Report - pub-996665b4c28241aabc7d099d1e74baf6.r2.dev/index.html

Report Overview

Submitted URL
pub-996665b4c28241aabc7d099d1e74baf6.r2.dev/index.html
IP
104.18.2.35
ASN
#13335 CLOUDFLARENET
Submitted
2024-04-16 16:08:10
Access
public
Website Title
Log in to My Account | American Express US
Final URL
pub-996665b4c28241aabc7d099d1e74baf6.r2.dev/0c3022e6-d30b-407d-bbdd-10bb23e732d0
Tags
american_express financial phishing
urlquery detections
Phishing - American Express

Detections

urlquery
25
Network Intrusion Detection
0
Threat Detection Systems
8

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
code.jquery.com	634	2005-12-10	2012-05-21	2024-04-16	1.2 kB	142 kB	151.101.130.137
themes-app.netlify.app	unknown	2018-05-08	2023-10-15	2024-04-13	4.9 kB	53 kB	18.192.94.96
ajax.googleapis.com	12905	2005-01-25	2013-08-16	2024-04-16	395 B	31 kB	142.250.74.170
aus5.mozilla.org	2548	1998-01-24	2015-10-27	2024-04-16	512 B	1.2 kB	35.244.181.201
dev-sqlmfia.pantheonsite.io	unknown	2016-01-29	2024-01-28	2024-03-28	897 B	340 kB	23.185.0.3
pub-996665b4c28241aabc7d099d1e74baf6.r2.dev	unknown	unknown	No data	No data	999 B	896 B	104.18.2.35
cdnjs.cloudflare.com	235	2009-02-17	2015-04-17	2024-04-16	462 B	7.2 kB	104.17.24.14

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2024-04-16	medium	pub-996665b4c28241aabc7d099d1e74baf6.r2.dev/index.html	American Express

PhishTank

Scan Date	Severity	Indicator	Alert
2024-04-01	medium	pub-996665b4c28241aabc7d099d1e74baf6.r2.dev/index.html	American Express

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-04-16	medium	pub-996665b4c28241aabc7d099d1e74baf6.r2.dev	Sinkholed
2024-04-16	medium	pub-996665b4c28241aabc7d099d1e74baf6.r2.dev	Sinkholed

ThreatFox

No alerts detected

JavaScript (5)

	URL	Size	First Seen	Last Seen
	code.jquery.com/jquery-3.3.1.js	272 kB	2023-03-07	2024-04-29
Pretty URL code.jquery.com/jquery-3.3.1.js IP 151.101.130.137 ASN #54113 FASTLY Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:01 Last Seen2024-04-29 20:20:20 Times Seen59351 Hash 6a07da9fae934baf3f749e876bbfdd96 46a436eba01c79acdb225757ed80bf54bad6416b d8aa24ecc6cecb1a60515bc093f1c9da38a0392612d9ab8ae0f7f36e6eee1fad Loading...

	cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js	19 kB	2023-03-07	2024-04-30
Pretty URL cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js IP 104.17.24.14 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:44 Last Seen2024-04-30 00:13:43 Times Seen112556 Hash 70d3fda195602fe8b75e0097eed74dde c3b977aa4b8dfb69d651e07015031d385ded964b a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66 Loading...

	pub-996665b4c28241aabc7d099d1e74baf6.r2.dev/0c3022e6-d30b-407d-bbdd-10bb23e732d0	6.5 kB	2024-03-30	2024-04-26
Pretty URL pub-996665b4c28241aabc7d099d1e74baf6.r2.dev/0c3022e6-d30b-407d-bbdd-10bb23e732d0 IP 0.0.0.0 ASN #0 Introduced by scriptElement Embedded in HTML true Observations First Seen2024-03-30 05:13:33 Last Seen2024-04-26 07:32:05 Times Seen10 Hash 6fd6b0d162bfcbb82aa61160ddd65541 0a785c1de3872d11001a429b03795f6c8727d384 3200517a7c9a392843cb6782a87a8cd69faa567d1c122405c4960d0eded189bd Loading...

	ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js	86 kB	2023-03-07	2024-04-29
Pretty URL ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js IP 142.250.74.170 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:00 Last Seen2024-04-29 23:30:28 Times Seen386232 Hash 2f6b11a7e914718e0290410e85366fe9 69bb69e25ca7d5ef0935317584e6153f3fd9a88c 05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e Loading...

	code.jquery.com/jquery-3.1.1.min.js	87 kB	2023-03-07	2024-04-29
Pretty URL code.jquery.com/jquery-3.1.1.min.js IP 151.101.130.137 ASN #54113 FASTLY Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:34 Last Seen2024-04-29 23:53:27 Times Seen264672 Hash e071abda8fe61194711cfc2ab99fe104 f647a6d37dc4ca055ced3cf64bbc1f490070acba 85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf Loading...

