urlquery - report: wvujvfgrrf.duckdns.org/

Fully Qualifying Domain Name	Rank	First Seen	Last Seen	IP	Comment
firefox.settings.services.mozilla.com (2)	867	2020-05-25 20:06:39 UTC	2023-01-30 04:09:03 UTC	35.241.9.150
content-signature-2.cdn.mozilla.net (1)	1152	2020-11-03 12:26:46 UTC	2023-01-30 04:10:11 UTC	34.160.144.191
contile.services.mozilla.com (1)	1114	2021-05-27 18:32:35 UTC	2023-01-30 04:10:15 UTC	34.117.237.239
push.services.mozilla.com (1)	2140	2014-10-24 08:27:06 UTC	2023-01-30 04:11:18 UTC	35.82.231.103
img-getpocket.cdn.mozilla.net (6)	1631	2017-09-01 03:40:57 UTC	2023-01-30 04:09:18 UTC	34.120.237.76
wvujvfgrrf.duckdns.org (10)	0	2022-09-22 07:43:48 UTC	2023-01-20 12:47:47 UTC	45.12.138.122	Unknown ranking
r3.o.lencr.org (7)	344	2020-12-02 08:52:13 UTC	2023-01-30 04:09:08 UTC	23.36.77.32

Timestamp	Severity	Source IP	Destination IP	Alert
2023-01-30 19:26:59 UTC	2	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain
2023-01-30 19:26:59 UTC	3	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
2023-01-30 19:26:59 UTC	2	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain
2023-01-30 19:26:59 UTC	3	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
2023-01-30 19:27:00 UTC	2	Client IP	45.12.138.122	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
2023-01-30 19:27:00 UTC	2	Client IP	45.12.138.122	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
2023-01-30 19:27:00 UTC	2	Client IP	45.12.138.122	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
2023-01-30 19:27:00 UTC	2	Client IP	45.12.138.122	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
2023-01-30 19:27:00 UTC	2	Client IP	45.12.138.122	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
2023-01-30 19:27:00 UTC	2	Client IP	45.12.138.122	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
2023-01-30 19:27:00 UTC	2	Client IP	45.12.138.122	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
2023-01-30 19:27:00 UTC	2	Client IP	45.12.138.122	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
2023-01-30 19:27:00 UTC	2	Client IP	45.12.138.122	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
2023-01-30 19:27:00 UTC	2	Client IP	45.12.138.122	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain

Scan Date	Severity	Indicator	Comment
2023-01-30	2	wvujvfgrrf.duckdns.org/	Phishing
2023-01-30	2	wvujvfgrrf.duckdns.org/noindex/css/fonts/Light/OpenSans-Light.woff	Phishing
2023-01-30	2	wvujvfgrrf.duckdns.org/noindex/css/fonts/Bold/OpenSans-Bold.woff	Phishing
2023-01-30	2	wvujvfgrrf.duckdns.org/noindex/css/fonts/Light/OpenSans-Light.ttf	Phishing
2023-01-30	2	wvujvfgrrf.duckdns.org/noindex/css/fonts/Bold/OpenSans-Bold.ttf	Phishing

Date	UQ / IDS / BL	URL	IP
2023-03-14 11:58:16 +0000	0 - 4 - 0	vstnybwdji.duckdns.org/	45.12.138.122
2023-03-11 21:13:06 +0000	0 - 4 - 0	dpmtfrczvw.duckdns.org/	45.12.138.122
2023-03-11 21:13:05 +0000	0 - 4 - 0	ttuafnxckp.duckdns.org/	45.12.138.122
2023-03-11 20:05:00 +0000	0 - 4 - 0	cvudvpomgz.duckdns.org/	45.12.138.122
2023-03-11 09:43:34 +0000	0 - 4 - 0	ldmnxobjht.duckdns.org/	45.12.138.122

Date	UQ / IDS / BL	URL	IP
2023-03-23 07:36:28 +0000	3 - 6 - 0	vxffoaozls.duckdns.org/	63.251.217.98
2023-03-23 05:09:03 +0000	0 - 0 - 1	botguard-checker.com/	45.66.248.9
2023-03-22 16:58:27 +0000	0 - 0 - 2	hello.studioqv.com/index.php/campaigns/rk3846 (...)	194.5.152.187
2023-03-22 15:29:06 +0000	0 - 0 - 1	mwtrk.elm.fetch3d.com/index.php/campaigns/yb6 (...)	194.5.152.187
2023-03-22 15:29:04 +0000	0 - 0 - 2	hello.studioqv.com/index.php/campaigns/yb660v (...)	194.5.152.187

Date	UQ / IDS / BL	URL	IP
2023-01-30 19:26:57 +0000	11 - 14 - 5	wvujvfgrrf.duckdns.org/	45.12.138.122

