Report - atlasbasincli.com/panel/kcfinder/upload/files/25463922288.pdf

Report Overview

Submitted URL
atlasbasincli.com/panel/kcfinder/upload/files/25463922288.pdf
IP
89.252.178.177
ASN
#42846 GNET Internet Telekomunikasyon A.S.
Submitted
2024-04-27 05:21:55
Access
public
Website Title
1 - 2 | American Express
Final URL
atlasbasincli.com/panel/kcfinder/upload/files/25463922288.pdf
Tags
phishing
urlquery detections
Phishing - Generic phishing

Detections

urlquery
2
Network Intrusion Detection
0
Threat Detection Systems
2

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
rawcdn.githack.com	72170	2013-10-12	2016-07-04	2024-04-26	1.4 kB	425 kB	104.21.234.230
www.aexp-static.com	12486	2010-10-07	2012-05-24	2024-04-23	1.6 kB	111 kB	104.110.3.84
www.americanexpress.com	13613	1995-06-04	2013-04-24	2024-04-25	432 B	1.9 kB	104.110.22.253
cdaas.americanexpress.com	36912	1995-06-04	2017-10-27	2024-04-25	483 B	11 kB	139.71.113.91
atlasbasincli.com	unknown	2010-01-14	2017-09-12	2024-02-23	517 B	27 kB	89.252.178.177
ajax.googleapis.com	12905	2005-01-25	2013-08-16	2024-04-26	432 B	31 kB	142.250.74.170

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2024-04-26	medium	atlasbasincli.com/panel/kcfinder/upload/files/25463922288.pdf	American Express

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (4)

	URL	Size	First Seen	Last Seen
	ajax.googleapis.com/ajax/libs/jquery/3.7.1/jquery.min.js	88 kB	2023-08-31	2024-05-08
Pretty URL ajax.googleapis.com/ajax/libs/jquery/3.7.1/jquery.min.js IP 142.250.74.170 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2023-08-31 16:03:19 Last Seen2024-05-08 22:28:29 Times Seen8995 Hash 2c872dbe60f4ba70fb85356113d8b35e ee48592d1fff952fcf06ce0b666ed4785493afdc fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a Loading...

	unknown	585 B	2024-04-23	2024-05-03
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-23 05:57:36 Last Seen2024-05-03 20:18:57 Times Seen4 Hash 75b783d1779d25a017e0c4f2e4699c57 8fbccc34a779417655d857d2997c803fdc479ad8 80f40e834ed5aaae381e6380d1ae8d58f465e5da10f9820b2bc8c2fa370fe236 Loading...

	atlasbasincli.com/panel/kcfinder/upload/files/25463922288.pdf	27 kB	2024-04-27	2024-04-27
Pretty URL atlasbasincli.com/panel/kcfinder/upload/files/25463922288.pdf IP 89.252.178.177 ASN #42846 GNET Internet Telekomunikasyon A.S. Introduced by scriptElement Embedded in HTML true Observations First Seen2024-04-27 07:21:56 Last Seen2024-04-27 07:21:56 Times Seen1 Hash 520d55b8c3b9188be289d159e6d19e0a f0981cdb9d1a4ef8cc759828974cc6e47e246532 636da35f49400099464443254bcd046193879c2676ae40b163a4a81a8c8d93dd Loading...

		Size	First Seen	Last Seen
	#1 Write - 4683ad769a2fd226175d880acac10b36	8.8 kB	2024-04-27	2024-05-03
Pretty Observations First Seen2024-04-27 07:21:56 Last Seen2024-05-03 20:18:57 Times Seen3 Hash 4683ad769a2fd226175d880acac10b36 79934aadd5aad576a4a90ef3b3d6e9a8a813251a 4c8d4edc788c3b7010b0d74b71caeb069ff98afdd7755f0fedb985ec5a1cfc56 Loading...

HTTP Transactions (10)

URL IP Response Size

ajax.googleapis.com/ajax/libs/jquery/3.7.1/jquery.min.js

142.250.74.170

200 OK

30 kB

URL GET HTTP/2
ajax.googleapis.com/ajax/libs/jquery/3.7.1/jquery.min.js
IP
142.250.74.170:443
ASN
#15169 GOOGLE

Requested by
https://atlasbasincli.com/panel/kcfinder/upload/files/25463922288.pdf
Certificate
IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
Fingerprint5F:6D:48:87:16:89:1E:A5:57:29:92:8B:34:BD:F2:92:0C:7F:F2:50
ValidityMon, 08 Apr 2024 07:32:03 GMT - Mon, 01 Jul 2024 07:32:02 GMT

File type
JavaScript source, ASCII text, with very long lines (65447)
Size
30 kB (30462 bytes)
Hash
2c872dbe60f4ba70fb85356113d8b35e
ee48592d1fff952fcf06ce0b666ed4785493afdc
fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a

HTTP Headers

GET /ajax/libs/jquery/3.7.1/jquery.min.js HTTP/1.1
Host: ajax.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://atlasbasincli.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
timing-allow-origin: *
content-length: 30462
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 26 Apr 2024 05:54:40 GMT
expires: Sat, 26 Apr 2025 05:54:40 GMT
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
last-modified: Tue, 12 Sep 2023 02:38:22 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
age: 84411
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

rawcdn.githack.com/tokenaxp/min/419ad35709f1ea82983b9460c208f1d99fa1f4d5/oce-fonts.css

104.21.234.230

200 OK

24 kB

URL GET HTTP/2
rawcdn.githack.com/tokenaxp/min/419ad35709f1ea82983b9460c208f1d99fa1f4d5/oce-fonts.css
IP
104.21.234.230:443
ASN
#13335 CLOUDFLARENET

Requested by
https://atlasbasincli.com/panel/kcfinder/upload/files/25463922288.pdf
Certificate
IssuerGoogle Trust Services LLC
Subjectgithack.com
FingerprintA4:13:2F:80:0A:C6:7C:8B:08:12:12:22:60:76:15:7D:40:80:70:54
ValidityFri, 01 Mar 2024 13:12:36 GMT - Thu, 30 May 2024 13:12:35 GMT

File type
Unicode text, UTF-8 text
Size
24 kB (23922 bytes)
Hash
283134482ff97a9bcc578ddea7273c69
534a3af11cef617ee68ffe21e7e1865e9b519956
18f3644f71d444e98a23bcccbd33e41a5dd356642e195559227879f10a182b19

HTTP Headers

GET /tokenaxp/min/419ad35709f1ea82983b9460c208f1d99fa1f4d5/oce-fonts.css HTTP/1.1
Host: rawcdn.githack.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://atlasbasincli.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sat, 27 Apr 2024 05:21:31 GMT
content-type: text/css; charset=utf-8
etag: W/"c408e28284057fe7f3c7b84b6e9edcbc528d33d19d43196d8f74f1e25da59d31"
x-content-type-options: nosniff
x-github-request-id: 1CAA:2ABA5C:3B43737:3DE5D92:65DB54B3
via: 1.1 varnish
x-served-by: cache-hel1410027-HEL
x-cache: MISS
x-cache-hits: 0
x-timer: S1708872884.832085,VS0,VE190
vary: Authorization,Accept-Encoding,Origin
cross-origin-resource-policy: cross-origin
x-fastly-request-id: d5f609f8bb44c2c886f87253c9d4c82ade539585
source-age: 0
expires: Mon, 24 Feb 2025 14:54:44 GMT
cache-control: max-age=31536000, public, immutable
x-robots-tag: none
access-control-allow-origin: *
x-githack-cache-status: MISS
cf-cache-status: HIT
age: 47336
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WmCx4myl40jijeMD5Y5jy05ag1UewyaqL%2FyY4URUUzrg5QlEVVVKz2YouMU8VqqDO5BX0PzSSBwyFnsCPknI7cVAIPuxJ9UmzX0JOXIijWeMDd66%2BpYcrDmdWRhYlnigLakzskA%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87ac5e993f6448c3-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

www.aexp-static.com/nav/ngn/fonts/0fababca-4914-46dd-9b0f-efbd51f67ae8-3.woff

104.110.3.84

200 OK

38 kB

URL GET HTTP/2
www.aexp-static.com/nav/ngn/fonts/0fababca-4914-46dd-9b0f-efbd51f67ae8-3.woff
IP
104.110.3.84:443
ASN
#16625 AKAMAI-AS

Requested by
https://atlasbasincli.com/panel/kcfinder/upload/files/25463922288.pdf
Certificate
IssuerDigiCert Inc
Subjectm.americanexpress.com
Fingerprint3D:49:C1:10:15:C4:62:62:B3:CD:E6:43:D8:FF:DE:DD:A4:9F:03:26
ValidityWed, 06 Mar 2024 00:00:00 GMT - Thu, 06 Mar 2025 23:59:59 GMT

File type
Web Open Font Format, TrueType, length 37949, version 1.0
Size
38 kB (37949 bytes)
Hash
5ad4796fabf0460a3f3dfeca32c0d7d0
2baa8fb40b9970b2c5fd18dd0f0d4e10b532d1a3
568d1bad8ef5d3ee9e14e5bdc304985d4d9a8d791bfe4fdb689fc2bef638466c

HTTP Headers

GET /nav/ngn/fonts/0fababca-4914-46dd-9b0f-efbd51f67ae8-3.woff HTTP/1.1
Host: www.aexp-static.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://atlasbasincli.com
DNT: 1
Connection: keep-alive
Referer: https://rawcdn.githack.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: font/woff
content-length: 37949
last-modified: Wed, 15 Aug 2018 20:46:09 GMT
etag: "5b749111-943d"
expires: Fri, 27 Nov 2020 03:31:12 GMT
access-control-allow-origin: *
timing-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
accept-ranges: bytes
date: Sat, 27 Apr 2024 05:21:31 GMT
X-Firefox-Spdy: h2

www.aexp-static.com/nav/ngn/fonts/3be50273-0b2e-4aef-ae68-882eacd611f9-3.woff

104.110.3.84

200 OK

37 kB

URL GET HTTP/2
www.aexp-static.com/nav/ngn/fonts/3be50273-0b2e-4aef-ae68-882eacd611f9-3.woff
IP
104.110.3.84:443
ASN
#16625 AKAMAI-AS

Requested by
https://atlasbasincli.com/panel/kcfinder/upload/files/25463922288.pdf
Certificate
IssuerDigiCert Inc
Subjectm.americanexpress.com
Fingerprint3D:49:C1:10:15:C4:62:62:B3:CD:E6:43:D8:FF:DE:DD:A4:9F:03:26
ValidityWed, 06 Mar 2024 00:00:00 GMT - Thu, 06 Mar 2025 23:59:59 GMT

File type
Web Open Font Format, TrueType, length 37153, version 1.0
Size
37 kB (37153 bytes)
Hash
c0e3b5653c803f69c05862736a765e4a
4ae2328614d48c62388c8409cbd1d9e7b5d4dfda
48050d8eeb740bb31aaad9eb82bcd4a493b474c9385eeda5fc2ca2ea279cffad

HTTP Headers

GET /nav/ngn/fonts/3be50273-0b2e-4aef-ae68-882eacd611f9-3.woff HTTP/1.1
Host: www.aexp-static.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://atlasbasincli.com
DNT: 1
Connection: keep-alive
Referer: https://rawcdn.githack.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: font/woff
content-length: 37153
last-modified: Wed, 15 Aug 2018 20:46:09 GMT
etag: "5b749111-9121"
expires: Mon, 25 Jan 2021 11:07:20 GMT
cache-control: max-age=15552000
access-control-allow-origin: *
timing-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
accept-ranges: bytes
date: Sat, 27 Apr 2024 05:21:31 GMT
X-Firefox-Spdy: h2

www.aexp-static.com/cdaas/one/statics/axp-dls/5.10.1/package/dist/iconfont/dls-icons.woff?v=5.10.1

104.110.3.84

200 OK

35 kB

URL GET HTTP/2
www.aexp-static.com/cdaas/one/statics/axp-dls/5.10.1/package/dist/iconfont/dls-icons.woff?v=5.10.1
IP
104.110.3.84:443
ASN
#16625 AKAMAI-AS

Requested by
https://atlasbasincli.com/panel/kcfinder/upload/files/25463922288.pdf
Certificate
IssuerDigiCert Inc
Subjectm.americanexpress.com
Fingerprint3D:49:C1:10:15:C4:62:62:B3:CD:E6:43:D8:FF:DE:DD:A4:9F:03:26
ValidityWed, 06 Mar 2024 00:00:00 GMT - Thu, 06 Mar 2025 23:59:59 GMT

File type
Web Open Font Format, TrueType, length 34756, version 1.0
Size
35 kB (34756 bytes)
Hash
00e1ece1ed6008465632d7b9800e3f4c
75e8f21ce1cf3fe13515c602bdcd8679581b6229
3ab0045c7cec2bd10b33c094d7ff82145efe1e75345bc49166dc5236db831b08

HTTP Headers

GET /cdaas/one/statics/axp-dls/5.10.1/package/dist/iconfont/dls-icons.woff?v=5.10.1 HTTP/1.1
Host: www.aexp-static.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://atlasbasincli.com
DNT: 1
Connection: keep-alive
Referer: https://rawcdn.githack.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: font/woff
content-length: 34756
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
etag: "1dc09d84-87c4"
timing-allow-origin: *
cache-control: max-age=31536000, must-revalidate
access-control-allow-origin: *
access-control-allow-methods: GET
accept-ranges: bytes
date: Sat, 27 Apr 2024 05:21:31 GMT
vary: Origin, Accept-Encoding
X-Firefox-Spdy: h2

www.americanexpress.com/favicon.ico

104.110.22.253

1.4 kB

URL GET
www.americanexpress.com/favicon.ico
IP
104.110.22.253:0
ASN
#16625 AKAMAI-AS

Requested by
https://atlasbasincli.com/panel/kcfinder/upload/files/25463922288.pdf
Certificate
IssuerDigiCert Inc
Subjectwww.americanexpress.com
Fingerprint64:A2:B0:4D:11:47:D0:C0:37:73:B5:62:91:90:F7:0D:1F:42:FA:10
ValidityThu, 03 Aug 2023 00:00:00 GMT - Thu, 01 Aug 2024 23:59:59 GMT

File type
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Size
1.4 kB (1381 bytes)
Hash
974ccc6c4c6e1c7f04606973beb3ba20
0f96f86d488a4b5805744fa067c3cfd57c928406
265d3f591d92fadfe95f4660c382ee64a23538a7353b9880434205a102833de0

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: www.americanexpress.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://atlasbasincli.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
strict-transport-security: max-age=15552000;
last-modified: Fri, 07 Jun 2019 04:05:21 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 1381
x-cnection: close
content-type: image/x-icon
date: Sat, 27 Apr 2024 05:21:31 GMT
set-cookie: agent-id=3a20c622-d24e-4907-b6ad-0d5ce1f1e0e6; expires=Sun, 27-Apr-2025 05:21:31 GMT; path=/; domain=.americanexpress.com; secure; HttpOnly
x-frame-options: SAMEORIGIN
X-Firefox-Spdy: h2

cdaas.americanexpress.com/myca/oce/latest/content/images/common/amex-desktop-logo.png

139.71.113.91

200 OK

11 kB

URL GET HTTP/1.1
cdaas.americanexpress.com/myca/oce/latest/content/images/common/amex-desktop-logo.png
IP
139.71.113.91:443
ASN
#6307 AMERICAN-EXPRESS

Requested by
https://atlasbasincli.com/panel/kcfinder/upload/files/25463922288.pdf
Certificate
IssuerDigiCert Inc
Subjectcdaas.americanexpress.com
Fingerprint85:14:2D:76:FA:1D:AD:6F:B8:10:2B:70:65:AB:0B:16:81:50:E9:BF
ValidityWed, 11 Oct 2023 00:00:00 GMT - Wed, 09 Oct 2024 23:59:59 GMT

File type
PNG image data, 470 x 30, 8-bit/color RGBA, interlaced
Size
11 kB (11134 bytes)
Hash
b82e61a35dabd32331d831c9bc5ee82f
4e958b3164982e8ff92f76336f3549bd1e8908c2
610166ddd2d965283356d314f592522c1907a5334cec1daa0874fc61639a667c

HTTP Headers

GET /myca/oce/latest/content/images/common/amex-desktop-logo.png HTTP/1.1
Host: cdaas.americanexpress.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rawcdn.githack.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 27 Apr 2024 05:21:31 GMT
Content-Type: image/png
Content-Length: 11134
Last-Modified: Tue, 23 Apr 2024 18:22:52 GMT
Connection: keep-alive
ETag: "6627fc7c-2b7e"
Timing-Allow-Origin: *
Vary: Origin
Cache-Control: max-age=31536000, must-revalidate
Accept-Ranges: bytes

rawcdn.githack.com/tokenaxp/min/419ad35709f1ea82983b9460c208f1d99fa1f4d5/oce-font.css

104.21.234.230

200 OK

106 kB

URL GET HTTP/2
rawcdn.githack.com/tokenaxp/min/419ad35709f1ea82983b9460c208f1d99fa1f4d5/oce-font.css
IP
104.21.234.230:443
ASN
#13335 CLOUDFLARENET

Requested by
https://atlasbasincli.com/panel/kcfinder/upload/files/25463922288.pdf
Certificate
IssuerGoogle Trust Services LLC
Subjectgithack.com
FingerprintA4:13:2F:80:0A:C6:7C:8B:08:12:12:22:60:76:15:7D:40:80:70:54
ValidityFri, 01 Mar 2024 13:12:36 GMT - Thu, 30 May 2024 13:12:35 GMT

File type
ASCII text, with very long lines (57394)
Size
106 kB (106102 bytes)
Hash
b885858fefee25a02f288315d3824f61
e6c33910da9b1777ecd3f8b3f281f0c28e6602d8
bcf4b83f0c88cac6c69c6a37010429b5db8af648c0bb5a7ddaed4fc357e2e46d

HTTP Headers

GET /tokenaxp/min/419ad35709f1ea82983b9460c208f1d99fa1f4d5/oce-font.css HTTP/1.1
Host: rawcdn.githack.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://atlasbasincli.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sat, 27 Apr 2024 05:21:31 GMT
content-type: text/css; charset=utf-8
etag: W/"26f8b7f629b0547cd04bfb9027a9336ada7ef041ebdc3500b73a4178d52339f7"
x-content-type-options: nosniff
x-github-request-id: 72C6:2ABA5C:3B43737:3DE5D8E:65DB54B3
via: 1.1 varnish
x-served-by: cache-hel1410020-HEL
x-cache: MISS
x-cache-hits: 0
x-timer: S1708872884.810971,VS0,VE203
vary: Authorization,Accept-Encoding,Origin
cross-origin-resource-policy: cross-origin
x-fastly-request-id: e4c129a08b618f11a6417ef8afa497d4a6caba11
source-age: 0
expires: Mon, 24 Feb 2025 14:54:44 GMT
cache-control: max-age=31536000, public, immutable
x-robots-tag: none
access-control-allow-origin: *
x-githack-cache-status: MISS
cf-cache-status: HIT
age: 66366
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QkgNFBrA5x3Z8SnWeoLV5wG0x4wiRubAcumaKEwtJ%2BReyTAoEXL%2FCE214GtnQtXuHNT3pFDm%2BUM079l3%2BTCJE4Qf6NHMhjmxg%2Btf80Rmlr%2BizcJKeja%2BMQm6eMPg2G1%2F8z5jchk%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87ac5e993f6648c3-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

atlasbasincli.com/panel/kcfinder/upload/files/25463922288.pdf

89.252.178.177

200 OK

27 kB

URL User Request GET HTTP/2
atlasbasincli.com/panel/kcfinder/upload/files/25463922288.pdf
IP
89.252.178.177:443
ASN
#42846 GNET Internet Telekomunikasyon A.S.

Certificate
IssuerLet's Encrypt
Subjectatlasbasincli.com
FingerprintE8:F3:EA:4E:50:0A:43:CE:7B:BD:21:78:71:12:E1:BA:A8:20:87:BA
ValidityFri, 08 Mar 2024 01:49:15 GMT - Thu, 06 Jun 2024 01:49:14 GMT

File type
HTML document, ASCII text, with very long lines (26669), with no line terminators
Size
27 kB (26669 bytes)
Hash
ec4a1af7bce17e0ac5b29cd88c33bc5d
29f67c847d44fd6e6b072a5540cb2422884b6862
a472b08ffc8d77740dbe25ad2dcb9f5a7678fd708500ff0d60cb542910bf919c

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	American Express

HTTP Headers

GET /panel/kcfinder/upload/files/25463922288.pdf HTTP/1.1
Host: atlasbasincli.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Sat, 27 Apr 2024 05:21:30 GMT
content-type: text/html
x-powered-by: PHP/5.4.45, PleskLin
content-encoding: br
X-Firefox-Spdy: h2

rawcdn.githack.com/tokenaxp/min/419ad35709f1ea82983b9460c208f1d99fa1f4d5/oce-min.css

104.21.234.230

200 OK

292 kB

URL GET HTTP/2
rawcdn.githack.com/tokenaxp/min/419ad35709f1ea82983b9460c208f1d99fa1f4d5/oce-min.css
IP
104.21.234.230:443
ASN
#13335 CLOUDFLARENET

Requested by
https://atlasbasincli.com/panel/kcfinder/upload/files/25463922288.pdf
Certificate
IssuerGoogle Trust Services LLC
Subjectgithack.com
FingerprintA4:13:2F:80:0A:C6:7C:8B:08:12:12:22:60:76:15:7D:40:80:70:54
ValidityFri, 01 Mar 2024 13:12:36 GMT - Thu, 30 May 2024 13:12:35 GMT

File type
ASCII text, with very long lines (2662)
Size
292 kB (291660 bytes)
Hash
136419d426a9264d5c5865718b8d68fb
495f980bd3f648b41b9b0f2b401643a07d75f23d
22ac73d718eefac83c6f65ec81fb08c201cda95fa7bb753407059f48df09e147

HTTP Headers

GET /tokenaxp/min/419ad35709f1ea82983b9460c208f1d99fa1f4d5/oce-min.css HTTP/1.1
Host: rawcdn.githack.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://atlasbasincli.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sat, 27 Apr 2024 05:21:31 GMT
content-type: text/css; charset=utf-8
etag: W/"58070408e19e0d997d1cd2ac1dd1e10e18e3f485a00e53d104893719c98df2e0"
x-github-request-id: 9A5E:0E70:15E167E:16F9476:6600810E
via: 1.1 varnish
x-served-by: cache-hel1410028-HEL
x-cache: MISS
x-cache-hits: 0
x-timer: S1711309070.450354,VS0,VE213
vary: Authorization,Accept-Encoding,Origin
cross-origin-resource-policy: cross-origin
x-fastly-request-id: 75308388e85a874efb8bec222f06f3f1591a1d00
source-age: 0
cache-control: max-age=31536000, public, immutable
x-robots-tag: none
access-control-allow-origin: *
x-githack-cache-status: MISS
cf-cache-status: HIT
age: 461753
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1xcBRugA89LyBh5%2FUkECBiqOZDwUvll7HrkOJblBmPSvXafUTxTWV46lJxC3b%2Frdg3iLYw%2FIU2ImFjgswxwj6MXg%2FZY%2FQLIaAiQ9n7DZHaj8Z%2F7ZGLmhHVanZbkd5oZy4VX3MyQ%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87ac5e992f6248c3-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (4)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Observations

Hash

HTTP Transactions (10)

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type