HTTP Transactions (22)

URL IP Response Size

pub-996665b4c28241aabc7d099d1e74baf6.r2.dev/index.html

104.18.2.35

200 OK

589 B

URL User Request GET HTTP/1.1
pub-996665b4c28241aabc7d099d1e74baf6.r2.dev/index.html
IP
104.18.2.35:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerLet's Encrypt
Subject*.r2.dev
Fingerprint48:74:F0:98:E0:A1:57:3E:86:18:BF:B3:DC:C9:7A:5B:53:50:FE:E0
ValidityFri, 05 Apr 2024 15:25:24 GMT - Thu, 04 Jul 2024 15:25:23 GMT

File type
HTML document, ASCII text, with CRLF line terminators
Size
589 B (589 bytes)
Hash
e8b1c6ccac1f7e33d744a8cd9b463a71
3d5d7a4f1639cdadba758258c533ace8696c7233
b6db5338cd2a3ec92fbb13d77bd8ab35aad165a7631db88ba0db6e759fab12d9

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	American Express
PhishTank	phishing	American Express
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /index.html HTTP/1.1
Host: pub-996665b4c28241aabc7d099d1e74baf6.r2.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Tue, 16 Apr 2024 16:07:44 GMT
Content-Type: text/html
Content-Length: 589
Connection: keep-alive
Accept-Ranges: bytes
ETag: "e8b1c6ccac1f7e33d744a8cd9b463a71"
Last-Modified: Sun, 31 Mar 2024 13:13:47 GMT
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 87556e167bb356be-OSL

cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js

104.17.24.14

200 OK

6.2 kB

URL GET HTTP/2
cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
IP
104.17.24.14:443
ASN
#13335 CLOUDFLARENET

Requested by
https://pub-996665b4c28241aabc7d099d1e74baf6.r2.dev/index.html
Certificate
IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint7A:EA:B9:09:71:70:6C:87:C9:D3:82:74:8A:7B:B4:60:E5:40:2D:8D
ValidityMon, 03 Jul 2023 00:00:00 GMT - Tue, 02 Jul 2024 23:59:59 GMT

File type
JavaScript source, ASCII text, with very long lines (19015)
Size
6.2 kB (6157 bytes)
Hash
70d3fda195602fe8b75e0097eed74dde
c3b977aa4b8dfb69d651e07015031d385ded964b
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66

HTTP Headers

GET /ajax/libs/popper.js/1.12.9/umd/popper.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://pub-996665b4c28241aabc7d099d1e74baf6.r2.dev
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Tue, 16 Apr 2024 16:07:45 GMT
content-type: application/javascript; charset=utf-8
content-length: 6157
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03fa9-4af4"
last-modified: Mon, 04 May 2020 16:15:37 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 2728549
expires: Sun, 06 Apr 2025 16:07:45 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=elok35uVOczWLCmuMqP7jjdJemYi1CxVoluv06iC0kIcOxT%2FYt7qZj3tg0spZ2ZEV%2FigsBeJCP6vITg4LhMZSjmX0itBVWpnYu1fLZPXkUsVmfYxYfaFe2yXy3fm7Yjmke3N2LLz"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 87556e1e4b6d56be-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

code.jquery.com/jquery-3.3.1.js

151.101.130.137

200 OK

80 kB

URL GET HTTP/2
code.jquery.com/jquery-3.3.1.js
IP
151.101.130.137:443
ASN
#54113 FASTLY

Requested by
https://pub-996665b4c28241aabc7d099d1e74baf6.r2.dev/index.html
Certificate
IssuerSectigo Limited
Subject*.jquery.com
FingerprintD2:19:0A:AD:CE:BB:9C:61:17:5D:29:4B:A2:54:E8:C6:91:B8:F9:8D
ValidityTue, 11 Jul 2023 00:00:00 GMT - Sun, 14 Jul 2024 23:59:59 GMT

File type
JavaScript source, ASCII text
Size
80 kB (80268 bytes)
Hash
6a07da9fae934baf3f749e876bbfdd96
46a436eba01c79acdb225757ed80bf54bad6416b
d8aa24ecc6cecb1a60515bc093f1c9da38a0392612d9ab8ae0f7f36e6eee1fad

HTTP Headers

GET /jquery-3.3.1.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://pub-996665b4c28241aabc7d099d1e74baf6.r2.dev
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: W/"28feccc0-42587"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 16 Apr 2024 16:07:45 GMT
age: 18483015
x-served-by: cache-lga21980-LGA, cache-hel1410032-HEL
x-cache: HIT, HIT
x-cache-hits: 99, 24196
x-timer: S1713283666.667037,VS0,VE0
vary: Accept-Encoding
content-length: 80268
X-Firefox-Spdy: h2

code.jquery.com/jquery-3.1.1.min.js

151.101.130.137

200 OK

30 kB

URL GET HTTP/2
code.jquery.com/jquery-3.1.1.min.js
IP
151.101.130.137:443
ASN
#54113 FASTLY

