Report - ezpass.com-engl.win/pay/

Report Overview

Visited public
2025-04-07 12:03:55
Tags
URL
ezpass.com-engl.win/pay/
Finishing URL
ezpass.com-engl.win/pay/
IP / ASN
172.67.142.208
#13335 CLOUDFLARENET
Title
E-ZPass® New York

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
ezpass.com-engl.win	unknown	2025-04-05	2025-04-07	2025-04-07	4.2 kB	3.0 MB	104.21.39.27

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2025-04-07	medium	com-engl.win	Sinkholed
2025-04-07	medium	com-engl.win	Sinkholed
2025-04-07	medium	com-engl.win	Sinkholed
2025-04-07	medium	com-engl.win	Sinkholed
2025-04-07	medium	com-engl.win	Sinkholed
2025-04-07	medium	com-engl.win	Sinkholed
2025-04-07	medium	com-engl.win	Sinkholed
2025-04-07	medium	com-engl.win	Sinkholed
2025-04-07	medium	com-engl.win	Sinkholed

ThreatFox

No alerts detected

JavaScript (4)

	URL	From	Size	First Seen	Last Seen
	ezpass.com-engl.win/pay/assets/fliceXIj.js	ScriptElement	36 kB	2025-03-29	2025-05-07
Pretty URL ezpass.com-engl.win/pay/assets/fliceXIj.js IP 104.21.39.27 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2025-03-29 09:18 Last Seen2025-05-07 22:31 Times Seen429 Hash 846fcd3733ef1d18da656035ac5b6c07 edee5ecfac40d3dd6f8186adbac6dbf54791dd0b fc7c1a6e0f7141e85a5b90a8f34cb2b8c0742aea25e9eab9c70ef88028bceecb Loading...

	ezpass.com-engl.win/pay/assets/DvLRPgr7.js	ScriptElement	811 kB	2025-03-29	2025-05-07
Pretty URL ezpass.com-engl.win/pay/assets/DvLRPgr7.js IP 104.21.39.27 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2025-03-29 09:18 Last Seen2025-05-07 22:31 Times Seen427 Hash 059321eba1d1e50c70080b6e7624354e 6a40bdac3195715e81e33896d34bfd5ad85bdf17 7b9b9117c9af8b4ebe7ee26d26acb07569f0b51e08cf15ee89367cdf67ace996 Loading...

	ezpass.com-engl.win/pay/	ScriptElement	314 B	2023-03-11	2025-05-13
Pretty URL ezpass.com-engl.win/pay/ IP 104.21.39.27 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-11 11:23 Last Seen2025-05-13 03:10 Times Seen3898 Hash cd7a34e714de94d5c29b8ac5acdde24b b722bccb435490630d97ef88cafeb02d92f70fd0 312ebfdc50a0e168cff60c206811b02e944263a7d9060c2685509dacfacd7f71 Loading...

	ezpass.com-engl.win/pay/	ScriptElement	84 B	2023-04-07	2025-05-13
Pretty URL ezpass.com-engl.win/pay/ IP 104.21.39.27 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-04-07 06:55 Last Seen2025-05-13 03:10 Times Seen12434 Hash 528dd01eb509d1fc3c68b48e165c9d77 8d702f33d869eb8c53cf75c17014f96385322395 b508dff20bdbd9138e31aa48c45bc501805e509d2fd4709b39c4a60cd5c6b43a Loading...

HTTP Transactions (9)

URL IP Response Size

wss://ezpass.com-engl.win/front/im/eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpZCI6MTYyOTl9.ETrAJEnD11Ru9O5hrjwRHggefA1QsAG8NgJk7O1tpdY

104.21.39.27

101

0 B

URL GET
wss://ezpass.com-engl.win/front/im/eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpZCI6MTYyOTl9.ETrAJEnD11Ru9O5hrjwRHggefA1QsAG8NgJk7O1tpdY
IP
104.21.39.27:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ezpass.com-engl.win/pay/
Certificate
IssuerGoogle Trust Services
Subjectcom-engl.win
Fingerprint60:CF:08:19:10:74:64:1E:F5:E1:E9:82:01:F0:D2:D3:66:A4:87:82
ValiditySat, 05 Apr 2025 11:27:05 GMT - Fri, 04 Jul 2025 12:24:15 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /front/im/eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpZCI6MTYyOTl9.ETrAJEnD11Ru9O5hrjwRHggefA1QsAG8NgJk7O1tpdY HTTP/1.1
Host: ezpass.com-engl.win
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: https://ezpass.com-engl.win
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: fsG7xci81EcyAQYwyA9PdQ==
DNT: 1
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 
Date: Mon, 07 Apr 2025 12:03:35 GMT
Connection: upgrade
Upgrade: websocket
Sec-WebSocket-Accept: 42epeguNdMKbflf5f6nNghmqLwI=
Sec-WebSocket-Extensions: permessage-deflate
cf-cache-status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8AsxQkN9OfhYKSUj1hK2ur6Q2dTne9aGA6aV2Ej24bAtPWKz1vPIs8RjeH6QIRPLog%2FvJ5KIfdDgblgpaq2ebuUnz5LRymktu19H7FzlPH6ItB1lE4OjsThpBYatnEupFq7lbOff"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 92c961f1bc4ffba4-AMS
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=19502&min_rtt=19465&rtt_var=4164&sent=5&recv=8&lost=0&retrans=0&sent_bytes=3116&recv_bytes=1260&delivery_rate=221576&cwnd=250&unsent_bytes=0&cid=fe71bfd7e467987c&ts=368&x=0"

ezpass.com-engl.win/pay/

104.21.39.27

200 OK

2.7 kB

URL User Request GET
ezpass.com-engl.win/pay/
IP
104.21.39.27:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerGoogle Trust Services
Subjectcom-engl.win
Fingerprint60:CF:08:19:10:74:64:1E:F5:E1:E9:82:01:F0:D2:D3:66:A4:87:82
ValiditySat, 05 Apr 2025 11:27:05 GMT - Fri, 04 Jul 2025 12:24:15 GMT

File type
HTML document, Unicode text, UTF-8 text, with very long lines (433)
Size
2.7 kB (2733 bytes)
Hash
f4f3d3688d5804d5d80073262c44f7fd
e80c289aaca9f3289c67b5f8eb6b16f7037cee65
b138195c934b1ee1fefc58ea1097fa4a1f3e3532353d324841ff819f2b11a7a1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /pay/ HTTP/1.1
Host: ezpass.com-engl.win
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Mon, 07 Apr 2025 12:03:33 GMT
content-type: text/html
server: cloudflare
vary: Accept-Encoding
cf-cache-status: DYNAMIC
content-encoding: br
cf-ray: 92c961e1aa2df5eb-AMS
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

ezpass.com-engl.win/front/checkIp?token=123

104.21.39.27

200 OK

225 B

URL GET
ezpass.com-engl.win/front/checkIp?token=123
IP
104.21.39.27:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ezpass.com-engl.win/pay/
Certificate
IssuerGoogle Trust Services
Subjectcom-engl.win
Fingerprint60:CF:08:19:10:74:64:1E:F5:E1:E9:82:01:F0:D2:D3:66:A4:87:82
ValiditySat, 05 Apr 2025 11:27:05 GMT - Fri, 04 Jul 2025 12:24:15 GMT

File type
JSON text data
Size
225 B (225 bytes)
Hash
34955dba0fc598103f0e72bcb410b409
1d3d0ebae69d2dfda41b2091e05445ad06ded52b
2bc0c961d14ed51c74ad9933a326a4b40e5533f8325c89100b1f1a81d6d0df87

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /front/checkIp?token=123 HTTP/1.1
Host: ezpass.com-engl.win
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://ezpass.com-engl.win/pay/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Mon, 07 Apr 2025 12:03:35 GMT
content-type: text/plain;charset=UTF-8
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2F2VFdcE6ufl9YfWh9ZPAtOx4WSYGhk11y%2Fq24ydL8Wvu2HQl06XeUYCU5%2FpFYtd9BGuCi%2FPNB5ddW7ipp%2Fy3ycfptYqXeb%2FwNtXN%2BI3t7QqEcKK4UKyTj68vibqVL7pFIWttQUl0"}],"group":"cf-nel","max_age":604800}
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
cf-cache-status: DYNAMIC
content-encoding: br
cf-ray: 92c961edbb2f6a67-HAM
server: cloudflare
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=21009&min_rtt=17817&rtt_var=8479&sent=24&recv=29&lost=0&retrans=0&sent_bytes=4374&recv_bytes=2511&delivery_rate=1490&cwnd=12000&unsent_bytes=0&cid=b1bfb2a15b0c427e&ts=1815&x=16"

ezpass.com-engl.win/pay/assets/BHcjXi3x.gif

104.21.39.27

200 OK

60 kB

URL GET
ezpass.com-engl.win/pay/assets/BHcjXi3x.gif
IP
104.21.39.27:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ezpass.com-engl.win/pay/
Certificate
IssuerGoogle Trust Services
Subjectcom-engl.win
Fingerprint60:CF:08:19:10:74:64:1E:F5:E1:E9:82:01:F0:D2:D3:66:A4:87:82
ValiditySat, 05 Apr 2025 11:27:05 GMT - Fri, 04 Jul 2025 12:24:15 GMT

File type
GIF image data, version 89a, 256 x 256
Size
60 kB (59994 bytes)
Hash
fadd89694f57f3d6143989b62b09b288
1c6d340af3c4b392538a96c9313136fb23087aa0
7515437df23c4af47700948c1650f0f9460da07e86a9447d33cfda1f36c91052

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /pay/assets/BHcjXi3x.gif HTTP/1.1
Host: ezpass.com-engl.win
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ezpass.com-engl.win/pay/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Mon, 07 Apr 2025 12:03:33 GMT
content-type: image/gif
server: cloudflare
vary: Accept-Encoding
content-encoding: gzip
cache-control: max-age=14400
cf-cache-status: EXPIRED
last-modified: Mon, 07 Apr 2025 12:03:33 GMT
cf-ray: 92c961e5ddc4f5eb-AMS
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

ezpass.com-engl.win/pay/assets/Vaqr03uz.gif

104.21.39.27

200 OK

217 kB

URL GET
ezpass.com-engl.win/pay/assets/Vaqr03uz.gif
IP
104.21.39.27:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ezpass.com-engl.win/pay/
Certificate
IssuerGoogle Trust Services
Subjectcom-engl.win
Fingerprint60:CF:08:19:10:74:64:1E:F5:E1:E9:82:01:F0:D2:D3:66:A4:87:82
ValiditySat, 05 Apr 2025 11:27:05 GMT - Fri, 04 Jul 2025 12:24:15 GMT

File type
PNG image data, 1491 x 471, 8-bit/color RGB, non-interlaced
Size
217 kB (217307 bytes)
Hash
5cff47ac1dcdc1c896b2d41f9ccbc504
2d23ce32086ed0a6a6e8e964f7640377648a2fa2
3fc7f6547de9ed2bcd69fced482867c0ecaf7b2764e6411230d9a7c0e1eb0dcc

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /pay/assets/Vaqr03uz.gif HTTP/1.1
Host: ezpass.com-engl.win
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ezpass.com-engl.win/pay/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Mon, 07 Apr 2025 12:03:35 GMT
content-type: image/gif
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DDv%2BFBh5hzVk8pfFCA09A9VCsnRBkH%2FS7VXFQpk3BSow1kheWpzXF4pyutPQPchVwPA5g8H18lKQ7R0N9dqyfZrk6cXECgjh5g1kQzv7URBUA%2Fzlknb4NYwubMnI1iaR6SenEVGj"}],"group":"cf-nel","max_age":604800}
vary: Accept-Encoding
content-encoding: gzip
cache-control: max-age=14400
cf-cache-status: MISS
last-modified: Mon, 07 Apr 2025 12:03:35 GMT
cf-ray: 92c961ef4b6d6a67-HAM
server: cloudflare
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=21009&min_rtt=17817&rtt_var=8479&sent=24&recv=29&lost=0&retrans=0&sent_bytes=4374&recv_bytes=2511&delivery_rate=1490&cwnd=12000&unsent_bytes=0&cid=b1bfb2a15b0c427e&ts=2062&x=16"

ezpass.com-engl.win/pay/favicon.ico

104.21.39.27

200 OK

0 B

URL GET
ezpass.com-engl.win/pay/favicon.ico
IP
104.21.39.27:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ezpass.com-engl.win/pay/
Certificate
IssuerGoogle Trust Services
Subjectcom-engl.win
Fingerprint60:CF:08:19:10:74:64:1E:F5:E1:E9:82:01:F0:D2:D3:66:A4:87:82
ValiditySat, 05 Apr 2025 11:27:05 GMT - Fri, 04 Jul 2025 12:24:15 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /pay/favicon.ico HTTP/1.1
Host: ezpass.com-engl.win
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ezpass.com-engl.win/pay/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Mon, 07 Apr 2025 12:03:35 GMT
content-type: image/vnd.microsoft.icon
content-length: 0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jOftXF1x9tpX94AC8rdPImMLFsUkvMss3WHrDXVfESbDNyLajuSpt6yBcqrOHVM2GmFYOfaEvD%2BNQSNwW7SiUhp2oQP5YwlH%2BjMgJqnzu3CF93CSmzNDm%2B89aHmxBRCQzPeotpfZ"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=14400
cf-cache-status: MISS
last-modified: Mon, 07 Apr 2025 12:03:35 GMT
cf-ray: 92c961f0db956a67-HAM
server: cloudflare
vary: Accept-Encoding
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=21009&min_rtt=17817&rtt_var=8479&sent=24&recv=29&lost=0&retrans=0&sent_bytes=4374&recv_bytes=2511&delivery_rate=1490&cwnd=12000&unsent_bytes=0&cid=b1bfb2a15b0c427e&ts=2317&x=16"

ezpass.com-engl.win/pay/assets/fliceXIj.js

104.21.39.27

200 OK

36 kB

URL GET
ezpass.com-engl.win/pay/assets/fliceXIj.js
IP
104.21.39.27:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ezpass.com-engl.win/pay/
Certificate
IssuerGoogle Trust Services
Subjectcom-engl.win
Fingerprint60:CF:08:19:10:74:64:1E:F5:E1:E9:82:01:F0:D2:D3:66:A4:87:82
ValiditySat, 05 Apr 2025 11:27:05 GMT - Fri, 04 Jul 2025 12:24:15 GMT

File type
JavaScript source, Unicode text, UTF-8 text, with very long lines (36441), with no line terminators
Size
36 kB (36442 bytes)
Hash
846fcd3733ef1d18da656035ac5b6c07
edee5ecfac40d3dd6f8186adbac6dbf54791dd0b
fc7c1a6e0f7141e85a5b90a8f34cb2b8c0742aea25e9eab9c70ef88028bceecb

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /pay/assets/fliceXIj.js HTTP/1.1
Host: ezpass.com-engl.win
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ezpass.com-engl.win/pay/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Mon, 07 Apr 2025 12:03:33 GMT
content-type: application/javascript
vary: Accept-Encoding
content-encoding: gzip
cache-control: max-age=14400
cf-cache-status: MISS
last-modified: Mon, 07 Apr 2025 12:03:33 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Qd2EgIa0ZQfEA9%2F6g6XCLPL%2BVl6nQU9ojXK19ssuLPktKO2SaujNDS0y2YL4wcIfKT373oBm%2FT4xcapY3xT0SpCDA7byATd8gP8LuQJy%2FAP%2BQFavi2bZMeLvUg9iGdsFQppJUQke"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 92c961e5cdbbf5eb-AMS
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=23682&min_rtt=19712&rtt_var=7772&sent=12&recv=18&lost=0&retrans=0&sent_bytes=4472&recv_bytes=1563&delivery_rate=219927&cwnd=258&unsent_bytes=0&cid=cd3b6dc6856a6936&ts=1049&x=0"
X-Firefox-Spdy: h2

ezpass.com-engl.win/pay/assets/DvLRPgr7.js

104.21.39.27

200 OK

811 kB

URL GET
ezpass.com-engl.win/pay/assets/DvLRPgr7.js
IP
104.21.39.27:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ezpass.com-engl.win/pay/
Certificate
IssuerGoogle Trust Services
Subjectcom-engl.win
Fingerprint60:CF:08:19:10:74:64:1E:F5:E1:E9:82:01:F0:D2:D3:66:A4:87:82
ValiditySat, 05 Apr 2025 11:27:05 GMT - Fri, 04 Jul 2025 12:24:15 GMT

File type
JavaScript source, Unicode text, UTF-8 text, with very long lines (54997)
Size
811 kB (811023 bytes)
Hash
059321eba1d1e50c70080b6e7624354e
6a40bdac3195715e81e33896d34bfd5ad85bdf17
7b9b9117c9af8b4ebe7ee26d26acb07569f0b51e08cf15ee89367cdf67ace996

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /pay/assets/DvLRPgr7.js HTTP/1.1
Host: ezpass.com-engl.win
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ezpass.com-engl.win/pay/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Mon, 07 Apr 2025 12:03:33 GMT
content-type: application/javascript
vary: Accept-Encoding
content-encoding: gzip
cache-control: max-age=14400
cf-cache-status: MISS
last-modified: Mon, 07 Apr 2025 12:03:33 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Cy0u2PKvWoZWlN1lzKH5IFe8cWTrL3MNFNUvdNpT0FI%2Bh2z%2BHzNhgL0BmXfXDsSPGISG0BJROwFZ58K4aw07I7TqPsC5rMxg1znwPNf9mMRAjaWgj8Ip2yyP1ErIgrKG9aTXSEXr"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 92c961e5cdbef5eb-AMS
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=20146&min_rtt=19639&rtt_var=761&sent=33&recv=35&lost=0&retrans=0&sent_bytes=31434&recv_bytes=1563&delivery_rate=866071&cwnd=258&unsent_bytes=0&cid=cd3b6dc6856a6936&ts=1181&x=0"
X-Firefox-Spdy: h2

ezpass.com-engl.win/pay/assets/vG6n00L4.css

104.21.39.27

200 OK

1.9 MB

URL GET
ezpass.com-engl.win/pay/assets/vG6n00L4.css
IP
104.21.39.27:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ezpass.com-engl.win/pay/
Certificate
IssuerGoogle Trust Services
Subjectcom-engl.win
Fingerprint60:CF:08:19:10:74:64:1E:F5:E1:E9:82:01:F0:D2:D3:66:A4:87:82
ValiditySat, 05 Apr 2025 11:27:05 GMT - Fri, 04 Jul 2025 12:24:15 GMT

File type
ASCII text, with very long lines (65536), with no line terminators
Size
1.9 MB (1903456 bytes)
Hash
8b343c8fea4a5371531a5f5e7b5c4c0a
03b128ddf0496f3533024ee11500ab7cd1abe1cc
f661dcd86f07630126854c77b9bf403609a7d14bcb58634ffdaa1101c11d4055

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /pay/assets/vG6n00L4.css HTTP/1.1
Host: ezpass.com-engl.win
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ezpass.com-engl.win/pay/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Mon, 07 Apr 2025 12:03:33 GMT
content-type: text/css
vary: Accept-Encoding
content-encoding: gzip
cache-control: max-age=14400
cf-cache-status: MISS
last-modified: Mon, 07 Apr 2025 12:03:33 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AGk2lDM3IFHrJ0wOqpsjIWkoPhw7PU98t5RH1rQGzrgLAhHYXVlL3lM9i2m3dnS62WcafaD%2F9%2FvZbJunhB%2BLqK%2FuI2iytvxN6UZOIwaIluAcqalZ8M1%2FVU1irAade5Hyg3AIUehi"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 92c961e5ddc1f5eb-AMS
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=20897&min_rtt=19639&rtt_var=2361&sent=21&recv=27&lost=0&retrans=0&sent_bytes=16280&recv_bytes=1563&delivery_rate=656557&cwnd=258&unsent_bytes=0&cid=cd3b6dc6856a6936&ts=1150&x=0"
X-Firefox-Spdy: h2

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

Quad9 DNS

ThreatFox

JavaScript (4)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (9)

URL GET

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL User Request GET

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers