Report - adwz.cn/QTVM74

Report Overview

Submitted URL
adwz.cn/QTVM74
IP
139.162.173.115
ASN
#63949 Akamai Connected Cloud
Submitted
2024-05-07 17:16:44
Access
public
Website Title
saison-6kkhihio.duckdns.org/
Final URL
saison-6kkhihio.duckdns.org/app/openid.pape.max_auth_age=/3
Tags
dyndns
urlquery detections
Suspicious - DynDNS domain

Detections

urlquery
9
Network Intrusion Detection
0
Threat Detection Systems
2

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
adwz.cn	unknown	2022-12-16	2016-07-25	2017-04-05	468 B	506 B	139.162.173.115
translate.google.com	1156	1997-09-15	2012-05-30	2024-05-06	632 B	973 B	142.250.74.46
saison-6kkhihio.duckdns.org	unknown	unknown	No data	No data	4.2 kB	116 kB	181.214.58.30

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2024-05-07	medium	adwz.cn/QTVM74	Apple Inc.

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (5)

	URL	Size	First Seen	Last Seen
	saison-6kkhihio.duckdns.org/static/js/1714481498076.0.38050786525053381714481498076.js	240 kB	2024-05-07	2024-05-07
Pretty URL saison-6kkhihio.duckdns.org/static/js/1714481498076.0.38050786525053381714481498076.js IP 181.214.58.30 ASN #201670 S.c. Infotech-Grup S.r.l. Introduced by scriptElement Embedded in HTML false Observations First Seen2024-05-07 19:16:52 Last Seen2024-05-07 19:16:52 Times Seen1 Hash 16c05c4769174acb023707e5188d68f4 512b38635d0001d25311d7a138986312b3d3c4f7 28b8bdcc5ac53af8ce1362bd165a0e15e6e4d6816e92a6056be56b8893ed7c8f Loading...

	saison-6kkhihio.duckdns.org/static/js/app.0.38050786525053381714481498076.js	3.2 kB	2023-11-22	2024-05-07
Pretty URL saison-6kkhihio.duckdns.org/static/js/app.0.38050786525053381714481498076.js IP 181.214.58.30 ASN #201670 S.c. Infotech-Grup S.r.l. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-11-22 15:49:37 Last Seen2024-05-07 19:16:52 Times Seen6 Hash 68899670b0928c042853860e4b5fa48f cf6628067fa933f8b9a9785ba84ebfc4c905af0c 81a409c5b190287e56aafff405528f844eb99a1081a1ed6619a0a217812adc66 Loading...

	unknown	54 B	2023-04-12	2024-05-19
Pretty Introduced by Function Embedded in HTML false Observations First Seen2023-04-12 08:25:39 Last Seen2024-05-19 17:08:09 Times Seen9834 Hash fcaea4b8885ca5c1fb3ddd5c490da5c6 35745f87b37210d992a9ed534a593ae500b7adaa 934c2008743c36db746a9d6ebd9f1b84ff11477edc55fbf7b599bbfa687f7272 Loading...

	saison-6kkhihio.duckdns.org/static/js/7.0.97483056830314931714481498076.js	2.0 kB	2024-05-07	2024-05-07
Pretty URL saison-6kkhihio.duckdns.org/static/js/7.0.97483056830314931714481498076.js IP 181.214.58.30 ASN #201670 S.c. Infotech-Grup S.r.l. Introduced by scriptElement Embedded in HTML false Observations First Seen2024-05-07 19:16:52 Last Seen2024-05-07 19:16:52 Times Seen2 Hash 007b7486e6281dc80d94aae2f1aa3e3e 7f30a27bb438ff627d1244ed302b65cfffe75186 7de15ce578e40529bd762a559c78eeb7beda19ea2f9a4ae117756a025ae86fb0 Loading...

	saison-6kkhihio.duckdns.org/static/js/8.0.97483056830314931714481498076.js	672 B	2023-11-22	2024-05-07
Pretty URL saison-6kkhihio.duckdns.org/static/js/8.0.97483056830314931714481498076.js IP 181.214.58.30 ASN #201670 S.c. Infotech-Grup S.r.l. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-11-22 15:49:37 Last Seen2024-05-07 19:16:52 Times Seen6 Hash b0cc155abf44d51ced251712c4e9b048 60bbdd8ab6acc248a5cf1f578ac43cf58298592b 07c494cdbc193149b50b1fef9ea7ae94ea2512447dc15cc1cbb3c5278ecbe3df Loading...

HTTP Transactions (10)

URL IP Response Size

adwz.cn/QTVM74

139.162.173.115

0 B

URL
adwz.cn/QTVM74
IP
139.162.173.115:0
ASN
#63949 Akamai Connected Cloud

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Apple Inc.

HTTP Headers

GET /QTVM74 HTTP/1.1
Host: adwz.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
Date: Tue, 07 May 2024 17:16:20 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Strict-Transport-Security: max-age=31536000
Set-Cookie: PHPSESSID=7f8e3lgm6hl1v8guga0q7890m0; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Location: https://translate.google.com/translate?sl=auto&tl=ja&hl=ja&u=https://www.jp-eposcord-login.workers.dev/&client=webapp
Server: nginx

translate.google.com/translate?sl=auto&tl=ja&hl=ja&u=https://www.jp-eposcord-login.workers.dev/&client=webapp

142.250.74.46

0 B

URL
translate.google.com/translate?sl=auto&tl=ja&hl=ja&u=https://www.jp-eposcord-login.workers.dev/&client=webapp
IP
142.250.74.46:0
ASN
#15169 GOOGLE

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /translate?sl=auto&tl=ja&hl=ja&u=https://www.jp-eposcord-login.workers.dev/&client=webapp HTTP/1.1
Host: translate.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: SOCS=CAESHAgBEhJnd3NfMjAyMjA5MjktMF9SQzEaAnJvIAEaBgiAkvOZBg
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
content-type: application/binary
x-robots-tag: none
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Tue, 07 May 2024 17:16:20 GMT
location: https://www-jp--eposcord--login-workers-dev.translate.goog/?_x_tr_sl=auto&_x_tr_tl=ja&_x_tr_hl=ja&_x_tr_pto=wapp
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cross-origin-opener-policy: same-origin-allow-popups
server: ESF
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
set-cookie: __Secure-ENID=19.SE=EFbpwjPEp1qdyjW6e9XPJVBBF1u_VGjjboYAg6FtYynkBXsiXD22N8bPlXIQWTycVXjfZg89O34-Z7ALrd2RfmqglTkQzoQS9IQzUvLYUUlqvwea4YyUhZW4p5QUk-MHoQ1biDrIbPLr9xYPMMaSUByGXK-7rv5FFazByD7NcAg; expires=Sat, 07-Jun-2025 09:34:38 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

saison-6kkhihio.duckdns.org/

181.214.58.30

200 OK

332 B

URL User Request GET HTTP/2
saison-6kkhihio.duckdns.org/
IP
181.214.58.30:443
ASN
#201670 S.c. Infotech-Grup S.r.l.

Certificate
IssuerLet's Encrypt
Subjectsaison-0mkjio08.duckdns.org
Fingerprint02:DD:ED:3A:35:D8:47:8B:AA:C9:EF:AA:79:34:E4:1E:F1:E0:2D:45
ValidityTue, 30 Apr 2024 14:49:09 GMT - Mon, 29 Jul 2024 14:49:08 GMT

File type
HTML document, ASCII text, with very long lines (526)
Size
332 B (332 bytes)
Hash
ba19f40e9bb3acced28ce7030f27d786
c9156058b2b715674e72d1111d7cf6d1a5fa4aa3
6492bd9481cda8e4d59448a4797cf648024840f83d79fec786434405c3357d3b

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain

HTTP Headers

GET / HTTP/1.1
Host: saison-6kkhihio.duckdns.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www-jp--eposcord--login-workers-dev.translate.goog/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS, DELETE
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type, Accept-Language, Origin, Accept-Encoding
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
set-cookie: PHPSESSID=k708dll18nnvsv63o61pvdjddm; path=/
vary: Accept-Encoding
content-encoding: gzip
content-length: 332
content-type: text/html; charset=utf-8
date: Tue, 07 May 2024 17:16:22 GMT
server: Apache
X-Firefox-Spdy: h2

saison-6kkhihio.duckdns.org/static/css/app.0.139423457599183061714481498076.css

181.214.58.30

200 OK

19 kB

URL GET HTTP/2
saison-6kkhihio.duckdns.org/static/css/app.0.139423457599183061714481498076.css
IP
181.214.58.30:443
ASN
#201670 S.c. Infotech-Grup S.r.l.

Requested by
https://saison-6kkhihio.duckdns.org/
Certificate
IssuerLet's Encrypt
Subjectsaison-0mkjio08.duckdns.org
Fingerprint02:DD:ED:3A:35:D8:47:8B:AA:C9:EF:AA:79:34:E4:1E:F1:E0:2D:45
ValidityTue, 30 Apr 2024 14:49:09 GMT - Mon, 29 Jul 2024 14:49:08 GMT

File type
Unicode text, UTF-8 text, with very long lines (65532), with no line terminators
Size
19 kB (18626 bytes)
Hash
b06668a58a1c227f061d29a6c5a57a9a
a97d6455ad619f9e99a0c3ed7f3f60c11daca858
4f22e5703da7054558f36c0c653b188e04e4038b628c9ea62e856f451cc2b306

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain

HTTP Headers

GET /static/css/app.0.139423457599183061714481498076.css HTTP/1.1
Host: saison-6kkhihio.duckdns.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://saison-6kkhihio.duckdns.org/
Cookie: PHPSESSID=k708dll18nnvsv63o61pvdjddm
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
last-modified: Wed, 01 May 2024 04:51:46 GMT
etag: "2bb66-6175d3e5ddc80-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-length: 18626
content-type: text/css
date: Tue, 07 May 2024 17:16:22 GMT
server: Apache
X-Firefox-Spdy: h2

saison-6kkhihio.duckdns.org/static/js/app.0.38050786525053381714481498076.js

181.214.58.30

200 OK

1.2 kB

URL GET HTTP/2
saison-6kkhihio.duckdns.org/static/js/app.0.38050786525053381714481498076.js
IP
181.214.58.30:443
ASN
#201670 S.c. Infotech-Grup S.r.l.

Requested by
https://saison-6kkhihio.duckdns.org/
Certificate
IssuerLet's Encrypt
Subjectsaison-0mkjio08.duckdns.org
Fingerprint02:DD:ED:3A:35:D8:47:8B:AA:C9:EF:AA:79:34:E4:1E:F1:E0:2D:45
ValidityTue, 30 Apr 2024 14:49:09 GMT - Mon, 29 Jul 2024 14:49:08 GMT

File type
JavaScript source, Unicode text, UTF-8 text, with very long lines (3184), with no line terminators
Size
1.2 kB (1190 bytes)
Hash
68899670b0928c042853860e4b5fa48f
cf6628067fa933f8b9a9785ba84ebfc4c905af0c
81a409c5b190287e56aafff405528f844eb99a1081a1ed6619a0a217812adc66

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain

HTTP Headers

GET /static/js/app.0.38050786525053381714481498076.js HTTP/1.1
Host: saison-6kkhihio.duckdns.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://saison-6kkhihio.duckdns.org/
Cookie: PHPSESSID=k708dll18nnvsv63o61pvdjddm
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
last-modified: Wed, 01 May 2024 04:51:46 GMT
etag: "ca8-6175d3e5ddc80-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-length: 1190
content-type: text/javascript
date: Tue, 07 May 2024 17:16:22 GMT
server: Apache
X-Firefox-Spdy: h2

saison-6kkhihio.duckdns.org/static/js/7.0.97483056830314931714481498076.js

181.214.58.30

200 OK

736 B

URL GET HTTP/2
saison-6kkhihio.duckdns.org/static/js/7.0.97483056830314931714481498076.js
IP
181.214.58.30:443
ASN
#201670 S.c. Infotech-Grup S.r.l.

Requested by
https://saison-6kkhihio.duckdns.org/
Certificate
IssuerLet's Encrypt
Subjectsaison-0mkjio08.duckdns.org
Fingerprint02:DD:ED:3A:35:D8:47:8B:AA:C9:EF:AA:79:34:E4:1E:F1:E0:2D:45
ValidityTue, 30 Apr 2024 14:49:09 GMT - Mon, 29 Jul 2024 14:49:08 GMT

File type
JavaScript source, ASCII text, with CRLF line terminators
Size
736 B (736 bytes)
Hash
007b7486e6281dc80d94aae2f1aa3e3e
7f30a27bb438ff627d1244ed302b65cfffe75186
7de15ce578e40529bd762a559c78eeb7beda19ea2f9a4ae117756a025ae86fb0

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain

HTTP Headers

GET /static/js/7.0.97483056830314931714481498076.js HTTP/1.1
Host: saison-6kkhihio.duckdns.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://saison-6kkhihio.duckdns.org/
Cookie: PHPSESSID=k708dll18nnvsv63o61pvdjddm
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
last-modified: Sun, 05 May 2024 21:13:58 GMT
etag: "801-617bb6e5a5180-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-length: 736
content-type: text/javascript
date: Tue, 07 May 2024 17:16:23 GMT
server: Apache
X-Firefox-Spdy: h2

saison-6kkhihio.duckdns.org/favicon.ico

181.214.58.30

200 OK

1.8 kB

URL GET HTTP/2
saison-6kkhihio.duckdns.org/favicon.ico
IP
181.214.58.30:443
ASN
#201670 S.c. Infotech-Grup S.r.l.

Requested by
https://saison-6kkhihio.duckdns.org/
Certificate
IssuerLet's Encrypt
Subjectsaison-0mkjio08.duckdns.org
Fingerprint02:DD:ED:3A:35:D8:47:8B:AA:C9:EF:AA:79:34:E4:1E:F1:E0:2D:45
ValidityTue, 30 Apr 2024 14:49:09 GMT - Mon, 29 Jul 2024 14:49:08 GMT

File type
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Size
1.8 kB (1816 bytes)
Hash
00beb1ac87315274ade25894e4f7ed75
ee29490c77ab58be7de42773b695c1a82d0b603c
f23c8ae00c7c2f90abfde4e652983b83ef356d1e6cb2255c671cc48fd859f7f4

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: saison-6kkhihio.duckdns.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://saison-6kkhihio.duckdns.org/
Cookie: PHPSESSID=k708dll18nnvsv63o61pvdjddm
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
last-modified: Sat, 23 Sep 2023 21:51:38 GMT
etag: "704-6060dbac3ce80-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-length: 1816
content-type: image/x-icon
date: Tue, 07 May 2024 17:16:23 GMT
server: Apache
X-Firefox-Spdy: h2

saison-6kkhihio.duckdns.org/jump.php

181.214.58.30

403 Forbidden

0 B

URL GET HTTP/2
saison-6kkhihio.duckdns.org/jump.php
IP
181.214.58.30:443
ASN
#201670 S.c. Infotech-Grup S.r.l.

Requested by
https://saison-6kkhihio.duckdns.org/
Certificate
IssuerLet's Encrypt
Subjectsaison-0mkjio08.duckdns.org
Fingerprint02:DD:ED:3A:35:D8:47:8B:AA:C9:EF:AA:79:34:E4:1E:F1:E0:2D:45
ValidityTue, 30 Apr 2024 14:49:09 GMT - Mon, 29 Jul 2024 14:49:08 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain

HTTP Headers

GET /jump.php HTTP/1.1
Host: saison-6kkhihio.duckdns.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://saison-6kkhihio.duckdns.org/
Cookie: PHPSESSID=k708dll18nnvsv63o61pvdjddm
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 403 Forbidden
access-control-allow-origin: *
access-control-allow-methods: *
access-control-allow-credentials: true
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
content-length: 0
content-type: text/html;charset=utf-8
date: Tue, 07 May 2024 17:16:23 GMT
server: Apache
X-Firefox-Spdy: h2

saison-6kkhihio.duckdns.org/static/js/8.0.97483056830314931714481498076.js

181.214.58.30

200 OK

408 B

URL GET HTTP/2
saison-6kkhihio.duckdns.org/static/js/8.0.97483056830314931714481498076.js
IP
181.214.58.30:443
ASN
#201670 S.c. Infotech-Grup S.r.l.

Requested by
https://saison-6kkhihio.duckdns.org/
Certificate
IssuerLet's Encrypt
Subjectsaison-0mkjio08.duckdns.org
Fingerprint02:DD:ED:3A:35:D8:47:8B:AA:C9:EF:AA:79:34:E4:1E:F1:E0:2D:45
ValidityTue, 30 Apr 2024 14:49:09 GMT - Mon, 29 Jul 2024 14:49:08 GMT

File type
JavaScript source, ASCII text, with very long lines (672), with no line terminators
Size
408 B (408 bytes)
Hash
b0cc155abf44d51ced251712c4e9b048
60bbdd8ab6acc248a5cf1f578ac43cf58298592b
07c494cdbc193149b50b1fef9ea7ae94ea2512447dc15cc1cbb3c5278ecbe3df

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain

HTTP Headers

GET /static/js/8.0.97483056830314931714481498076.js HTTP/1.1
Host: saison-6kkhihio.duckdns.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://saison-6kkhihio.duckdns.org/
Cookie: PHPSESSID=k708dll18nnvsv63o61pvdjddm
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
last-modified: Wed, 01 May 2024 04:51:46 GMT
etag: "2a0-6175d3e5ddc80-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-length: 408
content-type: text/javascript
date: Tue, 07 May 2024 17:16:23 GMT
server: Apache
X-Firefox-Spdy: h2

saison-6kkhihio.duckdns.org/static/js/1714481498076.0.38050786525053381714481498076.js

181.214.58.30

200 OK

90 kB

URL GET HTTP/2
saison-6kkhihio.duckdns.org/static/js/1714481498076.0.38050786525053381714481498076.js
IP
181.214.58.30:443
ASN
#201670 S.c. Infotech-Grup S.r.l.

Requested by
https://saison-6kkhihio.duckdns.org/
Certificate
IssuerLet's Encrypt
Subjectsaison-0mkjio08.duckdns.org
Fingerprint02:DD:ED:3A:35:D8:47:8B:AA:C9:EF:AA:79:34:E4:1E:F1:E0:2D:45
ValidityTue, 30 Apr 2024 14:49:09 GMT - Mon, 29 Jul 2024 14:49:08 GMT

File type
gzip compressed data, from Unix
Size
90 kB (89705 bytes)
Hash
78f3541f10e4108ff01753248517905c
799b817b315653b3ad22eb3bba1ace87538dde12
5593876ad6d7727ae1f8a33f780e10f8ce9b4c9632113f5f25450704c0b13d54

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain

HTTP Headers

GET /static/js/1714481498076.0.38050786525053381714481498076.js HTTP/1.1
Host: saison-6kkhihio.duckdns.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://saison-6kkhihio.duckdns.org/
Cookie: PHPSESSID=k708dll18nnvsv63o61pvdjddm
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
last-modified: Wed, 01 May 2024 04:51:46 GMT
etag: "3aa96-6175d3e5ddc80-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/javascript
date: Tue, 07 May 2024 17:16:22 GMT
server: Apache
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (5)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (10)

URL

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size