Requested by
https://pub-996665b4c28241aabc7d099d1e74baf6.r2.dev/index.html
Certificate
IssuerSectigo Limited
Subject*.jquery.com
FingerprintD2:19:0A:AD:CE:BB:9C:61:17:5D:29:4B:A2:54:E8:C6:91:B8:F9:8D
ValidityTue, 11 Jul 2023 00:00:00 GMT - Sun, 14 Jul 2024 23:59:59 GMT

File type
JavaScript source, ASCII text, with very long lines (32030)
Size
30 kB (30070 bytes)
Hash
e071abda8fe61194711cfc2ab99fe104
f647a6d37dc4ca055ced3cf64bbc1f490070acba
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

HTTP Headers

GET /jquery-3.1.1.min.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: W/"28feccc0-152b5"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 16 Apr 2024 16:07:45 GMT
age: 18483066
x-served-by: cache-lga21947-LGA, cache-hel1410029-HEL
x-cache: HIT, HIT
x-cache-hits: 118, 94268
x-timer: S1713283666.735026,VS0,VE0
vary: Accept-Encoding
content-length: 30070
X-Firefox-Spdy: h2

themes-app.netlify.app/img/dw.png

18.192.94.96

200 OK

9.1 kB

URL GET HTTP/2
themes-app.netlify.app/img/dw.png
IP
18.192.94.96:443
ASN
#16509 AMAZON-02

Requested by
https://pub-996665b4c28241aabc7d099d1e74baf6.r2.dev/index.html
Certificate
IssuerDigiCert Inc
Subject*.netlify.app
FingerprintB0:8E:E9:A5:C3:D9:B5:C1:FF:B6:51:7A:DF:98:CF:2D:28:18:41:9B
ValidityMon, 15 Jan 2024 00:00:00 GMT - Fri, 14 Feb 2025 23:59:59 GMT

File type
PNG image data, 291 x 280, 8-bit/color RGBA, non-interlaced
Size
9.1 kB (9050 bytes)
Hash
210cf3592ff428e90b2e1ceb6fd021d2
dc859feeb0d0b906b98965708cecf3ee43b9543e
d1dc4be2bb732742015d6ed477b2fc6fbde466a07a4cf57124a22c3a447a93b0

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - American Express

HTTP Headers

GET /img/dw.png HTTP/1.1
Host: themes-app.netlify.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
accept-ranges: bytes
age: 24653
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-type: image/png
date: Tue, 16 Apr 2024 16:07:45 GMT
etag: "1981a80fee6538e9d22b16e31eb37c45-ssl"
server: Netlify
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-nf-request-id: 01HVKTM3WE21Q4S42MQHSYH12J
content-length: 9050
X-Firefox-Spdy: h2

themes-app.netlify.app/img/se.png

18.192.94.96

200 OK

693 B

URL GET HTTP/2
themes-app.netlify.app/img/se.png
IP
18.192.94.96:443
ASN
#16509 AMAZON-02

Requested by
https://pub-996665b4c28241aabc7d099d1e74baf6.r2.dev/index.html
Certificate
IssuerDigiCert Inc
Subject*.netlify.app
FingerprintB0:8E:E9:A5:C3:D9:B5:C1:FF:B6:51:7A:DF:98:CF:2D:28:18:41:9B
ValidityMon, 15 Jan 2024 00:00:00 GMT - Fri, 14 Feb 2025 23:59:59 GMT

File type
PNG image data, 47 x 34, 8-bit/color RGBA, non-interlaced
Size
693 B (693 bytes)
Hash
d18f5369e1a97dfc02448d5b51b34267
420a392854cf561934f9985f8ee11bc4f694b1d2
0cd60fcc520da13e49b81375e1ebc9d8aad06f64b48e2cb420ac4eec5a5fdeeb

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - American Express

HTTP Headers

GET /img/se.png HTTP/1.1
Host: themes-app.netlify.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
accept-ranges: bytes
age: 24654
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-type: image/png
date: Tue, 16 Apr 2024 16:07:45 GMT
etag: "9176a978951d62401855db0c8af6b10a-ssl"
server: Netlify
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-nf-request-id: 01HVKTM3WDGY86SNDD1ZE5X1X2
content-length: 693
X-Firefox-Spdy: h2

themes-app.netlify.app/img/dl.webp

18.192.94.96

200 OK

9.3 kB

URL GET HTTP/2
themes-app.netlify.app/img/dl.webp
IP
18.192.94.96:443
ASN
#16509 AMAZON-02

Requested by
https://pub-996665b4c28241aabc7d099d1e74baf6.r2.dev/index.html
Certificate
IssuerDigiCert Inc
Subject*.netlify.app
FingerprintB0:8E:E9:A5:C3:D9:B5:C1:FF:B6:51:7A:DF:98:CF:2D:28:18:41:9B
ValidityMon, 15 Jan 2024 00:00:00 GMT - Fri, 14 Feb 2025 23:59:59 GMT

File type
RIFF (little-endian) data, Web/P image, VP8 encoding, 300x250, Scaling: [none]x[none], YUV color, decoders should clamp
Size
9.3 kB (9270 bytes)
Hash
ddccda979f5d3c3a9691d68eefe9889c
2745ce67bb334d35320bcfd48333208d208531fe
011871b672950332066994d18aaac9d923bc85df3ef22b296b3107df50261887

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - American Express

HTTP Headers

GET /img/dl.webp HTTP/1.1
Host: themes-app.netlify.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
accept-ranges: bytes
age: 24653
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-type: image/webp
date: Tue, 16 Apr 2024 16:07:45 GMT
etag: "4594a4c4cf3d9fed4e9079a969112d3f-ssl"
server: Netlify
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-nf-request-id: 01HVKTM3WDBZY4NJCP5W14075V
content-length: 9270
X-Firefox-Spdy: h2

themes-app.netlify.app/img/tn.gif

18.192.94.96

200 OK

12 kB

URL GET HTTP/2
themes-app.netlify.app/img/tn.gif
IP
18.192.94.96:443
ASN
#16509 AMAZON-02

Requested by
https://pub-996665b4c28241aabc7d099d1e74baf6.r2.dev/index.html
Certificate
IssuerDigiCert Inc
Subject*.netlify.app
FingerprintB0:8E:E9:A5:C3:D9:B5:C1:FF:B6:51:7A:DF:98:CF:2D:28:18:41:9B
ValidityMon, 15 Jan 2024 00:00:00 GMT - Fri, 14 Feb 2025 23:59:59 GMT

File type
GIF image data, version 89a, 128 x 128
Size
12 kB (11902 bytes)
Hash
08a4cb5bec62dbe2ae78d6654288f2a6
6709e2112d4faeba22adf727ac5aaec8a1ac0b28
50ded9570fa6f2a244d56fb49094b56bbe1026bb59ccf22b9b333b1697d4c46c

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - American Express

HTTP Headers

GET /img/tn.gif HTTP/1.1
Host: themes-app.netlify.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
accept-ranges: bytes
age: 24652
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-type: image/gif
date: Tue, 16 Apr 2024 16:07:45 GMT
etag: "32a2b0694ac3042ef45b9bbedffb44b4-ssl"
server: Netlify
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-nf-request-id: 01HVKTM3WEG7VMD8SZHS5B1WHE
content-length: 11902
X-Firefox-Spdy: h2

ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js

142.250.74.170

200 OK

30 kB

URL GET HTTP/2
ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
IP
142.250.74.170:443
ASN
#15169 GOOGLE

Requested by
https://pub-996665b4c28241aabc7d099d1e74baf6.r2.dev/index.html
Certificate
IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
Fingerprint47:5A:64:7D:9F:47:34:07:31:91:97:F7:04:42:7A:D5:EA:AD:07:4E
ValidityMon, 04 Mar 2024 07:16:44 GMT - Mon, 27 May 2024 07:16:43 GMT

File type
JavaScript source, ASCII text, with very long lines (32065)
Size
30 kB (30028 bytes)
Hash
2f6b11a7e914718e0290410e85366fe9
69bb69e25ca7d5ef0935317584e6153f3fd9a88c
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

HTTP Headers

GET /ajax/libs/jquery/2.2.4/jquery.min.js HTTP/1.1
Host: ajax.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
timing-allow-origin: *
content-length: 30028
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 11 Apr 2024 17:38:23 GMT
expires: Fri, 11 Apr 2025 17:38:23 GMT
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
age: 426562
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

themes-app.netlify.app/img/fc.png

18.192.94.96

200 OK

644 B

URL GET HTTP/2
themes-app.netlify.app/img/fc.png
IP
18.192.94.96:443
ASN
#16509 AMAZON-02

Requested by
https://pub-996665b4c28241aabc7d099d1e74baf6.r2.dev/index.html
Certificate
IssuerDigiCert Inc
Subject*.netlify.app
FingerprintB0:8E:E9:A5:C3:D9:B5:C1:FF:B6:51:7A:DF:98:CF:2D:28:18:41:9B
ValidityMon, 15 Jan 2024 00:00:00 GMT - Fri, 14 Feb 2025 23:59:59 GMT

File type
PNG image data, 64 x 64, 8-bit colormap, non-interlaced
Size
644 B (644 bytes)
Hash
38fa454b36c7e5e7837e9e6bdf14fc8f
f19f18d5eec57b8713654dcfca5da5e0b5e15240
428a13dcd90b9a52dac690a578092e1b24e6121952668d4bcf001a6287c880dd

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - American Express

HTTP Headers

GET /img/fc.png HTTP/1.1
Host: themes-app.netlify.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
accept-ranges: bytes
age: 24651
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-type: image/png
date: Tue, 16 Apr 2024 16:07:45 GMT
etag: "08fb724dc31151233c036f5bab9620e1-ssl"
server: Netlify
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-nf-request-id: 01HVKTM3WEGY3CFFKFRFZBVQ6X
content-length: 644
X-Firefox-Spdy: h2

themes-app.netlify.app/img/tw.png

18.192.94.96

200 OK

1.1 kB

URL GET HTTP/2
themes-app.netlify.app/img/tw.png
IP
18.192.94.96:443
ASN
#16509 AMAZON-02

Requested by
https://pub-996665b4c28241aabc7d099d1e74baf6.r2.dev/index.html
Certificate
IssuerDigiCert Inc
Subject*.netlify.app
FingerprintB0:8E:E9:A5:C3:D9:B5:C1:FF:B6:51:7A:DF:98:CF:2D:28:18:41:9B
ValidityMon, 15 Jan 2024 00:00:00 GMT - Fri, 14 Feb 2025 23:59:59 GMT

File type
PNG image data, 64 x 64, 8-bit colormap, non-interlaced
Size
1.1 kB (1061 bytes)
Hash
a9de6618402535255ea43aacb8c35a25
d62194b0ea3e6b9c4670f56f4fd08cf9cfd7f2f3
677a6a5da6f0e85f66c5232fc39ffd285ed010a9498c40cdd7e56d2ff0b7e7da

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - American Express

HTTP Headers

GET /img/tw.png HTTP/1.1
Host: themes-app.netlify.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
accept-ranges: bytes
age: 24651
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-type: image/png
date: Tue, 16 Apr 2024 16:07:45 GMT
etag: "c9375c240809a8d92fcd735cb3b4582f-ssl"
server: Netlify
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-nf-request-id: 01HVKTM3WE1X7NC3RGYGXPARGF
content-length: 1061
X-Firefox-Spdy: h2

themes-app.netlify.app/img/mt2.png

18.192.94.96

200 OK

1.9 kB

URL GET HTTP/2
themes-app.netlify.app/img/mt2.png
IP
18.192.94.96:443
ASN
#16509 AMAZON-02

Requested by
https://pub-996665b4c28241aabc7d099d1e74baf6.r2.dev/index.html
Certificate
IssuerDigiCert Inc
Subject*.netlify.app
FingerprintB0:8E:E9:A5:C3:D9:B5:C1:FF:B6:51:7A:DF:98:CF:2D:28:18:41:9B
ValidityMon, 15 Jan 2024 00:00:00 GMT - Fri, 14 Feb 2025 23:59:59 GMT

File type
PNG image data, 126 x 41, 8-bit/color RGBA, non-interlaced
Size
1.9 kB (1877 bytes)
Hash
3c8a1c8c1f853f9fb3b67420c984b59f
0310a1f4994d2a1510d446c5ed5b4fca55adfb4e
d31c57f28cc14b6362f61488eb82a0d2e00f0fa5899765495e1ca871a4e3ea2d

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - American Express

HTTP Headers

GET /img/mt2.png HTTP/1.1
Host: themes-app.netlify.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
accept-ranges: bytes
age: 24654
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-type: image/png
date: Tue, 16 Apr 2024 16:07:45 GMT
etag: "f09753fabf492a25caea39b9b940009f-ssl"
server: Netlify
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-nf-request-id: 01HVKTM3WFG09G6158834E3JXV
content-length: 1877
X-Firefox-Spdy: h2

themes-app.netlify.app/img/in.png

18.192.94.96

200 OK

8.3 kB

URL GET HTTP/2
themes-app.netlify.app/img/in.png
IP
18.192.94.96:443
ASN
#16509 AMAZON-02

Requested by
https://pub-996665b4c28241aabc7d099d1e74baf6.r2.dev/index.html
Certificate
IssuerDigiCert Inc
Subject*.netlify.app
FingerprintB0:8E:E9:A5:C3:D9:B5:C1:FF:B6:51:7A:DF:98:CF:2D:28:18:41:9B
ValidityMon, 15 Jan 2024 00:00:00 GMT - Fri, 14 Feb 2025 23:59:59 GMT

File type
PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Size
8.3 kB (8284 bytes)
Hash
9012c394b39d618236f231a642c762bf
05a2cf1d489da07dc6a4137e88147d05ed61cbf1
c000ce3efd67b43d573f0270ec30bb3854908f0672a8e08a6809a3680b7b8542

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - American Express

HTTP Headers

GET /img/in.png HTTP/1.1
Host: themes-app.netlify.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
accept-ranges: bytes
age: 24650
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-type: image/png
date: Tue, 16 Apr 2024 16:07:45 GMT
etag: "888a13173b4fd95f54ae15e493c9e3ed-ssl"
server: Netlify
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-nf-request-id: 01HVKTM3WFNTZK6V0GYCVE5VFQ
content-length: 8284
X-Firefox-Spdy: h2

themes-app.netlify.app/img/li.png

18.192.94.96

200 OK

764 B

URL GET HTTP/2
themes-app.netlify.app/img/li.png
IP
18.192.94.96:443
ASN
#16509 AMAZON-02

Requested by
https://pub-996665b4c28241aabc7d099d1e74baf6.r2.dev/index.html
Certificate
IssuerDigiCert Inc
Subject*.netlify.app
FingerprintB0:8E:E9:A5:C3:D9:B5:C1:FF:B6:51:7A:DF:98:CF:2D:28:18:41:9B
ValidityMon, 15 Jan 2024 00:00:00 GMT - Fri, 14 Feb 2025 23:59:59 GMT

File type
PNG image data, 64 x 64, 8-bit colormap, non-interlaced
Size
764 B (764 bytes)
Hash
af86e8905740485a58dd0af25af5658b
2175420804b33348425348c7eb02a1f0338231b4
5c5381a437e62da458e251201a5c46af59e750b8f40470b77d00ce9fcf08fc6b

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - American Express

HTTP Headers

GET /img/li.png HTTP/1.1
Host: themes-app.netlify.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
accept-ranges: bytes
age: 24648
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-type: image/png
date: Tue, 16 Apr 2024 16:07:45 GMT
etag: "47c0afb5cbfb3f56c9b5210375261a2e-ssl"
server: Netlify
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-nf-request-id: 01HVKTM3X1B8ZN01HWZMN9X6ZC
content-length: 764
X-Firefox-Spdy: h2

themes-app.netlify.app/css/main.css

18.192.94.96

200 OK

1.6 kB

URL GET HTTP/2
themes-app.netlify.app/css/main.css
IP
18.192.94.96:443
ASN
#16509 AMAZON-02

Requested by
https://pub-996665b4c28241aabc7d099d1e74baf6.r2.dev/index.html
Certificate
IssuerDigiCert Inc
Subject*.netlify.app
FingerprintB0:8E:E9:A5:C3:D9:B5:C1:FF:B6:51:7A:DF:98:CF:2D:28:18:41:9B
ValidityMon, 15 Jan 2024 00:00:00 GMT - Fri, 14 Feb 2025 23:59:59 GMT

File type
assembler source, ASCII text, with CRLF line terminators
Size
1.6 kB (1630 bytes)
Hash
c5cdce6c52e1b98bb8a66aefe4654ffc
e5462a39ce4690f7aa83912fde8b4daaf632a7ff
1c18890e44f53c9b0b4a22a56dff0b32e84b5fa38ec1721e6b580f9d26fd7820

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - American Express

HTTP Headers

GET /css/main.css HTTP/1.1
Host: themes-app.netlify.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
age: 24654
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-encoding: br
content-type: text/css; charset=UTF-8
date: Tue, 16 Apr 2024 16:07:45 GMT
etag: "ed0bb3e510be713fd48a9fc2f63bbd88-ssl-df"
server: Netlify
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-nf-request-id: 01HVKTM3X1YR7S4CBBT3GDSG8M
content-length: 1630
X-Firefox-Spdy: h2

themes-app.netlify.app/img/yt.png

18.192.94.96

200 OK

984 B

URL GET HTTP/2
themes-app.netlify.app/img/yt.png
IP
18.192.94.96:443
ASN
#16509 AMAZON-02

Requested by
https://pub-996665b4c28241aabc7d099d1e74baf6.r2.dev/index.html
Certificate
IssuerDigiCert Inc
Subject*.netlify.app
FingerprintB0:8E:E9:A5:C3:D9:B5:C1:FF:B6:51:7A:DF:98:CF:2D:28:18:41:9B
ValidityMon, 15 Jan 2024 00:00:00 GMT - Fri, 14 Feb 2025 23:59:59 GMT

File type
PNG image data, 64 x 64, 8-bit colormap, non-interlaced
Size
984 B (984 bytes)
Hash
8f4974962c746b411da4bbcca909cdcf
7843675dfccde5c154a7e7f15fecbcb1c78f193c
5cb5e693ba5e56c274a113f77c50becb662d18324b2ed681432f60ee4761de3d

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - American Express

HTTP Headers

GET /img/yt.png HTTP/1.1
Host: themes-app.netlify.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
accept-ranges: bytes
age: 24648
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-type: image/png
date: Tue, 16 Apr 2024 16:07:45 GMT
etag: "327974b57087925feede2ac36bf07c95-ssl"
server: Netlify
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-nf-request-id: 01HVKTM3X1P5SEDPYB06KACRWY
content-length: 984
X-Firefox-Spdy: h2

code.jquery.com/jquery-3.1.1.min.js

151.101.130.137

200 OK

30 kB

URL GET HTTP/2
code.jquery.com/jquery-3.1.1.min.js
IP
151.101.130.137:443
ASN
#54113 FASTLY

Requested by
https://pub-996665b4c28241aabc7d099d1e74baf6.r2.dev/index.html
Certificate
IssuerSectigo Limited
Subject*.jquery.com
FingerprintD2:19:0A:AD:CE:BB:9C:61:17:5D:29:4B:A2:54:E8:C6:91:B8:F9:8D
ValidityTue, 11 Jul 2023 00:00:00 GMT - Sun, 14 Jul 2024 23:59:59 GMT

File type
JavaScript source, ASCII text, with very long lines (32030)
Size
30 kB (30070 bytes)
Hash
e071abda8fe61194711cfc2ab99fe104
f647a6d37dc4ca055ced3cf64bbc1f490070acba
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

HTTP Headers

GET /jquery-3.1.1.min.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: W/"28feccc0-152b5"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 16 Apr 2024 16:07:46 GMT
age: 18483066
x-served-by: cache-lga21947-LGA, cache-hel1410029-HEL
x-cache: HIT, HIT
x-cache-hits: 118, 94269
x-timer: S1713283666.242998,VS0,VE0
vary: Accept-Encoding
content-length: 30070
X-Firefox-Spdy: h2

themes-app.netlify.app/img/icon.ico

18.192.94.96

200 OK

1.4 kB

URL GET HTTP/2
themes-app.netlify.app/img/icon.ico
IP
18.192.94.96:443
ASN
#16509 AMAZON-02

Requested by
https://pub-996665b4c28241aabc7d099d1e74baf6.r2.dev/index.html
Certificate
IssuerDigiCert Inc
Subject*.netlify.app
FingerprintB0:8E:E9:A5:C3:D9:B5:C1:FF:B6:51:7A:DF:98:CF:2D:28:18:41:9B
ValidityMon, 15 Jan 2024 00:00:00 GMT - Fri, 14 Feb 2025 23:59:59 GMT

File type
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Size
1.4 kB (1358 bytes)
Hash
974ccc6c4c6e1c7f04606973beb3ba20
0f96f86d488a4b5805744fa067c3cfd57c928406
265d3f591d92fadfe95f4660c382ee64a23538a7353b9880434205a102833de0

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - American Express

HTTP Headers

GET /img/icon.ico HTTP/1.1
Host: themes-app.netlify.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
accept-ranges: bytes
age: 24642
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-type: image/vnd.microsoft.icon
date: Tue, 16 Apr 2024 16:07:46 GMT
etag: "dfa5d6a823418c0c47bffdcf2fc37c1c-ssl"
server: Netlify
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-nf-request-id: 01HVKTM4FFD3GRE3YFBM6AV2B5
content-length: 1358
X-Firefox-Spdy: h2

aus5.mozilla.org/update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-101-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml

35.244.181.201

444 B

URL
aus5.mozilla.org/update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-101-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml
IP
35.244.181.201:0
ASN
#396982 GOOGLE-CLOUD-PLATFORM

File type
XML 1.0 document, ASCII text, with very long lines (332)
Size
444 B (444 bytes)
Hash
3b324dec137a87ef7e24a30a65b13dd0
c0faa95b2f1018e264b3a14aaf50d1003e6c27b3
6cd0b591d9239fc8564627e92a804fc261951b1cbaf5fa58a8ada3cc13f51463

HTTP Headers

GET /update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-101-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml HTTP/1.1
Host: aus5.mozilla.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Cache-Control: no-cache
Pragma: no-cache
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
rule-id: unknown
rule-data-version: unknown
content-signature: x5u=https://content-signature-2.cdn.mozilla.net/chains/aus.content-signature.mozilla.org-2024-05-20-00-15-28.chain; p384ecdsa=TdixhaQnmvFzAkOdSHWEEStg3BaEHbc5-RMj_bTo9Tks6tiGQLzQSZza9rEdVuUx-iHSSta_MU0suXRYlZDWbpqebVMIsoOZArQPYdlcPdmIYo_0p5mtDiXuZreR7nDM
strict-transport-security: max-age=31536000;
x-content-type-options: nosniff
content-security-policy: default-src 'none'; frame-ancestors 'none'
x-proxy-cache-status: EXPIRED
content-encoding: gzip
via: 1.1 google
date: Tue, 16 Apr 2024 16:07:08 GMT
content-type: text/xml; charset=utf-8
vary: Accept-Encoding
content-length: 444
age: 55
cache-control: public,max-age=90
alt-svc: clear
X-Firefox-Spdy: h2

dev-sqlmfia.pantheonsite.io/sqlammx/jquery.js

23.185.0.3

200 OK

291 kB

URL GET HTTP/2
dev-sqlmfia.pantheonsite.io/sqlammx/jquery.js
IP
23.185.0.3:443
ASN
#54113 FASTLY

Requested by
https://pub-996665b4c28241aabc7d099d1e74baf6.r2.dev/index.html
Certificate
IssuerLet's Encrypt
Subjectpantheonsite.io
Fingerprint23:29:40:F0:5B:2A:65:6E:BF:46:58:A1:10:8F:CF:AE:E4:77:7A:DA
ValidityWed, 24 Jan 2024 20:55:39 GMT - Tue, 23 Apr 2024 20:55:38 GMT

File type
JavaScript source, ASCII text, with CRLF line terminators
Size
291 kB (290960 bytes)
Hash
24fa855a7678b1938f16235881e3e80b
67b6c9946134456d67c07765d230130d8679f8c6
f2a84bc4f4cb8ae04162f42f1f3ebed1e05725d9b5bf666b885356c7698a071f

HTTP Headers

GET /sqlammx/jquery.js HTTP/1.1
Host: dev-sqlmfia.pantheonsite.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pub-996665b4c28241aabc7d099d1e74baf6.r2.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-encoding: gzip
content-type: application/x-javascript
etag: W/"65aade52-47090"
expires: Tue, 16 Apr 2024 16:07:44 GMT
last-modified: Fri, 19 Jan 2024 20:40:50 GMT
server: nginx
strict-transport-security: max-age=300
x-pantheon-styx-hostname: styx-fe3-b-6dcb674cdd-2fkmk
x-styx-req-id: 7637b046-fc0b-11ee-a538-32fd45d5d86a
cache-control: no-cache, must-revalidate
date: Tue, 16 Apr 2024 16:07:45 GMT
x-served-by: cache-chi-kigq8000044-CHI, cache-hel1410020-HEL
x-cache: MISS, MISS
x-cache-hits: 0, 0
x-timer: S1713283665.258901,VS0,VE142
vary: Accept-Encoding
x-robots-tag: noindex
age: 0
accept-ranges: bytes
via: 1.1 varnish, 1.1 varnish
X-Firefox-Spdy: h2

pub-996665b4c28241aabc7d099d1e74baf6.r2.dev/favicon.ico

0.0.0.0

0 B

URL GET
pub-996665b4c28241aabc7d099d1e74baf6.r2.dev/favicon.ico
IP
0.0.0.0:0
ASN
#0

Requested by
https://pub-996665b4c28241aabc7d099d1e74baf6.r2.dev/index.html
Certificate
IssuerLet's Encrypt
Subject*.r2.dev
Fingerprint48:74:F0:98:E0:A1:57:3E:86:18:BF:B3:DC:C9:7A:5B:53:50:FE:E0
ValidityFri, 05 Apr 2024 15:25:24 GMT - Thu, 04 Jul 2024 15:25:23 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: pub-996665b4c28241aabc7d099d1e74baf6.r2.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pub-996665b4c28241aabc7d099d1e74baf6.r2.dev/index.html
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

dev-sqlmfia.pantheonsite.io/sqlammx/basic.js

23.185.0.3

200 OK

47 kB

URL GET HTTP/2
dev-sqlmfia.pantheonsite.io/sqlammx/basic.js
IP
23.185.0.3:443
ASN
#54113 FASTLY

Requested by
https://pub-996665b4c28241aabc7d099d1e74baf6.r2.dev/index.html
Certificate
IssuerLet's Encrypt
Subjectpantheonsite.io
Fingerprint23:29:40:F0:5B:2A:65:6E:BF:46:58:A1:10:8F:CF:AE:E4:77:7A:DA
ValidityWed, 24 Jan 2024 20:55:39 GMT - Tue, 23 Apr 2024 20:55:38 GMT

File type
JavaScript source, ASCII text, with very long lines (46660), with CRLF line terminators
Size
47 kB (47215 bytes)
Hash
54af38a67965d3b29113f9096ec5ac28
3ec230e1bc053dd226574ca7aa893206c4baf4bf
4e9bd6f6716b9f99de4229f6605c39aeaf13d86e1c18d8297d7b81d446980f3b

HTTP Headers

GET /sqlammx/basic.js HTTP/1.1
Host: dev-sqlmfia.pantheonsite.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pub-996665b4c28241aabc7d099d1e74baf6.r2.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-encoding: gzip
content-type: application/x-javascript
etag: W/"6606d041-b86f"
expires: Tue, 16 Apr 2024 16:07:44 GMT
last-modified: Fri, 29 Mar 2024 14:29:21 GMT
server: nginx
strict-transport-security: max-age=300
x-pantheon-styx-hostname: styx-fe3-b-6dcb674cdd-nlc9q
x-styx-req-id: 763830c4-fc0b-11ee-86ea-f69397fb5f48
cache-control: no-cache, must-revalidate
date: Tue, 16 Apr 2024 16:07:45 GMT
x-served-by: cache-chi-kigq8000137-CHI, cache-hel1410020-HEL
x-cache: MISS, MISS
x-cache-hits: 0, 0
x-timer: S1713283665.261838,VS0,VE134
vary: Accept-Encoding
x-robots-tag: noindex
age: 0
accept-ranges: bytes
via: 1.1 varnish, 1.1 varnish
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (5)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (22)

URL User Request GET HTTP/1.1

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers