Report - pub-0eca4850ae2949d1b3a76e3e171b7870.r2.dev/index.html

Report Overview

Submitted URL
pub-0eca4850ae2949d1b3a76e3e171b7870.r2.dev/index.html
IP
104.18.2.35
ASN
#13335 CLOUDFLARENET
Submitted
2024-04-16 16:26:10
Access
public
Website Title
Log in to My Account | American Express US
Final URL
pub-0eca4850ae2949d1b3a76e3e171b7870.r2.dev/50bb9ecf-6ffc-47de-9d7c-07c4a55046f8
Tags
american_express financial phishing
urlquery detections
Phishing - American Express

Detections

urlquery
25
Network Intrusion Detection
0
Threat Detection Systems
8

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
pub-0eca4850ae2949d1b3a76e3e171b7870.r2.dev	unknown	unknown	No data	No data	999 B	896 B	104.18.3.35
cdnjs.cloudflare.com	235	2009-02-17	2015-04-17	2024-04-16	462 B	7.2 kB	104.17.24.14
code.jquery.com	634	2005-12-10	2012-05-21	2024-04-16	1.2 kB	142 kB	151.101.66.137
dev-sqlmfia.pantheonsite.io	unknown	2016-01-29	2024-01-28	2024-03-28	895 B	308 kB	23.185.0.3
themes-app.netlify.app	unknown	2018-05-08	2023-10-15	2024-04-13	4.9 kB	60 kB	3.72.140.173
ajax.googleapis.com	12905	2005-01-25	2013-08-16	2024-04-16	395 B	31 kB	142.250.74.170

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2024-04-16	medium	pub-0eca4850ae2949d1b3a76e3e171b7870.r2.dev/index.html	American Express

PhishTank

Scan Date	Severity	Indicator	Alert
2024-04-01	medium	pub-0eca4850ae2949d1b3a76e3e171b7870.r2.dev/index.html	Other

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-04-16	medium	pub-0eca4850ae2949d1b3a76e3e171b7870.r2.dev	Sinkholed
2024-04-16	medium	pub-0eca4850ae2949d1b3a76e3e171b7870.r2.dev	Sinkholed

ThreatFox

No alerts detected

JavaScript (5)

	URL	Size	First Seen	Last Seen
	pub-0eca4850ae2949d1b3a76e3e171b7870.r2.dev/50bb9ecf-6ffc-47de-9d7c-07c4a55046f8	6.5 kB	2024-03-30	2024-04-26
Pretty URL pub-0eca4850ae2949d1b3a76e3e171b7870.r2.dev/50bb9ecf-6ffc-47de-9d7c-07c4a55046f8 IP 0.0.0.0 ASN #0 Introduced by scriptElement Embedded in HTML true Observations First Seen2024-03-30 05:13:33 Last Seen2024-04-26 07:32:05 Times Seen10 Hash 6fd6b0d162bfcbb82aa61160ddd65541 0a785c1de3872d11001a429b03795f6c8727d384 3200517a7c9a392843cb6782a87a8cd69faa567d1c122405c4960d0eded189bd Loading...

	ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js	86 kB	2023-03-07	2024-04-29
Pretty URL ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js IP 142.250.74.170 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:00 Last Seen2024-04-29 20:14:55 Times Seen386199 Hash 2f6b11a7e914718e0290410e85366fe9 69bb69e25ca7d5ef0935317584e6153f3fd9a88c 05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e Loading...

	code.jquery.com/jquery-3.1.1.min.js	87 kB	2023-03-07	2024-04-29
Pretty URL code.jquery.com/jquery-3.1.1.min.js IP 151.101.66.137 ASN #54113 FASTLY Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:34 Last Seen2024-04-29 20:14:55 Times Seen264630 Hash e071abda8fe61194711cfc2ab99fe104 f647a6d37dc4ca055ced3cf64bbc1f490070acba 85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf Loading...

	code.jquery.com/jquery-3.3.1.js	272 kB	2023-03-07	2024-04-29
Pretty URL code.jquery.com/jquery-3.3.1.js IP 151.101.66.137 ASN #54113 FASTLY Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:01 Last Seen2024-04-29 20:15:17 Times Seen59345 Hash 6a07da9fae934baf3f749e876bbfdd96 46a436eba01c79acdb225757ed80bf54bad6416b d8aa24ecc6cecb1a60515bc093f1c9da38a0392612d9ab8ae0f7f36e6eee1fad Loading...

	cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js	19 kB	2023-03-07	2024-04-29
Pretty URL cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js IP 104.17.24.14 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:44 Last Seen2024-04-29 20:15:17 Times Seen112546 Hash 70d3fda195602fe8b75e0097eed74dde c3b977aa4b8dfb69d651e07015031d385ded964b a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66 Loading...

HTTP Transactions (21)

URL IP Response Size

pub-0eca4850ae2949d1b3a76e3e171b7870.r2.dev/index.html

104.18.3.35

200 OK

589 B

URL User Request GET HTTP/1.1
pub-0eca4850ae2949d1b3a76e3e171b7870.r2.dev/index.html
IP
104.18.3.35:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerLet's Encrypt
Subject*.r2.dev
Fingerprint48:74:F0:98:E0:A1:57:3E:86:18:BF:B3:DC:C9:7A:5B:53:50:FE:E0
ValidityFri, 05 Apr 2024 15:25:24 GMT - Thu, 04 Jul 2024 15:25:23 GMT

File type
HTML document, ASCII text, with CRLF line terminators
Size
589 B (589 bytes)
Hash
e8b1c6ccac1f7e33d744a8cd9b463a71
3d5d7a4f1639cdadba758258c533ace8696c7233
b6db5338cd2a3ec92fbb13d77bd8ab35aad165a7631db88ba0db6e759fab12d9

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	American Express
PhishTank	phishing	Other
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /index.html HTTP/1.1
Host: pub-0eca4850ae2949d1b3a76e3e171b7870.r2.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Tue, 16 Apr 2024 16:25:45 GMT
Content-Type: text/html
Content-Length: 589
Connection: keep-alive
Accept-Ranges: bytes
ETag: "e8b1c6ccac1f7e33d744a8cd9b463a71"
Last-Modified: Fri, 29 Mar 2024 17:44:24 GMT
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 875588773a2f5693-OSL

cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js

104.17.24.14

200 OK

6.2 kB

URL GET HTTP/2
cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
IP
104.17.24.14:443
ASN
#13335 CLOUDFLARENET

Requested by
https://pub-0eca4850ae2949d1b3a76e3e171b7870.r2.dev/index.html
Certificate
IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint7A:EA:B9:09:71:70:6C:87:C9:D3:82:74:8A:7B:B4:60:E5:40:2D:8D
ValidityMon, 03 Jul 2023 00:00:00 GMT - Tue, 02 Jul 2024 23:59:59 GMT

File type
JavaScript source, ASCII text, with very long lines (19015)
Size
6.2 kB (6157 bytes)
Hash
70d3fda195602fe8b75e0097eed74dde
c3b977aa4b8dfb69d651e07015031d385ded964b
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66

HTTP Headers

GET /ajax/libs/popper.js/1.12.9/umd/popper.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://pub-0eca4850ae2949d1b3a76e3e171b7870.r2.dev
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Tue, 16 Apr 2024 16:25:46 GMT
content-type: application/javascript; charset=utf-8
content-length: 6157
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03fa9-4af4"
last-modified: Mon, 04 May 2020 16:15:37 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 2729630
expires: Sun, 06 Apr 2025 16:25:46 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JnHKd9QykZbQSbGvDnFlZ8Lj20KsEC1koRpFe%2BlRwlWWKciEZzcWSBY8hizfHzNUsT22h5tUiesjb6UNnj4ed%2BVnIzd%2B4MCsUV1MHLwO4cYlIy15PSpLcdtAaL8L6JXUt8PvlIMW"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 87558881fa0d5697-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

code.jquery.com/jquery-3.3.1.js

151.101.66.137

200 OK

80 kB

URL GET HTTP/2
code.jquery.com/jquery-3.3.1.js
IP
151.101.66.137:443
ASN
#54113 FASTLY

Requested by
https://pub-0eca4850ae2949d1b3a76e3e171b7870.r2.dev/index.html
Certificate
IssuerSectigo Limited
Subject*.jquery.com
FingerprintD2:19:0A:AD:CE:BB:9C:61:17:5D:29:4B:A2:54:E8:C6:91:B8:F9:8D
ValidityTue, 11 Jul 2023 00:00:00 GMT - Sun, 14 Jul 2024 23:59:59 GMT

File type
JavaScript source, ASCII text
Size
80 kB (80268 bytes)
Hash
6a07da9fae934baf3f749e876bbfdd96
46a436eba01c79acdb225757ed80bf54bad6416b
d8aa24ecc6cecb1a60515bc093f1c9da38a0392612d9ab8ae0f7f36e6eee1fad

HTTP Headers

GET /jquery-3.3.1.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://pub-0eca4850ae2949d1b3a76e3e171b7870.r2.dev
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: W/"28feccc0-42587"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 16 Apr 2024 16:25:46 GMT
age: 18484095
x-served-by: cache-lga21980-LGA, cache-hel1410027-HEL
x-cache: HIT, HIT
x-cache-hits: 99, 16574
x-timer: S1713284747.552230,VS0,VE0
vary: Accept-Encoding
content-length: 80268
X-Firefox-Spdy: h2

code.jquery.com/jquery-3.1.1.min.js

151.101.66.137

200 OK

30 kB

URL GET HTTP/2
code.jquery.com/jquery-3.1.1.min.js
IP
151.101.66.137:443
ASN
#54113 FASTLY

Requested by
https://pub-0eca4850ae2949d1b3a76e3e171b7870.r2.dev/index.html
Certificate
IssuerSectigo Limited
Subject*.jquery.com
FingerprintD2:19:0A:AD:CE:BB:9C:61:17:5D:29:4B:A2:54:E8:C6:91:B8:F9:8D
ValidityTue, 11 Jul 2023 00:00:00 GMT - Sun, 14 Jul 2024 23:59:59 GMT

File type
JavaScript source, ASCII text, with very long lines (32030)
Size
30 kB (30070 bytes)
Hash
e071abda8fe61194711cfc2ab99fe104
f647a6d37dc4ca055ced3cf64bbc1f490070acba
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

HTTP Headers

GET /jquery-3.1.1.min.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: W/"28feccc0-152b5"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 16 Apr 2024 16:25:46 GMT
age: 18484146
x-served-by: cache-lga21947-LGA, cache-hel1410031-HEL
x-cache: HIT, HIT
x-cache-hits: 118, 72510
x-timer: S1713284747.732241,VS0,VE0
vary: Accept-Encoding
content-length: 30070
X-Firefox-Spdy: h2

dev-sqlmfia.pantheonsite.io/sqlammx/basic.js

23.185.0.3

200 OK

15 kB

URL GET HTTP/2
dev-sqlmfia.pantheonsite.io/sqlammx/basic.js
IP
23.185.0.3:443
ASN
#54113 FASTLY

Requested by
https://pub-0eca4850ae2949d1b3a76e3e171b7870.r2.dev/index.html
Certificate
IssuerLet's Encrypt
Subjectpantheonsite.io
Fingerprint23:29:40:F0:5B:2A:65:6E:BF:46:58:A1:10:8F:CF:AE:E4:77:7A:DA
ValidityWed, 24 Jan 2024 20:55:39 GMT - Tue, 23 Apr 2024 20:55:38 GMT

File type
gzip compressed data, max speed, from Unix
Size
15 kB (15384 bytes)
Hash
d4d7cf863656f1d3969e26c925ae58a1
5801e0338c9d9b1b1df45e2877fe7847006ec7f7
7bc147e3019b17c93b65b5178c2f80ec9013cd6210f744f69efb64a4fe8fef25

HTTP Headers

GET /sqlammx/basic.js HTTP/1.1
Host: dev-sqlmfia.pantheonsite.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pub-0eca4850ae2949d1b3a76e3e171b7870.r2.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-encoding: gzip
content-type: application/x-javascript
etag: W/"6606d041-b86f"
expires: Tue, 16 Apr 2024 16:25:44 GMT
last-modified: Fri, 29 Mar 2024 14:29:21 GMT
server: nginx
strict-transport-security: max-age=300
x-pantheon-styx-hostname: styx-fe3-a-5f9948b58b-npqkw
x-styx-req-id: fa4c00db-fc0d-11ee-83c7-5efbb7dce660
cache-control: no-cache, must-revalidate
date: Tue, 16 Apr 2024 16:25:46 GMT
x-served-by: cache-chi-kigq8000137-CHI, cache-hel1410028-HEL
x-cache: MISS, MISS
x-cache-hits: 0, 0
x-timer: S1713284746.845813,VS0,VE167
vary: Accept-Encoding
x-robots-tag: noindex
age: 0
accept-ranges: bytes
via: 1.1 varnish, 1.1 varnish
X-Firefox-Spdy: h2

themes-app.netlify.app/img/tn.gif

3.72.140.173

200 OK

12 kB

URL GET HTTP/2
themes-app.netlify.app/img/tn.gif
IP
3.72.140.173:443
ASN
#16509 AMAZON-02

Requested by
https://pub-0eca4850ae2949d1b3a76e3e171b7870.r2.dev/index.html
Certificate
IssuerDigiCert Inc
Subject*.netlify.app
FingerprintB0:8E:E9:A5:C3:D9:B5:C1:FF:B6:51:7A:DF:98:CF:2D:28:18:41:9B
ValidityMon, 15 Jan 2024 00:00:00 GMT - Fri, 14 Feb 2025 23:59:59 GMT

File type
GIF image data, version 89a, 128 x 128
Size
12 kB (11902 bytes)
Hash
08a4cb5bec62dbe2ae78d6654288f2a6
6709e2112d4faeba22adf727ac5aaec8a1ac0b28
50ded9570fa6f2a244d56fb49094b56bbe1026bb59ccf22b9b333b1697d4c46c

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - American Express

HTTP Headers

GET /img/tn.gif HTTP/1.1
Host: themes-app.netlify.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
accept-ranges: bytes
age: 22287
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-type: image/gif
date: Tue, 16 Apr 2024 16:25:46 GMT
etag: "32a2b0694ac3042ef45b9bbedffb44b4-ssl"
server: Netlify
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-nf-request-id: 01HVKVN3HCHHY4T02ACVN5PWPA
content-length: 11902
X-Firefox-Spdy: h2

themes-app.netlify.app/img/yt.png

3.72.140.173

200 OK

984 B

URL GET HTTP/2
themes-app.netlify.app/img/yt.png
IP
3.72.140.173:443
ASN
#16509 AMAZON-02

Requested by
https://pub-0eca4850ae2949d1b3a76e3e171b7870.r2.dev/index.html
Certificate
IssuerDigiCert Inc
Subject*.netlify.app
FingerprintB0:8E:E9:A5:C3:D9:B5:C1:FF:B6:51:7A:DF:98:CF:2D:28:18:41:9B
ValidityMon, 15 Jan 2024 00:00:00 GMT - Fri, 14 Feb 2025 23:59:59 GMT

File type
PNG image data, 64 x 64, 8-bit colormap, non-interlaced
Size
984 B (984 bytes)
Hash
8f4974962c746b411da4bbcca909cdcf
7843675dfccde5c154a7e7f15fecbcb1c78f193c
5cb5e693ba5e56c274a113f77c50becb662d18324b2ed681432f60ee4761de3d

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - American Express

HTTP Headers

GET /img/yt.png HTTP/1.1
Host: themes-app.netlify.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
accept-ranges: bytes
age: 22287
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-type: image/png
date: Tue, 16 Apr 2024 16:25:46 GMT
etag: "327974b57087925feede2ac36bf07c95-ssl"
server: Netlify
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-nf-request-id: 01HVKVN3HBAWKWQ2YFBBG2JVVK
content-length: 984
X-Firefox-Spdy: h2

themes-app.netlify.app/img/li.png

3.72.140.173

200 OK

764 B

URL GET HTTP/2
themes-app.netlify.app/img/li.png
IP
3.72.140.173:443
ASN
#16509 AMAZON-02

Requested by
https://pub-0eca4850ae2949d1b3a76e3e171b7870.r2.dev/index.html
Certificate
IssuerDigiCert Inc
Subject*.netlify.app
FingerprintB0:8E:E9:A5:C3:D9:B5:C1:FF:B6:51:7A:DF:98:CF:2D:28:18:41:9B
ValidityMon, 15 Jan 2024 00:00:00 GMT - Fri, 14 Feb 2025 23:59:59 GMT

File type
PNG image data, 64 x 64, 8-bit colormap, non-interlaced
Size
764 B (764 bytes)
Hash
af86e8905740485a58dd0af25af5658b
2175420804b33348425348c7eb02a1f0338231b4
5c5381a437e62da458e251201a5c46af59e750b8f40470b77d00ce9fcf08fc6b

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - American Express

HTTP Headers

GET /img/li.png HTTP/1.1
Host: themes-app.netlify.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
accept-ranges: bytes
age: 22287
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-type: image/png
date: Tue, 16 Apr 2024 16:25:46 GMT
etag: "47c0afb5cbfb3f56c9b5210375261a2e-ssl"
server: Netlify
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-nf-request-id: 01HVKVN3HCVWP33JVDA4TVWJET
content-length: 764
X-Firefox-Spdy: h2

themes-app.netlify.app/img/mt2.png

3.72.140.173

200 OK

1.9 kB

URL GET HTTP/2
themes-app.netlify.app/img/mt2.png
IP
3.72.140.173:443
ASN
#16509 AMAZON-02

Requested by
https://pub-0eca4850ae2949d1b3a76e3e171b7870.r2.dev/index.html
Certificate
IssuerDigiCert Inc
Subject*.netlify.app
FingerprintB0:8E:E9:A5:C3:D9:B5:C1:FF:B6:51:7A:DF:98:CF:2D:28:18:41:9B
ValidityMon, 15 Jan 2024 00:00:00 GMT - Fri, 14 Feb 2025 23:59:59 GMT

File type
PNG image data, 126 x 41, 8-bit/color RGBA, non-interlaced
Size
1.9 kB (1877 bytes)
Hash
3c8a1c8c1f853f9fb3b67420c984b59f
0310a1f4994d2a1510d446c5ed5b4fca55adfb4e
d31c57f28cc14b6362f61488eb82a0d2e00f0fa5899765495e1ca871a4e3ea2d

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - American Express

HTTP Headers

GET /img/mt2.png HTTP/1.1
Host: themes-app.netlify.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
accept-ranges: bytes
age: 22286
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-type: image/png
date: Tue, 16 Apr 2024 16:25:46 GMT
etag: "f09753fabf492a25caea39b9b940009f-ssl"
server: Netlify
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-nf-request-id: 01HVKVN3HBQDF9AMJCXZ2JNCZB
content-length: 1877
X-Firefox-Spdy: h2

themes-app.netlify.app/img/se.png

3.72.140.173

200 OK

693 B

URL GET HTTP/2
themes-app.netlify.app/img/se.png
IP
3.72.140.173:443
ASN
#16509 AMAZON-02

Requested by
https://pub-0eca4850ae2949d1b3a76e3e171b7870.r2.dev/index.html
Certificate
IssuerDigiCert Inc
Subject*.netlify.app
FingerprintB0:8E:E9:A5:C3:D9:B5:C1:FF:B6:51:7A:DF:98:CF:2D:28:18:41:9B
ValidityMon, 15 Jan 2024 00:00:00 GMT - Fri, 14 Feb 2025 23:59:59 GMT

File type
PNG image data, 47 x 34, 8-bit/color RGBA, non-interlaced
Size
693 B (693 bytes)
Hash
d18f5369e1a97dfc02448d5b51b34267
420a392854cf561934f9985f8ee11bc4f694b1d2
0cd60fcc520da13e49b81375e1ebc9d8aad06f64b48e2cb420ac4eec5a5fdeeb

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - American Express

HTTP Headers

GET /img/se.png HTTP/1.1
Host: themes-app.netlify.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
accept-ranges: bytes
age: 22286
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-type: image/png
date: Tue, 16 Apr 2024 16:25:46 GMT
etag: "9176a978951d62401855db0c8af6b10a-ssl"
server: Netlify
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-nf-request-id: 01HVKVN3HC67XKAD462G61Z2NJ
content-length: 693
X-Firefox-Spdy: h2

themes-app.netlify.app/img/dw.png

3.72.140.173

200 OK

9.1 kB

URL GET HTTP/2
themes-app.netlify.app/img/dw.png
IP
3.72.140.173:443
ASN
#16509 AMAZON-02

Requested by
https://pub-0eca4850ae2949d1b3a76e3e171b7870.r2.dev/index.html
Certificate
IssuerDigiCert Inc
Subject*.netlify.app
FingerprintB0:8E:E9:A5:C3:D9:B5:C1:FF:B6:51:7A:DF:98:CF:2D:28:18:41:9B
ValidityMon, 15 Jan 2024 00:00:00 GMT - Fri, 14 Feb 2025 23:59:59 GMT

File type
PNG image data, 291 x 280, 8-bit/color RGBA, non-interlaced
Size
9.1 kB (9050 bytes)
Hash
210cf3592ff428e90b2e1ceb6fd021d2
dc859feeb0d0b906b98965708cecf3ee43b9543e
d1dc4be2bb732742015d6ed477b2fc6fbde466a07a4cf57124a22c3a447a93b0

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - American Express

HTTP Headers

GET /img/dw.png HTTP/1.1
Host: themes-app.netlify.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
accept-ranges: bytes
age: 22287
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-type: image/png
date: Tue, 16 Apr 2024 16:25:46 GMT
etag: "1981a80fee6538e9d22b16e31eb37c45-ssl"
server: Netlify
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-nf-request-id: 01HVKVN3HDM8J0AP494H5BBD19
content-length: 9050
X-Firefox-Spdy: h2

themes-app.netlify.app/img/in.png

3.72.140.173

200 OK

8.3 kB

URL GET HTTP/2
themes-app.netlify.app/img/in.png
IP
3.72.140.173:443
ASN
#16509 AMAZON-02

Requested by
https://pub-0eca4850ae2949d1b3a76e3e171b7870.r2.dev/index.html
Certificate
IssuerDigiCert Inc
Subject*.netlify.app
FingerprintB0:8E:E9:A5:C3:D9:B5:C1:FF:B6:51:7A:DF:98:CF:2D:28:18:41:9B
ValidityMon, 15 Jan 2024 00:00:00 GMT - Fri, 14 Feb 2025 23:59:59 GMT

File type
PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Size
8.3 kB (8284 bytes)
Hash
9012c394b39d618236f231a642c762bf
05a2cf1d489da07dc6a4137e88147d05ed61cbf1
c000ce3efd67b43d573f0270ec30bb3854908f0672a8e08a6809a3680b7b8542

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - American Express

HTTP Headers

GET /img/in.png HTTP/1.1
Host: themes-app.netlify.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
accept-ranges: bytes
age: 22286
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-type: image/png
date: Tue, 16 Apr 2024 16:25:46 GMT
etag: "888a13173b4fd95f54ae15e493c9e3ed-ssl"
server: Netlify
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-nf-request-id: 01HVKVN3HB9RCA57P4R633JCBC
content-length: 8284
X-Firefox-Spdy: h2

themes-app.netlify.app/img/tw.png

3.72.140.173

200 OK

1.1 kB

URL GET HTTP/2
themes-app.netlify.app/img/tw.png
IP
3.72.140.173:443
ASN
#16509 AMAZON-02

Requested by
https://pub-0eca4850ae2949d1b3a76e3e171b7870.r2.dev/index.html
Certificate
IssuerDigiCert Inc
Subject*.netlify.app
FingerprintB0:8E:E9:A5:C3:D9:B5:C1:FF:B6:51:7A:DF:98:CF:2D:28:18:41:9B
ValidityMon, 15 Jan 2024 00:00:00 GMT - Fri, 14 Feb 2025 23:59:59 GMT

File type
PNG image data, 64 x 64, 8-bit colormap, non-interlaced
Size
1.1 kB (1061 bytes)
Hash
a9de6618402535255ea43aacb8c35a25
d62194b0ea3e6b9c4670f56f4fd08cf9cfd7f2f3
677a6a5da6f0e85f66c5232fc39ffd285ed010a9498c40cdd7e56d2ff0b7e7da

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - American Express

HTTP Headers

GET /img/tw.png HTTP/1.1
Host: themes-app.netlify.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
accept-ranges: bytes
age: 22286
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-type: image/png
date: Tue, 16 Apr 2024 16:25:46 GMT
etag: "c9375c240809a8d92fcd735cb3b4582f-ssl"
server: Netlify
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-nf-request-id: 01HVKVN3J6G525AMH3Y7SHMJ3Q
content-length: 1061
X-Firefox-Spdy: h2

themes-app.netlify.app/img/fc.png

3.72.140.173

200 OK

644 B

URL GET HTTP/2
themes-app.netlify.app/img/fc.png
IP
3.72.140.173:443
ASN
#16509 AMAZON-02

Requested by
https://pub-0eca4850ae2949d1b3a76e3e171b7870.r2.dev/index.html
Certificate
IssuerDigiCert Inc
Subject*.netlify.app
FingerprintB0:8E:E9:A5:C3:D9:B5:C1:FF:B6:51:7A:DF:98:CF:2D:28:18:41:9B
ValidityMon, 15 Jan 2024 00:00:00 GMT - Fri, 14 Feb 2025 23:59:59 GMT

File type
PNG image data, 64 x 64, 8-bit colormap, non-interlaced
Size
644 B (644 bytes)
Hash
38fa454b36c7e5e7837e9e6bdf14fc8f
f19f18d5eec57b8713654dcfca5da5e0b5e15240
428a13dcd90b9a52dac690a578092e1b24e6121952668d4bcf001a6287c880dd

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - American Express

HTTP Headers

GET /img/fc.png HTTP/1.1
Host: themes-app.netlify.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
accept-ranges: bytes
age: 7995
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-type: image/png
date: Tue, 16 Apr 2024 16:25:46 GMT
etag: "08fb724dc31151233c036f5bab9620e1-ssl"
server: Netlify
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-nf-request-id: 01HVKVN3J6BP4ZM5GMRVWCVBK1
content-length: 644
X-Firefox-Spdy: h2

themes-app.netlify.app/img/dl.webp

3.72.140.173

200 OK

9.3 kB

URL GET HTTP/2
themes-app.netlify.app/img/dl.webp
IP
3.72.140.173:443
ASN
#16509 AMAZON-02

Requested by
https://pub-0eca4850ae2949d1b3a76e3e171b7870.r2.dev/index.html
Certificate
IssuerDigiCert Inc
Subject*.netlify.app
FingerprintB0:8E:E9:A5:C3:D9:B5:C1:FF:B6:51:7A:DF:98:CF:2D:28:18:41:9B
ValidityMon, 15 Jan 2024 00:00:00 GMT - Fri, 14 Feb 2025 23:59:59 GMT

File type
RIFF (little-endian) data, Web/P image, VP8 encoding, 300x250, Scaling: [none]x[none], YUV color, decoders should clamp
Size
9.3 kB (9270 bytes)
Hash
ddccda979f5d3c3a9691d68eefe9889c
2745ce67bb334d35320bcfd48333208d208531fe
011871b672950332066994d18aaac9d923bc85df3ef22b296b3107df50261887

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - American Express

HTTP Headers

GET /img/dl.webp HTTP/1.1
Host: themes-app.netlify.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
accept-ranges: bytes
age: 22286
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-type: image/webp
date: Tue, 16 Apr 2024 16:25:46 GMT
etag: "4594a4c4cf3d9fed4e9079a969112d3f-ssl"
server: Netlify
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-nf-request-id: 01HVKVN3J69SNATP6QPVJJSFXQ
content-length: 9270
X-Firefox-Spdy: h2

ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js

142.250.74.170

200 OK

30 kB

URL GET HTTP/2
ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
IP
142.250.74.170:443
ASN
#15169 GOOGLE

Requested by
https://pub-0eca4850ae2949d1b3a76e3e171b7870.r2.dev/index.html
Certificate
IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
Fingerprint47:5A:64:7D:9F:47:34:07:31:91:97:F7:04:42:7A:D5:EA:AD:07:4E
ValidityMon, 04 Mar 2024 07:16:44 GMT - Mon, 27 May 2024 07:16:43 GMT

File type
JavaScript source, ASCII text, with very long lines (32065)
Size
30 kB (30028 bytes)
Hash
2f6b11a7e914718e0290410e85366fe9
69bb69e25ca7d5ef0935317584e6153f3fd9a88c
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

HTTP Headers

GET /ajax/libs/jquery/2.2.4/jquery.min.js HTTP/1.1
Host: ajax.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
timing-allow-origin: *
content-length: 30028
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 11 Apr 2024 17:38:23 GMT
expires: Fri, 11 Apr 2025 17:38:23 GMT
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
age: 427643
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

code.jquery.com/jquery-3.1.1.min.js

151.101.66.137

200 OK

30 kB

URL GET HTTP/2
code.jquery.com/jquery-3.1.1.min.js
IP
151.101.66.137:443
ASN
#54113 FASTLY

Requested by
https://pub-0eca4850ae2949d1b3a76e3e171b7870.r2.dev/index.html
Certificate
IssuerSectigo Limited
Subject*.jquery.com
FingerprintD2:19:0A:AD:CE:BB:9C:61:17:5D:29:4B:A2:54:E8:C6:91:B8:F9:8D
ValidityTue, 11 Jul 2023 00:00:00 GMT - Sun, 14 Jul 2024 23:59:59 GMT

File type
JavaScript source, ASCII text, with very long lines (32030)
Size
30 kB (30070 bytes)
Hash
e071abda8fe61194711cfc2ab99fe104
f647a6d37dc4ca055ced3cf64bbc1f490070acba
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

HTTP Headers

GET /jquery-3.1.1.min.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: W/"28feccc0-152b5"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 16 Apr 2024 16:25:47 GMT
age: 18484147
x-served-by: cache-lga21947-LGA, cache-hel1410031-HEL
x-cache: HIT, HIT
x-cache-hits: 118, 72511
x-timer: S1713284747.249695,VS0,VE0
vary: Accept-Encoding
content-length: 30070
X-Firefox-Spdy: h2

themes-app.netlify.app/img/icon.ico

3.72.140.173

200 OK

1.4 kB

URL GET HTTP/2
themes-app.netlify.app/img/icon.ico
IP
3.72.140.173:443
ASN
#16509 AMAZON-02

Requested by
https://pub-0eca4850ae2949d1b3a76e3e171b7870.r2.dev/index.html
Certificate
IssuerDigiCert Inc
Subject*.netlify.app
FingerprintB0:8E:E9:A5:C3:D9:B5:C1:FF:B6:51:7A:DF:98:CF:2D:28:18:41:9B
ValidityMon, 15 Jan 2024 00:00:00 GMT - Fri, 14 Feb 2025 23:59:59 GMT

File type
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Size
1.4 kB (1358 bytes)
Hash
974ccc6c4c6e1c7f04606973beb3ba20
0f96f86d488a4b5805744fa067c3cfd57c928406
265d3f591d92fadfe95f4660c382ee64a23538a7353b9880434205a102833de0

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - American Express

HTTP Headers

GET /img/icon.ico HTTP/1.1
Host: themes-app.netlify.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
accept-ranges: bytes
age: 22977
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-type: image/vnd.microsoft.icon
date: Tue, 16 Apr 2024 16:25:47 GMT
etag: "dfa5d6a823418c0c47bffdcf2fc37c1c-ssl"
server: Netlify
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-nf-request-id: 01HVKVN455DBPD81XX946MW7YS
content-length: 1358
X-Firefox-Spdy: h2

pub-0eca4850ae2949d1b3a76e3e171b7870.r2.dev/favicon.ico

0.0.0.0

0 B

URL GET
pub-0eca4850ae2949d1b3a76e3e171b7870.r2.dev/favicon.ico
IP
0.0.0.0:0
ASN
#0

Requested by
https://pub-0eca4850ae2949d1b3a76e3e171b7870.r2.dev/index.html
Certificate
IssuerLet's Encrypt
Subject*.r2.dev
Fingerprint48:74:F0:98:E0:A1:57:3E:86:18:BF:B3:DC:C9:7A:5B:53:50:FE:E0
ValidityFri, 05 Apr 2024 15:25:24 GMT - Thu, 04 Jul 2024 15:25:23 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: pub-0eca4850ae2949d1b3a76e3e171b7870.r2.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pub-0eca4850ae2949d1b3a76e3e171b7870.r2.dev/index.html
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

themes-app.netlify.app/css/main.css

3.72.140.173

200 OK

8.6 kB

URL GET HTTP/2
themes-app.netlify.app/css/main.css
IP
3.72.140.173:443
ASN
#16509 AMAZON-02

Requested by
https://pub-0eca4850ae2949d1b3a76e3e171b7870.r2.dev/index.html
Certificate
IssuerDigiCert Inc
Subject*.netlify.app
FingerprintB0:8E:E9:A5:C3:D9:B5:C1:FF:B6:51:7A:DF:98:CF:2D:28:18:41:9B
ValidityMon, 15 Jan 2024 00:00:00 GMT - Fri, 14 Feb 2025 23:59:59 GMT

File type
ASCII text, with very long lines (9434), with no line terminators
Size
8.6 kB (8616 bytes)
Hash
830b03b3d0077c17773edd463911e7bd
9e46f862e41c17fea39128f6f5e6dbbbb7685e85
39bb976c04851626cc4705acba828051af225dc8da625292dab7674bba995ba2

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - American Express

HTTP Headers

GET /css/main.css HTTP/1.1
Host: themes-app.netlify.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
age: 22286
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-encoding: br
content-type: text/css; charset=UTF-8
date: Tue, 16 Apr 2024 16:25:46 GMT
etag: "ed0bb3e510be713fd48a9fc2f63bbd88-ssl-df"
server: Netlify
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-nf-request-id: 01HVKVN3HC6JY8KM9BMKY6XA2Y
content-length: 1619
X-Firefox-Spdy: h2

dev-sqlmfia.pantheonsite.io/sqlammx/jquery.js

23.185.0.3

200 OK

291 kB

URL GET HTTP/2
dev-sqlmfia.pantheonsite.io/sqlammx/jquery.js
IP
23.185.0.3:443
ASN
#54113 FASTLY

Requested by
https://pub-0eca4850ae2949d1b3a76e3e171b7870.r2.dev/index.html
Certificate
IssuerLet's Encrypt
Subjectpantheonsite.io
Fingerprint23:29:40:F0:5B:2A:65:6E:BF:46:58:A1:10:8F:CF:AE:E4:77:7A:DA
ValidityWed, 24 Jan 2024 20:55:39 GMT - Tue, 23 Apr 2024 20:55:38 GMT

File type
JavaScript source, ASCII text, with CRLF line terminators
Size
291 kB (290960 bytes)
Hash
24fa855a7678b1938f16235881e3e80b
67b6c9946134456d67c07765d230130d8679f8c6
f2a84bc4f4cb8ae04162f42f1f3ebed1e05725d9b5bf666b885356c7698a071f

HTTP Headers

GET /sqlammx/jquery.js HTTP/1.1
Host: dev-sqlmfia.pantheonsite.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pub-0eca4850ae2949d1b3a76e3e171b7870.r2.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-encoding: gzip
content-type: application/x-javascript
etag: W/"65aade52-47090"
expires: Tue, 16 Apr 2024 16:25:44 GMT
last-modified: Fri, 19 Jan 2024 20:40:50 GMT
server: nginx
strict-transport-security: max-age=300
x-pantheon-styx-hostname: styx-fe3-a-5f9948b58b-krzgh
x-styx-req-id: fa4bf1d2-fc0d-11ee-ba0d-f2c141a5162e
cache-control: no-cache, must-revalidate
date: Tue, 16 Apr 2024 16:25:45 GMT
x-served-by: cache-chi-kigq8000044-CHI, cache-hel1410028-HEL
x-cache: MISS, MISS
x-cache-hits: 0, 0
x-timer: S1713284746.844774,VS0,VE150
vary: Accept-Encoding
x-robots-tag: noindex
age: 0
accept-ranges: bytes
via: 1.1 varnish, 1.1 varnish
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (5)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (21)

URL User Request GET HTTP/1.1

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers