{"report_id":"9b6e4e8a-91d3-4134-bc27-d71e355d64e3","version":0,"status":"done","tags":["dyndns"],"date":"2026-06-12T15:07:42Z","url":{"schema":"http","addr":"chickennuggets.fun/","fqdn":"chickennuggets.fun","domain":"chickennuggets.fun","tld":"fun"},"ip":{"addr":"89.84.190.120","port":0,"asn":5410,"as":"Bouygues Telecom SA","country":"France","country_code":"FR"},"final":{"url":{"schema":"https","addr":"medhi34.ddnsking.com/","fqdn":"medhi34.ddnsking.com","domain":"medhi34.ddnsking.com","tld":"ddnsking.com"},"title":"Registration Page","dom":{"size":11395,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"2b02b1cb3439c4a11849a50e863aae5a","sha1":"f9ae8c4ee5ccc72df8b4b3406acaa9ac84ff2ab4","sha256":"6518509b2d999c2c956fdee144dd4643bee8ede9bd1176fcb318157bd25b3d90","sha512":"70c3983e0fcf44d23dca5e95c85bda4d2b0ad5b2322fd1976b03853fc8cd73300fd269a563d047cfb67711e2c2375f2fb655ca3b3d8a3aad895ecfe13f8cab44","ssdeep":"96:gllZ3oRX5eK5JoPO9XVo8k96dmvlkpScvfi3yAni00STu7U5BQkt7gZHQ9:Q4qPO9lU96dmNMSgzUzQkt7gZHQ9","tlshash":"8332b68155f30c47651688693ff25b1a3a688483d40ac1b87bdca7bdef84bd589b378c","dom_hash":"domhash0b35c6615777195947eff627a9ef1019","first_seen":"2026-06-12T15:07:45.564788Z","last_seen":"2026-06-12T15:07:45.564788Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"chickennuggets.fun/","fqdn":"chickennuggets.fun","domain":"chickennuggets.fun","tld":"fun"},"ip":{"addr":"89.84.190.120","port":0,"asn":5410,"as":"Bouygues Telecom SA","country":"France","country_code":"FR"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-07-17T15:07:42Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-12","alert":"Sinkholed","trigger":"chickennuggets.fun","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-12","alert":"Sinkholed","trigger":"chickennuggets.fun","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]},"summary":[{"fqdn":"chickennuggets.fun","ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2025-08-14","domain_rank":0,"first_seen":"2025-09-06T12:04:33.073182Z","last_seen":"2025-09-06T12:04:33.073182Z","alert_count":4,"request_count":2,"received_data":204,"sent_data":890,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.29.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"medhi34.ddnsking.com","ip":{"addr":"89.84.190.120","port":443,"asn":5410,"as":"Bouygues Telecom SA","country":"France","country_code":"FR"},"domain_registered":"2014-05-08","domain_rank":0,"first_seen":"2026-06-12T15:07:42.686347Z","last_seen":"2026-06-12T15:07:42.686347Z","alert_count":4,"request_count":4,"received_data":1012062,"sent_data":2135,"comment":"","tags":null,"fingerprints":[{"name":"PHP:8.2.12","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx:1.29.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"medhi34.ddnsking.com/","fqdn":"medhi34.ddnsking.com","domain":"medhi34.ddnsking.com","tld":"ddnsking.com"},"ip":{"addr":"89.84.190.120","port":443,"asn":5410,"as":"Bouygues Telecom SA","country":"France","country_code":"FR"},"introduction_type":"scriptElement","is_inline":true,"md5":"4fb4dac8fa3b485b22e78fe893086653","sha1":"b94da52356613cd0b400f569c5279b988e24d2df","sha256":"1dff9fba28db04aa65893c1858ac6032d00eb47fe9475235ffd8b33c6891d5f2","sha512":"a8db060ae76f67b09e3a0f732cd442ff7acb2a275564a78933fcd8e222fb1d5c5dff456374dffcd746bc75225a4c42409a2159e1f5fa986bda1ed05b2d7616b2","ssdeep":"","tlshash":"8111c498249358260ba26f392bdf4119b675c84320095f48bd1c435e7f61bbb80f9785","size":1008,"data":"","first_seen":"2026-06-12T15:07:45.572538Z","last_seen":"2026-06-12T15:07:45.572538Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"chickennuggets.fun/","fqdn":"chickennuggets.fun","domain":"chickennuggets.fun","tld":"fun"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-06-12T15:07:15.977Z","timestamp":1781276835977,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: chickennuggets.fun\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T08:49:01.761015Z","times_seen":17739839,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-12","alert":"Sinkholed","trigger":"chickennuggets.fun","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-12","alert":"Sinkholed","trigger":"chickennuggets.fun","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"chickennuggets.fun/","fqdn":"chickennuggets.fun","domain":"chickennuggets.fun","tld":"fun"},"ip":{"addr":"89.84.190.120","port":80,"asn":5410,"as":"Bouygues Telecom SA","country":"France","country_code":"FR"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-06-12T15:07:19.054Z","timestamp":1781276839054,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: chickennuggets.fun\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 301 Moved Permanently\r\nServer: nginx/1.29.1\r\nDate: Fri, 12 Jun 2026 15:07:16 GMT\r\nContent-Type: text/html\r\nContent-Length: 169\r\nConnection: keep-alive\r\nLocation: https://medhi34.ddnsking.com/\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"Nginx:1.29.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T08:49:01.761015Z","times_seen":17739839,"resource_available":true,"data":null}},"time_used":94,"timings":{"blocked":-1,"dns":3,"connect":45,"send":0,"wait":46,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-12","alert":"Sinkholed","trigger":"chickennuggets.fun","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-12","alert":"Sinkholed","trigger":"chickennuggets.fun","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"medhi34.ddnsking.com/","fqdn":"medhi34.ddnsking.com","domain":"medhi34.ddnsking.com","tld":"ddnsking.com"},"ip":{"addr":"89.84.190.120","port":443,"asn":5410,"as":"Bouygues Telecom SA","country":"France","country_code":"FR"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-06-12T15:07:19.153Z","timestamp":1781276839153,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"medhi34.ddnsking.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 07 Jun 2026 15:25:40 GMT","end":"Sat, 05 Sep 2026 15:25:39 GMT"},"fingerprint":{"sha1":"52:C6:54:81:B2:33:47:F9:4C:FC:E4:D6:2F:1F:A1:42:C3:39:72:92","sha256":"10:26:28:5A:03:78:69:FC:3B:1D:8C:D2:DD:75:D6:0F:61:0C:1A:BC:6F:42:47:AB:CE:DE:AB:49:78:72:B1:FA"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: medhi34.ddnsking.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx/1.29.1\r\ndate: Fri, 12 Jun 2026 15:07:17 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nx-powered-by: PHP/8.2.12\r\nset-cookie: PHPSESSID=lfd92kje03grti1dk7srm3t865; path=/\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"PHP:8.2.12","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx:1.29.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":11407,"size_decoded":11735,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"4009860f11e19ce9a95b57179ec5d284","sha1":"83d6ca3004b9572e284c1db8a322f76ecc4136d4","sha256":"8cc1da0aadc79122c8bb990d880cb87c8ec5a745843f8124bb4c0a4d27e642ca","sha512":"3e82ced9bdf12b95ba24b2916befd4d233ea13f9709a4db1c90a829959a1e8615de656ba33b4867eeffc6efa2afb51cff00159cc172dd185b75ed28333589cba","ssdeep":"96:q/oGZ3oRX5eK5JoPO9XVo8k96dmvlkpScvfu1ywjPAq0aTu7U5BQkt7gZHQfz:W4qPO9lU96dmNMScLUzQkt7gZHQfz","tlshash":"9932b78159f30c47691684693fb25b2a36688483d00ac1b87fdca7bcdf84bd585b378c","first_seen":"2026-06-12T15:07:45.567079Z","last_seen":"2026-06-12T15:07:45.567079Z","times_seen":1,"resource_available":false,"data":null}},"time_used":192,"timings":{"blocked":-1,"dns":2,"connect":45,"send":0,"wait":81,"receive":0,"ssl":63},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"medhi34.ddnsking.com/site.css","fqdn":"medhi34.ddnsking.com","domain":"medhi34.ddnsking.com","tld":"ddnsking.com"},"ip":{"addr":"89.84.190.120","port":443,"asn":5410,"as":"Bouygues Telecom SA","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://medhi34.ddnsking.com/","date":"2026-06-12T15:07:19.504Z","timestamp":1781276839504,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"medhi34.ddnsking.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 07 Jun 2026 15:25:40 GMT","end":"Sat, 05 Sep 2026 15:25:39 GMT"},"fingerprint":{"sha1":"52:C6:54:81:B2:33:47:F9:4C:FC:E4:D6:2F:1F:A1:42:C3:39:72:92","sha256":"10:26:28:5A:03:78:69:FC:3B:1D:8C:D2:DD:75:D6:0F:61:0C:1A:BC:6F:42:47:AB:CE:DE:AB:49:78:72:B1:FA"}}},"request":{"raw":"GET /site.css HTTP/1.1\r\nHost: medhi34.ddnsking.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://medhi34.ddnsking.com/\r\nCookie: PHPSESSID=lfd92kje03grti1dk7srm3t865\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx/1.29.1\r\ndate: Fri, 12 Jun 2026 15:07:17 GMT\r\ncontent-type: text/css\r\ncontent-length: 1562\r\nlast-modified: Sun, 27 Jul 2025 02:17:49 GMT\r\netag: \"61a-63adfc81541cc\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx:1.29.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1562,"size_decoded":1797,"mime_type":"text/css","magic":"Unicode text, UTF-8 text","md5":"b01eaaa97fcfb54d773a5f8180d6293b","sha1":"3604188b7005b212ae65ed87e296c6fe9eaf9766","sha256":"70a646e4d20a16aa54200360453ed397d00e828474b444fc1c3ea7c57574f62c","sha512":"cbb5e8040faf9536118a355398fd4b16d36e3a6eb65b94214450a247c9b6ad11361e14259d7325b29c5a2c61f97190332377d0a635bbfeb84e410cd36864df35","ssdeep":"","tlshash":"3a31ce969ad7288b7806a5a82fb5175442a984538309c5fc7e9c72fc4f843c958e33c4","first_seen":"2026-06-12T15:07:45.568926Z","last_seen":"2026-06-12T15:07:45.568926Z","times_seen":1,"resource_available":false,"data":null}},"time_used":49,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":49,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"medhi34.ddnsking.com/img/background.jpg","fqdn":"medhi34.ddnsking.com","domain":"medhi34.ddnsking.com","tld":"ddnsking.com"},"ip":{"addr":"89.84.190.120","port":443,"asn":5410,"as":"Bouygues Telecom SA","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://medhi34.ddnsking.com/","date":"2026-06-12T15:07:19.566Z","timestamp":1781276839566,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"medhi34.ddnsking.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 07 Jun 2026 15:25:40 GMT","end":"Sat, 05 Sep 2026 15:25:39 GMT"},"fingerprint":{"sha1":"52:C6:54:81:B2:33:47:F9:4C:FC:E4:D6:2F:1F:A1:42:C3:39:72:92","sha256":"10:26:28:5A:03:78:69:FC:3B:1D:8C:D2:DD:75:D6:0F:61:0C:1A:BC:6F:42:47:AB:CE:DE:AB:49:78:72:B1:FA"}}},"request":{"raw":"GET /img/background.jpg HTTP/1.1\r\nHost: medhi34.ddnsking.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://medhi34.ddnsking.com/\r\nCookie: PHPSESSID=lfd92kje03grti1dk7srm3t865\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx/1.29.1\r\ndate: Fri, 12 Jun 2026 15:07:17 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 997160\r\nlast-modified: Sat, 07 Jun 2025 07:23:40 GMT\r\netag: \"f3728-636f639d9f682\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx:1.29.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":997160,"size_decoded":997401,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1658x1142, components 3","md5":"d29b59adfdd504bc73bb8f618bbd7120","sha1":"17a995279665831994dc769e778716f85d8cd781","sha256":"4d37ca55aa450babc55c4ce892fb00a9e674c1ea1dd35b37bd8b6cfcd23b9850","sha512":"3b4be91a7b75ce287ebf68f7ef602180a25720c9cb6877a4a7f938d20da3f241c33542f137f4b15ae2c39f4a31452a9eddb0bdbb4ef24c976636ac28fe583dbe","ssdeep":"24576:7gO+yYTFayXKcPulBUUR8YnV/n5NcPnsFOwwHPM4vuYC:sOIM8qR8YnVf5NcUq5vPC","tlshash":"f62533a9fe37be88e153c028271c5740d535a4a55868d57bb7e420c6ceb730fa2da39c","first_seen":"2026-06-12T15:07:45.570243Z","last_seen":"2026-06-12T15:07:45.570243Z","times_seen":1,"resource_available":false,"data":null}},"time_used":283,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":49,"receive":234,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}},{"url":{"schema":"https","addr":"medhi34.ddnsking.com/img/favicon.png","fqdn":"medhi34.ddnsking.com","domain":"medhi34.ddnsking.com","tld":"ddnsking.com"},"ip":{"addr":"89.84.190.120","port":443,"asn":5410,"as":"Bouygues Telecom SA","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://medhi34.ddnsking.com/","date":"2026-06-12T15:07:19.688Z","timestamp":1781276839688,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"medhi34.ddnsking.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 07 Jun 2026 15:25:40 GMT","end":"Sat, 05 Sep 2026 15:25:39 GMT"},"fingerprint":{"sha1":"52:C6:54:81:B2:33:47:F9:4C:FC:E4:D6:2F:1F:A1:42:C3:39:72:92","sha256":"10:26:28:5A:03:78:69:FC:3B:1D:8C:D2:DD:75:D6:0F:61:0C:1A:BC:6F:42:47:AB:CE:DE:AB:49:78:72:B1:FA"}}},"request":{"raw":"GET /img/favicon.png HTTP/1.1\r\nHost: medhi34.ddnsking.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://medhi34.ddnsking.com/\r\nCookie: PHPSESSID=lfd92kje03grti1dk7srm3t865\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx/1.29.1\r\ndate: Fri, 12 Jun 2026 15:07:17 GMT\r\ncontent-type: image/png\r\ncontent-length: 894\r\nlast-modified: Fri, 29 Dec 2023 14:43:21 GMT\r\netag: \"37e-60da70db61440\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx:1.29.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":894,"size_decoded":1129,"mime_type":"image/png","magic":"MS Windows icon resource - 1 icon, 16x16, 24 bits/pixel","md5":"cba21311fac62511b2d9921cc168b86e","sha1":"d9830e9034a65a7e91678daa15828566822d231a","sha256":"ea3767a81e101a56c7b94699a479a9dfef8b0c3f87ee8c274120a58fc9367408","sha512":"2c2864c2ecb1195938b6ca80118280a21c6667b6ff5bc7d5517474860c41734a3d9111b1b7cf9b97371d6c6f598e027b09081418aad17fcf1cf5aee4cd2a9326","ssdeep":"","tlshash":"451194a092ce390ac0191a35d2a20f47506a87b54fd6b34fddbc40ca0cde00afcab059","first_seen":"2023-05-25T20:52:17Z","last_seen":"2026-06-12T15:07:45.571707Z","times_seen":9,"resource_available":false,"data":null}},"time_used":67,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":67,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - DynDNS domain","verdict":"suspicious","severity":"low","comment":"","tags":["dyndns"],"meta":null}]}}]}