Date	UQ / IDS / BL	URL	IP
2023-03-23 02:18:23 +0000	0 - 4 - 6	cloudserve.pw/	207.180.212.249
2023-03-22 22:05:31 +0000	0 - 0 - 10	185.244.129.67/	185.244.129.67
2023-03-22 20:34:06 +0000	0 - 0 - 25	wrappixels.com	46.235.42.137
2023-03-22 08:55:44 +0000	0 - 0 - 10	103.29.182.143/	103.29.182.143
2023-03-22 01:49:19 +0000	0 - 0 - 25	wrappixels.com	46.235.42.137

HTTP Transactions (28)

Request	Response
GET / HTTP/1.1 Host: wvujvfgrrf.duckdns.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Upgrade-Insecure-Requests: 1	URL: wvujvfgrrf.duckdns.org/ FQDN: wvujvfgrrf.duckdns.org IP: 45.12.138.122 HASH: 9ec2f0698f1c3497de39a192dd1c3f3e4506ff1a84dbf85082344297dc52e681 45.12.138.122 HTTP/1.1 403 Forbidden Content-Type: text/html; charset=UTF-8 Date: Mon, 30 Jan 2023 19:26:46 GMT Server: Apache/2.4.6 (CentOS) Last-Modified: Thu, 16 Oct 2014 13:20:58 GMT ETag: "1321-5058a1e728280" Accept-Ranges: bytes Content-Length: 4897 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive --- Additional Info --- Magic: HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text Size: 4897 Md5: 5f3664ed52f6df47c88ec162bb36add4 Sha1: 8e66f78c4d0f075066205823d110bc1902157fcf Sha256: 9ec2f0698f1c3497de39a192dd1c3f3e4506ff1a84dbf85082344297dc52e681 Alerts: urlquery: - Suspicious - DynDNS domain Blocklists: - fortinet: Phishing IDS: - ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.77.32 HASH: d8083ee567c7b3023111dc30f32c94237df7db30d4d2daaea0a569e8a3069ad7 23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "D8083EE567C7B3023111DC30F32C94237DF7DB30D4D2DAAEA0A569E8A3069AD7" Last-Modified: Sat, 28 Jan 2023 16:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=14682 Expires: Mon, 30 Jan 2023 23:31:28 GMT Date: Mon, 30 Jan 2023 19:26:46 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 3eb88dea4fe00db1182370e72683c3ab Sha1: ca520abf1e91bfd2aef40c6a1270a911071e8922 Sha256: d8083ee567c7b3023111dc30f32c94237df7db30d4d2daaea0a569e8a3069ad7
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.77.32 HASH: c085cf277dd0429fe15e4a4bce5595636e9f2204d5a8e77220f8bf88adf4068f 23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "C085CF277DD0429FE15E4A4BCE5595636E9F2204D5A8E77220F8BF88ADF4068F" Last-Modified: Sun, 29 Jan 2023 00:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=15019 Expires: Mon, 30 Jan 2023 23:37:05 GMT Date: Mon, 30 Jan 2023 19:26:46 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 5eb7c9bc996a0ff420e58af45526f053 Sha1: 8c2614832b8efe1c9da0bbd465d6f3f172d95a9e Sha256: c085cf277dd0429fe15e4a4bce5595636e9f2204d5a8e77220f8bf88adf4068f
GET /v1/ HTTP/1.1 Host: firefox.settings.services.mozilla.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: firefox.settings.services.mozilla.com/v1/ FQDN: firefox.settings.services.mozilla.com IP: 35.241.9.150 HASH: 73672a816da4450fe2c938b08d7ae002d9ca29fdcbd3e29cc97084d826f8b459 35.241.9.150 HTTP/2 200 OK content-type: application/json access-control-allow-origin: * access-control-expose-headers: Alert, Retry-After, Content-Type, Content-Length, Backoff content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none'; strict-transport-security: max-age=31536000 x-content-type-options: nosniff content-length: 939 via: 1.1 google date: Mon, 30 Jan 2023 18:43:12 GMT age: 2614 cache-control: max-age=3600,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JSON data\012- , ASCII text, with very long lines (939), with no line terminators Size: 939 Md5: dcd75ca6daca51c5e39d431468511793 Sha1: 07f76d3bf23d65c9110d810fa71a994e39e085d3 Sha256: 73672a816da4450fe2c938b08d7ae002d9ca29fdcbd3e29cc97084d826f8b459
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.77.32 HASH: fc2bd9091006189e67e8074093805ee5492ce16e1dbfba32e083abeeae34969d 23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "FC2BD9091006189E67E8074093805EE5492CE16E1DBFBA32E083ABEEAE34969D" Last-Modified: Sat, 28 Jan 2023 16:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=10068 Expires: Mon, 30 Jan 2023 22:14:34 GMT Date: Mon, 30 Jan 2023 19:26:46 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 302c7548412192add063ad6c8b99cf3b Sha1: e5d178931a27db036ce8daae302594d3ff7050b8 Sha256: fc2bd9091006189e67e8074093805ee5492ce16e1dbfba32e083abeeae34969d
GET /chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain HTTP/1.1 Host: content-signature-2.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: no-cors Sec-Fetch-Site: cross-site	URL: content-signature-2.cdn.mozilla.net/chains/remote-setti (...) FQDN: content-signature-2.cdn.mozilla.net IP: 34.160.144.191 HASH: adbb3e06df0e870f5c7a9cb81e8979d4e92735853d75c9b779c06470d4db5d9c 34.160.144.191 HTTP/2 200 OK content-type: binary/octet-stream x-amz-id-2: 8wA7S6kl2ZZVrfXe+gpWVcBjAiM7vMlPacACWLclCzypcwFXvK28N8u01Bi+0sJtXn3SdOhCQu8= x-amz-request-id: 96M7TN0Y6JWANV9J content-disposition: attachment accept-ranges: bytes server: AmazonS3 content-length: 5348 via: 1.1 google date: Mon, 30 Jan 2023 19:21:55 GMT age: 291 last-modified: Mon, 09 Jan 2023 18:04:21 GMT etag: "7b922915ebf1fa3639b333f994c74f24" cache-control: public,max-age=3600 alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: PEM certificate\012- , ASCII text Size: 5348 Md5: 7b922915ebf1fa3639b333f994c74f24 Sha1: 144a3f80b98fd0652d4614f24cf6cbbee40f8938 Sha256: adbb3e06df0e870f5c7a9cb81e8979d4e92735853d75c9b779c06470d4db5d9c
GET /v1/tiles HTTP/1.1 Host: contile.services.mozilla.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: contile.services.mozilla.com/v1/tiles FQDN: contile.services.mozilla.com IP: 34.117.237.239 HASH: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3 34.117.237.239 HTTP/2 200 OK content-type: application/json server: nginx date: Mon, 30 Jan 2023 19:26:46 GMT content-length: 12 vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers access-control-expose-headers: content-type access-control-allow-credentials: true strict-transport-security: max-age=31536000 via: 1.1 google alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JSON data\012- , ASCII text, with no line terminators Size: 12 Md5: 23e88fb7b99543fb33315b29b1fad9d6 Sha1: a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce Sha256: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /noindex/css/bootstrap.min.css HTTP/1.1 Host: wvujvfgrrf.duckdns.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: text/css,/;q=0.1 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Referer: http://wvujvfgrrf.duckdns.org/	URL: wvujvfgrrf.duckdns.org/noindex/css/bootstrap.min.css FQDN: wvujvfgrrf.duckdns.org IP: 45.12.138.122 HASH: bc40aeafcd25bc944d0d6357298c1b198b4a1fe294e0b84015d04b72cf942c10 45.12.138.122 HTTP/1.1 200 OK Content-Type: text/css Date: Mon, 30 Jan 2023 19:26:47 GMT Server: Apache/2.4.6 (CentOS) Last-Modified: Tue, 17 Jun 2014 16:00:47 GMT ETag: "4b8d-4fc0a3f32a9c0" Accept-Ranges: bytes Content-Length: 19341 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive --- Additional Info --- Magic: ASCII text, with very long lines (19170) Size: 19341 Md5: 44c7856dea679ebcccf8fe201fbe1a7c Sha1: 192a297f8aeda2bcdd0faa5320ffff825d24116f Sha256: bc40aeafcd25bc944d0d6357298c1b198b4a1fe294e0b84015d04b72cf942c10 Alerts: urlquery: - Suspicious - DynDNS domain IDS: - ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
GET /noindex/css/open-sans.css HTTP/1.1 Host: wvujvfgrrf.duckdns.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: text/css,/;q=0.1 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Referer: http://wvujvfgrrf.duckdns.org/	URL: wvujvfgrrf.duckdns.org/noindex/css/open-sans.css FQDN: wvujvfgrrf.duckdns.org IP: 45.12.138.122 HASH: 65e9f0d6919c412dd5a04c322ce9cf9db80a1182f57778606a76110086c49fca 45.12.138.122 HTTP/1.1 200 OK Content-Type: text/css Date: Mon, 30 Jan 2023 19:26:47 GMT Server: Apache/2.4.6 (CentOS) Last-Modified: Tue, 17 Jun 2014 16:00:47 GMT ETag: "13d9-4fc0a3f32a9c0" Accept-Ranges: bytes Content-Length: 5081 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive --- Additional Info --- Magic: ASCII text Size: 5081 Md5: 0ca7398a3e9ef11b70b5dfd1a052fe58 Sha1: 8bb7623c7027e927c0eced114d6011c57101a26f Sha256: 65e9f0d6919c412dd5a04c322ce9cf9db80a1182f57778606a76110086c49fca Alerts: urlquery: - Suspicious - DynDNS domain IDS: - ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
GET /images/poweredby.png HTTP/1.1 Host: wvujvfgrrf.duckdns.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Referer: http://wvujvfgrrf.duckdns.org/	URL: wvujvfgrrf.duckdns.org/images/poweredby.png FQDN: wvujvfgrrf.duckdns.org IP: 45.12.138.122 HASH: 5b720d579bbc1f8fee3b64df9290d41a28c747a5802589e48e05b7ebbfe9fc2f 45.12.138.122 HTTP/1.1 200 OK Content-Type: image/png Date: Mon, 30 Jan 2023 19:26:47 GMT Server: Apache/2.4.6 (CentOS) Last-Modified: Tue, 17 Jun 2014 16:00:47 GMT ETag: "f74-4fc0a3f32a9c0" Accept-Ranges: bytes Content-Length: 3956 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive --- Additional Info --- Magic: PNG image data, 88 x 31, 8-bit/color RGB, non-interlaced\012- data Size: 3956 Md5: 5b1ca9f747c1b73dfa1c508765d9056a Sha1: 6b319c943d8c69e212e7de8385802891dbafe8a3 Sha256: 5b720d579bbc1f8fee3b64df9290d41a28c747a5802589e48e05b7ebbfe9fc2f Alerts: urlquery: - Suspicious - DynDNS domain IDS: - ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
GET /images/apache_pb.gif HTTP/1.1 Host: wvujvfgrrf.duckdns.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Referer: http://wvujvfgrrf.duckdns.org/	URL: wvujvfgrrf.duckdns.org/images/apache_pb.gif FQDN: wvujvfgrrf.duckdns.org IP: 45.12.138.122 HASH: 1654416fec35a8b5d36ee0257025cec63e56dfe8572b6ff67c6b0d0d43158cbb 45.12.138.122 HTTP/1.1 200 OK Content-Type: image/gif Date: Mon, 30 Jan 2023 19:26:47 GMT Server: Apache/2.4.6 (CentOS) Last-Modified: Tue, 17 Jun 2014 16:00:47 GMT ETag: "916-4fc0a3f32a9c0" Accept-Ranges: bytes Content-Length: 2326 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive --- Additional Info --- Magic: GIF image data, version 89a, 259 x 32\012- data Size: 2326 Md5: 48bc8b181b36c9289866a2e30f6afedd Sha1: 7bcc5d916d33ab08929a9f7c1d07c33ac1ba47ba Sha256: 1654416fec35a8b5d36ee0257025cec63e56dfe8572b6ff67c6b0d0d43158cbb Alerts: urlquery: - Suspicious - DynDNS domain IDS: - ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
GET /noindex/css/fonts/Light/OpenSans-Light.woff HTTP/1.1 Host: wvujvfgrrf.duckdns.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: identity Connection: keep-alive Referer: http://wvujvfgrrf.duckdns.org/noindex/css/open-sans.css	URL: wvujvfgrrf.duckdns.org/noindex/css/fonts/Light/OpenSans (...) FQDN: wvujvfgrrf.duckdns.org IP: 45.12.138.122 HASH: c4183128dc59a2ce673414a77fcab7ca0250ef354ef636df49d2b83580734ee0 45.12.138.122 HTTP/1.1 404 Not Found Content-Type: text/html; charset=iso-8859-1 Date: Mon, 30 Jan 2023 19:26:47 GMT Server: Apache/2.4.6 (CentOS) Content-Length: 241 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive --- Additional Info --- Magic: HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text Size: 241 Md5: d5d3f08fc8f1b36bac0b06b89d5384ca Sha1: cafebd0173cce7edfcbadcea5b8eabc4d7a20511 Sha256: c4183128dc59a2ce673414a77fcab7ca0250ef354ef636df49d2b83580734ee0 Alerts: urlquery: - Suspicious - DynDNS domain Blocklists: - fortinet: Phishing IDS: - ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
GET /noindex/css/fonts/Bold/OpenSans-Bold.woff HTTP/1.1 Host: wvujvfgrrf.duckdns.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: identity Connection: keep-alive Referer: http://wvujvfgrrf.duckdns.org/noindex/css/open-sans.css	URL: wvujvfgrrf.duckdns.org/noindex/css/fonts/Bold/OpenSans- (...) FQDN: wvujvfgrrf.duckdns.org IP: 45.12.138.122 HASH: b5b54ea0662073c401cabb250a4f107c4763241fa43418503ae5764cff7e9ee4 45.12.138.122 HTTP/1.1 404 Not Found Content-Type: text/html; charset=iso-8859-1 Date: Mon, 30 Jan 2023 19:26:47 GMT Server: Apache/2.4.6 (CentOS) Content-Length: 239 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive --- Additional Info --- Magic: HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text Size: 239 Md5: 55e916743163813c7b8f4524f6e36b99 Sha1: e1353703fda388ec26bf105b4132b0459f10163e Sha256: b5b54ea0662073c401cabb250a4f107c4763241fa43418503ae5764cff7e9ee4 Alerts: urlquery: - Suspicious - DynDNS domain Blocklists: - fortinet: Phishing IDS: - ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
GET /noindex/css/fonts/Light/OpenSans-Light.ttf HTTP/1.1 Host: wvujvfgrrf.duckdns.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Referer: http://wvujvfgrrf.duckdns.org/noindex/css/open-sans.css	URL: wvujvfgrrf.duckdns.org/noindex/css/fonts/Light/OpenSans (...) FQDN: wvujvfgrrf.duckdns.org IP: 45.12.138.122 HASH: 67db0d028a14f7beb79f8bc441b5d687ca683511965d60e40faebec708d85612 45.12.138.122 HTTP/1.1 404 Not Found Content-Type: text/html; charset=iso-8859-1 Date: Mon, 30 Jan 2023 19:26:47 GMT Server: Apache/2.4.6 (CentOS) Content-Length: 240 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive --- Additional Info --- Magic: HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text Size: 240 Md5: 5a99182bd45553a369543ec2937fa690 Sha1: c8766a2b6d830b3d38263d54b0e88c1e384664b7 Sha256: 67db0d028a14f7beb79f8bc441b5d687ca683511965d60e40faebec708d85612 Alerts: urlquery: - Suspicious - DynDNS domain Blocklists: - fortinet: Phishing IDS: - ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
GET /noindex/css/fonts/Bold/OpenSans-Bold.ttf HTTP/1.1 Host: wvujvfgrrf.duckdns.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Referer: http://wvujvfgrrf.duckdns.org/noindex/css/open-sans.css	URL: wvujvfgrrf.duckdns.org/noindex/css/fonts/Bold/OpenSans- (...) FQDN: wvujvfgrrf.duckdns.org IP: 45.12.138.122 HASH: e163df3b08c83f6bdc15321fb0403d1dd059f2846037916a3d12ad2806cb5978 45.12.138.122 HTTP/1.1 404 Not Found Content-Type: text/html; charset=iso-8859-1 Date: Mon, 30 Jan 2023 19:26:47 GMT Server: Apache/2.4.6 (CentOS) Content-Length: 238 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive --- Additional Info --- Magic: HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text Size: 238 Md5: 75a28665a8da5eb0e3200d8279c7ef42 Sha1: ee945af618fe1976e31cd1c467ae0cd68a7fad29 Sha256: e163df3b08c83f6bdc15321fb0403d1dd059f2846037916a3d12ad2806cb5978 Alerts: urlquery: - Suspicious - DynDNS domain Blocklists: - fortinet: Phishing IDS: - ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 Host: firefox.settings.services.mozilla.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: application/json Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Type: application/json Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: firefox.settings.services.mozilla.com/v1/buckets/main/c (...) FQDN: firefox.settings.services.mozilla.com IP: 35.241.9.150 HASH: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300 35.241.9.150 HTTP/2 200 OK content-type: application/json access-control-allow-origin: * access-control-expose-headers: Alert, Last-Modified, Pragma, ETag, Retry-After, Content-Type, Content-Length, Expires, Cache-Control, Backoff content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none'; strict-transport-security: max-age=31536000 x-content-type-options: nosniff content-length: 329 via: 1.1 google date: Mon, 30 Jan 2023 18:41:41 GMT age: 2706 last-modified: Fri, 25 Mar 2022 17:45:46 GMT etag: "1648230346554" cache-control: max-age=3600,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JSON data\012- , ASCII text, with very long lines (329), with no line terminators Size: 329 Md5: 0333b0655111aa68de771adfcc4db243 Sha1: 63f295a144ac87a7c8e23417626724eeca68a7eb Sha256: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /favicon.ico HTTP/1.1 Host: wvujvfgrrf.duckdns.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Referer: http://wvujvfgrrf.duckdns.org/	URL: wvujvfgrrf.duckdns.org/favicon.ico FQDN: wvujvfgrrf.duckdns.org IP: 45.12.138.122 HASH: b6682cab65d3243b5b75efb7279dbf49491957484780f2ba0a87632cc0e25642 45.12.138.122 HTTP/1.1 404 Not Found Content-Type: text/html; charset=iso-8859-1 Date: Mon, 30 Jan 2023 19:26:47 GMT Server: Apache/2.4.6 (CentOS) Content-Length: 209 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive --- Additional Info --- Magic: HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text Size: 209 Md5: 18ffb59b61525f781cf9251045be575d Sha1: bd7318b00b15b7a1c8a48524419fa2e5c27a5b6d Sha256: b6682cab65d3243b5b75efb7279dbf49491957484780f2ba0a87632cc0e25642 Alerts: urlquery: - Suspicious - DynDNS domain IDS: - ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.77.32 HASH: a29ee843c8a39551a1507cc6ad949ad509e33aaae8b72c58ac4884bad8b0b38e 23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "A29EE843C8A39551A1507CC6AD949AD509E33AAAE8B72C58AC4884BAD8B0B38E" Last-Modified: Sun, 29 Jan 2023 20:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=9761 Expires: Mon, 30 Jan 2023 22:09:28 GMT Date: Mon, 30 Jan 2023 19:26:47 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 22b9916fc1fafc9bdc9bb37f9eac8a9a Sha1: 86f640e134a741a0f906a8e3a0f5c6659dd0e394 Sha256: a29ee843c8a39551a1507cc6ad949ad509e33aaae8b72c58ac4884bad8b0b38e
GET / HTTP/1.1 Host: push.services.mozilla.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Sec-WebSocket-Version: 13 Origin: wss://push.services.mozilla.com/ Sec-WebSocket-Protocol: push-notification Sec-WebSocket-Extensions: permessage-deflate Sec-WebSocket-Key: 7OwZCeGWbP2gnWsBNASJYw== Connection: keep-alive, Upgrade Sec-Fetch-Dest: websocket Sec-Fetch-Mode: websocket Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache Upgrade: websocket	URL: push.services.mozilla.com/ FQDN: push.services.mozilla.com IP: 35.82.231.103 HASH: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 35.82.231.103 HTTP/1.1 101 Switching Protocols Connection: Upgrade Upgrade: websocket Sec-WebSocket-Accept: k7+qjSVvJrcXWiiIe/Q0b8PJT2s= --- Additional Info --- Magic: Size: 0 Md5: d41d8cd98f00b204e9800998ecf8427e Sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.77.32 HASH: d97efec67504b084ca6ff9e2af973b45b916f90aa021603e3615806bb2737b6a 23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "D97EFEC67504B084CA6FF9E2AF973B45B916F90AA021603E3615806BB2737B6A" Last-Modified: Sun, 29 Jan 2023 00:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=3480 Expires: Mon, 30 Jan 2023 20:24:49 GMT Date: Mon, 30 Jan 2023 19:26:49 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: dfb84426fed94988d5c90372baff059c Sha1: f1c4740830034ff8a5759d59ae3f657ea524d083 Sha256: d97efec67504b084ca6ff9e2af973b45b916f90aa021603e3615806bb2737b6a
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.77.32 HASH: d97efec67504b084ca6ff9e2af973b45b916f90aa021603e3615806bb2737b6a 23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "D97EFEC67504B084CA6FF9E2AF973B45B916F90AA021603E3615806BB2737B6A" Last-Modified: Sun, 29 Jan 2023 00:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=3480 Expires: Mon, 30 Jan 2023 20:24:49 GMT Date: Mon, 30 Jan 2023 19:26:49 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: dfb84426fed94988d5c90372baff059c Sha1: f1c4740830034ff8a5759d59ae3f657ea524d083 Sha256: d97efec67504b084ca6ff9e2af973b45b916f90aa021603e3615806bb2737b6a
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.77.32 HASH: d97efec67504b084ca6ff9e2af973b45b916f90aa021603e3615806bb2737b6a 23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "D97EFEC67504B084CA6FF9E2AF973B45B916F90AA021603E3615806BB2737B6A" Last-Modified: Sun, 29 Jan 2023 00:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=3480 Expires: Mon, 30 Jan 2023 20:24:49 GMT Date: Mon, 30 Jan 2023 19:26:49 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: dfb84426fed94988d5c90372baff059c Sha1: f1c4740830034ff8a5759d59ae3f657ea524d083 Sha256: d97efec67504b084ca6ff9e2af973b45b916f90aa021603e3615806bb2737b6a
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F52796f60-dafe-46ba-9c7a-a08ce5e16c34.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: img-getpocket.cdn.mozilla.net/296x148/filters:format(jp (...) FQDN: img-getpocket.cdn.mozilla.net IP: 34.120.237.76 HASH: 799af4bf9fa07ed27ebdc9d1a3344ee8a2b6529f076c263495b93290c47a1cc4 34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 8464 x-amzn-requestid: bf2cf356-ebb1-469b-ba35-a79bb009cad6 x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: fhj3qGeboAMFzNw= x-content-type-options: nosniff x-amzn-trace-id: Root=1-63d6e697-7c96841f52b6a96d1b0eaf34;Sampled=0 x-amzn-remapped-date: Sun, 29 Jan 2023 21:35:19 GMT x-amz-cf-pop: HIO50-C1, SEA19-C2 x-cache: Hit from cloudfront x-amz-cf-id: y6bDvcD7a3-A4DLC3cSdZT-yewV1kkFqcGr7AMuqvUeGA4A0pgF4wQ== via: 1.1 cd48ffda04934d18865e47e99ea080bc.cloudfront.net (CloudFront), 1.1 7022a5bbf9872d4a09d63e6cdb457dfe.cloudfront.net (CloudFront), 1.1 google date: Sun, 29 Jan 2023 21:59:27 GMT age: 77242 etag: "7aa5fbdc8156514770ae620e81f1afef1c77890f" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 8464 Md5: fe31ee140c2fd62e616c8a1edc9e78bb Sha1: 7aa5fbdc8156514770ae620e81f1afef1c77890f Sha256: 799af4bf9fa07ed27ebdc9d1a3344ee8a2b6529f076c263495b93290c47a1cc4
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fcb781854-72d1-4a71-a095-0416f886f570.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: img-getpocket.cdn.mozilla.net/296x148/filters:format(jp (...) FQDN: img-getpocket.cdn.mozilla.net IP: 34.120.237.76 HASH: 8486eb9dc6325018f8721bc6f37408f260b6e652b145280f2d778d860d3ec2d5 34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 7538 x-amzn-requestid: 8bec493a-9c81-4cfd-b6e9-66f4f3d55cb7 x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: fOOJQEZSoAMFb1w= x-content-type-options: nosniff x-amzn-trace-id: Root=1-63cf2a3b-5f0c9f3e4cac1ba26c802050;Sampled=0 x-amzn-remapped-date: Tue, 24 Jan 2023 00:45:47 GMT x-amz-cf-pop: SEA19-C2 x-cache: Hit from cloudfront x-amz-cf-id: PHd9IMeVMHy0TgXRqXyBCg6CZkOtT1WAOyq8zu8ERfIzoaB-7pLc2A== via: 1.1 030fe0607711293dda988e571617a9f2.cloudfront.net (CloudFront), 1.1 e4d3d5aafc7d7d582423c073065ab562.cloudfront.net (CloudFront), 1.1 google date: Mon, 30 Jan 2023 15:48:30 GMT age: 13099 etag: "ffb2035cf64fc83f01db5c6f26ffa264b6aac95b" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 7538 Md5: 131eb343c5abd61939457d69bd371348 Sha1: ffb2035cf64fc83f01db5c6f26ffa264b6aac95b Sha256: 8486eb9dc6325018f8721bc6f37408f260b6e652b145280f2d778d860d3ec2d5
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5f0097a6-af00-4a1c-8faa-f9516e27b31a.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: img-getpocket.cdn.mozilla.net/296x148/filters:format(jp (...) FQDN: img-getpocket.cdn.mozilla.net IP: 34.120.237.76 HASH: 31f1a28602a194bd0856495d4d81d5c72cd7ff4e5bad6bdd1a31ec3041f4a2cc 34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 4475 x-amzn-requestid: b7b272d6-3089-4f33-89b5-5cb388640e10 x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: fa_e6HsaIAMF5Lg= x-content-type-options: nosniff x-amzn-trace-id: Root=1-63d445f8-1789f7f4264270916da323db;Sampled=0 x-amzn-remapped-date: Fri, 27 Jan 2023 21:45:28 GMT x-amz-cf-pop: SEA19-C2 x-cache: Hit from cloudfront x-amz-cf-id: hAzO-IMqc1CFpiBAlRl8seIYL9UonyrBMATibovyFq5kEuaweY_VyA== via: 1.1 8f22423015641505b8c857a37450d6c0.cloudfront.net (CloudFront), 1.1 112d82578d402a38d8d02e8b857617e0.cloudfront.net (CloudFront), 1.1 google date: Mon, 30 Jan 2023 05:47:49 GMT age: 49140 etag: "ab4f6528594a1725934727dc7d834c028a79c609" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 4475 Md5: 4205d8106659e00fff1cbe9262918b8c Sha1: ab4f6528594a1725934727dc7d834c028a79c609 Sha256: 31f1a28602a194bd0856495d4d81d5c72cd7ff4e5bad6bdd1a31ec3041f4a2cc
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F72e6599c-6a41-4dd2-a346-b15fa84cb20a.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: img-getpocket.cdn.mozilla.net/296x148/filters:format(jp (...) FQDN: img-getpocket.cdn.mozilla.net IP: 34.120.237.76 HASH: 89d5443a1d313c632d09a583ef602aa4645a16986076387329f434262d15b0a1 34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 10997 x-amzn-requestid: a6fac0ab-1acf-4808-8785-3b4ec5e32edf x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: fhj30FX7IAMFa5w= x-content-type-options: nosniff x-amzn-trace-id: Root=1-63d6e698-005109ec2e76529e793678d6;Sampled=0 x-amzn-remapped-date: Sun, 29 Jan 2023 21:35:20 GMT x-amz-cf-pop: HIO50-C1, SEA19-C2 x-cache: Miss from cloudfront x-amz-cf-id: skGKI_MWvDwpAbGibUcr8wTlimgoPU9ZYhEHltd3uhdJZ_GoNznVAA== via: 1.1 e291f351a18746d40754b367095a2872.cloudfront.net (CloudFront), 1.1 325ed3ba58a560748d886354beef39c0.cloudfront.net (CloudFront), 1.1 google date: Sun, 29 Jan 2023 22:08:57 GMT etag: "027dbc7a104c922904f067ed15d696c363c11774" age: 76672 cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 10997 Md5: 65c02d8a1b0d6a210cb2a649c5c67469 Sha1: 027dbc7a104c922904f067ed15d696c363c11774 Sha256: 89d5443a1d313c632d09a583ef602aa4645a16986076387329f434262d15b0a1
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3bb7921c-8aaf-40cd-bf87-43903c3f1a74.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: img-getpocket.cdn.mozilla.net/296x148/filters:format(jp (...) FQDN: img-getpocket.cdn.mozilla.net IP: 34.120.237.76 HASH: df75cf7183d401a19655aab025d08ad2c498573c88b32e9b258d951d2993b936 34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 7679 x-amzn-requestid: 0c7983d5-6040-44e9-b394-21c3784702a2 x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: fhkEtEfHoAMFaNA= x-content-type-options: nosniff x-amzn-trace-id: Root=1-63d6e6ea-54c55dbd09ca642048af8916;Sampled=0 x-amzn-remapped-date: Sun, 29 Jan 2023 21:36:42 GMT x-amz-cf-pop: HIO50-C1, SEA19-C2 x-cache: Hit from cloudfront x-amz-cf-id: VHh2SQ21xoDoBnGvM2kRiposhXuCE-DdWW1bM35kEykjbHYmhsldVA== via: 1.1 26ca01ec7377e425b59b6a08cb1ec342.cloudfront.net (CloudFront), 1.1 82ea95080f526df99896343fb7269b06.cloudfront.net (CloudFront), 1.1 google date: Sun, 29 Jan 2023 21:51:22 GMT age: 77727 etag: "b820be4ed885dcf288eb6460c57e1fa7b1c7c476" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 7679 Md5: 3e04b9eaf7449828136ad59e4c9d69f1 Sha1: b820be4ed885dcf288eb6460c57e1fa7b1c7c476 Sha256: df75cf7183d401a19655aab025d08ad2c498573c88b32e9b258d951d2993b936
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6df754eb-70f9-4576-ac48-68a6ae719511.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: img-getpocket.cdn.mozilla.net/296x148/filters:format(jp (...) FQDN: img-getpocket.cdn.mozilla.net IP: 34.120.237.76 HASH: 588830e5f725e8e56270565e40f817f2658b0ee7c0425d138e5f65a17ff40483 34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 9457 x-amzn-requestid: 7c48e5ca-2128-43da-ba83-fd91568af1ef x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: fhkBOGHVoAMFQtw= x-content-type-options: nosniff x-amzn-trace-id: Root=1-63d6e6d4-1b850ffd543f51f92dec3894;Sampled=0 x-amzn-remapped-date: Sun, 29 Jan 2023 21:36:20 GMT x-amz-cf-pop: HIO50-C1, SEA19-C2 x-cache: Hit from cloudfront x-amz-cf-id: 3EXFa0gb46AbdZ9ZznGiPTemGZ7zWh9WLs5Yr1zmfyh_jyKA6o7xoA== via: 1.1 0c96ded7ff282d2dbcf47c918b6bb500.cloudfront.net (CloudFront), 1.1 7022a5bbf9872d4a09d63e6cdb457dfe.cloudfront.net (CloudFront), 1.1 google date: Sun, 29 Jan 2023 22:19:57 GMT age: 76012 etag: "e4388ced02e5576867e77547496dec1ac2338ef7" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 9457 Md5: 51aa950d5eed7b90cab6632107092edc Sha1: e4388ced02e5576867e77547496dec1ac2338ef7 Sha256: 588830e5f725e8e56270565e40f817f2658b0ee7c0425d138e5f65a17ff40483

URL	wvujvfgrrf.duckdns.org/
IP	45.12.138.122 (United States)
ASN	#35913 DEDIPATH-LLC
UserAgent	Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer
Report completed	2023-01-30 19:26:57 UTC
Status	Loading report..
IDS alerts	14
Blocklist alert	5
urlquery alerts	11 Suspicious - DynDNS domain
Tags	dyndns

Overview

Domain Summary (7)

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Blocklists

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

Files

No files detected

Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 45.12.138.122

Last 5 reports on ASN: DEDIPATH-LLC

Last 1 reports on domain: wvujvfgrrf.duckdns.org

Last 5 reports with similar screenshot

JavaScript

Executed Scripts (0)

Executed Evals (0)

Executed Writes (0)

HTTP Transactions (28)

Overview

Domain Summary (7)

Network Intrusion Detection Systemsinfo

Suricata /w Emerging Threats Pro

Blocklists

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

Files

No files detected

Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 45.12.138.122

Last 5 reports on ASN: DEDIPATH-LLC

Last 1 reports on domain: wvujvfgrrf.duckdns.org

Last 5 reports with similar screenshot

JavaScript

Executed Scripts (0)

Executed Evals (0)

Executed Writes (0)

HTTP Transactions (28)

Network Intrusion Detection Systems