Report - cafevillacastellane.ch/wp-includes/random_compat/au/mypost/pay/source/billing.php

Report Overview

Submitted URL
cafevillacastellane.ch/wp-includes/random_compat/au/mypost/pay/source/billing.php
IP
128.65.195.219
ASN
#29222 Infomaniak Network SA
Submitted
2024-04-25 00:46:32
Access
public
Website Title
Australia MyPost - Pay a bill
Final URL
cafevillacastellane.ch/wp-includes/random_compat/au/mypost/pay/source/billing.php
Tags
australia_post logistics phishing mypost
urlquery detections
Phishing - Australia Post
Phishing - MyPost

Detections

urlquery
32
Network Intrusion Detection
0
Threat Detection Systems
0

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
cafevillacastellane.ch	unknown	unknown	2021-03-18	2024-04-13	6.1 kB	74 kB	128.65.195.219

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (5)

	URL	Size	First Seen	Last Seen
	cafevillacastellane.ch/wp-includes/random_compat/au/mypost/pay/source/res/jq.js	90 kB	2023-03-07	2024-05-04
Pretty URL cafevillacastellane.ch/wp-includes/random_compat/au/mypost/pay/source/res/jq.js IP 128.65.195.219 ASN #29222 Infomaniak Network SA Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:21 Last Seen2024-05-04 01:37:15 Times Seen6046 Hash 3e4bb227fb55271bfe9c9d4a09147bd8 156837f75f6600ccb602b4efcbd393636c33f35e ee11e902416a1d896f538103110337b39a0e2e2606bc1faf5cd0652914891127 Loading...

	cafevillacastellane.ch/wp-includes/random_compat/au/mypost/pay/source/res/v.js	53 kB	2023-04-05	2024-05-02
Pretty URL cafevillacastellane.ch/wp-includes/random_compat/au/mypost/pay/source/res/v.js IP 128.65.195.219 ASN #29222 Infomaniak Network SA Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-05 05:27:20 Last Seen2024-05-02 17:28:15 Times Seen211 Hash e61cc7ee1b75fc0004a640ae8f46205e ff6f5215182351492a90776883cb62242186c9ae 10c034d8b06429ffa83d9f993d0bd21bade3eaff6d10b06f0934e582ede86317 Loading...

	cafevillacastellane.ch/wp-includes/random_compat/au/mypost/pay/source/res/m.js	23 kB	2023-03-07	2024-05-04
Pretty URL cafevillacastellane.ch/wp-includes/random_compat/au/mypost/pay/source/res/m.js IP 128.65.195.219 ASN #29222 Infomaniak Network SA Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:19:34 Last Seen2024-05-04 06:23:26 Times Seen2716 Hash 24992f1ed62baf9393609f3c6c2ad20e 34716cf70f7f7a9cd072e7796c34ce987f85d18c a199620fe981df00a825f78761d3f7c8870f8117daa4a890e08018dec386dae8 Loading...

	cafevillacastellane.ch/wp-includes/random_compat/au/mypost/pay/source/res/ccv.js	8.7 kB	2023-03-07	2024-04-25
Pretty URL cafevillacastellane.ch/wp-includes/random_compat/au/mypost/pay/source/res/ccv.js IP 128.65.195.219 ASN #29222 Infomaniak Network SA Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:23:53 Last Seen2024-04-25 19:22:21 Times Seen176 Hash 1019fb560a55d76e632cee5de5b655b5 e85c8b599c0fac90a074b28678cd885b4ca64a35 8338536908dbf97a2eeaf21a1390f707b867571d222dcf7be3d905e0a882b9aa Loading...

	cafevillacastellane.ch/wp-includes/random_compat/au/mypost/pay/source/billing.php	0 B	2023-03-07	2024-05-04
Pretty URL cafevillacastellane.ch/wp-includes/random_compat/au/mypost/pay/source/billing.php IP 128.65.195.219 ASN #29222 Infomaniak Network SA Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:01:59 Last Seen2024-05-04 08:44:20 Times Seen37330780 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

HTTP Transactions (11)

URL IP Response Size

cafevillacastellane.ch/wp-includes/random_compat/au/mypost/pay/source/res/style.css

