Report - cedrictheartist.com/wp-includes/html-api/

Report Overview

Visited public
2023-11-16 13:48:50
Tags
navy_federal_credit_union financial phishing
URL
cedrictheartist.com/wp-includes/html-api/
Finishing URL
cedrictheartist.com/wp-includes/html-api/
IP / ASN
185.104.29.126
#206281 Stichting DIGI NL
Title
Navy Federal Credit Union - Our Members are the Mission®
Phishing - Navy Federal Credit Union

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
i.ibb.co	13485	2010-07-20	2018-11-25 11:13:48	2023-11-15 19:10:55	433 B	3.6 kB	162.19.58.159
l2.io	163527	2012-05-12	2015-06-25 03:31:26	2023-11-15 19:56:03	402 B	226 B	195.80.159.133
cedrictheartist.com	unknown	2021-06-07	2022-03-18 17:15:04	2023-10-21 04:34:05	499 B	2.9 MB	185.104.29.126

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-11-16 13:48:34	medium	Client IP	Internal IP	ET POLICY Observed IP Lookup Domain (l2 .io in DNS Lookup)
2023-11-16 13:48:34	medium	Client IP	Internal IP	ET POLICY Observed IP Lookup Domain (l2 .io in DNS Lookup)
2023-11-16 13:48:35	medium	Client IP	195.80.159.133	ET POLICY Observed IP Lookup Domain (l2 .io in TLS SNI)

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2023-11-16	medium	cedrictheartist.com/wp-includes/html-api/	Navy Federal Credit Union

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (14)

	URL	From	Size	First Seen	Last Seen
	unknown	ScriptElement	1.9 kB	2023-04-17	2024-10-11
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-17 07:53 Last Seen2024-10-11 09:16 Times Seen50 Hash 6829a1a85f89a4f7dbc0a3958013e92c 2baf0eb5569a92924d1eea0b16a01972e5b52d13 7c418c0dc16171cb57a27f2c5c40e3d93a418d5dec3aee078c0e5582bad37a4b Loading...

	unknown	ScriptElement	1.4 kB	2023-04-17	2024-10-11
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-17 07:53 Last Seen2024-10-11 09:16 Times Seen50 Hash ee1a15d651c782ed641a4c89d3fdc783 57970461dc07c1acdbe5af72dcb9f119dc5c6d0d 06eac38398fca4d6490e96202f65646c7778590ab60d87d830254dfe1a8f4087 Loading...

	unknown	ScriptElement	851 B	2023-04-17	2024-10-11
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-17 07:53 Last Seen2024-10-11 09:16 Times Seen50 Hash 51b23d615f5079bbf4e617289cf779bf f9377defeef1870083fbded3f70b47e0a79bf9d4 2fa8cf2a0a8ba110e1ed9d119fcf29eaf67432ca67c72221e145daf1a5afc55b Loading...

	unknown	ScriptElement	2.1 kB	2023-04-17	2024-10-11
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-17 07:53 Last Seen2024-10-11 09:16 Times Seen50 Hash 69ebccaa295ce7d0d6879a5b23b2f681 889f6cab4dedfbde2967ae71c7c8dab98ee9c893 534c6aa9f1f6733d048d061423f4bdc7ef0d7f688fc2484f711caaf4d2f4bcb0 Loading...

	l2.io/ip.js?var=userip	ScriptElement	24 B	2023-03-07	2025-05-09
Pretty URL l2.io/ip.js?var=userip IP 195.80.159.133 ASN #29152 Decknet S.a.r.l. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02 Last Seen2025-05-09 07:36 Times Seen1137 Hash f9dc91b3feea65bd389a2f5b57306c32 147d1c9ae79ae948a34c5f1254bdcbf7af9caf8e d88923af30873abcf4cde709062c3d2e9ded181f9e2552c7fbcc983b3796ff77 Loading...

	unknown	ScriptElement	23 B	2023-04-17	2025-05-07
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-17 07:53 Last Seen2025-05-07 17:44 Times Seen172 Hash 7daf22e412582bd955abec238c735f24 6eea0cdb1040194e77d455024bb9cbfb5378016a 1263a3e1e1c19b2064d03506aba02ffc04f0d5747675d9e6404506a2a77da7a9 Loading...

	unknown	ScriptElement	80 B	2023-04-17	2025-05-07
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-17 07:53 Last Seen2025-05-07 17:44 Times Seen172 Hash ae20ce6047b374cdb6b4ed5a2fff9dd2 78044e79d31970c24cfb093c84b46bedbc1514eb 4ae158d12e85ef975077cdd7fb3422da87336f2a84ab777113974d704b60a6ca Loading...

	cedrictheartist.com/wp-includes/html-api/	ScriptElement	2.9 MB	2023-09-23	2024-08-21
Pretty URL cedrictheartist.com/wp-includes/html-api/ IP 185.104.29.126 ASN #206281 Stichting DIGI NL Introduced by scriptElement Embedded in HTML true Observations First Seen2023-09-23 21:39 Last Seen2024-08-21 05:55 Times Seen23 Hash b94406d2affb2c2ecfc70c45741a9d75 537f857dbc0817e710b6dee87dbf24d886cc79a1 7a9bf90ade8f308c0df130a36dee0031dc77e2e3bd379a6f0bebd0e32280c3ed Loading...

	unknown	ScriptElement	1.4 kB	2023-09-23	2024-08-21
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-09-23 21:38 Last Seen2024-08-21 05:55 Times Seen23 Hash bc20200a63b0a436a0354e0fd3380d53 4c81b64b7e228084b0e964deaccbfe01a32bbd28 133ec5cdc3d8609b3b34ab5f07f5d9a6b50517ecc5c0ad8b22059c59121e3caa Loading...

	unknown	ScriptElement	1.2 kB	2023-04-17	2024-10-11
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-17 07:53 Last Seen2024-10-11 09:16 Times Seen51 Hash bfc00918ec0700cac4af0096ef153f60 1b7ce355eaae26a67265362f659bf6d438288bfb b790fd96e5e2cf91a6d7d31847692fdb305ef67665afcffd7bf7de1a563baa1d Loading...

	unknown	ScriptElement	1.3 kB	2023-04-17	2024-10-11
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-17 07:53 Last Seen2024-10-11 09:16 Times Seen50 Hash 696f9b85ef2a33f6d320b7c5f5c04819 1097332992fac6dabcaf8c22851c030370f033f8 348a3bf5339383d8a9902fc56b5d42b80f884eaf9001f8fed3e2e12edc8ab09e Loading...

	unknown	ScriptElement	402 B	2023-04-17	2024-10-11
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-17 07:53 Last Seen2024-10-11 09:16 Times Seen54 Hash 5b6c0c4609a11d1776fea4f76c6d1628 90d8a5ad34d5ab0e8e73fedd71032a629feddbcb 8e70efecfd3d8d39267663531a9ed569fe792aaf75b038fb085612eae89c0588 Loading...

	unknown	ScriptElement	1.1 kB	2023-04-17	2024-10-11
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-17 07:53 Last Seen2024-10-11 09:16 Times Seen50 Hash aad43213d45ffc9be47d3b118e5dd546 3dbe846d54507b6a14952e0fb3ae199c3c481d7d 5ce0a6153b221478a8021d82e2e0923fa6a0a6ad71c0c29afc8c3075e4bccc3f Loading...

		Size	First Seen	Last Seen
	#1 Write - 857a1aceb6405efc7c3a330686574139	952 kB	2023-09-23 21:39	2024-08-21 05:55
Pretty Observations First Seen2023-09-23 21:39 Last Seen2024-08-21 05:55 Times Seen22 Hash 857a1aceb6405efc7c3a330686574139 bebf076a871c97b8ce19f3ef2bd25a5b939ae54d bb76f1d504cd9457018e07ea335bd812da282546daf3b809b89a751930d4d7c8 Loading...

HTTP Transactions (3)

URL IP Response Size

i.ibb.co/RpLNy4f/ajax-loader.gif

162.19.58.159

200 OK

3.2 kB

URL GET HTTP/2
i.ibb.co/RpLNy4f/ajax-loader.gif
IP
162.19.58.159:443
ASN
#16276 OVH SAS

Requested by
https://cedrictheartist.com/wp-includes/html-api/
Certificate
IssuerLet's Encrypt
Subjectibb.co
FingerprintCC:72:96:95:90:7F:15:8E:AC:C5:40:3A:D2:6F:83:A3:DF:5E:72:56
ValidityMon, 09 Oct 2023 14:39:49 GMT - Sun, 07 Jan 2024 14:39:48 GMT

File type
GIF image data, version 89a, 32 x 32\012- data
Size
3.2 kB (3208 bytes)
Hash
be1cede97289c13920048f238fd37b85
313b867d11fc0dd6bc6ca47c334bbcf18956ca76
fd29b3b084cf11160bfc4e99d98a261f2b36bff29113b07367c5204563c5d355

HTTP Headers

GET /RpLNy4f/ajax-loader.gif HTTP/1.1
Host: i.ibb.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://cedrictheartist.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Thu, 16 Nov 2023 13:48:34 GMT
content-type: image/gif
content-length: 3208
last-modified: Tue, 02 Mar 2021 22:27:30 GMT
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000, public
access-control-allow-origin: *
access-control-allow-methods: GET, OPTIONS
accept-ranges: bytes
X-Firefox-Spdy: h2

l2.io/ip.js?var=userip

195.80.159.133

200 OK

24 B

URL GET HTTP/1.1
l2.io/ip.js?var=userip
IP
195.80.159.133:443
ASN
#29152 Decknet S.a.r.l.

Requested by
https://cedrictheartist.com/wp-includes/html-api/
Certificate
IssuerLet's Encrypt
Subjectl2.io
Fingerprint65:49:ED:2D:E9:35:D9:26:3D:70:87:2B:4F:20:FF:14:56:55:52:B4
ValidityTue, 17 Oct 2023 07:33:55 GMT - Mon, 15 Jan 2024 07:33:54 GMT

File type
ASCII text, with no line terminators
Size
24 B (24 bytes)
Hash
f9dc91b3feea65bd389a2f5b57306c32
147d1c9ae79ae948a34c5f1254bdcbf7af9caf8e
d88923af30873abcf4cde709062c3d2e9ded181f9e2552c7fbcc983b3796ff77

HTTP Headers

GET /ip.js?var=userip HTTP/1.1
Host: l2.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://cedrictheartist.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Thu, 16 Nov 2023 13:48:34 GMT
Server: Apache/2.4.38 (Debian)
Content-Length: 24
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

cedrictheartist.com/wp-includes/html-api/

185.104.29.126

200 OK

2.9 MB

URL User Request GET HTTP/2
cedrictheartist.com/wp-includes/html-api/
IP
185.104.29.126:443
ASN
#206281 Stichting DIGI NL

Certificate
IssuerLet's Encrypt
Subjectcedrictheartist.com
FingerprintC8:C4:1A:EB:0B:64:AF:9A:1C:E5:C1:16:83:FA:AE:DA:8D:41:FA:3B
ValidityThu, 16 Nov 2023 11:00:49 GMT - Wed, 14 Feb 2024 11:00:48 GMT

File type

Size
2.9 MB (2857459 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Navy Federal Credit Union

HTTP Headers

GET /wp-includes/html-api/ HTTP/1.1
Host: cedrictheartist.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 16 Nov 2023 13:48:33 GMT
server: Apache/2
last-modified: Thu, 19 Oct 2023 10:20:54 GMT
etag: "2b99f3-6080f1c6dc42b-gzip"
accept-ranges: bytes
vary: Accept-Encoding,User-Agent
content-encoding: gzip
content-type: text/html
X-Firefox-Spdy: h2

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (14)

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Observations

Hash

HTTP Transactions (3)

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type