Report - xaw.bof.mybluehost.me/cc.php

Report Overview

Submitted URL
xaw.bof.mybluehost.me/cc.php
IP
162.241.219.203
ASN
#46606 UNIFIEDLAYER-AS-1
Submitted
2024-05-07 12:19:18
Access
public
Website Title
xaw.bof.mybluehost.me/cgi-sys/suspendedpage.cgi
Final URL
xaw.bof.mybluehost.me/cgi-sys/suspendedpage.cgi
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
8

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
bluehost-cdn.com	113054	2012-05-08	2012-12-10	2024-04-24	937 B	39 kB	52.52.57.238
fonts.gstatic.com	unknown	2008-02-11	2014-09-09	2024-05-07	1.1 kB	98 kB	216.58.207.227
xaw.bof.mybluehost.me	unknown	unknown	No data	No data	2.0 kB	2.4 kB	162.241.219.203
fonts.googleapis.com	8877	2005-01-25	2013-06-10	2024-05-07	462 B	2.7 kB	142.250.74.106

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2024-05-04	medium	xaw.bof.mybluehost.me/cc.php	PostNord
2024-05-04	medium	xaw.bof.mybluehost.me/	PostNord
2024-05-04	medium	xaw.bof.mybluehost.me/	PostNord
2024-05-04	medium	xaw.bof.mybluehost.me/	PostNord

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (0)

HTTP Transactions (9)

URL IP Response Size

xaw.bof.mybluehost.me/cc.php

162.241.219.203

302 Found

239 B

URL User Request GET HTTP/2
xaw.bof.mybluehost.me/cc.php
IP
162.241.219.203:443
ASN
#46606 UNIFIEDLAYER-AS-1

Certificate
IssuerLet's Encrypt
Subjectwebmail.xaw.bof.mybluehost.me
FingerprintB6:DB:76:5B:76:E0:59:65:95:41:F5:DA:77:C8:0C:23:DD:29:A9:62
ValidityFri, 26 Apr 2024 13:47:52 GMT - Thu, 25 Jul 2024 13:47:51 GMT

File type
HTML document, ASCII text
Size
239 B (239 bytes)
Hash
17ba91f70e68dd1769fb5badf0be2f05
3d96ae1292c4b95664a43e178599e045d82e0291
6e263476b32b92c8ca430f9bd01705f712bba04e0ec0e20ae92566db59d17ea7

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	PostNord

HTTP Headers

GET /cc.php HTTP/1.1
Host: xaw.bof.mybluehost.me
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
location: https://xaw.bof.mybluehost.me/cgi-sys/suspendedpage.cgi
content-length: 239
content-type: text/html; charset=iso-8859-1
date: Tue, 07 May 2024 12:18:53 GMT
server: Apache
X-Firefox-Spdy: h2

xaw.bof.mybluehost.me/cgi-sys/suspendedpage.cgi

162.241.219.203

200 OK

497 B

URL User Request GET HTTP/2
xaw.bof.mybluehost.me/cgi-sys/suspendedpage.cgi
IP
162.241.219.203:443
ASN
#46606 UNIFIEDLAYER-AS-1

Certificate
IssuerLet's Encrypt
Subjectwebmail.xaw.bof.mybluehost.me
FingerprintB6:DB:76:5B:76:E0:59:65:95:41:F5:DA:77:C8:0C:23:DD:29:A9:62
ValidityFri, 26 Apr 2024 13:47:52 GMT - Thu, 25 Jul 2024 13:47:51 GMT

File type
HTML document, Unicode text, UTF-8 text
Size
497 B (497 bytes)
Hash
998bed8bb5fb5a2207b8d94268d1e0b9
58f3f1208b7d8d2fd0298dd804ebab5d3d91b40c
4dd3d615813a715cd47725ce1afc19ba31787b11523081a307288a1aa0ad509c

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	PostNord

HTTP Headers

GET /cgi-sys/suspendedpage.cgi HTTP/1.1
Host: xaw.bof.mybluehost.me
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
vary: Accept-Encoding
content-encoding: gzip
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
content-length: 497
content-type: text/html
date: Tue, 07 May 2024 12:18:53 GMT
server: Apache
X-Firefox-Spdy: h2

fonts.googleapis.com/css2?family=Open+Sans:wght@300;400&display=swap

142.250.74.106

200 OK

2.1 kB

URL GET HTTP/2
fonts.googleapis.com/css2?family=Open+Sans:wght@300;400&display=swap
IP
142.250.74.106:443
ASN
#15169 GOOGLE

Requested by
https://xaw.bof.mybluehost.me/cgi-sys/suspendedpage.cgi
Certificate
IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
Fingerprint36:49:20:36:0C:4D:DA:55:65:64:23:0F:49:3E:FA:78:87:35:A3:79
ValidityTue, 16 Apr 2024 04:17:12 GMT - Tue, 09 Jul 2024 04:17:11 GMT

File type
gzip compressed data, max compression
Size
2.1 kB (2068 bytes)
Hash
b7e3d648e56b5c361d2239050e981ad3
7e18279fc15fc7ce00b483ec657ba6cb5b501948
18f3eece3254e1aa21b2c6b3850d540d378851c118e47ce16bab0a7583e65002

HTTP Headers

GET /css2?family=Open+Sans:wght@300;400&display=swap HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xaw.bof.mybluehost.me/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Tue, 07 May 2024 12:18:54 GMT
date: Tue, 07 May 2024 12:18:54 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

xaw.bof.mybluehost.me/favicon.ico

162.241.219.203

302 Found

239 B

URL GET HTTP/2
xaw.bof.mybluehost.me/favicon.ico
IP
162.241.219.203:443
ASN
#46606 UNIFIEDLAYER-AS-1

Requested by
https://xaw.bof.mybluehost.me/cgi-sys/suspendedpage.cgi
Certificate
IssuerLet's Encrypt
Subjectwebmail.xaw.bof.mybluehost.me
FingerprintB6:DB:76:5B:76:E0:59:65:95:41:F5:DA:77:C8:0C:23:DD:29:A9:62
ValidityFri, 26 Apr 2024 13:47:52 GMT - Thu, 25 Jul 2024 13:47:51 GMT

File type
HTML document, ASCII text
Size
239 B (239 bytes)
Hash
17ba91f70e68dd1769fb5badf0be2f05
3d96ae1292c4b95664a43e178599e045d82e0291
6e263476b32b92c8ca430f9bd01705f712bba04e0ec0e20ae92566db59d17ea7

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	PostNord

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: xaw.bof.mybluehost.me
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xaw.bof.mybluehost.me/cgi-sys/suspendedpage.cgi
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 302 Found
location: https://xaw.bof.mybluehost.me/cgi-sys/suspendedpage.cgi
content-length: 239
content-type: text/html; charset=iso-8859-1
date: Tue, 07 May 2024 12:18:54 GMT
server: Apache
X-Firefox-Spdy: h2

bluehost-cdn.com/media/user/suspended_account/_bh/suspended.css

52.52.57.238

200 OK

296 B

URL GET HTTP/2
bluehost-cdn.com/media/user/suspended_account/_bh/suspended.css
IP
52.52.57.238:443
ASN
#16509 AMAZON-02

Requested by
https://xaw.bof.mybluehost.me/cgi-sys/suspendedpage.cgi
Certificate
IssuerSectigo Limited
Subject*.bluehost-cdn.com
Fingerprint7D:CA:A6:C7:23:A9:C0:7F:DA:2F:44:7F:AE:9F:C8:41:E2:6F:FC:18
ValidityThu, 14 Sep 2023 00:00:00 GMT - Fri, 23 Aug 2024 23:59:59 GMT

File type
ASCII text
Size
296 B (296 bytes)
Hash
fcc0451fd57ae709762efcca96001902
d1b2f74c3cf5b11be47e6a780fdf640a25f245a8
62a3b1d143db0ea140983cdf2a54d4b87973aaf409b6b4c8370595c80ae5af9c

HTTP Headers

GET /media/user/suspended_account/_bh/suspended.css HTTP/1.1
Host: bluehost-cdn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xaw.bof.mybluehost.me/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: openresty
date: Tue, 07 May 2024 12:18:54 GMT
content-type: text/css
content-length: 296
last-modified: Tue, 30 Mar 2021 21:51:54 GMT
etag: "260-5bec801a6d280"
vary: Accept-Encoding
content-encoding: gzip
access-control-allow-origin: *
expires: Tue, 14 May 2024 12:18:54 GMT
cache-control: max-age=604800
x-proxy-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2

xaw.bof.mybluehost.me/cgi-sys/suspendedpage.cgi

162.241.219.203

200 OK

497 B

URL User Request GET HTTP/2
xaw.bof.mybluehost.me/cgi-sys/suspendedpage.cgi
IP
162.241.219.203:443
ASN
#46606 UNIFIEDLAYER-AS-1

Certificate
IssuerLet's Encrypt
Subjectwebmail.xaw.bof.mybluehost.me
FingerprintB6:DB:76:5B:76:E0:59:65:95:41:F5:DA:77:C8:0C:23:DD:29:A9:62
ValidityFri, 26 Apr 2024 13:47:52 GMT - Thu, 25 Jul 2024 13:47:51 GMT

File type
HTML document, Unicode text, UTF-8 text
Size
497 B (497 bytes)
Hash
998bed8bb5fb5a2207b8d94268d1e0b9
58f3f1208b7d8d2fd0298dd804ebab5d3d91b40c
4dd3d615813a715cd47725ce1afc19ba31787b11523081a307288a1aa0ad509c

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	PostNord

HTTP Headers

GET /cgi-sys/suspendedpage.cgi HTTP/1.1
Host: xaw.bof.mybluehost.me
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://xaw.bof.mybluehost.me/cgi-sys/suspendedpage.cgi
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
vary: Accept-Encoding
content-encoding: gzip
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
content-length: 497
content-type: text/html
date: Tue, 07 May 2024 12:18:54 GMT
server: Apache
X-Firefox-Spdy: h2

fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

216.58.207.227

200 OK

48 kB

URL GET HTTP/2
fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
IP
216.58.207.227:443
ASN
#15169 GOOGLE

Requested by
https://xaw.bof.mybluehost.me/cgi-sys/suspendedpage.cgi
Certificate
IssuerGoogle Trust Services LLC
Subject*.gstatic.com
Fingerprint15:DD:05:B3:2F:D8:E3:54:C9:B4:FA:E4:AC:01:ED:C8:E1:EA:A7:AD
ValidityTue, 16 Apr 2024 04:17:07 GMT - Tue, 09 Jul 2024 04:17:06 GMT

File type
Web Open Font Format (Version 2), TrueType, length 48236, version 1.0
Size
48 kB (48236 bytes)
Hash
015c126a3520c9a8f6a27979d0266e96
2acf956561d44434a6d84204670cf849d3215d5f
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa

HTTP Headers

GET /s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://xaw.bof.mybluehost.me
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 48236
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 02 May 2024 02:35:00 GMT
expires: Fri, 02 May 2025 02:35:00 GMT
cache-control: public, max-age=31536000
age: 467034
last-modified: Thu, 14 Dec 2023 02:08:40 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

bluehost-cdn.com/media/user/suspended_account/_bh/beback-soon.png

52.52.57.238

38 kB

URL GET
bluehost-cdn.com/media/user/suspended_account/_bh/beback-soon.png
IP
52.52.57.238:0
ASN
#16509 AMAZON-02

Requested by
https://xaw.bof.mybluehost.me/cgi-sys/suspendedpage.cgi
Certificate
IssuerSectigo Limited
Subject*.bluehost-cdn.com
Fingerprint7D:CA:A6:C7:23:A9:C0:7F:DA:2F:44:7F:AE:9F:C8:41:E2:6F:FC:18
ValidityThu, 14 Sep 2023 00:00:00 GMT - Fri, 23 Aug 2024 23:59:59 GMT

File type
PNG image data, 1430 x 982, 8-bit/color RGBA, non-interlaced
Size
38 kB (37982 bytes)
Hash
495826852ee860b53716aeedfcad9f75
6ff9eef566aa5bfe11749b37e16c1f24941633cc
a9119a330a2c1f636051fc96e31af730d7bd096d358d7ad1681ac3770630f4a8

HTTP Headers

GET /media/user/suspended_account/_bh/beback-soon.png HTTP/1.1
Host: bluehost-cdn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xaw.bof.mybluehost.me/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: openresty
date: Tue, 07 May 2024 12:18:54 GMT
content-type: image/png
content-length: 37982
last-modified: Tue, 30 Mar 2021 21:51:54 GMT
etag: "a8c1-5bec801b19bc5"
vary: Accept-Encoding
content-encoding: gzip
access-control-allow-origin: *
expires: Tue, 14 May 2024 12:18:54 GMT
cache-control: max-age=604800
x-proxy-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2

fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

216.58.207.227

200 OK

48 kB

URL GET HTTP/2
fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
IP
216.58.207.227:443
ASN
#15169 GOOGLE

Requested by
https://xaw.bof.mybluehost.me/cgi-sys/suspendedpage.cgi
Certificate
IssuerGoogle Trust Services LLC
Subject*.gstatic.com
Fingerprint15:DD:05:B3:2F:D8:E3:54:C9:B4:FA:E4:AC:01:ED:C8:E1:EA:A7:AD
ValidityTue, 16 Apr 2024 04:17:07 GMT - Tue, 09 Jul 2024 04:17:06 GMT

File type
Web Open Font Format (Version 2), TrueType, length 48236, version 1.0
Size
48 kB (48236 bytes)
Hash
015c126a3520c9a8f6a27979d0266e96
2acf956561d44434a6d84204670cf849d3215d5f
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa

HTTP Headers

GET /s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://xaw.bof.mybluehost.me
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 48236
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 02 May 2024 02:35:00 GMT
expires: Fri, 02 May 2025 02:35:00 GMT
cache-control: public, max-age=31536000
age: 467034
last-modified: Thu, 14 Dec 2023 02:08:40 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (0)

HTTP Transactions (9)

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash