Overview

URLgjwzmlgxbt.duckdns.org/
IP 103.169.91.217 (Malaysia)
ASN#0
UserAgentMozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer
Access public lock_open
Report completed2023-03-17 12:38:33 UTC
StatusLoading report..
IDS alerts7
Blocklist alert0
urlquery alerts
25
Phishing - Japan's Tax Agency
Suspicious - DynDNS domain
Tags government tax japan phishing dyndns

Domain Summary (8)

Fully Qualifying Domain Name Rank First Seen Last Seen Sent bytes Received bytes IP Comment
r3.o.lencr.org (8) 344 2020-12-02T09:52:13Z 2023-03-25T18:12:03Z 2704 7090 23.36.77.32
firefox.settings.services.mozilla.com (2) 867 2020-06-04T22:08:41Z 2023-03-25T18:14:26Z 782 2373 35.241.9.150
content-signature-2.cdn.mozilla.net (1) 1152 2020-11-03T13:26:46Z 2023-03-26T05:11:12Z 413 5881 34.160.144.191
contile.services.mozilla.com (1) 1114 2021-05-27T20:32:35Z 2023-03-26T05:11:59Z 333 391 34.117.237.239
gjwzmlgxbt.duckdns.org (11) 0 2023-03-09T08:08:49Z 2023-03-17T10:05:26Z 5007 374795 103.169.91.217
push.services.mozilla.com (1) 2140 2014-10-24T10:27:06Z 2023-03-26T05:10:29Z 606 127 35.163.227.146
img-getpocket.cdn.mozilla.net (6) 1631 2018-06-22T01:36:00Z 2023-03-26T05:09:08Z 3245 47001 34.120.237.76
www.nta.go.jp (1) 0 2022-06-02T17:52:52Z 2023-03-24T01:04:47Z 419 36238 54.230.111.115

Network Intrusion Detection Systemsinfo

Suricata /w Emerging Threats Pro
Timestamp Severity Source IP Destination IP Alert
2023-03-17 12:38:22 UTC medium Client IP Internal IP ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain 
2023-03-17 12:38:22 UTC medium Client IP Internal IP ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain 
2023-03-17 12:38:22 UTC low Client IP Internal IP ET INFO DYNAMIC_DNS Query to *.duckdns. Domain 
2023-03-17 12:38:22 UTC low Client IP Internal IP ET INFO DYNAMIC_DNS Query to *.duckdns. Domain 
2023-03-17 12:38:23 UTC medium Client IP  103.169.91.217 ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain 
2023-03-17 12:38:23 UTC medium Client IP Internal IP ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain 
2023-03-17 12:38:23 UTC low Client IP Internal IP ET INFO DYNAMIC_DNS Query to *.duckdns. Domain 

Blocklists

OpenPhish
 No alerts detected

PhishTank
 No alerts detected

Fortinet's Web Filter
 No alerts detected

mnemonic secure dns
 No alerts detected

Quad9 DNS
 No alerts detected

ThreatFox
 No alerts detected


Files

No files detected

Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 103.169.91.217
Date UQ / IDS / BL URL IP
2023-04-01 11:42:38 UTC 29 - 7 - 5 fitpwfzovn.duckdns.org/ 103.169.91.217
2023-03-17 12:38:33 UTC 25 - 7 - 0 gjwzmlgxbt.duckdns.org/ 103.169.91.217
2023-03-17 12:38:29 UTC 28 - 7 - 0 xnmsizrfao.duckdns.org/ 103.169.91.217
2023-03-17 12:11:09 UTC 29 - 7 - 0 vhfcdiewkh.duckdns.org/ 103.169.91.217
2023-03-17 10:09:25 UTC 28 - 7 - 0 vtsnoqldzv.duckdns.org/ 103.169.91.217


Last 5 reports on ASN:
Date UQ / IDS / BL URL IP
2023-06-09 04:14:27 UTC 0 - 1 - 0 www.messiah.edu/ 199.254.158.2
2023-06-09 04:00:27 UTC 0 - 0 - 2 5132014.installic.com/o/skypetalk/setup.exe 154.203.134.164
2023-06-09 03:45:27 UTC 0 - 0 - 1 iopnn.xyz/ 43.163.233.79
2023-06-09 03:42:18 UTC 0 - 0 - 1 gghmm.xyz/ 43.163.233.79
2023-06-09 03:40:49 UTC 0 - 0 - 1 ioptt.xyz/ 43.163.233.79


Last 1 reports on domain: gjwzmlgxbt.duckdns.org
Date UQ / IDS / BL URL IP
2023-03-17 12:38:33 UTC 25 - 7 - 0 gjwzmlgxbt.duckdns.org/ 103.169.91.217


Last 5 reports with similar screenshot
Date UQ / IDS / BL URL IP
2023-04-01 17:37:55 UTC 29 - 7 - 5 pocsezubgj.duckdns.org/ 64.15.75.85
2023-04-01 14:37:14 UTC 28 - 7 - 4 gcceohbdrs.duckdns.org/ 64.15.75.85
2023-04-01 13:29:18 UTC 29 - 7 - 5 yymtkjgind.duckdns.org/ 130.0.232.99
2023-04-01 11:42:38 UTC 29 - 7 - 5 fitpwfzovn.duckdns.org/ 103.169.91.217
2023-03-17 14:34:19 UTC 29 - 7 - 0 ucueaqtqze.duckdns.org/ 130.0.232.99

JavaScript

Executed Scripts (6)

Executed Evals (0)

Executed Writes (0)


HTTP Transactions (31)


Request Response
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "70B5BB76774526A0CF131445AE2F8639085C3449812497DF457F4BC78089917B"
Last-Modified: Wed, 15 Mar 2023 02:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15074
Expires: Fri, 17 Mar 2023 16:49:37 GMT
Date: Fri, 17 Mar 2023 12:38:23 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "0BC80613F3D493EA081BF5672AB76F6F33A1DCC0710FE1431DE83C46D7E8D31D"
Last-Modified: Fri, 17 Mar 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3612
Expires: Fri, 17 Mar 2023 13:38:35 GMT
Date: Fri, 17 Mar 2023 12:38:23 GMT
Connection: keep-alive

                                        
                                            GET /v1/ HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             35.241.9.150
HTTP/2 200 OK
content-type: application/json
                                            
access-control-allow-origin: *
access-control-expose-headers: Retry-After, Backoff, Alert, Content-Length, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Fri, 17 Mar 2023 12:26:42 GMT
age: 701
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size:   939
Md5:    84db75194692d4afe13196bda6f22da8
Sha1:   4c1f49bc973a4917f146d93c8d598344edc021f6
Sha256: a3bec66f95b3bdf1d310c726e8ed05f7b06c1901c62381a94582d581844d2c23
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "BB7622A85D32CBFF40ABD2995055E03DBAC05DD841B9A84D9023A5510D89E534"
Last-Modified: Fri, 17 Mar 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4768
Expires: Fri, 17 Mar 2023 13:57:51 GMT
Date: Fri, 17 Mar 2023 12:38:23 GMT
Connection: keep-alive

                                        
                                            GET /chains/remote-settings.content-signature.mozilla.org-2023-04-09-20-28-26.chain HTTP/1.1 
Host: content-signature-2.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             34.160.144.191
HTTP/2 200 OK
content-type: binary/octet-stream
                                            
x-amz-id-2: WZ1y4w76bMuJ+G/fKE1z6iS0OnPzv+QpaObWZqudrRfGBPXV/rJshEQQiliBtJJ3O1+sURCZS1g=
x-amz-request-id: KSSGJJM49F8R52SX
x-amz-server-side-encryption: AES256
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Fri, 17 Mar 2023 12:23:37 GMT
age: 886
last-modified: Sat, 18 Feb 2023 20:28:27 GMT
etag: "b5ba6334e73496995e3e3a9ecd0eb323"
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PEM certificate\012- , ASCII text
Size:   5348
Md5:    b5ba6334e73496995e3e3a9ecd0eb323
Sha1:   ad80d3b7718c28364e8c2004fb38a13a1747e462
Sha256: aa5abb52515c6383c014aadb63a86c9f798ad64de53c0218616c1fc6d424d2e2
                                        
                                            GET /v1/tiles HTTP/1.1 
Host: contile.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.117.237.239
HTTP/2 200 OK
content-type: application/json
                                            
server: nginx
date: Fri, 17 Mar 2023 12:38:23 GMT
content-length: 12
access-control-expose-headers: content-type
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-credentials: true
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   12
Md5:    23e88fb7b99543fb33315b29b1fad9d6
Sha1:   a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
Sha256: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
                                        
                                            GET / HTTP/1.1 
Host: gjwzmlgxbt.duckdns.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

                                        
                                             103.169.91.217
HTTP/1.1 301 Moved Permanently
Content-Type: text/html
                                            
Server: nginx
Date: Fri, 17 Mar 2023 12:38:23 GMT
Content-Length: 162
Connection: keep-alive
Location: https://gjwzmlgxbt.duckdns.org/
Strict-Transport-Security: max-age=31536000


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Size:   162
Md5:    4f8e702cc244ec5d4de32740c0ecbd97
Sha1:   3adb1f02d5b6054de0046e367c1d687b6cdf7aff
Sha256: 9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a

urlquery:
  - Phishing - Japan's Tax Agency
  - Phishing - Japan's Tax Agency
  - Suspicious - DynDNS domain
IDS:
  - ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
                                        
                                            GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             35.241.9.150
HTTP/2 200 OK
content-type: application/json
                                            
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Retry-After, Last-Modified, Content-Length, Pragma, Expires, ETag, Backoff, Alert, Cache-Control
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Fri, 17 Mar 2023 12:14:32 GMT
age: 1431
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size:   329
Md5:    0333b0655111aa68de771adfcc4db243
Sha1:   63f295a144ac87a7c8e23417626724eeca68a7eb
Sha256: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "5DB17BB0A40658845E03D8237A69458A0576D955006EE224930B0310179AF9AF"
Last-Modified: Fri, 17 Mar 2023 06:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4572
Expires: Fri, 17 Mar 2023 13:54:35 GMT
Date: Fri, 17 Mar 2023 12:38:23 GMT
Connection: keep-alive

                                        
                                            GET / HTTP/1.1 
Host: push.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: bpQfxhgpK+XMMGtOAjyTGA==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

                                        
                                             35.163.227.146
HTTP/1.1 101 Switching Protocols
                                            
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: Lhczyt8XEMkh8rdpl0Ygki2PHcc=

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "920778735CFB5F0395BBFA1391CB4E90C547D455CAC77C8BB161A0C3B55A6A3F"
Last-Modified: Thu, 16 Mar 2023 15:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3758
Expires: Fri, 17 Mar 2023 13:41:03 GMT
Date: Fri, 17 Mar 2023 12:38:25 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "920778735CFB5F0395BBFA1391CB4E90C547D455CAC77C8BB161A0C3B55A6A3F"
Last-Modified: Thu, 16 Mar 2023 15:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3758
Expires: Fri, 17 Mar 2023 13:41:03 GMT
Date: Fri, 17 Mar 2023 12:38:25 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "920778735CFB5F0395BBFA1391CB4E90C547D455CAC77C8BB161A0C3B55A6A3F"
Last-Modified: Thu, 16 Mar 2023 15:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3758
Expires: Fri, 17 Mar 2023 13:41:03 GMT
Date: Fri, 17 Mar 2023 12:38:25 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "A1D63B230095B1824D8EDA3E04AE792C2ECA4171FBBE4AAB0A505D4E1EF58547"
Last-Modified: Fri, 17 Mar 2023 03:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10393
Expires: Fri, 17 Mar 2023 15:31:38 GMT
Date: Fri, 17 Mar 2023 12:38:25 GMT
Connection: keep-alive

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa6272d07-0ccd-41ba-a86f-72932f0783bd.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 5828
x-amzn-requestid: 8361aeb7-1c8a-491d-b50d-59b3d6a061ab
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: B5K4lGhXIAMFlFA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-64138b69-7b1d2aa5075294e04d976ad9;Sampled=0
x-amzn-remapped-date: Thu, 16 Mar 2023 21:34:33 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C3
x-cache: Hit from cloudfront
x-amz-cf-id: VYAI-v5_r6-RO5c5aTrA4JJnM1iRUtwDL349__B7TVNKYs_XqfiEhA==
via: 1.1 41e349e25dc4bc856d0e5d2c162428a0.cloudfront.net (CloudFront), 1.1 618052a0d9c86c1a3bf663f82d041d1c.cloudfront.net (CloudFront), 1.1 google
date: Thu, 16 Mar 2023 22:06:15 GMT
age: 52330
etag: "280fe711e384d60749c6225ddcc7f57c48845719"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   5828
Md5:    05b82ec8d7e99e9499e8b5a980008c60
Sha1:   280fe711e384d60749c6225ddcc7f57c48845719
Sha256: 305b82d6aa40f5af58100de5007ac484c73c0a49ab7c5715b8ab6e83e10270f1
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fafa24301-1030-4c4f-989c-e2b17d183b89.webp HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 5823
x-amzn-requestid: e80767f3-f9d5-4617-841c-0ff537e127f9
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: B2oz2EdsIAMFVIw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-64128818-1ac71964287b5c9431cb9264;Sampled=0
x-amzn-remapped-date: Thu, 16 Mar 2023 03:08:08 GMT
x-amz-cf-pop: SEA19-C3
x-cache: Hit from cloudfront
x-amz-cf-id: MnNSoeWgZ3xQgnZq7b579WZ6wD61BPS_JEOkfjxfk0DHifilHeYveQ==
via: 1.1 eece508272520f70691e4eebdc5a6dea.cloudfront.net (CloudFront), 1.1 abbf2df97f9d83839470842dc2e68cb6.cloudfront.net (CloudFront), 1.1 google
date: Fri, 17 Mar 2023 04:14:07 GMT
age: 30258
etag: "d3e35ffefb1fb7463f0f4eedd6a83577dc73523a"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   5823
Md5:    558d071f9fca9b78c603772983479a2e
Sha1:   d3e35ffefb1fb7463f0f4eedd6a83577dc73523a
Sha256: 03a98d89ba218aead77e6c2470bc74840b05515e9e6c14cad12ae952974a845d
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F397a8aa0-cc33-491d-803e-2517ee9a86ba.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 6483
x-amzn-requestid: 00810211-292c-4582-9284-a6cfa962eda0
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: B3M7qF-FoAMFwSg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6412c1e3-60e04c44525865212d4064f4;Sampled=0
x-amzn-remapped-date: Thu, 16 Mar 2023 07:14:43 GMT
x-amz-cf-pop: SEA19-C3
x-cache: Miss from cloudfront
x-amz-cf-id: E7RFX-BFAoKMAtYyjUsU4fGclHQi96Uc8oaRrZjgcPOVA2GTD_JqYg==
via: 1.1 7f5e0d3b9ea85d0d75063a66c0ebc840.cloudfront.net (CloudFront), 1.1 5c35539543902c678280929df206948c.cloudfront.net (CloudFront), 1.1 google
date: Thu, 16 Mar 2023 21:53:22 GMT
age: 53103
etag: "9e30c5a51a00dd2e64d40a64f109870bb23f2f9e"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   6483
Md5:    b8ba7fb2c4aa96cbff91c044c37cf908
Sha1:   9e30c5a51a00dd2e64d40a64f109870bb23f2f9e
Sha256: 72890df12fd731f311fffa0b9ae8e1620104cab15379c3b41832855e28d854ce
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F32661b66-c29d-4fb2-8a6d-e8d32af65c0c.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 6291
x-amzn-requestid: 55afe02a-821a-48a1-ab71-77d42ae4adf8
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: B3lUdFqIoAMFQqg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6412e8e9-7f5e230e44eac3b31e963b38;Sampled=0
x-amzn-remapped-date: Thu, 16 Mar 2023 10:01:13 GMT
x-amz-cf-pop: SEA19-C3
x-cache: Miss from cloudfront
x-amz-cf-id: 7OQVogzC2etvZVgTCnc4vf3SnOuKRE0ouTzDK-vWZlzExAraw_Bwhg==
via: 1.1 28a7186077f9b5270d98dd053f31303e.cloudfront.net (CloudFront), 1.1 6af3b573d8970d5db2a4d03354335b84.cloudfront.net (CloudFront), 1.1 google
date: Thu, 16 Mar 2023 13:50:51 GMT
age: 82054
etag: "5114fb56e5d9847562d2c493dbe684ee1057ffba"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   6291
Md5:    b237b4b09287ed50ed4b41b5a4bfb339
Sha1:   5114fb56e5d9847562d2c493dbe684ee1057ffba
Sha256: a78555499f140649e47a5c0a561f36a8002abbceb2ab13189e91faefa6dd298c
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F8afa2cdb-a5f3-4c78-a2ab-132c8b752b4b.png HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 10338
x-amzn-requestid: 9f880b5b-056c-44bb-a811-36ea27c232aa
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: BvSgFGENoAMFuVw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-640f9799-2318d444248f7610300c658f;Sampled=0
x-amzn-remapped-date: Mon, 13 Mar 2023 21:37:29 GMT
x-amz-cf-pop: SEA19-C3
x-cache: Hit from cloudfront
x-amz-cf-id: bka10YWXvoKBRkwgvJNMzm1SSv_J1USzdugO9lPduHxe2uYFYkXh4w==
via: 1.1 2dc111aa3ead15d061e41a423155a53a.cloudfront.net (CloudFront), 1.1 e11ee4e3208082d534c251b36bbee268.cloudfront.net (CloudFront), 1.1 google
date: Fri, 17 Mar 2023 07:02:34 GMT
age: 20151
etag: "80519bb3726ee1f9f211344cd433cefaed3a7f2e"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   10338
Md5:    78453ba98b72eff3879ef163b59c86ed
Sha1:   80519bb3726ee1f9f211344cd433cefaed3a7f2e
Sha256: 61adfeff11af9583355ac7d1500e8a8d97357b2846f151f2421001994fb06655
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F283cce37-c692-4203-ad27-597093d4e1d7.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 5906
x-amzn-requestid: 81b47546-f999-40fc-887b-1f8e3d9e49b0
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: Bz5_JGH2oAMF_Mg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-64117060-303925a47d9431f63bf5afaa;Sampled=0
x-amzn-remapped-date: Wed, 15 Mar 2023 07:14:40 GMT
x-amz-cf-pop: SEA19-C3
x-cache: Miss from cloudfront
x-amz-cf-id: yhJQJKgvv9AxHjr1CFyDo6t5owgihxDs9W-HLMSV2bOb32s8KFFkAw==
via: 1.1 0c96ded7ff282d2dbcf47c918b6bb500.cloudfront.net (CloudFront), 1.1 2c6b5dd77f1abe60653ce0454f344b64.cloudfront.net (CloudFront), 1.1 google
date: Fri, 17 Mar 2023 01:19:03 GMT
age: 40762
etag: "b06c689355301378aedbe12d01782debc8e2559e"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   5906
Md5:    ab1194f894e79ce8de9c4a02925415e8
Sha1:   b06c689355301378aedbe12d01782debc8e2559e
Sha256: 1113a17eb74f317f3879f781f7b2fcb86f7e7da9ff6e18b44288f379cd5a21c2
                                        
                                            GET /static/gs_vk/reset.css HTTP/1.1 
Host: gjwzmlgxbt.duckdns.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://gjwzmlgxbt.duckdns.org/
Cookie: sessionid=22f60315f31f1e63b33be5c58c0e25b2
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        
                                             103.169.91.217
HTTP/2 200 OK
content-type: text/css; charset=utf-8
                                            
server: nginx
date: Fri, 17 Mar 2023 12:38:26 GMT
content-length: 884
last-modified: Tue, 09 Aug 2022 08:07:52 GMT
expires: Sun, 16 Apr 2023 12:38:26 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  CSV text\012- , ASCII text, with CRLF line terminators
Size:   884
Md5:    a77d6f26781539c015b1b1d84dac9c06
Sha1:   6f9e90a2e3c9f2bcb9337e577150bde1d3a29ccb
Sha256: e0e6a4ef211b0c936b3a38abe91cda1ebbbcc4a3c2d8e706ef7a1dc2c55427c3

urlquery:
  - Phishing - Japan's Tax Agency
  - Phishing - Japan's Tax Agency
  - Suspicious - DynDNS domain
                                        
                                            GET /static/gs_vk/index.css HTTP/1.1 
Host: gjwzmlgxbt.duckdns.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://gjwzmlgxbt.duckdns.org/
Cookie: sessionid=22f60315f31f1e63b33be5c58c0e25b2
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        
                                             103.169.91.217
HTTP/2 200 OK
content-type: text/css; charset=utf-8
                                            
server: nginx
date: Fri, 17 Mar 2023 12:38:26 GMT
content-length: 748
last-modified: Tue, 09 Aug 2022 08:07:52 GMT
expires: Sun, 16 Apr 2023 12:38:26 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text
Size:   748
Md5:    91692497e479f6cc955e4de6d627a499
Sha1:   bb57de5c2d4dafee21f66645d776d3064f4b79bd
Sha256: de36d3e9e989de40ae0bf5252af018ef55fdc0ed938042bdba11147f1127e431

urlquery:
  - Phishing - Japan's Tax Agency
  - Phishing - Japan's Tax Agency
  - Suspicious - DynDNS domain
                                        
                                            GET /static/hau/jquery-1.9.1.min.js HTTP/1.1 
Host: gjwzmlgxbt.duckdns.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://gjwzmlgxbt.duckdns.org/
Cookie: sessionid=22f60315f31f1e63b33be5c58c0e25b2
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        
                                             103.169.91.217
HTTP/2 200 OK
content-type: application/javascript
                                            
server: nginx
date: Fri, 17 Mar 2023 12:38:26 GMT
vary: Accept-Encoding
last-modified: Thu, 17 Mar 2022 06:45:22 GMT
expires: Sun, 16 Apr 2023 12:38:26 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  data
Size:   38171
Md5:    030b4143c36264bac4a9c53c64ac2ad5
Sha1:   7c2cddbd2b89e759829f46614139cb8ce0f65475
Sha256: 5aa7c15b91ce4a01c883cda39a5ca919bb7761200a15e1b06bdbf140ac015355

urlquery:
  - Suspicious - DynDNS domain
                                        
                                            GET /template/img/template/headerbackground.jpg HTTP/1.1 
Host: www.nta.go.jp
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://gjwzmlgxbt.duckdns.org/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             54.230.111.115
HTTP/2 200 OK
content-type: image/jpeg
                                            
content-length: 35682
server: Apache
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
last-modified: Mon, 06 Feb 2023 01:00:37 GMT
accept-ranges: bytes
date: Fri, 17 Mar 2023 12:38:13 GMT
etag: "8b62-5f3fd8f2a16e8"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 fc5e625db631bc657fc73f189d53fa14.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: Y640dWmeIoFbl1ZMUHXc_8FXY51bH_XY3F3DBjUO2bb0-K2dhydnsQ==
age: 78
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 980x123, components 3\012- data
Size:   35682
Md5:    9ec081316ee20a07e125203dea3d7c68
Sha1:   8db3749e8ad66f86571a2ff3435d2f666b6640d1
Sha256: d299b3eea8c890a7c5160a9633470c8973b6bfb19cdd4ccd38e3b78a2558a545
                                        
                                            GET / HTTP/1.1 
Host: gjwzmlgxbt.duckdns.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

                                        
                                             103.169.91.217
HTTP/2 200 OK
content-type: text/html; charset=utf-8
                                            
server: nginx
date: Fri, 17 Mar 2023 12:38:25 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-headers: Origin,Authorization,Access-Control-Allow-Origin,Access-Control-Allow-Headers,Content-Type,X-Token,X-Requested-With,withCredentials
access-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Access-Control-Allow-Origin,Access-Control-Allow-Headers,Content-Type
set-cookie: sessionid=22f60315f31f1e63b33be5c58c0e25b2; Path=/; HttpOnly
strict-transport-security: max-age=31536000
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  data
Size:   222621
Md5:    e6406be31ac1c352c673073d68dca5e4
Sha1:   c47eca74c944dc3443437a8e7006b4fefb1237e0
Sha256: 70e34e770c7a332b2e8e41cc48bef95a860fe91cdb062ec99049ca146fc12206

urlquery:
  - Suspicious - DynDNS domain
IDS:
  - ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
                                        
                                            GET /static/gs_vk/logo.png HTTP/1.1 
Host: gjwzmlgxbt.duckdns.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://gjwzmlgxbt.duckdns.org/
Cookie: sessionid=22f60315f31f1e63b33be5c58c0e25b2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        
                                             103.169.91.217
HTTP/2 200 OK
content-type: image/png
                                            
server: nginx
date: Fri, 17 Mar 2023 12:38:26 GMT
content-length: 2973
last-modified: Tue, 09 Aug 2022 08:07:52 GMT
expires: Sun, 16 Apr 2023 12:38:26 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PNG image data, 275 x 29, 8-bit/color RGBA, non-interlaced\012- data
Size:   2973
Md5:    c6d404ecaa7646ff497deaad55392996
Sha1:   1c66c5caf35e3e633d1cb1e09a334362ad11f5fb
Sha256: bf1532dfb899554f52b0a98c2870c9a6f19e6abaf74288c6de321813fed91666

urlquery:
  - Phishing - Japan's Tax Agency
  - Phishing - Japan's Tax Agency
  - Suspicious - DynDNS domain
                                        
                                            GET /static/gs_vk/syozai_icon.png HTTP/1.1 
Host: gjwzmlgxbt.duckdns.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://gjwzmlgxbt.duckdns.org/
Cookie: sessionid=22f60315f31f1e63b33be5c58c0e25b2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        
                                             103.169.91.217
HTTP/2 200 OK
content-type: image/png
                                            
server: nginx
date: Fri, 17 Mar 2023 12:38:26 GMT
content-length: 1297
last-modified: Tue, 09 Aug 2022 08:07:52 GMT
expires: Sun, 16 Apr 2023 12:38:26 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PNG image data, 15 x 24, 8-bit/color RGBA, non-interlaced\012- data
Size:   1297
Md5:    d038e6e8e4472bbcf6e5dac6a23d5a0e
Sha1:   fce966980cd73b2d732e0081b7e8dc9751db160d
Sha256: 5aa0964ac2cb5cbb5823d166f55495ac12747f3fbf2b56f7d290ac161eb2aead

urlquery:
  - Phishing - Japan's Tax Agency
  - Phishing - Japan's Tax Agency
  - Suspicious - DynDNS domain
                                        
                                            GET /static/gs_vk/index.png HTTP/1.1 
Host: gjwzmlgxbt.duckdns.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://gjwzmlgxbt.duckdns.org/
Cookie: sessionid=22f60315f31f1e63b33be5c58c0e25b2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        
                                             103.169.91.217
HTTP/2 200 OK
content-type: image/png
                                            
server: nginx
date: Fri, 17 Mar 2023 12:38:26 GMT
content-length: 104029
last-modified: Tue, 09 Aug 2022 08:07:52 GMT
expires: Sun, 16 Apr 2023 12:38:26 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 750x516, components 3\012- data
Size:   104029
Md5:    3b288cf2cf8b233a1f459e89dc209d79
Sha1:   08aa186779070d33edbca5dece75e2760dfa4065
Sha256: c0315642042bbc5f62714e1bf1ee5df4fd567a38745af3c67ff09b025a56efbb

urlquery:
  - Phishing - Japan's Tax Agency
  - Phishing - Japan's Tax Agency
  - Suspicious - DynDNS domain
                                        
                                            GET /static/js/jquery.cookie.js HTTP/1.1 
Host: gjwzmlgxbt.duckdns.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://gjwzmlgxbt.duckdns.org/
Cookie: sessionid=22f60315f31f1e63b33be5c58c0e25b2
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        
                                             103.169.91.217
HTTP/2 200 OK
content-type: application/javascript
                                            
server: nginx
date: Fri, 17 Mar 2023 12:38:26 GMT
vary: Accept-Encoding
last-modified: Thu, 17 Mar 2022 06:46:10 GMT
expires: Sun, 16 Apr 2023 12:38:26 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  
Size:   0
Md5:    
Sha1:   
Sha256: 

urlquery:
  - Suspicious - DynDNS domain
                                        
                                            GET /static/gs_vk/public.css HTTP/1.1 
Host: gjwzmlgxbt.duckdns.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://gjwzmlgxbt.duckdns.org/
Cookie: sessionid=22f60315f31f1e63b33be5c58c0e25b2
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        
                                             103.169.91.217
HTTP/2 200 OK
content-type: text/css; charset=utf-8
                                            
server: nginx
date: Fri, 17 Mar 2023 12:38:26 GMT
vary: Accept-Encoding
last-modified: Tue, 09 Aug 2022 08:07:52 GMT
expires: Sun, 16 Apr 2023 12:38:26 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  
Size:   0
Md5:    
Sha1:   
Sha256: 

urlquery:
  - Suspicious - DynDNS domain
                                        
                                            GET /static/js/1.js HTTP/1.1 
Host: gjwzmlgxbt.duckdns.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://gjwzmlgxbt.duckdns.org/
Cookie: sessionid=22f60315f31f1e63b33be5c58c0e25b2
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        
                                             103.169.91.217
HTTP/2 200 OK
content-type: application/javascript
                                            
server: nginx
date: Fri, 17 Mar 2023 12:38:26 GMT
vary: Accept-Encoding
last-modified: Fri, 10 Mar 2023 06:31:48 GMT
expires: Sun, 16 Apr 2023 12:38:26 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  
Size:   0
Md5:    
Sha1:   
Sha256: 

urlquery:
  - Suspicious - DynDNS domain