Report - customerstatements.wildoakclothings.com.au/statsmywao.docx

Report Overview

Submitted URL
customerstatements.wildoakclothings.com.au/statsmywao.docx
IP
192.250.232.15
ASN
#216180 WHG Hosting Services Ltd
Submitted
2024-04-25 05:34:59
Access
public
Website Title
https://office.com/launch/word
Final URL
customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/?statsmywao.docx
Tags
dyndns
urlquery detections
Suspicious - DynDNS domain

Detections

urlquery
15
Network Intrusion Detection
0
Threat Detection Systems
0

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
customerstatements.wildoakclothings.com.au	unknown	unknown	2024-04-17	2024-04-17	512 B	1.2 kB	192.250.232.15
customerstatementsrecords.faqserv.com	unknown	2001-04-02	2024-04-17	2024-04-17	8.1 kB	181 kB	192.250.232.15

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (4)

	URL	Size	First Seen	Last Seen
	customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/index_home/index_home/webkit.js	640 B	2024-04-22	2024-04-26
Pretty URL customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/index_home/index_home/webkit.js IP 192.250.232.15 ASN #216180 WHG Hosting Services Ltd Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-22 01:04:44 Last Seen2024-04-26 08:25:02 Times Seen14 Hash 17565fcdbcac67ad3c5212069f8bbc31 160142373489b5a618fb6191d6b89e4418d5e7b6 743f04ba1a2804495cf54f97df1a470a74b4235bc496f9c00fcf80f366a0ea9a Loading...

	customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/index_home/index_home/jquery.min.js	90 kB	2023-03-07	2024-05-04
Pretty URL customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/index_home/index_home/jquery.min.js IP 192.250.232.15 ASN #216180 WHG Hosting Services Ltd Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:27 Last Seen2024-05-04 18:31:26 Times Seen4896 Hash 12b69d0ae6c6f0c42942ae6da2896e84 d2cc8d43ce1c854b1172e42b1209502ad563db83 6150a35c0f486c46cadf0e230e2aa159c7c23ecfbb5611b64ee3f25fcbff341f Loading...

	customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/index_home/index_home/bootstrap.min.js	60 kB	2023-03-07	2024-05-03
Pretty URL customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/index_home/index_home/bootstrap.min.js IP 192.250.232.15 ASN #216180 WHG Hosting Services Ltd Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:07:32 Last Seen2024-05-03 16:41:47 Times Seen6393 Hash 6bea60c34c5db6797150610dacdc6bce 544afefd148715da7dd52d368a414703390ca0e0 38544024da1a0fc2f706be6582557b5722d17f48ad9a8073594a0cf928e2e3ff Loading...

	customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/index_home/index_home/bootstrap.js	3.9 kB	2024-04-22	2024-04-26
Pretty URL customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/index_home/index_home/bootstrap.js IP 192.250.232.15 ASN #216180 WHG Hosting Services Ltd Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-22 01:04:44 Last Seen2024-04-26 08:25:02 Times Seen14 Hash bba1b6ea907889270e7cf358d491867d 1e79ef3d5f5c18bb0474bbff7ea1719d9c6a8d88 2b42d3d42c11a502fbfdcd9f8e2d4f9ac55fe8c30d4a748f0342811694806564 Loading...

HTTP Transactions (15)

URL IP Response Size

customerstatements.wildoakclothings.com.au/statsmywao.docx

192.250.232.15

302 Found

683 B

URL User Request GET HTTP/2
customerstatements.wildoakclothings.com.au/statsmywao.docx
IP
192.250.232.15:443
ASN
#216180 WHG Hosting Services Ltd

Certificate
IssuerLet's Encrypt
Subjectwww.customerstatementsrecords.faqserv.com
Fingerprint71:DF:04:8A:B1:4F:D9:1B:E6:5D:8D:A3:B1:9B:FE:86:4B:FF:64:57
ValidityWed, 17 Apr 2024 20:38:12 GMT - Tue, 16 Jul 2024 20:38:11 GMT

File type
HTML document, ASCII text, with CRLF, LF line terminators
Size
683 B (683 bytes)
Hash
6371befc85069a96b0cb3c52e754a55a
de3def799f60ce2a16721687937ffb2a3f9bd3ae
db6f3663ecb5b124f3c02ce15691739fe69888b7ed6112f03062489470517f77

HTTP Headers

GET /statsmywao.docx HTTP/1.1
Host: customerstatements.wildoakclothings.com.au
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
content-type: text/html
content-length: 683
date: Thu, 25 Apr 2024 05:34:34 GMT
server: LiteSpeed
cache-control: no-cache, no-store, must-revalidate, max-age=0
location: https://customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/?statsmywao.docx
vary: User-Agent
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
X-Firefox-Spdy: h2

customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/?statsmywao.docx

192.250.232.15

200 OK

1.4 kB

URL User Request GET HTTP/2
customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/?statsmywao.docx
IP
192.250.232.15:443
ASN
#216180 WHG Hosting Services Ltd

Certificate
IssuerLet's Encrypt
Subjectwww.customerstatementsrecords.faqserv.com
Fingerprint71:DF:04:8A:B1:4F:D9:1B:E6:5D:8D:A3:B1:9B:FE:86:4B:FF:64:57
ValidityWed, 17 Apr 2024 20:38:12 GMT - Tue, 16 Jul 2024 20:38:11 GMT

File type
HTML document, ASCII text, with very long lines (459), with CRLF line terminators
Size
1.4 kB (1388 bytes)
Hash
348022cb2d5d174930b81d7977f31f1e
ef417766ca3ffac0ca525481c2fd1331f0f618c0
362f7c0ec30e141ab4d067ebb4e9a07ae9b7afc80bec4739c46cc4b978df4db0

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain

HTTP Headers

GET /invoicecustomer/invoicecustomer_id/?statsmywao.docx HTTP/1.1
Host: customerstatementsrecords.faqserv.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: text/html
last-modified: Thu, 18 Apr 2024 17:53:06 GMT
accept-ranges: bytes
content-encoding: br
vary: Accept-Encoding,User-Agent
content-length: 1388
date: Thu, 25 Apr 2024 05:34:35 GMT
server: LiteSpeed
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
X-Firefox-Spdy: h2

customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/index_home/index_home/all.css

192.250.232.15

200 OK

12 kB

URL GET HTTP/2
customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/index_home/index_home/all.css
IP
192.250.232.15:443
ASN
#216180 WHG Hosting Services Ltd

Requested by
https://customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/?statsmywao.docx
Certificate
IssuerLet's Encrypt
Subjectwww.customerstatementsrecords.faqserv.com
Fingerprint71:DF:04:8A:B1:4F:D9:1B:E6:5D:8D:A3:B1:9B:FE:86:4B:FF:64:57
ValidityWed, 17 Apr 2024 20:38:12 GMT - Tue, 16 Jul 2024 20:38:11 GMT

File type
ASCII text, with very long lines (54998)
Size
12 kB (11602 bytes)
Hash
77cbad34e5ce95e70847b074e05faeab
50ccfd672cc8d4d4cff476204509c2fd51907ffa
06d6e10886ed7de5561acab1935bce1c46174baa9cbd0bcb319aa3b69594131f

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain

HTTP Headers

GET /invoicecustomer/invoicecustomer_id/index_home/index_home/all.css HTTP/1.1
Host: customerstatementsrecords.faqserv.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/?statsmywao.docx
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
cache-control: public, max-age=604800
expires: Thu, 02 May 2024 05:34:35 GMT
content-type: text/css
last-modified: Mon, 01 Apr 2024 12:54:13 GMT
accept-ranges: bytes
content-encoding: br
vary: Accept-Encoding,User-Agent
content-length: 11602
date: Thu, 25 Apr 2024 05:34:35 GMT
server: LiteSpeed
X-Firefox-Spdy: h2

customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/index_home/index_home/bootstrap.min.css

