Report - www.kickoff.com.pl/wp-includes/widgets/

Report Overview

Visited public
2023-11-17 15:05:34
Tags
navy_federal_credit_union financial phishing
URL
www.kickoff.com.pl/wp-includes/widgets/
Finishing URL
www.kickoff.com.pl/wp-includes/widgets/
IP / ASN
188.128.210.199
#12824 home.pl S.A.
Title
Navy Federal Credit Union - Our Members are the Mission®
Phishing - Navy Federal Credit Union

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
h.ocsp-certum.com	18523	2013-12-19	2017-01-30 05:57:06	2023-11-16 21:20:22	662 B	3.5 kB	23.36.79.17
i.ibb.co	13485	2010-07-20	2018-11-25 11:13:48	2023-11-16 19:32:48	432 B	3.6 kB	162.19.58.157
l2.io	163527	2012-05-12	2015-06-25 03:31:26	2023-11-17 06:44:05	401 B	226 B	195.80.159.133
www.kickoff.com.pl	unknown	2019-09-06	2022-03-08 12:13:33	2023-11-17 16:00:12	497 B	2.9 MB	188.128.210.199

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-11-17 15:05:18	medium	Client IP	Internal IP	ET POLICY Observed IP Lookup Domain (l2 .io in DNS Lookup)
2023-11-17 15:05:18	medium	Client IP	Internal IP	ET POLICY Observed IP Lookup Domain (l2 .io in DNS Lookup)
2023-11-17 15:05:22	medium	Client IP	195.80.159.133	ET POLICY Observed IP Lookup Domain (l2 .io in TLS SNI)

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2023-11-17	medium	www.kickoff.com.pl/wp-includes/widgets/	Navy Federal Credit Union

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (14)

	URL	From	Size	First Seen	Last Seen
	www.kickoff.com.pl/wp-includes/widgets/	ScriptElement	2.9 MB	2023-03-10	2024-08-21
Pretty URL www.kickoff.com.pl/wp-includes/widgets/ IP 188.128.210.199 ASN #12824 home.pl S.A. Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-10 19:34 Last Seen2024-08-21 08:48 Times Seen10 Hash eea4067e9683a3718e5c0ceac34ea031 1e45056177789780a1251dd6db3d431acdd21afc 82eb6489c9ae186b0d2e8d4506826c644339573ac75ef63be0743e8ddfa77fcc Loading...

	unknown	ScriptElement	852 B	2023-04-14	2025-05-08
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-14 09:29 Last Seen2025-05-08 14:10 Times Seen97 Hash 9dceb192be2a6a42f1c8cb970822a65a 080e262a6354da1b65f5323c29fb8631274d54d6 0163580798d4f0e81b04f46aa5f0834b2d77160c58b3f77b29764bd51a1ccc14 Loading...

	unknown	ScriptElement	1.2 kB	2023-04-14	2025-05-06
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-14 09:29 Last Seen2025-05-06 14:06 Times Seen31 Hash 982a7a809e74f20e0f21939763aa2681 e2da2e627fca4da8d2c8c1afaa5a7703b13b8291 5aff3f7cb0a49da2081b51067315bdbae6ee8bf86546d7525756d80ad034d211 Loading...

	unknown	ScriptElement	1.3 kB	2023-04-12	2025-05-06
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-12 19:11 Last Seen2025-05-06 14:06 Times Seen62 Hash 7c019014fef43b5f4417056535a30d31 32f40351374ee91e1adeb1921d2f2acbb467c02f b4269160576c450214b445c8ff835fb26921d4f6a4120eb04c9157ddac6b853f Loading...

	unknown	ScriptElement	1.9 kB	2023-04-12	2025-05-06
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-12 19:11 Last Seen2025-05-06 14:06 Times Seen65 Hash ee9e4a822f8b85bc8906362bbe98a8b3 5b9688ae6f30d94277474f02609b92f5341a54d3 b2e820470a68e0089be9d8a0d2c2d791bf72c4a6b6077d765e4b51fe417c8da0 Loading...

	unknown	ScriptElement	1.4 kB	2023-04-12	2025-05-06
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-12 19:11 Last Seen2025-05-06 14:06 Times Seen65 Hash 81c97ebd890afc77ff82d7c79beca854 cdf9e82fc2c184210c55dbdd09572ebfbb08667f b5f98fc6510547589808b6cc70d2ab8bf766369f84b01a9a9ded49682c5b9a64 Loading...

	unknown	ScriptElement	1.1 kB	2023-04-12	2025-05-06
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-12 19:11 Last Seen2025-05-06 14:06 Times Seen64 Hash 9f982fda3140f4c73c12676d7058ace6 ed11bc6b7f5186835b756793fa858945f342f65d 5a711c57c47a9bb18c5a97a48209489a5b36ccb51ce7b561c1a566ef819c99e6 Loading...

	unknown	ScriptElement	81 B	2023-04-14	2025-05-08
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-14 09:29 Last Seen2025-05-08 14:10 Times Seen96 Hash f1986f6e942b9fd4d8e5f427725aaedd db4e78df8e28bf7e35b5c0806da193bf0c1b90b3 af1b5f1a1313c08c5037a63f9a6748a32ee7309378345d7d509dc5ae907dbf8a Loading...

	unknown	ScriptElement	2.1 kB	2023-04-14	2025-05-08
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-14 09:29 Last Seen2025-05-08 14:10 Times Seen95 Hash c86ca5c0ee0957abc3ecf1ac2c16a7e4 acca8e74f96b6f4bf54d53150e73e79afa646aec 540b2d3244db065c3a48a0c20500211cb43fa366e49ba32de6b91972956a832d Loading...

	unknown	ScriptElement	1.4 kB	2023-08-14	2024-08-21
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-08-14 00:58 Last Seen2024-08-21 08:48 Times Seen10 Hash 05d4a06587d2d25d61d4e3aa273672b2 ecc1ecf1dcfa1b50a249d10dff0efcd4b00a515d d7b1764df91e25c36da25fb7f31404b2d26b025c2f24ca811e9ea62feeba14ed Loading...

	unknown	ScriptElement	403 B	2023-04-12	2025-05-08
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-12 19:11 Last Seen2025-05-08 14:10 Times Seen111 Hash 5d2648ad74b193d98207a4e83d9a1f94 b38359f3dbf1144fb8ffeb52beec983e05c7f3f4 f0688816dc29b83540a757623970914cd111d5cf62a13b952a19e0b7e0abef5c Loading...

	l2.io/ip.js?var=userip	ScriptElement	24 B	2023-03-07	2025-05-09
Pretty URL l2.io/ip.js?var=userip IP 195.80.159.133 ASN #29152 Decknet S.a.r.l. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02 Last Seen2025-05-09 07:36 Times Seen1137 Hash f9dc91b3feea65bd389a2f5b57306c32 147d1c9ae79ae948a34c5f1254bdcbf7af9caf8e d88923af30873abcf4cde709062c3d2e9ded181f9e2552c7fbcc983b3796ff77 Loading...

	unknown	ScriptElement	24 B	2023-04-14	2025-05-08
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-14 09:29 Last Seen2025-05-08 14:10 Times Seen99 Hash 91bd33e881a6688ae7da8750397dac52 6d0c0de1f8d985079283072f9513090acb05a8c1 5e3309457053ce2503865aba4d1ee7be808e44ba94032174834e53f4d34222b3 Loading...

		Size	First Seen	Last Seen
	#1 Write - 2fc4622ca280a2052018b98551005f0e	952 kB	2023-03-10 19:39	2024-08-21 08:48
Pretty Observations First Seen2023-03-10 19:39 Last Seen2024-08-21 08:48 Times Seen10 Hash 2fc4622ca280a2052018b98551005f0e ee2f7cd900a0e9cd2eb080d10b50b4b861e8deb8 4c3ab9690153dd455832ab39316b3da0ec2e36bb3a14f826d7ca0a2aa643e49a Loading...

HTTP Transactions (5)

URL IP Response Size

h.ocsp-certum.com/

23.36.79.17

1.5 kB

URL
h.ocsp-certum.com/
IP
23.36.79.17:0
ASN
#20940 Akamai International B.V.

File type
data
Size
1.5 kB (1490 bytes)
Hash
79b4b39738e67e38c9824353049315c5
22d9c7ab4379dcfb7cc06a92d83da03a574d22ec
362066cf38e1b4b2f2582c35307fb3a75df729a4315e972e187c3f8dc9a030ea

HTTP Headers

POST / HTTP/1.1
Host: h.ocsp-certum.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 1490
X-Cached: STALE
Strict-Transport-Security: max-age=63072000,includeSubDomains,preload
Cache-Control: max-age=895
Date: Fri, 17 Nov 2023 15:05:16 GMT
Connection: keep-alive
X-N: S

h.ocsp-certum.com/

23.36.79.10

1.5 kB

URL
h.ocsp-certum.com/
IP
23.36.79.10:0
ASN
#20940 Akamai International B.V.

File type
data
Size
1.5 kB (1490 bytes)
Hash
15475a4c217d41a5853e450911614a02
a82d2d341568fa7e74e2eff3680c9de288120f0e
cf2ad4ad71aebf83eaaef4d877bbb19ce0c01add45a0fdbcc893a1c066e04a42

HTTP Headers

POST / HTTP/1.1
Host: h.ocsp-certum.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 1490
X-Cached: HIT
Strict-Transport-Security: max-age=63072000,includeSubDomains,preload
Cache-Control: max-age=900
Date: Fri, 17 Nov 2023 15:05:17 GMT
Connection: keep-alive
X-N: S

i.ibb.co/RpLNy4f/ajax-loader.gif

162.19.58.157

200 OK

3.2 kB

URL GET HTTP/2
i.ibb.co/RpLNy4f/ajax-loader.gif
IP
162.19.58.157:443
ASN
#16276 OVH SAS

Requested by
https://www.kickoff.com.pl/wp-includes/widgets/
Certificate
IssuerLet's Encrypt
Subjectibb.co
FingerprintCC:72:96:95:90:7F:15:8E:AC:C5:40:3A:D2:6F:83:A3:DF:5E:72:56
ValidityMon, 09 Oct 2023 14:39:49 GMT - Sun, 07 Jan 2024 14:39:48 GMT

File type
GIF image data, version 89a, 32 x 32\012- data
Size
3.2 kB (3208 bytes)
Hash
be1cede97289c13920048f238fd37b85
313b867d11fc0dd6bc6ca47c334bbcf18956ca76
fd29b3b084cf11160bfc4e99d98a261f2b36bff29113b07367c5204563c5d355

HTTP Headers

GET /RpLNy4f/ajax-loader.gif HTTP/1.1
Host: i.ibb.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.kickoff.com.pl/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Fri, 17 Nov 2023 15:05:18 GMT
content-type: image/gif
content-length: 3208
last-modified: Tue, 02 Mar 2021 22:27:30 GMT
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000, public
access-control-allow-origin: *
access-control-allow-methods: GET, OPTIONS
accept-ranges: bytes
X-Firefox-Spdy: h2

l2.io/ip.js?var=userip

195.80.159.133

200 OK

24 B

URL GET HTTP/1.1
l2.io/ip.js?var=userip
IP
195.80.159.133:443
ASN
#29152 Decknet S.a.r.l.

Requested by
https://www.kickoff.com.pl/wp-includes/widgets/
Certificate
IssuerLet's Encrypt
Subjectl2.io
Fingerprint65:49:ED:2D:E9:35:D9:26:3D:70:87:2B:4F:20:FF:14:56:55:52:B4
ValidityTue, 17 Oct 2023 07:33:55 GMT - Mon, 15 Jan 2024 07:33:54 GMT

File type
ASCII text, with no line terminators
Size
24 B (24 bytes)
Hash
f9dc91b3feea65bd389a2f5b57306c32
147d1c9ae79ae948a34c5f1254bdcbf7af9caf8e
d88923af30873abcf4cde709062c3d2e9ded181f9e2552c7fbcc983b3796ff77

HTTP Headers

GET /ip.js?var=userip HTTP/1.1
Host: l2.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.kickoff.com.pl/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 17 Nov 2023 15:05:21 GMT
Server: Apache/2.4.38 (Debian)
Content-Length: 24
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

www.kickoff.com.pl/wp-includes/widgets/

188.128.210.199

200 OK

2.9 MB

URL User Request GET HTTP/2
www.kickoff.com.pl/wp-includes/widgets/
IP
188.128.210.199:443
ASN
#12824 home.pl S.A.

Certificate
Issuerhome.pl S.A.
Subjectkickoff.com.pl
Fingerprint18:0E:05:B2:05:87:53:D4:D1:84:BB:F5:1D:F1:09:09:A6:0C:8B:5D
ValiditySat, 08 Apr 2023 12:00:59 GMT - Sun, 07 Apr 2024 12:00:58 GMT

File type

Size
2.9 MB (2857472 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Navy Federal Credit Union

HTTP Headers

GET /wp-includes/widgets/ HTTP/1.1
Host: www.kickoff.com.pl
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 17 Nov 2023 15:05:16 GMT
content-type: text/html
last-modified: Wed, 15 Nov 2023 22:04:14 GMT
server: IdeaWebServer/5.3.0
alt-svc: h3-29=":443"
content-encoding: gzip
X-Firefox-Spdy: h2

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (14)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Observations

Hash

HTTP Transactions (5)

URL

IP

ASN

File type

Size

Hash