128.65.195.219

200 OK

988 B

URL GET HTTP/2
cafevillacastellane.ch/wp-includes/random_compat/au/mypost/pay/source/res/style.css
IP
128.65.195.219:443
ASN
#29222 Infomaniak Network SA

Requested by
https://cafevillacastellane.ch/wp-includes/random_compat/au/mypost/pay/source/billing.php
Certificate
IssuerLet's Encrypt
Subjectcafevillacastellane.ch
Fingerprint0A:4B:0B:4D:38:D7:D5:66:8C:13:4A:F1:A8:AC:FB:6D:EA:06:6D:8E
ValidityFri, 08 Mar 2024 19:07:50 GMT - Thu, 06 Jun 2024 19:07:49 GMT

File type
ASCII text, with CRLF line terminators
Size
988 B (988 bytes)
Hash
a18719d24d5b7c8b2fdafe807fad0a60
48e76f51152249cf96704cdaa927475fe5e0aacf
a0937f7edd561e7ee7ad79de36261545786d292edffcb805f0998559be246bac

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Australia Post

HTTP Headers

GET /wp-includes/random_compat/au/mypost/pay/source/res/style.css HTTP/1.1
Host: cafevillacastellane.ch
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://cafevillacastellane.ch/wp-includes/random_compat/au/mypost/pay/source/billing.php
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Thu, 25 Apr 2024 00:46:07 GMT
server: Apache
strict-transport-security: max-age=16000000
last-modified: Fri, 05 Nov 2021 18:49:18 GMT
etag: "c53-5d00f19b60780-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-length: 988
content-type: text/css
X-Firefox-Spdy: h2

cafevillacastellane.ch/wp-includes/random_compat/au/mypost/pay/source/res/logo-mypost.png

128.65.195.219

200 OK

1.9 kB

URL GET HTTP/2
cafevillacastellane.ch/wp-includes/random_compat/au/mypost/pay/source/res/logo-mypost.png
IP
128.65.195.219:443
ASN
#29222 Infomaniak Network SA

Requested by
https://cafevillacastellane.ch/wp-includes/random_compat/au/mypost/pay/source/billing.php
Certificate
IssuerLet's Encrypt
Subjectcafevillacastellane.ch
Fingerprint0A:4B:0B:4D:38:D7:D5:66:8C:13:4A:F1:A8:AC:FB:6D:EA:06:6D:8E
ValidityFri, 08 Mar 2024 19:07:50 GMT - Thu, 06 Jun 2024 19:07:49 GMT

File type
PNG image data, 133 x 35, 8-bit/color RGBA, non-interlaced
Size
1.9 kB (1874 bytes)
Hash
4e24a0c8ae550705db9e2719270762ee
c92759e57c05b0781eeeb79204c482d58da19132
6695fc58bb36ed9c9ab9473d3c63bcec77dd35c73e3c04fe863c58c73333fd63

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Australia Post
urlquery	phishing	Phishing - MyPost

HTTP Headers

GET /wp-includes/random_compat/au/mypost/pay/source/res/logo-mypost.png HTTP/1.1
Host: cafevillacastellane.ch
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://cafevillacastellane.ch/wp-includes/random_compat/au/mypost/pay/source/billing.php
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Thu, 25 Apr 2024 00:46:07 GMT
server: Apache
strict-transport-security: max-age=16000000
last-modified: Sun, 31 Oct 2021 19:42:30 GMT
etag: "752-5cfab42c33580"
accept-ranges: bytes
content-length: 1874
content-type: image/png
X-Firefox-Spdy: h2

cafevillacastellane.ch/wp-includes/random_compat/au/mypost/pay/source/res/m.js

128.65.195.219

200 OK

5.9 kB

URL GET HTTP/2
cafevillacastellane.ch/wp-includes/random_compat/au/mypost/pay/source/res/m.js
IP
128.65.195.219:443
ASN
#29222 Infomaniak Network SA

Requested by
https://cafevillacastellane.ch/wp-includes/random_compat/au/mypost/pay/source/billing.php
Certificate
IssuerLet's Encrypt
Subjectcafevillacastellane.ch
Fingerprint0A:4B:0B:4D:38:D7:D5:66:8C:13:4A:F1:A8:AC:FB:6D:EA:06:6D:8E
ValidityFri, 08 Mar 2024 19:07:50 GMT - Thu, 06 Jun 2024 19:07:49 GMT

File type
JavaScript source, ASCII text
Size
5.9 kB (5877 bytes)
Hash
24992f1ed62baf9393609f3c6c2ad20e
34716cf70f7f7a9cd072e7796c34ce987f85d18c
a199620fe981df00a825f78761d3f7c8870f8117daa4a890e08018dec386dae8

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Australia Post

HTTP Headers

GET /wp-includes/random_compat/au/mypost/pay/source/res/m.js HTTP/1.1
Host: cafevillacastellane.ch
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://cafevillacastellane.ch/wp-includes/random_compat/au/mypost/pay/source/billing.php
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Thu, 25 Apr 2024 00:46:07 GMT
server: Apache
strict-transport-security: max-age=16000000
last-modified: Tue, 24 Mar 2020 10:30:46 GMT
etag: "5a88-5a1973e9a8180-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-length: 5877
content-type: application/javascript
X-Firefox-Spdy: h2

cafevillacastellane.ch/wp-includes/random_compat/au/mypost/pay/source/res/v.js

128.65.195.219

200 OK

14 kB

URL GET HTTP/2
cafevillacastellane.ch/wp-includes/random_compat/au/mypost/pay/source/res/v.js
IP
128.65.195.219:443
ASN
#29222 Infomaniak Network SA

Requested by
https://cafevillacastellane.ch/wp-includes/random_compat/au/mypost/pay/source/billing.php
Certificate
IssuerLet's Encrypt
Subjectcafevillacastellane.ch
Fingerprint0A:4B:0B:4D:38:D7:D5:66:8C:13:4A:F1:A8:AC:FB:6D:EA:06:6D:8E
ValidityFri, 08 Mar 2024 19:07:50 GMT - Thu, 06 Jun 2024 19:07:49 GMT

File type
JavaScript source, Unicode text, UTF-8 text, with very long lines (478), with CRLF line terminators
Size
14 kB (13778 bytes)
Hash
293343eb5fb614acf5c4a2990b743bdd
4e3d10deaa36637d625a192c926486f677345310
c5d85d054886c5b1438c896e06123d5d18a0f530f2da3c46271047b1b40cef00

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Australia Post

HTTP Headers

GET /wp-includes/random_compat/au/mypost/pay/source/res/v.js HTTP/1.1
Host: cafevillacastellane.ch
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://cafevillacastellane.ch/wp-includes/random_compat/au/mypost/pay/source/billing.php
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Thu, 25 Apr 2024 00:46:07 GMT
server: Apache
strict-transport-security: max-age=16000000
last-modified: Mon, 01 Nov 2021 02:24:40 GMT
etag: "cd77-5cfb0e105ca00-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-length: 13778
content-type: application/javascript
X-Firefox-Spdy: h2

cafevillacastellane.ch/wp-includes/random_compat/au/mypost/pay/source/billing.php

128.65.195.219

200 OK

5.4 kB

URL User Request GET HTTP/2
cafevillacastellane.ch/wp-includes/random_compat/au/mypost/pay/source/billing.php
IP
128.65.195.219:443
ASN
#29222 Infomaniak Network SA

Certificate
IssuerLet's Encrypt
Subjectcafevillacastellane.ch
Fingerprint0A:4B:0B:4D:38:D7:D5:66:8C:13:4A:F1:A8:AC:FB:6D:EA:06:6D:8E
ValidityFri, 08 Mar 2024 19:07:50 GMT - Thu, 06 Jun 2024 19:07:49 GMT

File type
gzip compressed data, from Unix
Size
5.4 kB (5368 bytes)
Hash
e95fda7e42b9d06223e60df8b38014f0
d08d8d6ead571bed8b69f53291d7b6cf6c07e934
9ba716c4b0e23bdfe0471ea849aeda1a7b9d38a4107ef84dea35aba402265564

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Australia Post

HTTP Headers

GET /wp-includes/random_compat/au/mypost/pay/source/billing.php HTTP/1.1
Host: cafevillacastellane.ch
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 25 Apr 2024 00:46:07 GMT
server: Apache
content-encoding: gzip
vary: Accept-Encoding
strict-transport-security: max-age=16000000
content-type: text/html; charset=UTF-8
X-Firefox-Spdy: h2

cafevillacastellane.ch/wp-includes/random_compat/au/mypost/pay/source/res/secure.png

128.65.195.219

200 OK

787 B

URL GET HTTP/2
cafevillacastellane.ch/wp-includes/random_compat/au/mypost/pay/source/res/secure.png
IP
128.65.195.219:443
ASN
#29222 Infomaniak Network SA

Requested by
https://cafevillacastellane.ch/wp-includes/random_compat/au/mypost/pay/source/billing.php
Certificate
IssuerLet's Encrypt
Subjectcafevillacastellane.ch
Fingerprint0A:4B:0B:4D:38:D7:D5:66:8C:13:4A:F1:A8:AC:FB:6D:EA:06:6D:8E
ValidityFri, 08 Mar 2024 19:07:50 GMT - Thu, 06 Jun 2024 19:07:49 GMT

File type
PNG image data, 111 x 26, 8-bit colormap, non-interlaced
Size
787 B (787 bytes)
Hash
b6904dc24bf7ea5d598da01b4595d687
001b97c8bf80c1cca666acbf5ab3aa63887133e1
e5372df7729b1978e1d9c9e161622ae83654a97bb072ccb1c8d96aafdbf1135f

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Australia Post
urlquery	phishing	Phishing - MyPost

HTTP Headers

GET /wp-includes/random_compat/au/mypost/pay/source/res/secure.png HTTP/1.1
Host: cafevillacastellane.ch
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://cafevillacastellane.ch/wp-includes/random_compat/au/mypost/pay/source/billing.php
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Thu, 25 Apr 2024 00:46:07 GMT
server: Apache
strict-transport-security: max-age=16000000
last-modified: Sun, 31 Oct 2021 18:42:02 GMT
etag: "313-5cfaa6a845280"
accept-ranges: bytes
content-length: 787
content-type: image/png
X-Firefox-Spdy: h2

cafevillacastellane.ch/wp-includes/random_compat/au/mypost/pay/source/res/ccv.js

128.65.195.219

200 OK

2.6 kB

URL GET HTTP/2
cafevillacastellane.ch/wp-includes/random_compat/au/mypost/pay/source/res/ccv.js
IP
128.65.195.219:443
ASN
#29222 Infomaniak Network SA

Requested by
https://cafevillacastellane.ch/wp-includes/random_compat/au/mypost/pay/source/billing.php
Certificate
IssuerLet's Encrypt
Subjectcafevillacastellane.ch
Fingerprint0A:4B:0B:4D:38:D7:D5:66:8C:13:4A:F1:A8:AC:FB:6D:EA:06:6D:8E
ValidityFri, 08 Mar 2024 19:07:50 GMT - Thu, 06 Jun 2024 19:07:49 GMT

File type
JavaScript source, ASCII text
Size
2.6 kB (2647 bytes)
Hash
1019fb560a55d76e632cee5de5b655b5
e85c8b599c0fac90a074b28678cd885b4ca64a35
8338536908dbf97a2eeaf21a1390f707b867571d222dcf7be3d905e0a882b9aa

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Australia Post

HTTP Headers

GET /wp-includes/random_compat/au/mypost/pay/source/res/ccv.js HTTP/1.1
Host: cafevillacastellane.ch
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://cafevillacastellane.ch/wp-includes/random_compat/au/mypost/pay/source/billing.php
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Thu, 25 Apr 2024 00:46:07 GMT
server: Apache
strict-transport-security: max-age=16000000
last-modified: Fri, 05 Nov 2021 12:51:20 GMT
etag: "2205-5d00a1985c200-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-length: 2647
content-type: application/javascript
X-Firefox-Spdy: h2

cafevillacastellane.ch/wp-includes/random_compat/au/mypost/pay/source/res/jq.js

128.65.195.219

200 OK

31 kB

URL GET HTTP/2
cafevillacastellane.ch/wp-includes/random_compat/au/mypost/pay/source/res/jq.js
IP
128.65.195.219:443
ASN
#29222 Infomaniak Network SA

Requested by
https://cafevillacastellane.ch/wp-includes/random_compat/au/mypost/pay/source/billing.php
Certificate
IssuerLet's Encrypt
Subjectcafevillacastellane.ch
Fingerprint0A:4B:0B:4D:38:D7:D5:66:8C:13:4A:F1:A8:AC:FB:6D:EA:06:6D:8E
ValidityFri, 08 Mar 2024 19:07:50 GMT - Thu, 06 Jun 2024 19:07:49 GMT

File type
JavaScript source, ASCII text, with very long lines (65446), with CRLF line terminators
Size
31 kB (30905 bytes)
Hash
3e4bb227fb55271bfe9c9d4a09147bd8
156837f75f6600ccb602b4efcbd393636c33f35e
ee11e902416a1d896f538103110337b39a0e2e2606bc1faf5cd0652914891127

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Australia Post

HTTP Headers

GET /wp-includes/random_compat/au/mypost/pay/source/res/jq.js HTTP/1.1
Host: cafevillacastellane.ch
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://cafevillacastellane.ch/wp-includes/random_compat/au/mypost/pay/source/billing.php
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Thu, 25 Apr 2024 00:46:07 GMT
server: Apache
strict-transport-security: max-age=16000000
last-modified: Wed, 27 Oct 2021 14:17:54 GMT
etag: "15d9d-5cf5642898880-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-length: 30905
content-type: application/javascript
X-Firefox-Spdy: h2

cafevillacastellane.ch/favicon.ico

128.65.195.219

302 Found

2.0 kB

URL GET HTTP/2
cafevillacastellane.ch/favicon.ico
IP
128.65.195.219:443
ASN
#29222 Infomaniak Network SA

Requested by
https://cafevillacastellane.ch/wp-includes/random_compat/au/mypost/pay/source/billing.php
Certificate
IssuerLet's Encrypt
Subjectcafevillacastellane.ch
Fingerprint0A:4B:0B:4D:38:D7:D5:66:8C:13:4A:F1:A8:AC:FB:6D:EA:06:6D:8E
ValidityFri, 08 Mar 2024 19:07:50 GMT - Thu, 06 Jun 2024 19:07:49 GMT

File type
gzip compressed data, from Unix
Size
2.0 kB (2026 bytes)
Hash
7b07ab66f50dba9e8b516e92222eef79
d1dc4e299d7c5a166473e46c516aa8159dfd05ed
fc65e540214befd19f77e351d0fdd7e93d2c4e22ea2df20009b8b81e7a334f8b

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Australia Post

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: cafevillacastellane.ch
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://cafevillacastellane.ch/wp-includes/random_compat/au/mypost/pay/source/billing.php
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 302 Found
date: Thu, 25 Apr 2024 00:46:08 GMT
server: Apache
cache-control: no-cache
set-cookie: rjpsPvVf=LroCPbDtp; expires=Fri, 26-Apr-2024 00:46:08 GMT; Max-Age=86400; path=/; secure
FXtaHPIS=yBxHgU.r%5BC; expires=Fri, 26-Apr-2024 00:46:08 GMT; Max-Age=86400; path=/; secure
hHtOBkIzgqSMwcAy=Wh%5BBitAKF%5DP1_fV; expires=Fri, 26-Apr-2024 00:46:08 GMT; Max-Age=86400; path=/; secure
cMbYOXmtsNkuVC=oL9YiZfO; expires=Fri, 26-Apr-2024 00:46:08 GMT; Max-Age=86400; path=/; secure
link: <https://cafevillacastellane.ch/wp-json/>; rel="https://api.w.org/"
x-redirect-by: WordPress
content-encoding: gzip
vary: Accept-Encoding
strict-transport-security: max-age=16000000
location: https://cafevillacastellane.ch/wp-content/uploads/2020/10/cropped-logo-cafevillacastellane1-32x32.png
content-type: text/html; charset=UTF-8
X-Firefox-Spdy: h2

cafevillacastellane.ch/wp-content/uploads/2020/10/cropped-logo-cafevillacastellane1-32x32.png

128.65.195.219

200 OK

2.0 kB

URL GET HTTP/2
cafevillacastellane.ch/wp-content/uploads/2020/10/cropped-logo-cafevillacastellane1-32x32.png
IP
128.65.195.219:443
ASN
#29222 Infomaniak Network SA

Requested by
https://cafevillacastellane.ch/wp-includes/random_compat/au/mypost/pay/source/billing.php
Certificate
IssuerLet's Encrypt
Subjectcafevillacastellane.ch
Fingerprint0A:4B:0B:4D:38:D7:D5:66:8C:13:4A:F1:A8:AC:FB:6D:EA:06:6D:8E
ValidityFri, 08 Mar 2024 19:07:50 GMT - Thu, 06 Jun 2024 19:07:49 GMT

File type
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Size
2.0 kB (2006 bytes)
Hash
9b4a551f561e2096be16c2c44796225a
135e0ce6d64625f398136e9316e3366a0028e45f
f120072440c7feb16e125f9eb2b7a3a7c593b55853b515309e685e5a20a88c9a

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Australia Post

HTTP Headers

GET /wp-content/uploads/2020/10/cropped-logo-cafevillacastellane1-32x32.png HTTP/1.1
Host: cafevillacastellane.ch
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://cafevillacastellane.ch/wp-includes/random_compat/au/mypost/pay/source/billing.php
DNT: 1
Connection: keep-alive
Cookie: rjpsPvVf=LroCPbDtp; FXtaHPIS=yBxHgU.r%5BC; hHtOBkIzgqSMwcAy=Wh%5BBitAKF%5DP1_fV; cMbYOXmtsNkuVC=oL9YiZfO
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 25 Apr 2024 00:46:09 GMT
server: Apache
strict-transport-security: max-age=16000000
last-modified: Thu, 01 Oct 2020 02:11:11 GMT
etag: "7d6-5b09287add797"
accept-ranges: bytes
content-length: 2006
content-type: image/png
X-Firefox-Spdy: h2

cafevillacastellane.ch/wp-includes/random_compat/au/mypost/pay/source/res/post-billpay.png

128.65.195.219

200 OK

3.4 kB

URL GET HTTP/2
cafevillacastellane.ch/wp-includes/random_compat/au/mypost/pay/source/res/post-billpay.png
IP
128.65.195.219:443
ASN
#29222 Infomaniak Network SA

Requested by
https://cafevillacastellane.ch/wp-includes/random_compat/au/mypost/pay/source/billing.php
Certificate
IssuerLet's Encrypt
Subjectcafevillacastellane.ch
Fingerprint0A:4B:0B:4D:38:D7:D5:66:8C:13:4A:F1:A8:AC:FB:6D:EA:06:6D:8E
ValidityFri, 08 Mar 2024 19:07:50 GMT - Thu, 06 Jun 2024 19:07:49 GMT

File type
PNG image data, 130 x 50, 8-bit/color RGB, non-interlaced
Size
3.4 kB (3362 bytes)
Hash
af28b57436cbeff95a4dff34d293e8f8
61d4fd69233ac71693636af59f1199cc888e6bab
8d2d6405a951b0dcaeec9566b06813cb2be533064dbe6524ea42dcf48910596b

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Australia Post
urlquery	phishing	Phishing - MyPost

HTTP Headers

GET /wp-includes/random_compat/au/mypost/pay/source/res/post-billpay.png HTTP/1.1
Host: cafevillacastellane.ch
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://cafevillacastellane.ch/wp-includes/random_compat/au/mypost/pay/source/billing.php
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 25 Apr 2024 00:46:07 GMT
server: Apache
strict-transport-security: max-age=16000000
last-modified: Sun, 31 Oct 2021 18:41:18 GMT
etag: "d22-5cfaa67e4ef80"
accept-ranges: bytes
content-length: 3362
content-type: image/png
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (5)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (11)

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash