Overview

URLzvlztmmmlf.duckdns.org/
IP 45.12.138.13 (United States)
ASN#35913 DEDIPATH-LLC
UserAgentMozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer
Report completed2022-10-17 18:38:00 UTC
StatusLoading report..
IDS alerts0
Blocklist alert21
urlquery alerts
13
DynDNS domain detected
Tags None

Domain Summary (12)

Fully Qualifying Domain Name Rank First Seen Last Seen IP Comment
www.nta.go.jp (1) 0 2022-06-02 22:30:28 UTC 2022-10-17 11:14:58 UTC 54.230.111.22 Domain (nta.go.jp) ranked at: 320855
firefox.settings.services.mozilla.com (2) 867 2020-06-04 20:08:41 UTC 2022-10-17 11:20:08 UTC 143.204.55.35
zvlztmmmlf.duckdns.org (12) 0 2022-09-26 07:13:18 UTC 2022-10-12 13:40:02 UTC 45.12.138.13 Unknown ranking
ocsp.digicert.com (1) 86 2012-05-21 07:02:23 UTC 2022-10-17 09:53:24 UTC 93.184.220.29
push.services.mozilla.com (1) 2140 2015-09-03 10:29:36 UTC 2022-10-17 04:45:36 UTC 34.215.56.181
img-getpocket.cdn.mozilla.net (6) 1631 2017-09-01 03:40:57 UTC 2022-10-17 10:52:10 UTC 34.120.237.76
ia.51.la (1) 59607 2017-10-31 08:01:51 UTC 2022-10-17 15:19:16 UTC 103.143.19.103
r3.o.lencr.org (8) 344 2020-12-02 08:52:13 UTC 2022-10-17 04:41:07 UTC 23.36.77.32
content-signature-2.cdn.mozilla.net (1) 1152 2020-11-03 12:26:46 UTC 2022-10-17 04:39:11 UTC 34.160.144.191
contile.services.mozilla.com (1) 1114 2021-05-27 18:32:35 UTC 2022-10-17 04:39:13 UTC 34.117.237.239
ocsp.globalsign.com (3) 2075 2012-05-25 06:20:55 UTC 2022-10-17 04:40:56 UTC 104.18.21.226
js.users.51.la (1) 53024 2012-05-30 15:10:11 UTC 2022-10-17 04:37:59 UTC 103.143.19.103

Network Intrusion Detection Systemsinfo

Suricata /w Emerging Threats Pro
 No alerts detected

Blocklists

OpenPhish
Scan Date Severity Indicator Comment
2022-09-26 2 zvlztmmmlf.duckdns.org/ National Tax Agency JAPAN
2022-09-26 2 zvlztmmmlf.duckdns.org/ National Tax Agency JAPAN
2022-09-26 2 zvlztmmmlf.duckdns.org/ National Tax Agency JAPAN
2022-09-26 2 zvlztmmmlf.duckdns.org/ National Tax Agency JAPAN
2022-09-26 2 zvlztmmmlf.duckdns.org/ National Tax Agency JAPAN
2022-09-26 2 zvlztmmmlf.duckdns.org/ National Tax Agency JAPAN
2022-09-26 2 zvlztmmmlf.duckdns.org/ National Tax Agency JAPAN
2022-09-26 2 zvlztmmmlf.duckdns.org/ National Tax Agency JAPAN
2022-09-26 2 zvlztmmmlf.duckdns.org/ National Tax Agency JAPAN
2022-09-26 2 zvlztmmmlf.duckdns.org/ National Tax Agency JAPAN

PhishTank
 No alerts detected

Fortinet's Web Filter
 No alerts detected

mnemonic secure dns
 No alerts detected

Quad9 DNS
Scan Date Severity Indicator Comment
2022-10-17 2 zvlztmmmlf.duckdns.org Sinkholed
2022-10-17 2 zvlztmmmlf.duckdns.org Sinkholed
2022-10-17 2 zvlztmmmlf.duckdns.org Sinkholed
2022-10-17 2 zvlztmmmlf.duckdns.org Sinkholed
2022-10-17 2 zvlztmmmlf.duckdns.org Sinkholed
2022-10-17 2 zvlztmmmlf.duckdns.org Sinkholed
2022-10-17 2 zvlztmmmlf.duckdns.org Sinkholed
2022-10-17 2 zvlztmmmlf.duckdns.org Sinkholed
2022-10-17 2 zvlztmmmlf.duckdns.org Sinkholed
2022-10-17 2 zvlztmmmlf.duckdns.org Sinkholed
2022-10-17 2 zvlztmmmlf.duckdns.org Sinkholed


Files

No files detected

Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 45.12.138.13
Date UQ / IDS / BL URL IP
2023-01-19 00:24:45 +0000 11 - 0 - 9 jmfonhercq.duckdns.org/ 45.12.138.13
2023-01-12 10:46:45 +0000 11 - 19 - 9 oytbgsfrff.duckdns.org/ 45.12.138.13
2023-01-12 10:46:29 +0000 11 - 19 - 9 orzfmqskxm.duckdns.org/ 45.12.138.13
2023-01-09 01:43:41 +0000 11 - 19 - 9 vxhvirunpm.duckdns.org/ 45.12.138.13
2023-01-07 18:38:41 +0000 11 - 19 - 9 ftmpnixfws.duckdns.org/ 45.12.138.13


Last 5 reports on ASN: DEDIPATH-LLC
Date UQ / IDS / BL URL IP
2023-02-03 22:53:11 +0000 4 - 7 - 1 rcmkwnxprm.duckdns.org/ 212.103.61.97
2023-02-03 22:26:48 +0000 5 - 7 - 7 jtwvmrgfvb.duckdns.org/ 64.94.211.101
2023-02-03 21:05:39 +0000 0 - 1 - 0 pakbond.com/downloads/windows/setup.exe 91.132.0.178
2023-02-03 18:35:30 +0000 5 - 7 - 0 whnxmjuzix.duckdns.org/ 64.94.211.101
2023-02-03 16:43:20 +0000 0 - 0 - 1 best.besttravelshack.com/iy78t67fstuygisus-is (...) 72.5.33.27


Last 3 reports on domain: zvlztmmmlf.duckdns.org
Date UQ / IDS / BL URL IP
2022-10-17 18:38:00 +0000 13 - 0 - 21 zvlztmmmlf.duckdns.org/ 45.12.138.13
2022-09-27 09:07:28 +0000 12 - 0 - 14 zvlztmmmlf.duckdns.org/ 45.12.138.13
2022-09-27 06:34:27 +0000 13 - 0 - 27 zvlztmmmlf.duckdns.org/ 45.12.138.13


Last 5 reports with similar screenshot
Date UQ / IDS / BL URL IP
2023-01-22 08:24:34 +0000 30 - 0 - 16 omaalqiion.duckdns.org/ 45.12.138.144
2023-01-22 08:21:53 +0000 30 - 0 - 16 myhrkoqavq.duckdns.org/ 45.12.138.144
2023-01-21 21:22:12 +0000 30 - 0 - 16 alcsewvqdk.duckdns.org/ 45.12.138.144
2023-01-21 20:00:12 +0000 30 - 0 - 16 jiqegntptc.duckdns.org/ 45.12.138.144
2023-01-21 18:39:32 +0000 27 - 0 - 15 omaalqiion.duckdns.org/ 45.12.138.144

JavaScript

Executed Scripts (5)

Executed Evals (0)

Executed Writes (0)


HTTP Transactions (38)


Request Response
                                        
                                            GET /v1/ HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         143.204.55.35
HTTP/1.1 200 OK
Content-Type: application/json
                                        
Content-Length: 939
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Type, Alert, Content-Length, Retry-After, Backoff
Cache-Control: max-age=3600
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Date: Mon, 17 Oct 2022 17:51:05 GMT
Expires: Mon, 17 Oct 2022 18:13:58 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
Via: 1.1 b9f0050ca4d212d7c855e005be54b1ac.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: GE-Fpg2pEBM7FlrryIo8MbFhtEdevjWKnP_xmQYBtn4QRgRMzCprsA==
Age: 2804


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size:   939
Md5:    bdb8b66c705a7b996496d780f50c00b5
Sha1:   403ae92039fcc933870f51f913f78ccaf9652256
Sha256: c923ed2539f4ce9f4d43743c402fbb2060a52a4cbedbf14c5f5742ab718073d6
                                        
                                            GET / HTTP/1.1 
Host: zvlztmmmlf.duckdns.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

search
                                         45.12.138.13
HTTP/1.1 301 Moved Permanently
Content-Type: text/html
                                        
Server: nginx
Date: Mon, 17 Oct 2022 18:37:49 GMT
Content-Length: 162
Connection: keep-alive
Location: https://zvlztmmmlf.duckdns.org/
Strict-Transport-Security: max-age=31536000


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Size:   162
Md5:    4f8e702cc244ec5d4de32740c0ecbd97
Sha1:   3adb1f02d5b6054de0046e367c1d687b6cdf7aff
Sha256: 9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a

Alerts:
  urlquery:
    - DynDNS domain detected
  Blocklists:
    - quad9: Sinkholed
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "25E13458988115AE1F8176CB2328DBFEBD612EABEBF256B4AF64594D5E23D6CA"
Last-Modified: Sat, 15 Oct 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11816
Expires: Mon, 17 Oct 2022 21:54:45 GMT
Date: Mon, 17 Oct 2022 18:37:49 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "0D1B73B2A228FE76BF14688E603741025A40803971E05570F873B28788334B33"
Last-Modified: Mon, 17 Oct 2022 14:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4954
Expires: Mon, 17 Oct 2022 20:00:23 GMT
Date: Mon, 17 Oct 2022 18:37:49 GMT
Connection: keep-alive

                                        
                                            GET /chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain HTTP/1.1 
Host: content-signature-2.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         34.160.144.191
HTTP/2 200 OK
content-type: binary/octet-stream
                                        
x-amz-id-2: rp6UvdONfTchGC5HFKeKpXKk5WtX90gpSvcmaF1pikhPYs5C6NLRshsQ8f7H+zauypKAshs/1SQ=
x-amz-request-id: 9G9YSSQZ2XJ4WS7H
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Mon, 17 Oct 2022 18:35:33 GMT
age: 136
last-modified: Fri, 30 Sep 2022 18:50:55 GMT
etag: "67d5a988edcda47bc3b3b3f65d32b4b6"
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PEM certificate\012- , ASCII text
Size:   5348
Md5:    67d5a988edcda47bc3b3b3f65d32b4b6
Sha1:   d4f0e0da8b3690cc7da925026d3414b68c7d954f
Sha256: 55e4848e3ec682e808ce7ee70950f86179c43af4f81926d826a95edfda395a78
                                        
                                            GET /v1/tiles HTTP/1.1 
Host: contile.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.117.237.239
HTTP/2 200 OK
content-type: application/json
                                        
server: nginx
date: Mon, 17 Oct 2022 18:37:49 GMT
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   12
Md5:    23e88fb7b99543fb33315b29b1fad9d6
Sha1:   a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
Sha256: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "A669C784910886BC3087C5B709D8470AA96494BB852D42CBC6188AD9E7E2C0BB"
Last-Modified: Sun, 16 Oct 2022 03:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=21596
Expires: Tue, 18 Oct 2022 00:37:45 GMT
Date: Mon, 17 Oct 2022 18:37:49 GMT
Connection: keep-alive

                                        
                                            GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         143.204.55.35
HTTP/1.1 200 OK
Content-Type: application/json
                                        
Content-Length: 329
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: ETag, Expires, Content-Length, Cache-Control, Pragma, Content-Type, Alert, Backoff, Last-Modified, Retry-After
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Last-Modified: Fri, 25 Mar 2022 17:45:46 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Date: Mon, 17 Oct 2022 18:07:43 GMT
Cache-Control: max-age=3600
Expires: Mon, 17 Oct 2022 19:03:15 GMT
ETag: "1648230346554"
X-Cache: Hit from cloudfront
Via: 1.1 142be88a35733307a5e7de05da0a20b8.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: 6Cik3qfmWdXlqKWeL8VGCvQ3MFzNvqJGWSYfSvnl2ogDR-h5ehlHWQ==
Age: 1806


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size:   329
Md5:    0333b0655111aa68de771adfcc4db243
Sha1:   63f295a144ac87a7c8e23417626724eeca68a7eb
Sha256: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
                                        
                                            GET /static/gs_vk/reset.css HTTP/1.1 
Host: zvlztmmmlf.duckdns.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://zvlztmmmlf.duckdns.org/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         45.12.138.13
HTTP/2 200 OK
content-type: text/css
                                        
server: nginx
date: Mon, 17 Oct 2022 18:37:49 GMT
content-length: 884
last-modified: Tue, 09 Aug 2022 08:07:50 GMT
etag: "62f215d6-374"
expires: Tue, 18 Oct 2022 06:37:49 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  CSV text\012- , ASCII text, with CRLF line terminators
Size:   884
Md5:    a77d6f26781539c015b1b1d84dac9c06
Sha1:   6f9e90a2e3c9f2bcb9337e577150bde1d3a29ccb
Sha256: e0e6a4ef211b0c936b3a38abe91cda1ebbbcc4a3c2d8e706ef7a1dc2c55427c3

Alerts:
  urlquery:
    - DynDNS domain detected
  Blocklists:
    - openphish: National Tax Agency JAPAN
    - quad9: Sinkholed
                                        
                                            GET /static/gs_vk/index.css HTTP/1.1 
Host: zvlztmmmlf.duckdns.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://zvlztmmmlf.duckdns.org/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         45.12.138.13
HTTP/2 200 OK
content-type: text/css
                                        
server: nginx
date: Mon, 17 Oct 2022 18:37:49 GMT
content-length: 748
last-modified: Tue, 09 Aug 2022 08:07:50 GMT
etag: "62f215d6-2ec"
expires: Tue, 18 Oct 2022 06:37:49 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text
Size:   748
Md5:    91692497e479f6cc955e4de6d627a499
Sha1:   bb57de5c2d4dafee21f66645d776d3064f4b79bd
Sha256: de36d3e9e989de40ae0bf5252af018ef55fdc0ed938042bdba11147f1127e431

Alerts:
  urlquery:
    - DynDNS domain detected
  Blocklists:
    - openphish: National Tax Agency JAPAN
    - quad9: Sinkholed
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 1637
Cache-Control: max-age=136574
Date: Mon, 17 Oct 2022 18:37:50 GMT
Etag: "634d0d17-1d7"
Expires: Wed, 19 Oct 2022 08:34:04 GMT
Last-Modified: Mon, 17 Oct 2022 08:06:47 GMT
Server: ECS (ska/F70E)
X-Cache: HIT
Content-Length: 471

                                        
                                            GET /static/gs_vk/logo.png HTTP/1.1 
Host: zvlztmmmlf.duckdns.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://zvlztmmmlf.duckdns.org/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         45.12.138.13
HTTP/2 200 OK
content-type: image/png
                                        
server: nginx
date: Mon, 17 Oct 2022 18:37:49 GMT
content-length: 2973
last-modified: Tue, 09 Aug 2022 08:07:50 GMT
etag: "62f215d6-b9d"
expires: Wed, 16 Nov 2022 18:37:49 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PNG image data, 275 x 29, 8-bit/color RGBA, non-interlaced\012- data
Size:   2973
Md5:    c6d404ecaa7646ff497deaad55392996
Sha1:   1c66c5caf35e3e633d1cb1e09a334362ad11f5fb
Sha256: bf1532dfb899554f52b0a98c2870c9a6f19e6abaf74288c6de321813fed91666

Alerts:
  urlquery:
    - DynDNS domain detected
  Blocklists:
    - openphish: National Tax Agency JAPAN
    - quad9: Sinkholed
                                        
                                            GET / HTTP/1.1 
Host: push.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: xqvyu+P43hQfHLq3hGqDBw==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

search
                                         34.215.56.181
HTTP/1.1 101 Switching Protocols
                                        
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: ia0Cg0cMjm5L7JSJ+B4pIugbAmE=

                                        
                                            GET /static/gs_vk/syozai_icon.png HTTP/1.1 
Host: zvlztmmmlf.duckdns.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://zvlztmmmlf.duckdns.org/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         45.12.138.13
HTTP/2 200 OK
content-type: image/png
                                        
server: nginx
date: Mon, 17 Oct 2022 18:37:49 GMT
content-length: 1297
last-modified: Tue, 09 Aug 2022 08:07:50 GMT
etag: "62f215d6-511"
expires: Wed, 16 Nov 2022 18:37:49 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PNG image data, 15 x 24, 8-bit/color RGBA, non-interlaced\012- data
Size:   1297
Md5:    d038e6e8e4472bbcf6e5dac6a23d5a0e
Sha1:   fce966980cd73b2d732e0081b7e8dc9751db160d
Sha256: 5aa0964ac2cb5cbb5823d166f55495ac12747f3fbf2b56f7d290ac161eb2aead

Alerts:
  urlquery:
    - DynDNS domain detected
  Blocklists:
    - openphish: National Tax Agency JAPAN
    - quad9: Sinkholed
                                        
                                            GET /static/gs_vk/index.png HTTP/1.1 
Host: zvlztmmmlf.duckdns.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://zvlztmmmlf.duckdns.org/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         45.12.138.13
HTTP/2 200 OK
content-type: image/png
                                        
server: nginx
date: Mon, 17 Oct 2022 18:37:49 GMT
content-length: 104029
last-modified: Tue, 09 Aug 2022 08:07:50 GMT
etag: "62f215d6-1965d"
expires: Wed, 16 Nov 2022 18:37:49 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 750x516, components 3\012- data
Size:   104029
Md5:    3b288cf2cf8b233a1f459e89dc209d79
Sha1:   08aa186779070d33edbca5dece75e2760dfa4065
Sha256: c0315642042bbc5f62714e1bf1ee5df4fd567a38745af3c67ff09b025a56efbb

Alerts:
  urlquery:
    - DynDNS domain detected
  Blocklists:
    - openphish: National Tax Agency JAPAN
                                        
                                            GET /static/gs_vk/banner.png HTTP/1.1 
Host: zvlztmmmlf.duckdns.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://zvlztmmmlf.duckdns.org/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         45.12.138.13
HTTP/2 200 OK
content-type: image/png
                                        
server: nginx
date: Mon, 17 Oct 2022 18:37:49 GMT
content-length: 220877
last-modified: Tue, 09 Aug 2022 08:07:50 GMT
etag: "62f215d6-35ecd"
expires: Wed, 16 Nov 2022 18:37:49 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PNG image data, 670 x 238, 8-bit/color RGB, non-interlaced\012- data
Size:   220877
Md5:    2f987a1099c7a986fa860cf0e80d7b5d
Sha1:   0a3e6dfbf3b0e7d361ba9fc088e2ef7805ec0310
Sha256: 2fe3b5cadeb4ad9fec7ee39d1f2170c6bb656436597087aa9a582713e53bed75

Alerts:
  urlquery:
    - DynDNS domain detected
  Blocklists:
    - openphish: National Tax Agency JAPAN
    - quad9: Sinkholed
                                        
                                            POST /gsgccr3dvtlsca2020 HTTP/1.1 
Host: ocsp.globalsign.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         104.18.21.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Mon, 17 Oct 2022 18:37:51 GMT
Content-Length: 1414
Connection: keep-alive
Expires: Fri, 21 Oct 2022 17:41:38 GMT
ETag: "07d2a19ad7cd52da795b38a65e8ad3c8dc7fb7f1"
Last-Modified: Mon, 17 Oct 2022 17:41:39 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: HIT
Age: 2929
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 75bb25dbc8c41c02-OSL


--- Additional Info ---
Magic:  data
Size:   1414
Md5:    06d3367b95c7ce927bfa1dfd30d24f8c
Sha1:   07d2a19ad7cd52da795b38a65e8ad3c8dc7fb7f1
Sha256: bee399183619705d475d8790520dba7a33f37a14349bdd9112d376a956034309
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "25C4798D1EF0730368CC5C6D41A4596C5C914865F6F7A4FAD97BDD4CE017894E"
Last-Modified: Sun, 16 Oct 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=13341
Expires: Mon, 17 Oct 2022 22:20:12 GMT
Date: Mon, 17 Oct 2022 18:37:51 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "25C4798D1EF0730368CC5C6D41A4596C5C914865F6F7A4FAD97BDD4CE017894E"
Last-Modified: Sun, 16 Oct 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=13341
Expires: Mon, 17 Oct 2022 22:20:12 GMT
Date: Mon, 17 Oct 2022 18:37:51 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "25C4798D1EF0730368CC5C6D41A4596C5C914865F6F7A4FAD97BDD4CE017894E"
Last-Modified: Sun, 16 Oct 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=13341
Expires: Mon, 17 Oct 2022 22:20:12 GMT
Date: Mon, 17 Oct 2022 18:37:51 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "25C4798D1EF0730368CC5C6D41A4596C5C914865F6F7A4FAD97BDD4CE017894E"
Last-Modified: Sun, 16 Oct 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=13341
Expires: Mon, 17 Oct 2022 22:20:12 GMT
Date: Mon, 17 Oct 2022 18:37:51 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "25C4798D1EF0730368CC5C6D41A4596C5C914865F6F7A4FAD97BDD4CE017894E"
Last-Modified: Sun, 16 Oct 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=13341
Expires: Mon, 17 Oct 2022 22:20:12 GMT
Date: Mon, 17 Oct 2022 18:37:51 GMT
Connection: keep-alive

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6da0eaa5-24ec-42bb-8269-d235104e844f.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 9623
x-amzn-requestid: b3d5bd8d-111b-4d50-9720-71f72c62f860
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: Z7Q8oFLRIAMFrEw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6347951d-613e5e810f420e4c0ba3e6f6;Sampled=0
x-amzn-remapped-date: Thu, 13 Oct 2022 04:33:33 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: OA9iHADyiam26eo88jYDECifkqeBaTjsuoeHD2YOy0aZJZEGhG-xow==
via: 1.1 0aebf3fe433ff96e68d785fad4ea4c0e.cloudfront.net (CloudFront), 1.1 6396e88c437c096ef98930ce29f731a2.cloudfront.net (CloudFront), 1.1 google
date: Sun, 16 Oct 2022 21:37:03 GMT
age: 75648
etag: "ce0f78803a81b1c6b3067c78b75bc6f1d5a7f7c1"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   9623
Md5:    440811a19987ddee099df289d9b61e79
Sha1:   ce0f78803a81b1c6b3067c78b75bc6f1d5a7f7c1
Sha256: 1309e9dcb36858de70ef82900ec1ad429fbb795ddb9823fd1c290b18f4e2c1a3
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ff4ae5b65-3d0a-4d73-8a6b-e8f407db78a1.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 5613
x-amzn-requestid: bffac0a6-d874-4928-838d-7f702ca7ae24
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: aHf5VGpJoAMFVNw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-634c79d5-2a58b7c6018952bc0967def4;Sampled=0
x-amzn-remapped-date: Sun, 16 Oct 2022 21:38:29 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: vBmUmkb1lqOcX03ln9YzL38v1HdvkWBwYjRnImNtnQYsgc5maPnlhQ==
via: 1.1 eece508272520f70691e4eebdc5a6dea.cloudfront.net (CloudFront), 1.1 09331f0822fc98eebaf04130a83dbd44.cloudfront.net (CloudFront), 1.1 google
date: Sun, 16 Oct 2022 22:10:15 GMT
age: 73656
etag: "0c7f5be7be8d6c21d0542eb4014d560eb0aae1ec"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   5613
Md5:    89156fccf0d7e65c0ac1467e63207bdb
Sha1:   0c7f5be7be8d6c21d0542eb4014d560eb0aae1ec
Sha256: 54316b96c831d7b77fffadb7a3c7a9370d6cbe59428f5ccf89490da25e40dd7f
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F89b2ee08-a53a-4763-aca2-fe23fd25f3d1.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 6367
x-amzn-requestid: 485c3cf9-d305-4540-8eef-8304d1103ccc
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: aEL5EHbOoAMFWsA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-634b26a0-2ac206d826bf23193740e74c;Sampled=0
x-amzn-remapped-date: Sat, 15 Oct 2022 21:31:12 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: FDpKbEtkkBwyl0pq3hI50XU9_5Qk43D5_CCq2mdq6phymrT0Op_wzg==
via: 1.1 c7c3cdef911c9ee3c1a83a78f425dc5a.cloudfront.net (CloudFront), 1.1 6396e88c437c096ef98930ce29f731a2.cloudfront.net (CloudFront), 1.1 google
date: Sun, 16 Oct 2022 21:50:24 GMT
age: 74847
etag: "9a305072cce8bb61ca3753bb98b999695fb4706e"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   6367
Md5:    df5f38c3dc43ccc382d0274bffb6b350
Sha1:   9a305072cce8bb61ca3753bb98b999695fb4706e
Sha256: 20ff21892e65787fecbadca0f59c05e54dee3a1359271839dab0ee5c9e796ab0
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F730763bb-3207-4921-9bea-b71a7356517b.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 9765
x-amzn-requestid: 7010796c-63dd-4e04-bc47-5920d33e81dd
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: aHf5PF4poAMFe3A=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-634c79d4-239c01c42ab711c553efa72b;Sampled=0
x-amzn-remapped-date: Sun, 16 Oct 2022 21:38:28 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: pKiFHHn-gV4tTJmRCJ7dk6JNUZcZbxw1y8DlNiXN9-ECozll_u1PQA==
via: 1.1 4dde8ec6d6c12741888c2d3a059d4a2e.cloudfront.net (CloudFront), 1.1 ee330666adf9f04c8c30094f8ddcd004.cloudfront.net (CloudFront), 1.1 google
date: Sun, 16 Oct 2022 21:50:12 GMT
age: 74859
etag: "04784a8026e1bfd22be9027337e24080dbf22b27"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   9765
Md5:    af4c7c0970c0ebf00c89be5612cd1baf
Sha1:   04784a8026e1bfd22be9027337e24080dbf22b27
Sha256: d919ce83ae2636ba64d9ed505611ee609c69720200cf580c8a57e1cbe6831681
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4e0224bc-3141-475c-88f3-48e2d36f204f.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 6352
x-amzn-requestid: c0479303-34b2-45d8-b794-4b83003312ef
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: aHjNXE81IAMFWaA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-634c7f22-702cee0d437cbdc349efa2e8;Sampled=0
x-amzn-remapped-date: Sun, 16 Oct 2022 22:01:06 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: eT73QK1fx-IvCFC2OGRnsLRxjaEkC2w-HZr5ri2D4NRBESTD5ktWrQ==
via: 1.1 efe54e8b68e074d39b2ecd249f85100a.cloudfront.net (CloudFront), 1.1 d01e7742f82df0bbc1fb681d709ed69c.cloudfront.net (CloudFront), 1.1 google
date: Sun, 16 Oct 2022 22:23:46 GMT
age: 72845
etag: "577a22b126e54bfe0e4e4ce26b0fb866bc7fe007"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   6352
Md5:    ddd17c7d44a2e136710171f237ded665
Sha1:   577a22b126e54bfe0e4e4ce26b0fb866bc7fe007
Sha256: b1327c4f33db5488ae49b1c2f7d5b49804d4245fd0bd92c41005b9045281f2a2
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F57cc9e14-e4d3-48c4-a056-d13d96008e85.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 1533742
x-amzn-requestid: 08622fbf-b5da-463d-93b0-2658eec7f963
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: Z7EhKFDKIAMFS3g=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6347813a-1fe827a352aced1614638272;Sampled=0
x-amzn-remapped-date: Thu, 13 Oct 2022 03:08:42 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: tURfDDYAWPP1lNDt0zEjlfl0On0v9_jOlaOM5491WSjY4UFvETM0pA==
via: 1.1 112c6b3f9aea37a6cb00b7d933e5af6e.cloudfront.net (CloudFront), 1.1 28390a4d24ed4fdccd685d99cd06cf4e.cloudfront.net (CloudFront), 1.1 google
date: Mon, 17 Oct 2022 13:57:16 GMT
age: 16835
etag: "07ca0730cfbb059faa84051c37c06b7309c0f40d"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   1533742
Md5:    78bccc731d9aec529604e6a78f8dd62a
Sha1:   07ca0730cfbb059faa84051c37c06b7309c0f40d
Sha256: 68b235ce9ced657a6b05e4b2761f8f089951fbc66ba56555350328d6fdbb28c7
                                        
                                            GET /21240581.js HTTP/1.1 
Host: js.users.51.la
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://zvlztmmmlf.duckdns.org/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         103.143.19.103
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                        
Server: CloudWAF
Date: Mon, 17 Oct 2022 18:37:51 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: HWWAFSESID=281ad238e8cd2a95ef4; path=/ HWWAFSESTIME=1666031869855; path=/
Cache-Control: max-age=360000
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Content-Encoding: gzip


--- Additional Info ---
Magic:  ASCII text, with very long lines (4898)
Size:   2310
Md5:    648d332a1a1b5037f4e0ebc4a16255e5
Sha1:   5238cd54b0126b54bd371267320e9854a1930491
Sha256: 07d02a0148b6511022ea5ba02eab78bf74dc6d6540974b4fcc6319d43ef67495
                                        
                                            POST /gsrsaovsslca2018 HTTP/1.1 
Host: ocsp.globalsign.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         104.18.21.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Mon, 17 Oct 2022 18:37:51 GMT
Content-Length: 1432
Connection: keep-alive
Expires: Fri, 21 Oct 2022 15:24:19 GMT
ETag: "6efd3370c07646b8adb1134946871632a577ca61"
Last-Modified: Mon, 17 Oct 2022 15:24:20 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: HIT
Age: 2991
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 75bb25dfddfb1c02-OSL


--- Additional Info ---
Magic:  data
Size:   1432
Md5:    e7ce90315b90b45be18c6cde96ae3dd9
Sha1:   6efd3370c07646b8adb1134946871632a577ca61
Sha256: 9541df4fad24c721f81f7fbc4e56850cf4df9b70b973b160be774812dce5b17c
                                        
                                            GET /template/img/template/headerbackground.jpg HTTP/1.1 
Host: www.nta.go.jp
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://zvlztmmmlf.duckdns.org/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         54.230.111.22
HTTP/2 200 OK
content-type: image/jpeg
                                        
content-length: 29881
server: Apache
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
last-modified: Fri, 30 Mar 2018 05:48:34 GMT
accept-ranges: bytes
date: Mon, 17 Oct 2022 18:37:36 GMT
etag: "74b9-5689aca6dd080"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 a343e36742f64defd0a2caf1f96ff772.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: u9kqR3aiIzZg63OXQ_6f5Z0CLfnnJcZfUnzMipFox_0sSJhmDN-fnA==
age: 16
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 980x113, components 3\012- data
Size:   29881
Md5:    e5e2087ec026ba50dceab21313cde200
Sha1:   32528b75731905a34f01e6b4cdf3937f72c4098f
Sha256: 9f7bcb50485acc2487f525f5d0d49bf0e3c239ee0150685a621b7e84d67818c7
                                        
                                            GET /favicon.ico HTTP/1.1 
Host: zvlztmmmlf.duckdns.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://zvlztmmmlf.duckdns.org/
Cookie: __tins__21240581=%7B%22sid%22%3A%201666031877439%2C%20%22vd%22%3A%201%2C%20%22expires%22%3A%201666033677439%7D; __51cke__=; __51laig__=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         45.12.138.13
HTTP/2 404 Not Found
content-type: text/html
                                        
server: nginx
date: Mon, 17 Oct 2022 18:37:52 GMT
content-length: 146
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Size:   146
Md5:    8eec510e57f5f732fd2cce73df7b73ef
Sha1:   3c0af39ecb3753c5fee3b53d063c7286019eac3b
Sha256: 55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0

Alerts:
  urlquery:
    - DynDNS domain detected
  Blocklists:
    - openphish: National Tax Agency JAPAN
    - quad9: Sinkholed
                                        
                                            POST /gsgccr3dvtlsca2020 HTTP/1.1 
Host: ocsp.globalsign.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         104.18.21.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Mon, 17 Oct 2022 18:37:52 GMT
Content-Length: 1414
Connection: keep-alive
Expires: Fri, 21 Oct 2022 16:17:18 GMT
ETag: "a658ca58c6a23aa9fea22fe56aa317b047873aa7"
Last-Modified: Mon, 17 Oct 2022 16:17:19 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: HIT
Age: 284
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 75bb25e52bf41c02-OSL


--- Additional Info ---
Magic:  data
Size:   1414
Md5:    6390f91a6bc22e1905d3e7c3cb7fc42d
Sha1:   a658ca58c6a23aa9fea22fe56aa317b047873aa7
Sha256: 95dc0588a7f33f9afa8131b2f2ad8554a96480e2c9ac9ee2dd68ddea1434c199
                                        
                                            GET /go1?id=21240581&rt=1666031877439&rl=1280*1024&lang=en-US&ct=unknow&pf=1&ins=1&vd=1&ce=1&cd=24&ds=&ing=1&ekc=&sid=1666031877439&tt=&kw=&cu=https%253A%252F%252Fzvlztmmmlf.duckdns.org%252F&pu= HTTP/1.1 
Host: ia.51.la
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://zvlztmmmlf.duckdns.org/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         103.143.19.103
HTTP/1.1 200
                                        
Server: CloudWAF
Date: Mon, 17 Oct 2022 18:37:53 GMT
Content-Length: 0
Connection: keep-alive
Set-Cookie: HWWAFSESID=70cd41bdf52ea52c444; path=/ HWWAFSESTIME=1666031872097; path=/

                                        
                                            GET / HTTP/1.1 
Host: zvlztmmmlf.duckdns.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

search
                                         45.12.138.13
HTTP/2 200 OK
content-type: text/html
                                        
server: nginx
date: Mon, 17 Oct 2022 18:37:49 GMT
last-modified: Thu, 22 Sep 2022 08:30:24 GMT
vary: Accept-Encoding
etag: W/"632c1d20-f3f"
strict-transport-security: max-age=31536000
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---

Alerts:
  urlquery:
    - DynDNS domain detected
  Blocklists:
    - quad9: Sinkholed
                                        
                                            GET /static/gs_vk/public.css HTTP/1.1 
Host: zvlztmmmlf.duckdns.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://zvlztmmmlf.duckdns.org/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         45.12.138.13
HTTP/2 200 OK
content-type: text/css
                                        
server: nginx
date: Mon, 17 Oct 2022 18:37:49 GMT
last-modified: Tue, 09 Aug 2022 08:07:50 GMT
vary: Accept-Encoding
etag: W/"62f215d6-818"
expires: Tue, 18 Oct 2022 06:37:49 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---

Alerts:
  urlquery:
    - DynDNS domain detected
  Blocklists:
    - openphish: National Tax Agency JAPAN
    - quad9: Sinkholed
                                        
                                            GET /static/js/jquery-3.3.1.min.js HTTP/1.1 
Host: zvlztmmmlf.duckdns.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://zvlztmmmlf.duckdns.org/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         45.12.138.13
HTTP/2 200 OK
content-type: application/javascript
                                        
server: nginx
date: Mon, 17 Oct 2022 18:37:49 GMT
last-modified: Thu, 17 Mar 2022 06:46:08 GMT
vary: Accept-Encoding
etag: W/"6232d930-1538f"
expires: Tue, 18 Oct 2022 06:37:49 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---

Alerts:
  urlquery:
    - DynDNS domain detected
  Blocklists:
    - openphish: National Tax Agency JAPAN
    - quad9: Sinkholed
                                        
                                            GET /static/js/jquery.cookie.js HTTP/1.1 
Host: zvlztmmmlf.duckdns.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://zvlztmmmlf.duckdns.org/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         45.12.138.13
HTTP/2 200 OK
content-type: application/javascript
                                        
server: nginx
date: Mon, 17 Oct 2022 18:37:49 GMT
last-modified: Thu, 17 Mar 2022 06:46:08 GMT
vary: Accept-Encoding
etag: W/"6232d930-c31"
expires: Tue, 18 Oct 2022 06:37:49 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---

Alerts:
  urlquery:
    - DynDNS domain detected
  Blocklists:
    - openphish: National Tax Agency JAPAN
    - quad9: Sinkholed