Report - rhythmic-book-wide.prd.on-fleek.net/kdcxmhdgreyq10.html

Report Overview

Visited public
2025-04-12 16:25:57
Tags
URL
rhythmic-book-wide.prd.on-fleek.net/kdcxmhdgreyq10.html
Finishing URL
rhythmic-book-wide.prd.on-fleek.net/kdcxmhdgreyq10.html
IP / ASN
104.21.32.1
#13335 CLOUDFLARENET
Title
Webmail

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
rhythmic-book-wide.prd.on-fleek.net	unknown	unknown	No data	No data	511 B	164 kB	104.21.32.1
code.jquery.com	634	2005-12-10	2012-05-21	2025-04-09	481 B	86 kB	151.101.2.137
ik.imagekit.io	30045	2016-01-17	2017-04-02	2025-04-08	478 B	56 kB	18.165.122.13
fac.corp.fortinet.com	unknown	2001-02-16	2017-10-16	2025-04-08	506 B	609 B	208.91.114.103
alphatrade-options.com	unknown	2023-10-23	2020-08-05	2025-04-09	460 B	415 B	198.251.84.141

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2025-03-27	medium	rhythmic-book-wide.prd.on-fleek.net/kdcxmhdgreyq10.html	Webmail Providers

PhishTank

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (5)

	URL	From	Size	First Seen	Last Seen
	rhythmic-book-wide.prd.on-fleek.net/kdcxmhdgreyq10.html	Function	79 B	2023-04-11	2025-05-09
Pretty URL rhythmic-book-wide.prd.on-fleek.net/kdcxmhdgreyq10.html IP 104.21.32.1 ASN #13335 CLOUDFLARENET Introduced by Function Embedded in HTML false Observations First Seen2023-04-11 21:38 Last Seen2025-05-09 04:02 Times Seen112365 Hash aa049e2749b8531cb8f233c2f64fc2b2 b611a5a62c1813ae5b4763378b3a4a565556530a e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2 Loading...

	code.jquery.com/jquery-2.2.4.min.js	ScriptElement	86 kB	2023-03-07	2025-05-09
Pretty URL code.jquery.com/jquery-2.2.4.min.js IP 151.101.2.137 ASN #54113 FASTLY Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02 Last Seen2025-05-09 03:47 Times Seen173842 Hash 2f6b11a7e914718e0290410e85366fe9 69bb69e25ca7d5ef0935317584e6153f3fd9a88c 05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e Loading...

	rhythmic-book-wide.prd.on-fleek.net/kdcxmhdgreyq10.html	ScriptElement	348 B	2023-03-07	2025-05-07
Pretty URL rhythmic-book-wide.prd.on-fleek.net/kdcxmhdgreyq10.html IP 104.21.32.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:12 Last Seen2025-05-07 21:41 Times Seen8004 Hash 0a18dbfb856e33fcea42e5a8db3458d0 bf7f679ff888573c6855b41a5b19661badcebbfe 3b5e8e9c897749a5b1360d449e0e0df9c2d01ea87cca28c9d93282e6570ced72 Loading...

	rhythmic-book-wide.prd.on-fleek.net/kdcxmhdgreyq10.html	Function	37 B	2023-04-11	2025-05-09
Pretty URL rhythmic-book-wide.prd.on-fleek.net/kdcxmhdgreyq10.html IP 104.21.32.1 ASN #13335 CLOUDFLARENET Introduced by Function Embedded in HTML false Observations First Seen2023-04-11 21:31 Last Seen2025-05-09 04:02 Times Seen263282 Hash 29d0c84b9d1d8da446a6062c6a840ad9 6d6b3a6065667c7c50d92f3889c85ed65a9ad784 3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1 Loading...

	rhythmic-book-wide.prd.on-fleek.net/kdcxmhdgreyq10.html	ScriptElement	149 kB	2025-01-23	2025-05-04
Pretty URL rhythmic-book-wide.prd.on-fleek.net/kdcxmhdgreyq10.html IP 104.21.32.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2025-01-23 11:41 Last Seen2025-05-04 17:44 Times Seen6 Hash c10f46be25034181d44a456ba86118fa 104558b33c8e92f2d03cb4e8aa80ee48814da0a0 871587f3a77dafba333e4785fd4391a0c98804bde420d63ab43ae2c7e38320d7 Loading...

HTTP Transactions (5)

URL IP Response Size

alphatrade-options.com/git/rand/favicon.png

198.251.84.141

404 Not Found

0 B

URL GET
alphatrade-options.com/git/rand/favicon.png
IP
198.251.84.141:443
ASN
#53667 PONYNET

Requested by
https://rhythmic-book-wide.prd.on-fleek.net/kdcxmhdgreyq10.html
Certificate
IssuerLet's Encrypt
Subject*.alphatrade-options.com
Fingerprint74:0D:64:A7:3B:5A:19:10:4A:65:99:12:0C:06:B3:CF:12:8E:03:3B
ValidityThu, 20 Mar 2025 15:57:47 GMT - Wed, 18 Jun 2025 15:57:46 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /git/rand/favicon.png HTTP/1.1
Host: alphatrade-options.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://rhythmic-book-wide.prd.on-fleek.net/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 404 Not Found
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
pragma: no-cache
content-type: text/html
content-length: 1251
date: Sat, 12 Apr 2025 16:25:38 GMT
server: LiteSpeed
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
X-Firefox-Spdy: h2

rhythmic-book-wide.prd.on-fleek.net/kdcxmhdgreyq10.html

104.21.32.1

200 OK

163 kB

URL User Request GET
rhythmic-book-wide.prd.on-fleek.net/kdcxmhdgreyq10.html
IP
104.21.32.1:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerLet's Encrypt
Subjecton-fleek.net
FingerprintDB:B2:3D:59:2B:C2:74:26:10:19:00:FD:3D:B3:7F:47:36:C9:9C:83
ValiditySun, 23 Mar 2025 14:26:54 GMT - Sat, 21 Jun 2025 14:26:53 GMT

File type
HTML document, ASCII text, with very long lines (52134), with CRLF line terminators
Size
163 kB (162718 bytes)
Hash
97991c06f398f7e7a5be0df3f2e7b5e2
22514964c9d010329f9c70d8f3509779e5fdc78c
c97d0f0616be51702981705f5003b9c77f1316157f03dc3258f70d94af91fe8a

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Webmail Providers

HTTP Headers

GET /kdcxmhdgreyq10.html HTTP/1.1
Host: rhythmic-book-wide.prd.on-fleek.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sat, 12 Apr 2025 16:25:36 GMT
content-type: text/html
cf-ray: 92f414a15b4156a8-OSL
cf-cache-status: HIT
access-control-allow-origin: *
age: 326019
cache-control: max-age=60, stale-while-revalidate=3600
last-modified: Tue, 08 Apr 2025 21:51:57 GMT
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
access-control-allow-headers: Content-Type, Range, User-Agent, X-Requested-With
access-control-allow-methods: GET,HEAD,OPTIONS
access-control-expose-headers: Content-Length, Content-Range, X-Chunked-Output, X-Ipfs-Path, X-Ipfs-Roots, X-Stream-Output
access-control-max-age: 86400
content-security-policy: upgrade-insecure-requests
referrer-policy: strict-origin-when-cross-origin
x-cache-status: MISS
x-content-type-options: nosniff
x-ipfs-path: /ipfs/bafybeibpcrxucq2dvdqbacmeneulwkjpkna7fzjn7jsgaexokgnfkw24zm/kdcxmhdgreyq10.html/
x-ipfs-roots: bafybeibpcrxucq2dvdqbacmeneulwkjpkna7fzjn7jsgaexokgnfkw24zm,bafkreigjpuhqmfv6kfyctalql5iahoohp4jrmfl7apodewhxbwkk7ep6ri
x-request-id: 5e93e79ce4df8609499a19bdbc321242
x-xss-protection: 0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NWPSpblg%2FsY3Ny%2FlNtKd9k7ywBIHy6nGV1BsNB2wf1O8Stss7OL7nAbx9omk9wvAjcI%2Flr%2FoC%2FCH9p4W4g%2FKZrqipenFpguqhnpPYLxtVde05XOKYrYk2CDYa%2BAH7SFM2uMo%2FLawA3Y6f5FJZOraCaHvGBzwcg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=5584&min_rtt=509&rtt_var=10217&sent=7&recv=10&lost=0&retrans=0&sent_bytes=2959&recv_bytes=1294&delivery_rate=5045296&cwnd=253&unsent_bytes=0&cid=9dcf9819077f786e&ts=586&x=0"
X-Firefox-Spdy: h2

code.jquery.com/jquery-2.2.4.min.js

151.101.2.137

200 OK

86 kB

URL GET
code.jquery.com/jquery-2.2.4.min.js
IP
151.101.2.137:443
ASN
#54113 FASTLY

Requested by
https://rhythmic-book-wide.prd.on-fleek.net/kdcxmhdgreyq10.html
Certificate
IssuerSectigo Limited
Subject*.jquery.com
FingerprintCD:B5:6E:05:85:0C:5A:AE:47:12:80:2A:5B:C6:E5:8F:11:72:E2:B5
ValidityTue, 25 Jun 2024 00:00:00 GMT - Wed, 25 Jun 2025 23:59:59 GMT

File type
JavaScript source, ASCII text, with very long lines (32065)
Size
86 kB (85578 bytes)
Hash
2f6b11a7e914718e0290410e85366fe9
69bb69e25ca7d5ef0935317584e6153f3fd9a88c
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

HTTP Headers

GET /jquery-2.2.4.min.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://rhythmic-book-wide.prd.on-fleek.net/
Origin: https://rhythmic-book-wide.prd.on-fleek.net
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: W/"28feccc0-14e4a"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Sat, 12 Apr 2025 16:25:37 GMT
age: 3400241
x-served-by: cache-lga21935-LGA, cache-hel1410030-HEL
x-cache: HIT, HIT
x-cache-hits: 37, 303826
x-timer: S1744475137.444274,VS0,VE0
vary: Accept-Encoding
content-length: 29811
X-Firefox-Spdy: h2

ik.imagekit.io/escrowmade/Rolling-1s-200px__1__trHCWXy9jD.gif

18.165.122.13

200 OK

55 kB

URL GET
ik.imagekit.io/escrowmade/Rolling-1s-200px__1__trHCWXy9jD.gif
IP
18.165.122.13:443
ASN
#16509 AMAZON-02

Requested by
https://rhythmic-book-wide.prd.on-fleek.net/kdcxmhdgreyq10.html
Certificate
IssuerAmazon
Subject*.imagekit.io
Fingerprint61:BF:F1:A1:C3:63:69:98:40:72:23:FE:9D:C6:A8:42:2E:10:3F:B0
ValiditySun, 22 Dec 2024 00:00:00 GMT - Tue, 20 Jan 2026 23:59:59 GMT

File type
GIF image data, version 89a, 200 x 200
Size
55 kB (55202 bytes)
Hash
d536d58ea2f4cfe5d5b734e7893fb09e
77c5e9fcbb33eb9b6df808aa86f50e0542e5162f
669c17cde38dd0ab9673de77a674c5b192e934399bbee3ebed65bd70b05bff5f

HTTP Headers

GET /escrowmade/Rolling-1s-200px__1__trHCWXy9jD.gif HTTP/1.1
Host: ik.imagekit.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://rhythmic-book-wide.prd.on-fleek.net/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: image/gif
content-length: 55202
access-control-allow-origin: *
access-control-allow-methods: GET
access-control-allow-headers: *
timing-allow-origin: *
x-server: ImageKit.io
x-request-id: 1dc702ea-845d-4b2e-8c6c-bdf5d311c497
cache-control: public, s-maxage=31536000, max-age=31536000, must-revalidate
etag: "d536d58ea2f4cfe5d5b734e7893fb09e"
last-modified: Wed, 01 Jan 2025 22:34:19 GMT
date: Thu, 27 Mar 2025 19:11:35 GMT
via: 1.1 dd09b3b5f5b8dc626e1ba6804a73af40.cloudfront.net (CloudFront), 1.1 c177d74e7453ab98353e6f69d3a557c0.cloudfront.net (CloudFront)
vary: Accept
x-cache: Hit from cloudfront
x-amz-cf-pop: HEL51-P2
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: 635HAQnB9DYd3hVk5eGFGB5GFKSEjE1BWam7tu5pgdou2h9hhJFKuA==
age: 1372442
X-Firefox-Spdy: h2

fac.corp.fortinet.com/customviews/image/password_hidden:93edf7d3ceb704be92ee084ecc62c6c8/

208.91.114.103

404 Not Found

0 B

URL GET
fac.corp.fortinet.com/customviews/image/password_hidden:93edf7d3ceb704be92ee084ecc62c6c8/
IP
208.91.114.103:443
ASN
#40934 FORTINET

Requested by
https://rhythmic-book-wide.prd.on-fleek.net/kdcxmhdgreyq10.html
Certificate
IssuerDigiCert Inc
Subjectfac.corp.fortinet.com
FingerprintF2:04:8D:F5:6F:6E:EE:68:A1:8A:98:5C:48:DA:BF:A2:40:00:8F:5D
ValidityMon, 10 Feb 2025 00:00:00 GMT - Mon, 09 Feb 2026 23:59:59 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /customviews/image/password_hidden:93edf7d3ceb704be92ee084ecc62c6c8/ HTTP/1.1
Host: fac.corp.fortinet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://rhythmic-book-wide.prd.on-fleek.net/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
Date: Sat, 12 Apr 2025 16:25:38 GMT
Content-Length: 1268
Content-Security-Policy: base-uri 'self'; script-src 'self'; default-src 'self'; style-src 'self' 'unsafe-inline'; object-src 'none'
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Content-Language: en
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Content-Encoding: gzip
Cache-Control: public, max-age=31536000
X-XSS-Protection: 1; mode=block
Permissions-Policy: fullscreen=(self)
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

Quad9 DNS

ThreatFox

JavaScript (5)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (5)

URL GET

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL User Request GET

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET

IP

ASN

Requested by

Certificate