Report - water2go.com.au/wp-content/plugins/wp-headers-and-footers/classes

Report Overview

Visited public
2023-11-16 13:03:36
Tags
navy_federal_credit_union financial phishing
URL
water2go.com.au/wp-content/plugins/wp-headers-and-footers/classes
Finishing URL
water2go.com.au/wp-content/plugins/wp-headers-and-footers/classes/
IP / ASN
118.127.63.12
#45671 Wholesale Services Provider
Title
Navy Federal Credit Union - Our Members are the Mission®
Phishing - Navy Federal Credit Union

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
water2go.com.au	unknown	unknown	2018-01-10 10:33:30	2023-11-16 13:41:45	1.0 kB	2.9 MB	118.127.63.12
i.ibb.co	13485	2010-07-20	2018-11-25 11:13:48	2023-11-15 19:10:55	429 B	3.6 kB	162.19.58.161
l2.io	163527	2012-05-12	2015-06-25 03:31:26	2023-11-15 19:56:03	398 B	226 B	195.80.159.133

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-11-16 13:03:22	medium	Client IP	Internal IP	ET POLICY Observed IP Lookup Domain (l2 .io in DNS Lookup)
2023-11-16 13:03:22	medium	Client IP	Internal IP	ET POLICY Observed IP Lookup Domain (l2 .io in DNS Lookup)
2023-11-16 13:03:22	medium	Client IP	195.80.159.133	ET POLICY Observed IP Lookup Domain (l2 .io in TLS SNI)

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2023-11-16	medium	water2go.com.au/wp-content/plugins/wp-headers-and-footers/classes	Navy Federal Credit Union

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (14)

	URL	From	Size	First Seen	Last Seen
	unknown	ScriptElement	2.1 kB	2023-04-17	2024-10-11
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-17 07:53 Last Seen2024-10-11 09:16 Times Seen50 Hash 69ebccaa295ce7d0d6879a5b23b2f681 889f6cab4dedfbde2967ae71c7c8dab98ee9c893 534c6aa9f1f6733d048d061423f4bdc7ef0d7f688fc2484f711caaf4d2f4bcb0 Loading...

	unknown	ScriptElement	80 B	2023-04-17	2025-05-07
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-17 07:53 Last Seen2025-05-07 17:44 Times Seen172 Hash ae20ce6047b374cdb6b4ed5a2fff9dd2 78044e79d31970c24cfb093c84b46bedbc1514eb 4ae158d12e85ef975077cdd7fb3422da87336f2a84ab777113974d704b60a6ca Loading...

	water2go.com.au/wp-content/plugins/wp-headers-and-footers/classes/	ScriptElement	2.9 MB	2023-09-23	2024-08-21
Pretty URL water2go.com.au/wp-content/plugins/wp-headers-and-footers/classes/ IP 118.127.63.12 ASN #45671 Wholesale Services Provider Introduced by scriptElement Embedded in HTML true Observations First Seen2023-09-23 21:39 Last Seen2024-08-21 05:55 Times Seen23 Hash b94406d2affb2c2ecfc70c45741a9d75 537f857dbc0817e710b6dee87dbf24d886cc79a1 7a9bf90ade8f308c0df130a36dee0031dc77e2e3bd379a6f0bebd0e32280c3ed Loading...

	unknown	ScriptElement	851 B	2023-04-17	2024-10-11
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-17 07:53 Last Seen2024-10-11 09:16 Times Seen50 Hash 51b23d615f5079bbf4e617289cf779bf f9377defeef1870083fbded3f70b47e0a79bf9d4 2fa8cf2a0a8ba110e1ed9d119fcf29eaf67432ca67c72221e145daf1a5afc55b Loading...

	l2.io/ip.js?var=userip	ScriptElement	24 B	2023-03-07	2025-05-09
Pretty URL l2.io/ip.js?var=userip IP 195.80.159.133 ASN #29152 Decknet S.a.r.l. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02 Last Seen2025-05-09 07:36 Times Seen1137 Hash f9dc91b3feea65bd389a2f5b57306c32 147d1c9ae79ae948a34c5f1254bdcbf7af9caf8e d88923af30873abcf4cde709062c3d2e9ded181f9e2552c7fbcc983b3796ff77 Loading...

	unknown	ScriptElement	1.4 kB	2023-09-23	2024-08-21
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-09-23 21:38 Last Seen2024-08-21 05:55 Times Seen23 Hash bc20200a63b0a436a0354e0fd3380d53 4c81b64b7e228084b0e964deaccbfe01a32bbd28 133ec5cdc3d8609b3b34ab5f07f5d9a6b50517ecc5c0ad8b22059c59121e3caa Loading...

	unknown	ScriptElement	1.2 kB	2023-04-17	2024-10-11
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-17 07:53 Last Seen2024-10-11 09:16 Times Seen51 Hash bfc00918ec0700cac4af0096ef153f60 1b7ce355eaae26a67265362f659bf6d438288bfb b790fd96e5e2cf91a6d7d31847692fdb305ef67665afcffd7bf7de1a563baa1d Loading...

	unknown	ScriptElement	1.3 kB	2023-04-17	2024-10-11
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-17 07:53 Last Seen2024-10-11 09:16 Times Seen50 Hash 696f9b85ef2a33f6d320b7c5f5c04819 1097332992fac6dabcaf8c22851c030370f033f8 348a3bf5339383d8a9902fc56b5d42b80f884eaf9001f8fed3e2e12edc8ab09e Loading...

	unknown	ScriptElement	1.4 kB	2023-04-17	2024-10-11
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-17 07:53 Last Seen2024-10-11 09:16 Times Seen50 Hash ee1a15d651c782ed641a4c89d3fdc783 57970461dc07c1acdbe5af72dcb9f119dc5c6d0d 06eac38398fca4d6490e96202f65646c7778590ab60d87d830254dfe1a8f4087 Loading...

	unknown	ScriptElement	23 B	2023-04-17	2025-05-07
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-17 07:53 Last Seen2025-05-07 17:44 Times Seen172 Hash 7daf22e412582bd955abec238c735f24 6eea0cdb1040194e77d455024bb9cbfb5378016a 1263a3e1e1c19b2064d03506aba02ffc04f0d5747675d9e6404506a2a77da7a9 Loading...

	unknown	ScriptElement	1.9 kB	2023-04-17	2024-10-11
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-17 07:53 Last Seen2024-10-11 09:16 Times Seen50 Hash 6829a1a85f89a4f7dbc0a3958013e92c 2baf0eb5569a92924d1eea0b16a01972e5b52d13 7c418c0dc16171cb57a27f2c5c40e3d93a418d5dec3aee078c0e5582bad37a4b Loading...

	unknown	ScriptElement	402 B	2023-04-17	2024-10-11
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-17 07:53 Last Seen2024-10-11 09:16 Times Seen54 Hash 5b6c0c4609a11d1776fea4f76c6d1628 90d8a5ad34d5ab0e8e73fedd71032a629feddbcb 8e70efecfd3d8d39267663531a9ed569fe792aaf75b038fb085612eae89c0588 Loading...

	unknown	ScriptElement	1.1 kB	2023-04-17	2024-10-11
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-17 07:53 Last Seen2024-10-11 09:16 Times Seen50 Hash aad43213d45ffc9be47d3b118e5dd546 3dbe846d54507b6a14952e0fb3ae199c3c481d7d 5ce0a6153b221478a8021d82e2e0923fa6a0a6ad71c0c29afc8c3075e4bccc3f Loading...

		Size	First Seen	Last Seen
	#1 Write - 857a1aceb6405efc7c3a330686574139	952 kB	2023-09-23 21:39	2024-08-21 05:55
Pretty Observations First Seen2023-09-23 21:39 Last Seen2024-08-21 05:55 Times Seen22 Hash 857a1aceb6405efc7c3a330686574139 bebf076a871c97b8ce19f3ef2bd25a5b939ae54d bb76f1d504cd9457018e07ea335bd812da282546daf3b809b89a751930d4d7c8 Loading...

HTTP Transactions (4)

URL IP Response Size

water2go.com.au/wp-content/plugins/wp-headers-and-footers/classes

118.127.63.12

301 Moved Permanently

162 B

URL User Request GET HTTP/1.1
water2go.com.au/wp-content/plugins/wp-headers-and-footers/classes
IP
118.127.63.12:443
ASN
#45671 Wholesale Services Provider

Certificate
IssuerLet's Encrypt
Subjectwater2go.com.au
Fingerprint54:12:05:7E:01:67:C0:90:C3:10:AB:4A:88:9D:9F:92:C1:4E:1A:A1
ValidityMon, 30 Oct 2023 21:43:54 GMT - Sun, 28 Jan 2024 21:43:53 GMT

File type
HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Size
162 B (162 bytes)
Hash
4f8e702cc244ec5d4de32740c0ecbd97
3adb1f02d5b6054de0046e367c1d687b6cdf7aff
9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Navy Federal Credit Union
OpenPhish	phishing	Navy Federal Credit Union

HTTP Headers

GET /wp-content/plugins/wp-headers-and-footers/classes HTTP/1.1
Host: water2go.com.au
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Thu, 16 Nov 2023 13:03:18 GMT
Content-Type: text/html
Content-Length: 162
Location: https://water2go.com.au/wp-content/plugins/wp-headers-and-footers/classes/
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block

water2go.com.au/wp-content/plugins/wp-headers-and-footers/classes/

118.127.63.12

200 OK

2.9 MB

URL User Request GET HTTP/1.1
water2go.com.au/wp-content/plugins/wp-headers-and-footers/classes/
IP
118.127.63.12:443
ASN
#45671 Wholesale Services Provider

Certificate
IssuerLet's Encrypt
Subjectwater2go.com.au
Fingerprint54:12:05:7E:01:67:C0:90:C3:10:AB:4A:88:9D:9F:92:C1:4E:1A:A1
ValidityMon, 30 Oct 2023 21:43:54 GMT - Sun, 28 Jan 2024 21:43:53 GMT

File type
HTML document text\012- exported SGML document, ASCII text, with very long lines (65499)
Size
2.9 MB (2857455 bytes)
Hash
ff2898cfeee5fb80d6a40166f71f0862
2ee15435c704151c215538c923c38be49eebcf94
a1c7c6403248864e69235978782e86f5d4c4e3bb25510a913dcd1949fbfe0f32

HTTP Headers

GET /wp-content/plugins/wp-headers-and-footers/classes/ HTTP/1.1
Host: water2go.com.au
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Thu, 16 Nov 2023 13:03:19 GMT
Content-Type: text/html
Content-Length: 2857455
Last-Modified: Sun, 22 Oct 2023 22:48:08 GMT
Connection: keep-alive
ETag: "6535a6a8-2b99ef"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
Accept-Ranges: bytes

i.ibb.co/RpLNy4f/ajax-loader.gif

162.19.58.161

200 OK

3.2 kB

URL GET HTTP/2
i.ibb.co/RpLNy4f/ajax-loader.gif
IP
162.19.58.161:443
ASN
#16276 OVH SAS

Requested by
https://water2go.com.au/wp-content/plugins/wp-headers-and-footers/classes/
Certificate
IssuerLet's Encrypt
Subjectibb.co
FingerprintCC:72:96:95:90:7F:15:8E:AC:C5:40:3A:D2:6F:83:A3:DF:5E:72:56
ValidityMon, 09 Oct 2023 14:39:49 GMT - Sun, 07 Jan 2024 14:39:48 GMT

File type
GIF image data, version 89a, 32 x 32\012- data
Size
3.2 kB (3208 bytes)
Hash
be1cede97289c13920048f238fd37b85
313b867d11fc0dd6bc6ca47c334bbcf18956ca76
fd29b3b084cf11160bfc4e99d98a261f2b36bff29113b07367c5204563c5d355

HTTP Headers

GET /RpLNy4f/ajax-loader.gif HTTP/1.1
Host: i.ibb.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://water2go.com.au/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Thu, 16 Nov 2023 13:03:22 GMT
content-type: image/gif
content-length: 3208
last-modified: Tue, 02 Mar 2021 22:27:30 GMT
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000, public
access-control-allow-origin: *
access-control-allow-methods: GET, OPTIONS
accept-ranges: bytes
X-Firefox-Spdy: h2

l2.io/ip.js?var=userip

195.80.159.133

200 OK

24 B

URL GET HTTP/1.1
l2.io/ip.js?var=userip
IP
195.80.159.133:443
ASN
#29152 Decknet S.a.r.l.

Requested by
https://water2go.com.au/wp-content/plugins/wp-headers-and-footers/classes/
Certificate
IssuerLet's Encrypt
Subjectl2.io
Fingerprint65:49:ED:2D:E9:35:D9:26:3D:70:87:2B:4F:20:FF:14:56:55:52:B4
ValidityTue, 17 Oct 2023 07:33:55 GMT - Mon, 15 Jan 2024 07:33:54 GMT

File type
ASCII text, with no line terminators
Size
24 B (24 bytes)
Hash
f9dc91b3feea65bd389a2f5b57306c32
147d1c9ae79ae948a34c5f1254bdcbf7af9caf8e
d88923af30873abcf4cde709062c3d2e9ded181f9e2552c7fbcc983b3796ff77

HTTP Headers

GET /ip.js?var=userip HTTP/1.1
Host: l2.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://water2go.com.au/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Thu, 16 Nov 2023 13:03:23 GMT
Server: Apache/2.4.38 (Debian)
Content-Length: 24
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (14)

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Observations

Hash

HTTP Transactions (4)

URL User Request GET HTTP/1.1

IP

ASN

Certificate

File type

Size