192.250.232.15

200 OK

22 kB

URL GET HTTP/2
customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/index_home/index_home/bootstrap.min.css
IP
192.250.232.15:443
ASN
#216180 WHG Hosting Services Ltd

Requested by
https://customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/?statsmywao.docx
Certificate
IssuerLet's Encrypt
Subjectwww.customerstatementsrecords.faqserv.com
Fingerprint71:DF:04:8A:B1:4F:D9:1B:E6:5D:8D:A3:B1:9B:FE:86:4B:FF:64:57
ValidityWed, 17 Apr 2024 20:38:12 GMT - Tue, 16 Jul 2024 20:38:11 GMT

File type
ASCII text, with very long lines (65324)
Size
22 kB (21469 bytes)
Hash
3afe15e976734d9daac26310110c4594
4f14a09a606c99a11f8fda15564ef66f70402826
680af6669abc319f9803f0fa26d443df1b6bc29133d88a8e4bea560ffed7288c

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain

HTTP Headers

GET /invoicecustomer/invoicecustomer_id/index_home/index_home/bootstrap.min.css HTTP/1.1
Host: customerstatementsrecords.faqserv.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/?statsmywao.docx
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
cache-control: public, max-age=604800
expires: Thu, 02 May 2024 05:34:36 GMT
content-type: text/css
last-modified: Mon, 01 Apr 2024 12:54:13 GMT
accept-ranges: bytes
content-encoding: br
vary: Accept-Encoding,User-Agent
content-length: 21469
date: Thu, 25 Apr 2024 05:34:36 GMT
server: LiteSpeed
X-Firefox-Spdy: h2

customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/index_home/index_home/mdb.min.css

192.250.232.15

200 OK

27 kB

URL GET HTTP/2
customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/index_home/index_home/mdb.min.css
IP
192.250.232.15:443
ASN
#216180 WHG Hosting Services Ltd

Requested by
https://customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/?statsmywao.docx
Certificate
IssuerLet's Encrypt
Subjectwww.customerstatementsrecords.faqserv.com
Fingerprint71:DF:04:8A:B1:4F:D9:1B:E6:5D:8D:A3:B1:9B:FE:86:4B:FF:64:57
ValidityWed, 17 Apr 2024 20:38:12 GMT - Tue, 16 Jul 2024 20:38:11 GMT

File type
ASCII text, with very long lines (32440)
Size
27 kB (26551 bytes)
Hash
40d99398910a0413696286ff3e6b60be
29b2766ed62385457569fa8aa4154073fc3bafc4
290758a94e9508647e9cb8e95128a300970ad62225329f2ba395003303e3d5e2

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain

HTTP Headers

GET /invoicecustomer/invoicecustomer_id/index_home/index_home/mdb.min.css HTTP/1.1
Host: customerstatementsrecords.faqserv.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/?statsmywao.docx
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
cache-control: public, max-age=604800
expires: Thu, 02 May 2024 05:34:36 GMT
content-type: text/css
last-modified: Mon, 01 Apr 2024 12:54:13 GMT
accept-ranges: bytes
content-encoding: br
vary: Accept-Encoding,User-Agent
content-length: 26551
date: Thu, 25 Apr 2024 05:34:36 GMT
server: LiteSpeed
X-Firefox-Spdy: h2

customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/index_home/index_home/style.css

192.250.232.15

200 OK

0 B

URL GET HTTP/2
customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/index_home/index_home/style.css
IP
192.250.232.15:443
ASN
#216180 WHG Hosting Services Ltd

Requested by
https://customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/?statsmywao.docx
Certificate
IssuerLet's Encrypt
Subjectwww.customerstatementsrecords.faqserv.com
Fingerprint71:DF:04:8A:B1:4F:D9:1B:E6:5D:8D:A3:B1:9B:FE:86:4B:FF:64:57
ValidityWed, 17 Apr 2024 20:38:12 GMT - Tue, 16 Jul 2024 20:38:11 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain

HTTP Headers

GET /invoicecustomer/invoicecustomer_id/index_home/index_home/style.css HTTP/1.1
Host: customerstatementsrecords.faqserv.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/?statsmywao.docx
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
cache-control: public, max-age=604800
expires: Thu, 02 May 2024 05:34:36 GMT
content-type: text/css
last-modified: Mon, 01 Apr 2024 12:54:13 GMT
accept-ranges: bytes
content-length: 0
date: Thu, 25 Apr 2024 05:34:36 GMT
server: LiteSpeed
vary: User-Agent
X-Firefox-Spdy: h2

customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/index_home/index_home/home.css

192.250.232.15

200 OK

642 B

URL GET HTTP/2
customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/index_home/index_home/home.css
IP
192.250.232.15:443
ASN
#216180 WHG Hosting Services Ltd

Requested by
https://customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/?statsmywao.docx
Certificate
IssuerLet's Encrypt
Subjectwww.customerstatementsrecords.faqserv.com
Fingerprint71:DF:04:8A:B1:4F:D9:1B:E6:5D:8D:A3:B1:9B:FE:86:4B:FF:64:57
ValidityWed, 17 Apr 2024 20:38:12 GMT - Tue, 16 Jul 2024 20:38:11 GMT

File type
ASCII text, with very long lines (458), with CRLF line terminators
Size
642 B (642 bytes)
Hash
d84969352e14f7360454643330194516
b22d8c4b5bb1ce8fa484ca8d20e1c8a4726f21a9
917b5d6fe6d93f4fdc5d2f3c3315c1f3a913af16791aa5b045e428dda3dace02

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain

HTTP Headers

GET /invoicecustomer/invoicecustomer_id/index_home/index_home/home.css HTTP/1.1
Host: customerstatementsrecords.faqserv.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/?statsmywao.docx
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
cache-control: public, max-age=604800
expires: Thu, 02 May 2024 05:34:36 GMT
content-type: text/css
last-modified: Mon, 01 Apr 2024 12:54:13 GMT
accept-ranges: bytes
content-encoding: br
vary: Accept-Encoding,User-Agent
content-length: 642
date: Thu, 25 Apr 2024 05:34:36 GMT
server: LiteSpeed
X-Firefox-Spdy: h2

customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/index_home/index_home/webkit.css

192.250.232.15

200 OK

156 B

URL GET HTTP/2
customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/index_home/index_home/webkit.css
IP
192.250.232.15:443
ASN
#216180 WHG Hosting Services Ltd

Requested by
https://customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/?statsmywao.docx
Certificate
IssuerLet's Encrypt
Subjectwww.customerstatementsrecords.faqserv.com
Fingerprint71:DF:04:8A:B1:4F:D9:1B:E6:5D:8D:A3:B1:9B:FE:86:4B:FF:64:57
ValidityWed, 17 Apr 2024 20:38:12 GMT - Tue, 16 Jul 2024 20:38:11 GMT

File type
ASCII text, with CRLF line terminators
Size
156 B (156 bytes)
Hash
a13ae4a11e86c008550d86ca8509222a
fc5eb85f886c36afb1a6be923e5f23c951ffd16d
1845a031792801dc58524411817de7edc5828ebd0143faac8a039ed2aa88679c

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain

HTTP Headers

GET /invoicecustomer/invoicecustomer_id/index_home/index_home/webkit.css HTTP/1.1
Host: customerstatementsrecords.faqserv.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/?statsmywao.docx
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
cache-control: public, max-age=604800
expires: Thu, 02 May 2024 05:34:36 GMT
content-type: text/css
last-modified: Mon, 01 Apr 2024 12:54:13 GMT
accept-ranges: bytes
content-encoding: br
vary: Accept-Encoding,User-Agent
content-length: 156
date: Thu, 25 Apr 2024 05:34:36 GMT
server: LiteSpeed
X-Firefox-Spdy: h2

customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/index_home/index_home/u0q8xl66vqjltloq6jt.svg

192.250.232.15

200 OK

1.4 kB

URL GET HTTP/2
customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/index_home/index_home/u0q8xl66vqjltloq6jt.svg
IP
192.250.232.15:443
ASN
#216180 WHG Hosting Services Ltd

Requested by
https://customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/?statsmywao.docx
Certificate
IssuerLet's Encrypt
Subjectwww.customerstatementsrecords.faqserv.com
Fingerprint71:DF:04:8A:B1:4F:D9:1B:E6:5D:8D:A3:B1:9B:FE:86:4B:FF:64:57
ValidityWed, 17 Apr 2024 20:38:12 GMT - Tue, 16 Jul 2024 20:38:11 GMT

File type
SVG Scalable Vector Graphics image
Size
1.4 kB (1371 bytes)
Hash
54653c229922759d6c34bd65585eb33b
6b931071b05cbd72e1db43782083b108dee74251
4cd1f9e91b2c86d089c5546d150cc44bb9f9c95db85f36d2ad1e5330aaaa6069

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain

HTTP Headers

GET /invoicecustomer/invoicecustomer_id/index_home/index_home/u0q8xl66vqjltloq6jt.svg HTTP/1.1
Host: customerstatementsrecords.faqserv.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/?statsmywao.docx
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
cache-control: public, max-age=604800
expires: Thu, 02 May 2024 05:34:36 GMT
content-type: image/svg+xml
last-modified: Mon, 01 Apr 2024 12:54:13 GMT
accept-ranges: bytes
content-encoding: br
vary: Accept-Encoding,User-Agent
content-length: 1371
date: Thu, 25 Apr 2024 05:34:36 GMT
server: LiteSpeed
X-Firefox-Spdy: h2

customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/index_home/index_home/webkit.js

192.250.232.15

200 OK

269 B

URL GET HTTP/2
customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/index_home/index_home/webkit.js
IP
192.250.232.15:443
ASN
#216180 WHG Hosting Services Ltd

Requested by
https://customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/?statsmywao.docx
Certificate
IssuerLet's Encrypt
Subjectwww.customerstatementsrecords.faqserv.com
Fingerprint71:DF:04:8A:B1:4F:D9:1B:E6:5D:8D:A3:B1:9B:FE:86:4B:FF:64:57
ValidityWed, 17 Apr 2024 20:38:12 GMT - Tue, 16 Jul 2024 20:38:11 GMT

File type
ASCII text, with CRLF line terminators
Size
269 B (269 bytes)
Hash
17565fcdbcac67ad3c5212069f8bbc31
160142373489b5a618fb6191d6b89e4418d5e7b6
743f04ba1a2804495cf54f97df1a470a74b4235bc496f9c00fcf80f366a0ea9a

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain

HTTP Headers

GET /invoicecustomer/invoicecustomer_id/index_home/index_home/webkit.js HTTP/1.1
Host: customerstatementsrecords.faqserv.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/?statsmywao.docx
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
cache-control: public, max-age=604800
expires: Thu, 02 May 2024 05:34:36 GMT
content-type: application/javascript
last-modified: Mon, 01 Apr 2024 12:54:13 GMT
accept-ranges: bytes
content-encoding: br
vary: Accept-Encoding,User-Agent
content-length: 269
date: Thu, 25 Apr 2024 05:34:36 GMT
server: LiteSpeed
X-Firefox-Spdy: h2

customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/index_home/index_home/jquery.min.js

192.250.232.15

200 OK

30 kB

URL GET HTTP/2
customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/index_home/index_home/jquery.min.js
IP
192.250.232.15:443
ASN
#216180 WHG Hosting Services Ltd

Requested by
https://customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/?statsmywao.docx
Certificate
IssuerLet's Encrypt
Subjectwww.customerstatementsrecords.faqserv.com
Fingerprint71:DF:04:8A:B1:4F:D9:1B:E6:5D:8D:A3:B1:9B:FE:86:4B:FF:64:57
ValidityWed, 17 Apr 2024 20:38:12 GMT - Tue, 16 Jul 2024 20:38:11 GMT

File type
JavaScript source, ASCII text, with very long lines (65451)
Size
30 kB (30278 bytes)
Hash
12b69d0ae6c6f0c42942ae6da2896e84
d2cc8d43ce1c854b1172e42b1209502ad563db83
6150a35c0f486c46cadf0e230e2aa159c7c23ecfbb5611b64ee3f25fcbff341f

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain

HTTP Headers

GET /invoicecustomer/invoicecustomer_id/index_home/index_home/jquery.min.js HTTP/1.1
Host: customerstatementsrecords.faqserv.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/?statsmywao.docx
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
cache-control: public, max-age=604800
expires: Thu, 02 May 2024 05:34:36 GMT
content-type: application/javascript
last-modified: Mon, 01 Apr 2024 12:54:13 GMT
accept-ranges: bytes
content-encoding: br
vary: Accept-Encoding,User-Agent
content-length: 30278
date: Thu, 25 Apr 2024 05:34:36 GMT
server: LiteSpeed
X-Firefox-Spdy: h2

customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/index_home/index_home/bootstrap.min.js

192.250.232.15

200 OK

14 kB

URL GET HTTP/2
customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/index_home/index_home/bootstrap.min.js
IP
192.250.232.15:443
ASN
#216180 WHG Hosting Services Ltd

Requested by
https://customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/?statsmywao.docx
Certificate
IssuerLet's Encrypt
Subjectwww.customerstatementsrecords.faqserv.com
Fingerprint71:DF:04:8A:B1:4F:D9:1B:E6:5D:8D:A3:B1:9B:FE:86:4B:FF:64:57
ValidityWed, 17 Apr 2024 20:38:12 GMT - Tue, 16 Jul 2024 20:38:11 GMT

File type
JavaScript source, ASCII text, with very long lines (59893)
Size
14 kB (14242 bytes)
Hash
6bea60c34c5db6797150610dacdc6bce
544afefd148715da7dd52d368a414703390ca0e0
38544024da1a0fc2f706be6582557b5722d17f48ad9a8073594a0cf928e2e3ff

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain

HTTP Headers

GET /invoicecustomer/invoicecustomer_id/index_home/index_home/bootstrap.min.js HTTP/1.1
Host: customerstatementsrecords.faqserv.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/?statsmywao.docx
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
cache-control: public, max-age=604800
expires: Thu, 02 May 2024 05:34:36 GMT
content-type: application/javascript
last-modified: Mon, 01 Apr 2024 12:54:13 GMT
accept-ranges: bytes
content-encoding: br
vary: Accept-Encoding,User-Agent
content-length: 14242
date: Thu, 25 Apr 2024 05:34:36 GMT
server: LiteSpeed
X-Firefox-Spdy: h2

customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/index_home/index_home/bootstrap.js

192.250.232.15

200 OK

1.2 kB

URL GET HTTP/2
customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/index_home/index_home/bootstrap.js
IP
192.250.232.15:443
ASN
#216180 WHG Hosting Services Ltd

Requested by
https://customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/?statsmywao.docx
Certificate
IssuerLet's Encrypt
Subjectwww.customerstatementsrecords.faqserv.com
Fingerprint71:DF:04:8A:B1:4F:D9:1B:E6:5D:8D:A3:B1:9B:FE:86:4B:FF:64:57
ValidityWed, 17 Apr 2024 20:38:12 GMT - Tue, 16 Jul 2024 20:38:11 GMT

File type
JavaScript source, ASCII text, with CRLF line terminators
Size
1.2 kB (1196 bytes)
Hash
bba1b6ea907889270e7cf358d491867d
1e79ef3d5f5c18bb0474bbff7ea1719d9c6a8d88
2b42d3d42c11a502fbfdcd9f8e2d4f9ac55fe8c30d4a748f0342811694806564

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain

HTTP Headers

GET /invoicecustomer/invoicecustomer_id/index_home/index_home/bootstrap.js HTTP/1.1
Host: customerstatementsrecords.faqserv.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/?statsmywao.docx
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
cache-control: public, max-age=604800
expires: Thu, 02 May 2024 05:34:36 GMT
content-type: application/javascript
last-modified: Thu, 18 Apr 2024 07:04:12 GMT
accept-ranges: bytes
content-encoding: br
vary: Accept-Encoding,User-Agent
content-length: 1196
date: Thu, 25 Apr 2024 05:34:36 GMT
server: LiteSpeed
X-Firefox-Spdy: h2

customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/index_home/index_home/u085el65vqmleloq6jt.png

192.250.232.15

200 OK

66 kB

URL GET HTTP/3
customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/index_home/index_home/u085el65vqmleloq6jt.png
IP
192.250.232.15:443
ASN
#216180 WHG Hosting Services Ltd

Requested by
https://customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/?statsmywao.docx
Certificate
IssuerLet's Encrypt
Subjectwww.customerstatementsrecords.faqserv.com
Fingerprint71:DF:04:8A:B1:4F:D9:1B:E6:5D:8D:A3:B1:9B:FE:86:4B:FF:64:57
ValidityWed, 17 Apr 2024 20:38:12 GMT - Tue, 16 Jul 2024 20:38:11 GMT

File type
PNG image data, 1599 x 761, 8-bit/color RGB, non-interlaced
Size
66 kB (66190 bytes)
Hash
2815afb966da0792357da848f9b95e31
05ffeb4a2b94f774e0bf05b49964d696663c9500
e3199fac9b72f56632d6641fe65df6fe455e8a4b19138f08f2663638bb8defd1

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain

HTTP Headers

GET /invoicecustomer/invoicecustomer_id/index_home/index_home/u085el65vqmleloq6jt.png HTTP/1.1
Host: customerstatementsrecords.faqserv.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/index_home/index_home/home.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
cache-control: public, max-age=604800
expires: Thu, 02 May 2024 05:34:37 GMT
content-type: image/png
last-modified: Wed, 17 Apr 2024 20:37:20 GMT
accept-ranges: bytes
content-length: 66190
date: Thu, 25 Apr 2024 05:34:37 GMT
server: LiteSpeed
vary: User-Agent
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"

customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/index_home/index_home/u088xl66vqjleloq6jt.ico

192.250.232.15

200 OK

805 B

URL GET HTTP/3
customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/index_home/index_home/u088xl66vqjleloq6jt.ico
IP
192.250.232.15:443
ASN
#216180 WHG Hosting Services Ltd

Requested by
https://customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/?statsmywao.docx
Certificate
IssuerLet's Encrypt
Subjectwww.customerstatementsrecords.faqserv.com
Fingerprint71:DF:04:8A:B1:4F:D9:1B:E6:5D:8D:A3:B1:9B:FE:86:4B:FF:64:57
ValidityWed, 17 Apr 2024 20:38:12 GMT - Tue, 16 Jul 2024 20:38:11 GMT

File type
MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel
Size
805 B (805 bytes)
Hash
760f69985c44556f90d31cdb278286be
98632d39e3ca24fdd974ac98bf187963a065ce8a
4fbd8cc4075e1795215327af5e43e8ca3339677802700d19aefc57ba1713a12d

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain

HTTP Headers

GET /invoicecustomer/invoicecustomer_id/index_home/index_home/u088xl66vqjleloq6jt.ico HTTP/1.1
Host: customerstatementsrecords.faqserv.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://customerstatementsrecords.faqserv.com/invoicecustomer/invoicecustomer_id/?statsmywao.docx
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
cache-control: public, max-age=604800
expires: Thu, 02 May 2024 05:34:37 GMT
content-type: image/x-icon
last-modified: Mon, 01 Apr 2024 12:54:13 GMT
accept-ranges: bytes
content-encoding: br
vary: Accept-Encoding,User-Agent
content-length: 805
date: Thu, 25 Apr 2024 05:34:37 GMT
server: LiteSpeed

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (4)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (15)

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash