Report - ducatl.com/click/five/PvqDq929BSx_A_D_M1n

Report Overview

Submitted URL
ducatl.com/click/five/PvqDq929BSx_A_D_M1n_a.php
IP
104.140.146.29
ASN
#62904 AS62904
Submitted
2023-02-08 08:50:50
Access
Website Title
Final URL
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
24

Domain Summary

Domain / FQDN	Rank	First Seen	Last Seen	Sent	Received	IP
firefox.settings.services.mozilla.com	867	2020-06-04T22:08:41Z	2023-03-13T05:09:10Z	782 B	2.4 kB	35.241.9.150
img-getpocket.cdn.mozilla.net	1631	2018-06-22T01:36:00Z	2023-03-13T05:09:16Z	3.2 kB	58 kB	34.120.237.76
ocsp.trust-provider.cn	unknown	2022-02-10T09:18:30Z	2023-03-13T07:40:56Z	692 B	2.6 kB	47.246.44.205
www.bill8888.com	unknown	2021-03-06T07:03:08Z	2023-03-13T08:20:45Z	354 B	2.0 kB	154.212.112.82
api.share.baidu.com	44629	2013-04-25T16:45:11Z	2023-03-13T05:37:01Z	352 B	114 B	182.61.201.94
content-signature-2.cdn.mozilla.net	1152	2020-11-03T13:26:46Z	2023-03-13T05:09:35Z	413 B	5.8 kB	34.160.144.191
ocsp.globalsign.com	2075	2012-07-20T19:46:16Z	2023-03-13T05:09:19Z	359 B	1.9 kB	104.18.20.226
www.ducatl.com	unknown	2022-12-15T08:30:30Z	2023-02-08T09:50:40Z	854 B	12 kB	104.140.146.29
push.services.mozilla.com	2140	2014-10-24T10:27:06Z	2023-03-13T05:09:14Z	606 B	127 B	52.88.101.41
hm.baidu.com	8254	2012-05-26T10:38:45Z	2023-03-13T05:32:36Z	2.1 kB	24 kB	103.235.46.191
www.bill2021.com	unknown	2021-03-06T07:37:32Z	2023-03-13T08:20:48Z	5.4 kB	228 kB	154.208.77.212
r3.o.lencr.org	344	2020-12-02T09:52:13Z	2023-03-13T05:09:07Z	2.4 kB	6.2 kB	23.36.77.32
ducatl.com	unknown	2021-09-10T04:29:54Z	2023-03-09T17:23:31Z	1.3 kB	1.9 kB	104.140.146.29
contile.services.mozilla.com	1114	2021-05-27T20:32:35Z	2023-03-13T05:09:13Z	333 B	391 B	34.117.237.239
push.zhanzhang.baidu.com	57139	2015-07-22T07:44:02Z	2023-03-13T05:37:01Z	280 B	750 B	182.61.201.94

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

Scan Date	Severity	Indicator	Alert
2023-02-08	medium	ducatl.com/click/five/PvqDq929BSx_A_D_M1n_a.php	Malware
2023-02-08	medium	ducatl.com/jquery.20.min.js	Malware
2023-02-08	medium	ducatl.com/jquery.la.min.js	Malware
2023-02-08	medium	www.ducatl.com/jquery.la.min.js	Malware
2023-02-08	medium	www.ducatl.com/jquery.20.min.js	Malware

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2023-02-08	medium	ducatl.com	Sinkholed
2023-02-08	medium	ducatl.com	Sinkholed
2023-02-08	medium	ducatl.com	Sinkholed
2023-02-08	medium	ducatl.com	Sinkholed
2023-02-08	medium	ducatl.com	Sinkholed
2023-02-08	medium	ducatl.com	Sinkholed
2023-02-08	medium	ducatl.com	Sinkholed

ThreatFox

No alerts detected

JavaScript (12)

	URL	Size	First Seen	Last Seen
	www.bill8888.com/bb/pp.js	6.2 kB	2023-03-09	2023-03-26
Pretty URL www.bill8888.com/bb/pp.js IP 154.212.112.82 ASN #134548 DXTL Tseung Kwan O Service Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-09 06:06:03 Last Seen2023-03-26 05:44:13 Times Seen7 Hash f01b4954be256491e50c429e16a3678a 79357c69ecaf39f082e4d0aeb1bfbc494e3ee02e 7833d2c2125fb924b6ca343410658ff03c6fb6986dba0a782ef7773a32971d17 Loading...

	ducatl.com/click/five/PvqDq929BSx_A_D_M1n_a.php	404 B	2023-03-07	2024-04-18
Pretty URL ducatl.com/click/five/PvqDq929BSx_A_D_M1n_a.php IP 104.140.146.29 ASN #62904 AS62904 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:09 Last Seen2024-04-18 08:01:19 Times Seen2975 Hash 91862680df880ab56f799547b01a5900 bd184fe6e0e046873c1a606c89ce2d3eed4b689f 6520359b93c2e43efd5a58f422af308b43c718769a0989344a10f00b345ca0b2 Loading...

	hm.baidu.com/hm.js?626f08b5cd8232372c847205733e28c8	30 kB	2023-03-13	2023-03-13
Pretty URL hm.baidu.com/hm.js?626f08b5cd8232372c847205733e28c8 IP 103.235.46.191 ASN #55967 Beijing Baidu Netcom Science and Technology Co., Ltd. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-13 19:35:53 Last Seen2023-03-13 19:35:53 Times Seen1 Hash 2f78042ec6af60b8a061618b2b9026c9 8efc5b3330ddb02d1afb1b57d4bf9c663e67c168 f41adbd4249dcbeff647451d0e10c685530cae58a7541809b27f2782669f6a50 Loading...

	www.bill2021.com/dan/indexty.html	251 B	2023-03-13	2023-04-01
Pretty URL www.bill2021.com/dan/indexty.html IP 154.208.77.212 ASN #134548 DXTL Tseung Kwan O Service Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-13 07:56:31 Last Seen2023-04-01 10:39:40 Times Seen7 Hash 7c2a2f744ff84b4f9df6a388066e5a89 7ce8aab570e54b18148154bbf429601cb4d4a82b a5bbc84b885e353dd18762a20225a91b1a6d865bde5a0c433b23aa10c05d5e17 Loading...

	www.bill2021.com/dan/js/zhongguomeng.js	921 B	2023-03-13	2023-03-13
Pretty URL www.bill2021.com/dan/js/zhongguomeng.js IP 154.208.77.212 ASN #134548 DXTL Tseung Kwan O Service Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-13 19:35:53 Last Seen2023-03-13 19:35:53 Times Seen1 Hash 3da863ecf8288216264f7cad05e4c25f 9dc6ba91c91d51a29d6700487737b52435316b5c 257652bb1b88d71b2ae81a3c18c742293c61b0e30bb14548061295ae09e942dc Loading...

	ducatl.com/jquery.20.min.js	2.9 kB	2023-03-08	2024-04-14
Pretty URL ducatl.com/jquery.20.min.js IP 104.140.146.29 ASN #62904 AS62904 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-08 00:28:37 Last Seen2024-04-14 20:15:22 Times Seen204 Hash 9ea925bfc838253437d2bc500c294629 b778753280367de97bb061ca87c9031ccc290593 0e5fe1265a477850496550d0bc8e56466c9d9603e643e74ebaa40f1343bdd7bb Loading...

	ducatl.com/jquery.la.min.js	524 B	2023-03-13	2023-03-13
Pretty URL ducatl.com/jquery.la.min.js IP 104.140.146.29 ASN #62904 AS62904 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-13 16:21:23 Last Seen2023-03-13 19:35:53 Times Seen1 Hash 7cdfa47d7b73911684e95a48658cd9d4 189088ab5db9235357a4c9f8769a8cbc7f7bdc21 b1184c4d07360650a6ce4040cc62b4198e9f98bc3b37e756e64e32b3e0f0d832 Loading...

	push.zhanzhang.baidu.com/push.js	281 B	2023-03-07	2024-04-21
Pretty URL push.zhanzhang.baidu.com/push.js IP 182.61.201.94 ASN #38365 Beijing Baidu Netcom Science and Technology Co., Ltd. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:09 Last Seen2024-04-21 21:29:48 Times Seen18980 Hash 1bb5a3267c9865ad4abe8d937734b62b b5478dd2edb3e64242eced1db2dbd945ef81f592 674bc0c70f98d627b8a7e1d278a1f21ffe33815565f7d5371bf0275da57571b2 Loading...

	hm.baidu.com/hm.js?0e62d9807fe7726c09e2c1481327dedf	30 kB	2023-03-13	2023-03-13
Pretty URL hm.baidu.com/hm.js?0e62d9807fe7726c09e2c1481327dedf IP 103.235.46.191 ASN #55967 Beijing Baidu Netcom Science and Technology Co., Ltd. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-13 19:35:53 Last Seen2023-03-13 19:35:53 Times Seen1 Hash e5c5314a7ff71e2afe2c5d8b5c7e1a9f bbba08181b610cec3f8d2fa5cbb02f6dc280176c d65fa64d918d61e45c05941158432d6b971ff22e20bff01e93324de9f2590a32 Loading...

	www.bill2021.com/dan/indexty.html	290 B	2023-03-08	2023-04-01
Pretty URL www.bill2021.com/dan/indexty.html IP 154.208.77.212 ASN #134548 DXTL Tseung Kwan O Service Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-08 01:15:01 Last Seen2023-04-01 11:22:43 Times Seen14 Hash df98945709ae88713fbb5ca94b7aefc8 c4bb66c02ffd36624d2a56105fb30cd8b97eb611 fa26c07c58a4f478a587a06cde2c2b3edb0f94ad3b4428088b4db185956c64dd Loading...

		Size	First Seen	Last Seen
	#1 Write - ca8acb244ae58e550e811c1b233d36a8	118 B	2023-03-08	2024-04-14
Pretty Observations First Seen2023-03-08 00:28:37 Last Seen2024-04-14 20:15:22 Times Seen104 Hash ca8acb244ae58e550e811c1b233d36a8 efbe86d4bb5ae5bb1eccf1150b35c96224296173 061522ea3aab4134d23d638a4a01a40e2b1c3ebb621a77f3891fa0b8952a936e Loading...

	#2 Write - c8a1c60a17a59165ae1fde336f13042b	185 B	2023-03-07	2024-04-21
Pretty Observations First Seen2023-03-07 01:19:11 Last Seen2024-04-21 11:46:22 Times Seen1071 Hash c8a1c60a17a59165ae1fde336f13042b b03c5e90dcd61e05fd5416417edfc76b49b42875 f57ad520d4c886dd0d5c383359823ae450923fd3e35085ca618b89143e0f0086 Loading...

HTTP Transactions (48)

URL IP Response Size

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
dca68db7aea32f6683ce8d542c078f04
19c495238df74fca680e21f18627ff94de5dd2e5
35cab3987fc0e4a41b305cb208c1e33fa38ce8bdfd9f386c3dc0411dd4d5ac61

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "35CAB3987FC0E4A41B305CB208C1E33FA38CE8BDFD9F386C3DC0411DD4D5AC61"
Last-Modified: Mon, 06 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7397
Expires: Wed, 08 Feb 2023 10:53:56 GMT
Date: Wed, 08 Feb 2023 08:50:39 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
565c1bbc5c1c40be1988b3bf6fd9dc1a
cfdba5bc597130461dd67bf6cda53183be592493
60ceb36a8329c92fc49a3caf50daf511a38e01eac21a07d7a0a838166bea058d

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "60CEB36A8329C92FC49A3CAF50DAF511A38E01EAC21A07D7A0A838166BEA058D"
Last-Modified: Mon, 06 Feb 2023 23:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3180
Expires: Wed, 08 Feb 2023 09:43:39 GMT
Date: Wed, 08 Feb 2023 08:50:39 GMT
Connection: keep-alive

firefox.settings.services.mozilla.com/v1/

35.241.9.150

200 OK

939 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size
939 B (939 bytes)
Hash
bf0c602d32b3c14606f22a86183b5e3c
6eabd8d83475eba731968abe1a05a8bfd272f160
6c6a7c519a9e950c2445ed874a25211a94dd4d3cf3afb0103af9dcd1dbd5ff9e

HTTP Headers

GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Retry-After, Backoff, Alert, Content-Length
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Wed, 08 Feb 2023 08:34:12 GMT
content-type: application/json
age: 987
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
cc14b0d2f7c451f6431dc87ba54d1d60
bab8bfda6fa3e2f17125353f5147211787dc25d0
b58fe18a5cc8fe5aaf49ba7eadd0ef34692892e68e9c52eb5bb56ea27e1300ad

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "B58FE18A5CC8FE5AAF49BA7EADD0EF34692892E68E9C52EB5BB56EA27E1300AD"
Last-Modified: Mon, 06 Feb 2023 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3847
Expires: Wed, 08 Feb 2023 09:54:46 GMT
Date: Wed, 08 Feb 2023 08:50:39 GMT
Connection: keep-alive

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-03-20-18-44-46.chain

34.160.144.191

200 OK

5.3 kB

URL HTTP/2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-03-20-18-44-46.chain
IP
34.160.144.191:0
ASN
#15169 GOOGLE

File type
PEM certificate\012- , ASCII text
Size
5.3 kB (5348 bytes)
Hash
e76071a28ee566dababb3834f46d68ed
aebb4e68c1ba2de0f90025283e8ed8470944fde0
78b6df2627172e5b35476bc31020f02898cdc412aaf4337af2c3b049a60912b6

HTTP Headers

GET /chains/remote-settings.content-signature.mozilla.org-2023-03-20-18-44-46.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
x-amz-id-2: ehLVLDDsFc5nGZUDZ4P7ZKlA4PbU51O62BSeXFqcozJ4cjy4ldsFuQhCHHId6Rb+cRmzKKRO19o=
x-amz-request-id: Y8TJRAZEA39E0X8F
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Wed, 08 Feb 2023 08:35:52 GMT
age: 887
last-modified: Sun, 29 Jan 2023 18:44:47 GMT
etag: "e76071a28ee566dababb3834f46d68ed"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

ducatl.com/click/five/PvqDq929BSx_A_D_M1n_a.php

104.140.146.29

200 OK

573 B

URL HTTP/1.1
ducatl.com/click/five/PvqDq929BSx_A_D_M1n_a.php
IP
104.140.146.29:0
ASN
#62904 AS62904

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with CRLF, LF line terminators
Size
573 B (573 bytes)
Hash
818b9d7292eabb50d8cb3d1d2d83323c
42c23daa1f170c410fecf9f96c0496780d0d2029
ee974e6877073aa5e0785eea46aa66880b64555cb88534c16bec5c94fc2c8669

Detections

Analyzer	Verdict	Alert
fortinet	Malware
quad9	Sinkholed

HTTP Headers

GET /click/five/PvqDq929BSx_A_D_M1n_a.php HTTP/1.1
Host: ducatl.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 08 Feb 2023 08:50:39 GMT
Content-Type: text/html;charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/5.4.41
Content-Encoding: gzip

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

12 B

URL HTTP/2
contile.services.mozilla.com/v1/tiles
IP
34.117.237.239:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with no line terminators
Size
12 B (12 bytes)
Hash
23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Wed, 08 Feb 2023 08:50:39 GMT
content-type: application/json
content-length: 12
access-control-allow-credentials: true
access-control-expose-headers: content-type
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

ducatl.com/jquery.20.min.js

104.140.146.29

301 Moved Permanently

178 B

URL HTTP/1.1
ducatl.com/jquery.20.min.js
IP
104.140.146.29:0
ASN
#62904 AS62904

File type
HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Size
178 B (178 bytes)
Hash
cd2e0e43980a00fb6a2742d3afd803b8
81ffbd1712afe8cdf138b570c0fc9934742c33c1
bd9df047d51943acc4bc6cf55d88edb5b6785a53337ee2a0f74dd521aedde87d

Detections

Analyzer	Verdict	Alert
fortinet	Malware
quad9	Sinkholed

HTTP Headers

GET /jquery.20.min.js HTTP/1.1
Host: ducatl.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ducatl.com/click/five/PvqDq929BSx_A_D_M1n_a.php

HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Wed, 08 Feb 2023 08:50:39 GMT
Content-Type: text/html
Content-Length: 178
Connection: keep-alive
Location: http://www.ducatl.com/jquery.20.min.js

ducatl.com/jquery.la.min.js

104.140.146.29

301 Moved Permanently

178 B

URL HTTP/1.1
ducatl.com/jquery.la.min.js
IP
104.140.146.29:0
ASN
#62904 AS62904

File type
HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Size
178 B (178 bytes)
Hash
cd2e0e43980a00fb6a2742d3afd803b8
81ffbd1712afe8cdf138b570c0fc9934742c33c1
bd9df047d51943acc4bc6cf55d88edb5b6785a53337ee2a0f74dd521aedde87d

Detections

Analyzer	Verdict	Alert
fortinet	Malware
quad9	Sinkholed

HTTP Headers

GET /jquery.la.min.js HTTP/1.1
Host: ducatl.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ducatl.com/click/five/PvqDq929BSx_A_D_M1n_a.php

HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Wed, 08 Feb 2023 08:50:39 GMT
Content-Type: text/html
Content-Length: 178
Connection: keep-alive
Location: http://www.ducatl.com/jquery.la.min.js

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

35.241.9.150

200 OK

329 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size
329 B (329 bytes)
Hash
0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

HTTP Headers

GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Last-Modified, Content-Type, Pragma, ETag, Retry-After, Backoff, Expires, Alert, Cache-Control, Content-Length
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Wed, 08 Feb 2023 08:14:52 GMT
age: 2147
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
9b88bae61bca33aba8aa99f6128db8d9
a07b61fb2458917699613fcae68710941b595416
54915c2f79822732e06a592d027da421ad1e7a6458c545f98333db25612b3dea

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "54915C2F79822732E06A592D027DA421AD1E7A6458C545F98333DB25612B3DEA"
Last-Modified: Mon, 06 Feb 2023 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6354
Expires: Wed, 08 Feb 2023 10:36:34 GMT
Date: Wed, 08 Feb 2023 08:50:40 GMT
Connection: keep-alive

www.ducatl.com/jquery.la.min.js

104.140.146.29

200 OK

524 B

URL HTTP/1.1
www.ducatl.com/jquery.la.min.js
IP
104.140.146.29:0
ASN
#62904 AS62904

File type
ASCII text, with CRLF line terminators
Size
524 B (524 bytes)
Hash
7cdfa47d7b73911684e95a48658cd9d4
189088ab5db9235357a4c9f8769a8cbc7f7bdc21
b1184c4d07360650a6ce4040cc62b4198e9f98bc3b37e756e64e32b3e0f0d832

Detections

Analyzer	Verdict	Alert
fortinet	Malware
quad9	Sinkholed

HTTP Headers

GET /jquery.la.min.js HTTP/1.1
Host: www.ducatl.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://ducatl.com/
Connection: keep-alive

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 08 Feb 2023 08:50:40 GMT
Content-Type: application/javascript
Content-Length: 524
Last-Modified: Wed, 26 Oct 2022 11:09:24 GMT
Connection: keep-alive
ETag: "63591564-20c"
Expires: Wed, 08 Feb 2023 09:50:40 GMT
Cache-Control: max-age=3600
Accept-Ranges: bytes

www.ducatl.com/jquery.20.min.js

104.140.146.29

200 OK

1.3 kB

URL HTTP/1.1
www.ducatl.com/jquery.20.min.js
IP
104.140.146.29:0
ASN
#62904 AS62904

File type
ASCII text, with very long lines (2924), with no line terminators
Size
1.3 kB (1339 bytes)
Hash
1656f1ef69f3c4ff16c961a1ca62e2e9
93bb802ea0dbe77593d6e24c41131894b5e0a97c
24b3bbb338694a6d29f2b0701d98a510c9188ae9f4bff9070bee9b987f70ec21

Detections

Analyzer	Verdict	Alert
fortinet	Malware
quad9	Sinkholed

HTTP Headers

GET /jquery.20.min.js HTTP/1.1
Host: www.ducatl.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://ducatl.com/
Connection: keep-alive

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 08 Feb 2023 08:50:40 GMT
Content-Type: application/javascript
Last-Modified: Wed, 26 Oct 2022 11:09:24 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"63591564-b6c"
Expires: Wed, 08 Feb 2023 09:50:40 GMT
Cache-Control: max-age=3600
Content-Encoding: gzip

push.services.mozilla.com/

52.88.101.41

101 Switching Protocols

0 B

URL HTTP/1.1
push.services.mozilla.com/
IP
52.88.101.41:0
ASN
#16509 AMAZON-02

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: lW+NSaGwNGE8q0AmUcOtCw==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: JVZBeHEtbhrQ1MtguUeZGpTSuMY=

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
68273225f74fbf7493f395610d7a73fc
5a8779ef5656aeeba23b365aad60b7901c5dd7fc
c83f285a1f3df0f7ac758a68ee95cc3d2671f80264c2e143cc0561cc574e3f19

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C83F285A1F3DF0F7AC758A68EE95CC3D2671F80264C2E143CC0561CC574E3F19"
Last-Modified: Mon, 06 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11980
Expires: Wed, 08 Feb 2023 12:10:21 GMT
Date: Wed, 08 Feb 2023 08:50:41 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
68273225f74fbf7493f395610d7a73fc
5a8779ef5656aeeba23b365aad60b7901c5dd7fc
c83f285a1f3df0f7ac758a68ee95cc3d2671f80264c2e143cc0561cc574e3f19

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C83F285A1F3DF0F7AC758A68EE95CC3D2671F80264C2E143CC0561CC574E3F19"
Last-Modified: Mon, 06 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11980
Expires: Wed, 08 Feb 2023 12:10:21 GMT
Date: Wed, 08 Feb 2023 08:50:41 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
68273225f74fbf7493f395610d7a73fc
5a8779ef5656aeeba23b365aad60b7901c5dd7fc
c83f285a1f3df0f7ac758a68ee95cc3d2671f80264c2e143cc0561cc574e3f19

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C83F285A1F3DF0F7AC758A68EE95CC3D2671F80264C2E143CC0561CC574E3F19"
Last-Modified: Mon, 06 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11980
Expires: Wed, 08 Feb 2023 12:10:21 GMT
Date: Wed, 08 Feb 2023 08:50:41 GMT
Connection: keep-alive

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F085f1306-f595-4e1a-8162-7d3d1f959ac3.jpeg

34.120.237.76

200 OK

9.1 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F085f1306-f595-4e1a-8162-7d3d1f959ac3.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
9.1 kB (9108 bytes)
Hash
7dbe304b5138a360ff07a9842bcf6a7f
00572f7667e322c9ef34bc35b7998c1c172dd34c
d63c58d6c96e23c61b92272de8c2aab01f4cf85f3420cc434c05447d355b1c77

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F085f1306-f595-4e1a-8162-7d3d1f959ac3.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 9108
x-amzn-requestid: a3bffa19-86ce-4a59-b826-551deddb3e9f
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fostZG2xIAMF0wQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d9c188-18acd7311c6190c9486e86ac;Sampled=0
x-amzn-remapped-date: Wed, 01 Feb 2023 01:34:00 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: D3DmTtciv2wzm5T0eQJopJiXCkHWZc1PlbVdbsBbJaquGcT1HoIZhg==
via: 1.1 8dbfaf7df256a75768461d934659b6b2.cloudfront.net (CloudFront), 1.1 fda3b2797d2719576f6b916583a28e52.cloudfront.net (CloudFront), 1.1 google
date: Wed, 08 Feb 2023 08:40:04 GMT
age: 637
etag: "00572f7667e322c9ef34bc35b7998c1c172dd34c"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

8.6 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F06b5f2a3-c53c-4690-b548-2c3d0f556f73.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
8.6 kB (8629 bytes)
Hash
02fde25be5ded120af759d19d8304f73
8d2a4d9ab5947113ce0737d4d4bed3e30a971026
7cdf26668cca22f28eee047d3fcf30cea8d97b1d8804fe2132728f26cd11558d

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F06b5f2a3-c53c-4690-b548-2c3d0f556f73.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 8629
x-amzn-requestid: cc20d28e-3937-4826-97ef-100fb5dd2645
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: f_O7LFn3oAMF61A=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63e2c514-6e764236604212fa26dab38a;Sampled=0
x-amzn-remapped-date: Tue, 07 Feb 2023 21:39:32 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: GIAPTJF7sfpuubLSngEDMrowvBWW5c1xRlyVf7PQ3o6rGWdFITVioA==
via: 1.1 4dde8ec6d6c12741888c2d3a059d4a2e.cloudfront.net (CloudFront), 1.1 d6b180eb367f7de26d67a9f3901b96a6.cloudfront.net (CloudFront), 1.1 google
date: Tue, 07 Feb 2023 22:15:10 GMT
etag: "8d2a4d9ab5947113ce0737d4d4bed3e30a971026"
content-type: image/jpeg
age: 38131
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

7.3 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F92b2ed55-154e-4ed7-a7ab-1418742cdf6e.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
7.3 kB (7303 bytes)
Hash
7543be9bef0afb8f61344286b7136dd7
e1537aa408cde39d2a314cc2a14f7f7a04a84eb1
162f0898f88d84c8d06542e48e8ff6a903e638f2a837f32681ae1f5e28ae40d7

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F92b2ed55-154e-4ed7-a7ab-1418742cdf6e.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 7303
x-amzn-requestid: 081c79e9-2b23-47ad-8b7d-7197c5515c0c
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: f58kdHMvIAMFdzg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63e0a7b5-66fca524070e374310920915;Sampled=0
x-amzn-remapped-date: Mon, 06 Feb 2023 07:09:41 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: CV8Q0EwlleoBURF3IvwUGDm_ANrg_SINlUR3cl6OhqySJPejP6T0hg==
via: 1.1 2afae0d44e2540f472c0635ab62c232a.cloudfront.net (CloudFront), 1.1 ce71f64ad5dca81beca846466f2d5008.cloudfront.net (CloudFront), 1.1 google
date: Wed, 08 Feb 2023 08:10:04 GMT
age: 2437
etag: "e1537aa408cde39d2a314cc2a14f7f7a04a84eb1"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

4.2 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc6ac124e-27b8-4818-9240-77708d007004.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
4.2 kB (4168 bytes)
Hash
845e4e4051f1162b20d3df5f208e8d3e
076462f67531c60b31ec768a275c96317292306d
40996d8929ab92f342328fc018518d6131c6222b0ec23051775eda276a602026

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc6ac124e-27b8-4818-9240-77708d007004.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 4168
x-amzn-requestid: 24814225-0063-49fb-86ff-e78869538b3c
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: f_OjQFS_IAMFtLQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63e2c47b-67307c42182089b3096e98b5;Sampled=0
x-amzn-remapped-date: Tue, 07 Feb 2023 21:36:59 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: f90qZAgSmdYFuW_BDTZVivBlk_c5SrirTSeJmvoysOmCcOjxtFZrbA==
via: 1.1 01c28b52813cd0e82f810c492808b142.cloudfront.net (CloudFront), 1.1 12a392bc3a7281f8d5d4591bfadc41fc.cloudfront.net (CloudFront), 1.1 google
date: Tue, 07 Feb 2023 21:42:03 GMT
age: 40118
etag: "076462f67531c60b31ec768a275c96317292306d"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

10 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdcf61053-67f6-4767-ad44-fa802c5ef5b4.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
10 kB (10058 bytes)
Hash
a9c2a9eee923b84d4e06438a8b2acaff
520b122e3ce52220af153fee26bb7067283f9075
9ff4236fdcd05210a9c8bb48ea68179e142b1b05c8b19dd66282590dff69fa22

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdcf61053-67f6-4767-ad44-fa802c5ef5b4.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 10058
x-amzn-requestid: 94374454-1e89-4c43-895b-0a90f39b851d
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: f_O5vEgcoAMFctg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63e2c50a-0bf11cad4b0818c36188ba91;Sampled=0
x-amzn-remapped-date: Tue, 07 Feb 2023 21:39:22 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 1R4SRNvqhRHbrDZsGB06NJbBXf8WRgJEHmXTbop8pqf8etTJSlmQwQ==
via: 1.1 9b311162717b41c968f6f00426d88aaa.cloudfront.net (CloudFront), 1.1 d6b180eb367f7de26d67a9f3901b96a6.cloudfront.net (CloudFront), 1.1 google
date: Tue, 07 Feb 2023 22:06:05 GMT
age: 38676
etag: "520b122e3ce52220af153fee26bb7067283f9075"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

13 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F308abacb-8d5b-49bf-9e2b-59b6b40157cb.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
13 kB (12772 bytes)
Hash
2bf626b824fefec1ecaceb9243f2e5ec
f222976d76d889a0cd767bfd73075ee114c531ce
3f981850c6e6628245be7f7e26418d8b945dbeaf45e06492d8e2ee9409245195

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F308abacb-8d5b-49bf-9e2b-59b6b40157cb.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 12772
x-amzn-requestid: a4603c5c-c842-4a1d-bf09-550f160e1082
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: f_O7OEz8oAMFbOg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63e2c514-763b7ecf50411a4d13dd8a25;Sampled=0
x-amzn-remapped-date: Tue, 07 Feb 2023 21:39:32 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: ECAdRS7as57pL15HxK4Ep0YOho8Kba8RFhMVnXGdJuKYItQHNf2yHA==
via: 1.1 e291f351a18746d40754b367095a2872.cloudfront.net (CloudFront), 1.1 556b99c6be8d7078b9f067347c62df6a.cloudfront.net (CloudFront), 1.1 google
date: Tue, 07 Feb 2023 21:53:57 GMT
age: 39404
etag: "f222976d76d889a0cd767bfd73075ee114c531ce"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

ocsp.trust-provider.cn/

47.246.44.205

200 OK

600 B

URL HTTP/1.1
ocsp.trust-provider.cn/
IP
47.246.44.205:0
ASN
#24429 Zhejiang Taobao Network Co.,Ltd

File type
data
Size
600 B (600 bytes)
Hash
777666a916cd5017332d379c6d30fe76
6af83eb1545a9d295cbb3051411c0c68cc19bba6
41bf55f7d91026b1982ad1250fa69000e0a8cde85f298f377f6fe4fdbd553ce9

HTTP Headers

POST / HTTP/1.1
Host: ocsp.trust-provider.cn
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: Tengine
Content-Type: application/ocsp-response
Transfer-Encoding: chunked
Connection: keep-alive
date: Wed, 08 Feb 2023 08:50:41 GMT
last-modified: Mon, 06 Feb 2023 03:17:37 GMT
expires: Mon, 13 Feb 2023 03:17:36 GMT
etag: "6af83eb1545a9d295cbb3051411c0c68cc19bba6"
cache-control: max-age=583049,s-maxage=1800,public,no-transform,must-revalidate
x-ccacdn-proxy-id: mcdpinlb3
x-frame-options: SAMEORIGIN
cf-cache-status: REVALIDATED
accept-ranges: bytes
cf-ray: 79631e81cb2290d4-FRA
via: cache17.l2de2[33,0], cache1.se1[55,0], cache3.se1[57,0]
timing-allow-origin: *, *
eagleid: 2ff62c9716758462415242840e, 2ff62c9716758462415242840e

www.bill8888.com/bb/pp.js

154.212.112.82

200 OK

1.7 kB

URL HTTP/1.1
www.bill8888.com/bb/pp.js
IP
154.212.112.82:0
ASN
#134548 DXTL Tseung Kwan O Service

File type
HTML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Size
1.7 kB (1743 bytes)
Hash
8c340169f87cdb27f0ea54b95faaba2f
d8832f36396c065615bae93d66942efa108752f9
454765233c725bc01fb5db56df1e0abbf9137f75dac6475a0f96bd252e36708c

HTTP Headers

GET /bb/pp.js HTTP/1.1
Host: www.bill8888.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://ducatl.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 08 Feb 2023 08:50:41 GMT
Content-Type: application/javascript
Last-Modified: Sat, 05 Nov 2022 07:51:14 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"636615f2-1814"
Content-Encoding: gzip

ducatl.com/favicon.ico

104.140.146.29

301 Moved Permanently

178 B

URL HTTP/1.1
ducatl.com/favicon.ico
IP
104.140.146.29:0
ASN
#62904 AS62904

File type
HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Size
178 B (178 bytes)
Hash
cd2e0e43980a00fb6a2742d3afd803b8
81ffbd1712afe8cdf138b570c0fc9934742c33c1
bd9df047d51943acc4bc6cf55d88edb5b6785a53337ee2a0f74dd521aedde87d

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: ducatl.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ducatl.com/click/five/PvqDq929BSx_A_D_M1n_a.php

HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Wed, 08 Feb 2023 08:50:42 GMT
Content-Type: text/html
Content-Length: 178
Connection: keep-alive
Location: http://www.ducatl.com/favicon.ico

www.ducatl.com/favicon.ico

104.140.146.29

200 OK

9.7 kB

URL HTTP/1.1
www.ducatl.com/favicon.ico
IP
104.140.146.29:0
ASN
#62904 AS62904

File type
MS Windows icon resource - 1 icon, 48x48, 32 bits/pixel\012- data
Size
9.7 kB (9662 bytes)
Hash
1af6c08eb07f675c862fa3cd50640511
bfc9fbddea831a3cae067a570bcb4450280c7f45
7fc7fdb7ea134949cefdbd00ac02724e091e0201c1cee06795f84db28a1586d4

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: www.ducatl.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://ducatl.com/
Connection: keep-alive

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 08 Feb 2023 08:50:42 GMT
Content-Type: image/x-icon
Content-Length: 9662
Last-Modified: Wed, 26 Oct 2022 11:09:24 GMT
Connection: keep-alive
ETag: "63591564-25be"
Accept-Ranges: bytes

ocsp.globalsign.com/gsrsaovsslca2018

104.18.20.226

200 OK

1.4 kB

URL HTTP/1.1
ocsp.globalsign.com/gsrsaovsslca2018
IP
104.18.20.226:0
ASN
#13335 CLOUDFLARENET

File type
data
Size
1.4 kB (1432 bytes)
Hash
8be99e1527d9a350cfa87ef44215949e
5384351e59862cd399cb644c0df427ec435575a5
0996272702c0dee035590b8936cc4e829b83d70242a44adb5a2afc88c70b3c0e

HTTP Headers

POST /gsrsaovsslca2018 HTTP/1.1
Host: ocsp.globalsign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Wed, 08 Feb 2023 08:50:42 GMT
Content-Type: application/ocsp-response
Content-Length: 1432
Connection: keep-alive
Expires: Sun, 12 Feb 2023 06:46:38 GMT
ETag: "5384351e59862cd399cb644c0df427ec435575a5"
Last-Modified: Wed, 08 Feb 2023 06:46:39 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: HIT
Age: 575
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 79631e89c87db529-OSL

push.zhanzhang.baidu.com/push.js

182.61.201.94

200 OK

227 B

URL HTTP/1.1
push.zhanzhang.baidu.com/push.js
IP
182.61.201.94:0
ASN
#38365 Beijing Baidu Netcom Science and Technology Co., Ltd.

File type
ASCII text, with no line terminators
Size
227 B (227 bytes)
Hash
e548b6ce15bb616c2bfba36e9cfbf307
a348285d9928a6548a57569f1fb9d62bdd747f33
7be3e4c53cc47ce5cfa40a5e79b42848a90acee0d7ff71f10ac31a49c81aead5

HTTP Headers

GET /push.js HTTP/1.1
Host: push.zhanzhang.baidu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ducatl.com/

HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=31536000
Content-Encoding: gzip
Content-Length: 227
Content-Type: text/javascript
Date: Wed, 08 Feb 2023 08:50:43 GMT
Etag: "4078521116"
Expires: Thu, 08 Feb 2024 08:50:43 GMT
Last-Modified: Wed, 25 Nov 2015 07:47:55 GMT
P3p: CP=" OTI DSP COR IVA OUR IND COM "
Server: apache
Set-Cookie: BAIDUID=5B5AE260383E7C490980DA725DA1C636:FG=1; max-age=31536000; expires=Thu, 08-Feb-24 08:50:43 GMT; domain=.baidu.com; path=/; version=1
Vary: Accept-Encoding

hm.baidu.com/hm.js?626f08b5cd8232372c847205733e28c8

103.235.46.191

200 OK

11 kB

URL HTTP/1.1
hm.baidu.com/hm.js?626f08b5cd8232372c847205733e28c8
IP
103.235.46.191:0
ASN
#55967 Beijing Baidu Netcom Science and Technology Co., Ltd.

File type
ASCII text, with very long lines (617)
Size
11 kB (11255 bytes)
Hash
8ed8f50016a12275e583b78f5ee97baa
71835926bd0a94bfc8f8c9b8dcd340064a74d74e
f0daafe87013635ac4f488401c09850e6e26ea9f46bf312e15c6608b2f2bed17

HTTP Headers

GET /hm.js?626f08b5cd8232372c847205733e28c8 HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://ducatl.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Cache-Control: max-age=0, must-revalidate
Content-Encoding: gzip
Content-Length: 11255
Content-Type: application/javascript
Date: Wed, 08 Feb 2023 08:50:43 GMT
Etag: b5390d9db5b8bcde96ede6b044512de3
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Server: apache
Set-Cookie: HMACCOUNT=AAF87C5F48745766; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800

api.share.baidu.com/s.gif?l=http://ducatl.com/click/five/PvqDq929BSx_A_D_M1n_a.php

182.61.201.94

200 OK

0 B

URL HTTP/1.1
api.share.baidu.com/s.gif?l=http://ducatl.com/click/five/PvqDq929BSx_A_D_M1n_a.php
IP
182.61.201.94:0
ASN
#38365 Beijing Baidu Netcom Science and Technology Co., Ltd.

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /s.gif?l=http://ducatl.com/click/five/PvqDq929BSx_A_D_M1n_a.php HTTP/1.1
Host: api.share.baidu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ducatl.com/

HTTP/1.1 200 OK
Content-Length: 0
Content-Type: text/plain; charset=utf-8
Date: Wed, 08 Feb 2023 08:50:44 GMT

hm.baidu.com/hm.js?0e62d9807fe7726c09e2c1481327dedf

103.235.46.191

200 OK

11 kB

URL HTTP/1.1
hm.baidu.com/hm.js?0e62d9807fe7726c09e2c1481327dedf
IP
103.235.46.191:0
ASN
#55967 Beijing Baidu Netcom Science and Technology Co., Ltd.

File type
ASCII text, with very long lines (621)
Size
11 kB (11259 bytes)
Hash
71a949571e25dadd4529411ac81527d5
e6a83def26b9592d3fb2555cfbe638c3db406a4d
6736f7203fc15f6bad25358cff74cab5abe3b04243e8b8cca074f27a4468eec4

HTTP Headers

GET /hm.js?0e62d9807fe7726c09e2c1481327dedf HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://ducatl.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Cache-Control: max-age=0, must-revalidate
Content-Encoding: gzip
Content-Length: 11259
Content-Type: application/javascript
Date: Wed, 08 Feb 2023 08:50:43 GMT
Etag: 0ce624a8f5b28280ac5040171998bfd0
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Server: apache
Set-Cookie: HMACCOUNT=3ABDA259216375E5; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800

hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=939&et=0&ja=0&ln=en-us&lo=0&rnd=1161573793&si=626f08b5cd8232372c847205733e28c8&v=1.3.0&lv=1&sn=50813&r=0&ww=1280&u=http%3A%2F%2Fducatl.com%2Fclick%2Ffive%2FPvqDq929BSx_A_D_M1n_a.php&tt=%E9%93%B6%E6%B2%B38366cc-%E4%B8%AD%E5%9B%BD%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8

103.235.46.191

200 OK

43 B

URL HTTP/1.1
hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=939&et=0&ja=0&ln=en-us&lo=0&rnd=1161573793&si=626f08b5cd8232372c847205733e28c8&v=1.3.0&lv=1&sn=50813&r=0&ww=1280&u=http%3A%2F%2Fducatl.com%2Fclick%2Ffive%2FPvqDq929BSx_A_D_M1n_a.php&tt=%E9%93%B6%E6%B2%B38366cc-%E4%B8%AD%E5%9B%BD%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8
IP
103.235.46.191:0
ASN
#55967 Beijing Baidu Netcom Science and Technology Co., Ltd.

File type
GIF image data, version 89a, 1 x 1\012- data
Size
43 B (43 bytes)
Hash
ad4b0f606e0f8465bc4c4c170b37e1a3
50b30fd5f87c85fe5cba2635cb83316ca71250d7
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

HTTP Headers

GET /hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=939&et=0&ja=0&ln=en-us&lo=0&rnd=1161573793&si=626f08b5cd8232372c847205733e28c8&v=1.3.0&lv=1&sn=50813&r=0&ww=1280&u=http%3A%2F%2Fducatl.com%2Fclick%2Ffive%2FPvqDq929BSx_A_D_M1n_a.php&tt=%E9%93%B6%E6%B2%B38366cc-%E4%B8%AD%E5%9B%BD%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8 HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://ducatl.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Cache-Control: private, max-age=0, no-cache
Content-Length: 43
Content-Type: image/gif
Date: Wed, 08 Feb 2023 08:50:44 GMT
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Pragma: no-cache
Server: apache
Set-Cookie: HMACCOUNT=8A47F8B39F908699; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800
X-Content-Type-Options: nosniff

ocsp.trust-provider.cn/

47.246.44.205

200 OK

599 B

URL HTTP/1.1
ocsp.trust-provider.cn/
IP
47.246.44.205:0
ASN
#24429 Zhejiang Taobao Network Co.,Ltd

File type
data
Size
599 B (599 bytes)
Hash
f6990cf1e656ac0c9535c7ae4cdf87e3
c2f1c2a2ca62b3359b25512636e93fb2b5c62c05
4456c04a3768046aafc586cd8dc038a24d4087ca650a8efcf8d367ca8ba75c1e

HTTP Headers

POST / HTTP/1.1
Host: ocsp.trust-provider.cn
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: Tengine
Content-Type: application/ocsp-response
Transfer-Encoding: chunked
Connection: keep-alive
date: Wed, 08 Feb 2023 08:50:44 GMT
last-modified: Sun, 05 Feb 2023 05:12:39 GMT
expires: Sun, 12 Feb 2023 05:12:38 GMT
etag: "c2f1c2a2ca62b3359b25512636e93fb2b5c62c05"
cache-control: max-age=461618,s-maxage=1800,public,no-transform,must-revalidate
x-ccacdn-proxy-id: mcdpinlb5
x-frame-options: SAMEORIGIN
cf-cache-status: REVALIDATED
accept-ranges: bytes
cf-ray: 79631e938e002c5f-FRA
via: cache1.l2de2[193,0], cache1.se1[212,0], cache3.se1[214,0]
timing-allow-origin: *, *
eagleid: 2ff62c9716758462443715884e, 2ff62c9716758462443715884e

hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=939&et=0&ja=0&ln=en-us&lo=0&rnd=1962714651&si=0e62d9807fe7726c09e2c1481327dedf&v=1.3.0&lv=1&sn=50813&r=0&ww=1280&u=http%3A%2F%2Fducatl.com%2Fclick%2Ffive%2FPvqDq929BSx_A_D_M1n_a.php&tt=%E9%93%B6%E6%B2%B38366cc-%E4%B8%AD%E5%9B%BD%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8

103.235.46.191

200 OK

43 B

URL HTTP/1.1
hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=939&et=0&ja=0&ln=en-us&lo=0&rnd=1962714651&si=0e62d9807fe7726c09e2c1481327dedf&v=1.3.0&lv=1&sn=50813&r=0&ww=1280&u=http%3A%2F%2Fducatl.com%2Fclick%2Ffive%2FPvqDq929BSx_A_D_M1n_a.php&tt=%E9%93%B6%E6%B2%B38366cc-%E4%B8%AD%E5%9B%BD%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8
IP
103.235.46.191:0
ASN
#55967 Beijing Baidu Netcom Science and Technology Co., Ltd.

File type
GIF image data, version 89a, 1 x 1\012- data
Size
43 B (43 bytes)
Hash
ad4b0f606e0f8465bc4c4c170b37e1a3
50b30fd5f87c85fe5cba2635cb83316ca71250d7
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

HTTP Headers

GET /hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=939&et=0&ja=0&ln=en-us&lo=0&rnd=1962714651&si=0e62d9807fe7726c09e2c1481327dedf&v=1.3.0&lv=1&sn=50813&r=0&ww=1280&u=http%3A%2F%2Fducatl.com%2Fclick%2Ffive%2FPvqDq929BSx_A_D_M1n_a.php&tt=%E9%93%B6%E6%B2%B38366cc-%E4%B8%AD%E5%9B%BD%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8 HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://ducatl.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Cache-Control: private, max-age=0, no-cache
Content-Length: 43
Content-Type: image/gif
Date: Wed, 08 Feb 2023 08:50:44 GMT
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Pragma: no-cache
Server: apache
Set-Cookie: HMACCOUNT=5D63F575432F06DF; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800
X-Content-Type-Options: nosniff

www.bill2021.com/dan/indexty.html

154.208.77.212

200 OK

1.4 kB

URL HTTP/1.1
www.bill2021.com/dan/indexty.html
IP
154.208.77.212:0
ASN
#134548 DXTL Tseung Kwan O Service

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (352)
Size
1.4 kB (1439 bytes)
Hash
9207a79bb10fc15812c3076c66ff52fc
2faef2e2afe7d9adf4978b196d554cdb5d129cc0
9a258e6c1b0d3eb25f3f5ef89cfc2edf31533be62ab10678c71e7af3041b95f4

HTTP Headers

GET /dan/indexty.html HTTP/1.1
Host: www.bill2021.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://ducatl.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 08 Feb 2023 08:50:44 GMT
Content-Type: text/html
Last-Modified: Sat, 29 Oct 2022 01:20:50 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"635c7ff2-ff0"
Content-Encoding: gzip

www.bill2021.com/js/zhongguomeng.js.js

154.208.77.212

404 Not Found

162 B

URL HTTP/1.1
www.bill2021.com/js/zhongguomeng.js.js
IP
154.208.77.212:0
ASN
#134548 DXTL Tseung Kwan O Service

File type
HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Size
162 B (162 bytes)
Hash
70461da8b94c6ca5d2fda3260c5a8c3b
994bc667720c21257500e29038c1a5f61e25da1e
f33c27745f2bd87344be790465ef984a972fd539dc83bd4f61d4242c607ef1ee

HTTP Headers

GET /js/zhongguomeng.js.js HTTP/1.1
Host: www.bill2021.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.bill2021.com/dan/indexty.html
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 404 Not Found
Server: nginx
Date: Wed, 08 Feb 2023 08:50:44 GMT
Content-Type: text/html
Content-Length: 162
Connection: keep-alive

www.bill2021.com/css/index.css

154.208.77.212

404 Not Found

162 B

URL HTTP/1.1
www.bill2021.com/css/index.css
IP
154.208.77.212:0
ASN
#134548 DXTL Tseung Kwan O Service

File type
HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Size
162 B (162 bytes)
Hash
70461da8b94c6ca5d2fda3260c5a8c3b
994bc667720c21257500e29038c1a5f61e25da1e
f33c27745f2bd87344be790465ef984a972fd539dc83bd4f61d4242c607ef1ee

HTTP Headers

GET /css/index.css HTTP/1.1
Host: www.bill2021.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.bill2021.com/dan/indexty.html
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 404 Not Found
Server: nginx
Date: Wed, 08 Feb 2023 08:50:45 GMT
Content-Type: text/html
Content-Length: 162
Connection: keep-alive

www.bill2021.com/dan/js/zhongguomeng.js

154.208.77.212

200 OK

921 B

URL HTTP/1.1
www.bill2021.com/dan/js/zhongguomeng.js
IP
154.208.77.212:0
ASN
#134548 DXTL Tseung Kwan O Service

File type
ASCII text, with CRLF line terminators
Size
921 B (921 bytes)
Hash
3da863ecf8288216264f7cad05e4c25f
9dc6ba91c91d51a29d6700487737b52435316b5c
257652bb1b88d71b2ae81a3c18c742293c61b0e30bb14548061295ae09e942dc

HTTP Headers

GET /dan/js/zhongguomeng.js HTTP/1.1
Host: www.bill2021.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.bill2021.com/dan/indexty.html
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 08 Feb 2023 08:50:45 GMT
Content-Type: application/javascript
Content-Length: 921
Last-Modified: Tue, 07 Feb 2023 08:39:00 GMT
Connection: keep-alive
ETag: "63e20e24-399"
Accept-Ranges: bytes

www.bill2021.com/dan/index.css

154.208.77.212

200 OK

511 B

URL HTTP/1.1
www.bill2021.com/dan/index.css
IP
154.208.77.212:0
ASN
#134548 DXTL Tseung Kwan O Service

File type
ASCII text
Size
511 B (511 bytes)
Hash
1a04275bd681a7baf6118fd368aa3eff
05969c3a348b2f8e4ab4f3e31c55fea788074480
b4328988195bd9d7ff38a3519f1d650d7d98c8cc91500174fcc24d448ebd2b2b

HTTP Headers

GET /dan/index.css HTTP/1.1
Host: www.bill2021.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.bill2021.com/dan/indexty.html
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 08 Feb 2023 08:50:45 GMT
Content-Type: text/css
Last-Modified: Fri, 24 Dec 2021 10:25:42 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"61c5a026-450"
Content-Encoding: gzip

www.bill2021.com/dan/img/bg1111.jpg

154.208.77.212

404 Not Found

162 B

URL HTTP/1.1
www.bill2021.com/dan/img/bg1111.jpg
IP
154.208.77.212:0
ASN
#134548 DXTL Tseung Kwan O Service

File type
HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Size
162 B (162 bytes)
Hash
70461da8b94c6ca5d2fda3260c5a8c3b
994bc667720c21257500e29038c1a5f61e25da1e
f33c27745f2bd87344be790465ef984a972fd539dc83bd4f61d4242c607ef1ee

HTTP Headers

GET /dan/img/bg1111.jpg HTTP/1.1
Host: www.bill2021.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.bill2021.com/dan/index.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 404 Not Found
Server: nginx
Date: Wed, 08 Feb 2023 08:50:45 GMT
Content-Type: text/html
Content-Length: 162
Connection: keep-alive

www.bill2021.com/dan/pkPhoto/ledong100.png

154.208.77.212

200 OK

222 kB

URL HTTP/1.1
www.bill2021.com/dan/pkPhoto/ledong100.png
IP
154.208.77.212:0
ASN
#134548 DXTL Tseung Kwan O Service

File type
PNG image data, 2100 x 150, 8-bit colormap, non-interlaced\012- data
Size
222 kB (222004 bytes)
Hash
c514cc26a8bbf5cb52abdf9ab9e68980
18199a677d4fbb0cf0a1c7f9af076c2ae76fb4cb
3a39dc076d1c0bfec10debd1c0f54249d89036049dad5f24255eb2e6b610b27d

HTTP Headers

GET /dan/pkPhoto/ledong100.png HTTP/1.1
Host: www.bill2021.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.bill2021.com/dan/indexty.html
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 08 Feb 2023 08:50:45 GMT
Content-Type: image/png
Content-Length: 222004
Last-Modified: Thu, 08 Sep 2022 07:53:28 GMT
Connection: keep-alive
ETag: "63199f78-36334"
Accept-Ranges: bytes

www.bill2021.com/dan/pkPhoto/kaiyun1100x200.png

154.208.77.212

200 OK

0 B

URL HTTP/1.1
www.bill2021.com/dan/pkPhoto/kaiyun1100x200.png
IP
154.208.77.212:0
ASN
#134548 DXTL Tseung Kwan O Service

File type

Size
0 B (0 bytes)
Hash

HTTP Headers

GET /dan/pkPhoto/kaiyun1100x200.png HTTP/1.1
Host: www.bill2021.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.bill2021.com/dan/indexty.html
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 08 Feb 2023 08:50:45 GMT
Content-Type: image/png
Content-Length: 470322
Last-Modified: Sat, 29 Oct 2022 01:15:52 GMT
Connection: keep-alive
ETag: "635c7ec8-72d32"
Accept-Ranges: bytes

www.bill2021.com/dan/pkPhoto/ty-wanbo.png

154.208.77.212

200 OK

0 B

URL HTTP/1.1
www.bill2021.com/dan/pkPhoto/ty-wanbo.png
IP
154.208.77.212:0
ASN
#134548 DXTL Tseung Kwan O Service

File type

Size
0 B (0 bytes)
Hash

HTTP Headers

GET /dan/pkPhoto/ty-wanbo.png HTTP/1.1
Host: www.bill2021.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.bill2021.com/dan/indexty.html
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 08 Feb 2023 08:50:45 GMT
Content-Type: image/png
Content-Length: 319786
Last-Modified: Thu, 08 Sep 2022 07:53:27 GMT
Connection: keep-alive
ETag: "63199f77-4e12a"
Accept-Ranges: bytes

www.bill2021.com/dan/pkPhoto/bet1000x100_jpg.jpg

154.208.77.212

200 OK

0 B

URL HTTP/1.1
www.bill2021.com/dan/pkPhoto/bet1000x100_jpg.jpg
IP
154.208.77.212:0
ASN
#134548 DXTL Tseung Kwan O Service

File type

Size
0 B (0 bytes)
Hash

HTTP Headers

GET /dan/pkPhoto/bet1000x100_jpg.jpg HTTP/1.1
Host: www.bill2021.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.bill2021.com/dan/indexty.html
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 08 Feb 2023 08:50:48 GMT
Content-Type: image/jpeg
Content-Length: 118484
Last-Modified: Mon, 26 Sep 2022 05:53:04 GMT
Connection: keep-alive
ETag: "63313e40-1ced4"
Accept-Ranges: bytes

www.bill2021.com/dan/pkPhoto/weibu.jpg

154.208.77.212

200 OK

0 B

URL HTTP/1.1
www.bill2021.com/dan/pkPhoto/weibu.jpg
IP
154.208.77.212:0
ASN
#134548 DXTL Tseung Kwan O Service

File type

Size
0 B (0 bytes)
Hash

HTTP Headers

GET /dan/pkPhoto/weibu.jpg HTTP/1.1
Host: www.bill2021.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.bill2021.com/dan/indexty.html
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 08 Feb 2023 08:50:45 GMT
Content-Type: image/jpeg
Content-Length: 93266
Last-Modified: Thu, 08 Sep 2022 07:53:17 GMT
Connection: keep-alive
ETag: "63199f6d-16c52"
Accept-Ranges: bytes

www.bill2021.com/dan/pkPhoto/bcxh.png

154.208.77.212

200 OK

0 B

URL HTTP/1.1
www.bill2021.com/dan/pkPhoto/bcxh.png
IP
154.208.77.212:0
ASN
#134548 DXTL Tseung Kwan O Service

File type

Size
0 B (0 bytes)
Hash

HTTP Headers

GET /dan/pkPhoto/bcxh.png HTTP/1.1
Host: www.bill2021.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.bill2021.com/dan/indexty.html
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 08 Feb 2023 08:50:46 GMT
Content-Type: image/png
Content-Length: 135021
Last-Modified: Thu, 08 Sep 2022 07:53:17 GMT
Connection: keep-alive
ETag: "63199f6d-20f6d"
Accept-Ranges: bytes

www.bill2021.com/dan/pkPhoto/amdcpc.gif

154.208.77.212

200 OK

0 B

URL HTTP/1.1
www.bill2021.com/dan/pkPhoto/amdcpc.gif
IP
154.208.77.212:0
ASN
#134548 DXTL Tseung Kwan O Service

File type

Size
0 B (0 bytes)
Hash

HTTP Headers

GET /dan/pkPhoto/amdcpc.gif HTTP/1.1
Host: www.bill2021.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.bill2021.com/dan/indexty.html
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 08 Feb 2023 08:50:45 GMT
Content-Type: image/gif
Content-Length: 278305
Last-Modified: Thu, 08 Sep 2022 07:53:28 GMT
Connection: keep-alive
ETag: "63199f78-43f21"
Accept-Ranges: bytes

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (12)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML