbsvr2026.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-09","alert":"Phishing Block","trigger":"prmsynbsvr2026.duckdns.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-09","alert":"Sinkholed","trigger":"prmsynbsvr2026.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-09","alert":"Sinkholed","trigger":"prmsynbsvr2026.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"prmsynbsvr2026.duckdns.org/QNB_Loading_Icon.gif","fqdn":"prmsynbsvr2026.duckdns.org","domain":"prmsynbsvr2026.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"167.99.38.75","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://prmsynbsvr2026.duckdns.org/","date":"2026-01-09T18:44:51.329Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"prmsynbsvr2026.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 08 Jan 2026 21:26:50 GMT","end":"Wed, 08 Apr 2026 21:26:49 GMT"},"fingerprint":{"sha1":"BB:E3:67:B9:D6:F0:DF:FC:DB:D2:94:EA:4B:2A:CB:B0:CC:5C:75:6B","sha256":"1C:D0:9A:A5:55:14:05:2B:37:D2:B3:76:D8:CE:41:86:FC:47:9A:CA:60:6A:08:80:53:5C:CC:4A:A9:CF:73:5C"}}},"request":{"raw":"GET /QNB_Loading_Icon.gif HTTP/1.1\r\nHost: prmsynbsvr2026.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://prmsynbsvr2026.duckdns.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 09 Jan 2026 18:44:51 GMT\r\ncontent-type: image/gif\r\ncontent-length: 356854\r\nlast-modified: Thu, 08 Jan 2026 14:16:51 GMT\r\netag: \"695fbc53-571f6\"\r\nx-powered-by: PleskLin\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":356854,"size_decoded":0,"mime_type":"image/gif","magic":"RIFF (little-endian) data, Web/P image","md5":"e3e900ff3a1ebca58a6da604267db3a1","sha1":"bf94aa916a85f57316c4e47c6586aecfd76bbda3","sha256":"d217e472671398f7807874103de8c87ce87621d40c23dac560f3b72bb6d47e8a","sha512":"7fc67615970c15e52eb6e7abab5f56f933edcdc5a36fe9686247b0628e7acfe3ce36c3415c37ead35cb6fcb2bf0f63917dda04fd7f5d8acf6ca95b40c8de0f69","ssdeep":"6144:HlkK1K5aMSXmnW74r5js2zhgENApiLKhU0pSx0XEb0Yrt6RhA5RiJCpt:HuK054eW74r5jH3NAQLKhUfx0XEb7riC","tlshash":"9b74131d6f03524ad46690f7eb419fa0f15b1f2f51d2a3a324abba37f4792c2bb44601","first_seen":"2025-06-29T16:10:01.761631Z","last_seen":"2026-04-05T10:06:59.081308Z","times_seen":74,"resource_available":false,"data":null}},"time_used":140,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":47,"receive":93,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-09","alert":"Phishing Block","trigger":"prmsynbsvr2026.duckdns.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-09","alert":"Sinkholed","trigger":"prmsynbsvr2026.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-09","alert":"Sinkholed","trigger":"prmsynbsvr2026.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-09","alert":"Sinkholed","trigger":"prmsynbsvr2026.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"prmsynbsvr2026.duckdns.org/mobil-kusak.png","fqdn":"prmsynbsvr2026.duckdns.org","domain":"prmsynbsvr2026.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"167.99.38.75","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://prmsynbsvr2026.duckdns.org/","date":"2026-01-09T18:44:51.331Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"prmsynbsvr2026.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 08 Jan 2026 21:26:50 GMT","end":"Wed, 08 Apr 2026 21:26:49 GMT"},"fingerprint":{"sha1":"BB:E3:67:B9:D6:F0:DF:FC:DB:D2:94:EA:4B:2A:CB:B0:CC:5C:75:6B","sha256":"1C:D0:9A:A5:55:14:05:2B:37:D2:B3:76:D8:CE:41:86:FC:47:9A:CA:60:6A:08:80:53:5C:CC:4A:A9:CF:73:5C"}}},"request":{"raw":"GET /mobil-kusak.png HTTP/1.1\r\nHost: prmsynbsvr2026.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://prmsynbsvr2026.duckdns.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 09 Jan 2026 18:44:51 GMT\r\ncontent-type: image/png\r\ncontent-length: 5938\r\nlast-modified: Thu, 08 Jan 2026 14:16:50 GMT\r\netag: \"695fbc52-1732\"\r\nx-powered-by: PleskLin\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5938,"size_decoded":0,"mime_type":"image/png","magic":"RIFF (little-endian) data, Web/P image","md5":"b538913ac820baa935a27db938aa9c10","sha1":"c85d738dcedbfb0e524e210eefbb8216b6989a9f","sha256":"da37af0ee6af2c9b94132958b1b41e01c82a78fbc3aec771fc52a3af591be57e","sha512":"23713078e871b4484b2113b5f1dbdf418954dfcfe4575f738cf53bfd0a523e497e4f1677ef49f6a1b143389c6df95f0c556a6807d9ceec16f869c72a33388b70","ssdeep":"96:PnbQrRBlv5SJ9GUGvOwGQEFr2e8Xf7ppD7ed7mfW3//O+8:IBSJ/GOBr2eIubN8","tlshash":"99c1ae354c29ce78b212a5ac82fb5f417c02b2de4471a3419939dee780360cea578e3b","first_seen":"2025-06-29T16:10:01.763342Z","last_seen":"2026-04-05T10:06:59.095784Z","times_seen":71,"resource_available":false,"data":null}},"time_used":112,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":88,"receive":24,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-09","alert":"Sinkholed","trigger":"prmsynbsvr2026.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-09","alert":"Phishing Block","trigger":"prmsynbsvr2026.duckdns.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-09","alert":"Sinkholed","trigger":"prmsynbsvr2026.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-09","alert":"Sinkholed","trigger":"prmsynbsvr2026.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"prmsynbsvr2026.duckdns.org/file.png","fqdn":"prmsynbsvr2026.duckdns.org","domain":"prmsynbsvr2026.duckdns.org","tld":"duckdns.org"},"ip":{"addr":"167.99.38.75","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://prmsynbsvr2026.duckdns.org/","date":"2026-01-09T18:44:51.334Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"prmsynbsvr2026.duckdns.org","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 08 Jan 2026 21:26:50 GMT","end":"Wed, 08 Apr 2026 21:26:49 GMT"},"fingerprint":{"sha1":"BB:E3:67:B9:D6:F0:DF:FC:DB:D2:94:EA:4B:2A:CB:B0:CC:5C:75:6B","sha256":"1C:D0:9A:A5:55:14:05:2B:37:D2:B3:76:D8:CE:41:86:FC:47:9A:CA:60:6A:08:80:53:5C:CC:4A:A9:CF:73:5C"}}},"request":{"raw":"GET /file.png HTTP/1.1\r\nHost: prmsynbsvr2026.duckdns.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://prmsynbsvr2026.duckdns.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 09 Jan 2026 18:44:51 GMT\r\ncontent-type: image/png\r\ncontent-length: 269294\r\nlast-modified: Thu, 08 Jan 2026 14:16:51 GMT\r\netag: \"695fbc53-41bee\"\r\nx-powered-by: PleskLin\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":269294,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1646 x 1588, 8-bit/color RGBA, non-interlaced","md5":"89fe45013c80112027c058ba02e8b1b0","sha1":"bf148c7e2d38f7cc8041d4b81b49db78584e8830","sha256":"482098a1b2e2fca2c773ad4e350b6ea908a30503f44550645d54e22df72d2578","sha512":"83c5334b6891f11de2d0516a89877a28b4b05cb754f0224bbebe5fa3d8a3a06b420c672d93da35faedabc0940ab5e466aca9e80aae7a33feaefaf019f3afebff","ssdeep":"6144:bLgq1QJllo3f3Me/OJkZMq8t49LGFN0ZiSX5yymg2OYfTu:LUQvH/OJo8t49LGaiSXQymg2OwTu","tlshash":"0b441279177bcd8bdc0f65c419bb16a310aa51b423b2bf328db6a7dcc32886db465413","first_seen":"2025-07-21T06:16:16.136085Z","last_seen":"2026-04-05T10:06:59.089097Z","times_seen":74,"resource_available":false,"data":null}},"time_used":145,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":87,"receive":58,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-09","alert":"Sinkholed","trigger":"prmsynbsvr2026.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-09","alert":"Sinkholed","trigger":"prmsynbsvr2026.duckdns.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-09","alert":"Phishing Block","trigger":"prmsynbsvr2026.duckdns.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-09","alert":"Sinkholed","trigger":"prmsynbsvr2026.duckdns.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}}]}